Commit garburator patch in my tree, to prepare for merging from Taras' tree.
authorbenjamin@smedbergs.us
Mon, 05 Nov 2007 12:46:48 -0500
changeset 41 4b448285bafe09958286196a7b4528ee124462a4
parent 40 1e07e3686c5e6cf7741475bb65b51eff10eac94d
child 47 2be8f5496cb0bff6d9d3eee2fcfd2da11bfeb587
push id1
push userbsmedberg@mozilla.com
push dateTue, 15 Apr 2008 21:51:22 +0000
Commit garburator patch in my tree, to prepare for merging from Taras' tree.
automatic-garburator.patch
fix-garburator.patch
series
new file mode 100644
--- /dev/null
+++ b/automatic-garburator.patch
@@ -0,0 +1,158746 @@
+diff --git a/accessible/src/atk/nsAccessibleWrap.cpp b/accessible/src/atk/nsAccessibleWrap.cpp
+--- a/accessible/src/atk/nsAccessibleWrap.cpp
++++ b/accessible/src/atk/nsAccessibleWrap.cpp
+@@ -428,74 +428,74 @@ nsAccessibleWrap::CreateMaiInterfaces(vo
+     }
+ 
+     //nsIAccessibleText
+-    nsCOMPtr<nsIAccessibleText> accessInterfaceText;
++    nsIAccessibleText* accessInterfaceText;
+     QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                   getter_AddRefs(accessInterfaceText));
++                   (void**)&accessInterfaceText);
+     if (accessInterfaceText) {
+         interfacesBits |= 1 << MAI_INTERFACE_TEXT;
+     }
+ 
+     //nsIAccessibleEditableText
+-    nsCOMPtr<nsIAccessibleEditableText> accessInterfaceEditableText;
++    nsIAccessibleEditableText* accessInterfaceEditableText;
+     QueryInterface(NS_GET_IID(nsIAccessibleEditableText),
+-                   getter_AddRefs(accessInterfaceEditableText));
++                   (void**)&accessInterfaceEditableText);
+     if (accessInterfaceEditableText) {
+         interfacesBits |= 1 << MAI_INTERFACE_EDITABLE_TEXT;
+     }
+ 
+     //nsIAccessibleValue
+-    nsCOMPtr<nsIAccessibleValue> accessInterfaceValue;
++    nsIAccessibleValue* accessInterfaceValue;
+     QueryInterface(NS_GET_IID(nsIAccessibleValue),
+-                   getter_AddRefs(accessInterfaceValue));
++                   (void**)&accessInterfaceValue);
+     if (accessInterfaceValue) {
+        interfacesBits |= 1 << MAI_INTERFACE_VALUE; 
+     }
+ 
+     //nsIAccessibleDocument
+-    nsCOMPtr<nsIAccessibleDocument> accessInterfaceDocument;
++    nsIAccessibleDocument* accessInterfaceDocument;
+     QueryInterface(NS_GET_IID(nsIAccessibleDocument),
+-                              getter_AddRefs(accessInterfaceDocument));
++                              (void**)&accessInterfaceDocument);
+     if (accessInterfaceDocument) {
+         interfacesBits |= 1 << MAI_INTERFACE_DOCUMENT;
+     }
+ 
+     //nsIAccessibleImage
+-    nsCOMPtr<nsIAccessibleImage> accessInterfaceImage;
++    nsIAccessibleImage* accessInterfaceImage;
+     QueryInterface(NS_GET_IID(nsIAccessibleImage),
+-                              getter_AddRefs(accessInterfaceImage));
++                              (void**)&accessInterfaceImage);
+     if (accessInterfaceImage) {
+         interfacesBits |= 1 << MAI_INTERFACE_IMAGE;
+     }
+ 
+     //nsIAccessibleHyperLink
+-    nsCOMPtr<nsIAccessibleHyperLink> accessInterfaceHyperlink;
++    nsIAccessibleHyperLink* accessInterfaceHyperlink;
+     QueryInterface(NS_GET_IID(nsIAccessibleHyperLink),
+-                   getter_AddRefs(accessInterfaceHyperlink));
++                   (void**)&accessInterfaceHyperlink);
+     if (accessInterfaceHyperlink) {
+        interfacesBits |= 1 << MAI_INTERFACE_HYPERLINK_IMPL;
+     }
+ 
+     if (!MustPrune(this)) {  // These interfaces require children
+       //nsIAccessibleHypertext
+-      nsCOMPtr<nsIAccessibleHyperText> accessInterfaceHypertext;
++      nsIAccessibleHyperText* accessInterfaceHypertext;
+       QueryInterface(NS_GET_IID(nsIAccessibleHyperText),
+-                     getter_AddRefs(accessInterfaceHypertext));
++                     (void**)&accessInterfaceHypertext);
+       if (accessInterfaceHypertext) {
+           interfacesBits |= 1 << MAI_INTERFACE_HYPERTEXT;
+       }
+ 
+       //nsIAccessibleTable
+-      nsCOMPtr<nsIAccessibleTable> accessInterfaceTable;
++      nsIAccessibleTable* accessInterfaceTable;
+       QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                     getter_AddRefs(accessInterfaceTable));
++                     (void**)&accessInterfaceTable);
+       if (accessInterfaceTable) {
+           interfacesBits |= 1 << MAI_INTERFACE_TABLE;
+       }
+       
+       //nsIAccessibleSelection
+-      nsCOMPtr<nsIAccessibleSelectable> accessInterfaceSelection;
++      nsIAccessibleSelectable* accessInterfaceSelection;
+       QueryInterface(NS_GET_IID(nsIAccessibleSelectable),
+-                     getter_AddRefs(accessInterfaceSelection));
++                     (void**)&accessInterfaceSelection);
+       if (accessInterfaceSelection) {
+           interfacesBits |= 1 << MAI_INTERFACE_SELECTION;
+       }
+@@ -788,8 +788,8 @@ GetAttributeSet(nsIAccessible* aAccessib
+ GetAttributeSet(nsIAccessible* aAccessible)
+ {
+     AtkAttributeSet *objAttributeSet = nsnull;
+-    nsCOMPtr<nsIPersistentProperties> attributes;
+-    aAccessible->GetAttributes(getter_AddRefs(attributes));
++    nsIPersistentProperties* attributes;
++    aAccessible->GetAttributes(&attributes);
+     
+     if (attributes) {
+         // Deal with attributes that we only need to expose in ATK
+@@ -808,15 +808,15 @@ GetAttributeSet(nsIAccessible* aAccessib
+                                         oldValueUnused);
+         }
+ 
+-        nsCOMPtr<nsISimpleEnumerator> propEnum;
+-        nsresult rv = attributes->Enumerate(getter_AddRefs(propEnum));
++        nsISimpleEnumerator* propEnum;
++        nsresult rv = attributes->Enumerate(&propEnum);
+         NS_ENSURE_SUCCESS(rv, nsnull);
+ 
+         PRBool hasMore;
+         while (NS_SUCCEEDED(propEnum->HasMoreElements(&hasMore)) && hasMore) {
+-            nsCOMPtr<nsISupports> sup;
+-            rv = propEnum->GetNext(getter_AddRefs(sup));
+-            nsCOMPtr<nsIPropertyElement> propElem(do_QueryInterface(sup));
++            nsISupports* sup;
++            rv = propEnum->GetNext(&sup);
++            nsIPropertyElement* propElem(do_QueryInterface(sup));
+             NS_ENSURE_TRUE(propElem, nsnull);
+ 
+             nsCAutoString name;
+@@ -854,8 +854,8 @@ getParentCB(AtkObject *aAtkObj)
+             return nsnull;
+         }
+ 
+-        nsCOMPtr<nsIAccessible> accParent;
+-        nsresult rv = accWrap->GetParent(getter_AddRefs(accParent));
++        nsIAccessible* accParent;
++        nsresult rv = accWrap->GetParent(&accParent);
+         if (NS_FAILED(rv) || !accParent)
+             return nsnull;
+ 
+@@ -874,15 +874,15 @@ getChildCountCB(AtkObject *aAtkObj)
+     }
+ 
+     PRInt32 count = 0;
+-    nsCOMPtr<nsIAccessibleHyperText> hyperText;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleHyperText), getter_AddRefs(hyperText));
++    nsIAccessibleHyperText* hyperText;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleHyperText), (void**)&hyperText);
+     if (hyperText) {
+         // If HyperText, then number of links matches number of children
+         hyperText->GetLinks(&count);
+     }
+     else {
+-        nsCOMPtr<nsIAccessibleText> accText;
+-        accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText), getter_AddRefs(accText));
++        nsIAccessibleText* accText;
++        accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText), (void**)&accText);
+         if (!accText) {    // Accessible text that is not a HyperText has no children
+             accWrap->GetChildCount(&count);
+         }
+@@ -907,20 +907,20 @@ refChildCB(AtkObject *aAtkObj, gint aChi
+         return nsnull;
+     }
+ 
+-    nsCOMPtr<nsIAccessible> accChild;
+-    nsCOMPtr<nsIAccessibleHyperText> hyperText;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleHyperText), getter_AddRefs(hyperText));
++    nsIAccessible* accChild;
++    nsIAccessibleHyperText* hyperText;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleHyperText), (void**)&hyperText);
+     if (hyperText) {
+         // If HyperText, then number of links matches number of children
+-        nsCOMPtr<nsIAccessibleHyperLink> hyperLink;
+-        hyperText->GetLink(aChildIndex, getter_AddRefs(hyperLink));
++        nsIAccessibleHyperLink* hyperLink;
++        hyperText->GetLink(aChildIndex, &hyperLink);
+         accChild = do_QueryInterface(hyperLink);
+     }
+     else {
+-        nsCOMPtr<nsIAccessibleText> accText;
+-        accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText), getter_AddRefs(accText));
++        nsIAccessibleText* accText;
++        accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText), (void**)&accText);
+         if (!accText) {  // Accessible Text that is not HyperText has no children
+-            accWrap->GetChildAt(aChildIndex, getter_AddRefs(accChild));
++            accWrap->GetChildAt(aChildIndex, &accChild);
+         }
+     }
+ 
+@@ -949,14 +949,14 @@ getIndexInParentCB(AtkObject *aAtkObj)
+         return -1;
+     }
+ 
+-    nsCOMPtr<nsIAccessible> parent;
+-    accWrap->GetParent(getter_AddRefs(parent));
++    nsIAccessible* parent;
++    accWrap->GetParent(&parent);
+     if (!parent) {
+         return -1; // No parent
+     }
+ 
+-    nsCOMPtr<nsIAccessible> sibling;
+-    parent->GetFirstChild(getter_AddRefs(sibling));
++    nsIAccessible* sibling;
++    parent->GetFirstChild(&sibling);
+     if (!sibling) {
+         return -1;  // Error, parent has no children
+     }
+@@ -973,9 +973,9 @@ getIndexInParentCB(AtkObject *aAtkObj)
+         ++ currentIndex;
+       }
+ 
+-      nsCOMPtr<nsIAccessible> tempAccessible;
+-      sibling->GetNextSibling(getter_AddRefs(tempAccessible));
+-      sibling.swap(tempAccessible);
++      nsIAccessible* tempAccessible;
++      sibling->GetNextSibling(&tempAccessible);
++      swap(sibling, tempAccessible);
+     }
+ 
+     return currentIndex;
+@@ -1089,10 +1089,10 @@ nsAccessibleWrap *GetAccessibleWrap(AtkO
+ 
+     NS_ENSURE_TRUE(tmpAccWrap->GetAtkObject() == aAtkObj, nsnull);
+ 
+-    nsRefPtr<nsApplicationAccessibleWrap> appAccWrap =
++    nsApplicationAccessibleWrap* appAccWrap =
+         nsAccessNode::GetApplicationAccessible();
+     nsAccessibleWrap* tmpAppAccWrap =
+-        static_cast<nsAccessibleWrap*>(appAccWrap.get());
++        static_cast<nsAccessibleWrap*>(appAccWrap);
+ 
+     if (tmpAppAccWrap != tmpAccWrap && !tmpAccWrap->IsValidObject())
+         return nsnull;
+@@ -1106,8 +1106,8 @@ nsAccessibleWrap::FireAccessibleEvent(ns
+     nsresult rv = nsAccessible::FireAccessibleEvent(aEvent);
+     NS_ENSURE_SUCCESS(rv, rv);
+ 
+-    nsCOMPtr<nsIAccessible> accessible;
+-    aEvent->GetAccessible(getter_AddRefs(accessible));
++    nsIAccessible* accessible;
++    aEvent->GetAccessible(&accessible);
+     NS_ENSURE_TRUE(accessible, NS_ERROR_FAILURE);
+ 
+     PRUint32 type = 0;
+@@ -1151,11 +1151,11 @@ nsAccessibleWrap::FireAccessibleEvent(ns
+     case nsIAccessibleEvent::EVENT_FOCUS:
+       {
+         MAI_LOG_DEBUG(("\n\nReceived: EVENT_FOCUS\n"));
+-        nsRefPtr<nsRootAccessible> rootAccWrap = accWrap->GetRootAccessible();
++        nsRootAccessible* rootAccWrap = accWrap->GetRootAccessible();
+         if (rootAccWrap && rootAccWrap->mActivated) {
+             atk_focus_tracker_notify(atkObj);
+             // Fire state change event for focus
+-            nsCOMPtr<nsIAccessibleStateChangeEvent> stateChangeEvent =
++            nsIAccessibleStateChangeEvent* stateChangeEvent =
+               new nsAccStateChangeEvent(accessible,
+                                         nsIAccessibleStates::STATE_FOCUSED,
+                                         PR_FALSE, PR_TRUE);
+@@ -1166,7 +1166,7 @@ nsAccessibleWrap::FireAccessibleEvent(ns
+     case nsIAccessibleEvent::EVENT_VALUE_CHANGE:
+       {
+         MAI_LOG_DEBUG(("\n\nReceived: EVENT_VALUE_CHANGE\n"));
+-        nsCOMPtr<nsIAccessibleValue> value(do_QueryInterface(accessible));
++        nsIAccessibleValue* value(do_QueryInterface(accessible));
+         if (value) {    // Make sure this is a numeric value
+             // Don't fire for MSAA string value changes (e.g. text editing)
+             // ATK values are always numeric
+@@ -1188,7 +1188,7 @@ nsAccessibleWrap::FireAccessibleEvent(ns
+       {
+         MAI_LOG_DEBUG(("\n\nReceived: EVENT_TEXT_CARET_MOVED\n"));
+ 
+-        nsCOMPtr<nsIAccessibleCaretMoveEvent> caretMoveEvent(do_QueryInterface(aEvent));
++        nsIAccessibleCaretMoveEvent* caretMoveEvent(do_QueryInterface(aEvent));
+         NS_ASSERTION(caretMoveEvent, "Event needs event data");
+         if (!caretMoveEvent)
+             break;
+@@ -1313,7 +1313,7 @@ nsAccessibleWrap::FireAccessibleEvent(ns
+       {
+         MAI_LOG_DEBUG(("\n\nReceived: EVENT_WINDOW_ACTIVATED\n"));
+         nsDocAccessibleWrap *accDocWrap =
+-          static_cast<nsDocAccessibleWrap *>(accessible.get());
++          static_cast<nsDocAccessibleWrap *>(accessible);
+         accDocWrap->mActivated = PR_TRUE;
+         guint id = g_signal_lookup ("activate", MAI_TYPE_ATK_OBJECT);
+         g_signal_emit(atkObj, id, 0);
+@@ -1323,7 +1323,7 @@ nsAccessibleWrap::FireAccessibleEvent(ns
+       {
+         MAI_LOG_DEBUG(("\n\nReceived: EVENT_WINDOW_DEACTIVATED\n"));
+         nsDocAccessibleWrap *accDocWrap =
+-          static_cast<nsDocAccessibleWrap *>(accessible.get());
++          static_cast<nsDocAccessibleWrap *>(accessible);
+         accDocWrap->mActivated = PR_FALSE;
+         guint id = g_signal_lookup ("deactivate", MAI_TYPE_ATK_OBJECT);
+         g_signal_emit(atkObj, id, 0);
+@@ -1370,7 +1370,7 @@ nsAccessibleWrap::FireAtkStateChangeEven
+ {
+     MAI_LOG_DEBUG(("\n\nReceived: EVENT_STATE_CHANGE\n"));
+ 
+-    nsCOMPtr<nsIAccessibleStateChangeEvent> event =
++    nsIAccessibleStateChangeEvent* event =
+         do_QueryInterface(aEvent);
+     NS_ENSURE_TRUE(event, NS_ERROR_FAILURE);
+ 
+@@ -1412,7 +1412,7 @@ nsAccessibleWrap::FireAtkTextChangedEven
+ {
+     MAI_LOG_DEBUG(("\n\nReceived: EVENT_TEXT_REMOVED/INSERTED\n"));
+ 
+-    nsCOMPtr<nsIAccessibleTextChangeEvent> event =
++    nsIAccessibleTextChangeEvent* event =
+         do_QueryInterface(aEvent);
+     NS_ENSURE_TRUE(event, NS_ERROR_FAILURE);
+ 
+@@ -1515,12 +1515,12 @@ nsAccessibleWrap::FireAtkShowHideEvent(n
+     else
+         MAI_LOG_DEBUG(("\n\nReceived: Hide event\n"));
+ 
+-    nsCOMPtr<nsIAccessible> accessible;
+-    aEvent->GetAccessible(getter_AddRefs(accessible));
++    nsIAccessible* accessible;
++    aEvent->GetAccessible(&accessible);
+     NS_ENSURE_STATE(accessible);
+ 
+-    nsCOMPtr<nsIAccessible> parentAccessible;
+-    accessible->GetParent(getter_AddRefs(parentAccessible));
++    nsIAccessible* parentAccessible;
++    accessible->GetParent(&parentAccessible);
+     NS_ENSURE_STATE(parentAccessible);
+ 
+     PRInt32 indexInParent = -1;
+diff --git a/accessible/src/atk/nsAppRootAccessible.cpp b/accessible/src/atk/nsAppRootAccessible.cpp
+--- a/accessible/src/atk/nsAppRootAccessible.cpp
++++ b/accessible/src/atk/nsAppRootAccessible.cpp
+@@ -435,7 +435,7 @@ AtkObject *
+ AtkObject *
+ mai_util_get_root(void)
+ {
+-    nsRefPtr<nsApplicationAccessibleWrap> root =
++    nsApplicationAccessibleWrap* root =
+         nsAccessNode::GetApplicationAccessible();
+ 
+     if (root)
+@@ -541,7 +541,7 @@ nsApplicationAccessibleWrap::Init()
+     } else {
+         //check gconf-2 setting
+         nsresult rv;
+-        nsCOMPtr<nsIPrefBranch> sysPrefService =
++        nsIPrefBranch* sysPrefService =
+             do_GetService(sSysPrefService, &rv);
+         if (NS_SUCCEEDED(rv) && sysPrefService) {
+             sysPrefService->GetBoolPref(sAccessibilityKey, &isGnomeATEnabled);
+@@ -665,7 +665,7 @@ nsApplicationAccessibleWrap::RemoveRootA
+     nsresult rv = NS_ERROR_FAILURE;
+ 
+     // we must use weak ref to get the index
+-    nsCOMPtr<nsIWeakReference> weakPtr = do_GetWeakReference(aRootAccWrap);
++    nsIWeakReference* weakPtr = do_GetWeakReference(aRootAccWrap);
+     rv = mChildren->IndexOf(0, weakPtr, &index);
+ 
+     AtkObject *atkAccessible = nsAccessibleWrap::GetAtkObject(aRootAccWrap);
+diff --git a/accessible/src/atk/nsMaiHyperlink.cpp b/accessible/src/atk/nsMaiHyperlink.cpp
+--- a/accessible/src/atk/nsMaiHyperlink.cpp
++++ b/accessible/src/atk/nsMaiHyperlink.cpp
+@@ -145,7 +145,7 @@ MaiHyperlink::GetAtkHyperlink(void)
+     if (mMaiAtkHyperlink)
+         return mMaiAtkHyperlink;
+ 
+-    nsCOMPtr<nsIAccessibleHyperLink> accessIf(do_QueryInterface(mHyperlink));
++    nsIAccessibleHyperLink* accessIf(do_QueryInterface(mHyperlink));
+     if (!accessIf)
+         return nsnull;
+ 
+@@ -225,8 +225,8 @@ getUriCB(AtkHyperlink *aLink, gint aLink
+     if (maiAtkHyperlink->uri)
+         return g_strdup(maiAtkHyperlink->uri);
+ 
+-    nsCOMPtr<nsIURI> uri;
+-    nsresult rv = accHyperlink->GetURI(aLinkIndex,getter_AddRefs(uri));
++    nsIURI* uri;
++    nsresult rv = accHyperlink->GetURI(aLinkIndex,&uri);
+     if (NS_FAILED(rv) || !uri)
+         return nsnull;
+     nsCAutoString cautoStr;
+@@ -242,8 +242,8 @@ getObjectCB(AtkHyperlink *aLink, gint aL
+     nsIAccessibleHyperLink *accHyperlink = get_accessible_hyperlink(aLink);
+     NS_ENSURE_TRUE(accHyperlink, nsnull);
+ 
+-    nsCOMPtr<nsIAccessible> accObj;
+-    accHyperlink->GetObject(aLinkIndex, getter_AddRefs(accObj));
++    nsIAccessible* accObj;
++    accHyperlink->GetObject(aLinkIndex, &accObj);
+     NS_ENSURE_TRUE(accObj, nsnull);
+ 
+     AtkObject *atkObj = nsAccessibleWrap::GetAtkObject(accObj);
+diff --git a/accessible/src/atk/nsMaiInterfaceAction.cpp b/accessible/src/atk/nsMaiInterfaceAction.cpp
+--- a/accessible/src/atk/nsMaiInterfaceAction.cpp
++++ b/accessible/src/atk/nsMaiInterfaceAction.cpp
+@@ -119,8 +119,8 @@ getKeyBindingCB(AtkAction *aAction, gint
+     nsresult rv = accWrap->GetKeyboardShortcut(accessKey);
+ 
+     if (NS_SUCCEEDED(rv) && !accessKey.IsEmpty()) {
+-        nsCOMPtr<nsIAccessible> parentAccessible;
+-        accWrap->GetParent(getter_AddRefs(parentAccessible));
++        nsIAccessible* parentAccessible;
++        accWrap->GetParent(&parentAccessible);
+         if (parentAccessible) {
+             PRUint32 role;
+             parentAccessible->GetRole(&role);
+@@ -135,7 +135,7 @@ getKeyBindingCB(AtkAction *aAction, gint
+             else if ((role == ATK_ROLE_MENU) || (role == ATK_ROLE_MENU_ITEM)) {
+                 //it is submenu, change from "s" to "s;<Alt>f:s"
+                 nsAutoString allKey = accessKey;
+-                nsCOMPtr<nsIAccessible> grandParentAcc = parentAccessible;
++                nsIAccessible* grandParentAcc = parentAccessible;
+ 
+                 while ((grandParentAcc) && (role != ATK_ROLE_MENU_BAR)) {
+                     nsAutoString grandParentKey;
+@@ -147,8 +147,8 @@ getKeyBindingCB(AtkAction *aAction, gint
+                         allKey = rightChar + NS_LITERAL_STRING(":") + allKey;
+                     }
+ 
+-                    nsCOMPtr<nsIAccessible> tempAcc = grandParentAcc;
+-                    tempAcc->GetParent(getter_AddRefs(grandParentAcc));
++                    nsIAccessible* tempAcc = grandParentAcc;
++                    tempAcc->GetParent(&grandParentAcc);
+                     if (grandParentAcc)
+                         grandParentAcc->GetRole(&role);
+                 }
+@@ -168,8 +168,8 @@ getKeyBindingCB(AtkAction *aAction, gint
+ 
+     //get shortcut
+     nsAutoString subShortcut;
+-    nsCOMPtr<nsIDOMDOMStringList> keyBindings;
+-    rv = accWrap->GetKeyBindings(aActionIndex, getter_AddRefs(keyBindings));
++    nsIDOMDOMStringList* keyBindings;
++    rv = accWrap->GetKeyBindings(aActionIndex, &keyBindings);
+ 
+     if (NS_SUCCEEDED(rv) && keyBindings) {
+         PRUint32 length = 0;
+diff --git a/accessible/src/atk/nsMaiInterfaceComponent.cpp b/accessible/src/atk/nsMaiInterfaceComponent.cpp
+--- a/accessible/src/atk/nsMaiInterfaceComponent.cpp
++++ b/accessible/src/atk/nsMaiInterfaceComponent.cpp
+@@ -74,15 +74,15 @@ refAccessibleAtPointCB(AtkComponent *aCo
+ 
+     // nsIAccessible getChildAtPoint (x,y) is in screen pixels.
+     if (aCoordType == ATK_XY_WINDOW) {
+-        nsCOMPtr<nsIDOMNode> domNode;
+-        accWrap->GetDOMNode(getter_AddRefs(domNode));
++        nsIDOMNode* domNode;
++        accWrap->GetDOMNode(&domNode);
+         nsIntPoint winCoords = nsAccUtils::GetScreenCoordsForWindow(domNode);
+         aAccX += winCoords.x;
+         aAccY += winCoords.y;
+     }
+ 
+-    nsCOMPtr<nsIAccessible> pointAcc;
+-    accWrap->GetChildAtPoint(aAccX, aAccY, getter_AddRefs(pointAcc));
++    nsIAccessible* pointAcc;
++    accWrap->GetChildAtPoint(aAccX, aAccY, &pointAcc);
+     if (!pointAcc) {
+         return nsnull;
+     }
+@@ -115,8 +115,8 @@ getExtentsCB(AtkComponent *aComponent,
+     if (NS_FAILED(rv))
+         return;
+     if (aCoordType == ATK_XY_WINDOW) {
+-        nsCOMPtr<nsIDOMNode> domNode;
+-        accWrap->GetDOMNode(getter_AddRefs(domNode));
++        nsIDOMNode* domNode;
++        accWrap->GetDOMNode(&domNode);
+         nsIntPoint winCoords = nsAccUtils::GetScreenCoordsForWindow(domNode);
+         nsAccX -= winCoords.x;
+         nsAccY -= winCoords.y;
+diff --git a/accessible/src/atk/nsMaiInterfaceDocument.cpp b/accessible/src/atk/nsMaiInterfaceDocument.cpp
+--- a/accessible/src/atk/nsMaiInterfaceDocument.cpp
++++ b/accessible/src/atk/nsMaiInterfaceDocument.cpp
+@@ -70,9 +70,9 @@ getDocumentLocaleCB(AtkDocument *aDocume
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessNode> docAccessNode;
++    nsIAccessNode* docAccessNode;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessNode),
+-                            getter_AddRefs(docAccessNode));
++                            (void**)&docAccessNode);
+     NS_ENSURE_TRUE(docAccessNode, nsnull);
+ 
+     nsAutoString locale;
+@@ -90,9 +90,9 @@ getDocumentTypeCB(AtkDocument *aDocument
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleDocument> accDocument;
++    nsIAccessibleDocument* accDocument;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleDocument),
+-                            getter_AddRefs(accDocument));
++                            (void**)&accDocument);
+     NS_ENSURE_TRUE(accDocument, nsnull);
+ 
+     nsAutoString mimeType;
+@@ -118,9 +118,9 @@ getDocumentAttributesCB(AtkDocument *aDo
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleDocument> accDocument;
++    nsIAccessibleDocument* accDocument;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleDocument),
+-                            getter_AddRefs(accDocument));
++                            (void**)&accDocument);
+     NS_ENSURE_TRUE(accDocument, nsnull);
+ 
+     // according to atkobject.h, AtkAttributeSet is a GSList
+@@ -153,9 +153,9 @@ getDocumentAttributeValueCB(AtkDocument 
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleDocument> accDocument;
++    nsIAccessibleDocument* accDocument;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleDocument),
+-                            getter_AddRefs(accDocument));
++                            (void**)&accDocument);
+     NS_ENSURE_TRUE(accDocument, nsnull);
+ 
+     nsresult rv;
+diff --git a/accessible/src/atk/nsMaiInterfaceEditableText.cpp b/accessible/src/atk/nsMaiInterfaceEditableText.cpp
+--- a/accessible/src/atk/nsMaiInterfaceEditableText.cpp
++++ b/accessible/src/atk/nsMaiInterfaceEditableText.cpp
+@@ -68,12 +68,12 @@ setRunAttributesCB(AtkEditableText *aTex
+     if (!accWrap)
+         return FALSE;
+ 
+-    nsCOMPtr<nsIAccessibleEditableText> accText;
++    nsIAccessibleEditableText* accText;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleEditableText),
+-                            getter_AddRefs(accText));
++                            (void**)&accText);
+     NS_ENSURE_TRUE(accText, FALSE);
+ 
+-    nsCOMPtr<nsISupports> attrSet;
++    nsISupports* attrSet;
+     /* how to insert attributes into nsISupports ??? */
+ 
+     nsresult rv = accText->SetAttributes(aStartOffset, aEndOffset,
+@@ -88,9 +88,9 @@ setTextContentsCB(AtkEditableText *aText
+     if (!accWrap)
+         return;
+ 
+-    nsCOMPtr<nsIAccessibleEditableText> accText;
++    nsIAccessibleEditableText* accText;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleEditableText),
+-                            getter_AddRefs(accText));
++                            (void**)&accText);
+     if (!accText)
+         return;
+ 
+@@ -108,9 +108,9 @@ insertTextCB(AtkEditableText *aText,
+     if (!accWrap)
+         return;
+ 
+-    nsCOMPtr<nsIAccessibleEditableText> accText;
++    nsIAccessibleEditableText* accText;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleEditableText),
+-                            getter_AddRefs(accText));
++                            (void**)&accText);
+     if (!accText)
+         return;
+ 
+@@ -135,9 +135,9 @@ copyTextCB(AtkEditableText *aText, gint 
+     if (!accWrap)
+         return;
+ 
+-    nsCOMPtr<nsIAccessibleEditableText> accText;
++    nsIAccessibleEditableText* accText;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleEditableText),
+-                            getter_AddRefs(accText));
++                            (void**)&accText);
+     if (!accText)
+         return;
+ 
+@@ -153,9 +153,9 @@ cutTextCB(AtkEditableText *aText, gint a
+     if (!accWrap)
+         return;
+ 
+-    nsCOMPtr<nsIAccessibleEditableText> accText;
++    nsIAccessibleEditableText* accText;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleEditableText),
+-                            getter_AddRefs(accText));
++                            (void**)&accText);
+     if (!accText)
+         return;
+     MAI_LOG_DEBUG(("EditableText: cutTextCB, aStartPos=%d, aEndPos=%d",
+@@ -170,9 +170,9 @@ deleteTextCB(AtkEditableText *aText, gin
+     if (!accWrap)
+         return;
+ 
+-    nsCOMPtr<nsIAccessibleEditableText> accText;
++    nsIAccessibleEditableText* accText;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleEditableText),
+-                            getter_AddRefs(accText));
++                            (void**)&accText);
+     if (!accText)
+         return;
+ 
+@@ -188,9 +188,9 @@ pasteTextCB(AtkEditableText *aText, gint
+     if (!accWrap)
+         return;
+ 
+-    nsCOMPtr<nsIAccessibleEditableText> accText;
++    nsIAccessibleEditableText* accText;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleEditableText),
+-                            getter_AddRefs(accText));
++                            (void**)&accText);
+     if (!accText)
+         return;
+ 
+diff --git a/accessible/src/atk/nsMaiInterfaceHyperlinkImpl.cpp b/accessible/src/atk/nsMaiInterfaceHyperlinkImpl.cpp
+--- a/accessible/src/atk/nsMaiInterfaceHyperlinkImpl.cpp
++++ b/accessible/src/atk/nsMaiInterfaceHyperlinkImpl.cpp
+@@ -56,9 +56,9 @@ getHyperlinkCB(AtkHyperlinkImpl *aImpl)
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleHyperLink> accHyperlink;
++    nsIAccessibleHyperLink* accHyperlink;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleHyperLink),
+-                            getter_AddRefs(accHyperlink));
++                            (void**)&accHyperlink);
+     NS_ENSURE_TRUE(accHyperlink, nsnull);
+     
+     MaiHyperlink *maiHyperlink = accWrap->GetMaiHyperlink();
+diff --git a/accessible/src/atk/nsMaiInterfaceHypertext.cpp b/accessible/src/atk/nsMaiInterfaceHypertext.cpp
+--- a/accessible/src/atk/nsMaiInterfaceHypertext.cpp
++++ b/accessible/src/atk/nsMaiInterfaceHypertext.cpp
+@@ -59,17 +59,17 @@ getLinkCB(AtkHypertext *aText, gint aLin
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleHyperText> hyperText;
++    nsIAccessibleHyperText* hyperText;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleHyperText),
+-                            getter_AddRefs(hyperText));
++                            (void**)&hyperText);
+     NS_ENSURE_TRUE(hyperText, nsnull);
+ 
+-    nsCOMPtr<nsIAccessibleHyperLink> hyperLink;
+-    nsresult rv = hyperText->GetLink(aLinkIndex, getter_AddRefs(hyperLink));
++    nsIAccessibleHyperLink* hyperLink;
++    nsresult rv = hyperText->GetLink(aLinkIndex, &hyperLink);
+     if (NS_FAILED(rv) || !hyperLink)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessible> hyperLinkAcc(do_QueryInterface(hyperLink));
++    nsIAccessible* hyperLinkAcc(do_QueryInterface(hyperLink));
+     AtkObject *hyperLinkAtkObj = nsAccessibleWrap::GetAtkObject(hyperLinkAcc);
+     nsAccessibleWrap *accChild = GetAccessibleWrap(hyperLinkAtkObj);
+     NS_ENSURE_TRUE(accChild, nsnull);
+@@ -86,9 +86,9 @@ getLinkCountCB(AtkHypertext *aText)
+     if (!accWrap)
+         return -1;
+ 
+-    nsCOMPtr<nsIAccessibleHyperText> hyperText;
++    nsIAccessibleHyperText* hyperText;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleHyperText),
+-                            getter_AddRefs(hyperText));
++                            (void**)&hyperText);
+     NS_ENSURE_TRUE(hyperText, -1);
+ 
+     PRInt32 count = -1;
+@@ -105,9 +105,9 @@ getLinkIndexCB(AtkHypertext *aText, gint
+     if (!accWrap)
+         return -1;
+ 
+-    nsCOMPtr<nsIAccessibleHyperText> hyperText;
++    nsIAccessibleHyperText* hyperText;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleHyperText),
+-                            getter_AddRefs(hyperText));
++                            (void**)&hyperText);
+     NS_ENSURE_TRUE(hyperText, -1);
+ 
+     PRInt32 index = -1;
+diff --git a/accessible/src/atk/nsMaiInterfaceImage.cpp b/accessible/src/atk/nsMaiInterfaceImage.cpp
+--- a/accessible/src/atk/nsMaiInterfaceImage.cpp
++++ b/accessible/src/atk/nsMaiInterfaceImage.cpp
+@@ -62,9 +62,9 @@ getImagePositionCB(AtkImage *aImage, gin
+     if (!accWrap) 
+       return;
+ 
+-    nsCOMPtr<nsIAccessibleImage> image;
++    nsIAccessibleImage* image;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleImage),
+-                            getter_AddRefs(image));
++                            (void**)&image);
+     if (!image)
+       return;
+ 
+@@ -75,8 +75,8 @@ getImagePositionCB(AtkImage *aImage, gin
+       return;
+     
+     if (aCoordType == ATK_XY_WINDOW) {
+-        nsCOMPtr<nsIDOMNode> domNode;
+-        accWrap->GetDOMNode(getter_AddRefs(domNode));
++        nsIDOMNode* domNode;
++        accWrap->GetDOMNode(&domNode);
+         nsIntPoint winCoords = nsAccUtils::GetScreenCoordsForWindow(domNode);
+         *aAccX -= winCoords.x;
+         *aAccY -= winCoords.y;
+@@ -96,9 +96,9 @@ getImageSizeCB(AtkImage *aImage, gint *a
+     if (!accWrap) 
+       return;
+ 
+-    nsCOMPtr<nsIAccessibleImage> image;
++    nsIAccessibleImage* image;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleImage),
+-                            getter_AddRefs(image));
++                            (void**)&image);
+     if (!image)
+       return;
+ 
+diff --git a/accessible/src/atk/nsMaiInterfaceSelection.cpp b/accessible/src/atk/nsMaiInterfaceSelection.cpp
+--- a/accessible/src/atk/nsMaiInterfaceSelection.cpp
++++ b/accessible/src/atk/nsMaiInterfaceSelection.cpp
+@@ -63,9 +63,9 @@ addSelectionCB(AtkSelection *aSelection,
+     if (!accWrap)
+         return FALSE;
+ 
+-    nsCOMPtr<nsIAccessibleSelectable> accSelection;
++    nsIAccessibleSelectable* accSelection;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleSelectable),
+-                            getter_AddRefs(accSelection));
++                            (void**)&accSelection);
+     NS_ENSURE_TRUE(accSelection, FALSE);
+ 
+     return NS_SUCCEEDED(accSelection->AddChildToSelection(i));
+@@ -78,9 +78,9 @@ clearSelectionCB(AtkSelection *aSelectio
+     if (!accWrap)
+         return FALSE;
+ 
+-    nsCOMPtr<nsIAccessibleSelectable> accSelection;
++    nsIAccessibleSelectable* accSelection;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleSelectable),
+-                            getter_AddRefs(accSelection));
++                            (void**)&accSelection);
+     NS_ENSURE_TRUE(accSelection, FALSE);
+ 
+     return NS_SUCCEEDED(accSelection->ClearSelection());
+@@ -93,13 +93,13 @@ refSelectionCB(AtkSelection *aSelection,
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleSelectable> accSelection;
++    nsIAccessibleSelectable* accSelection;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleSelectable),
+-                            getter_AddRefs(accSelection));
++                            (void**)&accSelection);
+     NS_ENSURE_TRUE(accSelection, nsnull);
+ 
+-    nsCOMPtr<nsIAccessible> accSelect;
+-    accSelection->RefSelection(i, getter_AddRefs(accSelect));
++    nsIAccessible* accSelect;
++    accSelection->RefSelection(i, &accSelect);
+     if (!accSelect) {
+         return nsnull;
+     }
+@@ -118,9 +118,9 @@ getSelectionCountCB(AtkSelection *aSelec
+     if (!accWrap)
+         return -1;
+ 
+-    nsCOMPtr<nsIAccessibleSelectable> accSelection;
++    nsIAccessibleSelectable* accSelection;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleSelectable),
+-                            getter_AddRefs(accSelection));
++                            (void**)&accSelection);
+     NS_ENSURE_TRUE(accSelection, -1);
+ 
+     PRInt32 num = 0;
+@@ -135,9 +135,9 @@ isChildSelectedCB(AtkSelection *aSelecti
+     if (!accWrap)
+         return FALSE;
+ 
+-    nsCOMPtr<nsIAccessibleSelectable> accSelection;
++    nsIAccessibleSelectable* accSelection;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleSelectable),
+-                            getter_AddRefs(accSelection));
++                            (void**)&accSelection);
+     NS_ENSURE_TRUE(accSelection, FALSE);
+ 
+     PRBool result = FALSE;
+@@ -152,9 +152,9 @@ removeSelectionCB(AtkSelection *aSelecti
+     if (!accWrap)
+         return FALSE;
+ 
+-    nsCOMPtr<nsIAccessibleSelectable> accSelection;
++    nsIAccessibleSelectable* accSelection;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleSelectable),
+-                            getter_AddRefs(accSelection));
++                            (void**)&accSelection);
+     NS_ENSURE_TRUE(accSelection, FALSE);
+ 
+     nsresult rv = accSelection->RemoveChildFromSelection(i);
+@@ -168,9 +168,9 @@ selectAllSelectionCB(AtkSelection *aSele
+     if (!accWrap)
+         return FALSE;
+ 
+-    nsCOMPtr<nsIAccessibleSelectable> accSelection;
++    nsIAccessibleSelectable* accSelection;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleSelectable),
+-                            getter_AddRefs(accSelection));
++                            (void**)&accSelection);
+     NS_ENSURE_TRUE(accSelection, FALSE);
+ 
+     PRBool result = FALSE;
+diff --git a/accessible/src/atk/nsMaiInterfaceTable.cpp b/accessible/src/atk/nsMaiInterfaceTable.cpp
+--- a/accessible/src/atk/nsMaiInterfaceTable.cpp
++++ b/accessible/src/atk/nsMaiInterfaceTable.cpp
+@@ -75,13 +75,13 @@ refAtCB(AtkTable *aTable, gint aRow, gin
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
+-    NS_ENSURE_TRUE(accTable, nsnull);
+-
+-    nsCOMPtr<nsIAccessible> cell;
+-    nsresult rv = accTable->CellRefAt(aRow, aColumn,getter_AddRefs(cell));
++    nsIAccessibleTable* accTable;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
++                            (void**)&accTable);
++    NS_ENSURE_TRUE(accTable, nsnull);
++
++    nsIAccessible* cell;
++    nsresult rv = accTable->CellRefAt(aRow, aColumn,&cell);
+     if (NS_FAILED(rv) || !cell)
+         return nsnull;
+ 
+@@ -99,9 +99,9 @@ getIndexAtCB(AtkTable *aTable, gint aRow
+     if (!accWrap)
+         return -1;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
++    nsIAccessibleTable* accTable;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
++                            (void**)&accTable);
+     NS_ENSURE_TRUE(accTable, -1);
+ 
+     PRInt32 index;
+@@ -118,9 +118,9 @@ getColumnAtIndexCB(AtkTable *aTable, gin
+     if (!accWrap)
+         return -1;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
++    nsIAccessibleTable* accTable;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
++                            (void**)&accTable);
+     NS_ENSURE_TRUE(accTable, -1);
+ 
+     PRInt32 col;
+@@ -137,9 +137,9 @@ getRowAtIndexCB(AtkTable *aTable, gint a
+     if (!accWrap)
+         return -1;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
++    nsIAccessibleTable* accTable;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
++                            (void**)&accTable);
+     NS_ENSURE_TRUE(accTable, -1);
+ 
+     PRInt32 row;
+@@ -156,9 +156,9 @@ getColumnCountCB(AtkTable *aTable)
+     if (!accWrap)
+         return -1;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
++    nsIAccessibleTable* accTable;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
++                            (void**)&accTable);
+     NS_ENSURE_TRUE(accTable, -1);
+ 
+     PRInt32 count;
+@@ -175,9 +175,9 @@ getRowCountCB(AtkTable *aTable)
+     if (!accWrap)
+         return -1;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
++    nsIAccessibleTable* accTable;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
++                            (void**)&accTable);
+     NS_ENSURE_TRUE(accTable, -1);
+ 
+     PRInt32 count;
+@@ -195,9 +195,9 @@ getColumnExtentAtCB(AtkTable *aTable,
+     if (!accWrap)
+         return -1;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
++    nsIAccessibleTable* accTable;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
++                            (void**)&accTable);
+     NS_ENSURE_TRUE(accTable, -1);
+ 
+     PRInt32 extent;
+@@ -215,9 +215,9 @@ getRowExtentAtCB(AtkTable *aTable,
+     if (!accWrap)
+         return -1;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
++    nsIAccessibleTable* accTable;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
++                            (void**)&accTable);
+     NS_ENSURE_TRUE(accTable, -1);
+ 
+     PRInt32 extent;
+@@ -234,13 +234,13 @@ getCaptionCB(AtkTable *aTable)
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
+-    NS_ENSURE_TRUE(accTable, nsnull);
+-
+-    nsCOMPtr<nsIAccessible> caption;
+-    nsresult rv = accTable->GetCaption(getter_AddRefs(caption));
++    nsIAccessibleTable* accTable;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
++                            (void**)&accTable);
++    NS_ENSURE_TRUE(accTable, nsnull);
++
++    nsIAccessible* caption;
++    nsresult rv = accTable->GetCaption(&caption);
+     if (NS_FAILED(rv) || !caption)
+         return nsnull;
+ 
+@@ -254,9 +254,9 @@ getColumnDescriptionCB(AtkTable *aTable,
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
++    nsIAccessibleTable* accTable;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
++                            (void**)&accTable);
+     NS_ENSURE_TRUE(accTable, nsnull);
+ 
+     nsAutoString autoStr;
+@@ -273,13 +273,13 @@ getColumnHeaderCB(AtkTable *aTable, gint
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
+-    NS_ENSURE_TRUE(accTable, nsnull);
+-
+-    nsCOMPtr<nsIAccessibleTable> header;
+-    nsresult rv = accTable->GetColumnHeader(getter_AddRefs(header));
++    nsIAccessibleTable* accTable;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
++                            (void**)&accTable);
++    NS_ENSURE_TRUE(accTable, nsnull);
++
++    nsIAccessibleTable* header;
++    nsresult rv = accTable->GetColumnHeader(&header);
+     NS_ENSURE_SUCCESS(rv, nsnull);
+     NS_ENSURE_TRUE(header, nsnull);
+ 
+@@ -292,8 +292,8 @@ getColumnHeaderCB(AtkTable *aTable, gint
+     // 2. "GetColumnHeader" defined in nsIAccessibleTable returns
+     // nsXULTreeColumnsAccessibleWrap, which exports nsIAccessibleTable and is
+     // "ROLE_LIST".
+-    nsCOMPtr<nsIAccessible> accHeader;
+-    header->CellRefAt(0, aColumn, getter_AddRefs(accHeader));
++    nsIAccessible* accHeader;
++    header->CellRefAt(0, aColumn, &accHeader);
+     NS_ENSURE_TRUE(accHeader, nsnull);
+ 
+     return nsAccessibleWrap::GetAtkObject(accHeader);
+@@ -306,9 +306,9 @@ getRowDescriptionCB(AtkTable *aTable, gi
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
++    nsIAccessibleTable* accTable;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
++                            (void**)&accTable);
+     NS_ENSURE_TRUE(accTable, nsnull);
+ 
+     nsAutoString autoStr;
+@@ -325,16 +325,16 @@ getRowHeaderCB(AtkTable *aTable, gint aR
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
+-    NS_ENSURE_TRUE(accTable, nsnull);
+-
+-    nsCOMPtr<nsIAccessibleTable> header;
+-    nsresult rv = accTable->GetRowHeader(getter_AddRefs(header));
++    nsIAccessibleTable* accTable;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
++                            (void**)&accTable);
++    NS_ENSURE_TRUE(accTable, nsnull);
++
++    nsIAccessibleTable* header;
++    nsresult rv = accTable->GetRowHeader(&header);
+     NS_ENSURE_SUCCESS(rv, nsnull);
+ 
+-    nsCOMPtr<nsIAccessible> accHeader(do_QueryInterface(header));
++    nsIAccessible* accHeader(do_QueryInterface(header));
+     NS_ENSURE_TRUE(accHeader, nsnull);
+ 
+     return nsAccessibleWrap::GetAtkObject(accHeader);
+@@ -354,9 +354,9 @@ getSelectedColumnsCB(AtkTable *aTable, g
+     if (!accWrap)
+         return 0;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
++    nsIAccessibleTable* accTable;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
++                            (void**)&accTable);
+     NS_ENSURE_TRUE(accTable, 0);
+ 
+     PRUint32 size = 0;
+@@ -389,9 +389,9 @@ getSelectedRowsCB(AtkTable *aTable, gint
+     if (!accWrap)
+         return 0;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
++    nsIAccessibleTable* accTable;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
++                            (void**)&accTable);
+     NS_ENSURE_TRUE(accTable, 0);
+ 
+     PRUint32 size = 0;
+@@ -424,9 +424,9 @@ isColumnSelectedCB(AtkTable *aTable, gin
+     if (!accWrap)
+         return FALSE;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
++    nsIAccessibleTable* accTable;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
++                            (void**)&accTable);
+     NS_ENSURE_TRUE(accTable, FALSE);
+ 
+     PRBool outValue;
+@@ -441,9 +441,9 @@ isRowSelectedCB(AtkTable *aTable, gint a
+     if (!accWrap)
+         return FALSE;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
++    nsIAccessibleTable* accTable;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
++                            (void**)&accTable);
+     NS_ENSURE_TRUE(accTable, FALSE);
+ 
+     PRBool outValue;
+@@ -458,9 +458,9 @@ isCellSelectedCB(AtkTable *aTable, gint 
+     if (!accWrap)
+         return FALSE;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
++    nsIAccessibleTable* accTable;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
++                            (void**)&accTable);
+     NS_ENSURE_TRUE(accTable, FALSE);
+ 
+     PRBool outValue;
+diff --git a/accessible/src/atk/nsMaiInterfaceText.cpp b/accessible/src/atk/nsMaiInterfaceText.cpp
+--- a/accessible/src/atk/nsMaiInterfaceText.cpp
++++ b/accessible/src/atk/nsMaiInterfaceText.cpp
+@@ -92,9 +92,9 @@ getTextCB(AtkText *aText, gint aStartOff
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleText> accText;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                            getter_AddRefs(accText));
++    nsIAccessibleText* accText;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
++                            (void**)&accText);
+     NS_ENSURE_TRUE(accText, nsnull);
+ 
+     nsAutoString autoStr;
+@@ -117,9 +117,9 @@ getTextAfterOffsetCB(AtkText *aText, gin
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleText> accText;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                            getter_AddRefs(accText));
++    nsIAccessibleText* accText;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
++                            (void**)&accText);
+     NS_ENSURE_TRUE(accText, nsnull);
+ 
+     nsAutoString autoStr;
+@@ -146,9 +146,9 @@ getTextAtOffsetCB(AtkText *aText, gint a
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleText> accText;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                            getter_AddRefs(accText));
++    nsIAccessibleText* accText;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
++                            (void**)&accText);
+     NS_ENSURE_TRUE(accText, nsnull);
+ 
+     nsAutoString autoStr;
+@@ -173,9 +173,9 @@ getCharacterAtOffsetCB(AtkText *aText, g
+     if (!accWrap)
+         return 0;
+ 
+-    nsCOMPtr<nsIAccessibleText> accText;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                            getter_AddRefs(accText));
++    nsIAccessibleText* accText;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
++                            (void**)&accText);
+     NS_ENSURE_TRUE(accText, 0);
+ 
+     /* PRUnichar is unsigned short in Mozilla */
+@@ -203,9 +203,9 @@ getTextBeforeOffsetCB(AtkText *aText, gi
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleText> accText;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                            getter_AddRefs(accText));
++    nsIAccessibleText* accText;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
++                            (void**)&accText);
+     NS_ENSURE_TRUE(accText, nsnull);
+ 
+     nsAutoString autoStr;
+@@ -230,9 +230,9 @@ getCaretOffsetCB(AtkText *aText)
+     if (!accWrap)
+         return 0;
+ 
+-    nsCOMPtr<nsIAccessibleText> accText;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                            getter_AddRefs(accText));
++    nsIAccessibleText* accText;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
++                            (void**)&accText);
+     NS_ENSURE_TRUE(accText, 0);
+ 
+     PRInt32 offset;
+@@ -249,16 +249,16 @@ getRunAttributesCB(AtkText *aText, gint 
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleText> accText;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                            getter_AddRefs(accText));
+-    NS_ENSURE_TRUE(accText, nsnull);
+-
+-    nsCOMPtr<nsIAccessible> accessibleWithAttrs;
++    nsIAccessibleText* accText;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
++                            (void**)&accText);
++    NS_ENSURE_TRUE(accText, nsnull);
++
++    nsIAccessible* accessibleWithAttrs;
+     PRInt32 startOffset = 0, endOffset = 0;
+     nsresult rv =
+         accText->GetAttributeRange(aOffset, &startOffset, &endOffset,
+-                                   getter_AddRefs(accessibleWithAttrs));
++                                   &accessibleWithAttrs);
+     *aStartOffset = startOffset;
+     *aEndOffset = endOffset;
+     if (NS_FAILED(rv))
+@@ -284,9 +284,9 @@ getCharacterExtentsCB(AtkText *aText, gi
+     if(!accWrap || !aX || !aY || !aWidth || !aHeight)
+         return;
+ 
+-    nsCOMPtr<nsIAccessibleText> accText;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                            getter_AddRefs(accText));
++    nsIAccessibleText* accText;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
++                            (void**)&accText);
+     if (!accText)
+         return;
+ 
+@@ -318,9 +318,9 @@ getRangeExtentsCB(AtkText *aText, gint a
+     if(!accWrap || !aRect)
+         return;
+ 
+-    nsCOMPtr<nsIAccessibleText> accText;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                            getter_AddRefs(accText));
++    nsIAccessibleText* accText;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
++                            (void**)&accText);
+     if (!accText)
+         return;
+ 
+@@ -352,9 +352,9 @@ getCharacterCountCB(AtkText *aText)
+     if (!accWrap)
+         return 0;
+ 
+-    nsCOMPtr<nsIAccessibleText> accText;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                            getter_AddRefs(accText));
++    nsIAccessibleText* accText;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
++                            (void**)&accText);
+     NS_ENSURE_TRUE(accText, 0);
+ 
+     PRInt32 count = 0;
+@@ -371,9 +371,9 @@ getOffsetAtPointCB(AtkText *aText,
+     if (!accWrap)
+         return -1;
+ 
+-    nsCOMPtr<nsIAccessibleText> accText;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                            getter_AddRefs(accText));
++    nsIAccessibleText* accText;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
++                            (void**)&accText);
+     NS_ENSURE_TRUE(accText, -1);
+ 
+     PRInt32 offset = 0;
+@@ -394,9 +394,9 @@ getTextSelectionCountCB(AtkText *aText)
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleText> accText;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                            getter_AddRefs(accText));
++    nsIAccessibleText* accText;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
++                            (void**)&accText);
+     NS_ENSURE_TRUE(accText, nsnull);
+ 
+     PRInt32 selectionCount;
+@@ -413,9 +413,9 @@ getTextSelectionCB(AtkText *aText, gint 
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleText> accText;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                            getter_AddRefs(accText));
++    nsIAccessibleText* accText;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
++                            (void**)&accText);
+     NS_ENSURE_TRUE(accText, nsnull);
+ 
+     PRInt32 startOffset = 0, endOffset = 0;
+@@ -440,9 +440,9 @@ addTextSelectionCB(AtkText *aText,
+     if (!accWrap)
+         return FALSE;
+ 
+-    nsCOMPtr<nsIAccessibleText> accText;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                            getter_AddRefs(accText));
++    nsIAccessibleText* accText;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
++                            (void**)&accText);
+     NS_ENSURE_TRUE(accText, FALSE);
+ 
+     nsresult rv = accText->AddSelection(aStartOffset, aEndOffset);
+@@ -458,9 +458,9 @@ removeTextSelectionCB(AtkText *aText,
+     if (!accWrap)
+         return FALSE;
+ 
+-    nsCOMPtr<nsIAccessibleText> accText;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                            getter_AddRefs(accText));
++    nsIAccessibleText* accText;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
++                            (void**)&accText);
+     NS_ENSURE_TRUE(accText, FALSE);
+ 
+     nsresult rv = accText->RemoveSelection(aSelectionNum);
+@@ -476,9 +476,9 @@ setTextSelectionCB(AtkText *aText, gint 
+     if (!accWrap)
+         return FALSE;
+ 
+-    nsCOMPtr<nsIAccessibleText> accText;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                            getter_AddRefs(accText));
++    nsIAccessibleText* accText;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
++                            (void**)&accText);
+     NS_ENSURE_TRUE(accText, FALSE);
+ 
+     nsresult rv = accText->SetSelectionBounds(aSelectionNum,
+@@ -493,9 +493,9 @@ setCaretOffsetCB(AtkText *aText, gint aO
+     if (!accWrap)
+         return FALSE;
+ 
+-    nsCOMPtr<nsIAccessibleText> accText;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                            getter_AddRefs(accText));
++    nsIAccessibleText* accText;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
++                            (void**)&accText);
+     NS_ENSURE_TRUE(accText, FALSE);
+ 
+     nsresult rv = accText->SetCaretOffset(aOffset);
+diff --git a/accessible/src/atk/nsMaiInterfaceValue.cpp b/accessible/src/atk/nsMaiInterfaceValue.cpp
+--- a/accessible/src/atk/nsMaiInterfaceValue.cpp
++++ b/accessible/src/atk/nsMaiInterfaceValue.cpp
+@@ -61,9 +61,9 @@ getCurrentValueCB(AtkValue *obj, GValue 
+     if (!accWrap)
+         return;
+ 
+-    nsCOMPtr<nsIAccessibleValue> accValue;
++    nsIAccessibleValue* accValue;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleValue),
+-                            getter_AddRefs(accValue));
++                            (void**)&accValue);
+     if (!accValue)
+         return;
+ 
+@@ -82,9 +82,9 @@ getMaximumValueCB(AtkValue *obj, GValue 
+     if (!accWrap)
+         return;
+ 
+-    nsCOMPtr<nsIAccessibleValue> accValue;
++    nsIAccessibleValue* accValue;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleValue),
+-                            getter_AddRefs(accValue));
++                            (void**)&accValue);
+     if (!accValue)
+         return;
+ 
+@@ -103,9 +103,9 @@ getMinimumValueCB(AtkValue *obj, GValue 
+     if (!accWrap)
+         return;
+ 
+-    nsCOMPtr<nsIAccessibleValue> accValue;
++    nsIAccessibleValue* accValue;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleValue),
+-                            getter_AddRefs(accValue));
++                            (void**)&accValue);
+     if (!accValue)
+         return;
+ 
+@@ -124,9 +124,9 @@ getMinimumIncrementCB(AtkValue *obj, GVa
+     if (!accWrap)
+         return;
+ 
+-    nsCOMPtr<nsIAccessibleValue> accValue;
++    nsIAccessibleValue* accValue;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleValue),
+-                            getter_AddRefs(accValue));
++                            (void**)&accValue);
+     if (!accValue)
+         return;
+ 
+@@ -145,9 +145,9 @@ setCurrentValueCB(AtkValue *obj, const G
+     if (!accWrap)
+         return FALSE;
+ 
+-    nsCOMPtr<nsIAccessibleValue> accValue;
++    nsIAccessibleValue* accValue;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleValue),
+-                            getter_AddRefs(accValue));
++                            (void**)&accValue);
+     NS_ENSURE_TRUE(accValue, FALSE);
+ 
+     double accDouble =g_value_get_double (value);
+diff --git a/accessible/src/atk/nsXULTreeAccessibleWrap.cpp b/accessible/src/atk/nsXULTreeAccessibleWrap.cpp
+--- a/accessible/src/atk/nsXULTreeAccessibleWrap.cpp
++++ b/accessible/src/atk/nsXULTreeAccessibleWrap.cpp
+@@ -91,21 +91,21 @@ NS_IMETHODIMP nsXULTreeAccessibleWrap::G
+ {
+   nsresult rv = NS_OK;
+ 
+-  nsCOMPtr<nsIAccessible> acc;
+-  rv = nsAccessible::GetFirstChild(getter_AddRefs(acc));
++  nsIAccessible* acc;
++  rv = nsAccessible::GetFirstChild(&acc);
+   NS_ENSURE_TRUE(acc, NS_ERROR_FAILURE);
+ 
+   rv = acc->GetChildCount(aColumns);
+ 
+   // The last child could be column picker. In that case, we need to minus the
+   // number of columns by 1
+-  nsCOMPtr<nsIAccessible> lastChildAccessible;
+-  acc->GetLastChild(getter_AddRefs(lastChildAccessible));
+-  nsCOMPtr<nsIAccessNode> accessNode = do_QueryInterface(lastChildAccessible);
++  nsIAccessible* lastChildAccessible;
++  acc->GetLastChild(&lastChildAccessible);
++  nsIAccessNode* accessNode = do_QueryInterface(lastChildAccessible);
+   NS_ENSURE_TRUE(accessNode, NS_ERROR_FAILURE);
+-  nsCOMPtr<nsIDOMNode> domNode;
+-  accessNode->GetDOMNode(getter_AddRefs(domNode));
+-  nsCOMPtr<nsIContent> content = do_QueryInterface(domNode);
++  nsIDOMNode* domNode;
++  accessNode->GetDOMNode(&domNode);
++  nsIContent* content = do_QueryInterface(domNode);
+   NS_ENSURE_TRUE(content, NS_ERROR_FAILURE);
+   // it's menupopup inside column picker
+   if (content->NodeInfo()->Equals(nsAccessibilityAtoms::menupopup,
+@@ -120,11 +120,11 @@ NS_IMETHODIMP nsXULTreeAccessibleWrap::G
+ {
+   nsresult rv = NS_OK;
+ 
+-  nsCOMPtr<nsIAccessible> acc;
+-  nsAccessible::GetFirstChild(getter_AddRefs(acc));
++  nsIAccessible* acc;
++  nsAccessible::GetFirstChild(&acc);
+   NS_ENSURE_TRUE(acc, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIAccessibleTable> accTable(do_QueryInterface(acc, &rv));
++  nsIAccessibleTable* accTable(do_QueryInterface(acc, &rv));
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+   *aColumnHeader = accTable;
+@@ -222,12 +222,12 @@ NS_IMETHODIMP nsXULTreeAccessibleWrap::G
+   PRInt32 *outArray = (PRInt32 *)nsMemory::Alloc((*aNumRows) * sizeof(PRInt32));
+   NS_ENSURE_TRUE(outArray, NS_ERROR_OUT_OF_MEMORY);
+ 
+-  nsCOMPtr<nsITreeView> view;
+-  rv = mTree->GetView(getter_AddRefs(view));
+-  NS_ENSURE_SUCCESS(rv, rv);
+-
+-  nsCOMPtr<nsITreeSelection> selection;
+-  rv = view->GetSelection(getter_AddRefs(selection));
++  nsITreeView* view;
++  rv = mTree->GetView(&view);
++  NS_ENSURE_SUCCESS(rv, rv);
++
++  nsITreeSelection* selection;
++  rv = view->GetSelection(&selection);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+   PRInt32 rowCount;
+@@ -331,8 +331,8 @@ NS_IMETHODIMP nsXULTreeAccessibleWrap::G
+ 
+ NS_IMETHODIMP nsXULTreeAccessibleWrap::GetColumnDescription(PRInt32 aColumn, nsAString & _retval)
+ {
+-  nsCOMPtr<nsIAccessibleTable> columnHeader;
+-  nsresult rv = GetColumnHeader(getter_AddRefs(columnHeader));
++  nsIAccessibleTable* columnHeader;
++  nsresult rv = GetColumnHeader(&columnHeader);
+   if (NS_SUCCEEDED(rv) && columnHeader) {
+     return columnHeader->GetColumnDescription(aColumn, _retval);
+   }
+@@ -371,12 +371,12 @@ NS_IMETHODIMP nsXULTreeAccessibleWrap::I
+ 
+   nsresult rv = NS_OK;
+ 
+-  nsCOMPtr<nsITreeView> view;
+-  rv = mTree->GetView(getter_AddRefs(view));
+-  NS_ENSURE_SUCCESS(rv, rv);
+-
+-  nsCOMPtr<nsITreeSelection> selection;
+-  rv = view->GetSelection(getter_AddRefs(selection));
++  nsITreeView* view;
++  rv = mTree->GetView(&view);
++  NS_ENSURE_SUCCESS(rv, rv);
++
++  nsITreeSelection* selection;
++  rv = view->GetSelection(&selection);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+   return selection->IsSelected(aRow, _retval);
+@@ -418,8 +418,8 @@ NS_IMETHODIMP nsXULTreeAccessibleWrap::C
+   PRInt32 rowIndex;
+   nsresult rv = GetRowAtIndex(aIndex, &rowIndex);
+ 
+-  nsCOMPtr<nsITreeSelection> selection;
+-  rv = mTreeView->GetSelection(getter_AddRefs(selection));
++  nsITreeSelection* selection;
++  rv = mTreeView->GetSelection(&selection);
+   NS_ASSERTION(selection, "Can't get selection from mTreeView");
+ 
+   if (selection) {
+@@ -532,12 +532,12 @@ NS_IMETHODIMP nsXULTreeColumnsAccessible
+ 
+ NS_IMETHODIMP nsXULTreeColumnsAccessibleWrap::CellRefAt(PRInt32 aRow, PRInt32 aColumn, nsIAccessible **_retval)
+ {
+-  nsCOMPtr<nsIAccessible> next, temp;
+-  GetFirstChild(getter_AddRefs(next));
++  nsIAccessible* next, *temp;
++  GetFirstChild(&next);
+   NS_ENSURE_TRUE(next, NS_ERROR_FAILURE);
+ 
+   for (PRInt32 col = 0; col < aColumn; col++) {
+-    next->GetNextSibling(getter_AddRefs(temp));
++    next->GetNextSibling(&temp);
+     NS_ENSURE_TRUE(temp, NS_ERROR_FAILURE);
+ 
+     next = temp;
+@@ -590,8 +590,8 @@ NS_IMETHODIMP nsXULTreeColumnsAccessible
+ 
+ NS_IMETHODIMP nsXULTreeColumnsAccessibleWrap::GetColumnDescription(PRInt32 aColumn, nsAString & _retval)
+ {
+-  nsCOMPtr<nsIAccessible> column;  
+-  nsresult rv = CellRefAt(0, aColumn, getter_AddRefs(column));
++  nsIAccessible* column;  
++  nsresult rv = CellRefAt(0, aColumn, &column);
+   if (NS_SUCCEEDED(rv) && column) {
+     return column->GetName(_retval);
+   }
+diff --git a/accessible/src/base/nsAccessNode.cpp b/accessible/src/base/nsAccessNode.cpp
+--- a/accessible/src/base/nsAccessNode.cpp
++++ b/accessible/src/base/nsAccessNode.cpp
+@@ -143,21 +143,21 @@ NS_IMETHODIMP nsAccessNode::Init()
+ #ifdef DEBUG_A11Y
+   NS_ASSERTION(!mIsInitialized, "Initialized twice!");
+ #endif
+-  nsCOMPtr<nsIAccessibleDocument> docAccessible(GetDocAccessible());
++  nsIAccessibleDocument* docAccessible(GetDocAccessible());
+   if (!docAccessible) {
+     // No doc accessible yet for this node's document. 
+     // There was probably an accessible event fired before the 
+     // current document was ever asked for by the assistive technology.
+     // Create a doc accessible so we can cache this node
+-    nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
++    nsIPresShell* presShell(do_QueryReferent(mWeakShell));
+     if (presShell) {
+-      nsCOMPtr<nsIDOMNode> docNode(do_QueryInterface(presShell->GetDocument()));
++      nsIDOMNode* docNode(do_QueryInterface(presShell->GetDocument()));
+       if (docNode) {
+         nsIAccessibilityService *accService = GetAccService();
+         if (accService) {
+-          nsCOMPtr<nsIAccessible> accessible;
++          nsIAccessible* accessible;
+           accService->GetAccessibleInShell(docNode, presShell,
+-                                           getter_AddRefs(accessible));
++                                           &accessible);
+           docAccessible = do_QueryInterface(accessible);
+         }
+       }
+@@ -169,7 +169,7 @@ NS_IMETHODIMP nsAccessNode::Init()
+   }
+   void* uniqueID;
+   GetUniqueID(&uniqueID);
+-  nsCOMPtr<nsPIAccessibleDocument> privateDocAccessible =
++  nsPIAccessibleDocument* privateDocAccessible =
+     do_QueryInterface(docAccessible);
+   NS_ASSERTION(privateDocAccessible, "No private docaccessible for docaccessible");
+   privateDocAccessible->CacheAccessNode(uniqueID, this);
+@@ -197,12 +197,12 @@ NS_IMETHODIMP nsAccessNode::GetUniqueID(
+ 
+ NS_IMETHODIMP nsAccessNode::GetOwnerWindow(void **aWindow)
+ {
+-  nsCOMPtr<nsIAccessibleDocument> docAccessible(GetDocAccessible());
++  nsIAccessibleDocument* docAccessible(GetDocAccessible());
+   NS_ASSERTION(docAccessible, "No root accessible pointer back, Init() not called.");
+   return docAccessible->GetWindowHandle(aWindow);
+ }
+ 
+-already_AddRefed<nsApplicationAccessibleWrap>
++nsApplicationAccessibleWrap*
+ nsAccessNode::GetApplicationAccessible()
+ {
+   if (!gIsAccessibilityActive) {
+@@ -235,7 +235,7 @@ void nsAccessNode::InitXPAccessibility()
+     return;
+   }
+ 
+-  nsCOMPtr<nsIStringBundleService> stringBundleService =
++  nsIStringBundleService* stringBundleService =
+     do_GetService(NS_STRINGBUNDLE_CONTRACTID);
+   if (stringBundleService) {
+     // Static variables are released in ShutdownAllXPAccessibility();
+@@ -249,7 +249,7 @@ void nsAccessNode::InitXPAccessibility()
+ 
+   gGlobalDocAccessibleCache.Init(4);
+ 
+-  nsCOMPtr<nsIPrefBranch> prefBranch(do_GetService(NS_PREFSERVICE_CONTRACTID));
++  nsIPrefBranch* prefBranch(do_GetService(NS_PREFSERVICE_CONTRACTID));
+   if (prefBranch) {
+     prefBranch->GetBoolPref("accessibility.disablecache", &gIsCacheDisabled);
+     prefBranch->GetBoolPref("browser.formfill.enable", &gIsFormFillEnabled);
+@@ -261,7 +261,7 @@ void nsAccessNode::InitXPAccessibility()
+ 
+ void nsAccessNode::NotifyA11yInitOrShutdown()
+ {
+-  nsCOMPtr<nsIObserverService> obsService =
++  nsIObserverService* obsService =
+     do_GetService("@mozilla.org/observer-service;1");
+   NS_ASSERTION(obsService, "No observer service to notify of a11y init/shutdown");
+   if (obsService) {
+@@ -299,7 +299,7 @@ void nsAccessNode::ShutdownXPAccessibili
+   NotifyA11yInitOrShutdown();
+ }
+ 
+-already_AddRefed<nsIPresShell> nsAccessNode::GetPresShell()
++nsIPresShell* nsAccessNode::GetPresShell()
+ {
+   nsIPresShell *presShell = nsnull;
+   if (mWeakShell)
+@@ -318,34 +318,34 @@ already_AddRefed<nsIPresShell> nsAccessN
+ 
+ nsPresContext* nsAccessNode::GetPresContext()
+ {
+-  nsCOMPtr<nsIPresShell> presShell(GetPresShell());
++  nsIPresShell* presShell(GetPresShell());
+   if (!presShell) {
+     return nsnull;
+   }
+   return presShell->GetPresContext();
+ }
+ 
+-already_AddRefed<nsIAccessibleDocument> nsAccessNode::GetDocAccessible()
++nsIAccessibleDocument* nsAccessNode::GetDocAccessible()
+ {
+   return GetDocAccessibleFor(mWeakShell); // Addref'd
+ }
+ 
+-already_AddRefed<nsRootAccessible> nsAccessNode::GetRootAccessible()
+-{
+-  nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem =
++nsRootAccessible* nsAccessNode::GetRootAccessible()
++{
++  nsIDocShellTreeItem* docShellTreeItem =
+     nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
+   NS_ASSERTION(docShellTreeItem, "No docshell tree item for mDOMNode");
+   if (!docShellTreeItem) {
+     return nsnull;
+   }
+-  nsCOMPtr<nsIDocShellTreeItem> root;
+-  docShellTreeItem->GetRootTreeItem(getter_AddRefs(root));
++  nsIDocShellTreeItem* root;
++  docShellTreeItem->GetRootTreeItem(&root);
+   NS_ASSERTION(root, "No root content tree item");
+   if (!root) {
+     return nsnull;
+   }
+ 
+-  nsCOMPtr<nsIAccessibleDocument> accDoc = GetDocAccessibleFor(root);
++  nsIAccessibleDocument* accDoc = GetDocAccessibleFor(root);
+   if (!accDoc) {
+     return nsnull;
+   }
+@@ -359,11 +359,11 @@ already_AddRefed<nsRootAccessible> nsAcc
+ 
+ nsIFrame* nsAccessNode::GetFrame()
+ {
+-  nsCOMPtr<nsIPresShell> shell(do_QueryReferent(mWeakShell));
++  nsIPresShell* shell(do_QueryReferent(mWeakShell));
+   if (!shell) 
+     return nsnull;  
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   return content ? shell->GetPrimaryFrameFor(content) : nsnull;
+ }
+ 
+@@ -377,7 +377,7 @@ NS_IMETHODIMP
+ NS_IMETHODIMP
+ nsAccessNode::GetNumChildren(PRInt32 *aNumChildren)
+ {
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+ 
+   if (!content) {
+     *aNumChildren = 0;
+@@ -393,7 +393,7 @@ NS_IMETHODIMP
+ NS_IMETHODIMP
+ nsAccessNode::GetAccessibleDocument(nsIAccessibleDocument **aDocAccessible)
+ {
+-  *aDocAccessible = GetDocAccessibleFor(mWeakShell).get();
++  *aDocAccessible = GetDocAccessibleFor(mWeakShell);
+   return NS_OK;
+ }
+ 
+@@ -402,7 +402,7 @@ nsAccessNode::GetInnerHTML(nsAString& aI
+ {
+   aInnerHTML.Truncate();
+ 
+-  nsCOMPtr<nsIDOMNSHTMLElement> domNSElement(do_QueryInterface(mDOMNode));
++  nsIDOMNSHTMLElement* domNSElement(do_QueryInterface(mDOMNode));
+   NS_ENSURE_TRUE(domNSElement, NS_ERROR_NULL_POINTER);
+ 
+   return domNSElement->GetInnerHTML(aInnerHTML);
+@@ -413,13 +413,13 @@ nsAccessNode::ScrollTo(PRUint32 aScrollT
+ {
+   NS_ENSURE_TRUE(mDOMNode, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIPresShell> shell(GetPresShell());
++  nsIPresShell* shell(GetPresShell());
+   NS_ENSURE_TRUE(shell, NS_ERROR_FAILURE);
+ 
+   nsIFrame *frame = GetFrame();
+   NS_ENSURE_TRUE(frame, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIContent> content = frame->GetContent();
++  nsIContent* content = frame->GetContent();
+   NS_ENSURE_TRUE(content, NS_ERROR_FAILURE);
+ 
+   PRInt16 vPercent, hPercent;
+@@ -454,13 +454,13 @@ nsAccessNode::MakeAccessNode(nsIDOMNode 
+   nsIAccessibilityService *accService = GetAccService();
+   NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIAccessNode> accessNode;
+-  accService->GetCachedAccessNode(aNode, mWeakShell, getter_AddRefs(accessNode));
++  nsIAccessNode* accessNode;
++  accService->GetCachedAccessNode(aNode, mWeakShell, &accessNode);
+ 
+   if (!accessNode) {
+-    nsCOMPtr<nsIAccessible> accessible;
++    nsIAccessible* accessible;
+     accService->GetAccessibleInWeakShell(aNode, mWeakShell,
+-                                         getter_AddRefs(accessible));
++                                         &accessible);
+ 
+     accessNode = do_QueryInterface(accessible);
+   }
+@@ -488,8 +488,8 @@ nsAccessNode::GetFirstChildNode(nsIAcces
+   *aAccessNode = nsnull;
+   NS_ENSURE_TRUE(mDOMNode, NS_ERROR_NULL_POINTER);
+ 
+-  nsCOMPtr<nsIDOMNode> domNode;
+-  mDOMNode->GetFirstChild(getter_AddRefs(domNode));
++  nsIDOMNode* domNode;
++  mDOMNode->GetFirstChild(&domNode);
+ 
+   return domNode ? MakeAccessNode(domNode, aAccessNode) : NS_OK;
+ }
+@@ -501,8 +501,8 @@ nsAccessNode::GetLastChildNode(nsIAccess
+   *aAccessNode = nsnull;
+   NS_ENSURE_TRUE(mDOMNode, NS_ERROR_NULL_POINTER);
+ 
+-  nsCOMPtr<nsIDOMNode> domNode;
+-  mDOMNode->GetLastChild(getter_AddRefs(domNode));
++  nsIDOMNode* domNode;
++  mDOMNode->GetLastChild(&domNode);
+ 
+   return domNode ? MakeAccessNode(domNode, aAccessNode) : NS_OK;
+ }
+@@ -514,8 +514,8 @@ nsAccessNode::GetParentNode(nsIAccessNod
+   *aAccessNode = nsnull;
+   NS_ENSURE_TRUE(mDOMNode, NS_ERROR_NULL_POINTER);
+ 
+-  nsCOMPtr<nsIDOMNode> domNode;
+-  mDOMNode->GetParentNode(getter_AddRefs(domNode));
++  nsIDOMNode* domNode;
++  mDOMNode->GetParentNode(&domNode);
+ 
+   return domNode ? MakeAccessNode(domNode, aAccessNode) : NS_OK;
+ }
+@@ -527,8 +527,8 @@ nsAccessNode::GetPreviousSiblingNode(nsI
+   *aAccessNode = nsnull;
+   NS_ENSURE_TRUE(mDOMNode, NS_ERROR_NULL_POINTER);
+ 
+-  nsCOMPtr<nsIDOMNode> domNode;
+-  mDOMNode->GetPreviousSibling(getter_AddRefs(domNode));
++  nsIDOMNode* domNode;
++  mDOMNode->GetPreviousSibling(&domNode);
+ 
+   return domNode ? MakeAccessNode(domNode, aAccessNode) : NS_OK;
+ }
+@@ -540,8 +540,8 @@ nsAccessNode::GetNextSiblingNode(nsIAcce
+   *aAccessNode = nsnull;
+   NS_ENSURE_TRUE(mDOMNode, NS_ERROR_NULL_POINTER);
+ 
+-  nsCOMPtr<nsIDOMNode> domNode;
+-  mDOMNode->GetNextSibling(getter_AddRefs(domNode));
++  nsIDOMNode* domNode;
++  mDOMNode->GetNextSibling(&domNode);
+ 
+   return domNode ? MakeAccessNode(domNode, aAccessNode) : NS_OK;
+ }
+@@ -552,10 +552,10 @@ nsAccessNode::GetChildNodeAt(PRInt32 aCh
+   NS_ENSURE_ARG_POINTER(aAccessNode);
+   *aAccessNode = nsnull;
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   NS_ENSURE_TRUE(content, NS_ERROR_NULL_POINTER);
+ 
+-  nsCOMPtr<nsIDOMNode> domNode =
++  nsIDOMNode* domNode =
+     do_QueryInterface(content->GetChildAt(aChildNum));
+ 
+   return domNode ? MakeAccessNode(domNode, aAccessNode) : NS_OK;
+@@ -564,12 +564,12 @@ NS_IMETHODIMP
+ NS_IMETHODIMP
+ nsAccessNode::GetComputedStyleValue(const nsAString& aPseudoElt, const nsAString& aPropertyName, nsAString& aValue)
+ {
+-  nsCOMPtr<nsIDOMElement> domElement(do_QueryInterface(mDOMNode));
++  nsIDOMElement* domElement(do_QueryInterface(mDOMNode));
+   if (!domElement) {
+     return NS_ERROR_FAILURE;
+   }
+-  nsCOMPtr<nsIDOMCSSStyleDeclaration> styleDecl;
+-  GetComputedStyleDeclaration(aPseudoElt, domElement, getter_AddRefs(styleDecl));
++  nsIDOMCSSStyleDeclaration* styleDecl;
++  GetComputedStyleDeclaration(aPseudoElt, domElement, &styleDecl);
+   NS_ENSURE_TRUE(styleDecl, NS_ERROR_FAILURE);
+   
+   return styleDecl->GetPropertyValue(aPropertyName, aValue);
+@@ -584,13 +584,13 @@ nsAccessNode::GetComputedStyleCSSValue(c
+ 
+   *aCSSValue = nsnull;
+ 
+-  nsCOMPtr<nsIDOMElement> domElement(do_QueryInterface(mDOMNode));
++  nsIDOMElement* domElement(do_QueryInterface(mDOMNode));
+   if (!domElement)
+     return NS_ERROR_FAILURE;
+ 
+-  nsCOMPtr<nsIDOMCSSStyleDeclaration> styleDecl;
++  nsIDOMCSSStyleDeclaration* styleDecl;
+   GetComputedStyleDeclaration(aPseudoElt, domElement,
+-                              getter_AddRefs(styleDecl));
++                              &styleDecl);
+   NS_ENSURE_STATE(styleDecl);
+ 
+   nsCOMPtr<nsIDOMCSSValue> cssValue;
+@@ -606,28 +606,28 @@ void nsAccessNode::GetComputedStyleDecla
+ {
+   *aCssDecl = nsnull;
+   // Returns number of items in style declaration
+-  nsCOMPtr<nsIContent> content = do_QueryInterface(aElement);
++  nsIContent* content = do_QueryInterface(aElement);
+   if (!content) {
+     return;
+   }
+-  nsCOMPtr<nsIDocument> doc = content->GetDocument();
++  nsIDocument* doc = content->GetDocument();
+   if (!doc) {
+     return;
+   }
+ 
+-  nsCOMPtr<nsIDOMViewCSS> viewCSS(do_QueryInterface(doc->GetWindow()));
++  nsIDOMViewCSS* viewCSS(do_QueryInterface(doc->GetWindow()));
+   if (!viewCSS) {
+     return;
+   }
+ 
+-  nsCOMPtr<nsIDOMCSSStyleDeclaration> cssDecl;
+-  viewCSS->GetComputedStyle(aElement, aPseudoElt, getter_AddRefs(cssDecl));
++  nsIDOMCSSStyleDeclaration* cssDecl;
++  viewCSS->GetComputedStyle(aElement, aPseudoElt, &cssDecl);
+   *aCssDecl = cssDecl;
+ }
+ 
+ /***************** Hashtable of nsIAccessNode's *****************/
+ 
+-already_AddRefed<nsIAccessibleDocument>
++nsIAccessibleDocument*
+ nsAccessNode::GetDocAccessibleFor(nsIWeakReference *aPresShell)
+ {
+   nsIAccessibleDocument *docAccessible = nsnull;
+@@ -639,19 +639,19 @@ nsAccessNode::GetDocAccessibleFor(nsIWea
+   return docAccessible;
+ }
+  
+-already_AddRefed<nsIAccessibleDocument>
++nsIAccessibleDocument*
+ nsAccessNode::GetDocAccessibleFor(nsISupports *aContainer, PRBool aCanCreate)
+ {
+   if (!aCanCreate) {
+-    nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(aContainer));
++    nsIDocShell* docShell(do_QueryInterface(aContainer));
+     NS_ASSERTION(docShell, "This method currently only supports docshells");
+-    nsCOMPtr<nsIPresShell> presShell;
+-    docShell->GetPresShell(getter_AddRefs(presShell));
+-    nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(presShell));
++    nsIPresShell* presShell;
++    docShell->GetPresShell(&presShell);
++    nsIWeakReference* weakShell(do_GetWeakReference(presShell));
+     return weakShell ? GetDocAccessibleFor(weakShell) : nsnull;
+   }
+ 
+-  nsCOMPtr<nsIDOMNode> node = GetDOMNodeForContainer(aContainer);
++  nsIDOMNode* node = GetDOMNodeForContainer(aContainer);
+   if (!node) {
+     return nsnull;
+   }
+@@ -665,20 +665,20 @@ nsAccessNode::GetDocAccessibleFor(nsISup
+   return docAccessible;
+ }
+  
+-already_AddRefed<nsIAccessibleDocument>
++nsIAccessibleDocument*
+ nsAccessNode::GetDocAccessibleFor(nsIDOMNode *aNode)
+ {
+-  nsCOMPtr<nsIPresShell> eventShell = GetPresShellFor(aNode);
+-  nsCOMPtr<nsIWeakReference> weakEventShell(do_GetWeakReference(eventShell));
++  nsIPresShell* eventShell = GetPresShellFor(aNode);
++  nsIWeakReference* weakEventShell(do_GetWeakReference(eventShell));
+   return weakEventShell? GetDocAccessibleFor(weakEventShell) : nsnull;
+ }
+ 
+-already_AddRefed<nsIPresShell>
++nsIPresShell*
+ nsAccessNode::GetPresShellFor(nsIDOMNode *aNode)
+ {
+-  nsCOMPtr<nsIDOMDocument> domDocument;
+-  aNode->GetOwnerDocument(getter_AddRefs(domDocument));
+-  nsCOMPtr<nsIDocument> doc(do_QueryInterface(domDocument));
++  nsIDOMDocument* domDocument;
++  aNode->GetOwnerDocument(&domDocument);
++  nsIDocument* doc(do_QueryInterface(domDocument));
+   if (!doc) {   // This is necessary when the node is the document node
+     doc = do_QueryInterface(aNode);
+   }
+@@ -689,20 +689,20 @@ nsAccessNode::GetPresShellFor(nsIDOMNode
+   return presShell;
+ }
+ 
+-already_AddRefed<nsIDOMNode>
++nsIDOMNode*
+ nsAccessNode::GetDOMNodeForContainer(nsISupports *aContainer)
+ {
+   nsIDOMNode* node = nsnull;
+-  nsCOMPtr<nsIDocShell> shell = do_QueryInterface(aContainer);
+-  nsCOMPtr<nsIContentViewer> cv;
+-  shell->GetContentViewer(getter_AddRefs(cv));
++  nsIDocShell* shell = do_QueryInterface(aContainer);
++  nsIContentViewer* cv;
++  shell->GetContentViewer(&cv);
+   if (cv) {
+-    nsCOMPtr<nsIDocumentViewer> docv(do_QueryInterface(cv));
++    nsIDocumentViewer* docv(do_QueryInterface(cv));
+     if (docv) {
+-      nsCOMPtr<nsIDocument> doc;
+-      docv->GetDocument(getter_AddRefs(doc));
++      nsIDocument* doc;
++      docv->GetDocument(&doc);
+       if (doc) {
+-        CallQueryInterface(doc.get(), &node);
++        CallQueryInterface(doc, &node);
+       }
+     }
+   }
+@@ -733,7 +733,7 @@ nsAccessNode::GetCacheEntry(nsAccessNode
+ 
+ PLDHashOperator nsAccessNode::ClearCacheEntry(const void* aKey, nsCOMPtr<nsIAccessNode>& aAccessNode, void* aUserArg)
+ {
+-  nsCOMPtr<nsPIAccessNode> privateAccessNode(do_QueryInterface(aAccessNode));
++  nsPIAccessNode* privateAccessNode(do_QueryInterface(aAccessNode));
+   privateAccessNode->Shutdown();
+ 
+   return PL_DHASH_REMOVE;
+@@ -745,14 +745,14 @@ nsAccessNode::ClearCache(nsAccessNodeHas
+   aCache.Enumerate(ClearCacheEntry, nsnull);
+ }
+ 
+-already_AddRefed<nsIDOMNode> nsAccessNode::GetCurrentFocus()
+-{
+-  nsCOMPtr<nsIPresShell> shell = GetPresShellFor(mDOMNode);
++nsIDOMNode* nsAccessNode::GetCurrentFocus()
++{
++  nsIPresShell* shell = GetPresShellFor(mDOMNode);
+   NS_ENSURE_TRUE(shell, nsnull);
+-  nsCOMPtr<nsIDocument> doc = shell->GetDocument();
++  nsIDocument* doc = shell->GetDocument();
+   NS_ENSURE_TRUE(doc, nsnull);
+ 
+-  nsCOMPtr<nsPIDOMWindow> privateDOMWindow(do_QueryInterface(doc->GetWindow()));
++  nsPIDOMWindow* privateDOMWindow(do_QueryInterface(doc->GetWindow()));
+   if (!privateDOMWindow) {
+     return nsnull;
+   }
+@@ -760,18 +760,18 @@ already_AddRefed<nsIDOMNode> nsAccessNod
+   if (!focusController) {
+     return nsnull;
+   }
+-  nsCOMPtr<nsIDOMElement> focusedElement;
+-  focusController->GetFocusedElement(getter_AddRefs(focusedElement));
++  nsIDOMElement* focusedElement;
++  focusController->GetFocusedElement(&focusedElement);
+   nsIDOMNode *focusedNode = nsnull;
+   if (!focusedElement) {
+     // Document itself has focus
+-    nsCOMPtr<nsIDOMWindowInternal> focusedWinInternal;
+-    focusController->GetFocusedWindow(getter_AddRefs(focusedWinInternal));
++    nsIDOMWindowInternal* focusedWinInternal;
++    focusController->GetFocusedWindow(&focusedWinInternal);
+     if (!focusedWinInternal) {
+       return nsnull;
+     }
+-    nsCOMPtr<nsIDOMDocument> focusedDOMDocument;
+-    focusedWinInternal->GetDocument(getter_AddRefs(focusedDOMDocument));
++    nsIDOMDocument* focusedDOMDocument;
++    focusedWinInternal->GetDocument(&focusedDOMDocument);
+     if (!focusedDOMDocument) {
+       return nsnull;
+     }
+@@ -788,22 +788,22 @@ nsAccessNode::GetLanguage(nsAString& aLa
+ nsAccessNode::GetLanguage(nsAString& aLanguage)
+ {
+   aLanguage.Truncate();
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   if (!content) {
+     // For documents make sure we look for lang attribute on
+     // document element
+-    nsCOMPtr<nsIDOMDocument> domDoc(do_QueryInterface(mDOMNode));
++    nsIDOMDocument* domDoc(do_QueryInterface(mDOMNode));
+     if (domDoc) {
+-      nsCOMPtr<nsIDOMHTMLDocument> htmlDoc(do_QueryInterface(mDOMNode));
++      nsIDOMHTMLDocument* htmlDoc(do_QueryInterface(mDOMNode));
+       if (htmlDoc) {
+         // Make sure we look for lang attribute on HTML <body>
+-        nsCOMPtr<nsIDOMHTMLElement> bodyElement;
+-        htmlDoc->GetBody(getter_AddRefs(bodyElement));
++        nsIDOMHTMLElement* bodyElement;
++        htmlDoc->GetBody(&bodyElement);
+         content = do_QueryInterface(bodyElement);
+       }
+       if (!content) {
+-        nsCOMPtr<nsIDOMElement> docElement;
+-        domDoc->GetDocumentElement(getter_AddRefs(docElement));
++        nsIDOMElement* docElement;
++        domDoc->GetDocumentElement(&docElement);
+         content = do_QueryInterface(docElement);
+       }
+     }
+@@ -839,7 +839,7 @@ nsAccessNode::GetARIARole(nsIContent *aC
+     if (!aContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::role, aRole)) {
+       return PR_FALSE;
+     }
+-    nsCOMPtr<nsIDOMNSDocument> doc(do_QueryInterface(aContent->GetDocument()));
++    nsIDOMNSDocument* doc(do_QueryInterface(aContent->GetDocument()));
+     if (doc) {
+       nsAutoString mimeType;
+       doc->GetContentType(mimeType);
+@@ -878,7 +878,7 @@ nsAccessNode::GetARIARole(nsIContent *aC
+     // QI to nsIDOM3Node causes some overhead. Unfortunately we need to do this each
+     // time there is a prefixed role attribute, because the prefix to namespace mappings
+     // can change within any subtree via the xmlns attribute
+-    nsCOMPtr<nsIDOM3Node> dom3Node(do_QueryInterface(aContent));
++    nsIDOM3Node* dom3Node(do_QueryInterface(aContent));
+     if (dom3Node) {
+       // Look up exact prefix name for WAI Roles
+       NS_NAMED_LITERAL_STRING(kWAIRoles_Namespace, "http://www.w3.org/2005/01/wai-rdf/GUIRoleTaxonomy#");
+diff --git a/accessible/src/base/nsAccessNode.h b/accessible/src/base/nsAccessNode.h
+--- a/accessible/src/base/nsAccessNode.h
++++ b/accessible/src/base/nsAccessNode.h
+@@ -97,7 +97,7 @@ class nsAccessNode: public XPCOMGCFinali
+     /**
+      * Return an application accessible.
+      */
+-    static already_AddRefed<nsApplicationAccessibleWrap> GetApplicationAccessible();
++    static nsApplicationAccessibleWrap* GetApplicationAccessible();
+ 
+     // Static methods for handling per-document cache
+     static void PutCacheEntry(nsAccessNodeHashtable& aCache,
+@@ -106,15 +106,15 @@ class nsAccessNode: public XPCOMGCFinali
+                               void* aUniqueID, nsIAccessNode **aAccessNode);
+     static void ClearCache(nsAccessNodeHashtable& aCache);
+ 
+-    static PLDHashOperator PR_CALLBACK ClearCacheEntry(const void* aKey, nsCOMPtr<nsIAccessNode>& aAccessNode, void* aUserArg);
++    static PLDHashOperator PR_CALLBACK ClearCacheEntry(const void* aKey, nsIAccessNode*& aAccessNode, void* aUserArg);
+ 
+     // Static cache methods for global document cache
+-    static already_AddRefed<nsIAccessibleDocument> GetDocAccessibleFor(nsIWeakReference *aPresShell);
+-    static already_AddRefed<nsIAccessibleDocument> GetDocAccessibleFor(nsISupports *aContainer, PRBool aCanCreate = PR_FALSE);
+-    static already_AddRefed<nsIAccessibleDocument> GetDocAccessibleFor(nsIDOMNode *aNode);
++    static nsIAccessibleDocument* GetDocAccessibleFor(nsIWeakReference *aPresShell);
++    static nsIAccessibleDocument* GetDocAccessibleFor(nsISupports *aContainer, PRBool aCanCreate = PR_FALSE);
++    static nsIAccessibleDocument* GetDocAccessibleFor(nsIDOMNode *aNode);
+ 
+-    static already_AddRefed<nsIDOMNode> GetDOMNodeForContainer(nsISupports *aContainer);
+-    static already_AddRefed<nsIPresShell> GetPresShellFor(nsIDOMNode *aStartNode);
++    static nsIDOMNode* GetDOMNodeForContainer(nsISupports *aContainer);
++    static nsIPresShell* GetPresShellFor(nsIDOMNode *aStartNode);
+     
+     // Return PR_TRUE if there is a role attribute
+     static PRBool HasRoleAttribute(nsIContent *aContent)
+@@ -139,17 +139,17 @@ class nsAccessNode: public XPCOMGCFinali
+                                             nsIDOMElement *aElement,
+                                             nsIDOMCSSStyleDeclaration **aCssDecl);
+ 
+-    already_AddRefed<nsRootAccessible> GetRootAccessible();
++    nsRootAccessible* GetRootAccessible();
+ 
+     static nsIDOMNode *gLastFocusedNode;
+     static nsIAccessibilityService* GetAccService();
+-    already_AddRefed<nsIDOMNode> GetCurrentFocus();
++    nsIDOMNode* GetCurrentFocus();
+ 
+ protected:
+     nsresult MakeAccessNode(nsIDOMNode *aNode, nsIAccessNode **aAccessNode);
+-    already_AddRefed<nsIPresShell> GetPresShell();
++    nsIPresShell* GetPresShell();
+     nsPresContext* GetPresContext();
+-    already_AddRefed<nsIAccessibleDocument> GetDocAccessible();
++    nsIAccessibleDocument* GetDocAccessible();
+     void LastRelease();
+ 
+     nsCOMPtr<nsIDOMNode> mDOMNode;
+diff --git a/accessible/src/base/nsAccessibilityService.cpp b/accessible/src/base/nsAccessibilityService.cpp
+--- a/accessible/src/base/nsAccessibilityService.cpp
++++ b/accessible/src/base/nsAccessibilityService.cpp
+@@ -117,13 +117,13 @@ nsAccessibilityService *nsAccessibilityS
+ 
+ nsAccessibilityService::nsAccessibilityService()
+ {
+-  nsCOMPtr<nsIObserverService> observerService = 
++  nsIObserverService* observerService = 
+     do_GetService("@mozilla.org/observer-service;1");
+   if (!observerService)
+     return;
+ 
+   observerService->AddObserver(this, NS_XPCOM_SHUTDOWN_OBSERVER_ID, PR_FALSE);
+-  nsCOMPtr<nsIWebProgress> progress(do_GetService(NS_DOCUMENTLOADER_SERVICE_CONTRACTID));
++  nsIWebProgress* progress(do_GetService(NS_DOCUMENTLOADER_SERVICE_CONTRACTID));
+   if (progress) {
+     progress->AddProgressListener(static_cast<nsIWebProgressListener*>(this),
+                                   nsIWebProgress::NOTIFY_STATE_DOCUMENT |
+@@ -148,12 +148,12 @@ nsAccessibilityService::Observe(nsISuppo
+                          const PRUnichar *aData)
+ {
+   if (!nsCRT::strcmp(aTopic, NS_XPCOM_SHUTDOWN_OBSERVER_ID)) {
+-    nsCOMPtr<nsIObserverService> observerService = 
++    nsIObserverService* observerService = 
+       do_GetService("@mozilla.org/observer-service;1");
+     if (observerService) {
+       observerService->RemoveObserver(this, NS_XPCOM_SHUTDOWN_OBSERVER_ID);
+     }
+-    nsCOMPtr<nsIWebProgress> progress(do_GetService(NS_DOCUMENTLOADER_SERVICE_CONTRACTID));
++    nsIWebProgress* progress(do_GetService(NS_DOCUMENTLOADER_SERVICE_CONTRACTID));
+     if (progress) {
+       progress->RemoveProgressListener(static_cast<nsIWebProgressListener*>(this));
+     }
+@@ -172,23 +172,23 @@ NS_IMETHODIMP nsAccessibilityService::On
+     return NS_OK;
+   }
+ 
+-  nsCOMPtr<nsIDOMWindow> domWindow;
+-  aWebProgress->GetDOMWindow(getter_AddRefs(domWindow));
++  nsIDOMWindow* domWindow;
++  aWebProgress->GetDOMWindow(&domWindow);
+   NS_ASSERTION(domWindow, "DOM Window for state change is null");
+   NS_ENSURE_TRUE(domWindow, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIDOMDocument> domDoc;
+-  domWindow->GetDocument(getter_AddRefs(domDoc));
+-  nsCOMPtr<nsIDOMNode> domDocRootNode(do_QueryInterface(domDoc));
++  nsIDOMDocument* domDoc;
++  domWindow->GetDocument(&domDoc);
++  nsIDOMNode* domDocRootNode(do_QueryInterface(domDoc));
+   NS_ENSURE_TRUE(domDocRootNode, NS_ERROR_FAILURE);
+ 
+   // Get the accessible for the new document.
+   // If it not created yet this will create it & cache it, as well as 
+   // set up event listeners so that MSAA/ATK toolkit and internal 
+   // accessibility events will get fired.
+-  nsCOMPtr<nsIAccessible> accessible;
+-  GetAccessibleFor(domDocRootNode, getter_AddRefs(accessible));
+-  nsCOMPtr<nsPIAccessibleDocument> docAccessible =
++  nsIAccessible* accessible;
++  GetAccessibleFor(domDocRootNode, &accessible);
++  nsPIAccessibleDocument* docAccessible =
+     do_QueryInterface(accessible);
+   NS_ENSURE_TRUE(docAccessible, NS_ERROR_FAILURE);
+ 
+@@ -199,8 +199,8 @@ NS_IMETHODIMP nsAccessibilityService::On
+     eventType = nsIAccessibleEvent::EVENT_DOCUMENT_LOAD_STOPPED;
+   } else if (aStateFlags & STATE_START) {
+     eventType = nsIAccessibleEvent::EVENT_DOCUMENT_LOAD_START;
+-    nsCOMPtr<nsIWebNavigation> webNav(do_GetInterface(domWindow));
+-    nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(webNav));
++    nsIWebNavigation* webNav(do_GetInterface(domWindow));
++    nsIDocShell* docShell(do_QueryInterface(webNav));
+     NS_ENSURE_TRUE(docShell, NS_ERROR_FAILURE);
+     PRUint32 loadType;
+     docShell->GetLoadType(&loadType);
+@@ -238,19 +238,19 @@ NS_IMETHODIMP nsAccessibilityService::On
+   // If there is no accessible for the document, we will ignore
+   // this and the anchor jump event will be fired via OnStateChange
+   // and nsIAccessibleStates::STATE_STOP
+-  nsCOMPtr<nsIDOMWindow> domWindow;
+-  aWebProgress->GetDOMWindow(getter_AddRefs(domWindow));
++  nsIDOMWindow* domWindow;
++  aWebProgress->GetDOMWindow(&domWindow);
+   NS_ASSERTION(domWindow, "DOM Window for state change is null");
+   NS_ENSURE_TRUE(domWindow, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIDOMDocument> domDoc;
+-  domWindow->GetDocument(getter_AddRefs(domDoc));
+-  nsCOMPtr<nsIDOMNode> domDocRootNode(do_QueryInterface(domDoc));
++  nsIDOMDocument* domDoc;
++  domWindow->GetDocument(&domDoc);
++  nsIDOMNode* domDocRootNode(do_QueryInterface(domDoc));
+   NS_ENSURE_TRUE(domDocRootNode, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIAccessibleDocument> accessibleDoc =
++  nsIAccessibleDocument* accessibleDoc =
+     nsAccessNode::GetDocAccessibleFor(domDocRootNode);
+-  nsCOMPtr<nsPIAccessibleDocument> privateAccessibleDoc =
++  nsPIAccessibleDocument* privateAccessibleDoc =
+     do_QueryInterface(accessibleDoc);
+   if (!privateAccessibleDoc) {
+     return NS_OK;
+@@ -280,20 +280,20 @@ nsAccessibilityService::GetInfo(nsISuppo
+ {
+   NS_ASSERTION(aFrame,"Error -- 1st argument (aFrame) is null!!");
+   *aRealFrame = static_cast<nsIFrame*>(aFrame);
+-  nsCOMPtr<nsIContent> content = (*aRealFrame)->GetContent();
+-  nsCOMPtr<nsIDOMNode> node(do_QueryInterface(content));
++  nsIContent* content = (*aRealFrame)->GetContent();
++  nsIDOMNode* node(do_QueryInterface(content));
+   if (!content || !node)
+     return NS_ERROR_FAILURE;
+   *aNode = node;
+ 
+-  nsCOMPtr<nsIDocument> document = content->GetDocument();
++  nsIDocument* document = content->GetDocument();
+   if (!document)
+     return NS_ERROR_FAILURE;
+ 
+   NS_ASSERTION(document->GetPrimaryShell(),"Error no shells!");
+ 
+   // do_GetWR only works into a |nsCOMPtr| :-(
+-  nsCOMPtr<nsIWeakReference> weakShell =
++  nsIWeakReference* weakShell =
+     do_GetWeakReference(document->GetPrimaryShell());
+   *aShell = weakShell;
+ 
+@@ -303,9 +303,9 @@ nsresult
+ nsresult
+ nsAccessibilityService::GetShellFromNode(nsIDOMNode *aNode, nsIWeakReference **aWeakShell)
+ {
+-  nsCOMPtr<nsIDOMDocument> domDoc;
+-  aNode->GetOwnerDocument(getter_AddRefs(domDoc));
+-  nsCOMPtr<nsIDocument> doc(do_QueryInterface(domDoc));
++  nsIDOMDocument* domDoc;
++  aNode->GetOwnerDocument(&domDoc);
++  nsIDocument* doc(do_QueryInterface(domDoc));
+   if (!doc)
+     return NS_ERROR_INVALID_ARG;
+ 
+@@ -314,7 +314,7 @@ nsAccessibilityService::GetShellFromNode
+   if (!shell)
+     return NS_ERROR_FAILURE;
+ 
+-  nsCOMPtr<nsIWeakReference> weakRef(do_GetWeakReference(shell));
++  nsIWeakReference* weakRef(do_GetWeakReference(shell));
+   
+   *aWeakShell = weakRef;
+ 
+@@ -333,8 +333,8 @@ nsAccessibilityService::CreateOuterDocAc
+   
+   *aOuterDocAccessible = nsnull;
+ 
+-  nsCOMPtr<nsIWeakReference> outerWeakShell;
+-  GetShellFromNode(aDOMNode, getter_AddRefs(outerWeakShell));
++  nsIWeakReference* outerWeakShell;
++  GetShellFromNode(aDOMNode, &outerWeakShell);
+   NS_ENSURE_TRUE(outerWeakShell, NS_ERROR_FAILURE);
+ 
+   nsOuterDocAccessible *outerDocAccessible =
+@@ -353,22 +353,22 @@ nsAccessibilityService::CreateRootAccess
+ {
+   *aRootAcc = nsnull;
+ 
+-  nsCOMPtr<nsIDOMNode> rootNode(do_QueryInterface(aDocument));
++  nsIDOMNode* rootNode(do_QueryInterface(aDocument));
+   NS_ENSURE_TRUE(rootNode, NS_ERROR_FAILURE);
+ 
+   nsIPresShell *presShell = aShell;
+   if (!presShell) {
+     presShell = aDocument->GetPrimaryShell();
+   }
+-  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(presShell));
+-
+-  nsCOMPtr<nsISupports> container = aDocument->GetContainer();
+-  nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem =
++  nsIWeakReference* weakShell(do_GetWeakReference(presShell));
++
++  nsISupports* container = aDocument->GetContainer();
++  nsIDocShellTreeItem* docShellTreeItem =
+     do_QueryInterface(container);
+   NS_ENSURE_TRUE(docShellTreeItem, NS_ERROR_FAILURE);
+   
+-  nsCOMPtr<nsIDocShellTreeItem> parentTreeItem;
+-  docShellTreeItem->GetParent(getter_AddRefs(parentTreeItem));
++  nsIDocShellTreeItem* parentTreeItem;
++  docShellTreeItem->GetParent(&parentTreeItem);
+ 
+   if (parentTreeItem) {
+     // We only create root accessibles for the true root, othewise create a
+@@ -381,7 +381,7 @@ nsAccessibilityService::CreateRootAccess
+   if (!*aRootAcc)
+     return NS_ERROR_OUT_OF_MEMORY;
+ 
+-  nsCOMPtr<nsPIAccessNode> privateAccessNode(do_QueryInterface(*aRootAcc));
++  nsPIAccessNode* privateAccessNode(do_QueryInterface(*aRootAcc));
+   privateAccessNode->Init();
+ 
+ 
+@@ -395,9 +395,9 @@ nsAccessibilityService::CreateHTML4Butto
+ nsAccessibilityService::CreateHTML4ButtonAccessible(nsISupports *aFrame, nsIAccessible **_retval)
+ {
+   nsIFrame* frame;
+-  nsCOMPtr<nsIDOMNode> node;
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
++  nsIDOMNode* node;
++  nsIWeakReference* weakShell;
++  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -412,9 +412,9 @@ nsAccessibilityService::CreateHTMLButton
+ nsAccessibilityService::CreateHTMLButtonAccessible(nsISupports *aFrame, nsIAccessible **_retval)
+ {
+   nsIFrame* frame;
+-  nsCOMPtr<nsIDOMNode> node;
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
++  nsIDOMNode* node;
++  nsIWeakReference* weakShell;
++  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -433,7 +433,7 @@ nsAccessibilityService::CreateHTMLAccess
+ {
+   // This method assumes we're in an HTML namespace.
+   *aAccessible = nsnull;
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(aNode));
++  nsIContent* content(do_QueryInterface(aNode));
+   nsIAtom *tag = content->Tag();
+   if (tag == nsAccessibilityAtoms::legend) {
+     *aAccessible = new nsHTMLLegendAccessible(aNode, aWeakShell);
+@@ -486,9 +486,9 @@ nsAccessibilityService::CreateHTMLLIAcce
+                                                nsIAccessible **_retval)
+ {
+   nsIFrame* frame;
+-  nsCOMPtr<nsIDOMNode> node;
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
++  nsIDOMNode* node;
++  nsIWeakReference* weakShell;
++  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -503,13 +503,13 @@ nsAccessibilityService::CreateHyperTextA
+ nsAccessibilityService::CreateHyperTextAccessible(nsISupports *aFrame, nsIAccessible **aAccessible)
+ {
+   nsIFrame* frame;
+-  nsCOMPtr<nsIDOMNode> node;
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
++  nsIDOMNode* node;
++  nsIWeakReference* weakShell;
++  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(node));
++  nsIContent* content(do_QueryInterface(node));
+   NS_ENSURE_TRUE(content, NS_ERROR_FAILURE);
+   
+   if (nsAccUtils::HasListener(content, NS_LITERAL_STRING("click"))) {
+@@ -530,9 +530,9 @@ nsAccessibilityService::CreateHTMLCheckb
+ nsAccessibilityService::CreateHTMLCheckboxAccessible(nsISupports *aFrame, nsIAccessible **_retval)
+ {
+   nsIFrame* frame;
+-  nsCOMPtr<nsIDOMNode> node;
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
++  nsIDOMNode* node;
++  nsIWeakReference* weakShell;
++  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -557,14 +557,14 @@ nsAccessibilityService::CreateHTMLImageA
+ nsAccessibilityService::CreateHTMLImageAccessible(nsISupports *aFrame, nsIAccessible **_retval)
+ {
+   nsIFrame* frame;
+-  nsCOMPtr<nsIDOMNode> node;
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
++  nsIDOMNode* node;
++  nsIWeakReference* weakShell;
++  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+   *_retval = nsnull;
+-  nsCOMPtr<nsIDOMElement> domElement(do_QueryInterface(node));
++  nsIDOMElement* domElement(do_QueryInterface(node));
+   if (domElement) {
+       *_retval = new nsHTMLImageAccessibleWrap(node, weakShell);
+   }
+@@ -585,9 +585,9 @@ nsAccessibilityService::CreateHTMLGroupb
+ nsAccessibilityService::CreateHTMLGroupboxAccessible(nsISupports *aFrame, nsIAccessible **_retval)
+ {
+   nsIFrame* frame;
+-  nsCOMPtr<nsIDOMNode> node;
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
++  nsIDOMNode* node;
++  nsIWeakReference* weakShell;
++  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -621,20 +621,20 @@ nsAccessibilityService::CreateHTMLObject
+ nsAccessibilityService::CreateHTMLObjectFrameAccessible(nsObjectFrame *aFrame,
+                                                         nsIAccessible **aAccessible)
+ {
+-  nsCOMPtr<nsIDOMNode> node;
+-  nsCOMPtr<nsIWeakReference> weakShell;
++  nsIDOMNode* node;
++  nsIWeakReference* weakShell;
+   nsIFrame *frame;
+-  GetInfo(static_cast<nsIFrame*>(aFrame), &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
++  GetInfo(static_cast<nsIFrame*>(aFrame), &frame, &weakShell, &node);
+ 
+   *aAccessible = nsnull;
+   if (!frame || frame->GetRect().IsEmpty()) {
+     return NS_ERROR_FAILURE;
+   }
+   // 1) for object elements containing either HTML or TXT documents
+-  nsCOMPtr<nsIDOMDocument> domDoc;
+-  nsCOMPtr<nsIDOMHTMLObjectElement> obj(do_QueryInterface(node));
++  nsIDOMDocument* domDoc;
++  nsIDOMHTMLObjectElement* obj(do_QueryInterface(node));
+   if (obj)
+-    obj->GetContentDocument(getter_AddRefs(domDoc));
++    obj->GetContentDocument(&domDoc);
+   else
+     domDoc = do_QueryInterface(node);
+   if (domDoc)
+@@ -669,9 +669,9 @@ nsAccessibilityService::CreateHTMLRadioB
+ nsAccessibilityService::CreateHTMLRadioButtonAccessible(nsISupports *aFrame, nsIAccessible **_retval)
+ {
+   nsIFrame* frame;
+-  nsCOMPtr<nsIDOMNode> node;
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
++  nsIDOMNode* node;
++  nsIWeakReference* weakShell;
++  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -699,9 +699,9 @@ nsAccessibilityService::CreateHTMLTableA
+ nsAccessibilityService::CreateHTMLTableAccessible(nsISupports *aFrame, nsIAccessible **_retval)
+ {
+   nsIFrame* frame;
+-  nsCOMPtr<nsIDOMNode> node;
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
++  nsIDOMNode* node;
++  nsIWeakReference* weakShell;
++  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -723,8 +723,8 @@ nsAccessibilityService::CreateHTMLTableH
+ 
+   nsresult rv = NS_OK;
+ 
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  rv = GetShellFromNode(aDOMNode, getter_AddRefs(weakShell));
++  nsIWeakReference* weakShell;
++  rv = GetShellFromNode(aDOMNode, &weakShell);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+   nsHTMLTableHeadAccessibleWrap* accTableHead =
+@@ -742,9 +742,9 @@ nsAccessibilityService::CreateHTMLTableC
+ nsAccessibilityService::CreateHTMLTableCellAccessible(nsISupports *aFrame, nsIAccessible **_retval)
+ {
+   nsIFrame* frame;
+-  nsCOMPtr<nsIDOMNode> node;
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
++  nsIDOMNode* node;
++  nsIWeakReference* weakShell;
++  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -761,9 +761,9 @@ nsAccessibilityService::CreateHTMLTextAc
+   *_retval = nsnull;
+ 
+   nsIFrame* frame;
+-  nsCOMPtr<nsIDOMNode> node;
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
++  nsIDOMNode* node;
++  nsIWeakReference* weakShell;
++  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -779,9 +779,9 @@ nsAccessibilityService::CreateHTMLTextFi
+ nsAccessibilityService::CreateHTMLTextFieldAccessible(nsISupports *aFrame, nsIAccessible **_retval)
+ {
+   nsIFrame* frame;
+-  nsCOMPtr<nsIDOMNode> node;
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
++  nsIDOMNode* node;
++  nsIWeakReference* weakShell;
++  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -796,9 +796,9 @@ nsAccessibilityService::CreateHTMLLabelA
+ nsAccessibilityService::CreateHTMLLabelAccessible(nsISupports *aFrame, nsIAccessible **_retval)
+ {
+   nsIFrame* frame;
+-  nsCOMPtr<nsIDOMNode> node;
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
++  nsIDOMNode* node;
++  nsIWeakReference* weakShell;
++  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -813,9 +813,9 @@ nsAccessibilityService::CreateHTMLHRAcce
+ nsAccessibilityService::CreateHTMLHRAccessible(nsISupports *aFrame, nsIAccessible **_retval)
+ {
+   nsIFrame* frame;
+-  nsCOMPtr<nsIDOMNode> node;
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
++  nsIDOMNode* node;
++  nsIWeakReference* weakShell;
++  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -830,9 +830,9 @@ nsAccessibilityService::CreateHTMLBRAcce
+ nsAccessibilityService::CreateHTMLBRAccessible(nsISupports *aFrame, nsIAccessible **_retval)
+ {
+   nsIFrame* frame;
+-  nsCOMPtr<nsIDOMNode> node;
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
++  nsIDOMNode* node;
++  nsIWeakReference* weakShell;
++  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -847,9 +847,9 @@ nsAccessibilityService::CreateHTMLCaptio
+ nsAccessibilityService::CreateHTMLCaptionAccessible(nsISupports *aFrame, nsIAccessible **_retval)
+ {
+   nsIFrame* frame;
+-  nsCOMPtr<nsIDOMNode> node;
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
++  nsIDOMNode* node;
++  nsIWeakReference* weakShell;
++  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -864,9 +864,9 @@ NS_IMETHODIMP nsAccessibilityService::Ge
+                                                           nsIWeakReference *aWeakShell,
+                                                           nsIAccessible **aAccessible)
+ {
+-  nsCOMPtr<nsIAccessNode> accessNode;
+-  nsresult rv = GetCachedAccessNode(aNode, aWeakShell, getter_AddRefs(accessNode));
+-  nsCOMPtr<nsIAccessible> accessible(do_QueryInterface(accessNode));
++  nsIAccessNode* accessNode;
++  nsresult rv = GetCachedAccessNode(aNode, aWeakShell, &accessNode);
++  nsIAccessible* accessible(do_QueryInterface(accessNode));
+   *aAccessible = accessible;
+   return rv;
+ }
+@@ -875,7 +875,7 @@ NS_IMETHODIMP nsAccessibilityService::Ge
+                                                           nsIWeakReference *aWeakShell,
+                                                           nsIAccessNode **aAccessNode)
+ {
+-  nsCOMPtr<nsIAccessibleDocument> accessibleDoc =
++  nsIAccessibleDocument* accessibleDoc =
+     nsAccessNode::GetDocAccessibleFor(aWeakShell);
+ 
+   if (!accessibleDoc) {
+@@ -1061,8 +1061,8 @@ nsAccessibilityService::GetAccessibleFor
+ 
+   // We use presentation shell #0 because we assume that is presentation of
+   // given node window.
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(aNode));
+-  nsCOMPtr<nsIDocument> doc;
++  nsIContent* content(do_QueryInterface(aNode));
++  nsIDocument* doc;
+   if (content) {
+     doc = content->GetDocument();
+   }
+@@ -1085,8 +1085,8 @@ nsAccessibilityService::GetAttachedAcces
+ 
+   *aAccessible = nsnull;
+ 
+-  nsCOMPtr<nsIDOMNode> relevantNode;
+-  nsresult rv = GetRelevantContentNodeFor(aNode, getter_AddRefs(relevantNode));
++  nsIDOMNode* relevantNode;
++  nsresult rv = GetRelevantContentNodeFor(aNode, &relevantNode);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+   if (relevantNode != aNode)
+@@ -1105,13 +1105,13 @@ NS_IMETHODIMP nsAccessibilityService::Ge
+   NS_ENSURE_ARG(aNode);
+   NS_ENSURE_ARG(aWin);
+ 
+-  nsCOMPtr<nsIWebNavigation> webNav(do_GetInterface(aWin));
+-  nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(webNav));
++  nsIWebNavigation* webNav(do_GetInterface(aWin));
++  nsIDocShell* docShell(do_QueryInterface(webNav));
+   if (!docShell)
+     return NS_ERROR_FAILURE;
+ 
+-  nsCOMPtr<nsIPresShell> presShell;
+-  docShell->GetPresShell(getter_AddRefs(presShell));
++  nsIPresShell* presShell;
++  docShell->GetPresShell(&presShell);
+   return GetAccessibleInShell(aNode, presShell, aAccessible);
+ }
+ 
+@@ -1125,7 +1125,7 @@ NS_IMETHODIMP nsAccessibilityService::Ge
+   NS_ENSURE_ARG(aNode);
+   NS_ENSURE_ARG(aPresShell);
+ 
+-  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
++  nsIWeakReference* weakShell(do_GetWeakReference(aPresShell));
+   nsIFrame *outFrameUnused = NULL;
+   PRBool isHiddenUnused = false;
+   return GetAccessible(aNode, aPresShell, weakShell, 
+@@ -1142,7 +1142,7 @@ NS_IMETHODIMP nsAccessibilityService::Ge
+   NS_ENSURE_ARG(aNode);
+   NS_ENSURE_ARG(aWeakShell);
+ 
+-  nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(aWeakShell));
++  nsIPresShell* presShell(do_QueryReferent(aWeakShell));
+   nsIFrame *outFrameUnused = NULL;
+   PRBool isHiddenUnused = false;
+   return GetAccessible(aNode, presShell, aWeakShell, 
+@@ -1157,7 +1157,7 @@ nsresult nsAccessibilityService::InitAcc
+   }
+   NS_ASSERTION(aAccessibleOut && !*aAccessibleOut, "Out param should already be cleared out");
+ 
+-  nsCOMPtr<nsPIAccessNode> privateAccessNode = do_QueryInterface(aAccessibleIn);
++  nsPIAccessNode* privateAccessNode = do_QueryInterface(aAccessibleIn);
+   NS_ASSERTION(privateAccessNode, "All accessibles must support nsPIAccessNode");
+   nsresult rv = privateAccessNode->Init(); // Add to cache, etc.
+   if (NS_SUCCEEDED(rv)) {
+@@ -1200,7 +1200,7 @@ NS_IMETHODIMP nsAccessibilityService::Ge
+   }
+ #endif
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(aNode));
++  nsIContent* content(do_QueryInterface(aNode));
+   if (content && content->Tag() == nsAccessibilityAtoms::map) {
+     // Don't walk into maps, they take up no space.
+     // The nsHTMLAreaAccessible's they contain are attached as
+@@ -1211,10 +1211,10 @@ NS_IMETHODIMP nsAccessibilityService::Ge
+ 
+   // Check to see if we already have an accessible for this
+   // node in the cache
+-  nsCOMPtr<nsIAccessNode> accessNode;
+-  GetCachedAccessNode(aNode, aWeakShell, getter_AddRefs(accessNode));
+-
+-  nsCOMPtr<nsIAccessible> newAcc;
++  nsIAccessNode* accessNode;
++  GetCachedAccessNode(aNode, aWeakShell, &accessNode);
++
++  nsIAccessible* newAcc;
+   if (accessNode) {
+     // Retrieved from cache
+     // QI might not succeed if it's a node that's not accessible
+@@ -1225,21 +1225,21 @@ NS_IMETHODIMP nsAccessibilityService::Ge
+ 
+   // No cache entry, so we must create the accessible
+   // Check to see if hidden first
+-  nsCOMPtr<nsIDocument> nodeIsDoc;
++  nsIDocument* nodeIsDoc;
+   if (!content) {
+     // This happens when we're on the document node, which will not QI to an
+     // nsIContent.
+     nodeIsDoc = do_QueryInterface(aNode);
+     NS_ENSURE_TRUE(nodeIsDoc, NS_ERROR_FAILURE); // No content, and not doc node
+ 
+-    nsCOMPtr<nsIAccessibleDocument> accessibleDoc =
++    nsIAccessibleDocument* accessibleDoc =
+       nsAccessNode::GetDocAccessibleFor(aWeakShell);
+     if (accessibleDoc) {
+       newAcc = do_QueryInterface(accessibleDoc);
+       NS_ASSERTION(newAcc, "nsIAccessibleDocument is not an nsIAccessible");
+     }
+     else {
+-      CreateRootAccessible(aPresShell, nodeIsDoc, getter_AddRefs(newAcc)); // Does Init() for us
++      CreateRootAccessible(aPresShell, nodeIsDoc, &newAcc); // Does Init() for us
+       NS_WARN_IF_FALSE(newAcc, "No root/doc accessible created");
+     }
+ 
+@@ -1288,10 +1288,10 @@ NS_IMETHODIMP nsAccessibilityService::Ge
+         // Check if frame is an image frame, and content is <area>
+         nsIImageFrame *imageFrame;
+         CallQueryInterface(frame, &imageFrame);
+-        nsCOMPtr<nsIDOMHTMLAreaElement> areaElmt = do_QueryInterface(content);
++        nsIDOMHTMLAreaElement* areaElmt = do_QueryInterface(content);
+         if (imageFrame && areaElmt) {
+-          nsCOMPtr<nsIAccessible> imageAcc;
+-          CreateHTMLImageAccessible(frame, getter_AddRefs(imageAcc));
++          nsIAccessible* imageAcc;
++          CreateHTMLImageAccessible(frame, &imageAcc);
+           if (imageAcc) {
+             // cache children
+             PRInt32 childCount;
+@@ -1324,7 +1324,7 @@ NS_IMETHODIMP nsAccessibilityService::Ge
+       *aIsHidden = PR_TRUE;
+       return NS_OK;
+     }
+-    frame->GetAccessible(getter_AddRefs(newAcc));
++    frame->GetAccessible(&newAcc);
+     return InitAccessible(newAcc, aAccessible);
+   }
+ 
+@@ -1338,7 +1338,7 @@ NS_IMETHODIMP nsAccessibilityService::Ge
+ 
+   // Elements may implement nsIAccessibleProvider via XBL. This allows them to
+   // say what kind of accessible to create.
+-  nsresult rv = GetAccessibleByType(aNode, getter_AddRefs(newAcc));
++  nsresult rv = GetAccessibleByType(aNode, &newAcc);
+   NS_ENSURE_SUCCESS(rv, rv);
+   
+   PRBool isHTML = content->IsNodeOfType(nsINode::eHTML);
+@@ -1391,7 +1391,7 @@ NS_IMETHODIMP nsAccessibilityService::Ge
+       // we do not call it if accessibles for table related content are
+       // prevented above.
+       rv = CreateHTMLAccessibleByMarkup(frame, aWeakShell, aNode,
+-                                        getter_AddRefs(newAcc));
++                                        &newAcc);
+       NS_ENSURE_SUCCESS(rv, rv);
+ 
+       if (!newAcc) {
+@@ -1408,13 +1408,13 @@ NS_IMETHODIMP nsAccessibilityService::Ge
+           *aIsHidden = PR_TRUE;
+           return NS_OK;
+         }
+-        frame->GetAccessible(getter_AddRefs(newAcc)); // Try using frame to do it
++        frame->GetAccessible(&newAcc); // Try using frame to do it
+       }
+     }
+   }
+ 
+   if (!newAcc) {
+-    GetAccessibleForDeckChildren(aNode, getter_AddRefs(newAcc));
++    GetAccessibleForDeckChildren(aNode, &newAcc);
+   }
+ 
+   // If no accessible, see if we need to create a generic accessible because
+@@ -1430,7 +1430,7 @@ NS_IMETHODIMP nsAccessibilityService::Ge
+     // other accessibles can point to it, or so that it can hold a state, etc.
+     if (isHTML) {
+       // Interesting HTML container which may have selectable text and/or embedded objects
+-      CreateHyperTextAccessible(frame, getter_AddRefs(newAcc));
++      CreateHyperTextAccessible(frame, &newAcc);
+     }
+     else {  // XUL, SVG, MathML etc.
+       // Interesting generic non-HTML container
+@@ -1445,7 +1445,7 @@ nsAccessibilityService::HasUniversalAria
+ nsAccessibilityService::HasUniversalAriaProperty(nsIContent *aContent,
+                                                  nsIWeakReference *aWeakShell)
+ {
+-  nsCOMPtr<nsIAccessibleDocument> docAccessible =
++  nsIAccessibleDocument* docAccessible =
+     nsAccessNode::GetDocAccessibleFor(aWeakShell);
+   if (!docAccessible) {
+     return PR_FALSE;
+@@ -1501,7 +1501,7 @@ nsAccessibilityService::GetRelevantConte
+   NS_ENSURE_ARG_POINTER(aRelevantNode);
+ 
+   nsresult rv;
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(aNode));
++  nsIContent* content(do_QueryInterface(aNode));
+   if (content) {
+     // Build stack of binding parents so we can walk it in reverse.
+     nsIContent *bindingParent;
+@@ -1516,15 +1516,15 @@ nsAccessibilityService::GetRelevantConte
+     PRInt32 bindingsCount = bindingsStack.Count();
+     for (PRInt32 index = bindingsCount - 1; index >= 0 ; index--) {
+       bindingParent = bindingsStack[index];
+-      nsCOMPtr<nsIDOMNode> bindingNode(do_QueryInterface(bindingParent));
++      nsIDOMNode* bindingNode(do_QueryInterface(bindingParent));
+       if (bindingNode) {
+         // Try to get an accessible by type since XBL widget can be accessible
+         // only if it implements nsIAccessibleProvider interface.
+-        nsCOMPtr<nsIAccessible> accessible;
+-        rv = GetAccessibleByType(bindingNode, getter_AddRefs(accessible));
++        nsIAccessible* accessible;
++        rv = GetAccessibleByType(bindingNode, &accessible);
+ 
+         if (NS_SUCCEEDED(rv)) {
+-          nsCOMPtr<nsPIAccessible> paccessible(do_QueryInterface(accessible));
++          nsPIAccessible* paccessible(do_QueryInterface(accessible));
+           if (paccessible) {
+             PRBool allowsAnonChildren = PR_FALSE;
+             paccessible->GetAllowsAnonChildAccessibles(&allowsAnonChildren);
+@@ -1550,7 +1550,7 @@ nsresult nsAccessibilityService::GetAcce
+ 
+   *aAccessible = nsnull;
+ 
+-  nsCOMPtr<nsIAccessibleProvider> accessibleProvider(do_QueryInterface(aNode));
++  nsIAccessibleProvider* accessibleProvider(do_QueryInterface(aNode));
+   if (!accessibleProvider)
+     return NS_OK;
+ 
+@@ -1561,8 +1561,8 @@ nsresult nsAccessibilityService::GetAcce
+   if (type == nsIAccessibleProvider::OuterDoc)
+     return CreateOuterDocAccessible(aNode, aAccessible);
+ 
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  GetShellFromNode(aNode, getter_AddRefs(weakShell));
++  nsIWeakReference* weakShell;
++  GetShellFromNode(aNode, &weakShell);
+ 
+   switch (type)
+   {
+@@ -1595,7 +1595,7 @@ nsresult nsAccessibilityService::GetAcce
+     case nsIAccessibleProvider::XULImage:
+     {
+       // Don't include nameless images in accessible tree
+-      nsCOMPtr<nsIDOMElement> elt(do_QueryInterface(aNode));
++      nsIDOMElement* elt(do_QueryInterface(aNode));
+       if (!elt)
+         return NS_ERROR_FAILURE;
+ 
+@@ -1637,7 +1637,7 @@ nsresult nsAccessibilityService::GetAcce
+       // XXX In the future we will should this for consistency across the nsIAccessible
+       // implementations on each platform for a consistent scripting environment, but
+       // then strip out redundant accessibles in the nsAccessibleWrap class for each platform.
+-      nsCOMPtr<nsIContent> content = do_QueryInterface(aNode);
++      nsIContent* content = do_QueryInterface(aNode);
+       if (content) {
+         nsIContent *parent = content->GetParent();
+         if (parent && parent->NodeInfo()->Equals(nsAccessibilityAtoms::menu, kNameSpaceID_XUL)) {
+@@ -1788,7 +1788,7 @@ NS_IMETHODIMP nsAccessibilityService::Ad
+ 
+   *aRootAccessible = static_cast<nsIAccessible*>(rootAccWrap);
+ 
+-  nsRefPtr<nsApplicationAccessibleWrap> appRoot =
++  nsApplicationAccessibleWrap* appRoot =
+     nsAccessNode::GetApplicationAccessible();
+   NS_ENSURE_STATE(appRoot);
+ 
+@@ -1806,7 +1806,7 @@ NS_IMETHODIMP nsAccessibilityService::Re
+   void* atkAccessible;
+   aRootAccessible->GetNativeInterface(&atkAccessible);
+ 
+-  nsRefPtr<nsApplicationAccessibleWrap> appRoot =
++  nsApplicationAccessibleWrap* appRoot =
+     nsAccessNode::GetApplicationAccessible();
+   NS_ENSURE_STATE(appRoot);
+ 
+@@ -1832,10 +1832,10 @@ NS_IMETHODIMP nsAccessibilityService::In
+                "Incorrect aEvent passed in");
+ 
+   NS_ENSURE_ARG_POINTER(aShell);
+-  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aShell));
+-  nsCOMPtr<nsIAccessibleDocument> accessibleDoc =
++  nsIWeakReference* weakShell(do_GetWeakReference(aShell));
++  nsIAccessibleDocument* accessibleDoc =
+     nsAccessNode::GetDocAccessibleFor(weakShell);
+-  nsCOMPtr<nsPIAccessibleDocument> privateAccessibleDoc =
++  nsPIAccessibleDocument* privateAccessibleDoc =
+     do_QueryInterface(accessibleDoc);
+   if (!privateAccessibleDoc) {
+     return NS_OK;
+@@ -1873,15 +1873,15 @@ nsresult
+ nsresult
+ nsAccessibilityService::GetAccessibleForDeckChildren(nsIDOMNode *aNode, nsIAccessible** aAccessible)
+ {
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  GetShellFromNode(aNode, getter_AddRefs(weakShell));
++  nsIWeakReference* weakShell;
++  GetShellFromNode(aNode, &weakShell);
+   NS_ENSURE_TRUE(weakShell, NS_ERROR_FAILURE);
+-  nsCOMPtr<nsIPresShell> shell(do_QueryReferent(weakShell));
++  nsIPresShell* shell(do_QueryReferent(weakShell));
+   NS_ENSURE_TRUE(shell, NS_ERROR_FAILURE);
+   
+   nsIFrame* frame = nsnull;
+   nsIFrame* parentFrame = nsnull;
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(aNode));
++  nsIContent* content(do_QueryInterface(aNode));
+ 
+   if (content) {
+     frame = shell->GetPrimaryFrameFor(content);
+diff --git a/accessible/src/base/nsAccessibilityUtils.cpp b/accessible/src/base/nsAccessibilityUtils.cpp
+--- a/accessible/src/base/nsAccessibilityUtils.cpp
++++ b/accessible/src/base/nsAccessibilityUtils.cpp
+@@ -167,12 +167,12 @@ nsAccUtils::SetAccAttrsForXULSelectContr
+ nsAccUtils::SetAccAttrsForXULSelectControlItem(nsIDOMNode *aNode,
+                                                nsIPersistentProperties *aAttributes)
+ {
+-  nsCOMPtr<nsIDOMXULSelectControlItemElement> item(do_QueryInterface(aNode));
++  nsIDOMXULSelectControlItemElement* item(do_QueryInterface(aNode));
+   if (!item)
+     return;
+ 
+-  nsCOMPtr<nsIDOMXULSelectControlElement> control;
+-  item->GetControl(getter_AddRefs(control));
++  nsIDOMXULSelectControlElement* control;
++  item->GetControl(&control);
+   if (!control)
+     return;
+ 
+@@ -184,13 +184,13 @@ nsAccUtils::SetAccAttrsForXULSelectContr
+ 
+   PRUint32 setSize = itemsCount, posInSet = indexOf;
+   for (PRUint32 index = 0; index < itemsCount; index++) {
+-    nsCOMPtr<nsIDOMXULSelectControlItemElement> currItem;
+-    control->GetItemAtIndex(index, getter_AddRefs(currItem));
+-    nsCOMPtr<nsIDOMNode> currNode(do_QueryInterface(currItem));
+-
+-    nsCOMPtr<nsIAccessible> itemAcc;
++    nsIDOMXULSelectControlItemElement* currItem;
++    control->GetItemAtIndex(index, &currItem);
++    nsIDOMNode* currNode(do_QueryInterface(currItem));
++
++    nsIAccessible* itemAcc;
+     nsAccessNode::GetAccService()->GetAccessibleFor(currNode,
+-                                                    getter_AddRefs(itemAcc));
++                                                    &itemAcc);
+     if (!itemAcc ||
+         nsAccessible::State(itemAcc) & nsIAccessibleStates::STATE_INVISIBLE) {
+       setSize--;
+@@ -206,8 +206,8 @@ nsAccUtils::HasListener(nsIContent *aCon
+ nsAccUtils::HasListener(nsIContent *aContent, const nsAString& aEventType)
+ {
+   NS_ENSURE_ARG_POINTER(aContent);
+-  nsCOMPtr<nsIEventListenerManager> listenerManager;
+-  aContent->GetListenerManager(PR_FALSE, getter_AddRefs(listenerManager));
++  nsIEventListenerManager* listenerManager;
++  aContent->GetListenerManager(PR_FALSE, &listenerManager);
+ 
+   return listenerManager && listenerManager->HasListenersFor(aEventType);  
+ }
+@@ -224,11 +224,11 @@ nsAccUtils::GetAccessKeyFor(nsIContent *
+   if (!aContent->HasAttr(kNameSpaceID_None, nsAccessibilityAtoms::accesskey))
+     return 0;
+ 
+-  nsCOMPtr<nsIDocument> doc = aContent->GetOwnerDoc();
++  nsIDocument* doc = aContent->GetOwnerDoc();
+   if (!doc)
+     return 0;
+ 
+-  nsCOMPtr<nsIPresShell> presShell = doc->GetPrimaryShell();
++  nsIPresShell* presShell = doc->GetPrimaryShell();
+   if (!presShell)
+     return 0;
+ 
+@@ -251,10 +251,10 @@ nsAccUtils::FireAccEvent(PRUint32 aEvent
+ {
+   NS_ENSURE_ARG(aAccessible);
+ 
+-  nsCOMPtr<nsPIAccessible> pAccessible(do_QueryInterface(aAccessible));
++  nsPIAccessible* pAccessible(do_QueryInterface(aAccessible));
+   NS_ASSERTION(pAccessible, "Accessible doesn't implement nsPIAccessible");
+ 
+-  nsCOMPtr<nsIAccessibleEvent> event =
++  nsIAccessibleEvent* event =
+     new nsAccEvent(aEventType, aAccessible, nsnull, aIsAsynch);
+   NS_ENSURE_TRUE(event, NS_ERROR_OUT_OF_MEMORY);
+ 
+@@ -268,23 +268,23 @@ nsAccUtils::IsAncestorOf(nsIDOMNode *aPo
+   NS_ENSURE_ARG_POINTER(aPossibleAncestorNode);
+   NS_ENSURE_ARG_POINTER(aPossibleDescendantNode);
+ 
+-  nsCOMPtr<nsIDOMNode> loopNode = aPossibleDescendantNode;
+-  nsCOMPtr<nsIDOMNode> parentNode;
+-  while (NS_SUCCEEDED(loopNode->GetParentNode(getter_AddRefs(parentNode))) &&
++  nsIDOMNode* loopNode = aPossibleDescendantNode;
++  nsIDOMNode* parentNode;
++  while (NS_SUCCEEDED(loopNode->GetParentNode(&parentNode)) &&
+          parentNode) {
+     if (parentNode == aPossibleAncestorNode) {
+       return PR_TRUE;
+     }
+-    loopNode.swap(parentNode);
++    swap(loopNode, parentNode);
+   }
+   return PR_FALSE;
+ }
+ 
+-already_AddRefed<nsIAccessible>
++nsIAccessible*
+ nsAccUtils::GetAncestorWithRole(nsIAccessible *aDescendant, PRUint32 aRole)
+ {
+-  nsCOMPtr<nsIAccessible> parentAccessible = aDescendant, testRoleAccessible;
+-  while (NS_SUCCEEDED(parentAccessible->GetParent(getter_AddRefs(testRoleAccessible))) &&
++  nsIAccessible* parentAccessible = aDescendant, *testRoleAccessible;
++  while (NS_SUCCEEDED(parentAccessible->GetParent(&testRoleAccessible)) &&
+          testRoleAccessible) {
+     PRUint32 testRole;
+     testRoleAccessible->GetFinalRole(&testRole);
+@@ -292,11 +292,11 @@ nsAccUtils::GetAncestorWithRole(nsIAcces
+       nsIAccessible *returnAccessible = testRoleAccessible;
+       return returnAccessible;
+     }
+-    nsCOMPtr<nsIAccessibleDocument> docAccessible = do_QueryInterface(testRoleAccessible);
++    nsIAccessibleDocument* docAccessible = do_QueryInterface(testRoleAccessible);
+     if (docAccessible) {
+       break;
+     }
+-    parentAccessible.swap(testRoleAccessible);
++    swap(parentAccessible, testRoleAccessible);
+   }
+   return nsnull;
+ }
+@@ -325,21 +325,21 @@ nsAccUtils::ScrollSubstringTo(nsIFrame *
+ 
+   nsPresContext *presContext = aFrame->PresContext();
+ 
+-  nsCOMPtr<nsIDOMRange> scrollToRange = do_CreateInstance(kRangeCID);
++  nsIDOMRange* scrollToRange = do_CreateInstance(kRangeCID);
+   NS_ENSURE_TRUE(scrollToRange, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsISelectionController> selCon;
+-  aFrame->GetSelectionController(presContext, getter_AddRefs(selCon));
++  nsISelectionController* selCon;
++  aFrame->GetSelectionController(presContext, &selCon);
+   NS_ENSURE_TRUE(selCon, NS_ERROR_FAILURE);
+ 
+   scrollToRange->SetStart(aStartNode, aStartIndex);
+   scrollToRange->SetEnd(aEndNode, aEndIndex);
+ 
+-  nsCOMPtr<nsISelection> selection1;
++  nsISelection* selection1;
+   selCon->GetSelection(nsISelectionController::SELECTION_ACCESSIBILITY,
+-                       getter_AddRefs(selection1));
+-
+-  nsCOMPtr<nsISelection2> selection(do_QueryInterface(selection1));
++                       &selection1);
++
++  nsISelection2* selection(do_QueryInterface(selection1));
+   if (selection) {
+     selection->RemoveAllRanges();
+     selection->AddRange(scrollToRange);
+@@ -434,8 +434,8 @@ nsAccUtils::ConvertToScreenCoords(PRInt3
+     {
+       NS_ENSURE_ARG(aAccessNode);
+ 
+-      nsCOMPtr<nsIDOMNode> DOMNode;
+-      aAccessNode->GetDOMNode(getter_AddRefs(DOMNode));
++      nsIDOMNode* DOMNode;
++      aAccessNode->GetDOMNode(&DOMNode);
+       NS_ENSURE_STATE(DOMNode);
+ 
+       nsIntPoint wndCoords = nsAccUtils::GetScreenCoordsForWindow(DOMNode);
+@@ -447,15 +447,15 @@ nsAccUtils::ConvertToScreenCoords(PRInt3
+     {
+       NS_ENSURE_ARG(aAccessNode);
+ 
+-      nsCOMPtr<nsPIAccessNode> parent;
+-      nsCOMPtr<nsIAccessible> accessible(do_QueryInterface(aAccessNode));
++      nsPIAccessNode* parent;
++      nsIAccessible* accessible(do_QueryInterface(aAccessNode));
+       if (accessible) {
+-        nsCOMPtr<nsIAccessible> parentAccessible;
+-        accessible->GetParent(getter_AddRefs(parentAccessible));
++        nsIAccessible* parentAccessible;
++        accessible->GetParent(&parentAccessible);
+         parent = do_QueryInterface(parentAccessible);
+       } else {
+-        nsCOMPtr<nsIAccessNode> parentAccessNode;
+-        aAccessNode->GetParentNode(getter_AddRefs(parentAccessNode));
++        nsIAccessNode* parentAccessNode;
++        aAccessNode->GetParentNode(&parentAccessNode);
+         parent = do_QueryInterface(parentAccessNode);
+       }
+ 
+@@ -481,20 +481,20 @@ nsAccUtils::GetScreenCoordsForWindow(nsI
+ nsAccUtils::GetScreenCoordsForWindow(nsIDOMNode *aNode)
+ {
+   nsIntPoint coords(0, 0);
+-  nsCOMPtr<nsIDocShellTreeItem> treeItem(GetDocShellTreeItemFor(aNode));
++  nsIDocShellTreeItem* treeItem(GetDocShellTreeItemFor(aNode));
+   if (!treeItem)
+     return coords;
+ 
+-  nsCOMPtr<nsIDocShellTreeItem> rootTreeItem;
+-  treeItem->GetRootTreeItem(getter_AddRefs(rootTreeItem));
+-  nsCOMPtr<nsIDOMDocument> domDoc = do_GetInterface(rootTreeItem);
+-  nsCOMPtr<nsIDOMDocumentView> docView(do_QueryInterface(domDoc));
++  nsIDocShellTreeItem* rootTreeItem;
++  treeItem->GetRootTreeItem(&rootTreeItem);
++  nsIDOMDocument* domDoc = do_GetInterface(rootTreeItem);
++  nsIDOMDocumentView* docView(do_QueryInterface(domDoc));
+   if (!docView)
+     return coords;
+ 
+-  nsCOMPtr<nsIDOMAbstractView> abstractView;
+-  docView->GetDefaultView(getter_AddRefs(abstractView));
+-  nsCOMPtr<nsIDOMWindowInternal> windowInter(do_QueryInterface(abstractView));
++  nsIDOMAbstractView* abstractView;
++  docView->GetDefaultView(&abstractView);
++  nsIDOMWindowInternal* windowInter(do_QueryInterface(abstractView));
+   if (!windowInter)
+     return coords;
+ 
+@@ -503,15 +503,15 @@ nsAccUtils::GetScreenCoordsForWindow(nsI
+   return coords;
+ }
+ 
+-already_AddRefed<nsIDocShellTreeItem>
++nsIDocShellTreeItem*
+ nsAccUtils::GetDocShellTreeItemFor(nsIDOMNode *aNode)
+ {
+   if (!aNode)
+     return nsnull;
+ 
+-  nsCOMPtr<nsIDOMDocument> domDoc;
+-  aNode->GetOwnerDocument(getter_AddRefs(domDoc));
+-  nsCOMPtr<nsIDocument> doc(do_QueryInterface(domDoc));
++  nsIDOMDocument* domDoc;
++  aNode->GetOwnerDocument(&domDoc);
++  nsIDocument* doc(do_QueryInterface(domDoc));
+   if (!doc)
+     doc = do_QueryInterface(aNode);
+ 
+@@ -541,12 +541,12 @@ nsAccUtils::GetAriaPropTypes(nsIContent 
+   PRUint32 ariaPropTypes = 0;
+ 
+   // Get the doc accessible using the optimsal methodology
+-  nsCOMPtr<nsIAccessibleDocument> docAccessible;
++  nsIAccessibleDocument* docAccessible;
+   if (aWeakShell) {
+     docAccessible = nsAccessNode::GetDocAccessibleFor(aWeakShell);
+   }
+   else {
+-      nsCOMPtr<nsIDOMNode> node = do_QueryInterface(aContent);
++      nsIDOMNode* node = do_QueryInterface(aContent);
+     if (node) {
+       docAccessible = nsAccessNode::GetDocAccessibleFor(node);
+     }
+@@ -605,7 +605,7 @@ nsAccUtils::FindNeighbourPointingToNode(
+                "Cannot pass in both an ARIA relation property and an atom relation. Choose one");
+   NS_ASSERTION(aAriaProperty == eAria_none || !aTagName,
+                "Cannot use aTagName with ARIA relation property, because ARIA relations apply to any tag");
+-  nsCOMPtr<nsIContent> binding;
++  nsIContent* binding;
+   nsAutoString controlID;
+   if (!nsAccUtils::GetID(aForNode, controlID)) {
+     binding = aForNode->GetBindingParent();
+@@ -628,14 +628,14 @@ nsAccUtils::FindNeighbourPointingToNode(
+     if (aForNode == binding) {
+       // When we reach the binding parent, make sure to check
+       // all of its anonymous child subtrees
+-      nsCOMPtr<nsIDocument> doc = aForNode->GetCurrentDoc();
+-      nsCOMPtr<nsIDOMDocumentXBL> xblDoc(do_QueryInterface(doc));
++      nsIDocument* doc = aForNode->GetCurrentDoc();
++      nsIDOMDocumentXBL* xblDoc(do_QueryInterface(doc));
+       if (!xblDoc)
+         return nsnull;
+ 
+-      nsCOMPtr<nsIDOMNodeList> nodes;
+-      nsCOMPtr<nsIDOMElement> forElm(do_QueryInterface(aForNode));
+-      xblDoc->GetAnonymousNodes(forElm, getter_AddRefs(nodes));
++      nsIDOMNodeList* nodes;
++      nsIDOMElement* forElm(do_QueryInterface(aForNode));
++      xblDoc->GetAnonymousNodes(forElm, &nodes);
+       if (!nodes)
+         return nsnull;
+ 
+@@ -645,12 +645,12 @@ nsAccUtils::FindNeighbourPointingToNode(
+         return nsnull;
+ 
+       for (PRUint32 index = 0; index < length && !labelContent; index++) {
+-        nsCOMPtr<nsIDOMNode> node;
+-        rv = nodes->Item(index, getter_AddRefs(node));
++        nsIDOMNode* node;
++        rv = nodes->Item(index, &node);
+         if (NS_FAILED(rv))
+           return nsnull;
+ 
+-        nsCOMPtr<nsIContent> content = do_QueryInterface(node);
++        nsIContent* content = do_QueryInterface(node);
+         if (!content)
+           return nsnull;
+ 
+diff --git a/accessible/src/base/nsAccessibilityUtils.h b/accessible/src/base/nsAccessibilityUtils.h
+--- a/accessible/src/base/nsAccessibilityUtils.h
++++ b/accessible/src/base/nsAccessibilityUtils.h
+@@ -144,7 +144,7 @@ public:
+     * @param aRole Role to find matching ancestor for
+     * @return The ancestor accessible with the given role, or nsnull if no match is found
+     */
+-   static already_AddRefed<nsIAccessible>
++   static nsIAccessible*
+      GetAncestorWithRole(nsIAccessible *aDescendant, PRUint32 aRole);
+ 
+   /**
+@@ -224,7 +224,7 @@ public:
+   /**
+    * Return document shell tree item for the given DOM node.
+    */
+-  static already_AddRefed<nsIDocShellTreeItem>
++  static nsIDocShellTreeItem*
+     GetDocShellTreeItemFor(nsIDOMNode *aNode);
+ 
+   /**
+diff --git a/accessible/src/base/nsAccessible.cpp b/accessible/src/base/nsAccessible.cpp
+--- a/accessible/src/base/nsAccessible.cpp
++++ b/accessible/src/base/nsAccessible.cpp
+@@ -196,7 +196,7 @@ nsresult nsAccessible::QueryInterface(RE
+   }
+ 
+   if (aIID.Equals(NS_GET_IID(nsIAccessibleSelectable))) {
+-    nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++    nsIContent* content(do_QueryInterface(mDOMNode));
+     if (!content) {
+       return NS_ERROR_FAILURE; // This accessible has been shut down
+     }
+@@ -223,8 +223,8 @@ nsresult nsAccessible::QueryInterface(RE
+   }                       
+ 
+   if (aIID.Equals(NS_GET_IID(nsIAccessibleHyperLink))) {
+-    nsCOMPtr<nsIAccessible> parent(GetParent());
+-    nsCOMPtr<nsIAccessibleHyperText> hyperTextParent(do_QueryInterface(parent));
++    nsIAccessible* parent(GetParent());
++    nsIAccessibleHyperText* hyperTextParent(do_QueryInterface(parent));
+     if (hyperTextParent) {
+       *aInstancePtr = static_cast<nsIAccessibleHyperLink*>(this);
+       return NS_OK;
+@@ -270,7 +270,7 @@ NS_IMETHODIMP nsAccessible::GetName(nsAS
+ NS_IMETHODIMP nsAccessible::GetName(nsAString& aName)
+ {
+   aName.Truncate();
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   if (!content) {
+     return NS_ERROR_FAILURE;  // Node shut down
+   }
+@@ -296,7 +296,7 @@ NS_IMETHODIMP nsAccessible::GetDescripti
+   // 2. It has no DHTML describedby property
+   // 3. it doesn't have an accName; or
+   // 4. its title attribute already equals to its accName nsAutoString name; 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   if (!content) {
+     return NS_ERROR_FAILURE;  // Node shut down
+   }
+@@ -349,7 +349,7 @@ static PRInt32
+ static PRInt32
+ GetAccessModifierMask(nsIContent* aContent)
+ {
+-  nsCOMPtr<nsIPrefBranch> prefBranch =
++  nsIPrefBranch* prefBranch =
+     do_GetService(NS_PREFSERVICE_CONTRACTID);
+   if (!prefBranch)
+     return 0;
+@@ -368,13 +368,13 @@ GetAccessModifierMask(nsIContent* aConte
+   }
+ 
+   // get the docShell to this DOMNode, return 0 on failure
+-  nsCOMPtr<nsIDocument> document = aContent->GetCurrentDoc();
++  nsIDocument* document = aContent->GetCurrentDoc();
+   if (!document)
+     return 0;
+-  nsCOMPtr<nsISupports> container = document->GetContainer();
++  nsISupports* container = document->GetContainer();
+   if (!container)
+     return 0;
+-  nsCOMPtr<nsIDocShellTreeItem> treeItem(do_QueryInterface(container));
++  nsIDocShellTreeItem* treeItem(do_QueryInterface(container));
+   if (!treeItem)
+     return 0;
+ 
+@@ -400,7 +400,7 @@ nsAccessible::GetKeyboardShortcut(nsAStr
+ {
+   aAccessKey.Truncate();
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   if (!content)
+     return NS_ERROR_FAILURE;
+ 
+@@ -408,8 +408,8 @@ nsAccessible::GetKeyboardShortcut(nsAStr
+   if (!key && content->IsNodeOfType(nsIContent::eELEMENT)) {
+     // Copy access key from label node unless it is labeled
+     // via an ancestor <label>, in which case that would be redundant
+-    nsCOMPtr<nsIContent> labelContent(GetLabelContent(content));
+-    nsCOMPtr<nsIDOMNode> labelNode = do_QueryInterface(labelContent);
++    nsIContent* labelContent(GetLabelContent(content));
++    nsIDOMNode* labelNode = do_QueryInterface(labelContent);
+     if (labelNode && !nsAccUtils::IsAncestorOf(labelNode, mDOMNode))
+       key = nsAccUtils::GetAccessKeyFor(labelContent);
+   }
+@@ -447,10 +447,10 @@ NS_IMETHODIMP nsAccessible::SetParent(ns
+ {
+ #ifdef DEBUG
+   if (aParent && aParent != mParent) {
+-    nsCOMPtr<nsPIAccessible> privParent = do_QueryInterface(mParent);
++    nsPIAccessible* privParent = do_QueryInterface(mParent);
+     if (privParent) {
+-      nsCOMPtr<nsIAccessible> firstChild;
+-      privParent->GetCachedFirstChild(getter_AddRefs(firstChild));
++      nsIAccessible* firstChild;
++      privParent->GetCachedFirstChild(&firstChild);
+       NS_ASSERTION(firstChild != this, "Reparenting other node's first child!");
+     }
+   }
+@@ -463,10 +463,10 @@ NS_IMETHODIMP nsAccessible::SetFirstChil
+ {
+ #ifdef DEBUG
+   // If there's parent of this child already, make sure it's us!
+-  nsCOMPtr<nsPIAccessible> privChild = do_QueryInterface(aFirstChild);
++  nsPIAccessible* privChild = do_QueryInterface(aFirstChild);
+   if (privChild) {
+-    nsCOMPtr<nsIAccessible> parent;
+-    privChild->GetCachedParent(getter_AddRefs(parent));
++    nsIAccessible* parent;
++    privChild->GetCachedParent(&parent);
+     NS_ASSERTION(!parent || parent == this, "Stealing child!");
+   }
+ #endif
+@@ -511,19 +511,19 @@ nsIContent *nsAccessible::GetRoleContent
+   // For doc accessibles, first try the <body> if it's HTML and there is
+   // a role attribute used there.
+   // For any other doc accessible , this is the document element.
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(aDOMNode));
++  nsIContent* content(do_QueryInterface(aDOMNode));
+   if (!content) {
+-    nsCOMPtr<nsIDOMDocument> domDoc(do_QueryInterface(aDOMNode));
++    nsIDOMDocument* domDoc(do_QueryInterface(aDOMNode));
+     if (domDoc) {
+-      nsCOMPtr<nsIDOMHTMLDocument> htmlDoc(do_QueryInterface(aDOMNode));
++      nsIDOMHTMLDocument* htmlDoc(do_QueryInterface(aDOMNode));
+       if (htmlDoc) {
+-        nsCOMPtr<nsIDOMHTMLElement> bodyElement;
+-        htmlDoc->GetBody(getter_AddRefs(bodyElement));
++        nsIDOMHTMLElement* bodyElement;
++        htmlDoc->GetBody(&bodyElement);
+         content = do_QueryInterface(bodyElement);
+       }
+       if (!content || !HasRoleAttribute(content)) {
+-        nsCOMPtr<nsIDOMElement> docElement;
+-        domDoc->GetDocumentElement(getter_AddRefs(docElement));
++        nsIDOMElement* docElement;
++        domDoc->GetDocumentElement(&docElement);
+         content = do_QueryInterface(docElement);
+       }
+     }
+@@ -536,10 +536,10 @@ NS_IMETHODIMP nsAccessible::Shutdown()
+   mNextSibling = nsnull;
+   // Make sure none of it's children point to this parent
+   if (mFirstChild) {
+-    nsCOMPtr<nsIAccessible> current(mFirstChild), next;
++    nsIAccessible* current(mFirstChild), *next;
+     while (current) {
+-      nsCOMPtr<nsPIAccessible> privateAcc(do_QueryInterface(current));
+-      current->GetNextSibling(getter_AddRefs(next));
++      nsPIAccessible* privateAcc(do_QueryInterface(current));
++      current->GetNextSibling(&next);
+       privateAcc->SetParent(nsnull);
+       current = next;
+     }
+@@ -547,7 +547,7 @@ NS_IMETHODIMP nsAccessible::Shutdown()
+   // Now invalidate the child count and pointers to other accessibles
+   InvalidateChildren();
+   if (mParent) {
+-    nsCOMPtr<nsPIAccessible> privateParent(do_QueryInterface(mParent));
++    nsPIAccessible* privateParent(do_QueryInterface(mParent));
+     privateParent->InvalidateChildren();
+     mParent = nsnull;
+   }
+@@ -582,7 +582,7 @@ NS_IMETHODIMP nsAccessible::GetParent(ns
+     return rv;
+   }
+ 
+-  nsCOMPtr<nsIAccessibleDocument> docAccessible(GetDocAccessible());
++  nsIAccessibleDocument* docAccessible(GetDocAccessible());
+   NS_ENSURE_TRUE(docAccessible, NS_ERROR_FAILURE);
+ 
+   return docAccessible->GetAccessibleInParentChain(mDOMNode, PR_TRUE, aParent);
+@@ -619,7 +619,7 @@ NS_IMETHODIMP nsAccessible::GetNextSibli
+     return NS_ERROR_FAILURE;
+   }
+   if (!mParent) {
+-    nsCOMPtr<nsIAccessible> parent(GetParent());
++    nsIAccessible* parent(GetParent());
+     if (parent) {
+       PRInt32 numChildren;
+       parent->GetChildCount(&numChildren);  // Make sure we cache all of the children
+@@ -648,16 +648,16 @@ NS_IMETHODIMP nsAccessible::GetPreviousS
+     return NS_ERROR_FAILURE;
+   }
+ 
+-  nsCOMPtr<nsIAccessible> parent;
+-  if (NS_FAILED(GetParent(getter_AddRefs(parent))) || !parent) {
++  nsIAccessible* parent;
++  if (NS_FAILED(GetParent(&parent)) || !parent) {
+     return NS_ERROR_FAILURE;
+   }
+ 
+-  nsCOMPtr<nsIAccessible> testAccessible, prevSibling;
+-  parent->GetFirstChild(getter_AddRefs(testAccessible));
++  nsIAccessible* testAccessible, *prevSibling;
++  parent->GetFirstChild(&testAccessible);
+   while (testAccessible && this != testAccessible) {
+     prevSibling = testAccessible;
+-    prevSibling->GetNextSibling(getter_AddRefs(testAccessible));
++    prevSibling->GetNextSibling(&testAccessible);
+   }
+ 
+   if (!prevSibling) {
+@@ -678,10 +678,10 @@ NS_IMETHODIMP nsAccessible::GetFirstChil
+   GetChildCount(&numChildren);  // Make sure we cache all of the children
+ 
+ #ifdef DEBUG
+-  nsCOMPtr<nsPIAccessible> firstChild(do_QueryInterface(mFirstChild));
++  nsPIAccessible* firstChild(do_QueryInterface(mFirstChild));
+   if (firstChild) {
+-    nsCOMPtr<nsIAccessible> realParent;
+-    firstChild->GetCachedParent(getter_AddRefs(realParent));
++    nsIAccessible* realParent;
++    firstChild->GetCachedParent(&realParent);
+     NS_ASSERTION(!realParent || realParent == this,
+                  "Two accessibles have the same first child accessible.");
+   }
+@@ -715,7 +715,7 @@ NS_IMETHODIMP nsAccessible::GetChildAt(P
+     aChildNum = numChildren - 1;
+   }
+ 
+-  nsCOMPtr<nsIAccessible> current(mFirstChild), nextSibling;
++  nsIAccessible* current(mFirstChild), *nextSibling;
+   PRInt32 index = 0;
+ 
+   while (current) {
+@@ -723,7 +723,7 @@ NS_IMETHODIMP nsAccessible::GetChildAt(P
+     if (++index > aChildNum) {
+       break;
+     }
+-    nextSibling->GetNextSibling(getter_AddRefs(current));
++    nextSibling->GetNextSibling(&current);
+   }
+ 
+   *aChild = nextSibling;
+@@ -734,11 +734,11 @@ NS_IMETHODIMP nsAccessible::GetChildAt(P
+ // readonly attribute nsIArray children;
+ NS_IMETHODIMP nsAccessible::GetChildren(nsIArray **aOutChildren)
+ {
+-  nsCOMPtr<nsIMutableArray> children = do_CreateInstance(NS_ARRAY_CONTRACTID);
++  nsIMutableArray* children = do_CreateInstance(NS_ARRAY_CONTRACTID);
+   if (!children)
+     return NS_ERROR_FAILURE;
+ 
+-  nsCOMPtr<nsIAccessible> curChild;
++  nsIAccessible* curChild;
+   while (NextChild(curChild)) {
+     children->AppendElement(curChild, PR_FALSE);
+   }
+@@ -747,14 +747,14 @@ NS_IMETHODIMP nsAccessible::GetChildren(
+   return NS_OK;
+ }
+ 
+-nsIAccessible *nsAccessible::NextChild(nsCOMPtr<nsIAccessible>& aAccessible)
+-{
+-  nsCOMPtr<nsIAccessible> nextChild;
++nsIAccessible *nsAccessible::NextChild(nsIAccessible*& aAccessible)
++{
++  nsIAccessible* nextChild;
+   if (!aAccessible) {
+-    GetFirstChild(getter_AddRefs(nextChild));
++    GetFirstChild(&nextChild);
+   }
+   else {
+-    aAccessible->GetNextSibling(getter_AddRefs(nextChild));
++    aAccessible->GetNextSibling(&nextChild);
+   }
+   return (aAccessible = nextChild);
+ }
+@@ -776,7 +776,7 @@ void nsAccessible::CacheChildren()
+     // a text node, because text nodes aren't in the frame map.
+     walker.mState.frame = GetFrame();
+ 
+-    nsCOMPtr<nsPIAccessible> privatePrevAccessible;
++    nsPIAccessible* privatePrevAccessible;
+     PRInt32 childCount = 0;
+     walker.GetFirstChild();
+     SetFirstChild(walker.mState.accessible);
+@@ -814,14 +814,14 @@ NS_IMETHODIMP nsAccessible::GetIndexInPa
+     return NS_ERROR_FAILURE;
+   }
+ 
+-  nsCOMPtr<nsIAccessible> parent;
+-  GetParent(getter_AddRefs(parent));
++  nsIAccessible* parent;
++  GetParent(&parent);
+   if (!parent) {
+     return NS_ERROR_FAILURE;
+   }
+ 
+-  nsCOMPtr<nsIAccessible> sibling;
+-  parent->GetFirstChild(getter_AddRefs(sibling));
++  nsIAccessible* sibling;
++  parent->GetFirstChild(&sibling);
+   if (!sibling) {
+     return NS_ERROR_FAILURE;
+   }
+@@ -834,8 +834,8 @@ NS_IMETHODIMP nsAccessible::GetIndexInPa
+       return NS_ERROR_FAILURE;
+ 
+     ++*aIndexInParent;
+-    nsCOMPtr<nsIAccessible> tempAccessible;
+-    sibling->GetNextSibling(getter_AddRefs(tempAccessible));
++    nsIAccessible* tempAccessible;
++    sibling->GetNextSibling(&tempAccessible);
+     sibling = tempAccessible;
+   }
+ 
+@@ -907,7 +907,7 @@ PRBool nsAccessible::IsVisible(PRBool *a
+ 
+   const PRUint16 kMinPixels  = 12;
+    // Set up the variables we need, return false if we can't get at them all
+-  nsCOMPtr<nsIPresShell> shell(GetPresShell());
++  nsIPresShell* shell(GetPresShell());
+   if (!shell) 
+     return PR_FALSE;
+ 
+@@ -984,9 +984,9 @@ PRBool nsAccessible::IsVisible(PRBool *a
+   // nsRectVisibility_kLeftOfViewport, 
+   // nsRectVisibility_kRightOfViewport
+   // This view says it is visible, but we need to check the parent view chain :(
+-  nsCOMPtr<nsIDOMDocument> domDoc;
+-  mDOMNode->GetOwnerDocument(getter_AddRefs(domDoc));
+-  nsCOMPtr<nsIDocument> doc(do_QueryInterface(domDoc));
++  nsIDOMDocument* domDoc;
++  mDOMNode->GetOwnerDocument(&domDoc);
++  nsIDocument* doc(do_QueryInterface(domDoc));
+   if (!doc)  {
+     return PR_FALSE;
+   }
+@@ -1011,7 +1011,7 @@ nsAccessible::GetState(PRUint32 *aState,
+     return NS_OK; // Node shut down
+   }
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   if (!content) {
+     return NS_OK;  // On document, this is not an error
+   }
+@@ -1066,20 +1066,20 @@ nsAccessible::GetState(PRUint32 *aState,
+   /* readonly attribute boolean focusedChild; */
+ NS_IMETHODIMP nsAccessible::GetFocusedChild(nsIAccessible **aFocusedChild) 
+ { 
+-  nsCOMPtr<nsIAccessible> focusedChild;
++  nsIAccessible* focusedChild;
+   if (gLastFocusedNode == mDOMNode) {
+     focusedChild = this;
+   }
+   else if (gLastFocusedNode) {
+-    nsCOMPtr<nsIAccessibilityService> accService =
++    nsIAccessibilityService* accService =
+       do_GetService("@mozilla.org/accessibilityService;1");
+     NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
+ 
+     accService->GetAccessibleFor(gLastFocusedNode,
+-                                 getter_AddRefs(focusedChild));
++                                 &focusedChild);
+     if (focusedChild) {
+-      nsCOMPtr<nsIAccessible> focusedParentAccessible;
+-      focusedChild->GetParent(getter_AddRefs(focusedParentAccessible));
++      nsIAccessible* focusedParentAccessible;
++      focusedChild->GetParent(&focusedParentAccessible);
+       if (focusedParentAccessible != this) {
+         focusedChild = nsnull;
+       }
+@@ -1104,7 +1104,7 @@ nsAccessible::GetChildAtPoint(PRInt32 aX
+ 
+   // If we can't find the point in a child, we will return the fallback answer:
+   // we return |this| if the point is within it, otherwise nsnull
+-  nsCOMPtr<nsIAccessible> fallbackAnswer;
++  nsIAccessible* fallbackAnswer;
+   PRInt32 x, y, width, height;
+   GetBounds(&x, &y, &width, &height);
+   if (aX >= x && aX < x + width &&
+@@ -1122,12 +1122,12 @@ nsAccessible::GetChildAtPoint(PRInt32 aX
+   // therefore accessible for containing block may be different from accessible
+   // for DOM parent but GetFrameForPoint() should be called for containing block
+   // to get an out of flow element.
+-  nsCOMPtr<nsIAccessibleDocument> accDocument;
+-  nsresult rv = GetAccessibleDocument(getter_AddRefs(accDocument));
++  nsIAccessibleDocument* accDocument;
++  nsresult rv = GetAccessibleDocument(&accDocument);
+   NS_ENSURE_SUCCESS(rv, rv);
+   NS_ENSURE_TRUE(accDocument, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsPIAccessNode> accessNodeDocument(do_QueryInterface(accDocument));
++  nsPIAccessNode* accessNodeDocument(do_QueryInterface(accDocument));
+   NS_ASSERTION(accessNodeDocument,
+                "nsIAccessibleDocument doesn't implement nsPIAccessNode");
+ 
+@@ -1140,31 +1140,31 @@ nsAccessible::GetChildAtPoint(PRInt32 aX
+   nsPoint offset(presContext->DevPixelsToAppUnits(aX - screenRect.x),
+                  presContext->DevPixelsToAppUnits(aY - screenRect.y));
+ 
+-  nsCOMPtr<nsIPresShell> presShell = presContext->PresShell();
++  nsIPresShell* presShell = presContext->PresShell();
+   nsIFrame *foundFrame = presShell->GetFrameForPoint(frame, offset);
+-  nsCOMPtr<nsIContent> content;
++  nsIContent* content;
+   if (!foundFrame || !(content = foundFrame->GetContent())) {
+     *aAccessible = fallbackAnswer;
+     return NS_OK;
+   }
+ 
+-  nsCOMPtr<nsIDOMNode> node(do_QueryInterface(content));
+-  nsCOMPtr<nsIAccessibilityService> accService = GetAccService();
+-
+-  nsCOMPtr<nsIDOMNode> relevantNode;
+-  accService->GetRelevantContentNodeFor(node, getter_AddRefs(relevantNode));
++  nsIDOMNode* node(do_QueryInterface(content));
++  nsIAccessibilityService* accService = GetAccService();
++
++  nsIDOMNode* relevantNode;
++  accService->GetRelevantContentNodeFor(node, &relevantNode);
+   if (!relevantNode) {
+     *aAccessible = fallbackAnswer;
+     return NS_OK;
+   }
+ 
+-  nsCOMPtr<nsIAccessible> accessible;
+-  accService->GetAccessibleFor(relevantNode, getter_AddRefs(accessible));
++  nsIAccessible* accessible;
++  accService->GetAccessibleFor(relevantNode, &accessible);
+   if (!accessible) {
+     // No accessible for the node with the point, so find the first
+     // accessible in the DOM parent chain
+     accDocument->GetAccessibleInParentChain(relevantNode, PR_TRUE,
+-                                            getter_AddRefs(accessible));
++                                            &accessible);
+     if (!accessible) {
+       *aAccessible = fallbackAnswer;
+       return NS_OK;
+@@ -1176,7 +1176,7 @@ nsAccessible::GetChildAtPoint(PRInt32 aX
+     // the are within this point.
+     // This takes care of cases where layout won't walk into
+     // things for us, such as image map areas and sub documents
+-    nsCOMPtr<nsIAccessible> child;
++    nsIAccessible* child;
+     while (NextChild(child)) {
+       PRInt32 childX, childY, childWidth, childHeight;
+       child->GetBounds(&childX, &childY, &childWidth, &childHeight);
+@@ -1192,9 +1192,9 @@ nsAccessible::GetChildAtPoint(PRInt32 aX
+     // We are allowed to return |this| as the answer
+   }
+   else {
+-    nsCOMPtr<nsIAccessible> parent;
++    nsIAccessible* parent;
+     while (PR_TRUE) {
+-      accessible->GetParent(getter_AddRefs(parent));
++      accessible->GetParent(&parent);
+       if (!parent) {
+         // Reached the top of the hierarchy
+         // these bounds were inside an accessible that is not a descendant of this one
+@@ -1206,7 +1206,7 @@ nsAccessible::GetChildAtPoint(PRInt32 aX
+         // child we want to return
+         break;
+       }
+-      accessible.swap(parent);
++      swap(accessible, parent);
+     }
+   }
+ 
+@@ -1249,7 +1249,7 @@ void nsAccessible::GetBoundsRect(nsRect&
+   }
+ 
+   nsIFrame *iterFrame = firstFrame;
+-  nsCOMPtr<nsIContent> firstContent(do_QueryInterface(mDOMNode));
++  nsIContent* firstContent(do_QueryInterface(mDOMNode));
+   nsIContent* iterContent = firstContent;
+   PRInt32 depth = 0;
+ 
+@@ -1358,15 +1358,15 @@ nsIFrame* nsAccessible::GetBoundsFrame()
+   return GetFrame();
+ }
+ 
+-already_AddRefed<nsIAccessible>
++nsIAccessible*
+ nsAccessible::GetMultiSelectFor(nsIDOMNode *aNode)
+ {
+   NS_ENSURE_TRUE(aNode, nsnull);
+-  nsCOMPtr<nsIAccessibilityService> accService =
++  nsIAccessibilityService* accService =
+     do_GetService("@mozilla.org/accessibilityService;1");
+   NS_ENSURE_TRUE(accService, nsnull);
+-  nsCOMPtr<nsIAccessible> accessible;
+-  accService->GetAccessibleFor(aNode, getter_AddRefs(accessible));
++  nsIAccessible* accessible;
++  accService->GetAccessibleFor(aNode, &accessible);
+   if (!accessible) {
+     return nsnull;
+   }
+@@ -1379,7 +1379,7 @@ nsAccessible::GetMultiSelectFor(nsIDOMNo
+   PRUint32 containerRole;
+   while (0 == (state & nsIAccessibleStates::STATE_MULTISELECTABLE)) {
+     nsIAccessible *current = accessible;
+-    current->GetParent(getter_AddRefs(accessible));
++    current->GetParent(&accessible);
+     if (!accessible || (NS_SUCCEEDED(accessible->GetFinalRole(&containerRole)) &&
+                         containerRole == nsIAccessibleRole::ROLE_PANE)) {
+       return nsnull;
+@@ -1387,7 +1387,7 @@ nsAccessible::GetMultiSelectFor(nsIDOMNo
+     state = State(accessible);
+   }
+   nsIAccessible *returnAccessible = nsnull;
+-  accessible.swap(returnAccessible);
++  swap(accessible, returnAccessible);
+   return returnAccessible;
+ }
+ 
+@@ -1401,11 +1401,11 @@ NS_IMETHODIMP nsAccessible::SetSelected(
+ 
+   PRUint32 state = State(this);
+   if (state & nsIAccessibleStates::STATE_SELECTABLE) {
+-    nsCOMPtr<nsIAccessible> multiSelect = GetMultiSelectFor(mDOMNode);
++    nsIAccessible* multiSelect = GetMultiSelectFor(mDOMNode);
+     if (!multiSelect) {
+       return aSelect ? TakeFocus() : NS_ERROR_FAILURE;
+     }
+-    nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++    nsIContent* content(do_QueryInterface(mDOMNode));
+     NS_ASSERTION(content, "Called for dead accessible");
+ 
+     // For ARIA widgets use WAI namespace or hyphenated property, depending on what doc accepts
+@@ -1443,9 +1443,9 @@ NS_IMETHODIMP nsAccessible::TakeSelectio
+ 
+   PRUint32 state = State(this);
+   if (state & nsIAccessibleStates::STATE_SELECTABLE) {
+-    nsCOMPtr<nsIAccessible> multiSelect = GetMultiSelectFor(mDOMNode);
++    nsIAccessible* multiSelect = GetMultiSelectFor(mDOMNode);
+     if (multiSelect) {
+-      nsCOMPtr<nsIAccessibleSelectable> selectable = do_QueryInterface(multiSelect);
++      nsIAccessibleSelectable* selectable = do_QueryInterface(multiSelect);
+       selectable->ClearSelection();
+     }
+     return SetSelected(PR_TRUE);
+@@ -1457,13 +1457,13 @@ NS_IMETHODIMP nsAccessible::TakeSelectio
+ /* void takeFocus (); */
+ NS_IMETHODIMP nsAccessible::TakeFocus()
+ { 
+-  nsCOMPtr<nsIDOMNSHTMLElement> htmlElement(do_QueryInterface(mDOMNode));
++  nsIDOMNSHTMLElement* htmlElement(do_QueryInterface(mDOMNode));
+   if (htmlElement) {
+     // HTML Elements also set the caret position
+     // in order to affect tabbing order
+     return htmlElement->Focus();
+   }
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   if (!content) {
+     return NS_ERROR_FAILURE;
+   }
+@@ -1490,8 +1490,8 @@ nsresult nsAccessible::AppendNameFromAcc
+ {
+   nsAutoString textEquivalent, value;
+ 
+-  nsCOMPtr<nsIDOMNode> domNode(do_QueryInterface(aContent));
+-  nsCOMPtr<nsIAccessible> accessible;
++  nsIDOMNode* domNode(do_QueryInterface(aContent));
++  nsIAccessible* accessible;
+   if (domNode == mDOMNode) {
+     accessible = this;
+     if (!aFromValue) {
+@@ -1500,10 +1500,10 @@ nsresult nsAccessible::AppendNameFromAcc
+     }
+   }
+   else {
+-    nsCOMPtr<nsIAccessibilityService> accService =
++    nsIAccessibilityService* accService =
+       do_GetService("@mozilla.org/accessibilityService;1");
+     NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
+-    accService->GetAccessibleInWeakShell(domNode, mWeakShell, getter_AddRefs(accessible));
++    accService->GetAccessibleInWeakShell(domNode, mWeakShell, &accessible);
+   }
+   if (accessible) {
+     if (aFromValue) {
+@@ -1532,13 +1532,13 @@ nsresult nsAccessible::AppendFlatStringF
+   if (aContent->IsNodeOfType(nsINode::eTEXT)) {
+     // If it's a text node, append the text
+     PRBool isHTMLBlock = PR_FALSE;
+-    nsCOMPtr<nsIPresShell> shell = GetPresShell();
++    nsIPresShell* shell = GetPresShell();
+     if (!shell) {
+       return NS_ERROR_FAILURE;  
+     }
+ 
+     nsIContent *parentContent = aContent->GetParent();
+-    nsCOMPtr<nsIContent> appendedSubtreeStart(do_QueryInterface(mDOMNode));
++    nsIContent* appendedSubtreeStart(do_QueryInterface(mDOMNode));
+     if (parentContent && parentContent != appendedSubtreeStart) {
+       nsIFrame *frame = shell->GetPrimaryFrameFor(parentContent);
+       if (frame) {
+@@ -1570,7 +1570,7 @@ nsresult nsAccessible::AppendFlatStringF
+   nsAutoString textEquivalent;
+   if (!aContent->IsNodeOfType(nsINode::eHTML)) {
+     if (aContent->IsNodeOfType(nsINode::eXUL)) {
+-      nsCOMPtr<nsIPresShell> shell = GetPresShell();
++      nsIPresShell* shell = GetPresShell();
+       if (!shell) {
+         return NS_ERROR_FAILURE;  
+       }
+@@ -1579,7 +1579,7 @@ nsresult nsAccessible::AppendFlatStringF
+         return NS_OK;
+       }
+ 
+-      nsCOMPtr<nsIDOMXULLabeledControlElement> labeledEl(do_QueryInterface(aContent));
++      nsIDOMXULLabeledControlElement* labeledEl(do_QueryInterface(aContent));
+       if (labeledEl) {
+         labeledEl->GetLabel(textEquivalent);
+       }
+@@ -1599,7 +1599,7 @@ nsresult nsAccessible::AppendFlatStringF
+     return NS_OK; // Not HTML and not XUL -- we don't handle it yet
+   }
+ 
+-  nsCOMPtr<nsIAtom> tag = aContent->Tag();
++  nsIAtom* tag = aContent->Tag();
+   if (tag == nsAccessibilityAtoms::img) {
+     return AppendNameFromAccessibleFor(aContent, aFlatString);
+   }
+@@ -1668,7 +1668,7 @@ nsresult nsAccessible::AppendFlatStringF
+   // Depth first search for all text nodes that are decendants of content node.
+   // Append all the text into one flat string
+   PRUint32 numChildren = 0;
+-  nsCOMPtr<nsIDOMXULSelectControlElement> selectControlEl(do_QueryInterface(aContent));
++  nsIDOMXULSelectControlElement* selectControlEl(do_QueryInterface(aContent));
+   if (!selectControlEl) {  // Don't walk children of elements with options, just get label directly
+     numChildren = aContent->GetChildCount();
+   }
+@@ -1732,7 +1732,7 @@ nsresult nsAccessible::GetTextFromRelati
+ {
+   // Get DHTML name from content subtree pointed to by ID attribute
+   aName.Truncate();
+-  nsCOMPtr<nsIContent> content = GetRoleContent(mDOMNode);
++  nsIContent* content = GetRoleContent(mDOMNode);
+   NS_ASSERTION(content, "Called from shutdown accessible");
+ 
+   nsAutoString ids;
+@@ -1741,7 +1741,7 @@ nsresult nsAccessible::GetTextFromRelati
+   }
+   ids.CompressWhitespace(PR_TRUE, PR_TRUE);
+ 
+-  nsCOMPtr<nsIDOMDocument> domDoc = do_QueryInterface(content->GetOwnerDoc());
++  nsIDOMDocument* domDoc = do_QueryInterface(content->GetOwnerDoc());
+   NS_ENSURE_TRUE(domDoc, NS_ERROR_FAILURE);
+   
+   nsresult rv = NS_ERROR_FAILURE;
+@@ -1762,8 +1762,8 @@ nsresult nsAccessible::GetTextFromRelati
+     if (!aName.IsEmpty()) {
+       aName += ' '; // Need whitespace between multiple labels or descriptions
+     }
+-    nsCOMPtr<nsIDOMElement> labelElement;
+-    domDoc->GetElementById(id, getter_AddRefs(labelElement));
++    nsIDOMElement* labelElement;
++    domDoc->GetElementById(id, &labelElement);
+     content = do_QueryInterface(labelElement);
+     if (!content) {
+       return NS_OK;
+@@ -1785,7 +1785,7 @@ nsresult nsAccessible::GetTextFromRelati
+   */
+ nsresult nsAccessible::GetHTMLName(nsAString& aLabel, PRBool aCanAggregateSubtree)
+ {
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   if (!content) {
+     return NS_ERROR_FAILURE;   // Node shut down
+   }
+@@ -1838,7 +1838,7 @@ nsresult nsAccessible::GetHTMLName(nsASt
+   */
+ nsresult nsAccessible::GetXULName(nsAString& aLabel, PRBool aCanAggregateSubtree)
+ {
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   NS_ASSERTION(content, "No nsIContent for DOM node");
+ 
+   // First check for label override via accessibility labelledby relationship
+@@ -1850,21 +1850,21 @@ nsresult nsAccessible::GetXULName(nsAStr
+   }
+ 
+   // CASE #1 (via label attribute) -- great majority of the cases
+-  nsCOMPtr<nsIDOMXULLabeledControlElement> labeledEl(do_QueryInterface(mDOMNode));
++  nsIDOMXULLabeledControlElement* labeledEl(do_QueryInterface(mDOMNode));
+   if (labeledEl) {
+     rv = labeledEl->GetLabel(label);
+   }
+   else {
+-    nsCOMPtr<nsIDOMXULSelectControlItemElement> itemEl(do_QueryInterface(mDOMNode));
++    nsIDOMXULSelectControlItemElement* itemEl(do_QueryInterface(mDOMNode));
+     if (itemEl) {
+       rv = itemEl->GetLabel(label);
+     }
+     else {
+-      nsCOMPtr<nsIDOMXULSelectControlElement> select(do_QueryInterface(mDOMNode));
++      nsIDOMXULSelectControlElement* select(do_QueryInterface(mDOMNode));
+       // Use label if this is not a select control element which 
+       // uses label attribute to indicate which option is selected
+       if (!select) {
+-        nsCOMPtr<nsIDOMXULElement> xulEl(do_QueryInterface(mDOMNode));
++        nsIDOMXULElement* xulEl(do_QueryInterface(mDOMNode));
+         if (xulEl) {
+           rv = xulEl->GetAttribute(NS_LITERAL_STRING("label"), label);
+         }
+@@ -1880,7 +1880,7 @@ nsresult nsAccessible::GetXULName(nsAStr
+                                               nsAccessibilityAtoms::label,
+                                               nsAccessibilityAtoms::control);
+ 
+-    nsCOMPtr<nsIDOMXULLabelElement> xulLabel(do_QueryInterface(labelContent));
++    nsIDOMXULLabelElement* xulLabel(do_QueryInterface(labelContent));
+     // Check if label's value attribute is used
+     if (xulLabel && NS_SUCCEEDED(xulLabel->GetValue(label)) && label.IsEmpty()) {
+       // If no value attribute, a non-empty label must contain
+@@ -1925,11 +1925,11 @@ PRBool nsAccessible::IsNodeRelevant(nsID
+ {
+   // Can this node be accessible and attached to
+   // the document's accessible tree?
+-  nsCOMPtr<nsIAccessibilityService> accService =
++  nsIAccessibilityService* accService =
+     do_GetService("@mozilla.org/accessibilityService;1");
+   NS_ENSURE_TRUE(accService, PR_FALSE);
+-  nsCOMPtr<nsIDOMNode> relevantNode;
+-  accService->GetRelevantContentNodeFor(aNode, getter_AddRefs(relevantNode));
++  nsIDOMNode* relevantNode;
++  accService->GetRelevantContentNodeFor(aNode, &relevantNode);
+   return aNode == relevantNode;
+ }
+ 
+@@ -1941,7 +1941,7 @@ nsAccessible::FireToolkitEvent(PRUint32 
+   if (!mWeakShell)
+     return NS_ERROR_FAILURE;
+ 
+-  nsCOMPtr<nsIAccessibleEvent> accEvent =
++  nsIAccessibleEvent* accEvent =
+     new nsAccEvent(aEvent, aTarget, aData);
+   NS_ENSURE_TRUE(accEvent, NS_ERROR_OUT_OF_MEMORY);
+ 
+@@ -1952,11 +1952,11 @@ nsAccessible::FireAccessibleEvent(nsIAcc
+ nsAccessible::FireAccessibleEvent(nsIAccessibleEvent *aEvent)
+ {
+   NS_ENSURE_ARG_POINTER(aEvent);
+-  nsCOMPtr<nsIDOMNode> eventNode;
+-  aEvent->GetDOMNode(getter_AddRefs(eventNode));
++  nsIDOMNode* eventNode;
++  aEvent->GetDOMNode(&eventNode);
+   NS_ENSURE_TRUE(IsNodeRelevant(eventNode), NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIObserverService> obsService =
++  nsIObserverService* obsService =
+     do_GetService("@mozilla.org/observer-service;1");
+   NS_ENSURE_TRUE(obsService, NS_ERROR_FAILURE);
+ 
+@@ -1974,7 +1974,7 @@ NS_IMETHODIMP nsAccessible::GetFinalRole
+     // These unfortunate exceptions don't fit into the ARIA table
+     // This is where the nsIAccessible role depends on both the role and ARIA state
+     if (*aRole == nsIAccessibleRole::ROLE_ENTRY) {
+-      nsCOMPtr<nsIContent> content = do_QueryInterface(mDOMNode);
++      nsIContent* content = do_QueryInterface(mDOMNode);
+       nsAutoString secret;
+       if (content && nsAccUtils::GetAriaProperty(content, mWeakShell, eAria_secret, secret) &&
+           secret.EqualsLiteral("true")) {
+@@ -1983,7 +1983,7 @@ NS_IMETHODIMP nsAccessible::GetFinalRole
+       }
+     }
+     else if (*aRole == nsIAccessibleRole::ROLE_PUSHBUTTON) {
+-      nsCOMPtr<nsIContent> content = do_QueryInterface(mDOMNode);
++      nsIContent* content = do_QueryInterface(mDOMNode);
+       if (content) {
+         if (nsAccUtils::HasAriaProperty(content, mWeakShell, eAria_pressed)) {
+           // For aaa:pressed="false" or aaa:pressed="true"
+@@ -2016,7 +2016,7 @@ nsAccessible::GetAttributes(nsIPersisten
+   if (!mDOMNode)
+     return NS_ERROR_FAILURE;
+ 
+-  nsCOMPtr<nsIPersistentProperties> attributes =
++  nsIPersistentProperties* attributes =
+      do_CreateInstance(NS_PERSISTENTPROPERTIES_CONTRACTID);
+   NS_ENSURE_TRUE(attributes, NS_ERROR_OUT_OF_MEMORY);
+ 
+@@ -2025,7 +2025,7 @@ nsAccessible::GetAttributes(nsIPersisten
+   nsresult rv = GetAttributesInternal(attributes);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+-  nsCOMPtr<nsIContent> content = GetRoleContent(mDOMNode);
++  nsIContent* content = GetRoleContent(mDOMNode);
+   nsAutoString id;
+   nsAutoString oldValueUnused;
+   if (content && nsAccUtils::GetID(content, id)) {
+@@ -2092,14 +2092,14 @@ nsAccessible::GetAttributes(nsIPersisten
+         role == nsIAccessibleRole::ROLE_PAGETAB ||
+         role == nsIAccessibleRole::ROLE_OUTLINEITEM) &&
+         0 == (State(this) & nsIAccessibleStates::STATE_INVISIBLE)) {
+-      nsCOMPtr<nsIAccessible> parent = GetParent();
++      nsIAccessible* parent = GetParent();
+       NS_ENSURE_TRUE(parent, NS_ERROR_FAILURE);
+ 
+       PRInt32 positionInGroup = 0;
+       PRInt32 setSize = 0;
+ 
+-      nsCOMPtr<nsIAccessible> sibling, nextSibling;
+-      parent->GetFirstChild(getter_AddRefs(sibling));
++      nsIAccessible* sibling, *nextSibling;
++      parent->GetFirstChild(&sibling);
+       NS_ENSURE_TRUE(sibling, NS_ERROR_FAILURE);
+ 
+       PRBool foundCurrent = PR_FALSE;
+@@ -2115,14 +2115,14 @@ nsAccessible::GetAttributes(nsIPersisten
+               foundCurrent = PR_TRUE;
+           }
+         }
+-        sibling->GetNextSibling(getter_AddRefs(nextSibling));
++        sibling->GetNextSibling(&nextSibling);
+         sibling = nextSibling;
+       }
+ 
+       PRInt32 groupLevel = 0;
+       if (role == nsIAccessibleRole::ROLE_OUTLINEITEM) {
+         groupLevel = 1;
+-        nsCOMPtr<nsIAccessible> nextParent;
++        nsIAccessible* nextParent;
+         while (parent) {
+           parent->GetFinalRole(&role);
+ 
+@@ -2131,8 +2131,8 @@ nsAccessible::GetAttributes(nsIPersisten
+           if (role == nsIAccessibleRole::ROLE_GROUPING)
+             ++ groupLevel;
+ 
+-          parent->GetParent(getter_AddRefs(nextParent));
+-          parent.swap(nextParent);
++          parent->GetParent(&nextParent);
++          swap(parent, nextParent);
+         }
+       }
+ 
+@@ -2141,7 +2141,7 @@ nsAccessible::GetAttributes(nsIPersisten
+     }
+   }
+ 
+-  attributes.swap(*aAttributes);
++  swap(attributes, *aAttributes);
+ 
+   return NS_OK;
+ }
+@@ -2149,7 +2149,7 @@ nsresult
+ nsresult
+ nsAccessible::GetAttributesInternal(nsIPersistentProperties *aAttributes)
+ {
+-  nsCOMPtr<nsIDOMElement> element(do_QueryInterface(mDOMNode));
++  nsIDOMElement* element(do_QueryInterface(mDOMNode));
+   NS_ENSURE_TRUE(element, NS_ERROR_UNEXPECTED);
+ 
+   nsAutoString tagName;
+@@ -2183,8 +2183,8 @@ nsAccessible::GroupPosition(PRInt32 *aGr
+   *aSimilarItemsInGroup = 0;
+   *aPositionInGroup = 0;
+ 
+-  nsCOMPtr<nsIPersistentProperties> attributes;
+-  nsresult rv = GetAttributes(getter_AddRefs(attributes));
++  nsIPersistentProperties* attributes;
++  nsresult rv = GetAttributes(&attributes);
+   NS_ENSURE_SUCCESS(rv, rv);
+   if (!attributes) {
+     return NS_ERROR_FAILURE;
+@@ -2247,15 +2247,15 @@ nsAccessible::GetFinalState(PRUint32 *aS
+     } else {
+       // Expose 'selected' state on ARIA tab if the focus is on internal element
+       // of related tabpanel.
+-      nsCOMPtr<nsIAccessible> tabPanel;
++      nsIAccessible* tabPanel;
+       rv = GetAccessibleRelated(nsIAccessibleRelation::RELATION_LABEL_FOR,
+-                                getter_AddRefs(tabPanel));
++                                &tabPanel);
+       NS_ENSURE_SUCCESS(rv, rv);
+ 
+       if (tabPanel && Role(tabPanel) == nsIAccessibleRole::ROLE_PROPERTYPAGE) {
+-        nsCOMPtr<nsIAccessNode> tabPanelAccessNode(do_QueryInterface(tabPanel));
+-        nsCOMPtr<nsIDOMNode> tabPanelNode;
+-        tabPanelAccessNode->GetDOMNode(getter_AddRefs(tabPanelNode));
++        nsIAccessNode* tabPanelAccessNode(do_QueryInterface(tabPanel));
++        nsIDOMNode* tabPanelNode;
++        tabPanelAccessNode->GetDOMNode(&tabPanelNode);
+         NS_ENSURE_STATE(tabPanelNode);
+ 
+         if (nsAccUtils::IsAncestorOf(tabPanelNode, gLastFocusedNode))
+@@ -2295,7 +2295,7 @@ nsAccessible::GetFinalState(PRUint32 *aS
+       role == nsIAccessibleRole::ROLE_PASSWORD_TEXT ||
+       role == nsIAccessibleRole::ROLE_COMBOBOX) {
+ 
+-    nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++    nsIContent* content(do_QueryInterface(mDOMNode));
+     NS_ENSURE_STATE(content);
+ 
+     nsAutoString autocomplete;
+@@ -2399,7 +2399,7 @@ NS_IMETHODIMP nsAccessible::GetValue(nsA
+     if (mRoleMapEntry->valueRule == eNoValue) {
+       return NS_OK;
+     }
+-    nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++    nsIContent* content(do_QueryInterface(mDOMNode));
+     if (content && nsAccUtils::GetAriaProperty(content, mWeakShell, eAria_valuenow, aValue)) {
+       return NS_OK;
+     }
+@@ -2459,7 +2459,7 @@ nsAccessible::SetCurrentValue(double aVa
+   if (NS_SUCCEEDED(GetMaximumValue(&maxValue)) && aValue > maxValue)
+     return NS_ERROR_INVALID_ARG;
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   NS_ENSURE_STATE(content);
+ 
+   nsAutoString newValue;
+@@ -2578,7 +2578,7 @@ NS_IMETHODIMP nsAccessible::GetAccessibl
+ 
+ nsIDOMNode* nsAccessible::GetAtomicRegion()
+ {
+-  nsCOMPtr<nsIContent> content = do_QueryInterface(mDOMNode);
++  nsIContent* content = do_QueryInterface(mDOMNode);
+   nsIContent *loopContent = content;
+   nsAutoString atomic;
+   PRUint32 ariaPropTypes = nsAccUtils::GetAriaPropTypes(content, mWeakShell);
+@@ -2589,7 +2589,7 @@ nsIDOMNode* nsAccessible::GetAtomicRegio
+     loopContent = loopContent->GetParent();
+   }
+ 
+-  nsCOMPtr<nsIDOMNode> atomicRegion;
++  nsIDOMNode* atomicRegion;
+   if (atomic.EqualsLiteral("true")) {
+     atomicRegion = do_QueryInterface(loopContent);
+   }
+@@ -2610,7 +2610,7 @@ NS_IMETHODIMP nsAccessible::GetAccessibl
+     return NS_ERROR_FAILURE;  // Node already shut down
+   }
+ 
+-  nsCOMPtr<nsIDOMNode> relatedNode;
++  nsIDOMNode* relatedNode;
+   nsAutoString relatedID;
+ 
+   // Search for the related DOM node according to the specified "relation type"
+@@ -2694,47 +2694,47 @@ NS_IMETHODIMP nsAccessible::GetAccessibl
+     {
+       if (content->IsNodeOfType(nsINode::eHTML)) {
+         // HTML form controls implements nsIFormControl interface.
+-        nsCOMPtr<nsIFormControl> control(do_QueryInterface(content));
++        nsIFormControl* control(do_QueryInterface(content));
+         if (control) {
+-          nsCOMPtr<nsIDOMHTMLFormElement> htmlform;
+-          control->GetForm(getter_AddRefs(htmlform));
+-          nsCOMPtr<nsIForm> form(do_QueryInterface(htmlform));
++          nsIDOMHTMLFormElement* htmlform;
++          control->GetForm(&htmlform);
++          nsIForm* form(do_QueryInterface(htmlform));
+           if (form)
+             relatedNode = do_QueryInterface(form->GetDefaultSubmitElement());
+         }
+       }
+       else {
+         // In XUL, use first <button default="true" .../> in the document
+-        nsCOMPtr<nsIDOMXULDocument> xulDoc = do_QueryInterface(content->GetDocument());
+-        nsCOMPtr<nsIDOMXULButtonElement> buttonEl;
++        nsIDOMXULDocument* xulDoc = do_QueryInterface(content->GetDocument());
++        nsIDOMXULButtonElement* buttonEl;
+         if (xulDoc) {
+-          nsCOMPtr<nsIDOMNodeList> possibleDefaultButtons;
++          nsIDOMNodeList* possibleDefaultButtons;
+           xulDoc->GetElementsByAttribute(NS_LITERAL_STRING("default"),
+                                          NS_LITERAL_STRING("true"),
+-                                         getter_AddRefs(possibleDefaultButtons));
++                                         &possibleDefaultButtons);
+           if (possibleDefaultButtons) {
+             PRUint32 length;
+             possibleDefaultButtons->GetLength(&length);
+-            nsCOMPtr<nsIDOMNode> possibleButton;
++            nsIDOMNode* possibleButton;
+             // Check for button in list of default="true" elements
+             for (PRUint32 count = 0; count < length && !buttonEl; count ++) {
+-              possibleDefaultButtons->Item(count, getter_AddRefs(possibleButton));
++              possibleDefaultButtons->Item(count, &possibleButton);
+               buttonEl = do_QueryInterface(possibleButton);
+             }
+           }
+           if (!buttonEl) { // Check for anonymous accept button in <dialog>
+-            nsCOMPtr<nsIDOMDocumentXBL> xblDoc(do_QueryInterface(xulDoc));
++            nsIDOMDocumentXBL* xblDoc(do_QueryInterface(xulDoc));
+             if (xblDoc) {
+-              nsCOMPtr<nsIDOMDocument> domDoc = do_QueryInterface(xulDoc);
++              nsIDOMDocument* domDoc = do_QueryInterface(xulDoc);
+               NS_ASSERTION(domDoc, "No DOM document");
+-              nsCOMPtr<nsIDOMElement> rootEl;
+-              domDoc->GetDocumentElement(getter_AddRefs(rootEl));
++              nsIDOMElement* rootEl;
++              domDoc->GetDocumentElement(&rootEl);
+               if (rootEl) {
+-                nsCOMPtr<nsIDOMElement> possibleButtonEl;
++                nsIDOMElement* possibleButtonEl;
+                 xblDoc->GetAnonymousElementByAttribute(rootEl,
+                                                       NS_LITERAL_STRING("default"),
+                                                       NS_LITERAL_STRING("true"),
+-                                                      getter_AddRefs(possibleButtonEl));
++                                                      &possibleButtonEl);
+                 buttonEl = do_QueryInterface(possibleButtonEl);
+               }
+             }
+@@ -2755,17 +2755,17 @@ NS_IMETHODIMP nsAccessible::GetAccessibl
+ 
+   if (!relatedID.IsEmpty()) {
+     // In some cases we need to get the relatedNode from an ID-style attribute
+-    nsCOMPtr<nsIDOMDocument> domDoc;
+-    mDOMNode->GetOwnerDocument(getter_AddRefs(domDoc));
++    nsIDOMDocument* domDoc;
++    mDOMNode->GetOwnerDocument(&domDoc);
+     NS_ENSURE_TRUE(domDoc, NS_ERROR_FAILURE);
+-    nsCOMPtr<nsIDOMElement> relatedEl;
+-    domDoc->GetElementById(relatedID, getter_AddRefs(relatedEl));
++    nsIDOMElement* relatedEl;
++    domDoc->GetElementById(relatedID, &relatedEl);
+     relatedNode = do_QueryInterface(relatedEl);
+   }
+ 
+   // Return the corresponding accessible if the related DOM node is found
+   if (relatedNode) {
+-    nsCOMPtr<nsIAccessibilityService> accService = GetAccService();
++    nsIAccessibilityService* accService = GetAccService();
+     NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
+     accService->GetAccessibleInWeakShell(relatedNode, mWeakShell, aRelated);
+   }
+@@ -2778,8 +2778,8 @@ nsAccessible::GetRelationsCount(PRUint32
+   NS_ENSURE_ARG_POINTER(aCount);
+   *aCount = 0;
+ 
+-  nsCOMPtr<nsIArray> relations;
+-  nsresult rv = GetRelations(getter_AddRefs(relations));
++  nsIArray* relations;
++  nsresult rv = GetRelations(&relations);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+   return relations->GetLength(aCount);
+@@ -2791,13 +2791,13 @@ nsAccessible::GetRelation(PRUint32 aInde
+   NS_ENSURE_ARG_POINTER(aRelation);
+   *aRelation = nsnull;
+ 
+-  nsCOMPtr<nsIArray> relations;
+-  nsresult rv = GetRelations(getter_AddRefs(relations));
++  nsIArray* relations;
++  nsresult rv = GetRelations(&relations);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+-  nsCOMPtr<nsIAccessibleRelation> relation;
++  nsIAccessibleRelation* relation;
+   rv = relations->QueryElementAt(aIndex, NS_GET_IID(nsIAccessibleRelation),
+-                                 getter_AddRefs(relation));
++                                 (void**)&relation);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+   *aRelation = relation;
+@@ -2809,17 +2809,17 @@ nsAccessible::GetRelations(nsIArray **aR
+ {
+   NS_ENSURE_ARG_POINTER(aRelations);
+ 
+-  nsCOMPtr<nsIMutableArray> relations = do_CreateInstance(NS_ARRAY_CONTRACTID);
++  nsIMutableArray* relations = do_CreateInstance(NS_ARRAY_CONTRACTID);
+   NS_ENSURE_TRUE(relations, NS_ERROR_OUT_OF_MEMORY);
+ 
+   for (PRUint32 relType = nsIAccessibleRelation::RELATION_FIRST;
+        relType < nsIAccessibleRelation::RELATION_LAST;
+        ++relType) {
+-    nsCOMPtr<nsIAccessible> accessible;
+-    GetAccessibleRelated(relType, getter_AddRefs(accessible));
++    nsIAccessible* accessible;
++    GetAccessibleRelated(relType, &accessible);
+ 
+     if (accessible) {
+-      nsCOMPtr<nsIAccessibleRelation> relation =
++      nsIAccessibleRelation* relation =
+         new nsAccessibleRelationWrap(relType, accessible);
+       NS_ENSURE_TRUE(relation, NS_ERROR_OUT_OF_MEMORY);
+ 
+@@ -2850,7 +2850,7 @@ void nsAccessible::DoCommandCallback(nsI
+   NS_RELEASE(gDoCommandTimer);
+ 
+   nsIContent *content = reinterpret_cast<nsIContent*>(aClosure);
+-  nsCOMPtr<nsIDOMXULElement> xulElement(do_QueryInterface(content));
++  nsIDOMXULElement* xulElement(do_QueryInterface(content));
+   if (xulElement) {
+     xulElement->Click();
+   }
+@@ -2859,7 +2859,7 @@ void nsAccessible::DoCommandCallback(nsI
+     if (!doc) {
+       return;
+     }
+-    nsCOMPtr<nsIPresShell> presShell = doc->GetPrimaryShell();
++    nsIPresShell* presShell = doc->GetPrimaryShell();
+     nsPIDOMWindow *outerWindow = doc->GetWindow();
+     if (presShell && outerWindow) {
+       nsAutoPopupStatePusher popupStatePusher(outerWindow, openAllowed);
+@@ -2892,7 +2892,7 @@ void nsAccessible::DoCommandCallback(nsI
+  */
+ nsresult nsAccessible::DoCommand(nsIContent *aContent)
+ {
+-  nsCOMPtr<nsIContent> content = aContent;
++  nsIContent* content = aContent;
+   if (!content) {
+     content = do_QueryInterface(mDOMNode);
+   }
+@@ -2902,7 +2902,7 @@ nsresult nsAccessible::DoCommand(nsICont
+     return NS_ERROR_FAILURE;
+   }
+ 
+-  nsCOMPtr<nsITimer> timer = do_CreateInstance("@mozilla.org/timer;1");
++  nsITimer* timer = do_CreateInstance("@mozilla.org/timer;1");
+   if (!timer) {
+     return NS_ERROR_OUT_OF_MEMORY;
+   } 
+@@ -2913,34 +2913,34 @@ nsresult nsAccessible::DoCommand(nsICont
+                                                nsITimer::TYPE_ONE_SHOT);
+ }
+ 
+-already_AddRefed<nsIAccessible>
++nsIAccessible*
+ nsAccessible::GetNextWithState(nsIAccessible *aStart, PRUint32 matchState)
+ {
+   // Return the next descendant that matches one of the states in matchState
+   // Uses depth first search
+   NS_ASSERTION(matchState, "GetNextWithState() not called with a state to match");
+   NS_ASSERTION(aStart, "GetNextWithState() not called with an accessible to start with");
+-  nsCOMPtr<nsIAccessible> look, current = aStart;
++  nsIAccessible* look, *current = aStart;
+   PRUint32 state = 0;
+   while (0 == (state & matchState)) {
+-    current->GetFirstChild(getter_AddRefs(look));
++    current->GetFirstChild(&look);
+     while (!look) {
+       if (current == this) {
+         return nsnull; // At top of subtree
+       }
+-      current->GetNextSibling(getter_AddRefs(look));
++      current->GetNextSibling(&look);
+       if (!look) {
+-        current->GetParent(getter_AddRefs(look));
+-        current.swap(look);
++        current->GetParent(&look);
++        swap(current, look);
+         continue;
+       }
+     }
+-    current.swap(look);
++    swap(current, look);
+     state = State(current);
+   }
+ 
+   nsIAccessible *returnAccessible = nsnull;
+-  current.swap(returnAccessible);
++  swap(current, returnAccessible);
+ 
+   return returnAccessible;
+ }
+@@ -2950,11 +2950,11 @@ NS_IMETHODIMP nsAccessible::GetSelectedC
+ {
+   *aSelectedAccessibles = nsnull;
+ 
+-  nsCOMPtr<nsIMutableArray> selectedAccessibles =
++  nsIMutableArray* selectedAccessibles =
+     do_CreateInstance(NS_ARRAY_CONTRACTID);
+   NS_ENSURE_STATE(selectedAccessibles);
+ 
+-  nsCOMPtr<nsIAccessible> selected = this;
++  nsIAccessible* selected = this;
+   while ((selected = GetNextWithState(selected, nsIAccessibleStates::STATE_SELECTED)) != nsnull) {
+     selectedAccessibles->AppendElement(selected, PR_FALSE);
+   }
+@@ -2975,7 +2975,7 @@ NS_IMETHODIMP nsAccessible::RefSelection
+   if (aIndex < 0) {
+     return NS_ERROR_FAILURE;
+   }
+-  nsCOMPtr<nsIAccessible> selected = this;
++  nsIAccessible* selected = this;
+   PRInt32 count = 0;
+   while (count ++ <= aIndex) {
+     selected = GetNextWithState(selected, nsIAccessibleStates::STATE_SELECTED);
+@@ -2990,7 +2990,7 @@ NS_IMETHODIMP nsAccessible::GetSelection
+ NS_IMETHODIMP nsAccessible::GetSelectionCount(PRInt32 *aSelectionCount)
+ {
+   *aSelectionCount = 0;
+-  nsCOMPtr<nsIAccessible> selected = this;
++  nsIAccessible* selected = this;
+   while ((selected = GetNextWithState(selected, nsIAccessibleStates::STATE_SELECTED)) != nsnull) {
+     ++ *aSelectionCount;
+   }
+@@ -3006,8 +3006,8 @@ NS_IMETHODIMP nsAccessible::AddChildToSe
+ 
+   NS_ENSURE_TRUE(aIndex >= 0, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIAccessible> child;
+-  GetChildAt(aIndex, getter_AddRefs(child));
++  nsIAccessible* child;
++  GetChildAt(aIndex, &child);
+ 
+   PRUint32 state = State(child);
+   if (!(state & nsIAccessibleStates::STATE_SELECTABLE)) {
+@@ -3025,8 +3025,8 @@ NS_IMETHODIMP nsAccessible::RemoveChildF
+ 
+   NS_ENSURE_TRUE(aIndex >= 0, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIAccessible> child;
+-  GetChildAt(aIndex, getter_AddRefs(child));
++  nsIAccessible* child;
++  GetChildAt(aIndex, &child);
+ 
+   PRUint32 state = State(child);
+   if (!(state & nsIAccessibleStates::STATE_SELECTED)) {
+@@ -3045,8 +3045,8 @@ NS_IMETHODIMP nsAccessible::IsChildSelec
+   *aIsSelected = PR_FALSE;
+   NS_ENSURE_TRUE(aIndex >= 0, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIAccessible> child;
+-  GetChildAt(aIndex, getter_AddRefs(child));
++  nsIAccessible* child;
++  GetChildAt(aIndex, &child);
+ 
+   PRUint32 state = State(child);
+   if (state & nsIAccessibleStates::STATE_SELECTED) {
+@@ -3057,7 +3057,7 @@ NS_IMETHODIMP nsAccessible::IsChildSelec
+ 
+ NS_IMETHODIMP nsAccessible::ClearSelection()
+ {
+-  nsCOMPtr<nsIAccessible> selected = this;
++  nsIAccessible* selected = this;
+   while ((selected = GetNextWithState(selected, nsIAccessibleStates::STATE_SELECTED)) != nsnull) {
+     selected->SetSelected(PR_FALSE);
+   }
+@@ -3066,7 +3066,7 @@ NS_IMETHODIMP nsAccessible::ClearSelecti
+ 
+ NS_IMETHODIMP nsAccessible::SelectAllSelection(PRBool *_retval)
+ {
+-  nsCOMPtr<nsIAccessible> selectable = this;
++  nsIAccessible* selectable = this;
+   while ((selectable = GetNextWithState(selectable, nsIAccessibleStates::STATE_SELECTED)) != nsnull) {
+     selectable->SetSelected(PR_TRUE);
+   }
+@@ -3136,14 +3136,14 @@ nsresult nsAccessible::GetLinkOffset(PRI
+ nsresult nsAccessible::GetLinkOffset(PRInt32* aStartOffset, PRInt32* aEndOffset)
+ {
+   *aStartOffset = *aEndOffset = 0;
+-  nsCOMPtr<nsIAccessible> parent(GetParent());
++  nsIAccessible* parent(GetParent());
+   if (!parent) {
+     return NS_ERROR_FAILURE;
+   }
+ 
+-  nsCOMPtr<nsIAccessible> accessible, nextSibling;
++  nsIAccessible* accessible, *nextSibling;
+   PRInt32 characterCount = 0;
+-  parent->GetFirstChild(getter_AddRefs(accessible));
++  parent->GetFirstChild(&accessible);
+ 
+   while (accessible) {
+     if (IsText(accessible)) {
+@@ -3157,8 +3157,8 @@ nsresult nsAccessible::GetLinkOffset(PRI
+     else {
+       ++ characterCount;
+     }
+-    accessible->GetNextSibling(getter_AddRefs(nextSibling));
+-    accessible.swap(nextSibling);
++    accessible->GetNextSibling(&nextSibling);
++    swap(accessible, nextSibling);
+   }
+ 
+   return NS_ERROR_FAILURE;
+@@ -3169,7 +3169,7 @@ PRInt32 nsAccessible::TextLength(nsIAcce
+   if (!IsText(aAccessible))
+     return 1;
+ 
+-  nsCOMPtr<nsPIAccessNode> pAccNode(do_QueryInterface(aAccessible));
++  nsPIAccessNode* pAccNode(do_QueryInterface(aAccessible));
+   NS_ASSERTION(pAccNode, "QI to nsPIAccessNode failed");
+ 
+   nsIFrame *frame = pAccNode->GetFrame();
+@@ -3187,7 +3187,7 @@ PRInt32 nsAccessible::TextLength(nsIAcce
+   // They don't have their own frame.
+   // XXX In the future, list bullets may have frame and anon content, so 
+   // we should be able to remove this at that point
+-  nsCOMPtr<nsPIAccessible> pAcc(do_QueryInterface(aAccessible));
++  nsPIAccessible* pAcc(do_QueryInterface(aAccessible));
+   NS_ASSERTION(pAcc, "QI to nsPIAccessible failed");
+ 
+   nsAutoString text;
+@@ -3201,16 +3201,16 @@ nsAccessible::AppendTextTo(nsAString& aT
+   return NS_OK;
+ }
+ 
+-already_AddRefed<nsIAccessible>
++nsIAccessible*
+ nsAccessible::GetFirstAvailableAccessible(nsIDOMNode *aStartNode, PRBool aRequireLeaf)
+ {
+   nsIAccessibilityService *accService = GetAccService();
+-  nsCOMPtr<nsIAccessible> accessible;
+-  nsCOMPtr<nsIDOMTreeWalker> walker; 
+-  nsCOMPtr<nsIDOMNode> currentNode(aStartNode);
++  nsIAccessible* accessible;
++  nsIDOMTreeWalker* walker; 
++  nsIDOMNode* currentNode(aStartNode);
+ 
+   while (currentNode) {
+-    accService->GetAccessibleInWeakShell(currentNode, mWeakShell, getter_AddRefs(accessible)); // AddRef'd
++    accService->GetAccessibleInWeakShell(currentNode, mWeakShell, &accessible); // AddRef'd
+     if (accessible && (!aRequireLeaf || IsLeaf(accessible))) {
+       nsIAccessible *retAccessible = accessible;
+       return retAccessible;
+@@ -3218,18 +3218,18 @@ nsAccessible::GetFirstAvailableAccessibl
+     if (!walker) {
+       // Instantiate walker lazily since we won't need it in 90% of the cases
+       // where the first DOM node we're given provides an accessible
+-      nsCOMPtr<nsIDOMDocument> document;
+-      currentNode->GetOwnerDocument(getter_AddRefs(document));
+-      nsCOMPtr<nsIDOMDocumentTraversal> trav = do_QueryInterface(document);
++      nsIDOMDocument* document;
++      currentNode->GetOwnerDocument(&document);
++      nsIDOMDocumentTraversal* trav = do_QueryInterface(document);
+       NS_ASSERTION(trav, "No DOM document traversal for document");
+       NS_ENSURE_TRUE(trav, nsnull);
+       trav->CreateTreeWalker(mDOMNode, nsIDOMNodeFilter::SHOW_ELEMENT | nsIDOMNodeFilter::SHOW_TEXT,
+-                            nsnull, PR_FALSE, getter_AddRefs(walker));
++                            nsnull, PR_FALSE, &walker);
+       NS_ENSURE_TRUE(walker, nsnull);
+       walker->SetCurrentNode(currentNode);
+     }
+ 
+-    walker->NextNode(getter_AddRefs(currentNode));
++    walker->NextNode(&currentNode);
+   }
+ 
+   return nsnull;
+@@ -3282,7 +3282,7 @@ nsAccessible::GetAttrValue(EAriaProperty
+  if (!mRoleMapEntry || mRoleMapEntry->valueRule == eNoValue)
+     return NS_OK_NO_ARIA_VALUE;
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   NS_ENSURE_STATE(content);
+ 
+   PRInt32 result = NS_OK;
+diff --git a/accessible/src/base/nsAccessible.h b/accessible/src/base/nsAccessible.h
+--- a/accessible/src/base/nsAccessible.h
++++ b/accessible/src/base/nsAccessible.h
+@@ -155,7 +155,7 @@ public:
+    */
+   static PRBool MustPrune(nsIAccessible *aAccessible);
+   
+-  already_AddRefed<nsIAccessible> GetParent() {
++  nsIAccessible* GetParent() {
+     nsIAccessible *parent = nsnull;
+     GetParent(&parent);
+     return parent;
+@@ -206,7 +206,7 @@ protected:
+   // depends on the passed-in comptr being null or already set to a child (finding the next sibling).
+   nsIAccessible *NextChild(nsCOMPtr<nsIAccessible>& aAccessible);
+     
+-  already_AddRefed<nsIAccessible> GetNextWithState(nsIAccessible *aStart, PRUint32 matchState);
++  nsIAccessible* GetNextWithState(nsIAccessible *aStart, PRUint32 matchState);
+ 
+   /**
+    * Return an accessible for the given DOM node, or if that node isn't accessible, return the
+@@ -215,10 +215,10 @@ protected:
+    * @param aRequireLeaf, only accept leaf accessible nodes
+    * @return the resulting accessible
+    */   
+-  already_AddRefed<nsIAccessible> GetFirstAvailableAccessible(nsIDOMNode *aStartNode, PRBool aRequireLeaf = PR_FALSE);
++  nsIAccessible* GetFirstAvailableAccessible(nsIDOMNode *aStartNode, PRBool aRequireLeaf = PR_FALSE);
+ 
+   // Selection helpers
+-  static already_AddRefed<nsIAccessible> GetMultiSelectFor(nsIDOMNode *aNode);
++  static nsIAccessible* GetMultiSelectFor(nsIDOMNode *aNode);
+ 
+   // Hyperlink helpers
+   virtual nsresult GetLinkOffset(PRInt32* aStartOffset, PRInt32* aEndOffset);
+diff --git a/accessible/src/base/nsAccessibleEventData.cpp b/accessible/src/base/nsAccessibleEventData.cpp
+--- a/accessible/src/base/nsAccessibleEventData.cpp
++++ b/accessible/src/base/nsAccessibleEventData.cpp
+@@ -87,8 +87,8 @@ void nsAccEvent::GetLastEventAttributes(
+ 
+ void nsAccEvent::CaptureIsFromUserInput(PRBool aIsAsynch)
+ {
+-  nsCOMPtr<nsIDOMNode> eventNode;
+-  GetDOMNode(getter_AddRefs(eventNode));
++  nsIDOMNode* eventNode;
++  GetDOMNode(&eventNode);
+   if (!eventNode) {
+     NS_NOTREACHED("There should always be a DOM node for an event");
+     return;
+@@ -114,8 +114,8 @@ nsAccEvent::GetIsFromUserInput(PRBool *a
+ 
+ void nsAccEvent::PrepareForEvent(nsIAccessibleEvent *aEvent)
+ {
+-  nsCOMPtr<nsIDOMNode> eventNode;
+-  aEvent->GetDOMNode(getter_AddRefs(eventNode));
++  nsIDOMNode* eventNode;
++  aEvent->GetDOMNode(&eventNode);
+   PRBool isFromUserInput;
+   aEvent->GetIsFromUserInput(&isFromUserInput);
+   PrepareForEvent(eventNode, isFromUserInput);
+@@ -130,18 +130,18 @@ void nsAccEvent::PrepareForEvent(nsIDOMN
+     return;
+   }
+ 
+-  nsCOMPtr<nsIDOMDocument> domDoc;
+-  aEventNode->GetOwnerDocument(getter_AddRefs(domDoc));
++  nsIDOMDocument* domDoc;
++  aEventNode->GetOwnerDocument(&domDoc);
+   if (!domDoc) {  // IF the node is a document itself
+     domDoc = do_QueryInterface(aEventNode);
+   }
+-  nsCOMPtr<nsIDocument> doc = do_QueryInterface(domDoc);
++  nsIDocument* doc = do_QueryInterface(domDoc);
+   if (!doc) {
+     NS_NOTREACHED("There should always be a document for an event");
+     return;
+   }
+ 
+-  nsCOMPtr<nsIPresShell> presShell = doc->GetPrimaryShell();
++  nsIPresShell* presShell = doc->GetPrimaryShell();
+   if (!presShell) {
+     NS_NOTREACHED("Threre should always be an pres shell for an event");
+     return;
+@@ -183,7 +183,7 @@ nsAccEvent::GetDOMNode(nsIDOMNode **aDOM
+   *aDOMNode = nsnull;
+ 
+   if (!mDOMNode) {
+-    nsCOMPtr<nsIAccessNode> accessNode(do_QueryInterface(mAccessible));
++    nsIAccessNode* accessNode(do_QueryInterface(mAccessible));
+     NS_ENSURE_TRUE(accessNode, NS_ERROR_FAILURE);
+     accessNode->GetDOMNode(getter_AddRefs(mDOMNode));
+   }
+@@ -200,11 +200,11 @@ nsAccEvent::GetAccessibleDocument(nsIAcc
+ 
+   if (!mDocAccessible) {
+     if (!mAccessible) {
+-      nsCOMPtr<nsIAccessible> accessible;
+-      GetAccessible(getter_AddRefs(accessible));
++      nsIAccessible* accessible;
++      GetAccessible(&accessible);
+     }
+ 
+-    nsCOMPtr<nsIAccessNode> accessNode(do_QueryInterface(mAccessible));
++    nsIAccessNode* accessNode(do_QueryInterface(mAccessible));
+     NS_ENSURE_TRUE(accessNode, NS_ERROR_FAILURE);
+     accessNode->GetAccessibleDocument(getter_AddRefs(mDocAccessible));
+   }
+@@ -213,13 +213,13 @@ nsAccEvent::GetAccessibleDocument(nsIAcc
+   return NS_OK;
+ }
+ 
+-already_AddRefed<nsIAccessible>
++nsIAccessible*
+ nsAccEvent::GetAccessibleByNode()
+ {
+   if (!mDOMNode)
+     return nsnull;
+ 
+-  nsCOMPtr<nsIAccessibilityService> accService = 
++  nsIAccessibilityService* accService = 
+     do_GetService("@mozilla.org/accessibilityService;1");
+   if (!accService)
+     return nsnull;
+@@ -234,20 +234,20 @@ nsAccEvent::GetAccessibleByNode()
+   nsAutoString localName;
+   mDOMNode->GetLocalName(localName);
+   if (localName.EqualsLiteral("tree")) {
+-    nsCOMPtr<nsIDOMXULMultiSelectControlElement> multiSelect =
++    nsIDOMXULMultiSelectControlElement* multiSelect =
+       do_QueryInterface(mDOMNode);
+     if (multiSelect) {
+       PRInt32 treeIndex = -1;
+       multiSelect->GetCurrentIndex(&treeIndex);
+       if (treeIndex >= 0) {
+-        nsCOMPtr<nsIAccessibleTreeCache> treeCache(do_QueryInterface(accessible));
++        nsIAccessibleTreeCache* treeCache(do_QueryInterface(accessible));
+         NS_IF_RELEASE(accessible);
+-        nsCOMPtr<nsIAccessible> treeItemAccessible;
++        nsIAccessible* treeItemAccessible;
+         if (!treeCache ||
+             NS_FAILED(treeCache->GetCachedTreeitemAccessible(
+                       treeIndex,
+                       nsnull,
+-                      getter_AddRefs(treeItemAccessible))) ||
++                      &treeItemAccessible)) ||
+                       !treeItemAccessible) {
+           return nsnull;
+         }
+@@ -292,7 +292,7 @@ nsAccStateChangeEvent::
+   // Use GetAccessibleByNode() because we do not want to store an accessible
+   // since it leads to problems with delayed events in the case when
+   // an accessible gets reorder event before delayed event is processed.
+-  nsCOMPtr<nsIAccessible> accessible(GetAccessibleByNode());
++  nsIAccessible* accessible(GetAccessibleByNode());
+   if (accessible) {
+     PRUint32 state = 0, extraState = 0;
+     accessible->GetFinalState(&state, mIsExtraState ? &extraState : nsnull);
+@@ -335,7 +335,7 @@ nsAccTextChangeEvent::
+              aAccessible, nsnull, aIsAsynch),
+   mStart(aStart), mLength(aLength), mIsInserted(aIsInserted)
+ {
+-  nsCOMPtr<nsIAccessibleText> textAccessible = do_QueryInterface(aAccessible);
++  nsIAccessibleText* textAccessible = do_QueryInterface(aAccessible);
+   NS_ASSERTION(textAccessible, "Should not be firing test change event for non-text accessible!!!");
+   if (textAccessible) {
+     textAccessible->GetText(aStart, aStart + aLength, mModifiedText);
+diff --git a/accessible/src/base/nsAccessibleEventData.h b/accessible/src/base/nsAccessibleEventData.h
+--- a/accessible/src/base/nsAccessibleEventData.h
++++ b/accessible/src/base/nsAccessibleEventData.h
+@@ -66,7 +66,7 @@ public:
+                                       nsIPersistentProperties *aAttributes);
+ 
+ protected:
+-  already_AddRefed<nsIAccessible> GetAccessibleByNode();
++  nsIAccessible* GetAccessibleByNode();
+ 
+   void CaptureIsFromUserInput(PRBool aIsAsynch);
+   PRBool mIsFromUserInput;
+diff --git a/accessible/src/base/nsAccessibleRelation.cpp b/accessible/src/base/nsAccessibleRelation.cpp
+--- a/accessible/src/base/nsAccessibleRelation.cpp
++++ b/accessible/src/base/nsAccessibleRelation.cpp
+@@ -83,7 +83,7 @@ nsAccessibleRelation::GetTargets(nsIArra
+ {
+   NS_ENSURE_ARG_POINTER(aRelations);
+ 
+-  nsCOMPtr<nsIMutableArray> relations = do_CreateInstance(NS_ARRAY_CONTRACTID);
++  nsIMutableArray* relations = do_CreateInstance(NS_ARRAY_CONTRACTID);
+   NS_ENSURE_TRUE(relations, NS_ERROR_OUT_OF_MEMORY);
+ 
+   relations->AppendElement(mTarget, PR_FALSE);
+diff --git a/accessible/src/base/nsAccessibleTreeWalker.cpp b/accessible/src/base/nsAccessibleTreeWalker.cpp
+--- a/accessible/src/base/nsAccessibleTreeWalker.cpp
++++ b/accessible/src/base/nsAccessibleTreeWalker.cpp
+@@ -71,7 +71,7 @@ nsAccessibleTreeWalker::~nsAccessibleTre
+ 
+ void nsAccessibleTreeWalker::GetKids(nsIDOMNode *aParentNode)
+ {
+-  nsCOMPtr<nsIContent> parentContent(do_QueryInterface(aParentNode));
++  nsIContent* parentContent(do_QueryInterface(aParentNode));
+   if (!parentContent || !parentContent->IsNodeOfType(nsINode::eHTML)) {
+     mState.frame = nsnull;  // Don't walk frames in non-HTML content, just walk the DOM.
+   }
+@@ -209,7 +209,7 @@ NS_IMETHODIMP nsAccessibleTreeWalker::Ge
+     return NS_ERROR_FAILURE;
+   }
+ 
+-  nsCOMPtr<nsIDOMNode> parent(mState.domNode);
++  nsIDOMNode* parent(mState.domNode);
+   GetKids(parent); // Side effects change our state (mState)
+ 
+   // Recursive loop: depth first search for first accessible child
+@@ -282,7 +282,7 @@ PRBool nsAccessibleTreeWalker::GetAccess
+   }
+ 
+   mState.accessible = nsnull;
+-  nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
++  nsIPresShell* presShell(do_QueryReferent(mWeakShell));
+ 
+   mAccService->GetAccessible(mState.domNode, presShell, mWeakShell,
+                              &mState.frame, &mState.isHidden,
+diff --git a/accessible/src/base/nsApplicationAccessible.cpp b/accessible/src/base/nsApplicationAccessible.cpp
+--- a/accessible/src/base/nsApplicationAccessible.cpp
++++ b/accessible/src/base/nsApplicationAccessible.cpp
+@@ -68,15 +68,15 @@ NS_IMETHODIMP
+ NS_IMETHODIMP
+ nsApplicationAccessible::GetName(nsAString& aName)
+ {
+-  nsCOMPtr<nsIStringBundleService> bundleService =
++  nsIStringBundleService* bundleService =
+     do_GetService(NS_STRINGBUNDLE_CONTRACTID);
+ 
+   NS_ASSERTION(bundleService, "String bundle service must be present!");
+   NS_ENSURE_STATE(bundleService);
+ 
+-  nsCOMPtr<nsIStringBundle> bundle;
++  nsIStringBundle* bundle;
+   bundleService->CreateBundle("chrome://branding/locale/brand.properties",
+-                              getter_AddRefs(bundle));
++                              &bundle);
+ 
+   nsXPIDLString appName;
+   if (bundle) {
+@@ -149,13 +149,13 @@ nsApplicationAccessible::GetChildAt(PRIn
+   if (aChildNum < 0)
+     aChildNum = count - 1;
+ 
+-  nsCOMPtr<nsIWeakReference> childWeakRef;
++  nsIWeakReference* childWeakRef;
+   rv = mChildren->QueryElementAt(aChildNum, NS_GET_IID(nsIWeakReference),
+-                                 getter_AddRefs(childWeakRef));
++                                 (void**)&childWeakRef);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+   if (childWeakRef) {
+-    nsCOMPtr<nsIAccessible> childAcc(do_QueryReferent(childWeakRef));
++    nsIAccessible* childAcc(do_QueryReferent(childWeakRef));
+     *aChild = childAcc;
+   }
+ 
+@@ -189,16 +189,16 @@ nsApplicationAccessible::CacheChildren()
+   }
+ 
+   if (mAccChildCount == eChildCountUninitialized) {
+-    nsCOMPtr<nsISimpleEnumerator> enumerator;
+-    mChildren->Enumerate(getter_AddRefs(enumerator));
+-
+-    nsCOMPtr<nsIWeakReference> childWeakRef;
+-    nsCOMPtr<nsIAccessible> accessible;
+-    nsCOMPtr<nsPIAccessible> previousAccessible;
++    nsISimpleEnumerator* enumerator;
++    mChildren->Enumerate(&enumerator);
++
++    nsIWeakReference* childWeakRef;
++    nsIAccessible* accessible;
++    nsPIAccessible* previousAccessible;
+     PRBool hasMoreElements;
+     while(NS_SUCCEEDED(enumerator->HasMoreElements(&hasMoreElements))
+           && hasMoreElements) {
+-      enumerator->GetNext(getter_AddRefs(childWeakRef));
++      enumerator->GetNext((class nsISupports**)&childWeakRef);
+       accessible = do_QueryReferent(childWeakRef);
+       if (accessible) {
+         if (previousAccessible)
+@@ -240,7 +240,7 @@ nsApplicationAccessible::RemoveRootAcces
+   PRUint32 index = 0;
+ 
+   // we must use weak ref to get the index
+-  nsCOMPtr<nsIWeakReference> weakPtr = do_GetWeakReference(aRootAccessible);
++  nsIWeakReference* weakPtr = do_GetWeakReference(aRootAccessible);
+   nsresult rv = mChildren->IndexOf(0, weakPtr, &index);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+diff --git a/accessible/src/base/nsBaseWidgetAccessible.cpp b/accessible/src/base/nsBaseWidgetAccessible.cpp
+--- a/accessible/src/base/nsBaseWidgetAccessible.cpp
++++ b/accessible/src/base/nsBaseWidgetAccessible.cpp
+@@ -109,7 +109,7 @@ NS_IMETHODIMP nsLinkableAccessible::Take
+ NS_IMETHODIMP nsLinkableAccessible::TakeFocus()
+ { 
+   if (mActionContent && mActionContent->IsFocusable()) {
+-    mActionContent->SetFocus(nsCOMPtr<nsPresContext>(GetPresContext()));
++    mActionContent->SetFocus((nsPresContext*)(GetPresContext()));
+   }
+   
+   return NS_OK;
+@@ -124,7 +124,7 @@ nsLinkableAccessible::GetState(PRUint32 
+ 
+   if (mIsLink) {
+     *aState |= nsIAccessibleStates::STATE_LINKED;
+-    nsCOMPtr<nsILink> link = do_QueryInterface(mActionContent);
++    nsILink* link = do_QueryInterface(mActionContent);
+     if (link) {
+       nsLinkState linkState;
+       link->GetLinkState(linkState);
+@@ -136,8 +136,8 @@ nsLinkableAccessible::GetState(PRUint32 
+ 
+   // XXX What if we're in a contenteditable container?
+   //     We may need to go up the parent chain unless a better API is found
+-  nsCOMPtr<nsIAccessible> docAccessible =
+-    do_QueryInterface(nsCOMPtr<nsIAccessibleDocument>(GetDocAccessible()));
++  nsIAccessible* docAccessible =
++    do_QueryInterface((nsIAccessibleDocument*)(GetDocAccessible()));
+   if (docAccessible) {
+     PRUint32 docState = 0, docExtraState = 0;
+     rv = docAccessible->GetFinalState(&docState, &docExtraState);
+@@ -155,8 +155,8 @@ NS_IMETHODIMP nsLinkableAccessible::GetV
+ NS_IMETHODIMP nsLinkableAccessible::GetValue(nsAString& _retval)
+ {
+   if (mIsLink) {
+-    nsCOMPtr<nsIDOMNode> linkNode(do_QueryInterface(mActionContent));
+-    nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
++    nsIDOMNode* linkNode(do_QueryInterface(mActionContent));
++    nsIPresShell* presShell(do_QueryReferent(mWeakShell));
+     if (linkNode && presShell)
+       return presShell->GetLinkLocation(linkNode, _retval);
+   }
+@@ -205,13 +205,13 @@ NS_IMETHODIMP nsLinkableAccessible::GetK
+ NS_IMETHODIMP nsLinkableAccessible::GetKeyboardShortcut(nsAString& aKeyboardShortcut)
+ {
+   if (mActionContent) {
+-    nsCOMPtr<nsIDOMNode> actionNode(do_QueryInterface(mActionContent));
++    nsIDOMNode* actionNode(do_QueryInterface(mActionContent));
+     if (actionNode && mDOMNode != actionNode) {
+-      nsCOMPtr<nsIAccessible> accessible;
+-      nsCOMPtr<nsIAccessibilityService> accService = 
++      nsIAccessible* accessible;
++      nsIAccessibilityService* accService = 
+         do_GetService("@mozilla.org/accessibilityService;1");
+       accService->GetAccessibleInWeakShell(actionNode, mWeakShell,
+-                                           getter_AddRefs(accessible));
++                                           &accessible);
+       if (accessible) {
+         accessible->GetKeyboardShortcut(aKeyboardShortcut);
+       }
+@@ -223,20 +223,20 @@ NS_IMETHODIMP nsLinkableAccessible::GetK
+ 
+ void nsLinkableAccessible::CacheActionContent()
+ {
+-  for (nsCOMPtr<nsIContent> walkUpContent(do_QueryInterface(mDOMNode));
++  for (nsIContent* walkUpContent(do_QueryInterface(mDOMNode));
+        walkUpContent;
+        walkUpContent = walkUpContent->GetParent()) {
+     PRBool isOnclick = nsAccUtils::HasListener(walkUpContent, NS_LITERAL_STRING("click"));
+     nsIAtom *tag = walkUpContent->Tag();
+     if ((tag == nsAccessibilityAtoms::a || tag == nsAccessibilityAtoms::area) &&
+         walkUpContent->IsNodeOfType(nsINode::eHTML)) {
+-      nsCOMPtr<nsILink> link = do_QueryInterface(walkUpContent);
++      nsILink* link = do_QueryInterface(walkUpContent);
+       if (link) {
+         // Currently we do not expose <link> tags, because they are not typically
+         // in <body> and rendered.
+         // We do not yet support xlinks
+-        nsCOMPtr<nsIURI> uri;
+-        link->GetHrefURI(getter_AddRefs(uri));
++        nsIURI* uri;
++        link->GetHrefURI(&uri);
+         if (uri) {
+           mActionContent = walkUpContent;
+           mIsLink = PR_TRUE;
+@@ -269,7 +269,7 @@ NS_IMETHODIMP nsLinkableAccessible::GetU
+     return NS_ERROR_FAILURE;
+   }
+ 
+-  nsCOMPtr<nsILink> link(do_QueryInterface(mActionContent));
++  nsILink* link(do_QueryInterface(mActionContent));
+   if (link) {
+     return link->GetHrefURI(aURI);
+   }
+diff --git a/accessible/src/base/nsCaretAccessible.cpp b/accessible/src/base/nsCaretAccessible.cpp
+--- a/accessible/src/base/nsCaretAccessible.cpp
++++ b/accessible/src/base/nsCaretAccessible.cpp
+@@ -77,7 +77,7 @@ void nsCaretAccessible::Shutdown()
+ 
+ nsresult nsCaretAccessible::ClearControlSelectionListener()
+ {
+-  nsCOMPtr<nsISelectionPrivate> selPrivate(do_QueryReferent(mCurrentControlSelection));
++  nsISelectionPrivate* selPrivate(do_QueryReferent(mCurrentControlSelection));
+   NS_ENSURE_TRUE(selPrivate, NS_ERROR_FAILURE);
+ 
+   mCurrentControlSelection = nsnull;
+@@ -92,15 +92,15 @@ nsresult nsCaretAccessible::SetControlSe
+ 
+   // When focus moves such that the caret is part of a new frame selection
+   // this removes the old selection listener and attaches a new one for the current focus
+-  nsCOMPtr<nsIPresShell> presShell = 
++  nsIPresShell* presShell = 
+     mRootAccessible->GetPresShellFor(aCurrentNode);
+   if (!presShell)
+     return NS_ERROR_FAILURE;
+ 
+-  nsCOMPtr<nsIDocument> doc = presShell->GetDocument();
+-  NS_ENSURE_TRUE(doc, NS_ERROR_FAILURE);
+-
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(aCurrentNode));
++  nsIDocument* doc = presShell->GetDocument();
++  NS_ENSURE_TRUE(doc, NS_ERROR_FAILURE);
++
++  nsIContent* content(do_QueryInterface(aCurrentNode));
+   // The control selection listener is only for form controls, not for the document
+   // When there is no document, the content will be null
+   if (!content) {
+@@ -113,15 +113,15 @@ nsresult nsCaretAccessible::SetControlSe
+   nsPresContext *presContext = presShell->GetPresContext();
+   NS_ENSURE_TRUE(presContext, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsISelectionController> selCon;
+-  frame->GetSelectionController(presContext, getter_AddRefs(selCon));
+-  NS_ENSURE_TRUE(selCon, NS_ERROR_FAILURE);
+-  
+-  nsCOMPtr<nsISelection> domSel;
+-  selCon->GetSelection(nsISelectionController::SELECTION_NORMAL, getter_AddRefs(domSel));
++  nsISelectionController* selCon;
++  frame->GetSelectionController(presContext, &selCon);
++  NS_ENSURE_TRUE(selCon, NS_ERROR_FAILURE);
++  
++  nsISelection* domSel;
++  selCon->GetSelection(nsISelectionController::SELECTION_NORMAL, &domSel);
+ 
+   ClearControlSelectionListener();
+-  nsCOMPtr<nsISelectionPrivate> selPrivate(do_QueryInterface(domSel));
++  nsISelectionPrivate* selPrivate(do_QueryInterface(domSel));
+   NS_ENSURE_TRUE(selPrivate, NS_ERROR_FAILURE);
+ 
+   mCurrentControlSelection = do_GetWeakReference(domSel);
+@@ -130,14 +130,14 @@ nsresult nsCaretAccessible::SetControlSe
+ 
+ nsresult nsCaretAccessible::AddDocSelectionListener(nsIDOMDocument *aDoc)
+ {
+-  nsCOMPtr<nsIDocument> doc = do_QueryInterface(aDoc);
+-  NS_ENSURE_TRUE(doc, NS_ERROR_FAILURE);
+-  nsCOMPtr<nsISelectionController> selCon = do_QueryInterface(doc->GetPrimaryShell());
+-  NS_ENSURE_TRUE(selCon, NS_ERROR_FAILURE);
+-
+-  nsCOMPtr<nsISelection> domSel;
+-  selCon->GetSelection(nsISelectionController::SELECTION_NORMAL, getter_AddRefs(domSel));
+-  nsCOMPtr<nsISelectionPrivate> selPrivate = do_QueryInterface(domSel);
++  nsIDocument* doc = do_QueryInterface(aDoc);
++  NS_ENSURE_TRUE(doc, NS_ERROR_FAILURE);
++  nsISelectionController* selCon = do_QueryInterface(doc->GetPrimaryShell());
++  NS_ENSURE_TRUE(selCon, NS_ERROR_FAILURE);
++
++  nsISelection* domSel;
++  selCon->GetSelection(nsISelectionController::SELECTION_NORMAL, &domSel);
++  nsISelectionPrivate* selPrivate = do_QueryInterface(domSel);
+   NS_ENSURE_TRUE(selPrivate, NS_ERROR_FAILURE);
+ 
+   return selPrivate->AddSelectionListener(this);
+@@ -145,15 +145,15 @@ nsresult nsCaretAccessible::AddDocSelect
+ 
+ nsresult nsCaretAccessible::RemoveDocSelectionListener(nsIDOMDocument *aDoc)
+ {
+-  nsCOMPtr<nsIDocument> doc = do_QueryInterface(aDoc);
+-  NS_ENSURE_TRUE(doc, NS_ERROR_FAILURE);
+-
+-  nsCOMPtr<nsISelectionController> selCon = do_QueryInterface(doc->GetPrimaryShell());
+-  NS_ENSURE_TRUE(selCon, NS_ERROR_FAILURE);
+-
+-  nsCOMPtr<nsISelection> domSel;
+-  selCon->GetSelection(nsISelectionController::SELECTION_NORMAL, getter_AddRefs(domSel));
+-  nsCOMPtr<nsISelectionPrivate> selPrivate = do_QueryInterface(domSel);
++  nsIDocument* doc = do_QueryInterface(aDoc);
++  NS_ENSURE_TRUE(doc, NS_ERROR_FAILURE);
++
++  nsISelectionController* selCon = do_QueryInterface(doc->GetPrimaryShell());
++  NS_ENSURE_TRUE(selCon, NS_ERROR_FAILURE);
++
++  nsISelection* domSel;
++  selCon->GetSelection(nsISelectionController::SELECTION_NORMAL, &domSel);
++  nsISelectionPrivate* selPrivate = do_QueryInterface(domSel);
+   NS_ENSURE_TRUE(selPrivate, NS_ERROR_FAILURE);
+ 
+   return selPrivate->RemoveSelectionListener(this);
+@@ -163,42 +163,42 @@ NS_IMETHODIMP nsCaretAccessible::NotifyS
+ {
+   mLastUsedSelection = do_GetWeakReference(aSel);
+ 
+-  nsCOMPtr<nsIDocument> doc = do_QueryInterface(aDoc);
++  nsIDocument* doc = do_QueryInterface(aDoc);
+   nsIPresShell *presShell = doc->GetPrimaryShell();
+   NS_ENSURE_TRUE(presShell, NS_OK);
+ 
+   // Get first nnsIAccessibleText in parent chain and fire caret-move, selection-change event for it
+-  nsCOMPtr<nsIAccessible> accessible;
++  nsIAccessible* accessible;
+   nsIAccessibilityService *accService = mRootAccessible->GetAccService();
+   NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
+   // Get accessible from selection's focus node or its parent
+-  nsCOMPtr<nsIDOMNode> focusNode;
+-  aSel->GetFocusNode(getter_AddRefs(focusNode));
++  nsIDOMNode* focusNode;
++  aSel->GetFocusNode(&focusNode);
+   if (!focusNode) {
+     mLastTextAccessible = nsnull;
+     return NS_OK; // No selection
+   }
+-  nsCOMPtr<nsIDOMNode> nodeWithCaret = focusNode;
+-
+-  nsCOMPtr<nsIAccessibleText> textAcc;
++  nsIDOMNode* nodeWithCaret = focusNode;
++
++  nsIAccessibleText* textAcc;
+   while (focusNode) {
+     // Make sure to get the correct starting node for selection events inside XBL content trees
+-    nsCOMPtr<nsIDOMNode> relevantNode;
+-    if (NS_SUCCEEDED(accService->GetRelevantContentNodeFor(focusNode, getter_AddRefs(relevantNode))) && relevantNode) {
++    nsIDOMNode* relevantNode;
++    if (NS_SUCCEEDED(accService->GetRelevantContentNodeFor(focusNode, &relevantNode)) && relevantNode) {
+       focusNode  = relevantNode;
+     }
+ 
+-    nsCOMPtr<nsIContent> content = do_QueryInterface(focusNode);
++    nsIContent* content = do_QueryInterface(focusNode);
+     if (!content || !content->IsNodeOfType(nsINode::eTEXT)) {
+-      accService->GetAccessibleInShell(focusNode, presShell,  getter_AddRefs(accessible));
++      accService->GetAccessibleInShell(focusNode, presShell,  &accessible);
+       textAcc = do_QueryInterface(accessible);
+       if (textAcc) {
+         break;
+       }
+     }
+-    nsCOMPtr<nsIDOMNode> parentNode;
+-    focusNode->GetParentNode(getter_AddRefs(parentNode));
+-    focusNode.swap(parentNode);
++    nsIDOMNode* parentNode;
++    focusNode->GetParentNode(&parentNode);
++    swap(focusNode, parentNode);
+   }
+   NS_ASSERTION(textAcc, "No nsIAccessibleText for caret move event!"); // No nsIAccessibleText for caret move event!
+   NS_ENSURE_TRUE(textAcc, NS_ERROR_FAILURE);
+@@ -217,7 +217,7 @@ NS_IMETHODIMP nsCaretAccessible::NotifyS
+   mLastCaretOffset = caretOffset;
+   mLastTextAccessible = textAcc;
+ 
+-  nsCOMPtr<nsIAccessibleCaretMoveEvent> event =
++  nsIAccessibleCaretMoveEvent* event =
+     new nsAccCaretMoveEvent(focusNode);
+   NS_ENSURE_TRUE(event, NS_ERROR_OUT_OF_MEMORY);
+ 
+@@ -235,23 +235,23 @@ nsCaretAccessible::GetCaretRect(nsIWidge
+     return caretRect;    // Return empty rect
+   }
+ 
+-  nsCOMPtr<nsIAccessNode> lastAccessNode(do_QueryInterface(mLastTextAccessible));
++  nsIAccessNode* lastAccessNode(do_QueryInterface(mLastTextAccessible));
+   NS_ENSURE_TRUE(lastAccessNode, caretRect);
+ 
+-  nsCOMPtr<nsIDOMNode> lastNodeWithCaret;
+-  lastAccessNode->GetDOMNode(getter_AddRefs(lastNodeWithCaret));
++  nsIDOMNode* lastNodeWithCaret;
++  lastAccessNode->GetDOMNode(&lastNodeWithCaret);
+   NS_ENSURE_TRUE(lastNodeWithCaret, caretRect);
+ 
+-  nsCOMPtr<nsIPresShell> presShell = mRootAccessible->GetPresShellFor(lastNodeWithCaret);
++  nsIPresShell* presShell = mRootAccessible->GetPresShellFor(lastNodeWithCaret);
+   NS_ENSURE_TRUE(presShell, caretRect);
+ 
+-  nsCOMPtr<nsICaret> caret;
+-  presShell->GetCaret(getter_AddRefs(caret));
++  nsICaret* caret;
++  presShell->GetCaret(&caret);
+   NS_ENSURE_TRUE(caret, caretRect);
+ 
+   PRBool isCollapsed;
+   nsIView *view;
+-  nsCOMPtr<nsISelection> caretSelection(do_QueryReferent(mLastUsedSelection));
++  nsISelection* caretSelection(do_QueryReferent(mLastUsedSelection));
+   NS_ENSURE_TRUE(caretSelection, caretRect);
+   
+   caret->GetCaretCoordinates(nsICaret::eRenderingViewCoordinates, caretSelection,
+diff --git a/accessible/src/base/nsDocAccessible.cpp b/accessible/src/base/nsDocAccessible.cpp
+--- a/accessible/src/base/nsDocAccessible.cpp
++++ b/accessible/src/base/nsDocAccessible.cpp
+@@ -96,7 +96,7 @@ nsDocAccessible::nsDocAccessible(nsIDOMN
+   // there can be 2 nsDocAccessible's for the content area, although for 2 different
+   // pres shells.
+ 
+-  nsCOMPtr<nsIPresShell> shell(do_QueryReferent(mWeakShell));
++  nsIPresShell* shell(do_QueryReferent(mWeakShell));
+   if (shell) {
+     // Find mDocument
+     mDocument = shell->GetDocument();
+@@ -106,7 +106,7 @@ nsDocAccessible::nsDocAccessible(nsIDOMN
+       return;
+     }
+     
+-    nsCOMPtr<nsIDOMNSHTMLDocument> htmlDoc(do_QueryInterface(mDocument));
++    nsIDOMNSHTMLDocument* htmlDoc(do_QueryInterface(mDocument));
+     if (htmlDoc) {
+       nsAutoString mimeType;
+       GetMimeType(mimeType);
+@@ -118,8 +118,8 @@ nsDocAccessible::nsDocAccessible(nsIDOMN
+     // Find mWnd
+     nsIViewManager* vm = shell->GetViewManager();
+     if (vm) {
+-      nsCOMPtr<nsIWidget> widget;
+-      vm->GetWidget(getter_AddRefs(widget));
++      nsIWidget* widget;
++      vm->GetWidget(&widget);
+       if (widget) {
+         mWnd = widget->GetNativeData(NS_NATIVE_WINDOW);
+       }
+@@ -129,9 +129,9 @@ nsDocAccessible::nsDocAccessible(nsIDOMN
+   // XXX aaronl should we use an algorithm for the initial cache size?
+   mAccessNodeCache.Init(kDefaultCacheSize);
+ 
+-  nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem =
++  nsIDocShellTreeItem* docShellTreeItem =
+     nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
+-  nsCOMPtr<nsIDocShell> docShell = do_QueryInterface(docShellTreeItem);
++  nsIDocShell* docShell = do_QueryInterface(docShellTreeItem);
+   if (docShell) {
+     PRUint32 busyFlags;
+     docShell->GetBusyFlags(&busyFlags);
+@@ -183,11 +183,11 @@ NS_IMETHODIMP nsDocAccessible::GetRole(P
+ {
+   *aRole = nsIAccessibleRole::ROLE_PANE; // Fall back
+ 
+-  nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem =
++  nsIDocShellTreeItem* docShellTreeItem =
+     nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
+   if (docShellTreeItem) {
+-    nsCOMPtr<nsIDocShellTreeItem> sameTypeRoot;
+-    docShellTreeItem->GetSameTypeRootTreeItem(getter_AddRefs(sameTypeRoot));
++    nsIDocShellTreeItem* sameTypeRoot;
++    docShellTreeItem->GetSameTypeRootTreeItem(&sameTypeRoot);
+     PRInt32 itemType;
+     docShellTreeItem->GetItemType(&itemType);
+     if (sameTypeRoot == docShellTreeItem) {
+@@ -197,7 +197,7 @@ NS_IMETHODIMP nsDocAccessible::GetRole(P
+       }
+       else if (itemType == nsIDocShellTreeItem::typeContent) {
+ #ifdef MOZ_XUL
+-        nsCOMPtr<nsIXULDocument> xulDoc(do_QueryInterface(mDocument));
++        nsIXULDocument* xulDoc(do_QueryInterface(mDocument));
+         if (xulDoc) {
+           *aRole = nsIAccessibleRole::ROLE_APPLICATION;
+         } else {
+@@ -237,7 +237,7 @@ nsDocAccessible::GetState(PRUint32 *aSta
+   nsAccessible::GetState(aState, aExtraState);
+ 
+ #ifdef MOZ_XUL
+-  nsCOMPtr<nsIXULDocument> xulDoc(do_QueryInterface(mDocument));
++  nsIXULDocument* xulDoc(do_QueryInterface(mDocument));
+   if (!xulDoc)
+ #endif
+   {
+@@ -265,8 +265,8 @@ nsDocAccessible::GetState(PRUint32 *aSta
+     }
+   }
+ 
+-  nsCOMPtr<nsIEditor> editor;
+-  GetAssociatedEditor(getter_AddRefs(editor));
++  nsIEditor* editor;
++  GetAssociatedEditor(&editor);
+   if (!editor) {
+     *aState |= nsIAccessibleStates::STATE_READONLY;
+   }
+@@ -286,7 +286,7 @@ NS_IMETHODIMP nsDocAccessible::GetFocuse
+ 
+   // Return an accessible for the current global focus, which does not have to
+   // be contained within the current document.
+-  nsCOMPtr<nsIAccessibilityService> accService =
++  nsIAccessibilityService* accService =
+     do_GetService("@mozilla.org/accessibilityService;1");
+   return accService->GetAccessibleFor(gLastFocusedNode, aFocusedChild);
+ }
+@@ -300,12 +300,12 @@ NS_IMETHODIMP nsDocAccessible::TakeFocus
+     return NS_ERROR_FAILURE; // Not focusable
+   }
+ 
+-  nsCOMPtr<nsIDocShellTreeItem> treeItem =
++  nsIDocShellTreeItem* treeItem =
+     nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
+-  nsCOMPtr<nsIDocShell> docShell = do_QueryInterface(treeItem);
++  nsIDocShell* docShell = do_QueryInterface(treeItem);
+   NS_ENSURE_TRUE(docShell, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIPresShell> shell(GetPresShell());
++  nsIPresShell* shell(GetPresShell());
+   if (!shell) {
+     NS_WARNING("Was not shutdown properly via InvalidateCacheSubtree()");
+     return NS_ERROR_FAILURE;
+@@ -328,12 +328,12 @@ NS_IMETHODIMP nsDocAccessible::GetURL(ns
+   if (!mDocument) {
+     return NS_ERROR_FAILURE; // Document has been shut down
+   }
+-  nsCOMPtr<nsISupports> container = mDocument->GetContainer();
+-  nsCOMPtr<nsIWebNavigation> webNav(do_GetInterface(container));
++  nsISupports* container = mDocument->GetContainer();
++  nsIWebNavigation* webNav(do_GetInterface(container));
+   nsCAutoString theURL;
+   if (webNav) {
+-    nsCOMPtr<nsIURI> pURI;
+-    webNav->GetCurrentURI(getter_AddRefs(pURI));
++    nsIURI* pURI;
++    webNav->GetCurrentURI(&pURI);
+     if (pURI)
+       pURI->GetSpec(theURL);
+   }
+@@ -353,7 +353,7 @@ NS_IMETHODIMP nsDocAccessible::GetTitle(
+ 
+ NS_IMETHODIMP nsDocAccessible::GetMimeType(nsAString& aMimeType)
+ {
+-  nsCOMPtr<nsIDOMNSDocument> domnsDocument(do_QueryInterface(mDocument));
++  nsIDOMNSDocument* domnsDocument(do_QueryInterface(mDocument));
+   if (domnsDocument) {
+     return domnsDocument->GetContentType(aMimeType);
+   }
+@@ -362,17 +362,17 @@ NS_IMETHODIMP nsDocAccessible::GetMimeTy
+ 
+ NS_IMETHODIMP nsDocAccessible::GetDocType(nsAString& aDocType)
+ {
+-  nsCOMPtr<nsIDOMDocument> domDoc(do_QueryInterface(mDocument));
+-  nsCOMPtr<nsIDOMDocumentType> docType;
++  nsIDOMDocument* domDoc(do_QueryInterface(mDocument));
++  nsIDOMDocumentType* docType;
+ 
+ #ifdef MOZ_XUL
+-  nsCOMPtr<nsIXULDocument> xulDoc(do_QueryInterface(mDocument));
++  nsIXULDocument* xulDoc(do_QueryInterface(mDocument));
+   if (xulDoc) {
+     aDocType.AssignLiteral("window"); // doctype not implemented for XUL at time of writing - causes assertion
+     return NS_OK;
+   } else
+ #endif
+-  if (domDoc && NS_SUCCEEDED(domDoc->GetDoctype(getter_AddRefs(docType))) && docType) {
++  if (domDoc && NS_SUCCEEDED(domDoc->GetDoctype(&docType)) && docType) {
+     return docType->GetPublicId(aDocType);
+   }
+ 
+@@ -382,7 +382,7 @@ NS_IMETHODIMP nsDocAccessible::GetNameSp
+ NS_IMETHODIMP nsDocAccessible::GetNameSpaceURIForID(PRInt16 aNameSpaceID, nsAString& aNameSpaceURI)
+ {
+   if (mDocument) {
+-    nsCOMPtr<nsINameSpaceManager> nameSpaceManager =
++    nsINameSpaceManager* nameSpaceManager =
+         do_GetService(NS_NAMESPACEMANAGER_CONTRACTID);
+     if (nameSpaceManager)
+       return nameSpaceManager->GetNameSpaceURI(aNameSpaceID, aNameSpaceURI);
+@@ -412,7 +412,7 @@ NS_IMETHODIMP nsDocAccessible::GetWindow
+ 
+ NS_IMETHODIMP nsDocAccessible::GetDocument(nsIDOMDocument **aDOMDoc)
+ {
+-  nsCOMPtr<nsIDOMDocument> domDoc(do_QueryInterface(mDocument));
++  nsIDOMDocument* domDoc(do_QueryInterface(mDocument));
+   *aDOMDoc = domDoc;
+ 
+   if (domDoc) {
+@@ -433,13 +433,13 @@ NS_IMETHODIMP nsDocAccessible::GetAssoci
+     return NS_OK; // Document not editable
+   }
+ 
+-  nsCOMPtr<nsISupports> container = mDocument->GetContainer();
+-  nsCOMPtr<nsIEditingSession> editingSession(do_GetInterface(container));
++  nsISupports* container = mDocument->GetContainer();
++  nsIEditingSession* editingSession(do_GetInterface(container));
+   if (!editingSession)
+     return NS_OK; // No editing session interface
+ 
+-  nsCOMPtr<nsIEditor> editor;
+-  editingSession->GetEditorForWindow(mDocument->GetWindow(), getter_AddRefs(editor));
++  nsIEditor* editor;
++  editingSession->GetEditorForWindow(mDocument->GetWindow(), &editor);
+   if (!editor) {
+     return NS_OK;
+   }
+@@ -488,9 +488,9 @@ NS_IMETHODIMP nsDocAccessible::GetParent
+     nsIDocument *parentDoc = mDocument->GetParentDocument();
+     NS_ENSURE_TRUE(parentDoc, NS_ERROR_FAILURE);
+     nsIContent *ownerContent = parentDoc->FindContentForSubDocument(mDocument);
+-    nsCOMPtr<nsIDOMNode> ownerNode(do_QueryInterface(ownerContent));
++    nsIDOMNode* ownerNode(do_QueryInterface(ownerContent));
+     if (ownerNode) {
+-      nsCOMPtr<nsIAccessibilityService> accService =
++      nsIAccessibilityService* accService =
+         do_GetService("@mozilla.org/accessibilityService;1");
+       if (accService) {
+         // XXX aaronl: ideally we would traverse the presshell chain
+@@ -549,7 +549,7 @@ NS_IMETHODIMP nsDocAccessible::Shutdown(
+     return NS_OK;  // Already shutdown
+   }
+ 
+-  nsCOMPtr<nsIDocShellTreeItem> treeItem =
++  nsIDocShellTreeItem* treeItem =
+     nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
+   ShutdownChildDocuments(treeItem);
+ 
+@@ -577,20 +577,20 @@ NS_IMETHODIMP nsDocAccessible::Shutdown(
+ 
+ void nsDocAccessible::ShutdownChildDocuments(nsIDocShellTreeItem *aStart)
+ {
+-  nsCOMPtr<nsIDocShellTreeNode> treeNode(do_QueryInterface(aStart));
++  nsIDocShellTreeNode* treeNode(do_QueryInterface(aStart));
+   if (treeNode) {
+     PRInt32 subDocuments;
+     treeNode->GetChildCount(&subDocuments);
+     for (PRInt32 count = 0; count < subDocuments; count ++) {
+-      nsCOMPtr<nsIDocShellTreeItem> treeItemChild;
+-      treeNode->GetChildAt(count, getter_AddRefs(treeItemChild));
++      nsIDocShellTreeItem* treeItemChild;
++      treeNode->GetChildAt(count, &treeItemChild);
+       NS_ASSERTION(treeItemChild, "No tree item when there should be");
+       if (!treeItemChild) {
+         continue;
+       }
+-      nsCOMPtr<nsIAccessibleDocument> docAccessible =
++      nsIAccessibleDocument* docAccessible =
+         GetDocAccessibleFor(treeItemChild);
+-      nsCOMPtr<nsPIAccessNode> accessNode = do_QueryInterface(docAccessible);
++      nsPIAccessNode* accessNode = do_QueryInterface(docAccessible);
+       if (accessNode) {
+         accessNode->Shutdown();
+       }
+@@ -600,7 +600,7 @@ void nsDocAccessible::ShutdownChildDocum
+ 
+ nsIFrame* nsDocAccessible::GetFrame()
+ {
+-  nsCOMPtr<nsIPresShell> shell(do_QueryReferent(mWeakShell));
++  nsIPresShell* shell(do_QueryReferent(mWeakShell));
+ 
+   nsIFrame* root = nsnull;
+   if (shell)
+@@ -658,11 +658,11 @@ nsresult nsDocAccessible::AddEventListen
+   // 1) Set up scroll position listener
+   // 2) Check for editor and listen for changes to editor
+ 
+-  nsCOMPtr<nsIPresShell> presShell(GetPresShell());
++  nsIPresShell* presShell(GetPresShell());
+   NS_ENSURE_TRUE(presShell, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsISupports> container = mDocument->GetContainer();
+-  nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem(do_QueryInterface(container));
++  nsISupports* container = mDocument->GetContainer();
++  nsIDocShellTreeItem* docShellTreeItem(do_QueryInterface(container));
+   NS_ENSURE_TRUE(docShellTreeItem, NS_ERROR_FAILURE);
+ 
+   // Make sure we're a content docshell
+@@ -674,22 +674,22 @@ nsresult nsDocAccessible::AddEventListen
+ 
+   if (isContent) {
+     // We're not an editor yet, but we might become one
+-    nsCOMPtr<nsICommandManager> commandManager = do_GetInterface(docShellTreeItem);
++    nsICommandManager* commandManager = do_GetInterface(docShellTreeItem);
+     if (commandManager) {
+       commandManager->AddCommandObserver(this, "obs_documentCreated");
+     }
+   }
+ 
+-  nsCOMPtr<nsIDocShellTreeItem> rootTreeItem;
+-  docShellTreeItem->GetRootTreeItem(getter_AddRefs(rootTreeItem));
++  nsIDocShellTreeItem* rootTreeItem;
++  docShellTreeItem->GetRootTreeItem(&rootTreeItem);
+   if (rootTreeItem) {
+-    nsCOMPtr<nsIAccessibleDocument> rootAccDoc =
++    nsIAccessibleDocument* rootAccDoc =
+       GetDocAccessibleFor(rootTreeItem, PR_TRUE); // Ensure root accessible is created;
+-    nsRefPtr<nsRootAccessible> rootAccessible = GetRootAccessible(); // Then get it as ref ptr
++    nsRootAccessible* rootAccessible = GetRootAccessible(); // Then get it as ref ptr
+     NS_ENSURE_TRUE(rootAccessible, NS_ERROR_FAILURE);
+-    nsRefPtr<nsCaretAccessible> caretAccessible = rootAccessible->GetCaretAccessible();
++    nsCaretAccessible* caretAccessible = rootAccessible->GetCaretAccessible();
+     if (caretAccessible) {
+-      nsCOMPtr<nsIDOMDocument> domDoc = do_QueryInterface(mDocument);
++      nsIDOMDocument* domDoc = do_QueryInterface(mDocument);
+       caretAccessible->AddDocSelectionListener(domDoc);
+     }
+   }
+@@ -713,23 +713,23 @@ nsresult nsDocAccessible::RemoveEventLis
+     mScrollWatchTimer = nsnull;
+   }
+ 
+-  nsRefPtr<nsRootAccessible> rootAccessible(GetRootAccessible());
++  nsRootAccessible* rootAccessible(GetRootAccessible());
+   if (rootAccessible) {
+-    nsRefPtr<nsCaretAccessible> caretAccessible = rootAccessible->GetCaretAccessible();
++    nsCaretAccessible* caretAccessible = rootAccessible->GetCaretAccessible();
+     if (caretAccessible) {
+-      nsCOMPtr<nsIDOMDocument> domDoc = do_QueryInterface(mDocument);
++      nsIDOMDocument* domDoc = do_QueryInterface(mDocument);
+       caretAccessible->RemoveDocSelectionListener(domDoc);
+     }
+   }
+ 
+-  nsCOMPtr<nsISupports> container = mDocument->GetContainer();
+-  nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem(do_QueryInterface(container));
++  nsISupports* container = mDocument->GetContainer();
++  nsIDocShellTreeItem* docShellTreeItem(do_QueryInterface(container));
+   NS_ENSURE_TRUE(docShellTreeItem, NS_ERROR_FAILURE);
+ 
+   PRInt32 itemType;
+   docShellTreeItem->GetItemType(&itemType);
+   if (itemType == nsIDocShellTreeItem::typeContent) {
+-    nsCOMPtr<nsICommandManager> commandManager = do_GetInterface(docShellTreeItem);
++    nsICommandManager* commandManager = do_GetInterface(docShellTreeItem);
+     if (commandManager) {
+       commandManager->RemoveCommandObserver(this, "obs_documentCreated");
+     }
+@@ -743,12 +743,12 @@ NS_IMETHODIMP nsDocAccessible::FireAncho
+   if (!mIsContentLoaded || !mDocument) {
+     return NS_OK;
+   }
+-  nsCOMPtr<nsISupports> container = mDocument->GetContainer();
+-  nsCOMPtr<nsIWebNavigation> webNav(do_GetInterface(container));
++  nsISupports* container = mDocument->GetContainer();
++  nsIWebNavigation* webNav(do_GetInterface(container));
+   nsCAutoString theURL;
+   if (webNav) {
+-    nsCOMPtr<nsIURI> pURI;
+-    webNav->GetCurrentURI(getter_AddRefs(pURI));
++    nsIURI* pURI;
++    webNav->GetCurrentURI(&pURI);
+     if (pURI) {
+       pURI->GetSpec(theURL);
+     }
+@@ -792,8 +792,8 @@ NS_IMETHODIMP nsDocAccessible::FireDocLo
+   if (isFinished) {
+     // Need to wait until scrollable view is available
+     AddScrollListener();
+-    nsCOMPtr<nsIAccessible> parent(nsAccessible::GetParent());
+-    nsCOMPtr<nsPIAccessible> privateAccessible(do_QueryInterface(parent));
++    nsIAccessible* parent(nsAccessible::GetParent());
++    nsPIAccessible* privateAccessible(do_QueryInterface(parent));
+     if (privateAccessible) {
+       // Make the parent forget about the old document as a child
+       privateAccessible->InvalidateChildren();
+@@ -808,20 +808,20 @@ NS_IMETHODIMP nsDocAccessible::FireDocLo
+                                           nsITimer::TYPE_ONE_SHOT);
+     }
+   } else {
+-    nsCOMPtr<nsIDocShellTreeItem> treeItem =
++    nsIDocShellTreeItem* treeItem =
+       nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
+     if (!treeItem) {
+       return NS_OK;
+     }
+ 
+-    nsCOMPtr<nsIDocShellTreeItem> sameTypeRoot;
+-    treeItem->GetSameTypeRootTreeItem(getter_AddRefs(sameTypeRoot));
++    nsIDocShellTreeItem* sameTypeRoot;
++    treeItem->GetSameTypeRootTreeItem(&sameTypeRoot);
+     if (sameTypeRoot != treeItem) {
+       return NS_OK; 
+     }
+ 
+     // Loading document: fire EVENT_STATE_CHANGE to set STATE_BUSY
+-    nsCOMPtr<nsIAccessibleStateChangeEvent> accEvent =
++    nsIAccessibleStateChangeEvent* accEvent =
+       new nsAccStateChangeEvent(this, nsIAccessibleStates::STATE_BUSY,
+                                 PR_FALSE, PR_TRUE);
+     FireAccessibleEvent(accEvent);
+@@ -853,7 +853,7 @@ void nsDocAccessible::ScrollTimerCallbac
+ 
+ void nsDocAccessible::AddScrollListener()
+ {
+-  nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
++  nsIPresShell* presShell(do_QueryReferent(mWeakShell));
+ 
+   nsIViewManager* vm = nsnull;
+   if (presShell)
+@@ -869,7 +869,7 @@ void nsDocAccessible::AddScrollListener(
+ 
+ void nsDocAccessible::RemoveScrollListener()
+ {
+-  nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
++  nsIPresShell* presShell(do_QueryReferent(mWeakShell));
+ 
+   nsIViewManager* vm = nsnull;
+   if (presShell)
+@@ -913,7 +913,7 @@ NS_IMETHODIMP nsDocAccessible::Observe(n
+ {
+   if (!nsCRT::strcmp(aTopic,"obs_documentCreated")) {    
+     // State editable will now be set, readonly is now clear
+-    nsCOMPtr<nsIAccessibleStateChangeEvent> event =
++    nsIAccessibleStateChangeEvent* event =
+       new nsAccStateChangeEvent(this, nsIAccessibleStates::EXT_STATE_EDITABLE,
+                                 PR_TRUE, PR_TRUE);
+     FireAccessibleEvent(event);
+@@ -944,10 +944,10 @@ nsDocAccessible::AttributeChanged(nsIDoc
+   AttributeChangedImpl(aContent, aNameSpaceID, aAttribute);
+ 
+   // If it was the focused node, cache the new state
+-  nsCOMPtr<nsIDOMNode> targetNode = do_QueryInterface(aContent);
++  nsIDOMNode* targetNode = do_QueryInterface(aContent);
+   if (targetNode == gLastFocusedNode) {
+-    nsCOMPtr<nsIAccessible> focusedAccessible;
+-    GetAccService()->GetAccessibleFor(targetNode, getter_AddRefs(focusedAccessible));
++    nsIAccessible* focusedAccessible;
++    GetAccService()->GetAccessibleFor(targetNode, &focusedAccessible);
+     if (focusedAccessible) {
+       gLastFocusedAccessiblesState = State(focusedAccessible);
+     }
+@@ -968,8 +968,8 @@ nsDocAccessible::AttributeChangedImpl(ns
+   // Otherwise it may just be a state change, for example an object changing
+   // its visibility
+ 
+-  nsCOMPtr<nsISupports> container = mDocument->GetContainer();
+-  nsCOMPtr<nsIDocShell> docShell = do_QueryInterface(container);
++  nsISupports* container = mDocument->GetContainer();
++  nsIDocShell* docShell = do_QueryInterface(container);
+   if (!docShell) {
+     return;
+   }
+@@ -987,12 +987,12 @@ nsDocAccessible::AttributeChangedImpl(ns
+     return; // Still loading, ignore setting of initial attributes
+   }
+ 
+-  nsCOMPtr<nsIPresShell> shell = GetPresShell();
++  nsIPresShell* shell = GetPresShell();
+   if (!shell) {
+     return; // Document has been shut down
+   }
+ 
+-  nsCOMPtr<nsIDOMNode> targetNode(do_QueryInterface(aContent));
++  nsIDOMNode* targetNode(do_QueryInterface(aContent));
+   NS_ASSERTION(targetNode, "No node for attr modified");
+   if (!targetNode || !IsNodeRelevant(targetNode)) {
+     return;
+@@ -1012,12 +1012,12 @@ nsDocAccessible::AttributeChangedImpl(ns
+     // disabled really is going to mean the same thing in any namespace.
+     // We use the attribute instead of the disabled state bit because
+     // ARIA's aaa:disabled does not affect the disabled state bit
+-    nsCOMPtr<nsIAccessibleStateChangeEvent> enabledChangeEvent =
++    nsIAccessibleStateChangeEvent* enabledChangeEvent =
+       new nsAccStateChangeEvent(targetNode,
+                                 nsIAccessibleStates::EXT_STATE_ENABLED,
+                                 PR_TRUE);
+     FireDelayedAccessibleEvent(enabledChangeEvent);
+-    nsCOMPtr<nsIAccessibleStateChangeEvent> sensitiveChangeEvent =
++    nsIAccessibleStateChangeEvent* sensitiveChangeEvent =
+       new nsAccStateChangeEvent(targetNode,
+                                 nsIAccessibleStates::EXT_STATE_SENSITIVE,
+                                 PR_TRUE);
+@@ -1026,7 +1026,7 @@ nsDocAccessible::AttributeChangedImpl(ns
+   }
+ 
+   // Check for namespaced ARIA attribute
+-  nsCOMPtr<nsIAtom> ariaAttribute;
++  nsIAtom* ariaAttribute;
+   if (aNameSpaceID == kNameSpaceID_WAIProperties) {
+     ariaAttribute = aAttribute;
+   }
+@@ -1057,7 +1057,7 @@ nsDocAccessible::AttributeChangedImpl(ns
+ 
+   if (aAttribute == nsAccessibilityAtoms::selected) {
+     // DHTML or XUL selection
+-    nsCOMPtr<nsIAccessible> multiSelect = GetMultiSelectFor(targetNode);
++    nsIAccessible* multiSelect = GetMultiSelectFor(targetNode);
+     // Multi selects use selection_add and selection_remove
+     // Single select widgets just mirror event_selection for
+     // whatever gets event_focus, which is done in
+@@ -1066,10 +1066,10 @@ nsDocAccessible::AttributeChangedImpl(ns
+     if (multiSelect) {
+       // Need to find the right event to use here, SELECTION_WITHIN would
+       // seem right but we had started using it for something else
+-      nsCOMPtr<nsIAccessNode> multiSelectAccessNode =
++      nsIAccessNode* multiSelectAccessNode =
+         do_QueryInterface(multiSelect);
+-      nsCOMPtr<nsIDOMNode> multiSelectDOMNode;
+-      multiSelectAccessNode->GetDOMNode(getter_AddRefs(multiSelectDOMNode));
++      nsIDOMNode* multiSelectDOMNode;
++      multiSelectAccessNode->GetDOMNode(&multiSelectDOMNode);
+       NS_ASSERTION(multiSelectDOMNode, "A new accessible without a DOM node!");
+       FireDelayedToolkitEvent(nsIAccessibleEvent::EVENT_SELECTION_WITHIN,
+                               multiSelectDOMNode, nsnull, eAllowDupes);
+@@ -1092,7 +1092,7 @@ nsDocAccessible::AttributeChangedImpl(ns
+   }
+ 
+   if (aAttribute == nsAccessibilityAtoms::contenteditable) {
+-    nsCOMPtr<nsIAccessibleStateChangeEvent> editableChangeEvent =
++    nsIAccessibleStateChangeEvent* editableChangeEvent =
+       new nsAccStateChangeEvent(targetNode,
+                                 nsIAccessibleStates::EXT_STATE_EDITABLE,
+                                 PR_TRUE);
+@@ -1104,12 +1104,12 @@ void
+ void
+ nsDocAccessible::ARIAAttributeChanged(nsIContent* aContent, nsIAtom* aAttribute)
+ {
+-  nsCOMPtr<nsIDOMNode> targetNode(do_QueryInterface(aContent));
++  nsIDOMNode* targetNode(do_QueryInterface(aContent));
+   if (!targetNode)
+     return;
+ 
+   if (aAttribute == nsAccessibilityAtoms::required) {
+-    nsCOMPtr<nsIAccessibleStateChangeEvent> event =
++    nsIAccessibleStateChangeEvent* event =
+       new nsAccStateChangeEvent(targetNode,
+                                 nsIAccessibleStates::STATE_REQUIRED,
+                                 PR_FALSE);
+@@ -1118,7 +1118,7 @@ nsDocAccessible::ARIAAttributeChanged(ns
+   }
+ 
+   if (aAttribute == nsAccessibilityAtoms::invalid) {
+-    nsCOMPtr<nsIAccessibleStateChangeEvent> event =
++    nsIAccessibleStateChangeEvent* event =
+       new nsAccStateChangeEvent(targetNode,
+                                 nsIAccessibleStates::STATE_INVALID,
+                                 PR_FALSE);
+@@ -1129,9 +1129,9 @@ nsDocAccessible::ARIAAttributeChanged(ns
+   if (aAttribute == nsAccessibilityAtoms::activedescendant) {
+     // The activedescendant universal property redirects accessible focus events
+     // to the element with the id that activedescendant points to
+-    nsCOMPtr<nsIDOMNode> currentFocus = GetCurrentFocus();
++    nsIDOMNode* currentFocus = GetCurrentFocus();
+     if (currentFocus == targetNode) {
+-      nsRefPtr<nsRootAccessible> rootAcc = GetRootAccessible();
++      nsRootAccessible* rootAcc = GetRootAccessible();
+       if (rootAcc)
+         rootAcc->FireAccessibleFocusEvent(nsnull, currentFocus, nsnull, PR_TRUE);
+     }
+@@ -1151,7 +1151,7 @@ nsDocAccessible::ARIAAttributeChanged(ns
+     const PRUint32 kState = (aAttribute == nsAccessibilityAtoms::checked) ?
+                             nsIAccessibleStates::STATE_CHECKED : 
+                             nsIAccessibleStates::STATE_PRESSED;
+-    nsCOMPtr<nsIAccessibleStateChangeEvent> event =
++    nsIAccessibleStateChangeEvent* event =
+       new nsAccStateChangeEvent(targetNode, kState, PR_FALSE);
+     FireDelayedAccessibleEvent(event);
+     if (targetNode == gLastFocusedNode) {
+@@ -1159,13 +1159,13 @@ nsDocAccessible::ARIAAttributeChanged(ns
+       // otherwise we would need access to the old attribute value in this listener.
+       // This is because we don't know if the previous value of aaa:checked or aaa:pressed was "mixed"
+       // without caching that info.
+-      nsCOMPtr<nsIAccessible> accessible;
+-      event->GetAccessible(getter_AddRefs(accessible));
++      nsIAccessible* accessible;
++      event->GetAccessible(&accessible);
+       if (accessible) {
+         PRBool wasMixed = (gLastFocusedAccessiblesState & nsIAccessibleStates::STATE_MIXED) != 0;
+         PRBool isMixed  = (State(accessible) & nsIAccessibleStates::STATE_MIXED) != 0;
+         if (wasMixed != isMixed) {
+-          nsCOMPtr<nsIAccessibleStateChangeEvent> event =
++          nsIAccessibleStateChangeEvent* event =
+             new nsAccStateChangeEvent(targetNode,
+                                       nsIAccessibleStates::STATE_MIXED,
+                                       PR_FALSE, isMixed);
+@@ -1177,7 +1177,7 @@ nsDocAccessible::ARIAAttributeChanged(ns
+   }
+ 
+   if (aAttribute == nsAccessibilityAtoms::expanded) {
+-    nsCOMPtr<nsIAccessibleStateChangeEvent> event =
++    nsIAccessibleStateChangeEvent* event =
+       new nsAccStateChangeEvent(targetNode,
+                                 nsIAccessibleStates::STATE_EXPANDED,
+                                 PR_FALSE);
+@@ -1186,7 +1186,7 @@ nsDocAccessible::ARIAAttributeChanged(ns
+   }
+ 
+   if (aAttribute == nsAccessibilityAtoms::readonly) {
+-    nsCOMPtr<nsIAccessibleStateChangeEvent> event =
++    nsIAccessibleStateChangeEvent* event =
+       new nsAccStateChangeEvent(targetNode,
+                                 nsIAccessibleStates::STATE_READONLY,
+                                 PR_FALSE);
+@@ -1224,7 +1224,7 @@ void nsDocAccessible::ContentAppended(ns
+ 
+   PRUint32 childCount = aContainer->GetChildCount();
+   for (PRUint32 index = aNewIndexInContainer; index < childCount; index ++) {
+-    nsCOMPtr<nsIContent> child(aContainer->GetChildAt(index));
++    nsIContent* child(aContainer->GetChildAt(index));
+     // InvalidateCacheSubtree will not fire the EVENT_SHOW for the new node
+     // unless an accessible can be created for the passed in node, which it
+     // can't do unless the node is visible. The right thing happens there so
+@@ -1296,18 +1296,18 @@ nsDocAccessible::FireTextChangeEventForT
+     return;
+   }
+ 
+-  nsCOMPtr<nsIDOMNode> node(do_QueryInterface(aContent));
++  nsIDOMNode* node(do_QueryInterface(aContent));
+   if (!node)
+     return;
+ 
+-  nsCOMPtr<nsIAccessible> accessible;
+-  nsresult rv = GetAccessibleInParentChain(node, PR_TRUE, getter_AddRefs(accessible));
++  nsIAccessible* accessible;
++  nsresult rv = GetAccessibleInParentChain(node, PR_TRUE, &accessible);
+   if (NS_FAILED(rv) || !accessible)
+     return;
+ 
+-  nsRefPtr<nsHyperTextAccessible> textAccessible;
++  nsHyperTextAccessible* textAccessible;
+   rv = accessible->QueryInterface(NS_GET_IID(nsHyperTextAccessible),
+-                                  getter_AddRefs(textAccessible));
++                                  (void**)&textAccessible);
+   if (NS_FAILED(rv) || !textAccessible)
+     return;
+ 
+@@ -1323,7 +1323,7 @@ nsDocAccessible::FireTextChangeEventForT
+     aInfo->mChangeEnd - start; // text has been removed
+ 
+   if (length > 0) {
+-    nsCOMPtr<nsIPresShell> shell(do_QueryReferent(mWeakShell));
++    nsIPresShell* shell(do_QueryReferent(mWeakShell));
+     if (!shell)
+       return;
+ 
+@@ -1340,7 +1340,7 @@ nsDocAccessible::FireTextChangeEventForT
+     if (NS_FAILED(rv))
+       return;
+ 
+-    nsCOMPtr<nsIAccessibleTextChangeEvent> event =
++    nsIAccessibleTextChangeEvent* event =
+       new nsAccTextChangeEvent(accessible, offset,
+                                renderedEndOffset - renderedStartOffset,
+                                aIsInserted, PR_FALSE);
+@@ -1348,25 +1348,25 @@ nsDocAccessible::FireTextChangeEventForT
+   }
+ }
+ 
+-already_AddRefed<nsIAccessibleTextChangeEvent>
++nsIAccessibleTextChangeEvent*
+ nsDocAccessible::CreateTextChangeEventForNode(nsIAccessible *aContainerAccessible,
+                                               nsIDOMNode *aChangeNode,
+                                               nsIAccessible *aAccessibleForChangeNode,
+                                               PRBool aIsInserting,
+                                               PRBool aIsAsynch)
+ {
+-  nsRefPtr<nsHyperTextAccessible> textAccessible;
++  nsHyperTextAccessible* textAccessible;
+   aContainerAccessible->QueryInterface(NS_GET_IID(nsHyperTextAccessible),
+-                                       getter_AddRefs(textAccessible));
++                                       (void**)&textAccessible);
+   if (!textAccessible) {
+     return nsnull;
+   }
+ 
+   PRInt32 offset;
+   PRInt32 length = 0;
+-  nsCOMPtr<nsIAccessible> changeAccessible;
++  nsIAccessible* changeAccessible;
+   nsresult rv = textAccessible->DOMPointToHypertextOffset(aChangeNode, -1, &offset,
+-                                                          getter_AddRefs(changeAccessible));
++                                                          &changeAccessible);
+   NS_ENSURE_SUCCESS(rv, nsnull);
+ 
+   if (!aAccessibleForChangeNode) {
+@@ -1378,21 +1378,21 @@ nsDocAccessible::CreateTextChangeEventFo
+     if (!changeAccessible) {
+       return nsnull; // No descendant content that represents any text in the hypertext parent
+     }
+-    nsCOMPtr<nsIAccessible> child = changeAccessible;
++    nsIAccessible* child = changeAccessible;
+     while (PR_TRUE) {
+-      nsCOMPtr<nsIAccessNode> childAccessNode =
++      nsIAccessNode* childAccessNode =
+         do_QueryInterface(changeAccessible);
+-      nsCOMPtr<nsIDOMNode> childNode;
+-      childAccessNode->GetDOMNode(getter_AddRefs(childNode));
++      nsIDOMNode* childNode;
++      childAccessNode->GetDOMNode(&childNode);
+       if (!nsAccUtils::IsAncestorOf(aChangeNode, childNode)) {
+         break;  // We only want accessibles with DOM nodes as children of this node
+       }
+       length += TextLength(child);
+-      child->GetNextSibling(getter_AddRefs(changeAccessible));
++      child->GetNextSibling(&changeAccessible);
+       if (!changeAccessible) {
+         break;
+       }
+-      child.swap(changeAccessible);
++      swap(child, changeAccessible);
+     }
+   }
+   else {
+@@ -1401,8 +1401,8 @@ nsDocAccessible::CreateTextChangeEventFo
+     length = TextLength(aAccessibleForChangeNode);
+     if (Role(aAccessibleForChangeNode) == nsIAccessibleRole::ROLE_WHITESPACE) {  // newline
+       // Don't fire event for the first html:br in an editor.
+-      nsCOMPtr<nsIEditor> editor;
+-      textAccessible->GetAssociatedEditor(getter_AddRefs(editor));
++      nsIEditor* editor;
++      textAccessible->GetAssociatedEditor(&editor);
+       if (editor) {
+         PRBool isEmpty = PR_FALSE;
+         editor->GetDocumentIsEmpty(&isEmpty);
+@@ -1429,7 +1429,7 @@ nsresult nsDocAccessible::FireDelayedToo
+                                                   EDupeEventRule aAllowDupes,
+                                                   PRBool aIsAsynch)
+ {
+-  nsCOMPtr<nsIAccessibleEvent> event =
++  nsIAccessibleEvent* event =
+     new nsAccEvent(aEvent, aDOMNode, aData, PR_TRUE);
+   NS_ENSURE_TRUE(event, NS_ERROR_OUT_OF_MEMORY);
+ 
+@@ -1454,8 +1454,8 @@ nsDocAccessible::FireDelayedAccessibleEv
+   PRUint32 newEventType;
+   aEvent->GetEventType(&newEventType);
+ 
+-  nsCOMPtr<nsIDOMNode> newEventDOMNode;
+-  aEvent->GetDOMNode(getter_AddRefs(newEventDOMNode));
++  nsIDOMNode* newEventDOMNode;
++  aEvent->GetDOMNode(&newEventDOMNode);
+ 
+   if (!aIsAsynch) {
+     // If already asynchronous don't call PrepareFromEvent() -- it
+@@ -1479,8 +1479,8 @@ nsDocAccessible::FireDelayedAccessibleEv
+       PRUint32 eventType;
+       accessibleEvent->GetEventType(&eventType);
+       if (eventType == newEventType) {
+-        nsCOMPtr<nsIDOMNode> domNode;
+-        accessibleEvent->GetDOMNode(getter_AddRefs(domNode));
++        nsIDOMNode* domNode;
++        accessibleEvent->GetDOMNode(&domNode);
+         if (newEventDOMNode == domNode || nsAccUtils::IsAncestorOf(newEventDOMNode, domNode)) {
+           mEventsToFire.RemoveObjectAt(index);
+           // The other event is the same type, but in a descendant of this
+@@ -1508,8 +1508,8 @@ nsDocAccessible::FireDelayedAccessibleEv
+       PRUint32 eventType;
+       accessibleEvent->GetEventType(&eventType);
+       if (eventType == newEventType) {
+-        nsCOMPtr<nsIDOMNode> domNode;
+-        accessibleEvent->GetDOMNode(getter_AddRefs(domNode));
++        nsIDOMNode* domNode;
++        accessibleEvent->GetDOMNode(&domNode);
+         if (domNode == newEventDOMNode) {
+           mEventsToFire.RemoveObjectAt(index);
+           -- index;
+@@ -1537,21 +1537,21 @@ NS_IMETHODIMP nsDocAccessible::FlushPend
+   NS_ASSERTION(length, "How did we get here without events to fire?");
+   PRUint32 index;
+   for (index = 0; index < length; index ++) {
+-    nsCOMPtr<nsIAccessibleEvent> accessibleEvent(
++    nsIAccessibleEvent* accessibleEvent(
+       do_QueryInterface(mEventsToFire[index]));
+     NS_ASSERTION(accessibleEvent, "Array item is not an accessible event");
+ 
+-    nsCOMPtr<nsIAccessible> accessible;
+-    accessibleEvent->GetAccessible(getter_AddRefs(accessible));
++    nsIAccessible* accessible;
++    accessibleEvent->GetAccessible(&accessible);
+ 
+     PRUint32 eventType;
+     accessibleEvent->GetEventType(&eventType);
+     if (eventType == nsIAccessibleEvent::EVENT_DOM_CREATE || 
+         eventType == nsIAccessibleEvent::EVENT_ASYNCH_SHOW) {
+-      nsCOMPtr<nsIAccessible> containerAccessible;
++      nsIAccessible* containerAccessible;
+       if (accessible) {
+-        accessible->GetParent(getter_AddRefs(containerAccessible));
+-        nsCOMPtr<nsPIAccessible> privateContainerAccessible =
++        accessible->GetParent(&containerAccessible);
++        nsPIAccessible* privateContainerAccessible =
+           do_QueryInterface(containerAccessible);
+         if (privateContainerAccessible)
+           privateContainerAccessible->InvalidateChildren();
+@@ -1562,20 +1562,20 @@ NS_IMETHODIMP nsDocAccessible::FlushPend
+       // At this point we now have the frame and accessible for this node if there is one. That is why we
+       // wait to fire this here, instead of in InvalidateCacheSubtree(), where we wouldn't be able to calculate
+       // the offset, length and text for the text change.
+-      nsCOMPtr<nsIDOMNode> domNode;
+-      accessibleEvent->GetDOMNode(getter_AddRefs(domNode));
++      nsIDOMNode* domNode;
++      accessibleEvent->GetDOMNode(&domNode);
+       PRBool isFromUserInput;
+       accessibleEvent->GetIsFromUserInput(&isFromUserInput);
+       if (domNode && domNode != mDOMNode) {
+         if (!containerAccessible)
+           GetAccessibleInParentChain(domNode, PR_TRUE,
+-                                     getter_AddRefs(containerAccessible));
+-
+-        nsCOMPtr<nsIAccessibleTextChangeEvent> textChangeEvent =
++                                     &containerAccessible);
++
++        nsIAccessibleTextChangeEvent* textChangeEvent =
+           CreateTextChangeEventForNode(containerAccessible, domNode, accessible, PR_TRUE, PR_TRUE);
+         if (textChangeEvent) {
+-          nsCOMPtr<nsIDOMNode> hyperTextNode;
+-          textChangeEvent->GetDOMNode(getter_AddRefs(hyperTextNode));
++          nsIDOMNode* hyperTextNode;
++          textChangeEvent->GetDOMNode(&hyperTextNode);
+           nsAccEvent::PrepareForEvent(hyperTextNode, isFromUserInput);
+           // XXX Queue them up and merge the text change events
+           // XXX We need a way to ignore SplitNode and JoinNode() when they
+@@ -1591,7 +1591,7 @@ NS_IMETHODIMP nsDocAccessible::FlushPend
+ 
+     if (accessible) {
+       if (eventType == nsIAccessibleEvent::EVENT_INTERNAL_LOAD) {
+-        nsCOMPtr<nsPIAccessibleDocument> docAccessible =
++        nsPIAccessibleDocument* docAccessible =
+           do_QueryInterface(accessible);
+         NS_ASSERTION(docAccessible, "No doc accessible for doc load event");
+         if (docAccessible) {
+@@ -1599,7 +1599,7 @@ NS_IMETHODIMP nsDocAccessible::FlushPend
+         }
+       }
+       else if (eventType == nsIAccessibleEvent::EVENT_TEXT_CARET_MOVED) {
+-        nsCOMPtr<nsIAccessibleText> accessibleText = do_QueryInterface(accessible);
++        nsIAccessibleText* accessibleText = do_QueryInterface(accessible);
+         PRInt32 caretOffset;
+         if (accessibleText && NS_SUCCEEDED(accessibleText->GetCaretOffset(&caretOffset))) {
+ #ifdef DEBUG_A11Y
+@@ -1607,7 +1607,7 @@ NS_IMETHODIMP nsDocAccessible::FlushPend
+           accessibleText->GetCharacterAtOffset(caretOffset, &chAtOffset);
+           printf("\nCaret moved to %d with char %c", caretOffset, chAtOffset);
+ #endif
+-          nsCOMPtr<nsIAccessibleCaretMoveEvent> caretMoveEvent =
++          nsIAccessibleCaretMoveEvent* caretMoveEvent =
+             new nsAccCaretMoveEvent(accessible, caretOffset);
+           NS_ENSURE_TRUE(caretMoveEvent, NS_ERROR_OUT_OF_MEMORY);
+ 
+@@ -1630,16 +1630,16 @@ NS_IMETHODIMP nsDocAccessible::FlushPend
+         if (eventType == nsIAccessibleEvent::EVENT_ASYNCH_HIDE ||
+             eventType == nsIAccessibleEvent::EVENT_DOM_DESTROY) {
+           // Invalidate children
+-          nsCOMPtr<nsIAccessible> containerAccessible;
+-          accessible->GetParent(getter_AddRefs(containerAccessible));
+-          nsCOMPtr<nsPIAccessible> privateContainerAccessible =
++          nsIAccessible* containerAccessible;
++          accessible->GetParent(&containerAccessible);
++          nsPIAccessible* privateContainerAccessible =
+             do_QueryInterface(containerAccessible);
+           if (privateContainerAccessible) {
+             privateContainerAccessible->InvalidateChildren();
+           }
+           // Shutdown nsIAccessNode's or nsIAccessibles for any DOM nodes in this subtree
+-          nsCOMPtr<nsIDOMNode> hidingNode;
+-          accessibleEvent->GetDOMNode(getter_AddRefs(hidingNode));
++          nsIDOMNode* hidingNode;
++          accessibleEvent->GetDOMNode(&hidingNode);
+           if (hidingNode) {
+             RefreshNodes(hidingNode); // Will this bite us with asynch events
+           }
+@@ -1660,11 +1660,11 @@ void nsDocAccessible::FlushEventsCallbac
+ 
+ void nsDocAccessible::RefreshNodes(nsIDOMNode *aStartNode)
+ {
+-  nsCOMPtr<nsIDOMNode> iterNode(aStartNode), nextNode;
+-  nsCOMPtr<nsIAccessNode> accessNode;
++  nsIDOMNode* iterNode(aStartNode), *nextNode;
++  nsIAccessNode* accessNode;
+ 
+   do {
+-    GetCachedAccessNode(iterNode, getter_AddRefs(accessNode));
++    GetCachedAccessNode(iterNode, &accessNode);
+     if (accessNode) {
+       // Accessibles that implement their own subtrees,
+       // like html combo boxes and xul trees must shutdown all of their own
+@@ -1673,14 +1673,14 @@ void nsDocAccessible::RefreshNodes(nsIDO
+       // Don't shutdown our doc object!
+       if (accessNode != static_cast<nsIAccessNode*>(this)) {
+ 
+-        nsCOMPtr<nsIAccessible> accessible(do_QueryInterface(accessNode));
++        nsIAccessible* accessible(do_QueryInterface(accessNode));
+         if (accessible) {
+           // Fire menupopupend events for menu popups that go away
+           PRUint32 role = Role(accessible);
+           if (role == nsIAccessibleRole::ROLE_MENUPOPUP) {
+-            nsCOMPtr<nsIDOMNode> domNode;
+-            accessNode->GetDOMNode(getter_AddRefs(domNode));
+-            nsCOMPtr<nsIDOMXULPopupElement> popup(do_QueryInterface(domNode));
++            nsIDOMNode* domNode;
++            accessNode->GetDOMNode(&domNode);
++            nsIDOMXULPopupElement* popup(do_QueryInterface(domNode));
+             if (!popup) {
+               // Popup elements already fire these via DOMMenuInactive
+               // handling in nsRootAccessible::HandleEvent
+@@ -1692,14 +1692,14 @@ void nsDocAccessible::RefreshNodes(nsIDO
+ 
+         void *uniqueID;
+         accessNode->GetUniqueID(&uniqueID);
+-        nsCOMPtr<nsPIAccessNode> privateAccessNode(do_QueryInterface(accessNode));
++        nsPIAccessNode* privateAccessNode(do_QueryInterface(accessNode));
+         privateAccessNode->Shutdown();
+         // Remove from hash table as well
+         mAccessNodeCache.Remove(uniqueID);
+       }
+     }
+ 
+-    iterNode->GetFirstChild(getter_AddRefs(nextNode));
++    iterNode->GetFirstChild(&nextNode);
+     if (nextNode) {
+       iterNode = nextNode;
+       continue;
+@@ -1707,18 +1707,18 @@ void nsDocAccessible::RefreshNodes(nsIDO
+ 
+     if (iterNode == aStartNode)
+       break;
+-    iterNode->GetNextSibling(getter_AddRefs(nextNode));
++    iterNode->GetNextSibling(&nextNode);
+     if (nextNode) {
+       iterNode = nextNode;
+       continue;
+     }
+ 
+     do {
+-      iterNode->GetParentNode(getter_AddRefs(nextNode));
++      iterNode->GetParentNode(&nextNode);
+       if (!nextNode || nextNode == aStartNode) {
+         return;
+       }
+-      nextNode->GetNextSibling(getter_AddRefs(iterNode));
++      nextNode->GetNextSibling(&iterNode);
+       if (iterNode)
+         break;
+       iterNode = nextNode;
+@@ -1756,7 +1756,7 @@ NS_IMETHODIMP nsDocAccessible::Invalidat
+   // Otherwise we might miss the nsAccessNode's that are not nsAccessible's.
+ 
+   NS_ENSURE_TRUE(mDOMNode, NS_ERROR_FAILURE);
+-  nsCOMPtr<nsIDOMNode> childNode = aChild ? do_QueryInterface(aChild) : mDOMNode;
++  nsIDOMNode* childNode = aChild ? do_QueryInterface(aChild) : mDOMNode;
+ 
+   if (!mIsContentLoaded) {
+     // Still loading document
+@@ -1771,7 +1771,7 @@ NS_IMETHODIMP nsDocAccessible::Invalidat
+       return InvalidateChildren();
+     }
+     if (aChangeEventType == nsIAccessibleEvent::EVENT_DOM_CREATE) {
+-      nsCOMPtr<nsIPresShell> presShell = GetPresShell();
++      nsIPresShell* presShell = GetPresShell();
+       NS_ENSURE_TRUE(presShell, NS_ERROR_FAILURE);
+       nsIEventStateManager *esm = presShell->GetPresContext()->EventStateManager();
+       NS_ENSURE_TRUE(esm, NS_ERROR_FAILURE);
+@@ -1779,12 +1779,12 @@ NS_IMETHODIMP nsDocAccessible::Invalidat
+         // Adding content during page load, but not caused by user input
+         // Just invalidate accessible hierarchy and return,
+         // otherwise the page load time slows down way too much
+-        nsCOMPtr<nsIAccessible> containerAccessible;
+-        GetAccessibleInParentChain(childNode, PR_FALSE, getter_AddRefs(containerAccessible));
++        nsIAccessible* containerAccessible;
++        GetAccessibleInParentChain(childNode, PR_FALSE, &containerAccessible);
+         if (!containerAccessible) {
+           containerAccessible = this;
+         }
+-        nsCOMPtr<nsPIAccessible> privateContainer = do_QueryInterface(containerAccessible);
++        nsPIAccessible* privateContainer = do_QueryInterface(containerAccessible);
+         return privateContainer->InvalidateChildren();
+       }     
+       // else: user input, so we must fall through and for full handling,
+@@ -1794,14 +1794,14 @@ NS_IMETHODIMP nsDocAccessible::Invalidat
+   }
+ 
+   // Update last change state information
+-  nsCOMPtr<nsIAccessNode> childAccessNode;
+-  GetCachedAccessNode(childNode, getter_AddRefs(childAccessNode));
+-  nsCOMPtr<nsIAccessible> childAccessible = do_QueryInterface(childAccessNode);
++  nsIAccessNode* childAccessNode;
++  GetCachedAccessNode(childNode, &childAccessNode);
++  nsIAccessible* childAccessible = do_QueryInterface(childAccessNode);
+   if (!childAccessible && !isHiding) {
+     // If not about to hide it, make sure there's an accessible so we can fire an
+     // event for it
+     GetAccService()->GetAttachedAccessibleFor(childNode,
+-                                              getter_AddRefs(childAccessible));
++                                              &childAccessible);
+   }
+ 
+ #ifdef DEBUG_A11Y
+@@ -1828,17 +1828,17 @@ NS_IMETHODIMP nsDocAccessible::Invalidat
+   }
+ #endif
+ 
+-  nsCOMPtr<nsIAccessible> containerAccessible;
+-  GetAccessibleInParentChain(childNode, PR_TRUE, getter_AddRefs(containerAccessible));
++  nsIAccessible* containerAccessible;
++  GetAccessibleInParentChain(childNode, PR_TRUE, &containerAccessible);
+   if (!containerAccessible) {
+     containerAccessible = this;
+   }
+ 
+   if (!isShowing) {
+     // Fire EVENT_ASYNCH_HIDE or EVENT_DOM_DESTROY
+-    nsCOMPtr<nsIContent> content(do_QueryInterface(childNode));
++    nsIContent* content(do_QueryInterface(childNode));
+     if (isHiding) {
+-      nsCOMPtr<nsIPresShell> presShell = GetPresShell();
++      nsIPresShell* presShell = GetPresShell();
+       if (content) {
+         nsIFrame *frame = presShell->GetPrimaryFrameFor(content);
+         if (frame) {
+@@ -1868,7 +1868,7 @@ NS_IMETHODIMP nsDocAccessible::Invalidat
+       // XXX Collate events when a range is deleted
+       // XXX We need a way to ignore SplitNode and JoinNode() when they
+       // do not affect the text within the hypertext
+-      nsCOMPtr<nsIAccessibleTextChangeEvent> textChangeEvent =
++      nsIAccessibleTextChangeEvent* textChangeEvent =
+         CreateTextChangeEventForNode(containerAccessible, childNode, childAccessible,
+                                      PR_FALSE, isAsynch);
+       if (textChangeEvent) {
+@@ -1905,7 +1905,7 @@ NS_IMETHODIMP nsDocAccessible::Invalidat
+     nsIContent *ancestor = aChild;
+     while (ancestor) {
+       if (ARIARoleEquals(ancestor, "alert")) {
+-        nsCOMPtr<nsIDOMNode> alertNode(do_QueryInterface(ancestor));
++        nsIDOMNode* alertNode(do_QueryInterface(ancestor));
+         FireDelayedToolkitEvent(nsIAccessibleEvent::EVENT_ALERT, alertNode, nsnull,
+                                 eRemoveDupes, isAsynch);
+         break;
+@@ -1919,7 +1919,7 @@ NS_IMETHODIMP nsDocAccessible::Invalidat
+     // This is only used by older MSAA clients. Newer ones should derive this
+     // from SHOW and HIDE so that they don't fetch extra objects
+     if (childAccessible) {
+-      nsCOMPtr<nsIAccessibleEvent> reorderEvent =
++      nsIAccessibleEvent* reorderEvent =
+         new nsAccEvent(nsIAccessibleEvent::EVENT_REORDER, containerAccessible, nsnull, PR_TRUE);
+       NS_ENSURE_TRUE(reorderEvent, NS_ERROR_OUT_OF_MEMORY);
+       FireDelayedAccessibleEvent(reorderEvent, eCoalesceFromSameSubtree, isAsynch);
+@@ -1936,22 +1936,22 @@ nsDocAccessible::GetAccessibleInParentCh
+ {
+   // Find accessible in parent chain of DOM nodes, or return null
+   *aAccessible = nsnull;
+-  nsCOMPtr<nsIDOMNode> currentNode(aNode), parentNode;
+-  nsCOMPtr<nsIAccessNode> accessNode;
++  nsIDOMNode* currentNode(aNode), *parentNode;
++  nsIAccessNode* accessNode;
+ 
+   nsIAccessibilityService *accService = GetAccService();
+   NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
+ 
+   do {
+-    currentNode->GetParentNode(getter_AddRefs(parentNode));
++    currentNode->GetParentNode(&parentNode);
+     currentNode = parentNode;
+     if (!currentNode) {
+       *aAccessible = this;
+       break;
+     }
+ 
+-    nsCOMPtr<nsIDOMNode> relevantNode;
+-    if (NS_SUCCEEDED(accService->GetRelevantContentNodeFor(currentNode, getter_AddRefs(relevantNode))) && relevantNode) {
++    nsIDOMNode* relevantNode;
++    if (NS_SUCCEEDED(accService->GetRelevantContentNodeFor(currentNode, &relevantNode)) && relevantNode) {
+       currentNode = relevantNode;
+     }
+     if (aCanCreate) {
+@@ -1975,17 +1975,17 @@ nsDocAccessible::FireShowHideEvents(nsID
+ {
+   NS_ENSURE_ARG(aDOMNode);
+ 
+-  nsCOMPtr<nsIAccessible> accessible;
++  nsIAccessible* accessible;
+   if (aEventType == nsIAccessibleEvent::EVENT_ASYNCH_HIDE ||
+       aEventType == nsIAccessibleEvent::EVENT_DOM_DESTROY) {
+     // Don't allow creation for accessibles when nodes going away
+-    nsCOMPtr<nsIAccessNode> accessNode;
+-    GetCachedAccessNode(aDOMNode, getter_AddRefs(accessNode));
++    nsIAccessNode* accessNode;
++    GetCachedAccessNode(aDOMNode, &accessNode);
+     accessible = do_QueryInterface(accessNode);
+   } else {
+     // Allow creation of new accessibles for show events
+     GetAccService()->GetAttachedAccessibleFor(aDOMNode,
+-                                              getter_AddRefs(accessible));
++                                              &accessible);
+   }
+ 
+   if (accessible) {
+@@ -1994,7 +1994,7 @@ nsDocAccessible::FireShowHideEvents(nsID
+     PRBool isAsynch = aEventType == nsIAccessibleEvent::EVENT_ASYNCH_HIDE ||
+                       aEventType == nsIAccessibleEvent::EVENT_ASYNCH_SHOW;
+ 
+-    nsCOMPtr<nsIAccessibleEvent> event =
++    nsIAccessibleEvent* event =
+       new nsAccEvent(aEventType, accessible, nsnull, isAsynch);
+     NS_ENSURE_TRUE(event, NS_ERROR_OUT_OF_MEMORY);
+     if (aForceIsFromUserInput) {
+@@ -2008,10 +2008,10 @@ nsDocAccessible::FireShowHideEvents(nsID
+ 
+   // Could not find accessible to show hide yet, so fire on any
+   // accessible descendants in this subtree
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(aDOMNode));
++  nsIContent* content(do_QueryInterface(aDOMNode));
+   PRUint32 count = content->GetChildCount();
+   for (PRUint32 index = 0; index < count; index++) {
+-    nsCOMPtr<nsIDOMNode> childNode = do_QueryInterface(content->GetChildAt(index));
++    nsIDOMNode* childNode = do_QueryInterface(content->GetChildAt(index));
+     nsresult rv = FireShowHideEvents(childNode, aEventType,
+                                      aDelay, aForceIsFromUserInput);
+     NS_ENSURE_SUCCESS(rv, rv);
+@@ -2035,17 +2035,17 @@ void nsDocAccessible::DocLoadCallback(ns
+   }
+ 
+   // Fire doc finished event
+-  nsCOMPtr<nsIDOMNode> docDomNode;
+-  docAcc->GetDOMNode(getter_AddRefs(docDomNode));
+-  nsCOMPtr<nsIDocument> doc(do_QueryInterface(docDomNode));
++  nsIDOMNode* docDomNode;
++  docAcc->GetDOMNode(&docDomNode);
++  nsIDocument* doc(do_QueryInterface(docDomNode));
+   if (doc) {
+-    nsCOMPtr<nsISupports> container = doc->GetContainer();
+-    nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem = do_QueryInterface(container);
++    nsISupports* container = doc->GetContainer();
++    nsIDocShellTreeItem* docShellTreeItem = do_QueryInterface(container);
+     if (!docShellTreeItem) {
+       return;
+     }
+-    nsCOMPtr<nsIDocShellTreeItem> sameTypeRoot;
+-    docShellTreeItem->GetSameTypeRootTreeItem(getter_AddRefs(sameTypeRoot));
++    nsIDocShellTreeItem* sameTypeRoot;
++    docShellTreeItem->GetSameTypeRootTreeItem(&sameTypeRoot);
+     if (sameTypeRoot != docShellTreeItem) {
+       // A frame or iframe has finished loading new content
+       docAcc->InvalidateCacheSubtree(nsnull, nsIAccessibleEvent::EVENT_DOM_SIGNIFICANT_CHANGE);
+@@ -2054,13 +2054,13 @@ void nsDocAccessible::DocLoadCallback(ns
+ 
+     // Fire STATE_CHANGE event for doc load finish if focus is in same doc tree
+     if (gLastFocusedNode) {
+-      nsCOMPtr<nsIDocShellTreeItem> focusedTreeItem =
++      nsIDocShellTreeItem* focusedTreeItem =
+         nsAccUtils::GetDocShellTreeItemFor(gLastFocusedNode);
+       if (focusedTreeItem) {
+-        nsCOMPtr<nsIDocShellTreeItem> sameTypeRootOfFocus;
+-        focusedTreeItem->GetSameTypeRootTreeItem(getter_AddRefs(sameTypeRootOfFocus));
++        nsIDocShellTreeItem* sameTypeRootOfFocus;
++        focusedTreeItem->GetSameTypeRootTreeItem(&sameTypeRootOfFocus);
+         if (sameTypeRoot == sameTypeRootOfFocus) {
+-          nsCOMPtr<nsIAccessibleStateChangeEvent> accEvent =
++          nsIAccessibleStateChangeEvent* accEvent =
+             new nsAccStateChangeEvent(docAcc, nsIAccessibleStates::STATE_BUSY,
+                                       PR_FALSE, PR_FALSE);
+           docAcc->FireAccessibleEvent(accEvent);
+diff --git a/accessible/src/base/nsDocAccessible.h b/accessible/src/base/nsDocAccessible.h
+--- a/accessible/src/base/nsDocAccessible.h
++++ b/accessible/src/base/nsDocAccessible.h
+@@ -185,7 +185,7 @@ class nsDocAccessible : public nsHyperTe
+      * @param aAccessibleForChangeNode, the accessible for that node, or nsnull if none exists
+      * @param aIsInserting, is aChangeNode being created or shown (vs. removed or hidden)
+      */
+-    already_AddRefed<nsIAccessibleTextChangeEvent>
++    nsIAccessibleTextChangeEvent*
+     CreateTextChangeEventForNode(nsIAccessible *aContainerAccessible,
+                                  nsIDOMNode *aChangeNode,
+                                  nsIAccessible *aAccessibleForNode,
+diff --git a/accessible/src/base/nsOuterDocAccessible.cpp b/accessible/src/base/nsOuterDocAccessible.cpp
+--- a/accessible/src/base/nsOuterDocAccessible.cpp
++++ b/accessible/src/base/nsOuterDocAccessible.cpp
+@@ -55,9 +55,9 @@ nsOuterDocAccessible::nsOuterDocAccessib
+   /* attribute wstring accName; */
+ NS_IMETHODIMP nsOuterDocAccessible::GetName(nsAString& aName) 
+ {
+-  nsCOMPtr<nsIAccessible> accessible;
+-  GetFirstChild(getter_AddRefs(accessible));
+-  nsCOMPtr<nsIAccessibleDocument> accDoc(do_QueryInterface(accessible));
++  nsIAccessible* accessible;
++  GetFirstChild(&accessible);
++  nsIAccessibleDocument* accDoc(do_QueryInterface(accessible));
+   if (!accDoc) {
+     return NS_ERROR_FAILURE;
+   }
+@@ -123,27 +123,27 @@ void nsOuterDocAccessible::CacheChildren
+   // The outer node is a something like a <browser>, <frame>, <iframe>, <page> or
+   // <editor> tag, whereas the inner node corresponds to the inner document root.
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   NS_ASSERTION(content, "No nsIContent for <browser>/<iframe>/<editor> dom node");
+ 
+-  nsCOMPtr<nsIDocument> outerDoc = content->GetDocument();
++  nsIDocument* outerDoc = content->GetDocument();
+   if (!outerDoc) {
+     mAccChildCount = 0;
+     return;
+   }
+ 
+   nsIDocument *innerDoc = outerDoc->GetSubDocumentFor(content);
+-  nsCOMPtr<nsIDOMNode> innerNode(do_QueryInterface(innerDoc));
++  nsIDOMNode* innerNode(do_QueryInterface(innerDoc));
+   if (!innerNode) {
+     mAccChildCount = 0;
+     return;
+   }
+ 
+-  nsCOMPtr<nsIAccessible> innerAccessible;
+-  nsCOMPtr<nsIAccessibilityService> accService = 
++  nsIAccessible* innerAccessible;
++  nsIAccessibilityService* accService = 
+     do_GetService("@mozilla.org/accessibilityService;1");
+-  accService->GetAccessibleFor(innerNode, getter_AddRefs(innerAccessible));
+-  nsCOMPtr<nsPIAccessible> privateInnerAccessible = 
++  accService->GetAccessibleFor(innerNode, &innerAccessible);
++  nsPIAccessible* privateInnerAccessible = 
+     do_QueryInterface(innerAccessible);
+   if (!privateInnerAccessible) {
+     mAccChildCount = 0;
+diff --git a/accessible/src/base/nsRootAccessible.cpp b/accessible/src/base/nsRootAccessible.cpp
+--- a/accessible/src/base/nsRootAccessible.cpp
++++ b/accessible/src/base/nsRootAccessible.cpp
+@@ -131,14 +131,14 @@ NS_IMETHODIMP nsRootAccessible::GetName(
+     }
+   }
+ 
+-  nsCOMPtr<nsIDocShellTreeItem> docShellAsItem =
++  nsIDocShellTreeItem* docShellAsItem =
+     nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
+   NS_ENSURE_TRUE(docShellAsItem, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIDocShellTreeOwner> treeOwner;
+-  docShellAsItem->GetTreeOwner(getter_AddRefs(treeOwner));
+-
+-  nsCOMPtr<nsIBaseWindow> baseWindow(do_QueryInterface(treeOwner));
++  nsIDocShellTreeOwner* treeOwner;
++  docShellAsItem->GetTreeOwner(&treeOwner);
++
++  nsIBaseWindow* baseWindow(do_QueryInterface(treeOwner));
+   if (baseWindow) {
+     nsXPIDLString title;
+     baseWindow->GetTitle(getter_Copies(title));
+@@ -155,7 +155,7 @@ NS_IMETHODIMP nsRootAccessible::GetParen
+   NS_ENSURE_ARG_POINTER(aParent);
+   *aParent = nsnull;
+ 
+-  nsRefPtr<nsApplicationAccessibleWrap> root = GetApplicationAccessible();
++  nsApplicationAccessibleWrap* root = GetApplicationAccessible();
+   *aParent = root;
+ 
+   return NS_OK;
+@@ -171,7 +171,7 @@ NS_IMETHODIMP nsRootAccessible::GetRole(
+   // If it's a <dialog> or <wizard>, use nsIAccessibleRole::ROLE_DIALOG instead
+   nsIContent *rootContent = mDocument->GetRootContent();
+   if (rootContent) {
+-    nsCOMPtr<nsIDOMElement> rootElement(do_QueryInterface(rootContent));
++    nsIDOMElement* rootElement(do_QueryInterface(rootContent));
+     if (rootElement) {
+       nsAutoString name;
+       rootElement->GetLocalName(name);
+@@ -191,13 +191,13 @@ PRUint32 nsRootAccessible::GetChromeFlag
+   // Return the flag set for the top level window as defined 
+   // by nsIWebBrowserChrome::CHROME_WINDOW_[FLAGNAME]
+   // Not simple: nsIXULWindow is not just a QI from nsIDOMWindow
+-  nsCOMPtr<nsIDocShellTreeItem> treeItem =
++  nsIDocShellTreeItem* treeItem =
+     nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
+   NS_ENSURE_TRUE(treeItem, 0);
+-  nsCOMPtr<nsIDocShellTreeOwner> treeOwner;
+-  treeItem->GetTreeOwner(getter_AddRefs(treeOwner));
++  nsIDocShellTreeOwner* treeOwner;
++  treeItem->GetTreeOwner(&treeOwner);
+   NS_ENSURE_TRUE(treeOwner, 0);
+-  nsCOMPtr<nsIXULWindow> xulWin(do_GetInterface(treeOwner));
++  nsIXULWindow* xulWin(do_GetInterface(treeOwner));
+   if (!xulWin) {
+     return 0;
+   }
+@@ -229,9 +229,9 @@ nsRootAccessible::GetState(PRUint32 *aSt
+   if (!aExtraState)
+     return NS_OK;
+ 
+-  nsCOMPtr<nsIDOMWindow> domWin;
+-  GetWindow(getter_AddRefs(domWin));
+-  nsCOMPtr<nsPIDOMWindow> privateDOMWindow(do_QueryInterface(domWin));
++  nsIDOMWindow* domWin;
++  GetWindow(&domWin);
++  nsPIDOMWindow* privateDOMWindow(do_QueryInterface(domWin));
+   if (privateDOMWindow) {
+     nsIFocusController *focusController =
+       privateDOMWindow->GetRootFocusController();
+@@ -253,15 +253,15 @@ void
+ void
+ nsRootAccessible::GetChromeEventHandler(nsIDOMEventTarget **aChromeTarget)
+ {
+-  nsCOMPtr<nsIDOMWindow> domWin;
+-  GetWindow(getter_AddRefs(domWin));
+-  nsCOMPtr<nsPIDOMWindow> privateDOMWindow(do_QueryInterface(domWin));
+-  nsCOMPtr<nsPIDOMEventTarget> chromeEventHandler;
++  nsIDOMWindow* domWin;
++  GetWindow(&domWin);
++  nsPIDOMWindow* privateDOMWindow(do_QueryInterface(domWin));
++  nsPIDOMEventTarget* chromeEventHandler;
+   if (privateDOMWindow) {
+     chromeEventHandler = privateDOMWindow->GetChromeEventHandler();
+   }
+ 
+-  nsCOMPtr<nsIDOMEventTarget> target(do_QueryInterface(chromeEventHandler));
++  nsIDOMEventTarget* target(do_QueryInterface(chromeEventHandler));
+ 
+   *aChromeTarget = target;
+ }
+@@ -300,7 +300,7 @@ nsresult nsRootAccessible::AddEventListe
+   // receive untrusted events (synthetic events generated by untrusted code).
+   // For example, XBL bindings implementations for elements that are hosted in
+   // non chrome document fire untrusted events.
+-  nsCOMPtr<nsIDOMNSEventTarget> nstarget(do_QueryInterface(mDocument));
++  nsIDOMNSEventTarget* nstarget(do_QueryInterface(mDocument));
+ 
+   if (nstarget) {
+     for (const char* const* e = docEvents,
+@@ -312,8 +312,8 @@ nsresult nsRootAccessible::AddEventListe
+     }
+   }
+ 
+-  nsCOMPtr<nsIDOMEventTarget> target;
+-  GetChromeEventHandler(getter_AddRefs(target));
++  nsIDOMEventTarget* target;
++  GetChromeEventHandler(&target);
+   if (target) {
+     target->AddEventListener(NS_LITERAL_STRING("pagehide"), this, PR_TRUE);
+   }
+@@ -327,7 +327,7 @@ nsresult nsRootAccessible::AddEventListe
+ 
+ nsresult nsRootAccessible::RemoveEventListeners()
+ {
+-  nsCOMPtr<nsIDOMEventTarget> target(do_QueryInterface(mDocument));
++  nsIDOMEventTarget* target(do_QueryInterface(mDocument));
+   if (target) { 
+     for (const char* const* e = docEvents,
+                    * const* e_end = docEvents + NS_ARRAY_LENGTH(docEvents);
+@@ -337,7 +337,7 @@ nsresult nsRootAccessible::RemoveEventLi
+     }
+   }
+ 
+-  GetChromeEventHandler(getter_AddRefs(target));
++  GetChromeEventHandler(&target);
+   if (target) {
+     target->RemoveEventListener(NS_LITERAL_STRING("pagehide"), this, PR_TRUE);
+   }
+@@ -368,7 +368,7 @@ void nsRootAccessible::TryFireEarlyLoadE
+ 
+   // This also works for firing events for error pages
+ 
+-  nsCOMPtr<nsIDocShellTreeItem> treeItem =
++  nsIDocShellTreeItem* treeItem =
+     nsAccUtils::GetDocShellTreeItemFor(aDocNode);
+   NS_ASSERTION(treeItem, "No docshelltreeitem for aDocNode");
+   if (!treeItem) {
+@@ -382,10 +382,10 @@ void nsRootAccessible::TryFireEarlyLoadE
+ 
+   // At minimum, create doc accessible so that events are listened to,
+   // allowing us to see any mutations from a page load handler
+-  nsCOMPtr<nsIAccessible> docAccessible;
+-  GetAccService()->GetAccessibleFor(aDocNode, getter_AddRefs(docAccessible));
+-
+-  nsCOMPtr<nsIDocShellTreeNode> treeNode(do_QueryInterface(treeItem));
++  nsIAccessible* docAccessible;
++  GetAccService()->GetAccessibleFor(aDocNode, &docAccessible);
++
++  nsIDocShellTreeNode* treeNode(do_QueryInterface(treeItem));
+   if (treeNode) {
+     PRInt32 subDocuments;
+     treeNode->GetChildCount(&subDocuments);
+@@ -393,16 +393,16 @@ void nsRootAccessible::TryFireEarlyLoadE
+       return;
+     }
+   }
+-  nsCOMPtr<nsIDocShellTreeItem> rootContentTreeItem;
+-  treeItem->GetSameTypeRootTreeItem(getter_AddRefs(rootContentTreeItem));
++  nsIDocShellTreeItem* rootContentTreeItem;
++  treeItem->GetSameTypeRootTreeItem(&rootContentTreeItem);
+   NS_ASSERTION(rootContentTreeItem, "No root content tree item");
+   if (!rootContentTreeItem) { // Not at root of content
+     return;
+   }
+   if (rootContentTreeItem != treeItem) {
+-    nsCOMPtr<nsIAccessibleDocument> rootContentDocAccessible =
++    nsIAccessibleDocument* rootContentDocAccessible =
+       GetDocAccessibleFor(rootContentTreeItem);
+-    nsCOMPtr<nsIAccessible> rootContentAccessible =
++    nsIAccessible* rootContentAccessible =
+       do_QueryInterface(rootContentDocAccessible);
+     if (!rootContentAccessible) {
+       return;
+@@ -426,7 +426,7 @@ PRBool nsRootAccessible::FireAccessibleF
+                                                   PRBool aIsAsynch)
+ {
+   if (mCaretAccessible) {
+-    nsCOMPtr<nsIDOMNSEvent> nsevent(do_QueryInterface(aFocusEvent));
++    nsIDOMNSEvent* nsevent(do_QueryInterface(aFocusEvent));
+     if (nsevent) {
+       // Use the originally focused node where the selection lives.
+       // For example, use the anonymous HTML:input instead of the containing
+@@ -436,9 +436,9 @@ PRBool nsRootAccessible::FireAccessibleF
+       // This happens because when some bindings handle focus, they retarget
+       // focus to the appropriate child inside of themselves, but DOM focus
+       // stays outside on that binding parent.
+-      nsCOMPtr<nsIDOMEventTarget> domEventTarget;
+-      nsevent->GetOriginalTarget(getter_AddRefs(domEventTarget));
+-      nsCOMPtr<nsIDOMNode> realFocusedNode(do_QueryInterface(domEventTarget));
++      nsIDOMEventTarget* domEventTarget;
++      nsevent->GetOriginalTarget(&domEventTarget);
++      nsIDOMNode* realFocusedNode(do_QueryInterface(domEventTarget));
+       if (!realFocusedNode) {
+         // When FireCurrentFocusEvent() synthesizes a focus event,
+         // the orignal target does not exist, so use the passed-in node
+@@ -452,24 +452,24 @@ PRBool nsRootAccessible::FireAccessibleF
+   }
+ 
+   // Check for aaa:activedescendant, which changes which element has focus
+-  nsCOMPtr<nsIDOMNode> finalFocusNode = aNode;
+-  nsCOMPtr<nsIAccessible> finalFocusAccessible = aAccessible;
+-  nsCOMPtr<nsIContent> finalFocusContent  = do_QueryInterface(aNode);
++  nsIDOMNode* finalFocusNode = aNode;
++  nsIAccessible* finalFocusAccessible = aAccessible;
++  nsIContent* finalFocusContent  = do_QueryInterface(aNode);
+   if (finalFocusContent) {
+     nsAutoString id;
+     if (nsAccUtils::GetAriaProperty(finalFocusContent, nsnull, eAria_activedescendant, id)) {
+-      nsCOMPtr<nsIDOMDocument> domDoc;
+-      aNode->GetOwnerDocument(getter_AddRefs(domDoc));
++      nsIDOMDocument* domDoc;
++      aNode->GetOwnerDocument(&domDoc);
+       if (!domDoc) {
+         return PR_FALSE;
+       }
+-      nsCOMPtr<nsIDOMElement> relatedEl;
+-      domDoc->GetElementById(id, getter_AddRefs(relatedEl));
++      nsIDOMElement* relatedEl;
++      domDoc->GetElementById(id, &relatedEl);
+       finalFocusNode = do_QueryInterface(relatedEl);
+       if (!finalFocusNode) {
+         return PR_FALSE;
+       }
+-      GetAccService()->GetAccessibleFor(finalFocusNode, getter_AddRefs(finalFocusAccessible));      
++      GetAccService()->GetAccessibleFor(finalFocusNode, &finalFocusAccessible);      
+       // For activedescendant, the ARIA spec does not require that the user agent
+       // checks whether finalFocusNode is actually a descendant of the element with
+       // the activedescendant attribute.
+@@ -500,7 +500,7 @@ PRBool nsRootAccessible::FireAccessibleF
+     }
+   }
+   else if (mCurrentARIAMenubar) {
+-    nsCOMPtr<nsIAccessibleEvent> menuEndEvent =
++    nsIAccessibleEvent* menuEndEvent =
+       new nsAccEvent(nsIAccessibleEvent::EVENT_MENU_END, mCurrentARIAMenubar, nsnull, PR_FALSE);
+     if (menuEndEvent) {
+       FireDelayedAccessibleEvent(menuEndEvent, eAllowDupes, PR_FALSE);
+@@ -511,10 +511,10 @@ PRBool nsRootAccessible::FireAccessibleF
+   NS_IF_RELEASE(gLastFocusedNode);
+   gLastFocusedNode = finalFocusNode;
+ 
+-  nsCOMPtr<nsIAccessibleDocument> docAccessible = do_QueryInterface(finalFocusAccessible);
++  nsIAccessibleDocument* docAccessible = do_QueryInterface(finalFocusAccessible);
+   if (docAccessible) {
+     // Doc is gaining focus, but actual focus may be on an element within document
+-    nsCOMPtr<nsIDOMNode> realFocusedNode = GetCurrentFocus();
++    nsIDOMNode* realFocusedNode = GetCurrentFocus();
+     if (realFocusedNode != aNode || realFocusedNode == mDOMNode) {
+       // Suppress document focus, because real DOM focus will be fired next,
+       // and that's what we care about
+@@ -531,24 +531,24 @@ PRBool nsRootAccessible::FireAccessibleF
+ 
+ void nsRootAccessible::FireCurrentFocusEvent()
+ {
+-  nsCOMPtr<nsIDOMNode> focusedNode = GetCurrentFocus();
++  nsIDOMNode* focusedNode = GetCurrentFocus();
+   if (!focusedNode) {
+     return; // No current focus
+   }
+ 
+   // Simulate a focus event so that we can reuse code that fires focus for container children like treeitems
+-  nsCOMPtr<nsIDOMDocumentEvent> docEvent = do_QueryInterface(mDocument);
++  nsIDOMDocumentEvent* docEvent = do_QueryInterface(mDocument);
+   if (docEvent) {
+-    nsCOMPtr<nsIDOMEvent> event;
++    nsIDOMEvent* event;
+     if (NS_SUCCEEDED(docEvent->CreateEvent(NS_LITERAL_STRING("Events"),
+-                                           getter_AddRefs(event))) &&
++                                           &event)) &&
+         NS_SUCCEEDED(event->InitEvent(NS_LITERAL_STRING("focus"), PR_TRUE, PR_TRUE))) {
+       // Get the target node we really want for the event.
+       nsIAccessibilityService* accService = GetAccService();
+       if (accService) {
+-        nsCOMPtr<nsIDOMNode> targetNode;
++        nsIDOMNode* targetNode;
+         accService->GetRelevantContentNodeFor(focusedNode,
+-                                            getter_AddRefs(targetNode));
++                                            &targetNode);
+         if (targetNode) {
+           HandleEventWithTarget(event, targetNode);
+         }
+@@ -563,8 +563,8 @@ NS_IMETHODIMP nsRootAccessible::HandleEv
+ {
+   // Turn DOM events in accessibility events
+   // Get info about event and target
+-  nsCOMPtr<nsIDOMNode> targetNode;
+-  GetTargetNode(aEvent, getter_AddRefs(targetNode));
++  nsIDOMNode* targetNode;
++  GetTargetNode(aEvent, &targetNode);
+   if (!targetNode)
+     return NS_ERROR_FAILURE;
+   
+@@ -588,7 +588,7 @@ nsresult nsRootAccessible::HandleEventWi
+   }
+ #endif
+ 
+-  nsCOMPtr<nsIPresShell> eventShell = GetPresShellFor(aTargetNode);
++  nsIPresShell* eventShell = GetPresShellFor(aTargetNode);
+   if (!eventShell) {
+     return NS_OK;
+   }
+@@ -603,10 +603,10 @@ nsresult nsRootAccessible::HandleEventWi
+     // so that we don't destroy something still in use, like wizard page. 
+     // And we only get cached document accessible to destroy, so that we don't
+     // create it just to destroy it.
+-    nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(eventShell));
+-    nsCOMPtr<nsIAccessible> accessible;
+-    accService->GetCachedAccessible(aTargetNode, weakShell, getter_AddRefs(accessible));
+-    nsCOMPtr<nsPIAccessibleDocument> privateAccDoc = do_QueryInterface(accessible);
++    nsIWeakReference* weakShell(do_GetWeakReference(eventShell));
++    nsIAccessible* accessible;
++    accService->GetCachedAccessible(aTargetNode, weakShell, &accessible);
++    nsPIAccessibleDocument* privateAccDoc = do_QueryInterface(accessible);
+     if (privateAccDoc) {
+       privateAccDoc->Destroy();
+     }
+@@ -623,16 +623,16 @@ nsresult nsRootAccessible::HandleEventWi
+ 
+   if (eventType.EqualsLiteral("TreeViewChanged")) { // Always asynch, always from user input
+     NS_ENSURE_TRUE(localName.EqualsLiteral("tree"), NS_OK);
+-    nsCOMPtr<nsIContent> treeContent = do_QueryInterface(aTargetNode);
++    nsIContent* treeContent = do_QueryInterface(aTargetNode);
+     nsAccEvent::PrepareForEvent(aTargetNode, PR_TRUE);
+     return accService->InvalidateSubtreeFor(eventShell, treeContent,
+                                             nsIAccessibleEvent::EVENT_ASYNCH_SIGNIFICANT_CHANGE);
+   }
+ 
+-  nsCOMPtr<nsIAccessible> accessible;
++  nsIAccessible* accessible;
+   accService->GetAccessibleInShell(aTargetNode, eventShell,
+-                                   getter_AddRefs(accessible));
+-  nsCOMPtr<nsPIAccessible> privAcc(do_QueryInterface(accessible));
++                                   &accessible);
++  nsPIAccessible* privAcc(do_QueryInterface(accessible));
+   if (!privAcc)
+     return NS_OK;
+ 
+@@ -646,7 +646,7 @@ nsresult nsRootAccessible::HandleEventWi
+     PRBool isEnabled = (state & (nsIAccessibleStates::STATE_CHECKED |
+                         nsIAccessibleStates::STATE_SELECTED)) != 0;
+ 
+-    nsCOMPtr<nsIAccessibleStateChangeEvent> accEvent =
++    nsIAccessibleStateChangeEvent* accEvent =
+       new nsAccStateChangeEvent(accessible, nsIAccessibleStates::STATE_CHECKED,
+                                 PR_FALSE, isEnabled);
+     privAcc->FireAccessibleEvent(accEvent);
+@@ -662,7 +662,7 @@ nsresult nsRootAccessible::HandleEventWi
+ 
+     PRBool isEnabled = !!(state & nsIAccessibleStates::STATE_CHECKED);
+ 
+-    nsCOMPtr<nsIAccessibleStateChangeEvent> accEvent =
++    nsIAccessibleStateChangeEvent* accEvent =
+       new nsAccStateChangeEvent(accessible,
+                                 nsIAccessibleStates::STATE_CHECKED,
+                                 PR_FALSE, isEnabled);
+@@ -670,22 +670,22 @@ nsresult nsRootAccessible::HandleEventWi
+     return privAcc->FireAccessibleEvent(accEvent);
+   }
+ 
+-  nsCOMPtr<nsIAccessible> treeItemAccessible;
++  nsIAccessible* treeItemAccessible;
+ #ifdef MOZ_XUL
+   // If it's a tree element, need the currently selected item
+   if (localName.EqualsLiteral("tree")) {
+-    nsCOMPtr<nsIDOMXULMultiSelectControlElement> multiSelect =
++    nsIDOMXULMultiSelectControlElement* multiSelect =
+       do_QueryInterface(aTargetNode);
+     if (multiSelect) {
+       PRInt32 treeIndex = -1;
+       multiSelect->GetCurrentIndex(&treeIndex);
+       if (treeIndex >= 0) {
+-        nsCOMPtr<nsIAccessibleTreeCache> treeCache(do_QueryInterface(accessible));
++        nsIAccessibleTreeCache* treeCache(do_QueryInterface(accessible));
+         if (!treeCache ||
+             NS_FAILED(treeCache->GetCachedTreeitemAccessible(
+                       treeIndex,
+                       nsnull,
+-                      getter_AddRefs(treeItemAccessible))) ||
++                      &treeItemAccessible)) ||
+                       !treeItemAccessible) {
+           return NS_ERROR_OUT_OF_MEMORY;
+         }
+@@ -700,7 +700,7 @@ nsresult nsRootAccessible::HandleEventWi
+     PRUint32 state = State(accessible); // collapsed/expanded changed
+     PRBool isEnabled = (state & nsIAccessibleStates::STATE_EXPANDED) != 0;
+ 
+-    nsCOMPtr<nsIAccessibleStateChangeEvent> accEvent =
++    nsIAccessibleStateChangeEvent* accEvent =
+       new nsAccStateChangeEvent(accessible, nsIAccessibleStates::STATE_EXPANDED,
+                                 PR_FALSE, isEnabled);
+     return FireAccessibleEvent(accEvent);
+@@ -709,7 +709,7 @@ nsresult nsRootAccessible::HandleEventWi
+   if (treeItemAccessible && eventType.EqualsLiteral("select")) {
+     // If multiselect tree, we should fire selectionadd or selection removed
+     if (gLastFocusedNode == aTargetNode) {
+-      nsCOMPtr<nsIDOMXULMultiSelectControlElement> multiSel =
++      nsIDOMXULMultiSelectControlElement* multiSel =
+         do_QueryInterface(aTargetNode);
+       nsAutoString selType;
+       multiSel->GetSelType(selType);
+@@ -745,19 +745,19 @@ nsresult nsRootAccessible::HandleEventWi
+     // Keep a reference to the target node. We might want to change
+     // it to the individual radio button or selected item, and send
+     // the focus event to that.
+-    nsCOMPtr<nsIDOMNode> focusedItem(aTargetNode);
++    nsIDOMNode* focusedItem(aTargetNode);
+ 
+     if (!treeItemAccessible) {
+-      nsCOMPtr<nsIDOMXULSelectControlElement> selectControl =
++      nsIDOMXULSelectControlElement* selectControl =
+         do_QueryInterface(aTargetNode);
+       if (selectControl) {
+-        nsCOMPtr<nsIDOMXULMenuListElement> menuList =
++        nsIDOMXULMenuListElement* menuList =
+           do_QueryInterface(aTargetNode);
+         if (!menuList) {
+           // Don't do this for menu lists, the items only get focused
+           // when the list is open, based on DOMMenuitemActive events
+-          nsCOMPtr<nsIDOMXULSelectControlItemElement> selectedItem;
+-          selectControl->GetSelectedItem(getter_AddRefs(selectedItem));
++          nsIDOMXULSelectControlItemElement* selectedItem;
++          selectControl->GetSelectedItem(&selectedItem);
+           if (selectedItem)
+             focusedItem = do_QueryInterface(selectedItem);
+ 
+@@ -765,7 +765,7 @@ nsresult nsRootAccessible::HandleEventWi
+             return NS_OK;
+ 
+           accService->GetAccessibleInShell(focusedItem, eventShell,
+-                                           getter_AddRefs(accessible));
++                                           &accessible);
+           if (!accessible)
+             return NS_OK;
+         }
+@@ -810,8 +810,8 @@ nsresult nsRootAccessible::HandleEventWi
+     }
+     if (gLastFocusedNode != aTargetNode) {
+       // Was not focused on popup
+-      nsCOMPtr<nsIDOMNode> parentOfFocus;
+-      gLastFocusedNode->GetParentNode(getter_AddRefs(parentOfFocus));
++      nsIDOMNode* parentOfFocus;
++      gLastFocusedNode->GetParentNode(&parentOfFocus);
+       if (parentOfFocus != aTargetNode) {
+         return NS_OK;  // And was not focused on an item inside the popup
+       }
+@@ -827,7 +827,7 @@ nsresult nsRootAccessible::HandleEventWi
+   }
+   else if (eventType.EqualsLiteral("DOMMenuItemActive")) {
+     if (!treeItemAccessible) {
+-      nsCOMPtr<nsPIAccessNode> menuAccessNode = do_QueryInterface(accessible);
++      nsPIAccessNode* menuAccessNode = do_QueryInterface(accessible);
+       NS_ENSURE_TRUE(menuAccessNode, NS_ERROR_FAILURE);
+       nsIFrame* menuFrame = menuAccessNode->GetFrame();
+       NS_ENSURE_TRUE(menuFrame, NS_ERROR_FAILURE);
+@@ -840,8 +840,8 @@ nsresult nsRootAccessible::HandleEventWi
+         // is active.
+         return NS_OK;
+       } else {
+-        nsCOMPtr<nsIAccessible> containerAccessible;
+-        accessible->GetParent(getter_AddRefs(containerAccessible));
++        nsIAccessible* containerAccessible;
++        accessible->GetParent(&containerAccessible);
+         NS_ENSURE_TRUE(containerAccessible, NS_ERROR_FAILURE);
+         // It is not top level menuitem
+         // Only fire focus event if it is not inside collapsed popup
+@@ -871,14 +871,14 @@ void nsRootAccessible::GetTargetNode(nsI
+ {
+   *aTargetNode = nsnull;
+ 
+-  nsCOMPtr<nsIDOMNSEvent> nsevent(do_QueryInterface(aEvent));
++  nsIDOMNSEvent* nsevent(do_QueryInterface(aEvent));
+ 
+   if (!nsevent)
+     return;
+ 
+-  nsCOMPtr<nsIDOMEventTarget> domEventTarget;
+-  nsevent->GetOriginalTarget(getter_AddRefs(domEventTarget));
+-  nsCOMPtr<nsIDOMNode> eventTarget(do_QueryInterface(domEventTarget));
++  nsIDOMEventTarget* domEventTarget;
++  nsevent->GetOriginalTarget(&domEventTarget);
++  nsIDOMNode* eventTarget(do_QueryInterface(domEventTarget));
+   if (!eventTarget)
+     return;
+ 
+@@ -906,7 +906,7 @@ nsRootAccessible::Init()
+   nsresult rv = nsDocAccessibleWrap::Init();
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+-  nsRefPtr<nsApplicationAccessibleWrap> root = GetApplicationAccessible();
++  nsApplicationAccessibleWrap* root = GetApplicationAccessible();
+   NS_ENSURE_STATE(root);
+ 
+   root->AddRootAccessible(this);
+@@ -920,7 +920,7 @@ NS_IMETHODIMP nsRootAccessible::Shutdown
+     return NS_OK;  // Already shutdown
+   }
+ 
+-  nsRefPtr<nsApplicationAccessibleWrap> root = GetApplicationAccessible();
++  nsApplicationAccessibleWrap* root = GetApplicationAccessible();
+   NS_ENSURE_STATE(root);
+ 
+   root->RemoveRootAccessible(this);
+@@ -935,7 +935,7 @@ NS_IMETHODIMP nsRootAccessible::Shutdown
+   return nsDocAccessibleWrap::Shutdown();
+ }
+ 
+-already_AddRefed<nsIDocShellTreeItem>
++nsIDocShellTreeItem*
+ nsRootAccessible::GetContentDocShell(nsIDocShellTreeItem *aStart)
+ {
+   if (!aStart) {
+@@ -945,9 +945,9 @@ nsRootAccessible::GetContentDocShell(nsI
+   PRInt32 itemType;
+   aStart->GetItemType(&itemType);
+   if (itemType == nsIDocShellTreeItem::typeContent) {
+-    nsCOMPtr<nsIAccessibleDocument> accDoc =
++    nsIAccessibleDocument* accDoc =
+       GetDocAccessibleFor(aStart, PR_TRUE);
+-    nsCOMPtr<nsIAccessible> accessible = do_QueryInterface(accDoc);
++    nsIAccessible* accessible = do_QueryInterface(accDoc);
+     // If ancestor chain of accessibles is not completely visible,
+     // don't use this one. This happens for example if it's inside
+     // a background tab (tabbed browsing)
+@@ -955,23 +955,23 @@ nsRootAccessible::GetContentDocShell(nsI
+       if (State(accessible) & nsIAccessibleStates::STATE_INVISIBLE) {
+         return nsnull;
+       }
+-      nsCOMPtr<nsIAccessible> ancestor;
+-      accessible->GetParent(getter_AddRefs(ancestor));
++      nsIAccessible* ancestor;
++      accessible->GetParent(&ancestor);
+       if (ancestor == this) {
+         break; // Don't check past original root accessible we started with
+       }
+-      accessible.swap(ancestor);
++      swap(accessible, ancestor);
+     }
+ 
+     return aStart;
+   }
+-  nsCOMPtr<nsIDocShellTreeNode> treeNode(do_QueryInterface(aStart));
++  nsIDocShellTreeNode* treeNode(do_QueryInterface(aStart));
+   if (treeNode) {
+     PRInt32 subDocuments;
+     treeNode->GetChildCount(&subDocuments);
+     for (PRInt32 count = 0; count < subDocuments; count ++) {
+-      nsCOMPtr<nsIDocShellTreeItem> treeItemChild, contentTreeItem;
+-      treeNode->GetChildAt(count, getter_AddRefs(treeItemChild));
++      nsIDocShellTreeItem* treeItemChild, *contentTreeItem;
++      treeNode->GetChildAt(count, &treeItemChild);
+       NS_ENSURE_TRUE(treeItemChild, nsnull);
+       contentTreeItem = GetContentDocShell(treeItemChild);
+       if (contentTreeItem) {
+@@ -992,12 +992,12 @@ NS_IMETHODIMP nsRootAccessible::GetAcces
+     return nsDocAccessibleWrap::GetAccessibleRelated(aRelationType, aRelated);
+   }
+ 
+-  nsCOMPtr<nsIDocShellTreeItem> treeItem =
++  nsIDocShellTreeItem* treeItem =
+     nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
+-  nsCOMPtr<nsIDocShellTreeItem> contentTreeItem = GetContentDocShell(treeItem);
++  nsIDocShellTreeItem* contentTreeItem = GetContentDocShell(treeItem);
+   // there may be no content area, so we need a null check
+   if (contentTreeItem) {
+-    nsCOMPtr<nsIAccessibleDocument> accDoc =
++    nsIAccessibleDocument* accDoc =
+       GetDocAccessibleFor(contentTreeItem, PR_TRUE);
+     NS_ASSERTION(accDoc, "No EMBEDS document");
+     if (accDoc) {
+@@ -1013,7 +1013,7 @@ NS_IMETHODIMP nsRootAccessible::FireDocL
+     return NS_OK;  // Document has been shut down
+   }
+ 
+-  nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem =
++  nsIDocShellTreeItem* docShellTreeItem =
+     nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
+   NS_ASSERTION(docShellTreeItem, "No doc shell tree item for document");
+   NS_ENSURE_TRUE(docShellTreeItem, NS_ERROR_FAILURE);
+diff --git a/accessible/src/base/nsRootAccessible.h b/accessible/src/base/nsRootAccessible.h
+--- a/accessible/src/base/nsRootAccessible.h
++++ b/accessible/src/base/nsRootAccessible.h
+@@ -122,7 +122,7 @@ class nsRootAccessible : public nsDocAcc
+ #ifdef MOZ_XUL
+     PRUint32 GetChromeFlags();
+ #endif
+-    already_AddRefed<nsIDocShellTreeItem>
++    nsIDocShellTreeItem*
+            GetContentDocShell(nsIDocShellTreeItem *aStart);
+     nsRefPtr<nsCaretAccessible> mCaretAccessible;
+     nsCOMPtr<nsIAccessible> mCurrentARIAMenubar;
+diff --git a/accessible/src/html/nsHTMLAreaAccessible.cpp b/accessible/src/html/nsHTMLAreaAccessible.cpp
+--- a/accessible/src/html/nsHTMLAreaAccessible.cpp
++++ b/accessible/src/html/nsHTMLAreaAccessible.cpp
+@@ -56,7 +56,7 @@ nsLinkableAccessible(aDomNode, aShell)
+ /* wstring getName (); */
+ NS_IMETHODIMP nsHTMLAreaAccessible::GetName(nsAString & aName)
+ {
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   if (!content) {
+     return NS_ERROR_FAILURE;
+   }
+@@ -89,7 +89,7 @@ NS_IMETHODIMP nsHTMLAreaAccessible::GetD
+ NS_IMETHODIMP nsHTMLAreaAccessible::GetDescription(nsAString& _retval)
+ {
+   // Still to do - follow IE's standard here
+-  nsCOMPtr<nsIDOMHTMLAreaElement> area(do_QueryInterface(mDOMNode));
++  nsIDOMHTMLAreaElement* area(do_QueryInterface(mDOMNode));
+   if (area) 
+     area->GetShape(_retval);
+   return NS_OK;
+@@ -127,7 +127,7 @@ NS_IMETHODIMP nsHTMLAreaAccessible::GetB
+   nsPresContext *presContext = GetPresContext();
+   NS_ENSURE_TRUE(presContext, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIContent> ourContent(do_QueryInterface(mDOMNode));
++  nsIContent* ourContent(do_QueryInterface(mDOMNode));
+   NS_ENSURE_TRUE(ourContent, NS_ERROR_FAILURE);
+ 
+   nsIFrame *frame = GetFrame();
+@@ -136,8 +136,8 @@ NS_IMETHODIMP nsHTMLAreaAccessible::GetB
+   nsresult rv = frame->QueryInterface(NS_GET_IID(nsIImageFrame), (void**)&imageFrame);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+-  nsCOMPtr<nsIImageMap> map;
+-  imageFrame->GetImageMap(presContext, getter_AddRefs(map));
++  nsIImageMap* map;
++  imageFrame->GetImageMap(presContext, &map);
+   NS_ENSURE_TRUE(map, NS_ERROR_FAILURE);
+ 
+   nsRect rect, orgRectPixels;
+diff --git a/accessible/src/html/nsHTMLFormControlAccessible.cpp b/accessible/src/html/nsHTMLFormControlAccessible.cpp
+--- a/accessible/src/html/nsHTMLFormControlAccessible.cpp
++++ b/accessible/src/html/nsHTMLFormControlAccessible.cpp
+@@ -111,7 +111,7 @@ nsHTMLCheckboxAccessible::GetState(PRUin
+ 
+   PRBool checked = PR_FALSE;   // Radio buttons and check boxes can be checked
+ 
+-  nsCOMPtr<nsIDOMHTMLInputElement> htmlCheckboxElement(do_QueryInterface(mDOMNode));
++  nsIDOMHTMLInputElement* htmlCheckboxElement(do_QueryInterface(mDOMNode));
+   if (htmlCheckboxElement)
+     htmlCheckboxElement->GetChecked(&checked);
+ 
+@@ -138,7 +138,7 @@ nsHTMLRadioButtonAccessible::GetState(PR
+   
+   PRBool checked = PR_FALSE;   // Radio buttons and check boxes can be checked
+ 
+-  nsCOMPtr<nsIDOMHTMLInputElement> htmlRadioElement(do_QueryInterface(mDOMNode));
++  nsIDOMHTMLInputElement* htmlRadioElement(do_QueryInterface(mDOMNode));
+   if (htmlRadioElement)
+     htmlRadioElement->GetChecked(&checked);
+ 
+@@ -162,7 +162,7 @@ nsHTMLRadioButtonAccessible::GetAttribut
+   nsAutoString tagName;
+   mDOMNode->GetLocalName(tagName);
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   NS_ENSURE_STATE(content);
+ 
+   nsAutoString type;
+@@ -170,18 +170,18 @@ nsHTMLRadioButtonAccessible::GetAttribut
+   nsAutoString name;
+   content->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::name, name);
+ 
+-  nsCOMPtr<nsIDOMNodeList> inputs;
+-
+-  nsCOMPtr<nsIDOMHTMLInputElement> radio(do_QueryInterface(mDOMNode));
+-  nsCOMPtr<nsIDOMHTMLFormElement> form;
+-  radio->GetForm(getter_AddRefs(form));
++  nsIDOMNodeList* inputs;
++
++  nsIDOMHTMLInputElement* radio(do_QueryInterface(mDOMNode));
++  nsIDOMHTMLFormElement* form;
++  radio->GetForm(&form);
+   if (form) {
+-    form->GetElementsByTagNameNS(nsURI, tagName, getter_AddRefs(inputs));
++    form->GetElementsByTagNameNS(nsURI, tagName, &inputs);
+   } else {
+-    nsCOMPtr<nsIDOMDocument> document;
+-    mDOMNode->GetOwnerDocument(getter_AddRefs(document));
++    nsIDOMDocument* document;
++    mDOMNode->GetOwnerDocument(&document);
+     if (document)
+-      document->GetElementsByTagNameNS(nsURI, tagName, getter_AddRefs(inputs));
++      document->GetElementsByTagNameNS(nsURI, tagName, &inputs);
+   }
+ 
+   NS_ENSURE_TRUE(inputs, NS_OK);
+@@ -194,10 +194,10 @@ nsHTMLRadioButtonAccessible::GetAttribut
+   PRInt32 count = 0;
+ 
+   for (PRUint32 index = 0; index < inputsCount; index++) {
+-    nsCOMPtr<nsIDOMNode> itemNode;
+-    inputs->Item(index, getter_AddRefs(itemNode));
+-
+-    nsCOMPtr<nsIContent> item(do_QueryInterface(itemNode));
++    nsIDOMNode* itemNode;
++    inputs->Item(index, &itemNode);
++
++    nsIContent* item(do_QueryInterface(itemNode));
+     if (item &&
+         item->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::type,
+                           type, eCaseMatters) &&
+@@ -249,7 +249,7 @@ NS_IMETHODIMP
+ NS_IMETHODIMP
+ nsHTMLButtonAccessible::GetState(PRUint32 *aState, PRUint32 *aExtraState)
+ {
+-  nsCOMPtr<nsIDOMElement> element(do_QueryInterface(mDOMNode));
++  nsIDOMElement* element(do_QueryInterface(mDOMNode));
+   NS_ENSURE_TRUE(element, NS_ERROR_FAILURE);
+ 
+   nsresult rv = nsHyperTextAccessibleWrap::GetState(aState, aExtraState);
+@@ -271,7 +271,7 @@ NS_IMETHODIMP nsHTMLButtonAccessible::Ge
+ 
+ NS_IMETHODIMP nsHTMLButtonAccessible::GetName(nsAString& aName)
+ {
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   if (!content) {
+     return NS_ERROR_FAILURE; // Node shut down
+   }
+@@ -350,7 +350,7 @@ NS_IMETHODIMP
+ NS_IMETHODIMP
+ nsHTML4ButtonAccessible::GetState(PRUint32 *aState, PRUint32 *aExtraState)
+ {
+-  nsCOMPtr<nsIDOMElement> element(do_QueryInterface(mDOMNode));
++  nsIDOMElement* element(do_QueryInterface(mDOMNode));
+   NS_ENSURE_TRUE(element, NS_ERROR_FAILURE);  // Button accessible shut down
+ 
+   nsresult rv = nsHyperTextAccessibleWrap::GetState(aState, aExtraState);
+@@ -376,7 +376,7 @@ NS_IMETHODIMP nsHTMLTextFieldAccessible:
+ NS_IMETHODIMP nsHTMLTextFieldAccessible::GetRole(PRUint32 *aRole)
+ {
+   *aRole = nsIAccessibleRole::ROLE_ENTRY;
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   if (content &&
+       content->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::type,
+                            nsAccessibilityAtoms::password, eIgnoreCase)) {
+@@ -387,7 +387,7 @@ NS_IMETHODIMP nsHTMLTextFieldAccessible:
+ 
+ NS_IMETHODIMP nsHTMLTextFieldAccessible::GetName(nsAString& aName)
+ {
+-  nsCOMPtr<nsIContent> content = do_QueryInterface(mDOMNode);
++  nsIContent* content = do_QueryInterface(mDOMNode);
+   if (!content) {
+     return NS_ERROR_FAILURE;
+   }
+@@ -400,8 +400,8 @@ NS_IMETHODIMP nsHTMLTextFieldAccessible:
+   // This means we're part of another control, so use parent accessible for name.
+   // This ensures that a textbox inside of a XUL widget gets
+   // an accessible name.
+-  nsCOMPtr<nsIAccessible> parent;
+-  rv = GetParent(getter_AddRefs(parent));
++  nsIAccessible* parent;
++  rv = GetParent(&parent);
+   return parent ? parent->GetName(aName) : rv;
+ }
+ 
+@@ -412,12 +412,12 @@ NS_IMETHODIMP nsHTMLTextFieldAccessible:
+   if (state & nsIAccessibleStates::STATE_PROTECTED)    // Don't return password text!
+     return NS_ERROR_FAILURE;
+ 
+-  nsCOMPtr<nsIDOMHTMLTextAreaElement> textArea(do_QueryInterface(mDOMNode));
++  nsIDOMHTMLTextAreaElement* textArea(do_QueryInterface(mDOMNode));
+   if (textArea) {
+     return textArea->GetValue(_retval);
+   }
+   
+-  nsCOMPtr<nsIDOMHTMLInputElement> inputElement(do_QueryInterface(mDOMNode));
++  nsIDOMHTMLInputElement* inputElement(do_QueryInterface(mDOMNode));
+   if (inputElement) {
+     return inputElement->GetValue(_retval);
+   }
+@@ -432,7 +432,7 @@ nsHTMLTextFieldAccessible::GetState(PRUi
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+   // can be focusable, focused, protected. readonly, unavailable, selected
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   NS_ASSERTION(content, "Should not have gotten here if upcalled GetExtState() succeeded");
+ 
+   if (content->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::type,
+@@ -440,8 +440,8 @@ nsHTMLTextFieldAccessible::GetState(PRUi
+     *aState |= nsIAccessibleStates::STATE_PROTECTED;
+   }
+   else {
+-    nsCOMPtr<nsIAccessible> parent;
+-    GetParent(getter_AddRefs(parent));
++    nsIAccessible* parent;
++    GetParent(&parent);
+     if (parent && Role(parent) == nsIAccessibleRole::ROLE_AUTOCOMPLETE) {
+       *aState |= nsIAccessibleStates::STATE_HASPOPUP;
+     }
+@@ -454,7 +454,7 @@ nsHTMLTextFieldAccessible::GetState(PRUi
+   if (!aExtraState || !(*aExtraState & nsIAccessibleStates::EXT_STATE_EDITABLE))
+     return NS_OK;
+ 
+-  nsCOMPtr<nsIDOMHTMLInputElement> htmlInput(do_QueryInterface(mDOMNode));
++  nsIDOMHTMLInputElement* htmlInput(do_QueryInterface(mDOMNode));
+   // Is it an <input> or a <textarea> ?
+   if (htmlInput) {
+     *aExtraState |= nsIAccessibleStates::EXT_STATE_SINGLE_LINE;
+@@ -463,7 +463,7 @@ nsHTMLTextFieldAccessible::GetState(PRUi
+     *aExtraState |= nsIAccessibleStates::EXT_STATE_MULTI_LINE;
+   }
+ 
+-  nsCOMPtr<nsIContent> bindingContent = content->GetBindingParent();
++  nsIContent* bindingContent = content->GetBindingParent();
+   if (bindingContent &&
+       bindingContent->NodeInfo()->Equals(nsAccessibilityAtoms::textbox,
+                                          kNameSpaceID_XUL) &&
+@@ -485,9 +485,9 @@ nsHTMLTextFieldAccessible::GetState(PRUi
+                      autocomplete);
+ 
+     if (!autocomplete.LowerCaseEqualsLiteral("off")) {
+-      nsCOMPtr<nsIDOMHTMLFormElement> form;
+-      htmlInput->GetForm(getter_AddRefs(form));
+-      nsCOMPtr<nsIContent> formContent(do_QueryInterface(form));
++      nsIDOMHTMLFormElement* form;
++      htmlInput->GetForm(&form);
++      nsIContent* formContent(do_QueryInterface(form));
+       if (formContent) {
+         formContent->GetAttr(kNameSpaceID_None,
+                      nsAccessibilityAtoms::autocomplete, autocomplete);
+@@ -519,7 +519,7 @@ NS_IMETHODIMP nsHTMLTextFieldAccessible:
+ NS_IMETHODIMP nsHTMLTextFieldAccessible::DoAction(PRUint8 index)
+ {
+   if (index == 0) {
+-    nsCOMPtr<nsIDOMNSHTMLElement> element(do_QueryInterface(mDOMNode));
++    nsIDOMNSHTMLElement* element(do_QueryInterface(mDOMNode));
+     if ( element ) {
+       return element->Focus();
+     }
+@@ -531,17 +531,17 @@ NS_IMETHODIMP nsHTMLTextFieldAccessible:
+ NS_IMETHODIMP nsHTMLTextFieldAccessible::GetAssociatedEditor(nsIEditor **aEditor)
+ {
+   *aEditor = nsnull;
+-  nsCOMPtr<nsIDOMNSEditableElement> editableElt(do_QueryInterface(mDOMNode));
++  nsIDOMNSEditableElement* editableElt(do_QueryInterface(mDOMNode));
+   NS_ENSURE_TRUE(editableElt, NS_ERROR_FAILURE);
+ 
+   // nsGenericHTMLElement::GetEditor has a security check.
+   // Make sure we're not restricted by the permissions of
+   // whatever script is currently running.
+-  nsCOMPtr<nsIJSContextStack> stack =
++  nsIJSContextStack* stack =
+     do_GetService("@mozilla.org/js/xpc/ContextStack;1");
+   PRBool pushed = stack && NS_SUCCEEDED(stack->Push(nsnull));
+ 
+-  nsCOMPtr<nsIEditor> editor;
++  nsIEditor* editor;
+   nsresult rv = editableElt->GetEditor(aEditor);
+ 
+   if (pushed) {
+@@ -572,7 +572,7 @@ NS_IMETHODIMP nsHTMLGroupboxAccessible::
+ 
+ nsIContent* nsHTMLGroupboxAccessible::GetLegend()
+ {
+-  nsCOMPtr<nsIContent> content = do_QueryInterface(mDOMNode);
++  nsIContent* content = do_QueryInterface(mDOMNode);
+   NS_ENSURE_TRUE(content, nsnull);
+ 
+   nsresult count = 0;
+@@ -628,7 +628,7 @@ nsHTMLGroupboxAccessible::GetAccessibleR
+ 
+   if (aRelationType == nsIAccessibleRelation::RELATION_LABELLED_BY) {
+     // No override for label, so use <legend> for this <fieldset>
+-    nsCOMPtr<nsIDOMNode> legendNode = do_QueryInterface(GetLegend());
++    nsIDOMNode* legendNode = do_QueryInterface(GetLegend());
+     if (legendNode) {
+       GetAccService()->GetAccessibleInWeakShell(legendNode, mWeakShell, aRelated);
+     }
+@@ -656,16 +656,16 @@ nsHTMLLegendAccessible::GetAccessibleRel
+ 
+   if (aRelationType == nsIAccessibleRelation::RELATION_LABEL_FOR) {
+     // Look for groupbox parent
+-    nsCOMPtr<nsIContent> content = do_QueryInterface(mDOMNode);
++    nsIContent* content = do_QueryInterface(mDOMNode);
+     if (!content) {
+       return NS_ERROR_FAILURE;  // Node already shut down
+     }
+-    nsCOMPtr<nsIAccessible> groupboxAccessible = GetParent();
++    nsIAccessible* groupboxAccessible = GetParent();
+     if (groupboxAccessible &&
+         Role(groupboxAccessible) == nsIAccessibleRole::ROLE_GROUPING) {
+-      nsCOMPtr<nsIAccessible> testLabelAccessible;
++      nsIAccessible* testLabelAccessible;
+       groupboxAccessible->GetAccessibleRelated(nsIAccessibleRelation::RELATION_LABELLED_BY,
+-                                               getter_AddRefs(testLabelAccessible));
++                                               &testLabelAccessible);
+       if (testLabelAccessible == this) {
+         // We're the first child of the parent groupbox
+         *aRelated = groupboxAccessible;
+diff --git a/accessible/src/html/nsHTMLImageAccessible.cpp b/accessible/src/html/nsHTMLImageAccessible.cpp
+--- a/accessible/src/html/nsHTMLImageAccessible.cpp
++++ b/accessible/src/html/nsHTMLImageAccessible.cpp
+@@ -60,8 +60,8 @@ nsHTMLImageAccessible::nsHTMLImageAccess
+ nsHTMLImageAccessible::nsHTMLImageAccessible(nsIDOMNode* aDOMNode, nsIWeakReference* aShell):
+ nsLinkableAccessible(aDOMNode, aShell), mAccessNodeCache(nsnull)
+ { 
+-  nsCOMPtr<nsIDOMElement> element(do_QueryInterface(aDOMNode));
+-  nsCOMPtr<nsIPresShell> shell(do_QueryReferent(mWeakShell));
++  nsIDOMElement* element(do_QueryInterface(aDOMNode));
++  nsIPresShell* shell(do_QueryReferent(mWeakShell));
+   if (!shell)
+     return;
+ 
+@@ -69,7 +69,7 @@ nsLinkableAccessible(aDOMNode, aShell), 
+   nsAutoString mapElementName;
+ 
+   if (doc && element) {
+-    nsCOMPtr<nsIHTMLDocument> htmlDoc(do_QueryInterface(doc));
++    nsIHTMLDocument* htmlDoc(do_QueryInterface(doc));
+     element->GetAttribute(NS_LITERAL_STRING("usemap"),mapElementName);
+     if (htmlDoc && !mapElementName.IsEmpty()) {
+       if (mapElementName.CharAt(0) == '#')
+@@ -95,16 +95,16 @@ nsHTMLImageAccessible::GetState(PRUint32
+   nsresult rv = nsLinkableAccessible::GetState(aState, aExtraState);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+-  nsCOMPtr<nsIImageLoadingContent> content(do_QueryInterface(mDOMNode));
+-  nsCOMPtr<imgIRequest> imageRequest;
++  nsIImageLoadingContent* content(do_QueryInterface(mDOMNode));
++  imgIRequest* imageRequest;
+ 
+   if (content)
+     content->GetRequest(nsIImageLoadingContent::CURRENT_REQUEST,
+-                        getter_AddRefs(imageRequest));
+-
+-  nsCOMPtr<imgIContainer> imgContainer;
++                        &imageRequest);
++
++  imgIContainer* imgContainer;
+   if (imageRequest)
+-    imageRequest->GetImage(getter_AddRefs(imgContainer));
++    imageRequest->GetImage(&imgContainer);
+ 
+   if (imgContainer) {
+     PRUint32 numFrames;
+@@ -120,7 +120,7 @@ nsHTMLImageAccessible::GetState(PRUint32
+ /* wstring getName (); */
+ NS_IMETHODIMP nsHTMLImageAccessible::GetName(nsAString& aName)
+ {
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   if (!content) {
+     return NS_ERROR_FAILURE;  // Node has been shut down
+   }
+@@ -150,32 +150,32 @@ NS_IMETHODIMP nsHTMLImageAccessible::Get
+ }
+ 
+ 
+-already_AddRefed<nsIAccessible>
++nsIAccessible*
+ nsHTMLImageAccessible::GetAreaAccessible(PRInt32 aAreaNum)
+ {
+   if (!mMapElement)
+     return nsnull;
+ 
+-  nsCOMPtr<nsIDOMHTMLCollection> mapAreas;
+-  mMapElement->GetAreas(getter_AddRefs(mapAreas));
++  nsIDOMHTMLCollection* mapAreas;
++  mMapElement->GetAreas(&mapAreas);
+   if (!mapAreas)
+     return nsnull;
+ 
+-  nsCOMPtr<nsIDOMNode> domNode;
+-  mapAreas->Item(aAreaNum,getter_AddRefs(domNode));
++  nsIDOMNode* domNode;
++  mapAreas->Item(aAreaNum,&domNode);
+   if (!domNode)
+     return nsnull;
+ 
+-  nsCOMPtr<nsIAccessNode> accessNode;
++  nsIAccessNode* accessNode;
+   GetCacheEntry(*mAccessNodeCache, (void*)(aAreaNum),
+-                getter_AddRefs(accessNode));
++                &accessNode);
+ 
+   if (!accessNode) {
+     accessNode = new nsHTMLAreaAccessible(domNode, this, mWeakShell);
+     if (!accessNode)
+       return nsnull;
+ 
+-    nsCOMPtr<nsPIAccessNode> privateAccessNode(do_QueryInterface(accessNode));
++    nsPIAccessNode* privateAccessNode(do_QueryInterface(accessNode));
+     NS_ASSERTION(privateAccessNode,
+                  "Accessible doesn't implement nsPIAccessNode");
+ 
+@@ -186,7 +186,7 @@ nsHTMLImageAccessible::GetAreaAccessible
+     PutCacheEntry(*mAccessNodeCache, (void*)(aAreaNum), accessNode);
+   }
+ 
+-  nsCOMPtr<nsIAccessible> accessible(do_QueryInterface(accessNode));
++  nsIAccessible* accessible(do_QueryInterface(accessNode));
+   nsIAccessible *accPtr;
+   accPtr = accessible;
+   return accPtr;
+@@ -205,9 +205,9 @@ void nsHTMLImageAccessible::CacheChildre
+     return;
+   }
+ 
+-  nsCOMPtr<nsIDOMHTMLCollection> mapAreas;
++  nsIDOMHTMLCollection* mapAreas;
+   if (mMapElement) {
+-    mMapElement->GetAreas(getter_AddRefs(mapAreas));
++    mMapElement->GetAreas(&mapAreas);
+   }
+   if (!mapAreas) {
+     mAccChildCount = 0;
+@@ -218,8 +218,8 @@ void nsHTMLImageAccessible::CacheChildre
+   mapAreas->GetLength(&numMapAreas);
+   PRInt32 childCount = 0;
+   
+-  nsCOMPtr<nsIAccessible> areaAccessible;
+-  nsCOMPtr<nsPIAccessible> privatePrevAccessible;
++  nsIAccessible* areaAccessible;
++  nsPIAccessible* privatePrevAccessible;
+   while (childCount < (PRInt32)numMapAreas && 
+          (areaAccessible = GetAreaAccessible(childCount)) != nsnull) {
+     if (privatePrevAccessible) {
+@@ -242,21 +242,21 @@ NS_IMETHODIMP nsHTMLImageAccessible::DoA
+ {
+   if (index == eAction_ShowLongDescription) {
+     //get the long description uri and open in a new window
+-    nsCOMPtr<nsIDOMHTMLImageElement> element(do_QueryInterface(mDOMNode));
++    nsIDOMHTMLImageElement* element(do_QueryInterface(mDOMNode));
+     NS_ENSURE_TRUE(element, NS_ERROR_FAILURE);
+     nsAutoString longDesc;
+     nsresult rv = element->GetLongDesc(longDesc);
+     NS_ENSURE_SUCCESS(rv, rv);
+-    nsCOMPtr<nsIDOMDocument> domDocument;
+-    rv = mDOMNode->GetOwnerDocument(getter_AddRefs(domDocument));
++    nsIDOMDocument* domDocument;
++    rv = mDOMNode->GetOwnerDocument(&domDocument);
+     NS_ENSURE_SUCCESS(rv, rv);
+-    nsCOMPtr<nsIDocument> document(do_QueryInterface(domDocument));
+-    nsCOMPtr<nsPIDOMWindow> piWindow = document->GetWindow();
+-    nsCOMPtr<nsIDOMWindowInternal> win(do_QueryInterface(piWindow));
++    nsIDocument* document(do_QueryInterface(domDocument));
++    nsPIDOMWindow* piWindow = document->GetWindow();
++    nsIDOMWindowInternal* win(do_QueryInterface(piWindow));
+     NS_ENSURE_TRUE(win, NS_ERROR_FAILURE);
+-    nsCOMPtr<nsIDOMWindow> tmp;
++    nsIDOMWindow* tmp;
+     return win->Open(longDesc, NS_LITERAL_STRING(""), NS_LITERAL_STRING(""),
+-                     getter_AddRefs(tmp));
++                     &tmp);
+   }
+   return nsLinkableAccessible::DoAction(index);
+ }
+diff --git a/accessible/src/html/nsHTMLImageAccessible.h b/accessible/src/html/nsHTMLImageAccessible.h
+--- a/accessible/src/html/nsHTMLImageAccessible.h
++++ b/accessible/src/html/nsHTMLImageAccessible.h
+@@ -74,7 +74,7 @@ public:
+ 
+ protected:
+   virtual void CacheChildren();
+-  already_AddRefed<nsIAccessible> GetAreaAccessible(PRInt32 aAreaNum);
++  nsIAccessible* GetAreaAccessible(PRInt32 aAreaNum);
+   nsCOMPtr<nsIDOMHTMLMapElement> mMapElement;
+ 
+   // Cache of area accessibles. We do not use common cache because images can
+diff --git a/accessible/src/html/nsHTMLLinkAccessible.cpp b/accessible/src/html/nsHTMLLinkAccessible.cpp
+--- a/accessible/src/html/nsHTMLLinkAccessible.cpp
++++ b/accessible/src/html/nsHTMLLinkAccessible.cpp
+@@ -73,7 +73,7 @@ nsHTMLLinkAccessible::GetState(PRUint32 
+ 
+   *aState  &= ~nsIAccessibleStates::STATE_READONLY;
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   if (content && content->HasAttr(kNameSpaceID_None,
+                                   nsAccessibilityAtoms::name)) {
+     // This is how we indicate it is a named anchor
+diff --git a/accessible/src/html/nsHTMLSelectAccessible.cpp b/accessible/src/html/nsHTMLSelectAccessible.cpp
+--- a/accessible/src/html/nsHTMLSelectAccessible.cpp
++++ b/accessible/src/html/nsHTMLSelectAccessible.cpp
+@@ -83,7 +83,7 @@ nsHTMLSelectableAccessible::iterator::it
+   mLength = mIndex = 0;
+   mSelCount = 0;
+ 
+-  nsCOMPtr<nsIDOMHTMLSelectElement> htmlSelect(do_QueryInterface(mParentSelect->mDOMNode));
++  nsIDOMHTMLSelectElement* htmlSelect(do_QueryInterface(mParentSelect->mDOMNode));
+   if (htmlSelect) {
+     htmlSelect->GetOptions(getter_AddRefs(mOptions));
+     if (mOptions)
+@@ -94,9 +94,9 @@ PRBool nsHTMLSelectableAccessible::itera
+ PRBool nsHTMLSelectableAccessible::iterator::Advance() 
+ {
+   if (mIndex < mLength) {
+-    nsCOMPtr<nsIDOMNode> tempNode;
++    nsIDOMNode* tempNode;
+     if (mOptions) {
+-      mOptions->Item(mIndex, getter_AddRefs(tempNode));
++      mOptions->Item(mIndex, &tempNode);
+       mOption = do_QueryInterface(tempNode);
+     }
+     mIndex++;
+@@ -121,13 +121,13 @@ void nsHTMLSelectableAccessible::iterato
+                                                                    nsPresContext *aContext)
+ {
+   PRBool isSelected = PR_FALSE;
+-  nsCOMPtr<nsIAccessible> tempAccess;
++  nsIAccessible* tempAccess;
+ 
+   if (mOption) {
+     mOption->GetSelected(&isSelected);
+     if (isSelected) {
+-      nsCOMPtr<nsIDOMNode> optionNode(do_QueryInterface(mOption));
+-      aAccService->GetAccessibleInWeakShell(optionNode, mWeakShell, getter_AddRefs(tempAccess));
++      nsIDOMNode* optionNode(do_QueryInterface(mOption));
++      aAccService->GetAccessibleInWeakShell(optionNode, mWeakShell, &tempAccess);
+     }
+   }
+ 
+@@ -148,7 +148,7 @@ PRBool nsHTMLSelectableAccessible::itera
+     mOption->GetSelected(&isSelected);
+     if (isSelected) {
+       if (mSelCount == aIndex) {
+-        nsCOMPtr<nsIDOMNode> optionNode(do_QueryInterface(mOption));
++        nsIDOMNode* optionNode(do_QueryInterface(mOption));
+         aAccService->GetAccessibleInWeakShell(optionNode, mWeakShell, aAccessible);
+         return PR_TRUE;
+       }
+@@ -178,18 +178,18 @@ NS_IMETHODIMP nsHTMLSelectableAccessible
+ {
+   *aSelState = PR_FALSE;
+ 
+-  nsCOMPtr<nsIDOMHTMLSelectElement> htmlSelect(do_QueryInterface(mDOMNode));
++  nsIDOMHTMLSelectElement* htmlSelect(do_QueryInterface(mDOMNode));
+   if (!htmlSelect)
+     return NS_ERROR_FAILURE;
+ 
+-  nsCOMPtr<nsIDOMHTMLOptionsCollection> options;
+-  htmlSelect->GetOptions(getter_AddRefs(options));
++  nsIDOMHTMLOptionsCollection* options;
++  htmlSelect->GetOptions(&options);
+   if (!options)
+     return NS_ERROR_FAILURE;
+ 
+-  nsCOMPtr<nsIDOMNode> tempNode;
+-  options->Item(aIndex, getter_AddRefs(tempNode));
+-  nsCOMPtr<nsIDOMHTMLOptionElement> tempOption(do_QueryInterface(tempNode));
++  nsIDOMNode* tempNode;
++  options->Item(aIndex, &tempNode);
++  nsIDOMHTMLOptionElement* tempOption(do_QueryInterface(tempNode));
+   if (!tempOption)
+     return NS_ERROR_FAILURE;
+ 
+@@ -207,11 +207,11 @@ NS_IMETHODIMP nsHTMLSelectableAccessible
+ {
+   *_retval = nsnull;
+ 
+-  nsCOMPtr<nsIAccessibilityService> accService(do_GetService("@mozilla.org/accessibilityService;1"));
++  nsIAccessibilityService* accService(do_GetService("@mozilla.org/accessibilityService;1"));
+   if (!accService)
+     return NS_ERROR_FAILURE;
+ 
+-  nsCOMPtr<nsIMutableArray> selectedAccessibles =
++  nsIMutableArray* selectedAccessibles =
+     do_CreateInstance(NS_ARRAY_CONTRACTID);
+   NS_ENSURE_STATE(selectedAccessibles);
+   
+@@ -236,7 +236,7 @@ NS_IMETHODIMP nsHTMLSelectableAccessible
+ {
+   *_retval = nsnull;
+ 
+-  nsCOMPtr<nsIAccessibilityService> accService(do_GetService("@mozilla.org/accessibilityService;1"));
++  nsIAccessibilityService* accService(do_GetService("@mozilla.org/accessibilityService;1"));
+   if (!accService)
+     return NS_ERROR_FAILURE;
+ 
+@@ -293,7 +293,7 @@ NS_IMETHODIMP nsHTMLSelectableAccessible
+ {
+   *_retval = PR_FALSE;
+   
+-  nsCOMPtr<nsIDOMHTMLSelectElement> htmlSelect(do_QueryInterface(mDOMNode));
++  nsIDOMHTMLSelectElement* htmlSelect(do_QueryInterface(mDOMNode));
+   if (!htmlSelect)
+     return NS_ERROR_FAILURE;
+ 
+@@ -330,7 +330,7 @@ nsHTMLSelectListAccessible::GetState(PRU
+   nsresult rv = nsHTMLSelectableAccessible::GetState(aState, aExtraState);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+-  nsCOMPtr<nsIDOMHTMLSelectElement> select (do_QueryInterface(mDOMNode));
++  nsIDOMHTMLSelectElement* select (do_QueryInterface(mDOMNode));
+   if (select) {
+     PRBool multiple;
+     select->GetMultiple(&multiple);
+@@ -353,25 +353,25 @@ NS_IMETHODIMP nsHTMLSelectListAccessible
+   return NS_OK;
+ }
+ 
+-already_AddRefed<nsIAccessible>
++nsIAccessible*
+ nsHTMLSelectListAccessible::AccessibleForOption(nsIAccessibilityService *aAccService,
+                                                 nsIContent *aContent,
+                                                 nsIAccessible *aLastGoodAccessible,
+                                                 PRInt32 *aChildCount)
+ {
+-  nsCOMPtr<nsIDOMNode> domNode(do_QueryInterface(aContent));
++  nsIDOMNode* domNode(do_QueryInterface(aContent));
+   NS_ASSERTION(domNode, "DOM node is null");
+   // Accessibility service will initialize & cache any accessibles created
+-  nsCOMPtr<nsIAccessible> accessible;
+-  aAccService->GetAccessibleInWeakShell(domNode, mWeakShell, getter_AddRefs(accessible));
+-  nsCOMPtr<nsPIAccessible> privateAccessible(do_QueryInterface(accessible));
++  nsIAccessible* accessible;
++  aAccService->GetAccessibleInWeakShell(domNode, mWeakShell, &accessible);
++  nsPIAccessible* privateAccessible(do_QueryInterface(accessible));
+   if (!privateAccessible) {
+     return nsnull;
+   }
+ 
+   ++ *aChildCount;
+   privateAccessible->SetParent(this);
+-  nsCOMPtr<nsPIAccessible> privatePrevAccessible(do_QueryInterface(aLastGoodAccessible));
++  nsPIAccessible* privatePrevAccessible(do_QueryInterface(aLastGoodAccessible));
+   if (privatePrevAccessible) {
+     privatePrevAccessible->SetNextSibling(accessible);
+   }
+@@ -382,7 +382,7 @@ nsHTMLSelectListAccessible::AccessibleFo
+   return returnAccessible;
+ }
+ 
+-already_AddRefed<nsIAccessible>
++nsIAccessible*
+ nsHTMLSelectListAccessible::CacheOptSiblings(nsIAccessibilityService *aAccService,
+                                              nsIContent *aParentContent,
+                                              nsIAccessible *aLastGoodAccessible,
+@@ -391,15 +391,15 @@ nsHTMLSelectListAccessible::CacheOptSibl
+   // Recursive helper for CacheChildren()
+ 
+   PRUint32 numChildren = aParentContent->GetChildCount();
+-  nsCOMPtr<nsIAccessible> lastGoodAccessible(aLastGoodAccessible);
+-  nsCOMPtr<nsIAccessible> newAccessible;
++  nsIAccessible* lastGoodAccessible(aLastGoodAccessible);
++  nsIAccessible* newAccessible;
+ 
+   for (PRUint32 count = 0; count < numChildren; count ++) {
+     nsIContent *childContent = aParentContent->GetChildAt(count);
+     if (!childContent->IsNodeOfType(nsINode::eHTML)) {
+       continue;
+     }
+-    nsCOMPtr<nsIAtom> tag = childContent->Tag();
++    nsIAtom* tag = childContent->Tag();
+     if (tag == nsAccessibilityAtoms::option || tag == nsAccessibilityAtoms::optgroup) {
+       newAccessible = AccessibleForOption(aAccService,
+                                            childContent,
+@@ -418,7 +418,7 @@ nsHTMLSelectListAccessible::CacheOptSibl
+     }
+   }
+   if (lastGoodAccessible) {
+-    nsCOMPtr<nsPIAccessible> privateLastAcc =
++    nsPIAccessible* privateLastAcc =
+       do_QueryInterface(lastGoodAccessible);
+     privateLastAcc->SetNextSibling(nsnull);
+     aLastGoodAccessible = lastGoodAccessible;
+@@ -437,15 +437,15 @@ void nsHTMLSelectListAccessible::CacheCh
+   // Cache the number of <optgroup> and <option> DOM decendents,
+   // as well as the accessibles for them. Avoid whitespace text nodes.
+ 
+-  nsCOMPtr<nsIContent> selectContent(do_QueryInterface(mDOMNode));
+-  nsCOMPtr<nsIAccessibilityService> accService(do_GetService("@mozilla.org/accessibilityService;1"));
++  nsIContent* selectContent(do_QueryInterface(mDOMNode));
++  nsIAccessibilityService* accService(do_GetService("@mozilla.org/accessibilityService;1"));
+   if (!selectContent || !accService) {
+     mAccChildCount = eChildCountUninitialized;
+     return;
+   }
+ 
+   PRInt32 childCount = 0;
+-  nsCOMPtr<nsIAccessible> lastGoodAccessible =
++  nsIAccessible* lastGoodAccessible =
+     CacheOptSiblings(accService, selectContent, nsnull, &childCount);
+   mAccChildCount = childCount;
+ }
+@@ -456,23 +456,23 @@ nsHTMLSelectOptionAccessible::nsHTMLSele
+ nsHTMLSelectOptionAccessible::nsHTMLSelectOptionAccessible(nsIDOMNode* aDOMNode, nsIWeakReference* aShell):
+ nsHyperTextAccessibleWrap(aDOMNode, aShell)
+ {
+-  nsCOMPtr<nsIAccessibilityService> accService(do_GetService("@mozilla.org/accessibilityService;1"));
+-  nsCOMPtr<nsIDOMNode> parentNode;
+-  aDOMNode->GetParentNode(getter_AddRefs(parentNode));
+-  nsCOMPtr<nsIAccessible> parentAccessible;
++  nsIAccessibilityService* accService(do_GetService("@mozilla.org/accessibilityService;1"));
++  nsIDOMNode* parentNode;
++  aDOMNode->GetParentNode(&parentNode);
++  nsIAccessible* parentAccessible;
+   if (parentNode) {
+     // If the parent node is a Combobox, then the option's accessible parent
+     // is nsHTMLComboboxListAccessible, not the nsHTMLComboboxAccessible that
+     // GetParent would normally return. This is because the 
+     // nsHTMLComboboxListAccessible is inserted into the accessible hierarchy
+     // where there is no DOM node for it.
+-    accService->GetAccessibleInWeakShell(parentNode, mWeakShell, getter_AddRefs(parentAccessible));
++    accService->GetAccessibleInWeakShell(parentNode, mWeakShell, &parentAccessible);
+     if (parentAccessible) {
+       PRUint32 role;
+       parentAccessible->GetRole(&role);
+       if (role == nsIAccessibleRole::ROLE_COMBOBOX) {
+-        nsCOMPtr<nsIAccessible> comboAccessible(parentAccessible);
+-        comboAccessible->GetLastChild(getter_AddRefs(parentAccessible));
++        nsIAccessible* comboAccessible(parentAccessible);
++        comboAccessible->GetLastChild(&parentAccessible);
+       }
+     }
+   }
+@@ -498,7 +498,7 @@ NS_IMETHODIMP nsHTMLSelectOptionAccessib
+ {
+   // CASE #1 -- great majority of the cases
+   // find the label attribute - this is what the W3C says we should use
+-  nsCOMPtr<nsIDOMElement> domElement(do_QueryInterface(mDOMNode));
++  nsIDOMElement* domElement(do_QueryInterface(mDOMNode));
+   if (!domElement)
+     return NS_ERROR_FAILURE;
+ 
+@@ -509,11 +509,11 @@ NS_IMETHODIMP nsHTMLSelectOptionAccessib
+   
+   // CASE #2 -- no label parameter, get the first child, 
+   // use it if it is a text node
+-  nsCOMPtr<nsIDOMNode> child;
+-  mDOMNode->GetFirstChild(getter_AddRefs(child));
++  nsIDOMNode* child;
++  mDOMNode->GetFirstChild(&child);
+ 
+   if (child) {
+-    nsCOMPtr<nsIContent> text = do_QueryInterface(child);
++    nsIContent* text = do_QueryInterface(child);
+     if (text && text->IsNodeOfType(nsINode::eTEXT)) {
+       nsAutoString txtValue;
+       rv = AppendFlatStringFromContentNode(text, &txtValue);
+@@ -541,9 +541,9 @@ nsHTMLSelectOptionAccessible::GetAttribu
+   nsresult rv = nsHyperTextAccessibleWrap::GetAttributesInternal(aAttributes);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+-  nsCOMPtr<nsIDOMNode> parentNode;
+-  mDOMNode->GetParentNode(getter_AddRefs(parentNode));
+-  nsCOMPtr<nsIDOMElement> parentElement(do_QueryInterface(parentNode));
++  nsIDOMNode* parentNode;
++  mDOMNode->GetParentNode(&parentNode);
++  nsIDOMElement* parentElement(do_QueryInterface(parentNode));
+   NS_ENSURE_TRUE(parentElement, NS_ERROR_FAILURE);
+   nsAutoString parentTagName;
+   parentNode->GetLocalName(parentTagName);
+@@ -555,14 +555,14 @@ nsHTMLSelectOptionAccessible::GetAttribu
+ 
+   nsAutoString tagName;
+   mDOMNode->GetLocalName(tagName);  // Will be looking for similar DOM siblings
+-  nsCOMPtr<nsIDOMNodeList> siblings;
+-  parentElement->GetElementsByTagName(tagName, getter_AddRefs(siblings));
++  nsIDOMNodeList* siblings;
++  parentElement->GetElementsByTagName(tagName, &siblings);
+   PRInt32 posInSet = 0;
+   PRUint32 setSize = 0;
+   if (siblings) {
+     siblings->GetLength(&setSize);
+-    nsCOMPtr<nsIDOMNode> itemNode;
+-    while (NS_SUCCEEDED(siblings->Item(posInSet ++, getter_AddRefs(itemNode))) &&
++    nsIDOMNode* itemNode;
++    while (NS_SUCCEEDED(siblings->Item(posInSet ++, &itemNode)) &&
+            itemNode != mDOMNode) {
+       // Keep looping, to increment posInSet
+     }
+@@ -576,9 +576,9 @@ nsIFrame* nsHTMLSelectOptionAccessible::
+ nsIFrame* nsHTMLSelectOptionAccessible::GetBoundsFrame()
+ {
+   PRUint32 state;
+-  nsCOMPtr<nsIContent> content = GetSelectState(&state);
++  nsIContent* content = GetSelectState(&state);
+   if (state & nsIAccessibleStates::STATE_COLLAPSED) {
+-    nsCOMPtr<nsIPresShell> presShell(GetPresShell());
++    nsIPresShell* presShell(GetPresShell());
+     if (!presShell) {
+       return nsnull;
+     }
+@@ -607,13 +607,13 @@ nsHTMLSelectOptionAccessible::GetState(P
+   }
+ 
+   PRUint32 selectState, selectExtState;
+-  nsCOMPtr<nsIContent> selectContent = GetSelectState(&selectState,
++  nsIContent* selectContent = GetSelectState(&selectState,
+                                                       &selectExtState);
+   if (selectState & nsIAccessibleStates::STATE_INVISIBLE) {
+     return NS_OK;
+   }
+ 
+-  nsCOMPtr<nsIDOMNode> selectNode = do_QueryInterface(selectContent); 
++  nsIDOMNode* selectNode = do_QueryInterface(selectContent); 
+   NS_ENSURE_TRUE(selectNode, NS_ERROR_FAILURE);
+ 
+   // Is disabled?
+@@ -624,7 +624,7 @@ nsHTMLSelectOptionAccessible::GetState(P
+ 
+   // Are we selected?
+   PRBool isSelected = PR_FALSE;
+-  nsCOMPtr<nsIDOMHTMLOptionElement> option (do_QueryInterface(mDOMNode));
++  nsIDOMHTMLOptionElement* option (do_QueryInterface(mDOMNode));
+   if (option) {
+     option->GetSelected(&isSelected);
+     if ( isSelected ) 
+@@ -654,7 +654,7 @@ nsHTMLSelectOptionAccessible::GetState(P
+     // visibility implementation unless they get reimplemented in layout
+     *aState &= ~nsIAccessibleStates::STATE_OFFSCREEN;
+     // <select> is not collapsed: compare bounds to calculate STATE_OFFSCREEN
+-    nsCOMPtr<nsIAccessible> listAccessible = GetParent();
++    nsIAccessible* listAccessible = GetParent();
+     if (listAccessible) {
+       PRInt32 optionX, optionY, optionWidth, optionHeight;
+       PRInt32 listX, listY, listWidth, listHeight;
+@@ -688,17 +688,17 @@ NS_IMETHODIMP nsHTMLSelectOptionAccessib
+ NS_IMETHODIMP nsHTMLSelectOptionAccessible::DoAction(PRUint8 index)
+ {
+   if (index == eAction_Select) {   // default action
+-    nsCOMPtr<nsIDOMHTMLOptionElement> newHTMLOption(do_QueryInterface(mDOMNode));
++    nsIDOMHTMLOptionElement* newHTMLOption(do_QueryInterface(mDOMNode));
+     if (!newHTMLOption) 
+       return NS_ERROR_FAILURE;
+     // Clear old selection
+-    nsCOMPtr<nsIDOMNode> oldHTMLOptionNode, selectNode;
+-    nsCOMPtr<nsIAccessible> parent(GetParent());
+-    nsCOMPtr<nsIAccessNode> accessNode(do_QueryInterface(parent));
++    nsIDOMNode* oldHTMLOptionNode, *selectNode;
++    nsIAccessible* parent(GetParent());
++    nsIAccessNode* accessNode(do_QueryInterface(parent));
+     NS_ASSERTION(accessNode, "Unable to QI to nsIAccessNode");
+-    accessNode->GetDOMNode(getter_AddRefs(selectNode));
+-    GetFocusedOptionNode(selectNode, getter_AddRefs(oldHTMLOptionNode));
+-    nsCOMPtr<nsIDOMHTMLOptionElement> oldHTMLOption(do_QueryInterface(oldHTMLOptionNode));
++    accessNode->GetDOMNode(&selectNode);
++    GetFocusedOptionNode(selectNode, &oldHTMLOptionNode);
++    nsIDOMHTMLOptionElement* oldHTMLOption(do_QueryInterface(oldHTMLOptionNode));
+     if (oldHTMLOption)
+       oldHTMLOption->SetSelected(PR_FALSE);
+     // Set new selection
+@@ -706,19 +706,19 @@ NS_IMETHODIMP nsHTMLSelectOptionAccessib
+ 
+     // If combo box, and open, close it
+     // First, get the <select> widgets list control frame
+-    nsCOMPtr<nsIDOMNode> testSelectNode;
+-    nsCOMPtr<nsIDOMNode> thisNode(do_QueryInterface(mDOMNode));
++    nsIDOMNode* testSelectNode;
++    nsIDOMNode* thisNode(do_QueryInterface(mDOMNode));
+     do {
+-      thisNode->GetParentNode(getter_AddRefs(testSelectNode));
+-      nsCOMPtr<nsIDOMHTMLSelectElement> selectControl(do_QueryInterface(testSelectNode));
++      thisNode->GetParentNode(&testSelectNode);
++      nsIDOMHTMLSelectElement* selectControl(do_QueryInterface(testSelectNode));
+       if (selectControl)
+         break;
+       thisNode = testSelectNode;
+     } while (testSelectNode);
+ 
+-    nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
+-    nsCOMPtr<nsIContent> selectContent(do_QueryInterface(testSelectNode));
+-    nsCOMPtr<nsIDOMHTMLOptionElement> option(do_QueryInterface(mDOMNode));
++    nsIPresShell* presShell(do_QueryReferent(mWeakShell));
++    nsIContent* selectContent(do_QueryInterface(testSelectNode));
++    nsIDOMHTMLOptionElement* option(do_QueryInterface(mDOMNode));
+ 
+     if (!testSelectNode || !selectContent || !presShell || !option) 
+       return NS_ERROR_FAILURE;
+@@ -756,8 +756,8 @@ nsresult nsHTMLSelectOptionAccessible::G
+   *aFocusedOptionNode = nsnull;
+   NS_ASSERTION(aListNode, "Called GetFocusedOptionNode without a valid list node");
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(aListNode));
+-  nsCOMPtr<nsIDocument> document = content->GetDocument();
++  nsIContent* content(do_QueryInterface(aListNode));
++  nsIDocument* document = content->GetDocument();
+   nsIPresShell *shell = nsnull;
+   if (document)
+     shell = document->GetPrimaryShell();
+@@ -771,11 +771,11 @@ nsresult nsHTMLSelectOptionAccessible::G
+   PRInt32 focusedOptionIndex = 0;
+ 
+   // Get options
+-  nsCOMPtr<nsIDOMHTMLSelectElement> selectElement(do_QueryInterface(aListNode));
++  nsIDOMHTMLSelectElement* selectElement(do_QueryInterface(aListNode));
+   NS_ASSERTION(selectElement, "No select element where it should be");
+ 
+-  nsCOMPtr<nsIDOMHTMLOptionsCollection> options;
+-  nsresult rv = selectElement->GetOptions(getter_AddRefs(options));
++  nsIDOMHTMLOptionsCollection* options;
++  nsresult rv = selectElement->GetOptions(&options);
+   
+   if (NS_SUCCEEDED(rv)) {
+     nsIListControlFrame *listFrame = nsnull;
+@@ -806,19 +806,19 @@ void nsHTMLSelectOptionAccessible::Selec
+     return;
+   }
+ 
+-  nsCOMPtr<nsIDOMNode> optionNode(do_QueryInterface(aPossibleOption));
++  nsIDOMNode* optionNode(do_QueryInterface(aPossibleOption));
+   NS_ASSERTION(optionNode, "No option node for nsIContent with option tag!");
+ 
+-  nsCOMPtr<nsIAccessible> multiSelect = GetMultiSelectFor(optionNode);
+-  nsCOMPtr<nsPIAccessible> privateMultiSelect = do_QueryInterface(multiSelect);
++  nsIAccessible* multiSelect = GetMultiSelectFor(optionNode);
++  nsPIAccessible* privateMultiSelect = do_QueryInterface(multiSelect);
+   if (!privateMultiSelect) {
+     return;
+   }
+ 
+-  nsCOMPtr<nsIAccessibilityService> accService = 
++  nsIAccessibilityService* accService = 
+     do_GetService("@mozilla.org/accessibilityService;1");
+-  nsCOMPtr<nsIAccessible> optionAccessible;
+-  accService->GetAccessibleFor(optionNode, getter_AddRefs(optionAccessible));
++  nsIAccessible* optionAccessible;
++  accService->GetAccessibleFor(optionNode, &optionAccessible);
+   if (!optionAccessible) {
+     return;
+   }
+@@ -841,17 +841,17 @@ nsIContent* nsHTMLSelectOptionAccessible
+ nsIContent* nsHTMLSelectOptionAccessible::GetSelectState(PRUint32* aState,
+                                                          PRUint32* aExtraState)
+ {
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   while (content && content->Tag() != nsAccessibilityAtoms::select) {
+     content = content->GetParent();
+   }
+ 
+-  nsCOMPtr<nsIDOMNode> selectNode(do_QueryInterface(content));
++  nsIDOMNode* selectNode(do_QueryInterface(content));
+   if (selectNode) {
+-    nsCOMPtr<nsIAccessibilityService> accService = GetAccService();
++    nsIAccessibilityService* accService = GetAccService();
+     if (accService) {
+-      nsCOMPtr<nsIAccessible> selAcc;
+-      accService->GetAccessibleFor(selectNode, getter_AddRefs(selAcc));
++      nsIAccessible* selAcc;
++      accService->GetAccessibleFor(selectNode, &selAcc);
+       if (selAcc) {
+         selAcc->GetFinalState(aState, aExtraState);
+         return content;
+@@ -1067,18 +1067,18 @@ NS_IMETHODIMP nsHTMLComboboxAccessible::
+     return NS_OK;
+   }
+   // Use description of currently focused option
+-  nsCOMPtr<nsIAccessible> optionAccessible = GetFocusedOptionAccessible();
++  nsIAccessible* optionAccessible = GetFocusedOptionAccessible();
+   return optionAccessible ? optionAccessible->GetDescription(aDescription) : NS_OK;
+ }
+ 
+-already_AddRefed<nsIAccessible>
++nsIAccessible*
+ nsHTMLComboboxAccessible::GetFocusedOptionAccessible()
+ {
+   if (!mWeakShell) {
+     return nsnull;  // Shut down
+   }
+-  nsCOMPtr<nsIDOMNode> focusedOptionNode;
+-  nsHTMLSelectOptionAccessible::GetFocusedOptionNode(mDOMNode, getter_AddRefs(focusedOptionNode));
++  nsIDOMNode* focusedOptionNode;
++  nsHTMLSelectOptionAccessible::GetFocusedOptionNode(mDOMNode, &focusedOptionNode);
+   nsIAccessibilityService *accService = GetAccService();
+   if (!focusedOptionNode || !accService) {
+     return nsnull;
+@@ -1098,7 +1098,7 @@ NS_IMETHODIMP nsHTMLComboboxAccessible::
+ NS_IMETHODIMP nsHTMLComboboxAccessible::GetValue(nsAString& aValue)
+ {
+   // Use label of currently focused option
+-  nsCOMPtr<nsIAccessible> optionAccessible = GetFocusedOptionAccessible();
++  nsIAccessible* optionAccessible = GetFocusedOptionAccessible();
+   NS_ENSURE_TRUE(optionAccessible, NS_ERROR_FAILURE);
+   return optionAccessible->GetName(aValue);
+ }
+@@ -1446,8 +1446,8 @@ void nsHTMLComboboxListAccessible::GetBo
+ {
+   *aBoundingFrame = nsnull;
+ 
+-  nsCOMPtr<nsIAccessible> comboAccessible;
+-  GetParent(getter_AddRefs(comboAccessible));
++  nsIAccessible* comboAccessible;
++  GetParent(&comboAccessible);
+   if (!comboAccessible) {
+     return;
+   }
+@@ -1456,16 +1456,16 @@ void nsHTMLComboboxListAccessible::GetBo
+     return;
+   }
+    // get our first option
+-  nsCOMPtr<nsIDOMNode> child;
+-  mDOMNode->GetFirstChild(getter_AddRefs(child));
++  nsIDOMNode* child;
++  mDOMNode->GetFirstChild(&child);
+ 
+   // now get its frame
+-  nsCOMPtr<nsIPresShell> shell = GetPresShell();
++  nsIPresShell* shell = GetPresShell();
+   if (!shell) {
+     return;
+   }
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(child));
++  nsIContent* content(do_QueryInterface(child));
+   if (!content) {
+     return;
+   }
+diff --git a/accessible/src/html/nsHTMLSelectAccessible.h b/accessible/src/html/nsHTMLSelectAccessible.h
+--- a/accessible/src/html/nsHTMLSelectAccessible.h
++++ b/accessible/src/html/nsHTMLSelectAccessible.h
+@@ -133,12 +133,12 @@ public:
+   void CacheChildren();
+ 
+ protected:
+-  already_AddRefed<nsIAccessible>
++  nsIAccessible*
+     AccessibleForOption(nsIAccessibilityService *aAccService,
+                         nsIContent *aContent,
+                         nsIAccessible *aLastGoodAccessible,
+                         PRInt32 *aChildCount);
+-  already_AddRefed<nsIAccessible>
++  nsIAccessible*
+     CacheOptSiblings(nsIAccessibilityService *aAccService,
+                      nsIContent *aParentContent,
+                      nsIAccessible *aLastGoodAccessible,
+@@ -229,7 +229,7 @@ public:
+   NS_IMETHOD Shutdown();
+ 
+ protected:
+-  already_AddRefed<nsIAccessible> GetFocusedOptionAccessible();
++  nsIAccessible* GetFocusedOptionAccessible();
+ 
+ private:
+   nsRefPtr<nsHTMLComboboxListAccessible> mListAccessible;
+diff --git a/accessible/src/html/nsHTMLTableAccessible.cpp b/accessible/src/html/nsHTMLTableAccessible.cpp
+--- a/accessible/src/html/nsHTMLTableAccessible.cpp
++++ b/accessible/src/html/nsHTMLTableAccessible.cpp
+@@ -103,24 +103,24 @@ void nsHTMLTableAccessible::CacheChildre
+   
+   if (mAccChildCount == eChildCountUninitialized) {
+     nsAccessible::CacheChildren();
+-    nsCOMPtr<nsIAccessible> captionAccessible;
++    nsIAccessible* captionAccessible;
+     while (NextChild(captionAccessible)) {
+       if (Role(captionAccessible) == nsIAccessibleRole::ROLE_CAPTION) {
+-        nsCOMPtr<nsIAccessible> captionParentAccessible;
+-        captionAccessible->GetParent(getter_AddRefs(captionParentAccessible));
++        nsIAccessible* captionParentAccessible;
++        captionAccessible->GetParent(&captionParentAccessible);
+         if (captionParentAccessible != this) {
+           NS_WARNING("Should not happen: parser ensures caption is the table's child, not the tbody's");
+           return;
+         }
+-        nsCOMPtr<nsIAccessible> beforeCaptionAccessible;
+-        captionAccessible->GetPreviousSibling(getter_AddRefs(beforeCaptionAccessible));
++        nsIAccessible* beforeCaptionAccessible;
++        captionAccessible->GetPreviousSibling(&beforeCaptionAccessible);
+         if (beforeCaptionAccessible) {
+           // Move caption accessible so that it's the first child
+-          nsCOMPtr<nsIAccessible> afterCaptionAccessible;
+-          captionAccessible->GetNextSibling(getter_AddRefs(afterCaptionAccessible));
+-          nsCOMPtr<nsPIAccessible> privateAcc = do_QueryInterface(beforeCaptionAccessible);
++          nsIAccessible* afterCaptionAccessible;
++          captionAccessible->GetNextSibling(&afterCaptionAccessible);
++          nsPIAccessible* privateAcc = do_QueryInterface(beforeCaptionAccessible);
+           privateAcc->SetNextSibling(afterCaptionAccessible);
+-          GetFirstChild(getter_AddRefs(afterCaptionAccessible));
++          GetFirstChild(&afterCaptionAccessible);
+           SetFirstChild(captionAccessible);
+           privateAcc = do_QueryInterface(captionAccessible);
+           privateAcc->SetNextSibling(afterCaptionAccessible);        
+@@ -159,7 +159,7 @@ NS_IMETHODIMP nsHTMLTableAccessible::Get
+ 
+   nsAccessible::GetName(aName);
+   if (aName.IsEmpty()) {
+-    nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++    nsIContent* content(do_QueryInterface(mDOMNode));
+     if (content) { 
+       content->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::summary, aName);
+     }
+@@ -217,8 +217,8 @@ NS_IMETHODIMP
+ NS_IMETHODIMP
+ nsHTMLTableAccessible::GetCaption(nsIAccessible **aCaption)
+ {
+-  nsCOMPtr<nsIAccessible> firstChild;
+-  GetFirstChild(getter_AddRefs(firstChild));
++  nsIAccessible* firstChild;
++  GetFirstChild(&firstChild);
+   if (firstChild && Role(firstChild) == nsIAccessibleRole::ROLE_CAPTION) {
+     *aCaption = firstChild;
+   }
+@@ -228,7 +228,7 @@ NS_IMETHODIMP
+ NS_IMETHODIMP
+ nsHTMLTableAccessible::GetSummary(nsAString &aSummary)
+ {
+-  nsCOMPtr<nsIDOMHTMLTableElement> table(do_QueryInterface(mDOMNode));
++  nsIDOMHTMLTableElement* table(do_QueryInterface(mDOMNode));
+   NS_ENSURE_TRUE(table, NS_ERROR_FAILURE);
+ 
+   return table->GetSummary(aSummary);
+@@ -250,36 +250,36 @@ nsHTMLTableAccessible::GetColumnHeader(n
+ {
+   nsresult rv = NS_OK;
+ 
+-  nsCOMPtr<nsIDOMHTMLTableElement> table(do_QueryInterface(mDOMNode));
++  nsIDOMHTMLTableElement* table(do_QueryInterface(mDOMNode));
+   NS_ENSURE_TRUE(table, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIDOMHTMLTableSectionElement> section;
+-  rv = table->GetTHead(getter_AddRefs(section));
+-  NS_ENSURE_SUCCESS(rv, rv);
+-
+-  nsCOMPtr<nsIAccessibilityService>
++  nsIDOMHTMLTableSectionElement* section;
++  rv = table->GetTHead(&section);
++  NS_ENSURE_SUCCESS(rv, rv);
++
++  nsIAccessibilityService*
+     accService(do_GetService("@mozilla.org/accessibilityService;1"));
+   NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIAccessible> accHead;
+-  nsCOMPtr<nsIDOMNode> sectionNode(do_QueryInterface(section));
++  nsIAccessible* accHead;
++  nsIDOMNode* sectionNode(do_QueryInterface(section));
+   if (sectionNode) {
+     rv = accService->GetCachedAccessible(sectionNode, mWeakShell,
+-                                         getter_AddRefs(accHead));
++                                         &accHead);
+     NS_ENSURE_SUCCESS(rv, rv);
+   }
+ 
+   if (!accHead) {
+      accService->CreateHTMLTableHeadAccessible(section,
+-                                               getter_AddRefs(accHead));
++                                               &accHead);
+                                                    
+-    nsCOMPtr<nsPIAccessNode> accessNode(do_QueryInterface(accHead));
++    nsPIAccessNode* accessNode(do_QueryInterface(accHead));
+     NS_ENSURE_TRUE(accHead, NS_ERROR_FAILURE);
+     rv = accessNode->Init();
+     NS_ENSURE_SUCCESS(rv, rv);
+   }
+ 
+-  nsCOMPtr<nsIAccessibleTable> accTableHead(do_QueryInterface(accHead));
++  nsIAccessibleTable* accTableHead(do_QueryInterface(accHead));
+   NS_ENSURE_TRUE(accTableHead, NS_ERROR_FAILURE);
+ 
+   *aColumnHeader = accTableHead;
+@@ -523,11 +523,11 @@ nsHTMLTableAccessible::CellRefAt(PRInt32
+ {
+   nsresult rv = NS_OK;
+ 
+-  nsCOMPtr<nsIDOMElement> cellElement;
+-  rv = GetCellAt(aRow, aColumn, *getter_AddRefs(cellElement));
+-  NS_ENSURE_SUCCESS(rv, rv);
+-
+-  nsCOMPtr<nsIAccessibilityService>
++  nsIDOMElement* cellElement;
++  rv = GetCellAt(aRow, aColumn, *&cellElement);
++  NS_ENSURE_SUCCESS(rv, rv);
++
++  nsIAccessibilityService*
+     accService(do_GetService("@mozilla.org/accessibilityService;1"));
+   NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
+ 
+@@ -542,12 +542,12 @@ nsHTMLTableAccessible::GetIndexAt(PRInt3
+   NS_ENSURE_ARG_POINTER(aIndex);
+ 
+   nsresult rv = NS_OK;
+-  nsCOMPtr<nsIDOMElement> domElement;
+-  rv = GetCellAt(aRow, aColumn, *getter_AddRefs(domElement));
+-  NS_ENSURE_SUCCESS(rv, rv);
+-
+-  nsCOMPtr<nsIAccessible> accessible;
+-  GetAccService()->GetCachedAccessible(domElement, mWeakShell, getter_AddRefs(accessible));
++  nsIDOMElement* domElement;
++  rv = GetCellAt(aRow, aColumn, *&domElement);
++  NS_ENSURE_SUCCESS(rv, rv);
++
++  nsIAccessible* accessible;
++  GetAccService()->GetCachedAccessible(domElement, mWeakShell, &accessible);
+   if (accessible) {
+     rv = accessible->GetIndexInParent(aIndex);
+   } else {
+@@ -562,11 +562,11 @@ nsHTMLTableAccessible::GetColumnAtIndex(
+ {
+   NS_ENSURE_ARG_POINTER(aColumn);
+ 
+-  nsCOMPtr<nsIAccessible> child;
+-  GetChildAt(aIndex, getter_AddRefs(child));
+-  nsCOMPtr<nsPIAccessNode> childNode(do_QueryInterface(child));
++  nsIAccessible* child;
++  GetChildAt(aIndex, &child);
++  nsPIAccessNode* childNode(do_QueryInterface(child));
+   nsIFrame* frame = childNode->GetFrame();
+-  nsCOMPtr<nsITableCellLayout> cellLayout(do_QueryInterface(frame));
++  nsITableCellLayout* cellLayout(do_QueryInterface(frame));
+   NS_ENSURE_TRUE(cellLayout, NS_ERROR_FAILURE);
+   return cellLayout->GetColIndex(*aColumn);
+ }
+@@ -576,11 +576,11 @@ nsHTMLTableAccessible::GetRowAtIndex(PRI
+ {
+   NS_ENSURE_ARG_POINTER(aRow);
+ 
+-  nsCOMPtr<nsIAccessible> child;
+-  GetChildAt(aIndex, getter_AddRefs(child));
+-  nsCOMPtr<nsPIAccessNode> childNode(do_QueryInterface(child));
++  nsIAccessible* child;
++  GetChildAt(aIndex, &child);
++  nsPIAccessNode* childNode(do_QueryInterface(child));
+   nsIFrame* frame = childNode->GetFrame();
+-  nsCOMPtr<nsITableCellLayout> cellLayout(do_QueryInterface(frame));
++  nsITableCellLayout* cellLayout(do_QueryInterface(frame));
+   NS_ENSURE_TRUE(cellLayout, NS_ERROR_FAILURE);
+   return cellLayout->GetRowIndex(*aRow);
+ }
+@@ -591,11 +591,11 @@ nsHTMLTableAccessible::GetColumnExtentAt
+ {
+   nsresult rv = NS_OK;
+ 
+-  nsCOMPtr<nsIDOMElement> domElement;
+-  rv = GetCellAt(aRow, aColumn, *getter_AddRefs(domElement));
+-  NS_ENSURE_SUCCESS(rv, rv);
+-
+-  nsCOMPtr<nsIDOMHTMLTableCellElement> cell(do_QueryInterface(domElement));
++  nsIDOMElement* domElement;
++  rv = GetCellAt(aRow, aColumn, *&domElement);
++  NS_ENSURE_SUCCESS(rv, rv);
++
++  nsIDOMHTMLTableCellElement* cell(do_QueryInterface(domElement));
+   NS_ENSURE_TRUE(cell, NS_ERROR_FAILURE);
+ 
+   return cell->GetColSpan(_retval);
+@@ -607,11 +607,11 @@ nsHTMLTableAccessible::GetRowExtentAt(PR
+ {
+   nsresult rv = NS_OK;
+ 
+-  nsCOMPtr<nsIDOMElement> domElement;
+-  rv = GetCellAt(aRow, aColumn, *getter_AddRefs(domElement));
+-  NS_ENSURE_SUCCESS(rv, rv);
+-
+-  nsCOMPtr<nsIDOMHTMLTableCellElement> cell(do_QueryInterface(domElement));
++  nsIDOMElement* domElement;
++  rv = GetCellAt(aRow, aColumn, *&domElement);
++  NS_ENSURE_SUCCESS(rv, rv);
++
++  nsIDOMHTMLTableCellElement* cell(do_QueryInterface(domElement));
+   NS_ENSURE_TRUE(cell, NS_ERROR_FAILURE);
+ 
+   return cell->GetRowSpan(_retval);
+@@ -681,12 +681,12 @@ nsHTMLTableAccessible::IsCellSelected(PR
+   nsresult rv = GetTableLayout(&tableLayout);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+-  nsCOMPtr<nsIDOMElement> domElement;
++  nsIDOMElement* domElement;
+   PRInt32 startRowIndex = 0, startColIndex = 0,
+           rowSpan, colSpan, actualRowSpan, actualColSpan;
+ 
+   return tableLayout->GetCellDataAt(aRow, aColumn,
+-                                    *getter_AddRefs(domElement),
++                                    *&domElement,
+                                     startRowIndex, startColIndex, rowSpan,
+                                     colSpan, actualRowSpan, actualColSpan,
+                                     *_retval);
+@@ -726,20 +726,20 @@ nsHTMLTableAccessible::SelectRowOrColumn
+ {
+   PRBool doSelectRow = (aTarget == nsISelectionPrivate::TABLESELECTION_ROW);
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   if (!content)
+     return NS_OK;
+ 
+-  nsCOMPtr<nsIDocument> document = content->GetCurrentDoc();
++  nsIDocument* document = content->GetCurrentDoc();
+   NS_ENSURE_STATE(document);
+ 
+-  nsCOMPtr<nsISelectionController> selController(
++  nsISelectionController* selController(
+     do_QueryInterface(document->GetPrimaryShell()));
+   NS_ENSURE_STATE(selController);
+ 
+-  nsCOMPtr<nsISelection> selection;
++  nsISelection* selection;
+   selController->GetSelection(nsISelectionController::SELECTION_NORMAL,
+-                              getter_AddRefs(selection));
++                              &selection);
+   NS_ENSURE_STATE(selection);
+ 
+   PRInt32 count = 0;
+@@ -747,11 +747,11 @@ nsHTMLTableAccessible::SelectRowOrColumn
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+   for (PRInt32 index = 0; index < count; index++) {
+-    nsCOMPtr<nsIDOMElement> cellElm;
++    nsIDOMElement* cellElm;
+     PRInt32 column = doSelectRow ? index : aIndex;
+     PRInt32 row = doSelectRow ? aIndex : index;
+ 
+-    rv = GetCellAt(row, column, *getter_AddRefs(cellElm));
++    rv = GetCellAt(row, column, *&cellElm);
+     NS_ENSURE_SUCCESS(rv, rv);
+ 
+     rv = SelectCell(selection, document, cellElm, aDoSelect);
+@@ -768,32 +768,32 @@ nsHTMLTableAccessible::SelectCell(nsISel
+                                   PRBool aDoSelect)
+ {
+   if (aDoSelect) {
+-    nsCOMPtr<nsIDOMDocumentRange> documentRange(do_QueryInterface(aDocument));
++    nsIDOMDocumentRange* documentRange(do_QueryInterface(aDocument));
+     NS_ENSURE_STATE(documentRange);
+ 
+-    nsCOMPtr<nsIDOMRange> range;
+-    documentRange->CreateRange(getter_AddRefs(range));
+-
+-    nsCOMPtr<nsIDOMNode> cellNode(do_QueryInterface(aCellElement));
++    nsIDOMRange* range;
++    documentRange->CreateRange(&range);
++
++    nsIDOMNode* cellNode(do_QueryInterface(aCellElement));
+     NS_ENSURE_STATE(cellNode);
+ 
+     range->SelectNode(cellNode);
+     return aSelection->AddRange(range);
+   }
+ 
+-  nsCOMPtr<nsIContent> cell(do_QueryInterface(aCellElement));
++  nsIContent* cell(do_QueryInterface(aCellElement));
+   NS_ENSURE_STATE(cell);
+ 
+-  nsCOMPtr<nsIContent> cellParent = cell->GetParent();
++  nsIContent* cellParent = cell->GetParent();
+   NS_ENSURE_STATE(cellParent);
+ 
+   PRInt32 offset = cellParent->IndexOf(cell);
+   NS_ENSURE_STATE(offset != -1);
+ 
+-  nsCOMPtr<nsIDOMNode> parent(do_QueryInterface(cellParent));
++  nsIDOMNode* parent(do_QueryInterface(cellParent));
+   NS_ENSURE_STATE(parent);
+ 
+-  nsCOMPtr<nsISelection2> selection2(do_QueryInterface(aSelection));
++  nsISelection2* selection2(do_QueryInterface(aSelection));
+   NS_ENSURE_STATE(selection2);
+ 
+   nsCOMArray<nsIDOMRange> ranges;
+@@ -813,16 +813,16 @@ nsHTMLTableAccessible::GetTableNode(nsID
+ {
+   nsresult rv = NS_OK;
+ 
+-  nsCOMPtr<nsIDOMHTMLTableElement> table(do_QueryInterface(mDOMNode));
++  nsIDOMHTMLTableElement* table(do_QueryInterface(mDOMNode));
+   if (table) {
+     *_retval = table;
+     return rv;
+   }
+ 
+-  nsCOMPtr<nsIDOMHTMLTableSectionElement> section(do_QueryInterface(mDOMNode));
++  nsIDOMHTMLTableSectionElement* section(do_QueryInterface(mDOMNode));
+   if (section) {
+-    nsCOMPtr<nsIDOMNode> parent;
+-    rv = section->GetParentNode(getter_AddRefs(parent));
++    nsIDOMNode* parent;
++    rv = section->GetParentNode(&parent);
+     NS_ENSURE_SUCCESS(rv, rv);
+ 
+     *_retval = parent;
+@@ -839,11 +839,11 @@ nsHTMLTableAccessible::GetTableLayout(ns
+ 
+   nsresult rv = NS_OK;
+ 
+-  nsCOMPtr<nsIDOMNode> tableNode;
+-  rv = GetTableNode(getter_AddRefs(tableNode));
+-  NS_ENSURE_SUCCESS(rv, rv);
+-
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(tableNode));
++  nsIDOMNode* tableNode;
++  rv = GetTableNode(&tableNode);
++  NS_ENSURE_SUCCESS(rv, rv);
++
++  nsIContent* content(do_QueryInterface(tableNode));
+   NS_ENSURE_TRUE(content, NS_ERROR_FAILURE);
+ 
+   nsIPresShell *presShell = content->GetDocument()->GetPrimaryShell();
+@@ -884,13 +884,13 @@ NS_IMETHODIMP nsHTMLTableAccessible::Get
+     return NS_OK;
+   }
+ 
+-  nsCOMPtr<nsIAccessible> captionAccessible;
+-  GetCaption(getter_AddRefs(captionAccessible));
+-  nsCOMPtr<nsIAccessNode> captionAccessNode = do_QueryInterface(captionAccessible);
++  nsIAccessible* captionAccessible;
++  GetCaption(&captionAccessible);
++  nsIAccessNode* captionAccessNode = do_QueryInterface(captionAccessible);
+   if (captionAccessNode) {
+-    nsCOMPtr<nsIDOMNode> captionNode;
+-    captionAccessNode->GetDOMNode(getter_AddRefs(captionNode));
+-    nsCOMPtr<nsIContent> captionContent = do_QueryInterface(captionNode);
++    nsIDOMNode* captionNode;
++    captionAccessNode->GetDOMNode(&captionNode);
++    nsIContent* captionContent = do_QueryInterface(captionNode);
+     if (captionContent) {
+       AppendFlatStringFromSubtree(captionContent, &aDescription);
+     }
+@@ -911,21 +911,21 @@ NS_IMETHODIMP nsHTMLTableAccessible::Get
+ 
+ PRBool nsHTMLTableAccessible::HasDescendant(char *aTagName, PRBool aAllowEmpty)
+ {
+-  nsCOMPtr<nsIDOMElement> tableElt(do_QueryInterface(mDOMNode));
++  nsIDOMElement* tableElt(do_QueryInterface(mDOMNode));
+   NS_ENSURE_TRUE(tableElt, PR_FALSE);
+ 
+-  nsCOMPtr<nsIDOMNodeList> nodeList;
++  nsIDOMNodeList* nodeList;
+   nsAutoString tagName;
+   tagName.AssignWithConversion(aTagName);
+-  tableElt->GetElementsByTagName(tagName, getter_AddRefs(nodeList));
++  tableElt->GetElementsByTagName(tagName, &nodeList);
+   NS_ENSURE_TRUE(nodeList, NS_ERROR_FAILURE);
+   PRUint32 length;
+   nodeList->GetLength(&length);
+   
+   if (length == 1) {
+     // Make sure it's not the table itself
+-    nsCOMPtr<nsIDOMNode> foundItem;
+-    nodeList->Item(0, getter_AddRefs(foundItem));
++    nsIDOMNode* foundItem;
++    nodeList->Item(0, &foundItem);
+     if (foundItem == mDOMNode) {
+       return PR_FALSE;
+     }
+@@ -933,7 +933,7 @@ PRBool nsHTMLTableAccessible::HasDescend
+       // Make sure that the item we found has contents
+       // and either has multiple children or the
+       // found item is not a whitespace-only text node
+-      nsCOMPtr<nsIContent> foundItemContent = do_QueryInterface(foundItem);
++      nsIContent* foundItemContent = do_QueryInterface(foundItem);
+       if (!foundItemContent) {
+         return PR_FALSE;
+       }
+@@ -972,12 +972,12 @@ NS_IMETHODIMP nsHTMLTableAccessible::IsP
+ 
+   *aIsProbablyForLayout = PR_FALSE;
+   
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   if (!content) {
+     return NS_ERROR_FAILURE; // Table shut down
+   }
+ 
+-  nsCOMPtr<nsIAccessible> docAccessible = do_QueryInterface(nsCOMPtr<nsIAccessibleDocument>(GetDocAccessible()));
++  nsIAccessible* docAccessible = do_QueryInterface((nsIAccessibleDocument*)(GetDocAccessible()));
+   if (docAccessible) {
+     PRUint32 state, extState;
+     docAccessible->GetFinalState(&state, &extState);
+@@ -1026,11 +1026,11 @@ NS_IMETHODIMP nsHTMLTableAccessible::IsP
+   // Now we know there are 2-4 columns and 2 or more rows
+   // Check to see if there are visible borders on the cells
+   // XXX currently, we just check the first cell -- do we really need to do more?
+-  nsCOMPtr<nsIDOMElement> cellElement;
+-  GetCellAt(0, 0, *getter_AddRefs(cellElement));
+-  nsCOMPtr<nsIContent> cellContent(do_QueryInterface(cellElement));
++  nsIDOMElement* cellElement;
++  GetCellAt(0, 0, *&cellElement);
++  nsIContent* cellContent(do_QueryInterface(cellElement));
+   NS_ENSURE_TRUE(cellContent, NS_ERROR_FAILURE);
+-  nsCOMPtr<nsIPresShell> shell(GetPresShell());
++  nsIPresShell* shell(GetPresShell());
+   nsIFrame *cellFrame = shell->GetPrimaryFrameFor(cellContent);
+   if (!cellFrame) {
+     return NS_OK;
+@@ -1047,19 +1047,19 @@ NS_IMETHODIMP nsHTMLTableAccessible::IsP
+ 
+   // Check for styled background color across the row
+   // Alternating background color is a common way 
+-  nsCOMPtr<nsIDOMNodeList> nodeList;
+-  nsCOMPtr<nsIDOMElement> tableElt(do_QueryInterface(mDOMNode));    
+-  tableElt->GetElementsByTagName(NS_LITERAL_STRING("tr"), getter_AddRefs(nodeList));
++  nsIDOMNodeList* nodeList;
++  nsIDOMElement* tableElt(do_QueryInterface(mDOMNode));    
++  tableElt->GetElementsByTagName(NS_LITERAL_STRING("tr"), &nodeList);
+   NS_ENSURE_TRUE(nodeList, NS_ERROR_FAILURE);
+   PRUint32 length;
+   nodeList->GetLength(&length);
+   nsAutoString color, lastRowColor;
+   for (PRInt32 rowCount = 0; rowCount < rows; rowCount ++) {
+-    nsCOMPtr<nsIDOMNode> rowNode;
+-    nodeList->Item(rowCount, getter_AddRefs(rowNode));
+-    nsCOMPtr<nsIDOMElement> rowElement = do_QueryInterface(rowNode);
+-    nsCOMPtr<nsIDOMCSSStyleDeclaration> styleDecl;
+-    GetComputedStyleDeclaration(EmptyString(), rowElement, getter_AddRefs(styleDecl));
++    nsIDOMNode* rowNode;
++    nodeList->Item(rowCount, &rowNode);
++    nsIDOMElement* rowElement = do_QueryInterface(rowNode);
++    nsIDOMCSSStyleDeclaration* styleDecl;
++    GetComputedStyleDeclaration(EmptyString(), rowElement, &styleDecl);
+     NS_ENSURE_TRUE(styleDecl, NS_ERROR_FAILURE);
+     lastRowColor = color;
+     styleDecl->GetPropertyValue(NS_LITERAL_STRING("background-color"), color);
+@@ -1084,8 +1084,8 @@ NS_IMETHODIMP nsHTMLTableAccessible::IsP
+     nsIFrame *tableFrame = GetFrame();
+     NS_ENSURE_TRUE(tableFrame , NS_ERROR_FAILURE);
+     nsSize tableSize  = tableFrame->GetSize();
+-    nsCOMPtr<nsIAccessibleDocument> docAccessible = GetDocAccessible();
+-    nsCOMPtr<nsPIAccessNode> docAccessNode(do_QueryInterface(docAccessible));
++    nsIAccessibleDocument* docAccessible = GetDocAccessible();
++    nsPIAccessNode* docAccessNode(do_QueryInterface(docAccessible));
+     NS_ENSURE_TRUE(docAccessNode, NS_ERROR_FAILURE);
+     nsIFrame *docFrame = docAccessNode->GetFrame();
+     NS_ENSURE_TRUE(docFrame , NS_ERROR_FAILURE);
+@@ -1150,11 +1150,11 @@ nsHTMLTableHeadAccessible::GetRows(PRInt
+ {
+   nsresult rv = NS_OK;
+ 
+-  nsCOMPtr<nsIDOMHTMLTableSectionElement> head(do_QueryInterface(mDOMNode));
++  nsIDOMHTMLTableSectionElement* head(do_QueryInterface(mDOMNode));
+   NS_ENSURE_TRUE(head, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIDOMHTMLCollection> rows;
+-  rv = head->GetRows(getter_AddRefs(rows));
++  nsIDOMHTMLCollection* rows;
++  rv = head->GetRows(&rows);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+   return rows->GetLength((PRUint32 *)aRows);
+diff --git a/accessible/src/html/nsHTMLTextAccessible.cpp b/accessible/src/html/nsHTMLTextAccessible.cpp
+--- a/accessible/src/html/nsHTMLTextAccessible.cpp
++++ b/accessible/src/html/nsHTMLTextAccessible.cpp
+@@ -78,8 +78,8 @@ nsHTMLTextAccessible::GetState(PRUint32 
+   nsresult rv = nsTextAccessible::GetState(aState, aExtraState);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+-  nsCOMPtr<nsIAccessible> docAccessible = 
+-    do_QueryInterface(nsCOMPtr<nsIAccessibleDocument>(GetDocAccessible()));
++  nsIAccessible* docAccessible = 
++    do_QueryInterface((nsIAccessibleDocument*)(GetDocAccessible()));
+   if (docAccessible) {
+      PRUint32 state, extState;
+      docAccessible->GetFinalState(&state, &extState);
+@@ -162,7 +162,7 @@ NS_IMETHODIMP nsHTMLLabelAccessible::Get
+ NS_IMETHODIMP nsHTMLLabelAccessible::GetName(nsAString& aReturn)
+ { 
+   nsresult rv = NS_ERROR_FAILURE;
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+ 
+   nsAutoString name;
+   if (content)
+@@ -221,7 +221,7 @@ nsHTMLLIAccessible::nsHTMLLIAccessible(n
+   if (!aBulletText.IsEmpty()) {
+     mBulletAccessible = new nsHTMLListBulletAccessible(mDOMNode, mWeakShell, 
+                                                        aBulletText);
+-    nsCOMPtr<nsPIAccessNode> bulletANode(mBulletAccessible);
++    nsPIAccessNode* bulletANode(mBulletAccessible);
+     if (bulletANode) {
+       bulletANode->Init();
+     }
+diff --git a/accessible/src/html/nsHyperTextAccessible.cpp b/accessible/src/html/nsHyperTextAccessible.cpp
+--- a/accessible/src/html/nsHyperTextAccessible.cpp
++++ b/accessible/src/html/nsHyperTextAccessible.cpp
+@@ -77,7 +77,7 @@ nsresult nsHyperTextAccessible::QueryInt
+ {
+   *aInstancePtr = nsnull;
+ 
+-  nsCOMPtr<nsIDOMXULDocument> xulDoc(do_QueryInterface(mDOMNode));
++  nsIDOMXULDocument* xulDoc(do_QueryInterface(mDOMNode));
+   if (mDOMNode && !xulDoc) {
+     // We need XUL doc check for now because for now nsDocAccessible must
+     // inherit from nsHyperTextAccessible in order for HTML document accessibles
+@@ -105,9 +105,9 @@ nsresult nsHyperTextAccessible::QueryInt
+     if (aIID.Equals(NS_GET_IID(nsIAccessibleHyperText))) {
+       if (role == nsIAccessibleRole::ROLE_ENTRY ||
+           role == nsIAccessibleRole::ROLE_PASSWORD_TEXT) {
+-        nsCOMPtr<nsIEditor> editor;
+-        GetAssociatedEditor(getter_AddRefs(editor));
+-        nsCOMPtr<nsIPlaintextEditor> peditor(do_QueryInterface(editor));
++        nsIEditor* editor;
++        GetAssociatedEditor(&editor);
++        nsIPlaintextEditor* peditor(do_QueryInterface(editor));
+         if (peditor) {
+           return NS_ERROR_NO_INTERFACE; // No embedded objects ever in plain text
+         }
+@@ -132,7 +132,7 @@ nsAccessibleWrap(aNode, aShell)
+ 
+ NS_IMETHODIMP nsHyperTextAccessible::GetRole(PRUint32 *aRole)
+ {
+-  nsCOMPtr<nsIContent> content = do_QueryInterface(mDOMNode);
++  nsIContent* content = do_QueryInterface(mDOMNode);
+   if (!content) {
+     return NS_ERROR_FAILURE;
+   }
+@@ -175,8 +175,8 @@ nsHyperTextAccessible::GetState(PRUint32
+   if (!aExtraState)
+     return NS_OK;
+ 
+-  nsCOMPtr<nsIEditor> editor;
+-  GetAssociatedEditor(getter_AddRefs(editor));
++  nsIEditor* editor;
++  GetAssociatedEditor(&editor);
+   if (editor) {
+     PRUint32 flags;
+     editor->GetFlags(&flags);
+@@ -210,20 +210,20 @@ void nsHyperTextAccessible::CacheChildre
+       nsAccessible::CacheChildren();
+       return;
+     }
+-    nsCOMPtr<nsIEditor> editor;
+-    GetAssociatedEditor(getter_AddRefs(editor));
++    nsIEditor* editor;
++    GetAssociatedEditor(&editor);
+     if (!editor) {
+       nsAccessible::CacheChildren();
+       return;
+     }
+-    nsCOMPtr<nsIDOMElement> editorRoot;
+-    editor->GetRootElement(getter_AddRefs(editorRoot));
+-    nsCOMPtr<nsIDOMNode> editorRootDOMNode = do_QueryInterface(editorRoot);
++    nsIDOMElement* editorRoot;
++    editor->GetRootElement(&editorRoot);
++    nsIDOMNode* editorRootDOMNode = do_QueryInterface(editorRoot);
+     if (!editorRootDOMNode) {
+       return;
+     }
+     nsAccessibleTreeWalker walker(mWeakShell, editorRootDOMNode, PR_TRUE);
+-    nsCOMPtr<nsPIAccessible> privatePrevAccessible;
++    nsPIAccessible* privatePrevAccessible;
+     PRInt32 childCount = 0;
+     walker.GetFirstChild();
+     SetFirstChild(walker.mState.accessible);
+@@ -265,11 +265,11 @@ nsIntRect nsHyperTextAccessible::GetBoun
+                                              &startContentOffsetInFrame, &frame);
+   NS_ENSURE_SUCCESS(rv, screenRect);
+ 
+-  nsCOMPtr<nsIPresShell> shell = GetPresShell();
++  nsIPresShell* shell = GetPresShell();
+   NS_ENSURE_TRUE(shell, screenRect);
+ 
+-  nsCOMPtr<nsIRenderingContext> rc;
+-  shell->CreateRenderingContext(frame, getter_AddRefs(rc));
++  nsIRenderingContext* rc;
++  shell->CreateRenderingContext(frame, &rc);
+   NS_ENSURE_TRUE(rc, screenRect);
+ 
+   const nsStyleFont *font = frame->GetStyleFont();
+@@ -362,7 +362,7 @@ nsHyperTextAccessible::GetPosAndText(PRI
+     *aEndAcc = nsnull;
+ 
+   nsIntRect unionRect;
+-  nsCOMPtr<nsIAccessible> accessible, lastAccessible;
++  nsIAccessible* accessible, *lastAccessible;
+ 
+   gfxSkipChars skipChars;
+   gfxSkipCharsIterator iter;
+@@ -371,7 +371,7 @@ nsHyperTextAccessible::GetPosAndText(PRI
+   // depending on what we need for out parameters
+   while (NextChild(accessible)) {
+     lastAccessible = accessible;
+-    nsCOMPtr<nsPIAccessNode> accessNode(do_QueryInterface(accessible));
++    nsPIAccessNode* accessNode(do_QueryInterface(accessible));
+     nsIFrame *frame = accessNode->GetFrame();
+     if (!frame) {
+       continue;
+@@ -426,7 +426,7 @@ nsHyperTextAccessible::GetPosAndText(PRI
+           aEndOffset = endOffset;
+         }
+         if (aText) {
+-          nsCOMPtr<nsPIAccessible> pAcc(do_QueryInterface(accessible));
++          nsPIAccessible* pAcc(do_QueryInterface(accessible));
+           pAcc->AppendTextTo(*aText, startOffset,
+                              substringEndOffset - startOffset);
+         }
+@@ -514,7 +514,7 @@ NS_IMETHODIMP nsHyperTextAccessible::Get
+     return NS_ERROR_FAILURE;
+   }
+ 
+-  nsCOMPtr<nsIAccessible> accessible;
++  nsIAccessible* accessible;
+ 
+   while (NextChild(accessible)) {
+     PRInt32 textLength = TextLength(accessible);
+@@ -560,7 +560,7 @@ nsresult nsHyperTextAccessible::DOMPoint
+   }
+ 
+   PRUint32 addTextOffset = 0;
+-  nsCOMPtr<nsIDOMNode> findNode;
++  nsIDOMNode* findNode;
+ 
+   unsigned short nodeType;
+   aNode->GetNodeType(&nodeType);
+@@ -571,9 +571,9 @@ nsresult nsHyperTextAccessible::DOMPoint
+     // For text nodes, aNodeOffset comes in as a character offset
+     // Text offset will be added at the end, if we find the offset in this hypertext
+     // We want the "skipped" offset into the text (rendered text without the extra whitespace)
+-    nsCOMPtr<nsIContent> content = do_QueryInterface(aNode);
++    nsIContent* content = do_QueryInterface(aNode);
+     NS_ASSERTION(content, "No nsIContent for dom node");
+-    nsCOMPtr<nsIPresShell> presShell = GetPresShell();
++    nsIPresShell* presShell = GetPresShell();
+     NS_ENSURE_TRUE(presShell, NS_ERROR_FAILURE);
+     nsIFrame *frame = presShell->GetPrimaryFrameFor(content);
+     NS_ENSURE_TRUE(frame, NS_ERROR_FAILURE);
+@@ -584,7 +584,7 @@ nsresult nsHyperTextAccessible::DOMPoint
+   }
+   else {
+     // For non-text nodes, aNodeOffset comes in as a child node index
+-    nsCOMPtr<nsIContent> parentContent(do_QueryInterface(aNode));
++    nsIContent* parentContent(do_QueryInterface(aNode));
+     // Should not happen, but better to protect against crash if doc node is somehow passed in
+     NS_ENSURE_TRUE(parentContent, NS_ERROR_FAILURE);
+     // findNode could be null if aNodeOffset == # of child nodes, which means one of two things:
+@@ -606,15 +606,15 @@ nsresult nsHyperTextAccessible::DOMPoint
+ 
+   // Get accessible for this findNode, or if that node isn't accessible, use the
+   // accessible for the next DOM node which has one (based on forward depth first search)
+-  nsCOMPtr<nsIAccessible> descendantAccessible;
++  nsIAccessible* descendantAccessible;
+   if (findNode) {
+     descendantAccessible = GetFirstAvailableAccessible(findNode);
+   }
+   // From the descendant, go up and get the immediate child of this hypertext
+-  nsCOMPtr<nsIAccessible> childAccessible;
++  nsIAccessible* childAccessible;
+   while (descendantAccessible) {
+-    nsCOMPtr<nsIAccessible> parentAccessible;
+-    descendantAccessible->GetParent(getter_AddRefs(parentAccessible));
++    nsIAccessible* parentAccessible;
++    descendantAccessible->GetParent(&parentAccessible);
+     if (this == parentAccessible) {
+       childAccessible = descendantAccessible;
+       break;
+@@ -644,7 +644,7 @@ nsresult nsHyperTextAccessible::DOMPoint
+   // If childAccessible is null we will end up adding up the entire length of
+   // the hypertext, which is good -- it just means our offset node
+   // came after the last accessible child's node
+-  nsCOMPtr<nsIAccessible> accessible;
++  nsIAccessible* accessible;
+   while (NextChild(accessible) && accessible != childAccessible) {
+     PRInt32 textLength = TextLength(accessible);
+     NS_ENSURE_TRUE(textLength >= 0, nsnull);
+@@ -682,24 +682,24 @@ nsHyperTextAccessible::HypertextOffsetsT
+   NS_ENSURE_ARG_POINTER(aEndOffset);
+   *aEndOffset = -1;
+ 
+-  nsCOMPtr<nsIAccessible> startAcc, endAcc;
++  nsIAccessible* startAcc, *endAcc;
+   PRInt32 startOffset = aStartHTOffset, endOffset = aEndHTOffset;
+   nsIFrame *startFrame = nsnull, *endFrame = nsnull;
+ 
+   startFrame = GetPosAndText(startOffset, endOffset, nsnull, &endFrame, nsnull,
+-                             getter_AddRefs(startAcc), getter_AddRefs(endAcc));
++                             &startAcc, &endAcc);
+   if (!startAcc || !endAcc)
+     return NS_ERROR_FAILURE;
+ 
+-  nsCOMPtr<nsIDOMNode> startNode, endNode;
++  nsIDOMNode* startNode, *endNode;
+   nsresult rv = GetDOMPointByFrameOffset(startFrame, startOffset, startAcc,
+-                                         getter_AddRefs(startNode),
++                                         &startNode,
+                                          &startOffset);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+   if (aStartHTOffset != aEndHTOffset) {
+     rv = GetDOMPointByFrameOffset(endFrame, endOffset, endAcc,
+-                                  getter_AddRefs(endNode), &endOffset);
++                                  &endNode, &endOffset);
+     NS_ENSURE_SUCCESS(rv, rv);
+   } else {
+     endNode = startNode;
+@@ -740,7 +740,7 @@ nsHyperTextAccessible::GetRelativeOffset
+   nsresult rv;
+   PRInt32 contentOffset = aFromOffset;
+   if (IsText(aFromAccessible)) {
+-    nsCOMPtr<nsPIAccessNode> accessNode(do_QueryInterface(aFromAccessible));
++    nsPIAccessNode* accessNode(do_QueryInterface(aFromAccessible));
+     NS_ASSERTION(accessNode, "nsIAccessible doesn't support nsPIAccessNode");
+ 
+     nsIFrame *frame = accessNode->GetFrame();
+@@ -772,12 +772,12 @@ nsHyperTextAccessible::GetRelativeOffset
+ 
+   // Turn the resulting node and offset into a hyperTextOffset
+   PRInt32 hyperTextOffset;
+-  nsCOMPtr<nsIDOMNode> resultNode = do_QueryInterface(pos.mResultContent);
++  nsIDOMNode* resultNode = do_QueryInterface(pos.mResultContent);
+   NS_ENSURE_TRUE(resultNode, -1);
+ 
+-  nsCOMPtr<nsIAccessible> finalAccessible;
++  nsIAccessible* finalAccessible;
+   rv = DOMPointToHypertextOffset(resultNode, pos.mContentOffset, &hyperTextOffset,
+-                                 getter_AddRefs(finalAccessible),
++                                 &finalAccessible,
+                                  aDirection == eDirNext);
+   // If finalAccessible == nsnull, then DOMPointToHypertextOffset() searched through the hypertext
+   // children without finding the node/offset position
+@@ -835,7 +835,7 @@ nsresult nsHyperTextAccessible::GetTextH
+   aText.Truncate();
+   *aStartOffset = *aEndOffset = 0;
+ 
+-  nsCOMPtr<nsIPresShell> presShell = GetPresShell();
++  nsIPresShell* presShell = GetPresShell();
+   if (!presShell) {
+     return NS_ERROR_FAILURE;
+   }
+@@ -849,16 +849,16 @@ nsresult nsHyperTextAccessible::GetTextH
+     ++ endOffset;
+   }
+   // Convert offsets to frame-relative
+-  nsCOMPtr<nsIAccessible> startAcc;
++  nsIAccessible* startAcc;
+   nsIFrame *startFrame = GetPosAndText(startOffset, endOffset, nsnull, nsnull,
+-                                       nsnull, getter_AddRefs(startAcc));
++                                       nsnull, &startAcc);
+ 
+   if (!startFrame) {
+     PRInt32 textLength;
+     GetCharacterCount(&textLength);
+     if (aBoundaryType == BOUNDARY_LINE_START && aOffset > 0 && aOffset == textLength) {
+       // Asking for start of line, while on last character
+-      nsCOMPtr<nsPIAccessNode> startAccessNode = do_QueryInterface(startAcc);
++      nsPIAccessNode* startAccessNode = do_QueryInterface(startAcc);
+       if (startAccessNode) {
+         startFrame = startAccessNode->GetFrame();
+       }
+@@ -944,9 +944,9 @@ nsresult nsHyperTextAccessible::GetTextH
+     // 2 words/lines if the offset occured on whitespace boundary
+     // Careful, startOffset and endOffset are passed by reference to GetPosAndText() and changed
+     startOffset = endOffset = finalStartOffset;
+-    nsCOMPtr<nsIAccessible> endAcc;
++    nsIAccessible* endAcc;
+     nsIFrame *endFrame = GetPosAndText(startOffset, endOffset, nsnull, nsnull,
+-                                       nsnull, getter_AddRefs(endAcc));
++                                       nsnull, &endAcc);
+     if (!endFrame) {
+       return NS_ERROR_FAILURE;
+     }
+@@ -1013,7 +1013,7 @@ NS_IMETHODIMP nsHyperTextAccessible::Get
+     return NS_ERROR_FAILURE;
+   }
+ 
+-  nsCOMPtr<nsIAccessible> accessible;
++  nsIAccessible* accessible;
+   
+   while (NextChild(accessible)) {
+     PRInt32 length = TextLength(accessible);
+@@ -1039,7 +1039,7 @@ nsHyperTextAccessible::GetAttributesInte
+   nsresult rv = nsAccessibleWrap::GetAttributesInternal(aAttributes);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   NS_ENSURE_TRUE(content, NS_ERROR_UNEXPECTED);
+   nsIAtom *tag = content->Tag();
+ 
+@@ -1108,17 +1108,17 @@ NS_IMETHODIMP nsHyperTextAccessible::Get
+ 
+   if (aCoordType == nsIAccessibleCoordinateType::COORDTYPE_WINDOW_RELATIVE) {
+     //co-ord type = window
+-    nsCOMPtr<nsIPresShell> shell = GetPresShell();
++    nsIPresShell* shell = GetPresShell();
+     NS_ENSURE_TRUE(shell, NS_ERROR_FAILURE);
+-    nsCOMPtr<nsIDocument> doc = shell->GetDocument();
+-    nsCOMPtr<nsIDOMDocumentView> docView(do_QueryInterface(doc));
++    nsIDocument* doc = shell->GetDocument();
++    nsIDOMDocumentView* docView(do_QueryInterface(doc));
+     NS_ENSURE_TRUE(docView, NS_ERROR_FAILURE);
+ 
+-    nsCOMPtr<nsIDOMAbstractView> abstractView;
+-    docView->GetDefaultView(getter_AddRefs(abstractView));
++    nsIDOMAbstractView* abstractView;
++    docView->GetDefaultView(&abstractView);
+     NS_ENSURE_TRUE(abstractView, NS_ERROR_FAILURE);
+ 
+-    nsCOMPtr<nsIDOMWindowInternal> windowInter(do_QueryInterface(abstractView));
++    nsIDOMWindowInternal* windowInter(do_QueryInterface(abstractView));
+     NS_ENSURE_TRUE(windowInter, NS_ERROR_FAILURE);
+ 
+     PRInt32 screenX, screenY;
+@@ -1143,7 +1143,7 @@ nsHyperTextAccessible::GetOffsetAtPoint(
+                                         PRUint32 aCoordType, PRInt32 *aOffset)
+ {
+   *aOffset = -1;
+-  nsCOMPtr<nsIPresShell> shell = GetPresShell();
++  nsIPresShell* shell = GetPresShell();
+   if (!shell) {
+     return NS_ERROR_FAILURE;
+   }
+@@ -1154,15 +1154,15 @@ nsHyperTextAccessible::GetOffsetAtPoint(
+   nsIntRect frameScreenRect = hyperFrame->GetScreenRectExternal();
+ 
+   if (aCoordType == nsIAccessibleCoordinateType::COORDTYPE_WINDOW_RELATIVE) {
+-    nsCOMPtr<nsIDocument> doc = shell->GetDocument();
+-    nsCOMPtr<nsIDOMDocumentView> docView(do_QueryInterface(doc));
++    nsIDocument* doc = shell->GetDocument();
++    nsIDOMDocumentView* docView(do_QueryInterface(doc));
+     NS_ENSURE_TRUE(docView, NS_ERROR_FAILURE);
+ 
+-    nsCOMPtr<nsIDOMAbstractView> abstractView;
+-    docView->GetDefaultView(getter_AddRefs(abstractView));
++    nsIDOMAbstractView* abstractView;
++    docView->GetDefaultView(&abstractView);
+     NS_ENSURE_TRUE(abstractView, NS_ERROR_FAILURE);
+ 
+-    nsCOMPtr<nsIDOMWindowInternal> windowInter(do_QueryInterface(abstractView));
++    nsIDOMWindowInternal* windowInter(do_QueryInterface(abstractView));
+     NS_ENSURE_TRUE(windowInter, NS_ERROR_FAILURE);
+ 
+     PRInt32 windowX, windowY;
+@@ -1189,11 +1189,11 @@ nsHyperTextAccessible::GetOffsetAtPoint(
+ 
+   // We have an point in an accessible child of this, now we need to add up the
+   // offsets before it to what we already have
+-  nsCOMPtr<nsIAccessible> accessible;
++  nsIAccessible* accessible;
+   PRInt32 offset = 0;
+ 
+   while (NextChild(accessible)) {
+-    nsCOMPtr<nsPIAccessNode> accessNode(do_QueryInterface(accessible));
++    nsPIAccessNode* accessNode(do_QueryInterface(accessible));
+     nsIFrame *primaryFrame = accessNode->GetFrame();
+     NS_ENSURE_TRUE(primaryFrame, NS_ERROR_FAILURE);
+ 
+@@ -1238,7 +1238,7 @@ NS_IMETHODIMP nsHyperTextAccessible::Get
+     return NS_ERROR_FAILURE;
+   }
+ 
+-  nsCOMPtr<nsIAccessible> accessible;
++  nsIAccessible* accessible;
+ 
+   while (NextChild(accessible)) {
+     if (IsEmbeddedObject(accessible)) {
+@@ -1258,7 +1258,7 @@ NS_IMETHODIMP nsHyperTextAccessible::Get
+ 
+   nsCOMPtr<nsIAccessible> accessible;
+ 
+-  while (NextChild(accessible)) {
++  while (NextChild(*getter_AddRefs(accessible))) {
+     if (IsEmbeddedObject(accessible) && aIndex-- == 0) {
+       CallQueryInterface(accessible, aLink);
+       return NS_OK;
+@@ -1277,7 +1277,7 @@ NS_IMETHODIMP nsHyperTextAccessible::Get
+     return NS_ERROR_FAILURE;
+   }
+ 
+-  nsCOMPtr<nsIAccessible> accessible;
++  nsIAccessible* accessible;
+ 
+   while (NextChild(accessible) && characterCount <= aCharIndex) {
+     PRUint32 role = Role(accessible);
+@@ -1322,9 +1322,9 @@ NS_IMETHODIMP nsHyperTextAccessible::Ins
+ NS_IMETHODIMP nsHyperTextAccessible::InsertText(const nsAString &aText, PRInt32 aPosition)
+ {
+   if (NS_SUCCEEDED(SetCaretOffset(aPosition))) {
+-    nsCOMPtr<nsIEditor> editor;
+-    GetAssociatedEditor(getter_AddRefs(editor));
+-    nsCOMPtr<nsIPlaintextEditor> peditor(do_QueryInterface(editor));
++    nsIEditor* editor;
++    GetAssociatedEditor(&editor);
++    nsIPlaintextEditor* peditor(do_QueryInterface(editor));
+     return peditor ? peditor->InsertText(aText) : NS_ERROR_FAILURE;
+   }
+ 
+@@ -1333,8 +1333,8 @@ NS_IMETHODIMP nsHyperTextAccessible::Ins
+ 
+ NS_IMETHODIMP nsHyperTextAccessible::CopyText(PRInt32 aStartPos, PRInt32 aEndPos)
+ {
+-  nsCOMPtr<nsIEditor> editor;
+-  GetAssociatedEditor(getter_AddRefs(editor));
++  nsIEditor* editor;
++  GetAssociatedEditor(&editor);
+   if (editor && NS_SUCCEEDED(SetSelectionRange(aStartPos, aEndPos)))
+     return editor->Copy();
+ 
+@@ -1343,8 +1343,8 @@ NS_IMETHODIMP nsHyperTextAccessible::Cop
+ 
+ NS_IMETHODIMP nsHyperTextAccessible::CutText(PRInt32 aStartPos, PRInt32 aEndPos)
+ {
+-  nsCOMPtr<nsIEditor> editor;
+-  GetAssociatedEditor(getter_AddRefs(editor));
++  nsIEditor* editor;
++  GetAssociatedEditor(&editor);
+   if (editor && NS_SUCCEEDED(SetSelectionRange(aStartPos, aEndPos)))
+     return editor->Cut();
+ 
+@@ -1353,8 +1353,8 @@ NS_IMETHODIMP nsHyperTextAccessible::Cut
+ 
+ NS_IMETHODIMP nsHyperTextAccessible::DeleteText(PRInt32 aStartPos, PRInt32 aEndPos)
+ {
+-  nsCOMPtr<nsIEditor> editor;
+-  GetAssociatedEditor(getter_AddRefs(editor));
++  nsIEditor* editor;
++  GetAssociatedEditor(&editor);
+   if (editor && NS_SUCCEEDED(SetSelectionRange(aStartPos, aEndPos)))
+     return editor->DeleteSelection(nsIEditor::eNone);
+ 
+@@ -1363,8 +1363,8 @@ NS_IMETHODIMP nsHyperTextAccessible::Del
+ 
+ NS_IMETHODIMP nsHyperTextAccessible::PasteText(PRInt32 aPosition)
+ {
+-  nsCOMPtr<nsIEditor> editor;
+-  GetAssociatedEditor(getter_AddRefs(editor));
++  nsIEditor* editor;
++  GetAssociatedEditor(&editor);
+   if (editor && NS_SUCCEEDED(SetCaretOffset(aPosition)))
+     return editor->Paste(nsIClipboard::kGlobalClipboard);
+ 
+@@ -1377,16 +1377,16 @@ nsHyperTextAccessible::GetAssociatedEdit
+   NS_ENSURE_ARG_POINTER(aEditor);
+ 
+   *aEditor = nsnull;
+-  nsCOMPtr<nsIContent> content = do_QueryInterface(mDOMNode);
++  nsIContent* content = do_QueryInterface(mDOMNode);
+   NS_ENSURE_TRUE(content, NS_ERROR_FAILURE);
+ 
+   if (!content->HasFlag(NODE_IS_EDITABLE)) {
+     // If we're inside an editable container, then return that container's editor
+-    nsCOMPtr<nsIAccessible> ancestor, current = this;
+-    while (NS_SUCCEEDED(current->GetParent(getter_AddRefs(ancestor))) && ancestor) {
+-      nsRefPtr<nsHyperTextAccessible> ancestorTextAccessible;
++    nsIAccessible* ancestor, *current = this;
++    while (NS_SUCCEEDED(current->GetParent(&ancestor)) && ancestor) {
++      nsHyperTextAccessible* ancestorTextAccessible;
+       ancestor->QueryInterface(NS_GET_IID(nsHyperTextAccessible),
+-                               getter_AddRefs(ancestorTextAccessible));
++                               (void**)&ancestorTextAccessible);
+       if (ancestorTextAccessible) {
+         // Recursion will stop at container doc because it has its own impl
+         // of GetAssociatedEditor()
+@@ -1397,19 +1397,19 @@ nsHyperTextAccessible::GetAssociatedEdit
+     return NS_OK;
+   }
+ 
+-  nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem =
++  nsIDocShellTreeItem* docShellTreeItem =
+     nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
+-  nsCOMPtr<nsIEditingSession> editingSession(do_GetInterface(docShellTreeItem));
++  nsIEditingSession* editingSession(do_GetInterface(docShellTreeItem));
+   if (!editingSession)
+     return NS_OK; // No editing session interface
+ 
+-  nsCOMPtr<nsIPresShell> shell = GetPresShell();
++  nsIPresShell* shell = GetPresShell();
+   NS_ENSURE_TRUE(shell, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIDocument> doc = shell->GetDocument();
++  nsIDocument* doc = shell->GetDocument();
+   NS_ENSURE_TRUE(doc, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIEditor> editor;
++  nsIEditor* editor;
+   return editingSession->GetEditorForWindow(doc->GetWindow(), aEditor);
+ }
+ 
+@@ -1425,16 +1425,16 @@ nsresult nsHyperTextAccessible::SetSelec
+ 
+   // If range 0 was successfully set, clear any additional selection 
+   // ranges remaining from previous selection
+-  nsCOMPtr<nsISelection> domSel;
+-  nsCOMPtr<nsISelectionController> selCon;
+-  GetSelections(getter_AddRefs(selCon), getter_AddRefs(domSel));
++  nsISelection* domSel;
++  nsISelectionController* selCon;
++  GetSelections(&selCon, &domSel);
+   if (domSel) {
+     PRInt32 numRanges;
+     domSel->GetRangeCount(&numRanges);
+ 
+     for (PRInt32 count = 0; count < numRanges - 1; count ++) {
+-      nsCOMPtr<nsIDOMRange> range;
+-      domSel->GetRangeAt(1, getter_AddRefs(range));
++      nsIDOMRange* range;
++      domSel->GetRangeAt(1, &range);
+       domSel->RemoveRange(range);
+     }
+   }
+@@ -1459,12 +1459,12 @@ NS_IMETHODIMP nsHyperTextAccessible::Get
+ {
+   *aCaretOffset = 0;
+ 
+-  nsCOMPtr<nsISelection> domSel;
+-  nsresult rv = GetSelections(nsnull, getter_AddRefs(domSel));
+-  NS_ENSURE_SUCCESS(rv, rv);
+-
+-  nsCOMPtr<nsIDOMNode> caretNode;
+-  rv = domSel->GetFocusNode(getter_AddRefs(caretNode));
++  nsISelection* domSel;
++  nsresult rv = GetSelections(nsnull, &domSel);
++  NS_ENSURE_SUCCESS(rv, rv);
++
++  nsIDOMNode* caretNode;
++  rv = domSel->GetFocusNode(&caretNode);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+   PRInt32 caretOffset;
+@@ -1490,23 +1490,23 @@ nsresult nsHyperTextAccessible::GetSelec
+     aRanges->Clear();
+   }
+   
+-  nsCOMPtr<nsISelection> domSel;
+-  nsCOMPtr<nsISelectionController> selCon;
+-
+-  nsCOMPtr<nsIEditor> editor;
+-  GetAssociatedEditor(getter_AddRefs(editor));
+-  nsCOMPtr<nsIPlaintextEditor> peditor(do_QueryInterface(editor));
++  nsISelection* domSel;
++  nsISelectionController* selCon;
++
++  nsIEditor* editor;
++  GetAssociatedEditor(&editor);
++  nsIPlaintextEditor* peditor(do_QueryInterface(editor));
+   if (peditor) {
+     // Case 1: plain text editor
+     // This is for form controls which have their own
+     // selection controller separate from the document, for example
+     // HTML:input, HTML:textarea, XUL:textbox, etc.
+     if (aSelCon) {
+-      editor->GetSelectionController(getter_AddRefs(selCon));
++      editor->GetSelectionController(&selCon);
+       NS_ENSURE_TRUE(*aSelCon, NS_ERROR_FAILURE);
+     }
+ 
+-    editor->GetSelection(getter_AddRefs(domSel));
++    editor->GetSelection(&domSel);
+     NS_ENSURE_TRUE(domSel, NS_ERROR_FAILURE);
+     }
+   else {
+@@ -1517,10 +1517,10 @@ nsresult nsHyperTextAccessible::GetSelec
+ 
+     // Get the selection and selection controller
+     frame->GetSelectionController(GetPresContext(),
+-                                  getter_AddRefs(selCon));
++                                  &selCon);
+     NS_ENSURE_TRUE(selCon, NS_ERROR_FAILURE);
+     selCon->GetSelection(nsISelectionController::SELECTION_NORMAL,
+-                         getter_AddRefs(domSel));
++                         &domSel);
+     NS_ENSURE_TRUE(domSel, NS_ERROR_FAILURE);
+   }
+ 
+@@ -1531,11 +1531,11 @@ nsresult nsHyperTextAccessible::GetSelec
+     *aDomSel = domSel;
+   }
+   if (aRanges) {
+-    nsCOMPtr<nsISelection2> selection2(do_QueryInterface(domSel));
++    nsISelection2* selection2(do_QueryInterface(domSel));
+     NS_ENSURE_TRUE(selection2, NS_ERROR_FAILURE);
+ 
+-    nsCOMPtr<nsIDOMNodeList> childNodes;
+-    nsresult rv = mDOMNode->GetChildNodes(getter_AddRefs(childNodes));
++    nsIDOMNodeList* childNodes;
++    nsresult rv = mDOMNode->GetChildNodes(&childNodes);
+     NS_ENSURE_SUCCESS(rv, rv);
+     PRUint32 numChildren; 
+     rv = childNodes->GetLength(&numChildren);
+@@ -1565,7 +1565,7 @@ nsresult nsHyperTextAccessible::GetSelec
+  */
+ NS_IMETHODIMP nsHyperTextAccessible::GetSelectionCount(PRInt32 *aSelectionCount)
+ {
+-  nsCOMPtr<nsISelection> domSel;
++  nsISelection* domSel;
+   nsCOMArray<nsIDOMRange> ranges;
+   nsresult rv = GetSelections(nsnull, nsnull, &ranges);
+   NS_ENSURE_SUCCESS(rv, rv);
+@@ -1582,26 +1582,26 @@ NS_IMETHODIMP nsHyperTextAccessible::Get
+ {
+   *aStartOffset = *aEndOffset = 0;
+ 
+-  nsCOMPtr<nsISelection> domSel;
++  nsISelection* domSel;
+   nsCOMArray<nsIDOMRange> ranges;
+-  nsresult rv = GetSelections(nsnull, getter_AddRefs(domSel), &ranges);
++  nsresult rv = GetSelections(nsnull, &domSel, &ranges);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+   PRInt32 rangeCount = ranges.Count();
+   if (aSelectionNum < 0 || aSelectionNum >= rangeCount)
+     return NS_ERROR_INVALID_ARG;
+ 
+-  nsCOMPtr<nsIDOMRange> range = ranges[aSelectionNum];
++  nsIDOMRange* range = ranges[aSelectionNum];
+ 
+   // Get start point
+-  nsCOMPtr<nsIDOMNode> startNode;
+-  range->GetStartContainer(getter_AddRefs(startNode));
++  nsIDOMNode* startNode;
++  range->GetStartContainer(&startNode);
+   PRInt32 startOffset;
+   range->GetStartOffset(&startOffset);
+ 
+   // Get end point
+-  nsCOMPtr<nsIDOMNode> endNode;
+-  range->GetEndContainer(getter_AddRefs(endNode));
++  nsIDOMNode* endNode;
++  range->GetEndContainer(&endNode);
+   PRInt32 endOffset;
+   range->GetEndOffset(&endOffset);
+ 
+@@ -1612,14 +1612,14 @@ NS_IMETHODIMP nsHyperTextAccessible::Get
+   if (rangeCompareResult < 0) {
+     // Make sure start is before end, by swapping offsets
+     // This occurs when the user selects backwards in the text
+-    startNode.swap(endNode);
++    swap(startNode, endNode);
+     PRInt32 tempOffset = startOffset;
+     startOffset = endOffset;
+     endOffset = tempOffset;
+   }
+ 
+-  nsCOMPtr<nsIAccessible> startAccessible;
+-  rv = DOMPointToHypertextOffset(startNode, startOffset, aStartOffset, getter_AddRefs(startAccessible));
++  nsIAccessible* startAccessible;
++  rv = DOMPointToHypertextOffset(startNode, startOffset, aStartOffset, &startAccessible);
+   NS_ENSURE_SUCCESS(rv, rv);
+   if (!startAccessible) {
+     *aStartOffset = 0; // Could not find start point within this hypertext, so starts before
+@@ -1636,8 +1636,8 @@ nsHyperTextAccessible::SetSelectionBound
+                                           PRInt32 aStartOffset,
+                                           PRInt32 aEndOffset)
+ {
+-  nsCOMPtr<nsISelection> domSel;
+-  nsresult rv = GetSelections(nsnull, getter_AddRefs(domSel));
++  nsISelection* domSel;
++  nsresult rv = GetSelections(nsnull, &domSel);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+   // Caret is a collapsed selection
+@@ -1645,7 +1645,7 @@ nsHyperTextAccessible::SetSelectionBound
+ 
+   PRInt32 rangeCount;
+   dom