I was rebasing this against the wrong tree. Going to save the results and see what happens when I use the correct actionmonkey revision!
authorBenjamin Smedberg <benjamin@smedbergs.us>
Thu, 22 May 2008 11:00:06 -0400
changeset 123 55f4c3203c4f384a083cc87cccea108f7db740b9
parent 122 eb192196cd992859118c6da63ca40e6906da489c
child 124 0f6daec64ecb954b82b5a550327242837700329f
push id12
push userbsmedberg@mozilla.com
push dateTue, 10 Jun 2008 19:10:56 +0000
I was rebasing this against the wrong tree. Going to save the results and see what happens when I use the correct actionmonkey revision!
64bit
comptr-rewrite.patch
gc-hashtables.patch
gcobject-nodelete.patch
gfx-refcounting
nscore-class-annotation-types
prerewrite_fixes.patch
remove-cyclec.patch
success-macros.patch
xpcomproxy-gcalloc.patch
xpconnect-allocations
--- a/64bit
+++ b/64bit
@@ -1,12 +1,54 @@
 diff --git a/configure.in b/configure.in
 --- a/configure.in
 +++ b/configure.in
-@@ -8155,7 +8155,7 @@
-     ;;
- esac
+@@ -4726,8 +4726,11 @@ cairo-mac|cairo-cocoa)
+     MOZ_GFX_TOOLKIT=cairo
+     MOZ_USER_DIR="Mozilla"
+     AC_DEFINE(XP_MACOSX)
++    AC_DEFINE(_MAC)
++    AC_DEFINE(DARWIN)
+     AC_DEFINE(TARGET_CARBON)
+     AC_DEFINE(TARGET_API_MAC_CARBON)
++    AC_DEFINE(TARGET_RT_MAC_MACHO)
+     TK_LIBS='-framework Carbon'
+     TK_CFLAGS="-I${MACOS_SDK_DIR}/Developer/Headers/FlatCarbon"
+     CFLAGS="$CFLAGS $TK_CFLAGS"
+@@ -8052,6 +8055,8 @@ AC_SUBST(MOZ_MOVEMAIL)
+ AC_SUBST(MOZ_MOVEMAIL)
+ 
+ AC_DEFINE(JS_THREADSAFE)
++AC_DEFINE(MMGC_THREADSAFE)
++AC_DEFINE(NEED_MMGC_CONFIG_H)
+ 
+ if test "$MOZ_DEBUG"; then
+     AC_DEFINE(MOZ_REFLOW_PERF)
+@@ -8248,6 +8253,8 @@ unset MAKEFILES
+ unset MAKEFILES
+ unset CONFIG_FILES
  
--ac_configure_args="$_SUBDIR_CONFIG_ARGS --with-mmgc-shared --with-threadsafe-mmgc --with-nspr-includes=-I../../dist/include/nspr --with-nspr-ldopts=\"$TAMARIN_NSPR_LIBS\""
-+ac_configure_args="$_SUBDIR_CONFIG_ARGS --with-mmgc-shared --without-tamarin --with-threadsafe-mmgc --with-nspr-includes=-I../../dist/include/nspr --with-nspr-ldopts=\"$TAMARIN_NSPR_LIBS\""
++export PYTHON
++
+ if test "$COMPILE_ENVIRONMENT"; then
+ if test -z "$MOZ_NATIVE_NSPR" || test "$MOZ_LDAP_XPCOM"; then
+     ac_configure_args="$_SUBDIR_CONFIG_ARGS --with-dist-prefix=$MOZ_BUILD_ROOT/dist --with-mozilla"
+@@ -8281,6 +8288,20 @@ if test -z "$MOZ_NATIVE_NSPR"; then
+     rm -f config/autoconf.mk.bak
+ fi
  
- AC_OUTPUT_SUBDIRS(js/tamarin)
- ac_configure_args="$_SUBDIR_CONFIG_ARGS"
++case "$OS_ARCH" in
++WINNT)
++    TAMARIN_NSPR_LIBS=../../dist/lib/nspr4.lib
++    ;;
++*)
++    TAMARIN_NSPR_LIBS=$(nsprpub/config/nspr-config --prefix=../../dist --libdir=../../dist/lib --libs)
++    ;;
++esac
++
++ac_configure_args="$_SUBDIR_CONFIG_ARGS --with-mmgc-shared --without-tamarin --with-threadsafe-mmgc --with-nspr-includes=-I../../dist/include/nspr --with-nspr-ldopts=\"$TAMARIN_NSPR_LIBS\""
++
++AC_OUTPUT_SUBDIRS(js/tamarin)
++ac_configure_args="$_SUBDIR_CONFIG_ARGS"
++
+ # if we're building the LDAP XPCOM component, we need to build 
+ # the c-sdk first.  
+ #
--- a/comptr-rewrite.patch
+++ b/comptr-rewrite.patch
@@ -24,25 +24,25 @@
 * * *
 * * *
 * * *
 * * *
 
 diff --git a/accessible/src/base/nsAccessNode.cpp b/accessible/src/base/nsAccessNode.cpp
 --- a/accessible/src/base/nsAccessNode.cpp
 +++ b/accessible/src/base/nsAccessNode.cpp
-@@ -117,7 +117,6 @@
+@@ -117,7 +117,6 @@ nsIAccessibilityService *nsAccessNode::G
  //-----------------------------------------------------
  NS_IMPL_QUERY_INTERFACE2(nsAccessNode, nsIAccessNode, nsPIAccessNode)
  NS_IMPL_ADDREF(nsAccessNode)
 -NS_IMPL_RELEASE_WITH_DESTROY(nsAccessNode, LastRelease())
  
  nsAccessNode::nsAccessNode(nsIDOMNode *aNode, nsIWeakReference* aShell): 
    mDOMNode(aNode), mWeakShell(aShell)
-@@ -132,18 +131,10 @@
+@@ -132,18 +131,10 @@ nsAccessNode::nsAccessNode(nsIDOMNode *a
  //-----------------------------------------------------
  nsAccessNode::~nsAccessNode()
  {
 -  NS_ASSERTION(!mWeakShell, "LastRelease was never called!?!");
 -}
 -
 -void nsAccessNode::LastRelease()
 -{
@@ -54,29 +54,29 @@ diff --git a/accessible/src/base/nsAcces
 -  // ... then die.
 -  NS_DELETEXPCOM(this);
  }
  
  NS_IMETHODIMP nsAccessNode::Init()
 diff --git a/caps/include/nsPrincipal.h b/caps/include/nsPrincipal.h
 --- a/caps/include/nsPrincipal.h
 +++ b/caps/include/nsPrincipal.h
-@@ -51,7 +51,7 @@
+@@ -51,7 +51,7 @@ class nsIObjectInputStream;
  class nsIObjectInputStream;
  class nsIObjectOutputStream;
  
 -class nsPrincipal : public nsIPrincipal
 +class nsPrincipal : public XPCOMGCFinalizedObject, public nsIPrincipal
  {
  public:
    nsPrincipal();
 diff --git a/caps/src/nsNullPrincipal.cpp b/caps/src/nsNullPrincipal.cpp
 --- a/caps/src/nsNullPrincipal.cpp
 +++ b/caps/src/nsNullPrincipal.cpp
-@@ -60,28 +60,6 @@
+@@ -60,28 +60,6 @@ NS_IMPL_CI_INTERFACE_GETTER2(nsNullPrinc
  NS_IMPL_CI_INTERFACE_GETTER2(nsNullPrincipal,
                               nsIPrincipal,
                               nsISerializable)
 -
 -NS_IMETHODIMP_(nsrefcnt) 
 -nsNullPrincipal::AddRef()
 -{
 -  NS_PRECONDITION(PRInt32(mJSPrincipals.refcount) >= 0, "illegal refcnt");
@@ -98,17 +98,17 @@ diff --git a/caps/src/nsNullPrincipal.cp
 -  return count;
 -}
  
  nsNullPrincipal::nsNullPrincipal()
  {
 diff --git a/caps/src/nsPrincipal.cpp b/caps/src/nsPrincipal.cpp
 --- a/caps/src/nsPrincipal.cpp
 +++ b/caps/src/nsPrincipal.cpp
-@@ -81,29 +81,6 @@
+@@ -81,29 +81,6 @@ NS_IMPL_CI_INTERFACE_GETTER2(nsPrincipal
  NS_IMPL_CI_INTERFACE_GETTER2(nsPrincipal,
                               nsIPrincipal,
                               nsISerializable)
 -
 -NS_IMETHODIMP_(nsrefcnt)
 -nsPrincipal::AddRef()
 -{
 -  NS_PRECONDITION(PRInt32(mJSPrincipals.refcount) >= 0, "illegal refcnt");
@@ -131,17 +131,17 @@ diff --git a/caps/src/nsPrincipal.cpp b/
 -  return count;
 -}
  
  nsPrincipal::nsPrincipal()
    : mCapabilities(nsnull),
 diff --git a/caps/src/nsSystemPrincipal.cpp b/caps/src/nsSystemPrincipal.cpp
 --- a/caps/src/nsSystemPrincipal.cpp
 +++ b/caps/src/nsSystemPrincipal.cpp
-@@ -56,29 +56,6 @@
+@@ -56,29 +56,6 @@ NS_IMPL_CI_INTERFACE_GETTER2(nsSystemPri
  NS_IMPL_CI_INTERFACE_GETTER2(nsSystemPrincipal,
                               nsIPrincipal,
                               nsISerializable)
 -
 -NS_IMETHODIMP_(nsrefcnt) 
 -nsSystemPrincipal::AddRef()
 -{
 -  NS_PRECONDITION(PRInt32(mJSPrincipals.refcount) >= 0, "illegal refcnt");
@@ -164,79 +164,79 @@ diff --git a/caps/src/nsSystemPrincipal.
 -}
 -
  
  ///////////////////////////////////////
  // Methods implementing nsIPrincipal //
 diff --git a/content/base/public/nsIDocument.h b/content/base/public/nsIDocument.h
 --- a/content/base/public/nsIDocument.h
 +++ b/content/base/public/nsIDocument.h
-@@ -111,7 +111,6 @@
+@@ -111,7 +111,6 @@ class nsIDocument : public nsINode
  {
  public:
    NS_DECLARE_STATIC_IID_ACCESSOR(NS_IDOCUMENT_IID)
 -  NS_DECL_AND_IMPL_ZEROING_OPERATOR_NEW
  
  #ifdef MOZILLA_INTERNAL_API
    nsIDocument()
 diff --git a/content/base/src/nsCommentNode.cpp b/content/base/src/nsCommentNode.cpp
 --- a/content/base/src/nsCommentNode.cpp
 +++ b/content/base/src/nsCommentNode.cpp
-@@ -178,7 +178,7 @@
+@@ -178,7 +178,7 @@ nsCommentNode::List(FILE* out, PRInt32 a
    PRInt32 indx;
    for (indx = aIndent; --indx >= 0; ) fputs("  ", out);
  
 -  fprintf(out, "Comment@%p refcount=%d<!--", (void*)this, mRefCnt.get());
 +  fprintf(out, "Comment@%p<!--", (void*) this);
  
    nsAutoString tmp;
    ToCString(tmp, 0, mText.GetLength());
 diff --git a/content/base/src/nsContentIterator.cpp b/content/base/src/nsContentIterator.cpp
 --- a/content/base/src/nsContentIterator.cpp
 +++ b/content/base/src/nsContentIterator.cpp
-@@ -121,7 +121,8 @@
+@@ -121,7 +121,8 @@ ContentIsInTraversalRange(nsIContent *aC
  /*
   *  A simple iterator class for traversing the content in "close tag" order
   */
 -class nsContentIterator : public nsIContentIterator //, public nsIEnumerator
 +class nsContentIterator : public nsIContentIterator
 +                      //, public nsIEnumerator
  {
  public:
    NS_DECL_ISUPPORTS
 diff --git a/content/base/src/nsGenericElement.cpp b/content/base/src/nsGenericElement.cpp
 --- a/content/base/src/nsGenericElement.cpp
 +++ b/content/base/src/nsGenericElement.cpp
-@@ -892,14 +892,14 @@
+@@ -881,14 +881,14 @@ nsNSElementTearoff::GetClientRects(nsIDO
  {
    *aResult = nsnull;
  
 -  nsRefPtr<nsClientRectList> rectList = new nsClientRectList();
 +  nsClientRectList *rectList = new nsClientRectList();
    if (!rectList)
      return NS_ERROR_OUT_OF_MEMORY;
  
    nsIFrame* frame = mContent->GetPrimaryFrame(Flush_Layout);
    if (!frame) {
      // display:none, perhaps? Return an empty list
 -    *aResult = rectList.forget().get();
 +    *aResult = rectList;
      return NS_OK;
    }
  
-@@ -908,7 +908,7 @@
+@@ -897,7 +897,7 @@ nsNSElementTearoff::GetClientRects(nsIDO
            GetContainingBlockForClientRect(frame), &builder);
    if (NS_FAILED(builder.mRV))
      return builder.mRV;
 -  *aResult = rectList.forget().get();
 +  *aResult = rectList;
    return NS_OK;
  }
  
-@@ -963,21 +963,6 @@
+@@ -952,21 +952,6 @@ nsNodeSupportsWeakRefTearoff::GetWeakRef
  
  //----------------------------------------------------------------------
  
 -nsDOMEventRTTearoff *
 -nsDOMEventRTTearoff::mCachedEventTearoff[NS_EVENT_TEAROFF_CACHE_SIZE];
 -
 -PRUint32 nsDOMEventRTTearoff::mCachedEventTearoffCount = 0;
 -
@@ -248,17 +248,17 @@ diff --git a/content/base/src/nsGenericE
 -
 -nsDOMEventRTTearoff::~nsDOMEventRTTearoff()
 -{
 -}
 -
  NS_IMPL_CYCLE_COLLECTION_1(nsDOMEventRTTearoff, mContent)
  
  NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsDOMEventRTTearoff)
-@@ -988,64 +973,6 @@
+@@ -977,64 +962,6 @@ NS_INTERFACE_MAP_END_AGGREGATED(mContent
  
  NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOUS(nsDOMEventRTTearoff,
                                            nsIDOMEventTarget)
 -NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUOUS_WITH_DESTROY(nsDOMEventRTTearoff,
 -                                                        nsIDOMEventTarget,
 -                                                        LastRelease())
 -
 -nsDOMEventRTTearoff *
@@ -313,40 +313,40 @@ diff --git a/content/base/src/nsGenericE
 -    return;
 -  }
 -
 -  delete this;
 -}
  
  nsresult
  nsDOMEventRTTearoff::GetDOM3EventTarget(nsIDOM3EventTarget **aTarget)
-@@ -4072,8 +3999,7 @@
+@@ -4077,8 +4004,7 @@ nsGenericElement::List(FILE* out, PRInt3
  
    ListAttributes(out);
  
 -  fprintf(out, " intrinsicstate=[%08x]", IntrinsicState());
 -  fprintf(out, " refcount=%d<", mRefCnt.get());
 +  fprintf(out, " intrinsicstate=[%08x]<", IntrinsicState());
  
    PRUint32 i, length = GetChildCount();
    if (length > 0) {
 diff --git a/content/base/src/nsGenericElement.h b/content/base/src/nsGenericElement.h
 --- a/content/base/src/nsGenericElement.h
 +++ b/content/base/src/nsGenericElement.h
-@@ -206,7 +206,8 @@
+@@ -206,7 +206,8 @@ private:
   * @see nsDOMEventRTTearoff::Create
   */
  
 -class nsDOMEventRTTearoff : public nsIDOMEventTarget,
 +class nsDOMEventRTTearoff : public XPCOMGCObject,
 +                            public nsIDOMEventTarget,
                              public nsIDOM3EventTarget,
                              public nsIDOMNSEventTarget
  {
-@@ -217,33 +218,23 @@
+@@ -217,33 +218,23 @@ private:
    // nsDOMEventRTTearoff::Create(). That's why the constructor and
    // destrucor of this class is private.
  
 -  nsDOMEventRTTearoff(nsIContent *aContent);
 -
 -  static nsDOMEventRTTearoff *mCachedEventTearoff[NS_EVENT_TEAROFF_CACHE_SIZE];
 -  static PRUint32 mCachedEventTearoffCount;
 -
@@ -422,17 +422,17 @@ diff --git a/content/base/src/nsNodeInfo
 -  // Create a new one
 -  void* place = sNodeInfoPool->Alloc(sizeof(nsNodeInfo));
 -  return place ? new (place) nsNodeInfo() : nsnull;
 -}
 -
  nsNodeInfo::nsNodeInfo()
  {
  }
-@@ -130,19 +97,8 @@
+@@ -130,19 +97,8 @@ nsNodeInfo::Init(nsIAtom *aName, nsIAtom
  
  // nsISupports
  
 -NS_IMPL_CYCLE_COLLECTION_CLASS(nsNodeInfo)
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_0(nsNodeInfo)
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsNodeInfo)
 -  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NATIVE_MEMBER(mOwnerManager,
 -                                                  nsNodeInfoManager)
@@ -444,17 +444,17 @@ diff --git a/content/base/src/nsNodeInfo
 -  NS_INTERFACE_TABLE1(nsNodeInfo, nsINodeInfo)
 -  NS_INTERFACE_TABLE_TO_MAP_SEGUE_CYCLE_COLLECTION(nsNodeInfo)
 -NS_INTERFACE_MAP_END
 +NS_IMPL_ADDREF(nsNodeInfo)
 +NS_IMPL_QUERY_INTERFACE1(nsNodeInfo, nsINodeInfo)
  
  // nsINodeInfo
  
-@@ -287,27 +243,3 @@
+@@ -287,27 +243,3 @@ nsNodeInfo::QualifiedNameEqualsInternal(
    // end of aQualifiedName
    return mInner.mName->EqualsUTF8(Substring(colon, end));
  }
 -
 -// static
 -void
 -nsNodeInfo::ClearCache()
 -{
@@ -484,28 +484,28 @@ diff --git a/content/base/src/nsNodeInfo
  
  class nsFixedSizeAllocator;
  
 -class nsNodeInfo : public nsINodeInfo
 +class nsNodeInfo : public XPCOMGCFinalizedObject, public nsINodeInfo
  {
  public:
    NS_DECL_CYCLE_COLLECTING_ISUPPORTS
-@@ -75,7 +75,9 @@
+@@ -75,7 +75,9 @@ public:
    // nsNodeInfo
    // Create objects with Create
  public:
 -  static nsNodeInfo *Create();
 +  static nsNodeInfo *Create() {
 +    return new nsNodeInfo();
 +  }
  private:
    nsNodeInfo();
  protected:
-@@ -91,21 +93,6 @@
+@@ -91,21 +93,6 @@ public:
     */
    nsresult Init(nsIAtom *aName, nsIAtom *aPrefix, PRInt32 aNamespaceID,
                  nsNodeInfoManager *aOwnerManager);
 -
 -  /**
 -   * Call before shutdown to clear the cache and free memory for this class.
 -   */
 -  static void ClearCache();
@@ -537,17 +537,17 @@ diff --git a/content/base/src/nsNodeInfo
 -
 -#ifdef PR_LOGGING
 -static PRLogModuleInfo* gNodeInfoManagerLeakPRLog;
 -#endif
 -
  PLHashNumber
  nsNodeInfoManager::GetNodeInfoInnerHashValue(const void *key)
  {
-@@ -135,33 +125,6 @@
+@@ -135,33 +125,6 @@ nsNodeInfoManager::~nsNodeInfoManager()
  #endif
  
    nsLayoutStatics::Release();
 -}
 -
 -
 -nsrefcnt
 -nsNodeInfoManager::AddRef()
@@ -574,17 +574,17 @@ diff --git a/content/base/src/nsNodeInfo
 -
 -  return count;
  }
  
  NS_IMPL_CYCLE_COLLECTION_CLASS(nsNodeInfoManager)
 diff --git a/content/base/src/nsNodeInfoManager.h b/content/base/src/nsNodeInfoManager.h
 --- a/content/base/src/nsNodeInfoManager.h
 +++ b/content/base/src/nsNodeInfoManager.h
-@@ -60,16 +60,12 @@
+@@ -60,16 +60,12 @@ class nsXULPrototypeDocument;
  class nsXULPrototypeDocument;
  class nsBindingManager;
  
 -class nsNodeInfoManager
 +class nsNodeInfoManager : public XPCOMGCFinalizedObject
 +                        , public MMgc::GCFinalizable
  {
  public:
@@ -593,53 +593,53 @@ diff --git a/content/base/src/nsNodeInfo
 -
 -  NS_DECL_CYCLE_COLLECTION_NATIVE_CLASS(nsNodeInfoManager)
 -
 -  nsrefcnt AddRef(void);
 -  nsrefcnt Release(void);
  
    /**
     * Initialize the nodeinfo manager with a document.
-@@ -155,7 +151,6 @@
+@@ -155,7 +151,6 @@ private:
                                                      const void *key2);
    static PLHashNumber PR_CALLBACK GetNodeInfoInnerHashValue(const void *key);
  
 -  nsAutoRefCnt mRefCnt;
    NS_DECL_OWNINGTHREAD
  
    PLHashTable *mNodeInfoHash;
 diff --git a/content/base/src/nsTextNode.cpp b/content/base/src/nsTextNode.cpp
 --- a/content/base/src/nsTextNode.cpp
 +++ b/content/base/src/nsTextNode.cpp
-@@ -236,8 +236,7 @@
+@@ -236,8 +236,7 @@ nsTextNode::List(FILE* out, PRInt32 aInd
    for (index = aIndent; --index >= 0; ) fputs("  ", out);
  
    fprintf(out, "Text@%p", this);
 -  fprintf(out, " intrinsicstate=[%08x]", IntrinsicState());
 -  fprintf(out, " refcount=%d<", mRefCnt.get());
 +  fprintf(out, " intrinsicstate=[%08x]<", IntrinsicState());
  
    nsAutoString tmp;
    ToCString(tmp, 0, mText.GetLength());
 diff --git a/content/events/src/nsEventDispatcher.cpp b/content/events/src/nsEventDispatcher.cpp
 --- a/content/events/src/nsEventDispatcher.cpp
 +++ b/content/events/src/nsEventDispatcher.cpp
-@@ -494,8 +494,6 @@
+@@ -498,8 +498,6 @@ nsEventDispatcher::Dispatch(nsISupports*
    if (!externalDOMEvent && preVisitor.mDOMEvent) {
      // An nsDOMEvent was created while dispatching the event.
      // Duplicate private data if someone holds a pointer to it.
 -    nsrefcnt rc = 0;
 -    NS_RELEASE2(preVisitor.mDOMEvent, rc);
      nsCOMPtr<nsIPrivateDOMEvent> privateEvent =
        do_QueryInterface(preVisitor.mDOMEvent);
      if (privateEvent) {
 diff --git a/content/html/document/src/nsHTMLDocument.h b/content/html/document/src/nsHTMLDocument.h
 --- a/content/html/document/src/nsHTMLDocument.h
 +++ b/content/html/document/src/nsHTMLDocument.h
-@@ -78,9 +78,6 @@
+@@ -78,9 +78,6 @@ public:
    virtual nsresult Init();
  
    NS_IMETHOD QueryInterface(REFNSIID aIID, void** aInstancePtr);
 -
 -  NS_IMETHOD_(nsrefcnt) AddRef(void);
 -  NS_IMETHOD_(nsrefcnt) Release(void);
  
    virtual void Reset(nsIChannel* aChannel, nsILoadGroup* aLoadGroup);
@@ -676,17 +676,17 @@ diff --git a/content/svg/content/src/nsS
 +                    // , nsIDOMSVGTextPositioningElement
 +                    // , nsIDOMSVGTextContentElement
  {
  protected:
    friend nsresult NS_NewSVGTextElement(nsIContent **aResult,
 diff --git a/content/xbl/src/nsXBLBinding.h b/content/xbl/src/nsXBLBinding.h
 --- a/content/xbl/src/nsXBLBinding.h
 +++ b/content/xbl/src/nsXBLBinding.h
-@@ -77,25 +77,6 @@
+@@ -77,25 +77,6 @@ public:
     *    which are queued to fire their constructors.
     */
  
 -  nsrefcnt AddRef()
 -  {
 -    ++mRefCnt;
 -    NS_LOG_ADDREF(this, mRefCnt, "nsXBLBinding", sizeof(nsXBLBinding));
 -    return mRefCnt;
@@ -702,45 +702,45 @@ diff --git a/content/xbl/src/nsXBLBindin
 -      return 0;
 -    }
 -    return mRefCnt;
 -  }
 -
    NS_DECL_CYCLE_COLLECTION_NATIVE_CLASS(nsXBLBinding)
  
    nsXBLPrototypeBinding* PrototypeBinding() { return mPrototypeBinding; }
-@@ -169,7 +150,6 @@
+@@ -169,7 +150,6 @@ public:
  // MEMBER VARIABLES
  protected:
  
 -  nsAutoRefCnt mRefCnt;
    nsXBLPrototypeBinding* mPrototypeBinding; // Weak, but we're holding a ref to the docinfo
    nsCOMPtr<nsIContent> mContent; // Strong. Our anonymous content stays around with us.
    nsRefPtr<nsXBLBinding> mNextBinding; // Strong. The derived binding owns the base class bindings.
 diff --git a/content/xbl/src/nsXBLContentSink.cpp b/content/xbl/src/nsXBLContentSink.cpp
 --- a/content/xbl/src/nsXBLContentSink.cpp
 +++ b/content/xbl/src/nsXBLContentSink.cpp
-@@ -891,13 +891,6 @@
+@@ -891,13 +891,6 @@ nsXBLContentSink::CreateElement(const PR
    AddAttributesToXULPrototype(aAtts, aAttsCount, prototype);
  
    nsresult rv = nsXULElement::Create(prototype, mDocument, PR_FALSE, aResult);
 -
 -  // XUL prototype elements start with a refcnt of 1 to represent
 -  // ownership by the XUL prototype document.  In our case we have no
 -  // prototype document, so release that reference.  The Create call
 -  // above took a reference.
 -  prototype->Release();
 -
    return rv;
  #endif
  }
 diff --git a/content/xbl/src/nsXBLInsertionPoint.cpp b/content/xbl/src/nsXBLInsertionPoint.cpp
 --- a/content/xbl/src/nsXBLInsertionPoint.cpp
 +++ b/content/xbl/src/nsXBLInsertionPoint.cpp
-@@ -51,20 +51,6 @@
+@@ -52,20 +52,6 @@ nsXBLInsertionPoint::~nsXBLInsertionPoin
  {
  }
  
 -nsrefcnt
 -nsXBLInsertionPoint::Release()
 -{
 -  --mRefCnt;
 -  NS_LOG_RELEASE(this, mRefCnt, "nsXBLInsertionPoint");
@@ -777,37 +777,37 @@ diff --git a/content/xbl/src/nsXBLInsert
 -                  sizeof(nsXBLInsertionPoint));
 -    return mRefCnt;
 -  }
 -
 -  nsrefcnt Release();
  
    NS_DECL_CYCLE_COLLECTION_NATIVE_CLASS(nsXBLInsertionPoint)
  
-@@ -88,7 +78,6 @@
+@@ -88,7 +78,6 @@ public:
    void UnbindDefaultContent();
  
  protected:
 -  nsAutoRefCnt mRefCnt;
    nsIContent* mParentElement;            // This ref is weak.  The parent of the <children> element.
    PRInt32 mIndex;                        // The index of this insertion point. -1 is a pseudo-point.
    nsCOMArray<nsIContent> mElements;      // An array of elements present at the insertion point.
 diff --git a/content/xbl/src/nsXBLPrototypeBinding.cpp b/content/xbl/src/nsXBLPrototypeBinding.cpp
 --- a/content/xbl/src/nsXBLPrototypeBinding.cpp
 +++ b/content/xbl/src/nsXBLPrototypeBinding.cpp
-@@ -137,7 +137,7 @@
+@@ -137,7 +137,7 @@ private:
  // The same insertion point may be in the insertion point table for multiple
  // keys, so we refcount the entries.
  
 -class nsXBLInsertionPointEntry {
 +class nsXBLInsertionPointEntry : public XPCOMGCFinalizedObject {
  public:
    ~nsXBLInsertionPointEntry() {
      if (mDefaultContent) {
-@@ -157,92 +157,20 @@
+@@ -158,92 +158,20 @@ public:
    nsIContent* GetDefaultContent() { return mDefaultContent; }
    void SetDefaultContent(nsIContent* aChildren) { mDefaultContent = aChildren; }
  
 -
 -  // We keep kPool alive as long as there is at least either a
 -  // nsXBLPrototypeBinding or a nsXBLInsertionPointEntry alive.
 -  // nsXBLPrototypeBinding has its own global refcount so it only adds 1 to
 -  // nsXBLInsertionPointEntry::gRefCnt as long as there's at least one
@@ -891,136 +891,136 @@ diff --git a/content/xbl/src/nsXBLProtot
 -  static PRUint32 gRefCnt;
  };
 -
 -PRUint32 nsXBLInsertionPointEntry::gRefCnt = 0;
 -nsFixedSizeAllocator* nsXBLInsertionPointEntry::kPool;
  
  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NATIVE_BEGIN(nsXBLInsertionPointEntry)
    NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mInsertionParent)
-@@ -291,7 +219,6 @@
+@@ -292,7 +220,6 @@ nsXBLPrototypeBinding::nsXBLPrototypeBin
      if (kAttrPool) {
        kAttrPool->Init("XBL Attribute Entries", kAttrBucketSizes, kAttrNumBuckets, kAttrInitialSize);
      }
 -    nsXBLInsertionPointEntry::InitPool(kInsInitialSize);
    }
  }
  
-@@ -300,7 +227,7 @@
+@@ -301,7 +228,7 @@ nsXBLPrototypeBinding::Init(const nsACSt
                              nsIXBLDocumentInfo* aInfo,
                              nsIContent* aElement)
  {
 -  if (!kAttrPool || !nsXBLInsertionPointEntry::PoolInited()) {
 +  if (!kAttrPool) {
      return NS_ERROR_OUT_OF_MEMORY;
    }
  
-@@ -342,7 +269,6 @@
+@@ -343,7 +270,6 @@ nsXBLPrototypeBinding::~nsXBLPrototypeBi
    gRefCnt--;
    if (gRefCnt == 0) {
      delete kAttrPool;
 -    nsXBLInsertionPointEntry::ReleasePool();
    }
    MOZ_COUNT_DTOR(nsXBLPrototypeBinding);
  }
-@@ -1142,13 +1068,6 @@
+@@ -1143,13 +1069,6 @@ nsXBLPrototypeBinding::ConstructAttribut
    }
  }
  
 -static PRBool PR_CALLBACK
 -DeleteInsertionPointEntry(nsHashKey* aKey, void* aData, void* aClosure)
 -{
 -  static_cast<nsXBLInsertionPointEntry*>(aData)->Release();
 -  return PR_TRUE;
 -}
 -
  void 
  nsXBLPrototypeBinding::ConstructInsertionTable(nsIContent* aContent)
  {
-@@ -1161,7 +1080,7 @@
+@@ -1162,7 +1081,7 @@ nsXBLPrototypeBinding::ConstructInsertio
      return;
  
    mInsertionPointTable = new nsObjectHashtable(nsnull, nsnull,
 -                                               DeleteInsertionPointEntry,
 +                                               nsnull,
                                                 nsnull, 4);
    if (!mInsertionPointTable)
      return;
-@@ -1178,7 +1097,6 @@
+@@ -1179,7 +1098,6 @@ nsXBLPrototypeBinding::ConstructInsertio
      child->GetAttr(kNameSpaceID_None, nsGkAtoms::includes, includes);
      if (includes.IsEmpty()) {
        nsISupportsKey key(nsGkAtoms::children);
 -      xblIns->AddRef();
        mInsertionPointTable->Put(&key, xblIns);
      }
      else {
-@@ -1197,7 +1115,6 @@
+@@ -1198,7 +1116,6 @@ nsXBLPrototypeBinding::ConstructInsertio
          nsCOMPtr<nsIAtom> atom = do_GetAtom(tok);
             
          nsISupportsKey key(atom);
 -        xblIns->AddRef();
          mInsertionPointTable->Put(&key, xblIns);
            
          token = nsCRT::strtok( newStr, "| ", &newStr );
 diff --git a/content/xml/content/src/nsXMLCDATASection.cpp b/content/xml/content/src/nsXMLCDATASection.cpp
 --- a/content/xml/content/src/nsXMLCDATASection.cpp
 +++ b/content/xml/content/src/nsXMLCDATASection.cpp
-@@ -169,7 +169,7 @@
+@@ -169,7 +169,7 @@ nsXMLCDATASection::List(FILE* out, PRInt
    PRInt32 index;
    for (index = aIndent; --index >= 0; ) fputs("  ", out);
  
 -  fprintf(out, "CDATASection refcount=%d<", mRefCnt.get());
 +  fprintf(out, "CDATASection<");
  
    nsAutoString tmp;
    ToCString(tmp, 0, mText.GetLength());
 diff --git a/content/xml/content/src/nsXMLProcessingInstruction.cpp b/content/xml/content/src/nsXMLProcessingInstruction.cpp
 --- a/content/xml/content/src/nsXMLProcessingInstruction.cpp
 +++ b/content/xml/content/src/nsXMLProcessingInstruction.cpp
-@@ -188,7 +188,7 @@
+@@ -188,7 +188,7 @@ nsXMLProcessingInstruction::List(FILE* o
    PRInt32 index;
    for (index = aIndent; --index >= 0; ) fputs("  ", out);
  
 -  fprintf(out, "Processing instruction refcount=%d<", mRefCnt.get());
 +  fprintf(out, "Processing instruction <");
  
    nsAutoString tmp;
    ToCString(tmp, 0, mText.GetLength());
 diff --git a/content/xslt/src/base/txNamespaceMap.cpp b/content/xslt/src/base/txNamespaceMap.cpp
 --- a/content/xslt/src/base/txNamespaceMap.cpp
 +++ b/content/xslt/src/base/txNamespaceMap.cpp
-@@ -46,8 +46,8 @@
+@@ -46,8 +46,8 @@ txNamespaceMap::txNamespaceMap()
  
  txNamespaceMap::txNamespaceMap(const txNamespaceMap& aOther)
      : mPrefixes(aOther.mPrefixes)
 +    , mNamespaces(aOther.mNamespaces)
  {
 -    mNamespaces = aOther.mNamespaces; //bah! I want a copy-constructor!
  }
  
  nsresult
-@@ -79,7 +79,7 @@
+@@ -79,7 +79,7 @@ txNamespaceMap::mapNamespace(nsIAtom* aP
      // Check if the mapping already exists
      PRInt32 index = mPrefixes.IndexOf(prefix);
      if (index >= 0) {
 -        mNamespaces.ReplaceElementAt(NS_INT32_TO_PTR(nsId), index);
 +        mNamespaces[index] = nsId;
  
          return NS_OK;
      }
-@@ -89,7 +89,7 @@
+@@ -89,7 +89,7 @@ txNamespaceMap::mapNamespace(nsIAtom* aP
          return NS_ERROR_OUT_OF_MEMORY;
      }
      
 -    if (!mNamespaces.AppendElement(NS_INT32_TO_PTR(nsId))) {
 +    if (!mNamespaces.AppendElement(nsId)) {
          mPrefixes.RemoveObjectAt(mPrefixes.Count() - 1);
  
          return NS_ERROR_OUT_OF_MEMORY;
-@@ -109,7 +109,7 @@
+@@ -109,7 +109,7 @@ txNamespaceMap::lookupNamespace(nsIAtom*
  
      PRInt32 index = mPrefixes.IndexOf(prefix);
      if (index >= 0) {
 -        return NS_PTR_TO_INT32(mNamespaces.SafeElementAt(index));
 +        return mNamespaces[index];
      }
  
      if (!prefix) {
@@ -1051,31 +1051,31 @@ diff --git a/content/xslt/src/base/txNam
 -            delete this;
 -            return 0;
 -        }
 -        return mRefCnt;
 -    }
  
      nsresult mapNamespace(nsIAtom* aPrefix, const nsAString& aNamespaceURI);
      PRInt32 lookupNamespace(nsIAtom* aPrefix);
-@@ -68,9 +55,8 @@
+@@ -68,9 +55,8 @@ public:
      PRInt32 lookupNamespaceWithDefault(const nsAString& aPrefix);
  
  private:
 -    nsAutoRefCnt mRefCnt;
      nsCOMArray<nsIAtom> mPrefixes;
 -    nsVoidArray mNamespaces;
 +    nsTArray<PRInt32> mNamespaces;
  };
  
  #endif //TRANSFRMX_TXNAMESPACEMAP_H
 diff --git a/content/xslt/src/xpath/nsXPathResult.cpp b/content/xslt/src/xpath/nsXPathResult.cpp
 --- a/content/xslt/src/xpath/nsXPathResult.cpp
 +++ b/content/xslt/src/xpath/nsXPathResult.cpp
-@@ -389,7 +389,7 @@
+@@ -389,7 +389,7 @@ nsXPathResult::GetExprResult(txAExprResu
          return NS_ERROR_DOM_INVALID_STATE_ERR;
      }
  
 -    nsRefPtr<txNodeSet> nodeSet = new txNodeSet(nsnull);
 +    txNodeSet* nodeSet = new txNodeSet();
      if (!nodeSet) {
          return NS_ERROR_OUT_OF_MEMORY;
      }
@@ -1110,17 +1110,17 @@ diff --git a/content/xslt/src/xpath/txCo
  #include "txXMLUtils.h"
 +#include "txResultRecycler.h"
  
  struct txCoreFunctionDescriptor
  {
 diff --git a/content/xslt/src/xpath/txExpr.h b/content/xslt/src/xpath/txExpr.h
 --- a/content/xslt/src/xpath/txExpr.h
 +++ b/content/xslt/src/xpath/txExpr.h
-@@ -699,11 +699,11 @@
+@@ -699,11 +699,11 @@ class txLiteralExpr : public Expr {
  class txLiteralExpr : public Expr {
  public:
      txLiteralExpr(double aDbl)
 -        : mValue(new NumberResult(aDbl, nsnull))
 +        : mValue(new NumberResult(aDbl))
      {
      }
      txLiteralExpr(const nsAString& aStr)
@@ -1140,17 +1140,17 @@ diff --git a/content/xslt/src/xpath/txEx
 +class txAExprResult : public XPCOMGCFinalizedObject
  {
  public:
 -    friend class txResultRecycler;
 -
      // Update txLiteralExpr::getReturnType and sTypes in txEXSLTFunctions.cpp if
      // this enum is changed.
      enum ResultType {
-@@ -69,20 +67,12 @@
+@@ -69,20 +67,12 @@ public:
          RESULT_TREE_FRAGMENT
      };
  
 -    txAExprResult(txResultRecycler* aRecycler) : mRecycler(aRecycler)
 +    txAExprResult()
      {
      }
      virtual ~txAExprResult()
@@ -1162,90 +1162,90 @@ diff --git a/content/xslt/src/xpath/txEx
 -        ++mRefCnt;
 -        NS_LOG_ADDREF(this, mRefCnt, "txAExprResult", sizeof(*this));
 -    }
 -    
 -    void Release(); // Implemented in txResultRecycler.cpp
  
      /**
       * Returns the type of ExprResult represented
-@@ -114,10 +104,6 @@
+@@ -114,10 +104,6 @@ public:
       * @return the Number value
      **/
      virtual double numberValue()          = 0;
 -
 -private:
 -    nsAutoRefCnt mRefCnt;
 -    nsRefPtr<txResultRecycler> mRecycler;
  };
  
  #define TX_DECL_EXPRRESULT                                        \
-@@ -142,7 +128,7 @@
+@@ -142,7 +128,7 @@ class NumberResult : public txAExprResul
  class NumberResult : public txAExprResult {
  
  public:
 -    NumberResult(double aValue, txResultRecycler* aRecycler);
 +    NumberResult(double aValue);
  
      TX_DECL_EXPRRESULT
  
-@@ -153,8 +139,8 @@
+@@ -153,8 +139,8 @@ public:
  
  class StringResult : public txAExprResult {
  public:
 -    StringResult(txResultRecycler* aRecycler);
 -    StringResult(const nsAString& aValue, txResultRecycler* aRecycler);
 +    StringResult();
 +    StringResult(const nsAString& aValue);
  
      TX_DECL_EXPRRESULT
  
 diff --git a/content/xslt/src/xpath/txNodeSet.cpp b/content/xslt/src/xpath/txNodeSet.cpp
 --- a/content/xslt/src/xpath/txNodeSet.cpp
 +++ b/content/xslt/src/xpath/txNodeSet.cpp
-@@ -69,9 +69,8 @@
+@@ -69,9 +69,8 @@ static const PRInt32 kTxNodeSetGrowFacto
  #define kForward   1
  #define kReversed -1
  
 -txNodeSet::txNodeSet(txResultRecycler* aRecycler)
 -    : txAExprResult(aRecycler),
 -      mStart(nsnull),
 +txNodeSet::txNodeSet()
 +    : mStart(nsnull),
        mEnd(nsnull),
        mStartBuffer(nsnull),
        mEndBuffer(nsnull),
-@@ -80,9 +79,8 @@
+@@ -80,9 +79,8 @@ txNodeSet::txNodeSet(txResultRecycler* a
  {
  }
  
 -txNodeSet::txNodeSet(const txXPathNode& aNode, txResultRecycler* aRecycler)
 -    : txAExprResult(aRecycler),
 -      mStart(nsnull),
 +txNodeSet::txNodeSet(const txXPathNode& aNode)
 +    : mStart(nsnull),
        mEnd(nsnull),
        mStartBuffer(nsnull),
        mEndBuffer(nsnull),
-@@ -97,9 +95,8 @@
+@@ -97,9 +95,8 @@ txNodeSet::txNodeSet(const txXPathNode& 
      ++mEnd;
  }
  
 -txNodeSet::txNodeSet(const txNodeSet& aSource, txResultRecycler* aRecycler)
 -    : txAExprResult(aRecycler),
 -      mStart(nsnull),
 +txNodeSet::txNodeSet(const txNodeSet& aSource)
 +    : mStart(nsnull),
        mEnd(nsnull),
        mStartBuffer(nsnull),
        mEndBuffer(nsnull),
 diff --git a/content/xslt/src/xpath/txNodeSet.h b/content/xslt/src/xpath/txNodeSet.h
 --- a/content/xslt/src/xpath/txNodeSet.h
 +++ b/content/xslt/src/xpath/txNodeSet.h
-@@ -54,18 +54,18 @@
+@@ -54,18 +54,18 @@ public:
      /**
       * Creates a new empty NodeSet
       */
 -    txNodeSet(txResultRecycler* aRecycler);
 +    txNodeSet();
  
      /**
       * Creates a new NodeSet with one node.
@@ -1260,17 +1260,17 @@ diff --git a/content/xslt/src/xpath/txNo
 -    txNodeSet(const txNodeSet& aSource, txResultRecycler* aRecycler);
 +    txNodeSet(const txNodeSet& aSource);
  
      /**
       * Destructor for txNodeSet, deletes the nodes.
 diff --git a/content/xslt/src/xpath/txNodeSetAdaptor.cpp b/content/xslt/src/xpath/txNodeSetAdaptor.cpp
 --- a/content/xslt/src/xpath/txNodeSetAdaptor.cpp
 +++ b/content/xslt/src/xpath/txNodeSetAdaptor.cpp
-@@ -59,7 +59,7 @@
+@@ -59,7 +59,7 @@ txNodeSetAdaptor::Init()
  txNodeSetAdaptor::Init()
  {
      if (!mNodeSet) {
 -        mNodeSet = new txNodeSet(nsnull);
 +        mNodeSet = new txNodeSet();
      }
  
      return mNodeSet ? NS_OK : NS_ERROR_OUT_OF_MEMORY;
@@ -1297,17 +1297,17 @@ diff --git a/content/xslt/src/xpath/txRe
  #include "txXPathTreeWalker.h"
 +#include "txResultRecycler.h"
  
  /**
   *  Compares the two ExprResults based on XPath 1.0 Recommendation (section 3.4)
 diff --git a/content/xslt/src/xpath/txResultRecycler.cpp b/content/xslt/src/xpath/txResultRecycler.cpp
 --- a/content/xslt/src/xpath/txResultRecycler.cpp
 +++ b/content/xslt/src/xpath/txResultRecycler.cpp
-@@ -47,257 +47,87 @@
+@@ -47,257 +47,87 @@ txResultRecycler::txResultRecycler()
  {
  }
  
 -txResultRecycler::~txResultRecycler()
 -{
 -    txStackIterator stringIter(&mStringResults);
 -    while (stringIter.hasNext()) {
 -        delete static_cast<StringResult*>(stringIter.next());
@@ -1574,17 +1574,17 @@ diff --git a/content/xslt/src/xpath/txRe
 -        else {
 -            delete this;
 -        }
 -    }
 -}
 diff --git a/content/xslt/src/xpath/txResultRecycler.h b/content/xslt/src/xpath/txResultRecycler.h
 --- a/content/xslt/src/xpath/txResultRecycler.h
 +++ b/content/xslt/src/xpath/txResultRecycler.h
-@@ -49,33 +49,12 @@
+@@ -49,33 +49,12 @@ class NumberResult;
  class NumberResult;
  class BooleanResult;
  
 -class txResultRecycler
 +class txResultRecycler : public XPCOMGCObject
  {
  public:
      txResultRecycler();
@@ -1610,17 +1610,17 @@ diff --git a/content/xslt/src/xpath/txRe
 -    /**
 -     * Returns an txAExprResult to this recycler for reuse.
 -     * @param aResult  result to recycle
 -     */
 -    void recycle(txAExprResult* aResult);
  
      /**
       * Functions to return results that will be fully used by the caller.
-@@ -102,10 +81,6 @@
+@@ -102,10 +81,6 @@ public:
      nsresult getNonSharedNodeSet(txNodeSet* aNodeSet, txNodeSet** aResult);
  
  private:
 -    nsAutoRefCnt mRefCnt;
 -    txStack mStringResults;
 -    txStack mNodeSetResults;
 -    txStack mNumberResults;
      StringResult* mEmptyStringResult;
@@ -1634,77 +1634,77 @@ diff --git a/content/xslt/src/xpath/txSt
   * Default Constructor
  **/
 -StringResult::StringResult(txResultRecycler* aRecycler)
 -    : txAExprResult(aRecycler)
 +StringResult::StringResult()
  {
  }
  
-@@ -54,8 +53,8 @@
+@@ -54,8 +53,8 @@ StringResult::StringResult(txResultRecyc
   * Creates a new StringResult with the value of the given String parameter
   * @param str the String to use for initialization of this StringResult's value
  **/
 -StringResult::StringResult(const nsAString& aValue, txResultRecycler* aRecycler)
 -    : txAExprResult(aRecycler), mValue(aValue)
 +StringResult::StringResult(const nsAString& aValue)
 +    : mValue(aValue)
  {
  }
  
 diff --git a/content/xslt/src/xslt/txExecutionState.cpp b/content/xslt/src/xslt/txExecutionState.cpp
 --- a/content/xslt/src/xslt/txExecutionState.cpp
 +++ b/content/xslt/src/xslt/txExecutionState.cpp
-@@ -183,7 +183,7 @@
+@@ -183,7 +183,7 @@ txExecutionState::init(const txXPathNode
      
      // The actual value here doesn't really matter since noone should use this
      // value. But lets put something errorlike in just in case
 -    mGlobalVarPlaceholderValue = new StringResult(NS_LITERAL_STRING("Error"), nsnull);
 +    mGlobalVarPlaceholderValue = new StringResult(NS_LITERAL_STRING("Error"));
      NS_ENSURE_TRUE(mGlobalVarPlaceholderValue, NS_ERROR_OUT_OF_MEMORY);
  
      // Initiate first instruction. This has to be done last since findTemplate
 diff --git a/content/xslt/src/xslt/txKey.h b/content/xslt/src/xslt/txKey.h
 --- a/content/xslt/src/xslt/txKey.h
 +++ b/content/xslt/src/xslt/txKey.h
-@@ -70,7 +70,7 @@
+@@ -70,7 +70,7 @@ struct txKeyValueHashEntry : public PLDH
  {
      txKeyValueHashEntry(const void* aKey)
          : mKey(*static_cast<const txKeyValueHashKey*>(aKey)),
 -          mNodeSet(new txNodeSet(nsnull))
 +          mNodeSet(new txNodeSet())
      {
      }
  
 diff --git a/content/xslt/src/xslt/txKeyFunctionCall.cpp b/content/xslt/src/xslt/txKeyFunctionCall.cpp
 --- a/content/xslt/src/xslt/txKeyFunctionCall.cpp
 +++ b/content/xslt/src/xslt/txKeyFunctionCall.cpp
-@@ -288,7 +288,7 @@
+@@ -288,7 +288,7 @@ txKeyHash::init()
      rv = mIndexedKeys.Init(1);
      NS_ENSURE_SUCCESS(rv, rv);
      
 -    mEmptyNodeSet = new txNodeSet(nsnull);
 +    mEmptyNodeSet = new txNodeSet();
      NS_ENSURE_TRUE(mEmptyNodeSet, NS_ERROR_OUT_OF_MEMORY);
      
      return NS_OK;
 diff --git a/content/xslt/src/xslt/txMozillaStylesheetCompiler.cpp b/content/xslt/src/xslt/txMozillaStylesheetCompiler.cpp
 --- a/content/xslt/src/xslt/txMozillaStylesheetCompiler.cpp
 +++ b/content/xslt/src/xslt/txMozillaStylesheetCompiler.cpp
-@@ -435,9 +435,6 @@
+@@ -435,9 +435,6 @@ public:
      nsresult startLoad(nsIURI* aUri, txStylesheetCompiler* aCompiler,
                         nsIPrincipal* aSourcePrincipal);
  
 -protected:
 -    nsAutoRefCnt mRefCnt;
 -
  private:
      nsRefPtr<txMozillaXSLTProcessor> mProcessor;
      nsCOMPtr<nsILoadGroup> mLoadGroup;
-@@ -453,23 +450,6 @@
+@@ -453,23 +450,6 @@ txCompileObserver::txCompileObserver(txM
      : mProcessor(aProcessor),
        mLoadGroup(aLoadGroup)
  {
 -}
 -
 -nsrefcnt
 -txCompileObserver::AddRef()
 -{
@@ -1718,17 +1718,17 @@ diff --git a/content/xslt/src/xslt/txMoz
 -        mRefCnt = 1; //stabilize
 -        delete this;
 -        return 0;
 -    }
 -    return mRefCnt;
  }
  
  nsresult
-@@ -669,29 +649,12 @@
+@@ -669,29 +649,12 @@ public:
  
  protected:
      nsRefPtr<txMozillaXSLTProcessor> mProcessor;
 -    nsAutoRefCnt mRefCnt;
 +    nsCOMPtr<nsIPrincipal> mCallerPrincipal;
  };
  
  txSyncCompileObserver::txSyncCompileObserver(txMozillaXSLTProcessor* aProcessor)
@@ -1752,71 +1752,71 @@ diff --git a/content/xslt/src/xslt/txMoz
 -    }
 -    return mRefCnt;
  }
  
  nsresult
 diff --git a/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp b/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp
 --- a/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp
 +++ b/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp
-@@ -503,7 +503,7 @@
+@@ -503,7 +503,7 @@ txMozillaXSLTProcessor::AddXSLTParam(con
          NS_ENSURE_SUCCESS(rv, rv);
      }
      else {
 -        value = new StringResult(aValue, nsnull);
 +        value = new StringResult(aValue);
          NS_ENSURE_TRUE(value, NS_ERROR_OUT_OF_MEMORY);
      }
  
-@@ -1319,7 +1319,7 @@
+@@ -1319,7 +1319,7 @@ txVariable::Convert(nsIVariant *aValue, 
              nsresult rv = aValue->GetAsDouble(&value);
              NS_ENSURE_SUCCESS(rv, rv);
  
 -            *aResult = new NumberResult(value, nsnull);
 +            *aResult = new NumberResult(value);
              NS_ENSURE_TRUE(*aResult, NS_ERROR_OUT_OF_MEMORY);
  
              NS_ADDREF(*aResult);
-@@ -1358,7 +1358,7 @@
+@@ -1358,7 +1358,7 @@ txVariable::Convert(nsIVariant *aValue, 
              nsresult rv = aValue->GetAsAString(value);
              NS_ENSURE_SUCCESS(rv, rv);
  
 -            *aResult = new StringResult(value, nsnull);
 +            *aResult = new StringResult(value);
              NS_ENSURE_TRUE(*aResult, NS_ERROR_OUT_OF_MEMORY);
  
              NS_ADDREF(*aResult);
-@@ -1381,7 +1381,7 @@
+@@ -1381,7 +1381,7 @@ txVariable::Convert(nsIVariant *aValue, 
                      return NS_ERROR_FAILURE;
                  }
  
 -                *aResult = new txNodeSet(*xpathNode, nsnull);
 +                *aResult = new txNodeSet(*xpathNode);
                  if (!*aResult) {
                      return NS_ERROR_OUT_OF_MEMORY;
                  }
-@@ -1398,7 +1398,7 @@
+@@ -1398,7 +1398,7 @@ txVariable::Convert(nsIVariant *aValue, 
  
              nsCOMPtr<nsIDOMNodeList> nodeList = do_QueryInterface(supports);
              if (nodeList) {
 -                nsRefPtr<txNodeSet> nodeSet = new txNodeSet(nsnull);
 +                nsRefPtr<txNodeSet> nodeSet = new txNodeSet();
                  if (!nodeSet) {
                      return NS_ERROR_OUT_OF_MEMORY;
                  }
-@@ -1453,7 +1453,7 @@
+@@ -1453,7 +1453,7 @@ txVariable::Convert(nsIVariant *aValue, 
                                      (::JS_GetStringChars(str));
                  nsDependentString value(strChars, ::JS_GetStringLength(str));
  
 -                *aResult = new StringResult(value, nsnull);
 +                *aResult = new StringResult(value);
                  if (!*aResult) {
                      return NS_ERROR_OUT_OF_MEMORY;
                  }
-@@ -1481,7 +1481,7 @@
+@@ -1481,7 +1481,7 @@ txVariable::Convert(nsIVariant *aValue, 
  
              nsISupports** values = static_cast<nsISupports**>(array);
  
 -            nsRefPtr<txNodeSet> nodeSet = new txNodeSet(nsnull);
 +            nsRefPtr<txNodeSet> nodeSet = new txNodeSet();
              if (!nodeSet) {
                  NS_FREE_XPCOM_ISUPPORTS_POINTER_ARRAY(count, values);
  
@@ -1831,26 +1831,26 @@ diff --git a/content/xslt/src/xslt/txRtf
 -      mBuffer(aBuffer)
 +    : mBuffer(aBuffer)
  {
  }
  
 diff --git a/content/xslt/src/xslt/txStylesheet.h b/content/xslt/src/xslt/txStylesheet.h
 --- a/content/xslt/src/xslt/txStylesheet.h
 +++ b/content/xslt/src/xslt/txStylesheet.h
-@@ -55,7 +55,7 @@
+@@ -55,7 +55,7 @@ class txStripSpaceTest;
  class txStripSpaceTest;
  class txXSLKey;
  
 -class txStylesheet
 +class txStylesheet : public XPCOMGCFinalizedObject
  {
  public:
      class ImportFrame;
-@@ -67,20 +67,6 @@
+@@ -67,20 +67,6 @@ public:
      txStylesheet();
      ~txStylesheet();
      nsresult init();
 -
 -    nsrefcnt AddRef()
 -    {
 -        return ++mRefCnt;
 -    }
@@ -1861,30 +1861,30 @@ diff --git a/content/xslt/src/xslt/txSty
 -            delete this;
 -            return 0;
 -        }
 -        return mRefCnt;
 -    }
  
      txInstruction* findTemplate(const txXPathNode& aNode,
                                  const txExpandedName& aMode,
-@@ -159,9 +145,6 @@
+@@ -159,9 +145,6 @@ private:
                             nsTPtrArray<txStripSpaceTest>& aFrameStripSpaceTests);
      nsresult addAttributeSet(txAttributeSetItem* aAttributeSetItem);
  
 -    // Refcount
 -    nsAutoRefCnt mRefCnt;
 -
      // List of ImportFrames
      txList mImportFrames;
      
 diff --git a/content/xslt/src/xslt/txStylesheetCompiler.cpp b/content/xslt/src/xslt/txStylesheetCompiler.cpp
 --- a/content/xslt/src/xslt/txStylesheetCompiler.cpp
 +++ b/content/xslt/src/xslt/txStylesheetCompiler.cpp
-@@ -67,27 +67,6 @@
+@@ -67,27 +67,6 @@ txStylesheetCompiler::txStylesheetCompil
      : txStylesheetCompilerState(aObserver)
  {
      mStatus = init(aStylesheetURI, aStylesheet, aInsertPosition);
 -}
 -
 -nsrefcnt
 -txStylesheetCompiler::AddRef()
 -{
@@ -1905,72 +1905,72 @@ diff --git a/content/xslt/src/xslt/txSty
 -    }
 -    return mRefCnt;
  }
  
  void
 diff --git a/content/xslt/src/xslt/txStylesheetCompiler.h b/content/xslt/src/xslt/txStylesheetCompiler.h
 --- a/content/xslt/src/xslt/txStylesheetCompiler.h
 +++ b/content/xslt/src/xslt/txStylesheetCompiler.h
-@@ -75,9 +75,6 @@
+@@ -75,9 +75,6 @@ class txACompileObserver
  class txACompileObserver
  {
  public:
 -    virtual nsrefcnt AddRef() = 0;
 -    virtual nsrefcnt Release() = 0;
 -
      virtual nsresult loadURI(const nsAString& aUri,
                               const nsAString& aReferrerUri,
                               txStylesheetCompiler* aCompiler) = 0;
-@@ -88,8 +85,6 @@
+@@ -88,8 +85,6 @@ public:
  };
  
  #define TX_DECL_ACOMPILEOBSERVER \
 -  nsrefcnt AddRef(); \
 -  nsrefcnt Release(); \
    nsresult loadURI(const nsAString& aUri, const nsAString& aReferrerUri, \
                     txStylesheetCompiler* aCompiler); \
    void onDoneCompiling(txStylesheetCompiler* aCompiler, nsresult aResult, \
-@@ -213,8 +208,6 @@
+@@ -213,8 +208,6 @@ public:
                           txStylesheet* aStylesheet,
                           txListIterator* aInsertPosition,
                           txACompileObserver* aObserver);
 -    virtual nsrefcnt AddRef();
 -    virtual nsrefcnt Release();
  
      void setBaseURI(const nsString& aBaseURI);
  
-@@ -251,7 +244,6 @@
+@@ -251,7 +244,6 @@ private:
      nsresult ensureNewElementContext();
      nsresult maybeDoneCompiling();
  
 -    nsAutoRefCnt mRefCnt;
      nsString mCharacters;
      nsresult mStatus;
  };
 diff --git a/content/xul/content/src/nsXULElement.h b/content/xul/content/src/nsXULElement.h
 --- a/content/xul/content/src/nsXULElement.h
 +++ b/content/xul/content/src/nsXULElement.h
-@@ -184,14 +184,12 @@
+@@ -184,14 +184,12 @@ public:
  
   */
  
 -class nsXULPrototypeNode
 +class nsXULPrototypeNode : public XPCOMGCFinalizedObject
  {
  public:
      enum Type { eType_Element, eType_Script, eType_Text, eType_PI };
  
      Type                     mType;
 -
 -    nsAutoRefCnt             mRefCnt;
  
      virtual ~nsXULPrototypeNode() {}
      virtual nsresult Serialize(nsIObjectOutputStream* aStream,
-@@ -207,17 +205,6 @@
+@@ -207,17 +205,6 @@ public:
      virtual PRUint32 ClassSize() = 0;
  #endif
  
 -    void AddRef() {
 -        ++mRefCnt;
 -        NS_LOG_ADDREF(this, mRefCnt, ClassName(), ClassSize());
 -    }
 -    void Release()
@@ -1978,85 +1978,85 @@ diff --git a/content/xul/content/src/nsX
 -        --mRefCnt;
 -        NS_LOG_RELEASE(this, mRefCnt, ClassName());
 -        if (mRefCnt == 0)
 -            delete this;
 -    }
      /**
       * The prototype document must call ReleaseSubtree when it is going
       * away.  This makes the parents through the tree stop owning their
-@@ -226,13 +213,13 @@
+@@ -226,13 +213,13 @@ public:
       * those prototypes no longer remember their children to allow them
       * to be constructed.
       */
 -    virtual void ReleaseSubtree() { Release(); }
 +    virtual void ReleaseSubtree() { }
  
      NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_NATIVE_CLASS(nsXULPrototypeNode)
  
  protected:
      nsXULPrototypeNode(Type aType)
 -        : mType(aType), mRefCnt(1) {}
 +        : mType(aType) {}
  };
  
  class nsXULPrototypeElement : public nsXULPrototypeNode
-@@ -274,8 +261,6 @@
+@@ -274,8 +261,6 @@ public:
          delete[] mChildren;
          mChildren = nsnull;
        }
 -
 -      nsXULPrototypeNode::ReleaseSubtree();
      }
  
      virtual nsresult Serialize(nsIObjectOutputStream* aStream,
 diff --git a/content/xul/document/src/nsXULContentSink.cpp b/content/xul/document/src/nsXULContentSink.cpp
 --- a/content/xul/document/src/nsXULContentSink.cpp
 +++ b/content/xul/document/src/nsXULContentSink.cpp
-@@ -719,12 +719,10 @@
+@@ -719,12 +719,10 @@ XULContentSinkImpl::HandleProcessingInst
      nsVoidArray* children;
      rv = mContextStack.GetTopChildren(&children);
      if (NS_FAILED(rv)) {
 -        pi->Release();
          return rv;
      }
  
      if (!children->AppendElement(pi)) {
 -        pi->Release();
          return NS_ERROR_OUT_OF_MEMORY;
      }
  
-@@ -900,7 +898,6 @@
+@@ -900,7 +898,6 @@ XULContentSinkImpl::OpenRoot(const PRUni
      // containers will hook up to us as their parent.
      rv = mContextStack.Push(element, mState);
      if (NS_FAILED(rv)) {
 -        element->Release();
          return rv;
      }
  
 diff --git a/content/xul/document/src/nsXULPrototypeDocument.cpp b/content/xul/document/src/nsXULPrototypeDocument.cpp
 --- a/content/xul/document/src/nsXULPrototypeDocument.cpp
 +++ b/content/xul/document/src/nsXULPrototypeDocument.cpp
-@@ -177,12 +177,6 @@
+@@ -177,12 +177,6 @@ nsXULPrototypeDocument::~nsXULPrototypeD
      if (mGlobalObject) {
          // cleaup cycles etc.
          mGlobalObject->ClearGlobalObjectOwner();
 -    }
 -
 -    PRUint32 count = mProcessingInstructions.Length();
 -    for (PRUint32 i = 0; i < count; i++)
 -    {
 -        mProcessingInstructions[i]->Release();
      }
  
      if (mRoot)
 diff --git a/content/xul/templates/src/nsXMLBinding.h b/content/xul/templates/src/nsXMLBinding.h
 --- a/content/xul/templates/src/nsXMLBinding.h
 +++ b/content/xul/templates/src/nsXMLBinding.h
-@@ -72,22 +72,14 @@
+@@ -72,22 +72,14 @@ struct nsXMLBinding {
   * a collection of <binding> descriptors. This object is refcounted by
   * nsXMLBindingValues objects and the query processor.
   */
 -class nsXMLBindingSet
 +class nsXMLBindingSet : public XPCOMGCFinalizedObject
  {
  public:
 -
@@ -2073,70 +2073,70 @@ diff --git a/content/xul/templates/src/n
 -  NS_IMETHOD_(nsrefcnt) Release();
 -  NS_DECL_OWNINGTHREAD
  
    /**
     * Add a binding to the set
 diff --git a/docshell/base/nsWebShell.cpp b/docshell/base/nsWebShell.cpp
 --- a/docshell/base/nsWebShell.cpp
 +++ b/docshell/base/nsWebShell.cpp
-@@ -560,9 +560,6 @@
+@@ -560,9 +560,6 @@ nsWebShell::~nsWebShell()
  nsWebShell::~nsWebShell()
  {
     Destroy();
 -
 -  ++mRefCnt; // following releases can cause this destructor to be called
 -             // recursively if the refcount is allowed to remain 0
  
    mContentViewer=nsnull;
  
 diff --git a/dom/src/base/nsWindowRoot.cpp b/dom/src/base/nsWindowRoot.cpp
 --- a/dom/src/base/nsWindowRoot.cpp
 +++ b/dom/src/base/nsWindowRoot.cpp
-@@ -67,10 +67,8 @@
+@@ -67,10 +67,8 @@ nsWindowRoot::nsWindowRoot(nsIDOMWindow*
    nsFocusController::Create(getter_AddRefs(mFocusController));
  
    nsCOMPtr<nsIDOMFocusListener> focusListener(do_QueryInterface(mFocusController));
 -  ++mRefCnt;
    AddEventListener(NS_LITERAL_STRING("focus"), focusListener, PR_TRUE);
    AddEventListener(NS_LITERAL_STRING("blur"), focusListener, PR_TRUE);
 -  --mRefCnt;
  }
  
  nsWindowRoot::~nsWindowRoot()
 diff --git a/editor/libeditor/base/IMETextTxn.h b/editor/libeditor/base/IMETextTxn.h
 --- a/editor/libeditor/base/IMETextTxn.h
 +++ b/editor/libeditor/base/IMETextTxn.h
-@@ -120,9 +120,6 @@
+@@ -120,9 +120,6 @@ protected:
    PRBool	mFixed;
  
    friend class TransactionFactory;
 -
 -  friend class nsDerivedSafe<IMETextTxn>; // work around for a compiler bug
 -
  };
  
  #endif
 diff --git a/editor/libeditor/base/InsertTextTxn.h b/editor/libeditor/base/InsertTextTxn.h
 --- a/editor/libeditor/base/InsertTextTxn.h
 +++ b/editor/libeditor/base/InsertTextTxn.h
-@@ -104,9 +104,6 @@
+@@ -104,9 +104,6 @@ protected:
    nsIEditor *mEditor;   
  
    friend class TransactionFactory;
 -
 -  friend class nsDerivedSafe<InsertTextTxn>; // work around for a compiler bug
 -
  };
  
  #endif
 diff --git a/editor/txtsvc/src/nsTSDNotifier.cpp b/editor/txtsvc/src/nsTSDNotifier.cpp
 --- a/editor/txtsvc/src/nsTSDNotifier.cpp
 +++ b/editor/txtsvc/src/nsTSDNotifier.cpp
-@@ -48,32 +48,6 @@
+@@ -48,32 +48,6 @@ nsTSDNotifier::~nsTSDNotifier()
  {
    mDoc = 0;
  }
 -
 -#define DEBUG_TSD_NOTIFIER_REFCNT 1
 -
 -#ifdef DEBUG_TSD_NOTIFIER_REFCNT
 -
@@ -2162,26 +2162,26 @@ diff --git a/editor/txtsvc/src/nsTSDNoti
 -
 -#endif
  
  NS_IMPL_QUERY_INTERFACE1(nsTSDNotifier, nsIEditActionListener)
  
 diff --git a/editor/txtsvc/src/nsTextServicesDocument.cpp b/editor/txtsvc/src/nsTextServicesDocument.cpp
 --- a/editor/txtsvc/src/nsTextServicesDocument.cpp
 +++ b/editor/txtsvc/src/nsTextServicesDocument.cpp
-@@ -104,8 +104,6 @@
+@@ -104,8 +104,6 @@ nsIRangeUtils* nsTextServicesDocument::s
  
  nsTextServicesDocument::nsTextServicesDocument()
  {
 -  mRefCnt         = 0;
 -
    mSelStartIndex  = -1;
    mSelStartOffset = -1;
    mSelEndIndex    = -1;
-@@ -142,32 +140,6 @@
+@@ -142,32 +140,6 @@ nsTextServicesDocument::Shutdown()
  {
    NS_IF_RELEASE(sRangeHelper);
  }
 -
 -#define DEBUG_TEXT_SERVICES__DOCUMENT_REFCNT 1
 -
 -#ifdef DEBUG_TEXT_SERVICES__DOCUMENT_REFCNT
 -
@@ -2207,17 +2207,17 @@ diff --git a/editor/txtsvc/src/nsTextSer
 -
 -#endif
  
  NS_IMPL_QUERY_INTERFACE1(nsTextServicesDocument, nsITextServicesDocument)
  
 diff --git a/embedding/browser/gtk/src/EmbedPrivate.cpp b/embedding/browser/gtk/src/EmbedPrivate.cpp
 --- a/embedding/browser/gtk/src/EmbedPrivate.cpp
 +++ b/embedding/browser/gtk/src/EmbedPrivate.cpp
-@@ -113,18 +113,6 @@
+@@ -113,18 +113,6 @@ NS_IMPL_QUERY_INTERFACE2(GTKEmbedDirecto
  NS_IMPL_QUERY_INTERFACE2(GTKEmbedDirectoryProvider,
                           nsIDirectoryServiceProvider,
                           nsIDirectoryServiceProvider2)
 -
 -NS_IMETHODIMP_(nsrefcnt)
 -GTKEmbedDirectoryProvider::AddRef()
 -{
 -  return 1;
@@ -2229,75 +2229,75 @@ diff --git a/embedding/browser/gtk/src/E
 -  return 1;
 -}
  
  NS_IMETHODIMP
  GTKEmbedDirectoryProvider::GetFile(const char *aKey, PRBool *aPersist,
 diff --git a/embedding/browser/webBrowser/nsWebBrowser.cpp b/embedding/browser/webBrowser/nsWebBrowser.cpp
 --- a/embedding/browser/webBrowser/nsWebBrowser.cpp
 +++ b/embedding/browser/webBrowser/nsWebBrowser.cpp
-@@ -125,7 +125,7 @@
+@@ -125,7 +125,7 @@ nsWebBrowser::~nsWebBrowser()
  
  PRBool PR_CALLBACK deleteListener(void *aElement, void *aData) {
      nsWebBrowserListenerState *state = (nsWebBrowserListenerState*)aElement;
 -    NS_DELETEXPCOM(state);
 +    delete state;
      return PR_TRUE;
  }
  
-@@ -307,7 +307,7 @@
+@@ -308,7 +308,7 @@ NS_IMETHODIMP nsWebBrowser::RemoveWebBro
          // if we've emptied the array, get rid of it.
          if (0 >= mListenerArray->Count()) {
              (void)mListenerArray->EnumerateForwards(deleteListener, nsnull);
 -            NS_DELETEXPCOM(mListenerArray);
 +            delete mListenerArray;
              mListenerArray = nsnull;
          }
  
-@@ -1156,7 +1156,7 @@
+@@ -1157,7 +1157,7 @@ NS_IMETHODIMP nsWebBrowser::Create()
            i++;
        }
        (void)mListenerArray->EnumerateForwards(deleteListener, nsnull);
 -      NS_DELETEXPCOM(mListenerArray);
 +      delete mListenerArray;
        mListenerArray = nsnull;
     }
  
 diff --git a/embedding/components/windowwatcher/src/nsWindowWatcher.cpp b/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
 --- a/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
 +++ b/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
-@@ -198,13 +198,11 @@
+@@ -198,13 +198,11 @@ nsWatcherWindowEnumerator::nsWatcherWind
      mCurrentPosition(inWatcher->mOldestWindow)
  {
    mWindowWatcher->AddEnumerator(this);
 -  mWindowWatcher->AddRef();
  }
  
  nsWatcherWindowEnumerator::~nsWatcherWindowEnumerator()
  {
    mWindowWatcher->RemoveEnumerator(this);
 -  mWindowWatcher->Release();
  }
  
  NS_IMETHODIMP
 diff --git a/gfx/src/thebes/nsThebesRegion.cpp b/gfx/src/thebes/nsThebesRegion.cpp
 --- a/gfx/src/thebes/nsThebesRegion.cpp
 +++ b/gfx/src/thebes/nsThebesRegion.cpp
-@@ -43,7 +43,6 @@
+@@ -43,7 +43,6 @@ NS_IMPL_ISUPPORTS1(nsThebesRegion, nsIRe
  
  nsThebesRegion::nsThebesRegion() 
  {  
 -  NS_INIT_ISUPPORTS();
  }
  
  nsresult nsThebesRegion::Init (void)
 diff --git a/intl/unicharutil/src/nsCaseConversionImp2.cpp b/intl/unicharutil/src/nsCaseConversionImp2.cpp
 --- a/intl/unicharutil/src/nsCaseConversionImp2.cpp
 +++ b/intl/unicharutil/src/nsCaseConversionImp2.cpp
-@@ -168,16 +168,6 @@
+@@ -168,16 +168,6 @@ nsCaseConversionImp2* nsCaseConversionIm
    return gCaseConv;
  }
  
 -NS_IMETHODIMP_(nsrefcnt) nsCaseConversionImp2::AddRef(void)
 -{
 -  return (nsrefcnt)1;
 -}
 -
@@ -2331,17 +2331,59 @@ diff --git a/intl/unicharutil/src/nsCate
 -  return nsrefcnt(1);
 -}
  
  nsCategoryImp* nsCategoryImp::GetInstance()
  {
 diff --git a/js/src/xpconnect/shell/xpcshell.cpp b/js/src/xpconnect/shell/xpcshell.cpp
 --- a/js/src/xpconnect/shell/xpcshell.cpp
 +++ b/js/src/xpconnect/shell/xpcshell.cpp
-@@ -899,11 +899,11 @@
+@@ -296,29 +296,14 @@ DumpXPC(JSContext *cx, JSObject *obj, ui
+     return JS_TRUE;
+ }
+ 
+-/* XXX needed only by GC() */
+-#include "jscntxt.h"
+-
+ JS_STATIC_DLL_CALLBACK(JSBool)
+ GC(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
+ {
+-    JSRuntime *rt;
+-    uint32 preBytes;
+-
+-    rt = cx->runtime;
+-    preBytes = rt->gcBytes;
+     JS_GC(cx);
+-    fprintf(gOutFile, "before %lu, after %lu, break %08lx\n",
+-           (unsigned long)preBytes, (unsigned long)rt->gcBytes,
+ #ifdef XP_UNIX
+-           (unsigned long)sbrk(0)
+-#else
+-           0
++    fprintf(stderr, "done - break %08lx\n", (unsigned long)sbrk(0));
+ #endif
+-           );
+-#ifdef JS_GCMETER
+-    js_DumpGCStats(rt, stdout);
+-#endif
++    *rval = JSVAL_VOID;
+     return JS_TRUE;
+ }
+ 
+@@ -561,6 +546,9 @@ static JSClass env_class = {
+ };
+ 
+ /***************************************************************************/
++
++/* XXX for JSErr_Limit */
++#include "jscntxt.h"
+ 
+ typedef enum JSShellErrNum {
+ #define MSG_DEF(name, number, count, exception, format) \
+@@ -911,11 +899,11 @@ ProcessArgs(JSContext *cx, JSObject *obj
  
  /***************************************************************************/
  
 -class FullTrustSecMan
 +class FullTrustSecMan : public XPCOMGCFinalizedObject
  #ifndef XPCONNECT_STANDALONE
 -  : public nsIScriptSecurityManager
 +                      , public nsIScriptSecurityManager
@@ -2349,61 +2391,61 @@ diff --git a/js/src/xpconnect/shell/xpcs
 -  : public nsIXPCSecurityManager
 +                      , public nsIXPCSecurityManager
  #endif
  {
  public:
 diff --git a/js/src/xpconnect/src/nsXPConnect.cpp b/js/src/xpconnect/src/nsXPConnect.cpp
 --- a/js/src/xpconnect/src/nsXPConnect.cpp
 +++ b/js/src/xpconnect/src/nsXPConnect.cpp
-@@ -241,14 +241,6 @@
+@@ -244,14 +244,6 @@ nsXPConnect::ReleaseXPConnectSingleton()
          // NOTE: to see really interesting stuff turn on the prlog stuff.
          // See the comment at the top of xpclog.h to see how to do that.
          xpc->DebugDump(7);
 -#endif
 -        nsrefcnt cnt;
 -        NS_RELEASE2(xpc, cnt);
 -#ifdef XPC_DUMP_AT_SHUTDOWN
 -        if(0 != cnt)
 -            printf("*** dangling reference to nsXPConnect: refcnt=%d\n", cnt);
 -        else
 -            printf("+++ XPConnect had no dangling references.\n");
  #endif
      }
  }
-@@ -1445,7 +1437,7 @@
+@@ -1448,7 +1440,7 @@ nsXPConnect::DebugDump(PRInt16 depth)
  {
  #ifdef DEBUG
      depth-- ;
 -    XPC_LOG_ALWAYS(("nsXPConnect @ %x with mRefCnt = %d", this, mRefCnt.get()));
 +    XPC_LOG_ALWAYS(("nsXPConnect @ %x", this));
      XPC_LOG_INDENT();
          XPC_LOG_ALWAYS(("gSelf @ %x", gSelf));
          XPC_LOG_ALWAYS(("gOnceAliveNowDead is %d", (int)gOnceAliveNowDead));
 diff --git a/js/src/xpconnect/src/xpcjsruntime.cpp b/js/src/xpconnect/src/xpcjsruntime.cpp
 --- a/js/src/xpconnect/src/xpcjsruntime.cpp
 +++ b/js/src/xpconnect/src/xpcjsruntime.cpp
-@@ -83,6 +83,8 @@
+@@ -83,6 +83,8 @@ struct JSDyingJSObjectData
      nsVoidArray* array;
  };
  
 +#if 0
 +// Let's pretend this is unnecessary (it probably is)
  JS_STATIC_DLL_CALLBACK(JSDHashOperator)
  WrappedJSDyingJSObjectFinder(JSDHashTable *table, JSDHashEntryHdr *hdr,
                  uint32 number, void *arg)
-@@ -103,6 +105,7 @@
+@@ -103,6 +105,7 @@ WrappedJSDyingJSObjectFinder(JSDHashTabl
      }
      return JS_DHASH_NEXT;
  }
 +#endif
  
  struct CX_AND_XPCRT_Data
  {
-@@ -254,57 +257,6 @@
+@@ -254,57 +257,6 @@ ContextCallback(JSContext *cx, uintN ope
  }
  
  // static
 -void XPCJSRuntime::TraceJS(JSTracer* trc, void* data)
 -{
 -    XPCJSRuntime* self = (XPCJSRuntime*)data;
 -
 -    // Skip this part if XPConnect is shutting down. We get into
@@ -2451,55 +2493,55 @@ diff --git a/js/src/xpconnect/src/xpcjsr
 -    for(XPCRootSetElem *e = mWrappedJSRoots; e ; e = e->GetNextRoot())
 -        static_cast<nsXPCWrappedJS*>(e)->TraceJS(trc);
 -}
 -
 -// static
  JSBool XPCJSRuntime::GCCallback(JSContext *cx, JSGCStatus status)
  {
      nsVoidArray* dyingWrappedJSArray;
-@@ -344,8 +296,11 @@
+@@ -344,8 +296,11 @@ JSBool XPCJSRuntime::GCCallback(JSContex
                      // We add them to the array now and Release the array members
                      // later to avoid the posibility of doing any JS GCThing
                      // allocations during the gc cycle.
 +#if 0
 +                    // let's pretend this is unnecessary (it probably is)
                      self->mWrappedJSMap->
                          Enumerate(WrappedJSDyingJSObjectFinder, &data);
 +#endif
                  }
  
                  // Do cleanup in NativeInterfaces. This part just finds 
-@@ -670,7 +625,7 @@
+@@ -670,7 +625,7 @@ XPCJSRuntime::~XPCJSRuntime()
      // count the total JSContexts in use
      JSContext* iter = nsnull;
      int count = 0;
 -    while(JS_ContextIterator(mJSRuntime, &iter))
 +    while(JS_ContextIterator(gJSRuntime, &iter))
          count ++;
      if(count)
          printf("deleting XPCJSRuntime with %d live JSContexts\n", count);
-@@ -692,7 +647,7 @@
+@@ -692,7 +647,7 @@ XPCJSRuntime::~XPCJSRuntime()
          if(count)
              printf("deleting XPCJSRuntime with %d live wrapped JSObject\n", (int)count);
  #endif
 -        mWrappedJSMap->Enumerate(WrappedJSShutdownMarker, mJSRuntime);
 +        mWrappedJSMap->Enumerate(WrappedJSShutdownMarker, gJSRuntime);
          delete mWrappedJSMap;
      }
  
-@@ -814,7 +769,6 @@
+@@ -814,7 +769,6 @@ XPCJSRuntime::XPCJSRuntime(nsXPConnect* 
  XPCJSRuntime::XPCJSRuntime(nsXPConnect* aXPConnect,
                             nsIJSRuntimeService* aJSRuntimeService)
   : mXPConnect(aXPConnect),
 -   mJSRuntime(nsnull),
     mJSRuntimeService(aJSRuntimeService),
     mContextMap(JSContext2XPCContextMap::newMap(XPC_CONTEXT_MAP_SIZE)),
     mWrappedJSMap(JSObject2WrappedJSMap::newMap(XPC_JS_MAP_SIZE)),
-@@ -848,22 +802,17 @@
+@@ -848,22 +802,17 @@ XPCJSRuntime::XPCJSRuntime(nsXPConnect* 
      if(mJSRuntimeService)
      {
          NS_ADDREF(mJSRuntimeService);
 -        mJSRuntimeService->GetRuntime(&mJSRuntime);
      }
  
      NS_ASSERTION(!gOldJSGCCallback, "XPCJSRuntime created more than once");
 -    if(mJSRuntime)
@@ -2517,38 +2559,38 @@ diff --git a/js/src/xpconnect/src/xpcjsr
  #ifdef DEBUG
 -    if(mJSRuntime && !JS_GetGlobalDebugHooks(mJSRuntime)->debuggerHandler)
 -        xpc_InstallJSDebuggerKeywordHandler(mJSRuntime);
 +    if(!JS_GetGlobalDebugHooks(gJSRuntime)->debuggerHandler)
 +        xpc_InstallJSDebuggerKeywordHandler(gJSRuntime);
  #endif
  }
  
-@@ -945,7 +894,7 @@
+@@ -945,7 +894,7 @@ XPCJSRuntime::SyncXPCContextList(JSConte
  
      // add XPCContexts that represent any JSContexts we have not seen before
      JSContext *cur, *iter = nsnull;
 -    while(nsnull != (cur = JS_ContextIterator(mJSRuntime, &iter)))
 +    while(nsnull != (cur = JS_ContextIterator(gJSRuntime, &iter)))
      {
          XPCContext* xpcc = mContextMap->Find(cur);
  
-@@ -1078,7 +1027,7 @@
+@@ -1078,7 +1027,7 @@ XPCJSRuntime::DebugDump(PRInt16 depth)
      XPC_LOG_ALWAYS(("XPCJSRuntime @ %x", this));
          XPC_LOG_INDENT();
          XPC_LOG_ALWAYS(("mXPConnect @ %x", mXPConnect));
 -        XPC_LOG_ALWAYS(("mJSRuntime @ %x", mJSRuntime));
 +        XPC_LOG_ALWAYS(("gJSRuntime @ %x", gJSRuntime));
          XPC_LOG_ALWAYS(("mMapLock @ %x", mMapLock));
          XPC_LOG_ALWAYS(("mJSRuntimeService @ %x", mJSRuntimeService));
  
 diff --git a/js/src/xpconnect/src/xpcmodule.cpp b/js/src/xpconnect/src/xpcmodule.cpp
 --- a/js/src/xpconnect/src/xpcmodule.cpp
 +++ b/js/src/xpconnect/src/xpcmodule.cpp
-@@ -130,7 +130,6 @@
+@@ -130,7 +130,6 @@ xpcModuleDtor(nsIModule* self)
  {
      // Release our singletons
      nsXPConnect::ReleaseXPConnectSingleton();
 -    nsXPCThreadJSContextStackImpl::FreeSingleton();
      nsJSRuntimeServiceImpl::FreeSingleton();
      xpc_DestroyJSxIDClassObjects();
  #ifdef XPC_IDISPATCH_SUPPORT
 diff --git a/js/src/xpconnect/src/xpcprivate.h b/js/src/xpconnect/src/xpcprivate.h
@@ -2557,63 +2599,63 @@ diff --git a/js/src/xpconnect/src/xpcpri
 @@ -52,6 +52,7 @@
  #include <math.h>
  #include "nscore.h"
  #include "nsXPCOM.h"
 +#include "nsXPCOMPrivate.h" // for gJSRuntime
  #include "nsAutoPtr.h"
  #include "nsCycleCollectionParticipant.h"
  #include "nsISupports.h"
-@@ -570,7 +571,7 @@
+@@ -576,7 +577,7 @@ public:
      static XPCJSRuntime* newXPCJSRuntime(nsXPConnect* aXPConnect,
                                           nsIJSRuntimeService* aJSRuntimeService);
  
 -    JSRuntime*     GetJSRuntime() const {return mJSRuntime;}
 +    static JSRuntime* GetJSRuntime() {return gJSRuntime;}
      nsXPConnect*   GetXPConnect() const {return mXPConnect;}
  
      nsIJSRuntimeService* GetJSRuntimeService() const {return mJSRuntimeService;}
-@@ -659,9 +660,6 @@
+@@ -665,9 +666,6 @@ public:
          return mStrings[index];
      }
  
 -    static void JS_DLL_CALLBACK TraceJS(JSTracer* trc, void* data);
 -    void TraceXPConnectRoots(JSTracer *trc);
 -
      static JSBool JS_DLL_CALLBACK GCCallback(JSContext *cx, JSGCStatus status);
  
      inline void AddVariantRoot(XPCTraceableVariant* variant);
-@@ -710,7 +708,6 @@
+@@ -716,7 +714,6 @@ private:
      jsval mStrJSVals[IDX_TOTAL_COUNT];
  
      nsXPConnect* mXPConnect;
 -    JSRuntime*  mJSRuntime;
      nsIJSRuntimeService* mJSRuntimeService; // hold this to hold the JSRuntime
      JSContext2XPCContextMap* mContextMap;
      JSObject2WrappedJSMap*   mWrappedJSMap;
-@@ -1203,9 +1200,6 @@
+@@ -1209,9 +1206,6 @@ public:
  
      static void
      SystemIsBeingShutDown(JSContext* cx);
 -
 -    static void
 -    TraceJS(JSTracer* trc, XPCJSRuntime* rt);
  
      static void
      FinishedMarkPhaseOfGC(JSContext* cx, XPCJSRuntime* rt);
-@@ -2240,8 +2234,6 @@
+@@ -2246,8 +2240,6 @@ public:
                          nsIClassInfo* classInfo,
                          XPCNativeScriptableCreateInfo* sciProto);
  
 -    JSBool HasExternalReference() const {return mRefCnt > 1;}
 -
      JSObject* GetWrapper()              { return mWrapper; }
      void      SetWrapper(JSObject *obj) { mWrapper = obj; }
  
-@@ -2470,21 +2462,8 @@
+@@ -2477,21 +2469,8 @@ public:
      JSBool IsValid() const {return mJSObj != nsnull;}
      void SystemIsBeingShutDown(JSRuntime* rt);
  
 -    // This is used by XPCJSRuntime::GCCallback to find wrappers that no
 -    // longer root their JSObject and are only still alive because they
 -    // were being used via nsSupportsWeakReference at the time when their
 -    // last (outside) reference was released. Wrappers that fit into that
 -    // category are only deleted when we see that their corresponding JSObject
@@ -2625,25 +2667,25 @@ diff --git a/js/src/xpconnect/src/xpcpri
 -
 -    void TraceJS(JSTracer* trc);
 -#ifdef DEBUG
 -    static void PrintTraceName(JSTracer* trc, char *buf, size_t bufsize);
 -#endif
  
      virtual ~nsXPCWrappedJS();
  protected:
-@@ -3170,7 +3149,6 @@
+@@ -3177,7 +3156,6 @@ public:
      static nsXPCThreadJSContextStackImpl* GetSingleton();
  
      static void InitStatics() { gXPCThreadJSContextStack = nsnull; }
 -    static void FreeSingleton();
  
      nsXPCThreadJSContextStackImpl();
      virtual ~nsXPCThreadJSContextStackImpl();
-@@ -3248,12 +3226,11 @@
+@@ -3255,12 +3233,11 @@ class nsJSRuntimeServiceImpl : public ns
  
      static void FreeSingleton();
  
 -    nsJSRuntimeServiceImpl();
 -    virtual ~nsJSRuntimeServiceImpl();
 +    nsJSRuntimeServiceImpl() {}
 +    ~nsJSRuntimeServiceImpl() {}
  
@@ -2651,17 +2693,17 @@ diff --git a/js/src/xpconnect/src/xpcpri
   protected:
 -    JSRuntime *mRuntime;
      static nsJSRuntimeServiceImpl* gJSRuntimeService;
      nsCOMPtr<nsIXPCScriptable> mBackstagePass;
  };
 diff --git a/js/src/xpconnect/src/xpcruntimesvc.cpp b/js/src/xpconnect/src/xpcruntimesvc.cpp
 --- a/js/src/xpconnect/src/xpcruntimesvc.cpp
 +++ b/js/src/xpconnect/src/xpcruntimesvc.cpp
-@@ -187,24 +187,6 @@
+@@ -187,24 +187,6 @@ BackstagePass::GetClassIDNoAlloc(nsCID *
   * is using it.
   */
  
 -nsJSRuntimeServiceImpl::nsJSRuntimeServiceImpl() :
 -    mRuntime(0)
 -{
 -}
 -
@@ -2676,52 +2718,52 @@ diff --git a/js/src/xpconnect/src/xpcrun
 -    }
 -
 -    XPCPerThreadData::ShutDown();
 -}
 -
  NS_IMPL_THREADSAFE_ISUPPORTS2(nsJSRuntimeServiceImpl,
                                nsIJSRuntimeService,
                                nsISupportsWeakReference)
-@@ -242,8 +224,8 @@
+@@ -242,8 +224,8 @@ nsJSRuntimeServiceImpl::GetRuntime(JSRun
      if(!runtime)
          return NS_ERROR_NULL_POINTER;
  
 -    if(!mRuntime)
 -    {
 +#if 0
 +        // XXXbsmedberg: this comment is completely out of date
          // Call XPCPerThreadData::GetData to initialize 
          // XPCPerThreadData::gTLSIndex before initializing 
          // JSRuntime::threadTPIndex in JS_NewRuntime.
-@@ -261,10 +243,6 @@
+@@ -261,10 +243,6 @@ nsJSRuntimeServiceImpl::GetRuntime(JSRun
          // the same order of calling PR_NewThreadPrivateIndex.
          XPCPerThreadData::GetData(nsnull);
          
 -        mRuntime = JS_NewRuntime(gGCSize);
 -        if(!mRuntime)
 -            return NS_ERROR_OUT_OF_MEMORY;
 -
          // Unconstrain the runtime's threshold on nominal heap size, to avoid
          // triggering GC too often if operating continuously near an arbitrary
          // finite threshold (0xffffffff is infinity for uint32 parameters).
-@@ -273,7 +251,8 @@
+@@ -273,7 +251,8 @@ nsJSRuntimeServiceImpl::GetRuntime(JSRun
          // the GC's allocator.
          JS_SetGCParameter(mRuntime, JSGC_MAX_BYTES, 0xffffffff);
      }
 -    *runtime = mRuntime;
 +#endif
 +    *runtime = gJSRuntime;
      return NS_OK;
  }
  
 diff --git a/js/src/xpconnect/src/xpcthreadcontext.cpp b/js/src/xpconnect/src/xpcthreadcontext.cpp
 --- a/js/src/xpconnect/src/xpcthreadcontext.cpp
 +++ b/js/src/xpconnect/src/xpcthreadcontext.cpp
-@@ -323,21 +323,6 @@
+@@ -323,21 +323,6 @@ nsXPCThreadJSContextStackImpl::GetSingle
      return gXPCThreadJSContextStack;
  }
  
 -void
 -nsXPCThreadJSContextStackImpl::FreeSingleton()
 -{
 -    nsXPCThreadJSContextStackImpl* tcs = gXPCThreadJSContextStack;
 -    if(tcs)
@@ -2736,17 +2778,17 @@ diff --git a/js/src/xpconnect/src/xpcthr
 -}
 -
  /* readonly attribute PRInt32 Count; */
  NS_IMETHODIMP
  nsXPCThreadJSContextStackImpl::GetCount(PRInt32 *aCount)
 diff --git a/js/src/xpconnect/src/xpcwrappedjs.cpp b/js/src/xpconnect/src/xpcwrappedjs.cpp
 --- a/js/src/xpconnect/src/xpcwrappedjs.cpp
 +++ b/js/src/xpconnect/src/xpcwrappedjs.cpp
-@@ -96,91 +96,6 @@
+@@ -96,91 +96,6 @@ nsXPCWrappedJS::QueryInterface(REFNSIID 
  
      return mClass->DelegatedQueryInterface(this, aIID, aInstancePtr);
  }
 -
 -
 -// Refcounting is now similar to that used in the chained (pre-flattening)
 -// wrappednative system.
 -//
@@ -2828,17 +2870,17 @@ diff --git a/js/src/xpconnect/src/xpcwra
 -                                            (trc->debugPrintArg);
 -    JS_snprintf(buf, bufsize, "nsXPCWrappedJS[%s,0x%p].mJSObj",
 -                self->GetClass()->GetInterfaceName(), self);
 -}
 -#endif
  
  NS_IMETHODIMP
  nsXPCWrappedJS::GetWeakReference(nsIWeakReference** aInstancePtr)
-@@ -353,15 +268,10 @@
+@@ -353,15 +268,10 @@ nsXPCWrappedJS::nsXPCWrappedJS(XPCCallCo
  
  nsXPCWrappedJS::~nsXPCWrappedJS()
  {
 -    NS_PRECONDITION(0 == mRefCnt, "refcounting error");
 -
 +    XPCJSRuntime* rt = nsXPConnect::GetRuntime();
      if(mRoot == this)
      {
@@ -2846,66 +2888,66 @@ diff --git a/js/src/xpconnect/src/xpcwra
 -        ClearWeakReferences();
 -
 -        // Remove this root wrapper from the map
 -        XPCJSRuntime* rt = nsXPConnect::GetRuntime();
 +        // remove this root wrapper from the map
          if(rt)
          {
              JSObject2WrappedJSMap* map = rt->GetWrappedJSMap();
-@@ -533,7 +443,7 @@
+@@ -533,7 +443,7 @@ nsXPCWrappedJS::DebugDump(PRInt16 depth)
  nsXPCWrappedJS::DebugDump(PRInt16 depth)
  {
  #ifdef DEBUG
 -    XPC_LOG_ALWAYS(("nsXPCWrappedJS @ %x with mRefCnt = %d", this, mRefCnt.get()));
 +    XPC_LOG_ALWAYS(("nsXPCWrappedJS @ %x", this));
          XPC_LOG_INDENT();
  
          PRBool isRoot = mRoot == this;
 diff --git a/js/src/xpconnect/src/xpcwrappedjsclass.cpp b/js/src/xpconnect/src/xpcwrappedjsclass.cpp
 --- a/js/src/xpconnect/src/xpcwrappedjsclass.cpp
 +++ b/js/src/xpconnect/src/xpcwrappedjsclass.cpp
-@@ -1740,7 +1740,7 @@
+@@ -1795,7 +1795,7 @@ nsXPCWrappedJSClass::DebugDump(PRInt16 d
  {
  #ifdef DEBUG
      depth-- ;
 -    XPC_LOG_ALWAYS(("nsXPCWrappedJSClass @ %x with mRefCnt = %d", this, mRefCnt.get()));
 +    XPC_LOG_ALWAYS(("nsXPCWrappedJSClass @ %x", this));
      XPC_LOG_INDENT();
          char* name;
          mInfo->GetName(&name);
 diff --git a/js/src/xpconnect/src/xpcwrappednative.cpp b/js/src/xpconnect/src/xpcwrappednative.cpp
 --- a/js/src/xpconnect/src/xpcwrappednative.cpp
 +++ b/js/src/xpconnect/src/xpcwrappednative.cpp
-@@ -818,12 +818,6 @@
+@@ -837,12 +837,6 @@ XPCWrappedNative::Init(XPCCallContext& c
          mFlatJSObject = nsnull;
          return JS_FALSE;
      }
 -
 -    // This reference will be released when mFlatJSObject is finalized.
 -    // Since this reference will push the refcount to 2 it will also root
 -    // mFlatJSObject;
 -    NS_ASSERTION(1 == mRefCnt, "unexpected refcount value");
 -    NS_ADDREF(this);
  
      if(si && si->GetFlags().WantCreate() &&
         NS_FAILED(si->GetCallback()->Create(this, ccx, mFlatJSObject)))
-@@ -2629,7 +2623,7 @@
+@@ -2648,7 +2642,7 @@ NS_IMETHODIMP XPCWrappedNative::DebugDum
  {
  #ifdef DEBUG
      depth-- ;
 -    XPC_LOG_ALWAYS(("XPCWrappedNative @ %x with mRefCnt = %d", this, mRefCnt.get()));
 +    XPC_LOG_ALWAYS(("XPCWrappedNative @ %x", this));
      XPC_LOG_INDENT();
  
          if(HasProto())
 diff --git a/js/src/xpconnect/src/xpcwrappednativescope.cpp b/js/src/xpconnect/src/xpcwrappednativescope.cpp
 --- a/js/src/xpconnect/src/xpcwrappednativescope.cpp
 +++ b/js/src/xpconnect/src/xpcwrappednativescope.cpp
-@@ -348,36 +348,6 @@
+@@ -348,36 +348,6 @@ XPCWrappedNativeScope::GetPrototypeNoHel
      }
  
      return mPrototypeNoHelper;
 -}
 -
 -JS_STATIC_DLL_CALLBACK(JSDHashOperator)
 -WrappedNativeJSGCThingTracer(JSDHashTable *table, JSDHashEntryHdr *hdr,
 -                             uint32 number, void *arg)
@@ -2935,17 +2977,17 @@ diff --git a/js/src/xpconnect/src/xpcwra
 -        cur->mWrappedNativeMap->Enumerate(WrappedNativeJSGCThingTracer, trc);
 -    }
  }
  
  // static
 diff --git a/js/src/xpconnect/tests/components/xpctest_noisy.cpp b/js/src/xpconnect/tests/components/xpctest_noisy.cpp
 --- a/js/src/xpconnect/tests/components/xpctest_noisy.cpp
 +++ b/js/src/xpconnect/tests/components/xpctest_noisy.cpp
-@@ -60,28 +60,6 @@
+@@ -60,28 +60,6 @@ int xpctestNoisy::sID = 0;
  int xpctestNoisy::sID = 0;
  int xpctestNoisy::sCount = 0;
  
 -
 -NS_IMETHODIMP_(nsrefcnt) xpctestNoisy::AddRef(void)
 -{
 -  NS_PRECONDITION(PRInt32(mRefCnt) >= 0, "illegal refcnt");
 -  ++mRefCnt;
@@ -2967,36 +3009,36 @@ diff --git a/js/src/xpconnect/tests/comp
 -  return mRefCnt;
 -}
  
  NS_IMETHODIMP
  xpctestNoisy::QueryInterface(REFNSIID iid, void** result)
 diff --git a/layout/build/nsLayoutStatics.cpp b/layout/build/nsLayoutStatics.cpp
 --- a/layout/build/nsLayoutStatics.cpp
 +++ b/layout/build/nsLayoutStatics.cpp
-@@ -245,7 +245,6 @@
+@@ -245,7 +245,6 @@ nsLayoutStatics::Shutdown()
    nsDOMStorageManager::Shutdown();
    txMozillaXSLTProcessor::Shutdown();
    nsDOMAttribute::Shutdown();
 -  nsDOMEventRTTearoff::Shutdown();
    nsEventListenerManager::Shutdown();
    nsContentList::Shutdown();
    nsComputedDOMStyle::Shutdown();
-@@ -292,7 +291,6 @@
+@@ -292,7 +291,6 @@ nsLayoutStatics::Shutdown()
  
    nsAttrValue::Shutdown();
    nsContentUtils::Shutdown();
 -  nsNodeInfo::ClearCache();
    nsLayoutStylesheetCache::Shutdown();
    NS_NameSpaceManagerShutdown();
    nsStyleSet::FreeGlobals();
 diff --git a/layout/generic/nsGfxScrollFrame.cpp b/layout/generic/nsGfxScrollFrame.cpp
 --- a/layout/generic/nsGfxScrollFrame.cpp
 +++ b/layout/generic/nsGfxScrollFrame.cpp
-@@ -844,18 +844,6 @@
+@@ -849,18 +849,6 @@ nsHTMLScrollFrame::Reflow(nsPresContext*
    return rv;
  }
  
 -NS_IMETHODIMP_(nsrefcnt) 
 -nsHTMLScrollFrame::AddRef(void)
 -{
 -  return NS_OK;
 -}
@@ -3005,17 +3047,17 @@ diff --git a/layout/generic/nsGfxScrollF
 -nsHTMLScrollFrame::Release(void)
 -{
 -    return NS_OK;
 -}
 -
  #ifdef NS_DEBUG
  NS_IMETHODIMP
  nsHTMLScrollFrame::GetFrameName(nsAString& aResult) const
-@@ -1190,18 +1178,6 @@
+@@ -1195,18 +1183,6 @@ nsXULScrollFrame::GetMinWidth(nsIRenderi
  }
  #endif
  
 -NS_IMETHODIMP_(nsrefcnt) 
 -nsXULScrollFrame::AddRef(void)
 -{
 -  return NS_OK;
 -}
@@ -3024,17 +3066,17 @@ diff --git a/layout/generic/nsGfxScrollF
 -nsXULScrollFrame::Release(void)
 -{
 -    return NS_OK;
 -}
 -
  #ifdef NS_DEBUG
  NS_IMETHODIMP
  nsXULScrollFrame::GetFrameName(nsAString& aResult) const
-@@ -1274,16 +1250,6 @@
+@@ -1279,16 +1255,6 @@ nsGfxScrollFrameInner::nsGfxScrollFrameI
  
  nsGfxScrollFrameInner::~nsGfxScrollFrameInner()
  {
 -}
 -
 -NS_IMETHODIMP_(nsrefcnt) nsGfxScrollFrameInner::AddRef(void)
 -{
 -  return 2;
@@ -3044,29 +3086,29 @@ diff --git a/layout/generic/nsGfxScrollF
 -{
 -  return 1;
  }
  
  NS_IMPL_QUERY_INTERFACE1(nsGfxScrollFrameInner, nsIScrollPositionListener)
 diff --git a/layout/generic/nsGfxScrollFrame.h b/layout/generic/nsGfxScrollFrame.h
 --- a/layout/generic/nsGfxScrollFrame.h
 +++ b/layout/generic/nsGfxScrollFrame.h
-@@ -65,8 +65,6 @@
+@@ -66,8 +66,6 @@ class nsGfxScrollFrameInner : public nsI
                                public nsIReflowCallback {
  public:
    NS_IMETHOD QueryInterface(REFNSIID aIID, void** aInstancePtr);
 -  NS_IMETHOD_(nsrefcnt) AddRef(void);
 -  NS_IMETHOD_(nsrefcnt) Release(void);
  
    nsGfxScrollFrameInner(nsContainerFrame* aOuter, PRBool aIsRoot,
                          PRBool aIsXUL);
 diff --git a/layout/generic/nsSelection.cpp b/layout/generic/nsSelection.cpp
 --- a/layout/generic/nsSelection.cpp
 +++ b/layout/generic/nsSelection.cpp
-@@ -4039,44 +4039,12 @@
+@@ -4038,44 +4038,12 @@ NS_INTERFACE_MAP_END
  NS_INTERFACE_MAP_END
  
  
 -NS_IMETHODIMP_(nsrefcnt)
 -nsTypedSelection::AddRef()
 -{
 -  if (mFrameSelection) {
 -    return mFrameSelection->AddRef();
@@ -3113,17 +3155,17 @@ diff --git a/layout/style/nsCSSDeclarati
  #include "nsCSSDataBlock.h"
  #include "nsCSSStruct.h"
  
 -class nsCSSDeclaration {
 +class nsCSSDeclaration : public XPCOMGCFinalizedObject {
  public:
    /**
     * Construct an |nsCSSDeclaration| that is in an invalid state (null
-@@ -221,28 +221,19 @@
+@@ -221,28 +221,19 @@ private:
                                            nsAString& aResult) const;
  
  private:
 -    //
 -    // Specialized ref counting.
 -    // We do not want everyone to ref count us, only the rules which hold
 -    //  onto us (our well defined lifetime is when the last rule releases
 -    //  us).
@@ -3144,17 +3186,17 @@ diff --git a/layout/style/nsCSSDeclarati
 +      NS_NOTREACHED("Stop!");
      }
  public:
      void RuleAbort(void) {
 -      NS_ASSERTION(0 == mRefCnt, "bad RuleAbort");
        delete this;
      }
  private:
-@@ -255,7 +246,6 @@
+@@ -255,7 +246,6 @@ private:
  
  private:
      nsAutoTArray<PRUint8, 8> mOrder;
 -    nsAutoRefCnt mRefCnt;
      nsCSSCompressedDataBlock *mData; // never null, except while expanded
      nsCSSCompressedDataBlock *mImportantData; // may be null
  };
 diff --git a/layout/style/nsCSSRule.cpp b/layout/style/nsCSSRule.cpp
@@ -3176,17 +3218,17 @@ diff --git a/layout/style/nsCSSRule.cpp 
 -    mSheet(aCopy.mSheet),
 +  : mSheet(aCopy.mSheet),
      mParentRule(aCopy.mParentRule)
  {
  }
 diff --git a/layout/style/nsCSSRule.h b/layout/style/nsCSSRule.h
 --- a/layout/style/nsCSSRule.h
 +++ b/layout/style/nsCSSRule.h
-@@ -48,17 +48,13 @@
+@@ -48,17 +48,13 @@ struct nsRuleData;
  struct nsRuleData;
  class nsICSSGroupRule;
  
 -class nsCSSRule {
 +class nsCSSRule : public XPCOMGCFinalizedObject {
  public:
    nsCSSRule(void);
    nsCSSRule(const nsCSSRule& aCopy);
@@ -3198,40 +3240,40 @@ diff --git a/layout/style/nsCSSRule.h b/
  protected:
 -  nsAutoRefCnt mRefCnt;
    NS_DECL_OWNINGTHREAD
  public:
  
 diff --git a/layout/style/nsCSSStyleRule.cpp b/layout/style/nsCSSStyleRule.cpp
 --- a/layout/style/nsCSSStyleRule.cpp
 +++ b/layout/style/nsCSSStyleRule.cpp
-@@ -816,11 +816,6 @@
+@@ -817,11 +817,6 @@ public:
                                              nsICSSParser** aCSSParser);
    virtual nsresult DeclarationChanged();
  
 -  // Override |AddRef| and |Release| for being a member of
 -  // |DOMCSSStyleRuleImpl|.
 -  NS_IMETHOD_(nsrefcnt) AddRef(void);
 -  NS_IMETHOD_(nsrefcnt) Release(void);
 -
    friend class DOMCSSStyleRuleImpl;
  
  protected:
 diff --git a/layout/style/nsCSSStyleSheet.cpp b/layout/style/nsCSSStyleSheet.cpp
 --- a/layout/style/nsCSSStyleSheet.cpp
 +++ b/layout/style/nsCSSStyleSheet.cpp
-@@ -623,7 +623,6 @@
+@@ -624,7 +624,6 @@ nsCSSStyleSheetInner::RebuildNameSpaces(
  
  nsCSSStyleSheet::nsCSSStyleSheet()
    : nsICSSStyleSheet(),
 -    mRefCnt(0),
      mTitle(), 
      mMedia(nsnull),
      mFirstChild(nsnull), 
-@@ -648,7 +647,6 @@
+@@ -649,7 +648,6 @@ nsCSSStyleSheet::nsCSSStyleSheet(const n
                                   nsIDocument* aDocumentToUse,
                                   nsIDOMNode* aOwningNodeToUse)
    : nsICSSStyleSheet(),
 -    mRefCnt(0),
      mTitle(aCopy.mTitle), 
      mMedia(nsnull),
      mFirstChild(nsnull), 
 diff --git a/layout/style/nsComputedDOMStyle.cpp b/layout/style/nsComputedDOMStyle.cpp
@@ -3265,30 +3307,30 @@ diff --git a/layout/style/nsComputedDOMS
 -  }
 -
 -  NS_ADDREF(*aComputedStyle);
 +  *aComputedStyle = new nsComputedDOMStyle();
 +  NS_ENSURE_TRUE(*aComputedStyle, NS_ERROR_OUT_OF_MEMORY);
  
    return NS_OK;
  }
-@@ -129,12 +115,6 @@
+@@ -129,12 +115,6 @@ void
  void
  nsComputedDOMStyle::Shutdown()
  {
 -  // We want to de-allocate without calling the dtor since we
 -  // already did that manually in doDestroyComputedDOMStyle(),
 -  // so cast our cached object to something that doesn't know
 -  // about our dtor.
 -  delete reinterpret_cast<char*>(sCachedComputedDOMStyle);
 -  sCachedComputedDOMStyle = nsnull;
  }
  
  
-@@ -148,26 +128,6 @@
+@@ -148,26 +128,6 @@ NS_INTERFACE_MAP_BEGIN(nsComputedDOMStyl
    NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIComputedDOMStyle)
    NS_INTERFACE_MAP_ENTRY_CONTENT_CLASSINFO(ComputedCSSStyleDeclaration)
  NS_INTERFACE_MAP_END
 -
 -
 -static void doDestroyComputedDOMStyle(nsComputedDOMStyle *aComputedStyle)
 -{
 -  if (!sCachedComputedDOMStyle) {
@@ -3320,41 +3362,41 @@ diff --git a/layout/style/nsComputedDOMS
 -class nsComputedDOMStyle : public nsIComputedDOMStyle
 +class nsComputedDOMStyle : public XPCOMGCFinalizedObject, public nsIComputedDOMStyle
  {
  public:
    NS_DECL_ISUPPORTS
 diff --git a/layout/style/nsDOMCSSAttrDeclaration.h b/layout/style/nsDOMCSSAttrDeclaration.h
 --- a/layout/style/nsDOMCSSAttrDeclaration.h
 +++ b/layout/style/nsDOMCSSAttrDeclaration.h
-@@ -55,10 +55,6 @@
+@@ -55,10 +55,6 @@ public:
    nsDOMCSSAttributeDeclaration(nsIContent *aContent);
    ~nsDOMCSSAttributeDeclaration();
  
 -  // impl AddRef/Release; QI is implemented by our parent class
 -  NS_IMETHOD_(nsrefcnt) AddRef(void);
 -  NS_IMETHOD_(nsrefcnt) Release(void);
 -
    virtual void DropReference();
    // If GetCSSDeclaration returns non-null, then the decl it returns
    // is owned by our current style rule.
-@@ -74,9 +70,6 @@
+@@ -74,9 +70,6 @@ protected:
  protected:
    virtual nsresult DeclarationChanged();
    
 -  nsAutoRefCnt mRefCnt;
 -  NS_DECL_OWNINGTHREAD
 -
    nsIContent *mContent;
  };
  
 diff --git a/layout/style/nsDOMCSSDeclaration.cpp b/layout/style/nsDOMCSSDeclaration.cpp
 --- a/layout/style/nsDOMCSSDeclaration.cpp
 +++ b/layout/style/nsDOMCSSDeclaration.cpp
-@@ -358,18 +358,6 @@
+@@ -358,18 +358,6 @@ CSS2PropertiesTearoff::~CSS2PropertiesTe
  {
  }
  
 -NS_IMETHODIMP_(nsrefcnt)
 -CSS2PropertiesTearoff::AddRef(void)
 -{
 -  return mOuter->AddRef();
 -}
@@ -3366,53 +3408,53 @@ diff --git a/layout/style/nsDOMCSSDeclar
 -}
 -
  NS_IMETHODIMP
  CSS2PropertiesTearoff::QueryInterface(REFNSIID aIID, void** aInstancePtr)
  {
 diff --git a/layout/style/nsDOMCSSDeclaration.h b/layout/style/nsDOMCSSDeclaration.h
 --- a/layout/style/nsDOMCSSDeclaration.h
 +++ b/layout/style/nsDOMCSSDeclaration.h
-@@ -64,7 +64,7 @@
+@@ -64,7 +64,7 @@ private:
    nsICSSDeclaration* mOuter;
  };
  
 -class nsDOMCSSDeclaration : public nsICSSDeclaration
 +class nsDOMCSSDeclaration : public XPCOMGCFinalizedObject, public nsICSSDeclaration
  {
  public:
    nsDOMCSSDeclaration();
 diff --git a/layout/style/nsHTMLCSSStyleSheet.cpp b/layout/style/nsHTMLCSSStyleSheet.cpp
 --- a/layout/style/nsHTMLCSSStyleSheet.cpp
 +++ b/layout/style/nsHTMLCSSStyleSheet.cpp
-@@ -391,7 +391,6 @@
+@@ -391,7 +391,6 @@ protected:
  
  HTMLCSSStyleSheetImpl::HTMLCSSStyleSheetImpl()
    : nsIHTMLCSSStyleSheet(),
 -    mRefCnt(0),
      mURL(nsnull),
      mDocument(nsnull),
      mFirstLineRule(nsnull),
 diff --git a/layout/svg/base/src/nsSVGGlyphFrame.h b/layout/svg/base/src/nsSVGGlyphFrame.h
 --- a/layout/svg/base/src/nsSVGGlyphFrame.h
 +++ b/layout/svg/base/src/nsSVGGlyphFrame.h
-@@ -53,7 +53,8 @@
+@@ -53,7 +53,8 @@ typedef nsSVGGeometryFrame nsSVGGlyphFra
  typedef nsSVGGeometryFrame nsSVGGlyphFrameBase;
  
  class nsSVGGlyphFrame : public nsSVGGlyphFrameBase,
 -                        public nsISVGGlyphFragmentLeaf, // : nsISVGGlyphFragmentNode
 +                        public nsISVGGlyphFragmentLeaf,
 +                   // : nsISVGGlyphFragmentNode
                          public nsISVGChildFrame
  {
    friend nsIFrame*
 diff --git a/layout/tables/nsTableRowGroupFrame.cpp b/layout/tables/nsTableRowGroupFrame.cpp
 --- a/layout/tables/nsTableRowGroupFrame.cpp
 +++ b/layout/tables/nsTableRowGroupFrame.cpp
-@@ -65,15 +65,6 @@
+@@ -65,15 +65,6 @@ nsTableRowGroupFrame::~nsTableRowGroupFr
  }
  
  /* ----------- nsTableRowGroupFrame ---------- */
 -nsrefcnt nsTableRowGroupFrame::AddRef(void)
 -{
 -  return 1;//implementation of nsLineIterator
 -}
 -
@@ -3421,17 +3463,17 @@ diff --git a/layout/tables/nsTableRowGro
 -  return 1;//implementation of nsLineIterator
 -}
  
  NS_IMETHODIMP
  nsTableRowGroupFrame::QueryInterface(const nsIID& aIID, void** aInstancePtr)
 diff --git a/layout/xul/base/src/nsDocElementBoxFrame.cpp b/layout/xul/base/src/nsDocElementBoxFrame.cpp
 --- a/layout/xul/base/src/nsDocElementBoxFrame.cpp
 +++ b/layout/xul/base/src/nsDocElementBoxFrame.cpp
-@@ -149,18 +149,6 @@
+@@ -149,18 +149,6 @@ nsDocElementBoxFrame::CreateAnonymousCon
    return NS_OK;
  }
  
 -NS_IMETHODIMP_(nsrefcnt) 
 -nsDocElementBoxFrame::AddRef(void)
 -{
 -  return NS_OK;
 -}
@@ -3443,17 +3485,17 @@ diff --git a/layout/xul/base/src/nsDocEl
 -}
 -
  NS_INTERFACE_MAP_BEGIN(nsDocElementBoxFrame)
    NS_INTERFACE_MAP_ENTRY(nsIAnonymousContentCreator)
  NS_INTERFACE_MAP_END_INHERITING(nsBoxFrame)
 diff --git a/layout/xul/base/src/nsListBoxBodyFrame.cpp b/layout/xul/base/src/nsListBoxBodyFrame.cpp
 --- a/layout/xul/base/src/nsListBoxBodyFrame.cpp
 +++ b/layout/xul/base/src/nsListBoxBodyFrame.cpp
-@@ -204,20 +204,6 @@
+@@ -204,20 +204,6 @@ nsListBoxBodyFrame::~nsListBoxBodyFrame(
    mAutoScrollTimer = nsnull;
  #endif
  
 -}
 -
 -////////// nsISupports /////////////////
 -
 -NS_IMETHODIMP_(nsrefcnt) 
@@ -3489,17 +3531,17 @@ diff --git a/layout/xul/base/src/nsListI
 -  return NS_OK;
 -}
  
  NS_INTERFACE_MAP_BEGIN(nsListItemFrame)
  NS_INTERFACE_MAP_END_INHERITING(nsGridRowLeafFrame)
 diff --git a/layout/xul/base/src/nsMenuFrame.cpp b/layout/xul/base/src/nsMenuFrame.cpp
 --- a/layout/xul/base/src/nsMenuFrame.cpp
 +++ b/layout/xul/base/src/nsMenuFrame.cpp
-@@ -165,18 +165,6 @@
+@@ -165,18 +165,6 @@ NS_NewMenuFrame(nsIPresShell* aPresShell
      it->SetIsMenu(PR_TRUE);
  
    return it;
 -}
 -
 -NS_IMETHODIMP_(nsrefcnt) 
 -nsMenuFrame::AddRef(void)
 -{
@@ -3511,17 +3553,17 @@ diff --git a/layout/xul/base/src/nsMenuF
 -{
 -    return NS_OK;
  }
  
  //
 diff --git a/layout/xul/base/src/nsRootBoxFrame.cpp b/layout/xul/base/src/nsRootBoxFrame.cpp
 --- a/layout/xul/base/src/nsRootBoxFrame.cpp
 +++ b/layout/xul/base/src/nsRootBoxFrame.cpp
-@@ -333,18 +333,6 @@
+@@ -333,18 +333,6 @@ nsRootBoxFrame::RemoveTooltipSupport(nsI
    return NS_ERROR_NOT_IMPLEMENTED;
  }
  
 -NS_IMETHODIMP_(nsrefcnt) 
 -nsRootBoxFrame::AddRef(void)
 -{
 -  return NS_OK;
 -}
@@ -3533,36 +3575,36 @@ diff --git a/layout/xul/base/src/nsRootB
 -}
 -
  NS_INTERFACE_MAP_BEGIN(nsRootBoxFrame)
    NS_INTERFACE_MAP_ENTRY(nsIRootBox)
  NS_INTERFACE_MAP_END_INHERITING(nsBoxFrame)
 diff --git a/layout/xul/base/src/nsSplitterFrame.cpp b/layout/xul/base/src/nsSplitterFrame.cpp
 --- a/layout/xul/base/src/nsSplitterFrame.cpp
 +++ b/layout/xul/base/src/nsSplitterFrame.cpp
-@@ -267,7 +267,6 @@
+@@ -273,7 +273,6 @@ nsSplitterFrame::Destroy()
    if (mInner) {
      mInner->RemoveListener();
      mInner->Disconnect();
 -    mInner->Release();
      mInner = nsnull;
    }
    nsBoxFrame::Destroy();
-@@ -332,7 +331,6 @@
+@@ -338,7 +337,6 @@ nsSplitterFrame::Init(nsIContent*      a
    if (!mInner)
      return NS_ERROR_OUT_OF_MEMORY;
  
 -  mInner->AddRef();
    mInner->mChildInfosAfter = nsnull;
    mInner->mChildInfosBefore = nsnull;
    mInner->mState = nsSplitterFrameInner::Open;
 diff --git a/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp b/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp
 --- a/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp
 +++ b/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp
-@@ -176,18 +176,6 @@
+@@ -176,18 +176,6 @@ nsTreeBodyFrame::~nsTreeBodyFrame()
    delete mSlots;
  }
  
 -NS_IMETHODIMP_(nsrefcnt) 
 -nsTreeBodyFrame::AddRef(void)
 -{
 -  return NS_OK;
 -}
@@ -3574,17 +3616,17 @@ diff --git a/layout/xul/base/src/tree/sr
 -}
 -
  static void
  GetBorderPadding(nsStyleContext* aContext, nsMargin& aMargin)
  {
 diff --git a/layout/xul/base/src/tree/src/nsTreeColFrame.cpp b/layout/xul/base/src/tree/src/nsTreeColFrame.cpp
 --- a/layout/xul/base/src/tree/src/nsTreeColFrame.cpp
 +++ b/layout/xul/base/src/tree/src/nsTreeColFrame.cpp
-@@ -63,18 +63,6 @@
+@@ -63,18 +63,6 @@ NS_NewTreeColFrame(nsIPresShell* aPresSh
  {
    return new (aPresShell) nsTreeColFrame(aPresShell, aContext, aIsRoot, aLayoutManager);
  } // NS_NewTreeColFrame
 -
 -NS_IMETHODIMP_(nsrefcnt) 
 -nsTreeColFrame::AddRef(void)
 -{
 -  return NS_OK;
@@ -3596,17 +3638,17 @@ diff --git a/layout/xul/base/src/tree/sr
 -  return NS_OK;
 -}
  
  //
  // QueryInterface
 diff --git a/modules/libjar/nsJAR.cpp b/modules/libjar/nsJAR.cpp
 --- a/modules/libjar/nsJAR.cpp
 +++ b/modules/libjar/nsJAR.cpp
-@@ -133,32 +133,12 @@
+@@ -133,32 +133,12 @@ nsJAR::nsJAR(): mManifestData(nsnull, ns
  
  nsJAR::~nsJAR()
  {
 +  mCache->ReleaseZip(this);
    Close();
  }
  
  NS_IMPL_THREADSAFE_QUERY_INTERFACE2(nsJAR, nsIZipReader, nsIJAR)
@@ -3633,48 +3675,48 @@ diff --git a/modules/libjar/nsJAR.cpp b/
 -  return count; 
 -} 
  
  //----------------------------------------------
  // nsIZipReader implementation
 diff --git a/modules/libpref/src/nsPrefBranch.cpp b/modules/libpref/src/nsPrefBranch.cpp
 --- a/modules/libpref/src/nsPrefBranch.cpp
 +++ b/modules/libpref/src/nsPrefBranch.cpp
-@@ -95,10 +95,8 @@
+@@ -95,10 +95,8 @@ nsPrefBranch::nsPrefBranch(const char *a
    nsCOMPtr<nsIObserverService> observerService = 
             do_GetService("@mozilla.org/observer-service;1");
    if (observerService) {
 -    ++mRefCnt;    // Our refcnt must be > 0 when we call this, or we'll get deleted!
      // add weak so we don't have to clean up at shutdown
      observerService->AddObserver(this, NS_XPCOM_SHUTDOWN_OBSERVER_ID, PR_TRUE);
 -    --mRefCnt;
    }
  }
  
 diff --git a/modules/plugin/base/src/nsPluginHostImpl.cpp b/modules/plugin/base/src/nsPluginHostImpl.cpp
 --- a/modules/plugin/base/src/nsPluginHostImpl.cpp
 +++ b/modules/plugin/base/src/nsPluginHostImpl.cpp
-@@ -1331,7 +1331,7 @@
+@@ -1331,7 +1331,7 @@ private:
  
    // local cached file, we save the content into local cache if browser cache is not available,
    // or plugin asks stream as file and it expects file extension until bug 90558 got fixed
 -  nsIFile                 *mLocalCachedFile;
 +  nsCOMPtr<nsIFile>         mLocalCachedFile;
    nsCOMPtr<nsIOutputStream> mFileCacheOutputStream;
    nsHashtable             *mDataForwardToRequest;
  
-@@ -1712,7 +1712,6 @@
+@@ -1712,7 +1712,6 @@ nsPluginStreamListenerPeer::nsPluginStre
    mPendingRequests = 0;
    mHaveFiredOnStartRequest = PR_FALSE;
    mDataForwardToRequest = nsnull;
 -  mLocalCachedFile = nsnull;
  }
  
  
-@@ -1738,25 +1737,9 @@
+@@ -1738,25 +1737,9 @@ nsPluginStreamListenerPeer::~nsPluginStr
    if (mFileCacheOutputStream)
      mFileCacheOutputStream = nsnull;
  
 -  // if we have mLocalCachedFile lets release it
 -  // and it'll be fiscally remove if refcnt == 1
 -  if (mLocalCachedFile) {
 -    nsrefcnt refcnt;
 -    NS_RELEASE2(mLocalCachedFile, refcnt);
@@ -3693,58 +3735,58 @@ diff --git a/modules/plugin/base/src/nsP
 -    }
 -  }
 +  // XXXbsmedberg: previously we would do dark magic to see if anyone else
 +  // was holding a reference to mLocalCachedFile and if not, we'd remove it.
 +  // Now we just punt
  
    delete mDataForwardToRequest;
  }
-@@ -1926,7 +1909,7 @@
+@@ -1926,7 +1909,7 @@ nsPluginStreamListenerPeer::SetupPluginC
              (useExistingCacheFile =
               lp->mPluginStreamInfo->UseExistingPluginCacheFile(mPluginStreamInfo)))
          {
 -            NS_ADDREF(mLocalCachedFile = lp->mLocalCachedFile);
 +            mLocalCachedFile = lp->mLocalCachedFile;
          }
          NS_RELEASE(lp);
        }
-@@ -1972,10 +1955,7 @@
+@@ -1972,10 +1955,7 @@ nsPluginStreamListenerPeer::SetupPluginC
        return rv;
  
      // save the file.
 -    CallQueryInterface(pluginTmp, &mLocalCachedFile); // no need to check return value, just addref
 -    // add one extra refcnt, we can use NS_RELEASE2(mLocalCachedFile...) in dtor
 -    // to remove this file when refcnt == 1
 -    NS_ADDREF(mLocalCachedFile);
 +    mLocalCachedFile = do_QueryInterface(pluginTmp);
    }
  
    // add this listenerPeer to list of stream peers for this instance
-@@ -2403,7 +2383,7 @@
+@@ -2403,7 +2383,7 @@ NS_IMETHODIMP nsPluginStreamListenerPeer
  
    // call OnFileAvailable if plugin requests stream type StreamType_AsFile or StreamType_AsFileOnly
    if (mStreamType >= nsPluginStreamType_AsFile) {
 -    nsCOMPtr<nsIFile> localFile = do_QueryInterface(mLocalCachedFile);
 +    nsCOMPtr<nsIFile> localFile = mLocalCachedFile;
      if (!localFile) {
        nsCOMPtr<nsICachingChannel> cacheChannel = do_QueryInterface(request);
        if (cacheChannel) {
-@@ -6484,7 +6464,6 @@
+@@ -6484,7 +6464,6 @@ NS_IMETHODIMP nsPluginHostImpl::Observe(
      OnShutdown();
      Destroy();
      UnloadUnusedLibraries();
 -    sInst->Release();
    }
    if (!nsCRT::strcmp(NS_PREFBRANCH_PREFCHANGE_TOPIC_ID, aTopic)) {
      NS_ASSERTION(someData &&
 diff --git a/modules/plugin/tools/sdk/samples/simple/Makefile.in b/modules/plugin/tools/sdk/samples/simple/Makefile.in
 --- a/modules/plugin/tools/sdk/samples/simple/Makefile.in
 +++ b/modules/plugin/tools/sdk/samples/simple/Makefile.in
-@@ -52,11 +52,9 @@
+@@ -52,11 +52,9 @@ NO_DIST_INSTALL = 1
  NO_DIST_INSTALL = 1
  NO_INSTALL = 1
  
 -CPPSRCS = nsScriptablePeer.cpp \
 +CPPSRCS = \
            plugin.cpp \
            $(NULL)
 -
@@ -4055,17 +4097,17 @@ diff --git a/modules/plugin/tools/sdk/sa
 -
 -// service manager which will give the access to all public browser services
 -// we will use memory service as an illustration
 -nsIServiceManager * gServiceManager = NULL;
 +#include <string.h>
  
  // Unix needs this
  #ifdef XP_UNIX
-@@ -81,28 +75,11 @@
+@@ -81,28 +75,11 @@ NPError NS_PluginGetValue(NPPVariable aV
  //
  NPError NS_PluginInitialize()
  {
 -  // this is probably a good place to get the service manager
 -  // note that Mozilla will add reference, so do not forget to release
 -  nsISupports * sm = NULL;
 -  
 -  NPN_GetValue(NULL, NPNVserviceManager, &sm);
@@ -4084,17 +4126,17 @@ diff --git a/modules/plugin/tools/sdk/sa
  void NS_PluginShutdown()
  {
 -  // we should release the service manager
 -  NS_IF_RELEASE(gServiceManager);
 -  gServiceManager = NULL;
  }
  
  /////////////////////////////////////////////////////////////
-@@ -130,20 +107,13 @@
+@@ -130,20 +107,13 @@ void NS_DestroyPluginInstance(nsPluginIn
  //
  nsPluginInstance::nsPluginInstance(NPP aInstance) : nsPluginInstanceBase(),
    mInstance(aInstance),
 -  mInitialized(FALSE),
 -  mScriptablePeer(NULL)
 +  mInitialized(FALSE)
  {
    mString[0] = '\0';
@@ -4106,17 +4148,17 @@ diff --git a/modules/plugin/tools/sdk/sa
 -  // so releasing it here does not guarantee that it is over
 -  // we should take precaution in case it will be called later
 -  // and zero its mPlugin member
 -  mScriptablePeer->SetInstance(NULL);
 -  NS_IF_RELEASE(mScriptablePeer);
  }
  
  NPBool nsPluginInstance::init(NPWindow* aWindow)
-@@ -168,86 +138,12 @@
+@@ -168,86 +138,12 @@ void nsPluginInstance::getVersion(char* 
  void nsPluginInstance::getVersion(char* *aVersion)
  {
    const char *ua = NPN_UserAgent(mInstance);
 -  char*& version = *aVersion;
 -
 -  // although we can use NPAPI NPN_MemAlloc call to allocate memory:
 -  //    version = (char*)NPN_MemAlloc(strlen(ua) + 1);
 -  // for illustration purposed we use the service manager to access 
@@ -4208,41 +4250,41 @@ diff --git a/modules/plugin/tools/sdk/sa
 @@ -39,7 +39,6 @@
  #define __PLUGIN_H__
  
  #include "pluginbase.h"
 -#include "nsScriptablePeer.h"
  
  class nsPluginInstance : public nsPluginInstanceBase
  {
-@@ -59,12 +58,9 @@
+@@ -59,12 +58,9 @@ public:
    // locals
    void getVersion(char* *aVersion);
  
 -  nsScriptablePeer* getScriptablePeer();
 -
  private:
    NPP mInstance;
    NPBool mInitialized;
 -  nsScriptablePeer * mScriptablePeer;
  
  public:
    char mString[128];
 diff --git a/netwerk/base/src/nsSocketTransport2.cpp b/netwerk/base/src/nsSocketTransport2.cpp
 --- a/netwerk/base/src/nsSocketTransport2.cpp
 +++ b/netwerk/base/src/nsSocketTransport2.cpp
-@@ -221,6 +221,7 @@
+@@ -221,6 +221,7 @@ nsSocketInputStream::nsSocketInputStream
  
  nsSocketInputStream::~nsSocketInputStream()
  {
 +    Close();
  }
  
  // called on the socket transport thread...
-@@ -259,21 +260,6 @@
+@@ -259,21 +260,6 @@ NS_IMPL_QUERY_INTERFACE2(nsSocketInputSt
  NS_IMPL_QUERY_INTERFACE2(nsSocketInputStream,
                           nsIInputStream,
                           nsIAsyncInputStream)
 -
 -NS_IMETHODIMP_(nsrefcnt)
 -nsSocketInputStream::AddRef()
 -{
 -    PR_AtomicIncrement((PRInt32*)&mReaderRefCnt);
@@ -4254,25 +4296,25 @@ diff --git a/netwerk/base/src/nsSocketTr
 -{
 -    if (PR_AtomicDecrement((PRInt32*)&mReaderRefCnt) == 0)
 -        Close();
 -    return mTransport->Release();
 -}
  
  NS_IMETHODIMP
  nsSocketInputStream::Close()
-@@ -480,6 +466,7 @@
+@@ -480,6 +466,7 @@ nsSocketOutputStream::nsSocketOutputStre
  
  nsSocketOutputStream::~nsSocketOutputStream()
  {
 +  Close();
  }
  
  // called on the socket transport thread...
-@@ -518,21 +505,6 @@
+@@ -518,21 +505,6 @@ NS_IMPL_QUERY_INTERFACE2(nsSocketOutputS
  NS_IMPL_QUERY_INTERFACE2(nsSocketOutputStream,
                           nsIOutputStream,
                           nsIAsyncOutputStream)
 -
 -NS_IMETHODIMP_(nsrefcnt)
 -nsSocketOutputStream::AddRef()
 -{
 -    PR_AtomicIncrement((PRInt32*)&mWriterRefCnt);
@@ -4287,39 +4329,39 @@ diff --git a/netwerk/base/src/nsSocketTr
 -    return mTransport->Release();
 -}
  
  NS_IMETHODIMP
  nsSocketOutputStream::Close()
 diff --git a/netwerk/base/src/nsStandardURL.h b/netwerk/base/src/nsStandardURL.h
 --- a/netwerk/base/src/nsStandardURL.h
 +++ b/netwerk/base/src/nsStandardURL.h
-@@ -102,7 +102,7 @@
+@@ -102,7 +102,7 @@ public: /* internal -- HPUX compiler can
      //
      // Pref observer
      //
 -    class nsPrefObserver : public nsIObserver
 +    class nsPrefObserver : public XPCOMGCObject, public nsIObserver
      {
      public:
          NS_DECL_ISUPPORTS
 diff --git a/netwerk/build/nsNetModule.cpp b/netwerk/build/nsNetModule.cpp
 --- a/netwerk/build/nsNetModule.cpp
 +++ b/netwerk/build/nsNetModule.cpp
-@@ -180,9 +180,6 @@
+@@ -180,9 +180,6 @@ NS_GENERIC_FACTORY_CONSTRUCTOR(nsSafeAbo
  
  #ifdef NECKO_PROTOCOL_about
  // about
 -#ifdef NS_BUILD_REFCNT_LOGGING
 -#include "nsAboutBloat.h"
 -#endif
  #include "nsAboutCache.h"
  #include "nsAboutCacheEntry.h"
  NS_GENERIC_FACTORY_CONSTRUCTOR(nsAboutCacheEntry)
-@@ -1002,13 +999,6 @@
+@@ -1002,13 +999,6 @@ static const nsModuleComponentInfo gNetM
        nsAboutBlank::Create
      },
  #ifdef NECKO_PROTOCOL_about
 -#ifdef NS_BUILD_REFCNT_LOGGING
 -    { "about:bloat", 
 -      NS_ABOUT_BLOAT_MODULE_CID,
 -      NS_ABOUT_MODULE_CONTRACTID_PREFIX "bloat", 
 -      nsAboutBloat::Create
@@ -4396,17 +4438,17 @@ diff --git a/netwerk/cookie/src/nsCookie
 +    mHost = dest;
 +    WriteString(aHost, dest);
 +    mPath = dest;
 +    WriteString(aPath, dest);
 +    mEnd = dest - 1;
  }
  
  /******************************************************************************
-@@ -95,21 +112,9 @@
+@@ -95,21 +112,9 @@ nsCookie::Create(const nsACString &aName
                   PRBool            aIsSecure,
                   PRBool            aIsHttpOnly)
  {
 -  // find the required string buffer size, adding 4 for the terminating nulls
 +  // find the required string buffer size
    const PRUint32 stringLength = aName.Length() + aValue.Length() +
 -                                aHost.Length() + aPath.Length() + 4;
 -
@@ -4420,17 +4462,17 @@ diff --git a/netwerk/cookie/src/nsCookie
 -  char *name, *value, *host, *path, *end;
 -  name = static_cast<char *>(place) + sizeof(nsCookie);
 -  StrBlockCopy(aName, aValue, aHost, aPath,
 -               name, value, host, path, end);
 +                                aHost.Length() + aPath.Length();
  
    // check if the creation id given to us is greater than the running maximum
    // (it should always be monotonically increasing). if it's not, make up our own.
-@@ -119,9 +124,10 @@
+@@ -119,9 +124,10 @@ nsCookie::Create(const nsACString &aName
      aCreationID = ++gLastCreationID;
  
    // construct the cookie. placement new, oh yeah!
 -  return new (place) nsCookie(name, value, host, path, end,
 -                              aExpiry, aLastAccessed, aCreationID,
 -                              aIsSession, aIsSecure, aIsHttpOnly);
 +  return new (NS_GetGC(), stringLength)
 +      nsCookie(aName, aValue, aHost, aPath,
@@ -4446,17 +4488,17 @@ diff --git a/netwerk/cookie/src/nsCookie
   * implementation
   ******************************************************************************/
  
 -class nsCookie : public nsICookie2
 +class nsCookie : public MMgc::GCObject, public nsICookie2
  {
    public:
      // nsISupports
-@@ -64,35 +64,24 @@
+@@ -64,35 +64,24 @@ class nsCookie : public nsICookie2
  
    private:
      // for internal use only. see nsCookie::Create().
 -    nsCookie(const char     *aName,
 -             const char     *aValue,
 -             const char     *aHost,
 -             const char     *aPath,
 -             const char     *aEnd,
@@ -4492,93 +4534,93 @@ diff --git a/netwerk/cookie/src/nsCookie
  
    public:
 -    // public helper to create an nsCookie object. use |operator delete|
 -    // to destroy an object created by this method.
 +    // public helper to create an nsCookie object
      static nsCookie * Create(const nsACString &aName,
                               const nsACString &aValue,
                               const nsACString &aHost,
-@@ -103,8 +92,6 @@
+@@ -103,8 +92,6 @@ class nsCookie : public nsICookie2
                               PRBool            aIsSession,
                               PRBool            aIsSecure,
                               PRBool            aIsHttpOnly);
 -
 -    virtual ~nsCookie() {}
  
      // fast (inline, non-xpcom) getters
      inline const nsDependentCString Name()  const { return nsDependentCString(mName, mValue - 1); }
-@@ -152,6 +139,10 @@
+@@ -152,6 +139,10 @@ class nsCookie : public nsICookie2
      PRPackedBool mIsSession;
      PRPackedBool mIsSecure;
      PRPackedBool mIsHttpOnly;
 +
 +    // The name/value/host/path data is allocated directly at the end of this
 +    // object, with four bytes for terminating nulls
 +    char mStringBuffer[4];
  };
  
  #endif // nsCookie_h__
 diff --git a/netwerk/cookie/src/nsCookieService.cpp b/netwerk/cookie/src/nsCookieService.cpp
 --- a/netwerk/cookie/src/nsCookieService.cpp
 +++ b/netwerk/cookie/src/nsCookieService.cpp
-@@ -939,15 +939,7 @@
+@@ -948,15 +948,7 @@ nsCookieService::Read()
      if (!newCookie)
        return NS_ERROR_OUT_OF_MEMORY;
  
 -    if (!AddCookieToList(newCookie, PR_FALSE))
 -      // It is purpose that created us; purpose that connects us;
 -      // purpose that pulls us; that guides us; that drives us.
 -      // It is purpose that defines us; purpose that binds us.
 -      // When a cookie no longer has purpose, it has a choice:
 -      // it can return to the source to be deleted, or it can go
 -      // into exile, and stay hidden inside the Matrix.
 -      // Let's choose deletion.
 -      delete newCookie;
 +    (void) AddCookieToList(newCookie, PR_FALSE);
    }
  
    COOKIE_LOGSTRING(PR_LOG_DEBUG, ("Read(): %ld cookies read", mCookieCount));
-@@ -1075,10 +1067,7 @@
+@@ -1084,10 +1076,7 @@ nsCookieService::ImportCookies(nsIFile *
      // by successively decrementing the lastAccessed time
      lastAccessedCounter--;
  
 -    if (originalCookieCount == 0)
 -      AddCookieToList(newCookie);
 -    else
 -      AddInternal(newCookie, currentTime, nsnull, nsnull, PR_TRUE);
 +    (void) AddCookieToList(newCookie);
    }
  
    COOKIE_LOGSTRING(PR_LOG_DEBUG, ("ImportCookies(): %ld cookies imported", mCookieCount));
 diff --git a/netwerk/dns/src/nsHostResolver.cpp b/netwerk/dns/src/nsHostResolver.cpp
 --- a/netwerk/dns/src/nsHostResolver.cpp
 +++ b/netwerk/dns/src/nsHostResolver.cpp
-@@ -166,7 +166,7 @@
+@@ -166,7 +166,7 @@ nsHostRecord::Create(const nsHostKey *ke
      size_t hostLen = strlen(key->host) + 1;
      size_t size = hostLen + sizeof(nsHostRecord);
  
 -    nsHostRecord *rec = (nsHostRecord*) ::operator new(size);
 +    nsHostRecord *rec = (nsHostRecord*) MMgc::GCFinalizedObject::operator new(size, NS_GetGC());
      if (!rec) {
          PR_DestroyLock(lock);
          return NS_ERROR_OUT_OF_MEMORY;
-@@ -176,8 +176,6 @@
+@@ -176,8 +176,6 @@ nsHostRecord::Create(const nsHostKey *ke
      rec->flags = RES_KEY_FLAGS(key->flags);
      rec->af = key->af;
  
 -    rec->_refc = 1; // addref
 -    NS_LOG_ADDREF(rec, 1, "nsHostRecord", sizeof(nsHostRecord));
      rec->addr_info_lock = lock;
      rec->addr_info = nsnull;
      rec->addr_info_gencnt = 0;
 diff --git a/netwerk/dns/src/nsHostResolver.h b/netwerk/dns/src/nsHostResolver.h
 --- a/netwerk/dns/src/nsHostResolver.h
 +++ b/netwerk/dns/src/nsHostResolver.h
-@@ -51,22 +51,7 @@
+@@ -51,22 +51,7 @@ class nsResolveHostCallback;
  class nsResolveHostCallback;
  
  /* XXX move this someplace more generic */
 -#define NS_DECL_REFCOUNTED_THREADSAFE(classname)                             \
 -  private:                                                                   \
 -    nsAutoRefCnt _refc;                                                      \
 -  public:                                                                    \
 -    PRInt32 AddRef() {                                                       \
@@ -4592,38 +4634,38 @@ diff --git a/netwerk/dns/src/nsHostResol
 -        if (n == 0)                                                          \
 -            delete this;                                                     \
 -        return n;                                                            \
 -    }
 +#define NS_DECL_REFCOUNTED_THREADSAFE(classname)
  
  struct nsHostKey
  {
-@@ -78,7 +63,7 @@
+@@ -78,7 +63,7 @@ struct nsHostKey
  /**
   * nsHostRecord - ref counted object type stored in host resolver cache.
   */
 -class nsHostRecord : public PRCList, public nsHostKey
 +class nsHostRecord : public XPCOMGCFinalizedObject, public PRCList, public nsHostKey
  {
  public:
      NS_DECL_REFCOUNTED_THREADSAFE(nsHostRecord)
-@@ -155,7 +140,7 @@
+@@ -155,7 +140,7 @@ public:
  /**
   * nsHostResolver - an asynchronous host name resolver.
   */
 -class nsHostResolver
 +class nsHostResolver : public XPCOMGCFinalizedObject
  {
  public:
      /**
 diff --git a/netwerk/protocol/about/src/Makefile.in b/netwerk/protocol/about/src/Makefile.in
 --- a/netwerk/protocol/about/src/Makefile.in
 +++ b/netwerk/protocol/about/src/Makefile.in
-@@ -54,7 +54,6 @@
+@@ -54,7 +54,6 @@ CPPSRCS		= \
  CPPSRCS		= \
  		nsAboutProtocolHandler.cpp \
  		nsAboutBlank.cpp \
 -		nsAboutBloat.cpp \
  		nsAboutCache.cpp \
  		nsAboutCacheEntry.cpp \
  		$(NULL)
 diff --git a/netwerk/protocol/about/src/nsAboutBloat.cpp b/netwerk/protocol/about/src/nsAboutBloat.cpp
@@ -4885,17 +4927,17 @@ deleted file mode 100644
 -    0x11d3,                                          \
 -    {0x93, 0x99, 0x00, 0x10, 0x4b, 0xa0, 0xfd, 0x40} \
 -}
 -
 -#endif // nsAboutBloat_h__
 diff --git a/netwerk/protocol/http/src/nsHttpTransaction.cpp b/netwerk/protocol/http/src/nsHttpTransaction.cpp
 --- a/netwerk/protocol/http/src/nsHttpTransaction.cpp
 +++ b/netwerk/protocol/http/src/nsHttpTransaction.cpp
-@@ -1032,62 +1032,10 @@
+@@ -1032,62 +1032,10 @@ nsHttpTransaction::ProcessData(char *buf
  }
  
  //-----------------------------------------------------------------------------
 -// nsHttpTransaction deletion event
 -//-----------------------------------------------------------------------------
 -
 -class nsDeleteHttpTransaction : public nsRunnable {
 -public:
@@ -4951,35 +4993,35 @@ diff --git a/netwerk/protocol/http/src/n
 -    return count;
 -}
  
  NS_IMPL_THREADSAFE_QUERY_INTERFACE2(nsHttpTransaction,
                                      nsIInputStreamCallback,
 diff --git a/rdf/base/src/nsCompositeDataSource.cpp b/rdf/base/src/nsCompositeDataSource.cpp
 --- a/rdf/base/src/nsCompositeDataSource.cpp
 +++ b/rdf/base/src/nsCompositeDataSource.cpp
-@@ -146,7 +146,7 @@
+@@ -146,7 +146,7 @@ protected:
  // CompositeEnumeratorImpl
  //
  
 -class CompositeEnumeratorImpl : public nsISimpleEnumerator
 +class CompositeEnumeratorImpl : public XPCOMGCObject, public nsISimpleEnumerator
  {
      // nsISupports
      NS_DECL_ISUPPORTS
-@@ -160,8 +160,6 @@
+@@ -160,8 +160,6 @@ class CompositeEnumeratorImpl : public n
  
      virtual nsresult
      HasNegation(nsIRDFDataSource* aDataSource, nsIRDFNode* aNode, PRBool* aResult) = 0;
 -
 -    virtual void Destroy() = 0;
  
  protected:
      CompositeEnumeratorImpl(CompositeDataSourceImpl* aCompositeDataSource,
-@@ -197,22 +195,9 @@
+@@ -197,22 +195,9 @@ CompositeEnumeratorImpl::CompositeEnumer
  
  CompositeEnumeratorImpl::~CompositeEnumeratorImpl(void)
  {
 -	if (mCoalesceDuplicateArcs == PR_TRUE)
 -	{
 -		for (PRInt32 i = mAlreadyReturned.Count() - 1; i >= 0; --i)
 -		{
 -			nsIRDFNode *node = (nsIRDFNode *) mAlreadyReturned[i];
@@ -4992,17 +5034,17 @@ diff --git a/rdf/base/src/nsCompositeDat
 -	NS_RELEASE(mCompositeDataSource);
  }
  
  NS_IMPL_ADDREF(CompositeEnumeratorImpl)
 -NS_IMPL_RELEASE_WITH_DESTROY(CompositeEnumeratorImpl, Destroy())
  NS_IMPL_QUERY_INTERFACE1(CompositeEnumeratorImpl, nsISimpleEnumerator)
  
  NS_IMETHODIMP
-@@ -375,20 +360,11 @@
+@@ -375,20 +360,11 @@ public:
  public:
      enum Type { eArcsIn, eArcsOut };
  
 -    static CompositeArcsInOutEnumeratorImpl*
 -    Create(nsFixedSizeAllocator& aAllocator,
 -           CompositeDataSourceImpl* aCompositeDataSource,
 -           nsIRDFNode* aNode,
 -           Type aType,
@@ -5018,17 +5060,17 @@ diff --git a/rdf/base/src/nsCompositeDat
 +    CompositeArcsInOutEnumeratorImpl(CompositeDataSourceImpl* aCompositeDataSource,
 +                                     nsIRDFNode* aNode,
 +                                     Type aType,
 +                                     PRBool aAllowNegativeAssertions,
 +                                     PRBool aCoalesceDuplicateArcs);
  
      virtual ~CompositeArcsInOutEnumeratorImpl();
  
-@@ -398,25 +374,13 @@
+@@ -398,25 +374,13 @@ public:
      virtual nsresult
      HasNegation(nsIRDFDataSource* aDataSource, nsIRDFNode* aNode, PRBool* aResult);
  
 -    virtual void Destroy();
 -
  protected:
 -    CompositeArcsInOutEnumeratorImpl(CompositeDataSourceImpl* aCompositeDataSource,
 -                                     nsIRDFNode* aNode,
@@ -5044,17 +5086,17 @@ diff --git a/rdf/base/src/nsCompositeDat
 -
 -    // Hide so that only Create() and Destroy() can be used to
 -    // allocate and deallocate from the heap
 -    static void* operator new(size_t) CPP_THROW_NEW { return 0; }
 -    static void operator delete(void*, size_t) {}
  };
  
  
-@@ -465,19 +429,6 @@
+@@ -465,19 +429,6 @@ CompositeArcsInOutEnumeratorImpl::HasNeg
      return NS_OK;
  }
  
 -void
 -CompositeArcsInOutEnumeratorImpl::Destroy()
 -{
 -    // Keep the datasource alive for the duration of the stack
 -    // frame so its allocator stays valid.
@@ -5064,17 +5106,17 @@ diff --git a/rdf/base/src/nsCompositeDat
 -    this->~CompositeArcsInOutEnumeratorImpl();
 -    pool.Free(this, sizeof(*this));
 -}
 -
 -
  //----------------------------------------------------------------------
  //
  // CompositeAssertionEnumeratorImpl
-@@ -486,23 +437,13 @@
+@@ -486,23 +437,13 @@ class CompositeAssertionEnumeratorImpl :
  class CompositeAssertionEnumeratorImpl : public CompositeEnumeratorImpl
  {
  public:
 -    static CompositeAssertionEnumeratorImpl*
 -    Create(nsFixedSizeAllocator& aAllocator,
 -           CompositeDataSourceImpl* aCompositeDataSource,
 -           nsIRDFResource* aSource,
 -           nsIRDFResource* aProperty,
@@ -5095,46 +5137,46 @@ diff --git a/rdf/base/src/nsCompositeDat
 +                                     nsIRDFResource* aProperty,
 +                                     nsIRDFNode* aTarget,
 +                                     PRBool aTruthValue,
 +                                     PRBool aAllowNegativeAssertions,
 +                                     PRBool aCoalesceDuplicateArcs);
  
      virtual nsresult
      GetEnumerator(nsIRDFDataSource* aDataSource, nsISimpleEnumerator** aResult);
-@@ -510,16 +451,7 @@
+@@ -510,16 +451,7 @@ public:
      virtual nsresult
      HasNegation(nsIRDFDataSource* aDataSource, nsIRDFNode* aNode, PRBool* aResult);
  
 -    virtual void Destroy();
 -
  protected:
 -    CompositeAssertionEnumeratorImpl(CompositeDataSourceImpl* aCompositeDataSource,
 -                                     nsIRDFResource* aSource,
 -                                     nsIRDFResource* aProperty,
 -                                     nsIRDFNode* aTarget,
 -                                     PRBool aTruthValue,
 -                                     PRBool aAllowNegativeAssertions,
 -                                     PRBool aCoalesceDuplicateArcs);
  
      virtual ~CompositeAssertionEnumeratorImpl();
  
-@@ -530,11 +462,6 @@
+@@ -530,11 +462,6 @@ private:
      PRBool          mTruthValue;
      PRBool          mAllowNegativeAssertions;
      PRBool          mCoalesceDuplicateArcs;
 -
 -    // Hide so that only Create() and Destroy() can be used to
 -    // allocate and deallocate from the heap
 -    static void* operator new(size_t) CPP_THROW_NEW { return 0; }
 -    static void operator delete(void*, size_t) {}
  };
  
  
-@@ -593,18 +520,6 @@
+@@ -593,18 +520,6 @@ CompositeAssertionEnumeratorImpl::HasNeg
          nsCOMPtr<nsIRDFResource> source( do_QueryInterface(aNode) );
          return aDataSource->HasAssertion(source, mProperty, mTarget, !mTruthValue, aResult);
      }
 -}
 -
 -void
 -CompositeAssertionEnumeratorImpl::Destroy()
 -{
@@ -5143,65 +5185,65 @@ diff --git a/rdf/base/src/nsCompositeDat
 -    nsCOMPtr<nsIRDFCompositeDataSource> kungFuDeathGrip = mCompositeDataSource;
 -
 -    nsFixedSizeAllocator& pool = mCompositeDataSource->mAllocator;
 -    this->~CompositeAssertionEnumeratorImpl();
 -    pool.Free(this, sizeof(*this));
  }
  
  ////////////////////////////////////////////////////////////////////////
-@@ -727,11 +642,10 @@
+@@ -727,11 +642,10 @@ CompositeDataSourceImpl::GetSources(nsIR
      if ((mAllowNegativeAssertions == PR_FALSE) && (aTruthValue == PR_FALSE))
          return(NS_RDF_NO_VALUE);
  
 -    *aResult = CompositeAssertionEnumeratorImpl::Create(mAllocator,
 -                                                        this, nsnull, aProperty,
 -                                                        aTarget, aTruthValue,
 -                                                        mAllowNegativeAssertions,
 -                                                        mCoalesceDuplicateArcs);
 +    *aResult = new CompositeAssertionEnumeratorImpl(this, nsnull, aProperty,
 +                                                    aTarget, aTruthValue,
 +                                                    mAllowNegativeAssertions,
 +                                                    mCoalesceDuplicateArcs);
  
      if (! *aResult)
          return NS_ERROR_OUT_OF_MEMORY;
-@@ -834,11 +748,11 @@
+@@ -834,11 +748,11 @@ CompositeDataSourceImpl::GetTargets(nsIR
          return(NS_RDF_NO_VALUE);
  
      *aResult =
 -        CompositeAssertionEnumeratorImpl::Create(mAllocator, this,
 -                                                 aSource, aProperty, nsnull,
 -                                                 aTruthValue,
 -                                                 mAllowNegativeAssertions,
 -                                                 mCoalesceDuplicateArcs);
 +        new CompositeAssertionEnumeratorImpl(this,
 +                                             aSource, aProperty, nsnull,
 +                                             aTruthValue,
 +                                             mAllowNegativeAssertions,
 +                                             mCoalesceDuplicateArcs);
  
      if (! *aResult)
          return NS_ERROR_OUT_OF_MEMORY;
-@@ -1166,10 +1080,10 @@
+@@ -1166,10 +1080,10 @@ CompositeDataSourceImpl::ArcLabelsIn(nsI
          return NS_ERROR_NULL_POINTER;
  
      nsISimpleEnumerator* result = 
 -        CompositeArcsInOutEnumeratorImpl::Create(mAllocator, this, aTarget,
 -                                                 CompositeArcsInOutEnumeratorImpl::eArcsIn,
 -                                                 mAllowNegativeAssertions,
 -                                                 mCoalesceDuplicateArcs);
 +        new CompositeArcsInOutEnumeratorImpl(this, aTarget,
 +                                             CompositeArcsInOutEnumeratorImpl::eArcsIn,
 +                                             mAllowNegativeAssertions,
 +                                             mCoalesceDuplicateArcs);
  
      if (! result)
          return NS_ERROR_OUT_OF_MEMORY;
-@@ -1192,10 +1106,10 @@
+@@ -1192,10 +1106,10 @@ CompositeDataSourceImpl::ArcLabelsOut(ns
          return NS_ERROR_NULL_POINTER;
  
      nsISimpleEnumerator* result =
 -        CompositeArcsInOutEnumeratorImpl::Create(mAllocator, this, aSource,
 -                                                 CompositeArcsInOutEnumeratorImpl::eArcsOut,
 -                                                 mAllowNegativeAssertions,
 -                                                 mCoalesceDuplicateArcs);
 +        new CompositeArcsInOutEnumeratorImpl(this, aSource,
@@ -5209,27 +5251,27 @@ diff --git a/rdf/base/src/nsCompositeDat
 +                                             mAllowNegativeAssertions,
 +                                             mCoalesceDuplicateArcs);
  
      if (! result)
          return NS_ERROR_OUT_OF_MEMORY;
 diff --git a/rdf/base/src/nsInMemoryDataSource.cpp b/rdf/base/src/nsInMemoryDataSource.cpp
 --- a/rdf/base/src/nsInMemoryDataSource.cpp
 +++ b/rdf/base/src/nsInMemoryDataSource.cpp
-@@ -427,7 +427,8 @@
+@@ -427,7 +427,8 @@ public:
  /**
   * InMemoryAssertionEnumeratorImpl
   */
 -class InMemoryAssertionEnumeratorImpl : public nsISimpleEnumerator
 +class InMemoryAssertionEnumeratorImpl : public XPCOMGCFinalizedObject
 +                                      , public nsISimpleEnumerator
  {
  private:
      InMemoryDataSource* mDataSource;
-@@ -440,44 +441,14 @@
+@@ -440,44 +441,14 @@ private:
      Assertion*      mNextAssertion;
      nsCOMPtr<nsISupportsArray> mHashArcs;
  
 -    // Hide so that only Create() and Destroy() can be used to
 -    // allocate and deallocate from the heap
 -    static void* operator new(size_t) CPP_THROW_NEW { return 0; }
 -    static void operator delete(void*, size_t) {}
 +    virtual ~InMemoryAssertionEnumeratorImpl();
@@ -5266,48 +5308,48 @@ diff --git a/rdf/base/src/nsInMemoryData
 -        // Grab the pool from the datasource; since we keep the
 -        // datasource alive, this has to be safe.
 -        nsFixedSizeAllocator& pool = aEnumerator->mDataSource->mAllocator;
 -        aEnumerator->~InMemoryAssertionEnumeratorImpl();
 -        pool.Free(aEnumerator, sizeof(*aEnumerator)); }
  
      // nsISupports interface
      NS_DECL_ISUPPORTS
-@@ -548,7 +519,6 @@
+@@ -548,7 +519,6 @@ InMemoryAssertionEnumeratorImpl::~InMemo
  }
  
  NS_IMPL_ADDREF(InMemoryAssertionEnumeratorImpl)
 -NS_IMPL_RELEASE_WITH_DESTROY(InMemoryAssertionEnumeratorImpl, Destroy(this))
  NS_IMPL_QUERY_INTERFACE1(InMemoryAssertionEnumeratorImpl, nsISimpleEnumerator)
  
  NS_IMETHODIMP
-@@ -631,11 +601,6 @@
+@@ -631,11 +601,6 @@ class InMemoryArcsEnumeratorImpl : publi
  class InMemoryArcsEnumeratorImpl : public nsISimpleEnumerator
  {
  private:
 -    // Hide so that only Create() and Destroy() can be used to
 -    // allocate and deallocate from the heap
 -    static void* operator new(size_t) CPP_THROW_NEW { return 0; }
 -    static void operator delete(void*, size_t) {}
 -
      InMemoryDataSource* mDataSource;
      nsIRDFResource*     mSource;
      nsIRDFNode*         mTarget;
-@@ -643,10 +608,6 @@
+@@ -643,10 +608,6 @@ private:
      nsIRDFResource*     mCurrent;
      Assertion*          mAssertion;
      nsCOMPtr<nsISupportsArray> mHashArcs;
 -
 -    InMemoryArcsEnumeratorImpl(InMemoryDataSource* aDataSource,
 -                               nsIRDFResource* aSource,
 -                               nsIRDFNode* aTarget);
  
      virtual ~InMemoryArcsEnumeratorImpl();
  
-@@ -661,26 +622,9 @@
+@@ -661,26 +622,9 @@ public:
      // nsISimpleEnumerator interface
      NS_DECL_NSISIMPLEENUMERATOR
  
 -    static InMemoryArcsEnumeratorImpl*
 -    Create(InMemoryDataSource* aDataSource,
 -           nsIRDFResource* aSource,
 -           nsIRDFNode* aTarget) {
 -        void* place = aDataSource->mAllocator.Alloc(sizeof(InMemoryArcsEnumeratorImpl));
@@ -5327,84 +5369,84 @@ diff --git a/rdf/base/src/nsInMemoryData
 -        aEnumerator->~InMemoryArcsEnumeratorImpl();
 -        pool.Free(aEnumerator, sizeof(*aEnumerator)); }
 +    InMemoryArcsEnumeratorImpl(InMemoryDataSource* aDataSource,
 +                               nsIRDFResource* aSource,
 +                               nsIRDFNode* aTarget);
  };
  
  
-@@ -747,7 +691,6 @@
+@@ -747,7 +691,6 @@ InMemoryArcsEnumeratorImpl::~InMemoryArc
  }
  
  NS_IMPL_ADDREF(InMemoryArcsEnumeratorImpl)
 -NS_IMPL_RELEASE_WITH_DESTROY(InMemoryArcsEnumeratorImpl, Destroy(this))
  NS_IMPL_QUERY_INTERFACE1(InMemoryArcsEnumeratorImpl, nsISimpleEnumerator)
  
  NS_IMETHODIMP
-@@ -1207,8 +1150,8 @@
+@@ -1207,8 +1150,8 @@ InMemoryDataSource::GetSources(nsIRDFRes
          return NS_ERROR_NULL_POINTER;
  
      InMemoryAssertionEnumeratorImpl* result =
 -        InMemoryAssertionEnumeratorImpl::Create(this, nsnull, aProperty,
 -                                                  aTarget, aTruthValue);
 +        new InMemoryAssertionEnumeratorImpl(this, nsnull, aProperty,
 +                                            aTarget, aTruthValue);
  
      if (! result)
          return NS_ERROR_OUT_OF_MEMORY;
-@@ -1238,8 +1181,8 @@
+@@ -1238,8 +1181,8 @@ InMemoryDataSource::GetTargets(nsIRDFRes
          return NS_ERROR_NULL_POINTER;
  
      InMemoryAssertionEnumeratorImpl* result =
 -        InMemoryAssertionEnumeratorImpl::Create(this, aSource, aProperty,
 -                                                nsnull, aTruthValue);
 +        new InMemoryAssertionEnumeratorImpl(this, aSource, aProperty,
 +                                            nsnull, aTruthValue);
  
      if (! result)
          return NS_ERROR_OUT_OF_MEMORY;
-@@ -1744,7 +1687,7 @@
+@@ -1744,7 +1687,7 @@ InMemoryDataSource::ArcLabelsIn(nsIRDFNo
          return NS_ERROR_NULL_POINTER;
  
      InMemoryArcsEnumeratorImpl* result =
 -        InMemoryArcsEnumeratorImpl::Create(this, nsnull, aTarget);
 +        new InMemoryArcsEnumeratorImpl(this, nsnull, aTarget);
  
      if (! result)
          return NS_ERROR_OUT_OF_MEMORY;
-@@ -1763,7 +1706,7 @@
+@@ -1763,7 +1706,7 @@ InMemoryDataSource::ArcLabelsOut(nsIRDFR
          return NS_ERROR_NULL_POINTER;
  
      InMemoryArcsEnumeratorImpl* result =
 -        InMemoryArcsEnumeratorImpl::Create(this, aSource, nsnull);
 +        new InMemoryArcsEnumeratorImpl(this, aSource, nsnull);
  
      if (! result)
          return NS_ERROR_OUT_OF_MEMORY;
 diff --git a/rdf/base/src/nsRDFContentSink.cpp b/rdf/base/src/nsRDFContentSink.cpp
 --- a/rdf/base/src/nsRDFContentSink.cpp
 +++ b/rdf/base/src/nsRDFContentSink.cpp
-@@ -437,12 +437,10 @@
+@@ -437,12 +437,10 @@ RDFContentSinkImpl::QueryInterface(REFNS
          iid.Equals(kIContentSinkIID) ||
          iid.Equals(kISupportsIID)) {
          *result = static_cast<nsIXMLContentSink*>(this);
 -        AddRef();
          return NS_OK;
      }
      else if (iid.Equals(kIExpatSinkIID)) {
        *result = static_cast<nsIExpatSink*>(this);
 -       AddRef();
         return NS_OK;
      }
      return NS_NOINTERFACE;
 diff --git a/rdf/base/src/nsRDFService.cpp b/rdf/base/src/nsRDFService.cpp
 --- a/rdf/base/src/nsRDFService.cpp
 +++ b/rdf/base/src/nsRDFService.cpp
-@@ -318,39 +318,38 @@
+@@ -318,39 +318,38 @@ static PLDHashTableOps gDateTableOps = {
      nsnull
  };
  
 -class BlobImpl : public nsIRDFBlob
 +class BlobImpl : public MMgc::GCFinalizedObject, public nsIRDFBlob
  {
  public:
      struct Data {
@@ -5446,44 +5488,44 @@ diff --git a/rdf/base/src/nsRDFService.c
      NS_DECL_NSIRDFBLOB
  
 -    Data mData;
 +    Data    mData;
 +    PRUint8 mBytes[1];
  };
  
  NS_IMPL_ISUPPORTS2(BlobImpl, nsIRDFNode, nsIRDFBlob)
-@@ -367,7 +366,7 @@
+@@ -367,7 +366,7 @@ BlobImpl::EqualsNode(nsIRDFNode *aNode, 
              const PRUint8 *bytes;
              blob->GetValue(&bytes);
  
 -            if (0 == memcmp(bytes, mData.mBytes, length)) {
 +            if (0 == memcmp(bytes, mBytes, length)) {
                  *aEquals = PR_TRUE;
                  return NS_OK;
              }
-@@ -381,7 +380,7 @@
+@@ -381,7 +380,7 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  BlobImpl::GetValue(const PRUint8 **aResult)
  {
 -    *aResult = mData.mBytes;
 +    *aResult = mBytes;
      return NS_OK;
  }
  
-@@ -448,7 +447,7 @@
+@@ -448,7 +447,7 @@ static PLDHashTableOps gBlobTableOps = {
  //   i.e., there is are no resource factories to allow you to generate
  //   customer resources. I doubt that makes sense, anyway.
  //
 -class LiteralImpl : public nsIRDFLiteral {
 +class LiteralImpl : public XPCOMGCFinalizedObject, public nsIRDFLiteral {
  public:
      static nsresult
      Create(const PRUnichar* aValue, nsIRDFLiteral** aResult);
-@@ -463,51 +462,41 @@
+@@ -463,51 +462,41 @@ public:
      NS_DECL_NSIRDFLITERAL
  
  protected:
 -    LiteralImpl(const PRUnichar* s);
 +    static void* operator new(size_t size, size_t extra)
 +    {
 +        return MMgc::GCObject::operator new(size, NS_GetGC(), extra);
 +    }
@@ -5541,92 +5583,92 @@ diff --git a/rdf/base/src/nsRDFService.c
 -    // Use NS_RELEASE2() here, because we want to decrease the
 -    // refcount, but not null out the gRDFService pointer (which is
 -    // what a vanilla NS_RELEASE() would do).
 -    nsrefcnt refcnt;
 -    NS_RELEASE2(RDFServiceImpl::gRDFService, refcnt);
  }
  
  NS_IMPL_THREADSAFE_ADDREF(LiteralImpl)
-@@ -524,7 +513,6 @@
+@@ -524,7 +513,6 @@ LiteralImpl::QueryInterface(REFNSIID iid
          iid.Equals(kIRDFNodeIID) ||
          iid.Equals(kISupportsIID)) {
          *result = static_cast<nsIRDFLiteral*>(this);
 -        AddRef();
          return NS_OK;
      }
      return NS_NOINTERFACE;
-@@ -604,12 +592,6 @@
+@@ -604,12 +592,6 @@ DateImpl::~DateImpl()
  DateImpl::~DateImpl()
  {
      RDFServiceImpl::gRDFService->UnregisterDate(this);
 -
 -    // Use NS_RELEASE2() here, because we want to decrease the
 -    // refcount, but not null out the gRDFService pointer (which is
 -    // what a vanilla NS_RELEASE() would do).
 -    nsrefcnt refcnt;
 -    NS_RELEASE2(RDFServiceImpl::gRDFService, refcnt);
  }
  
  NS_IMPL_ADDREF(DateImpl)
-@@ -626,7 +608,6 @@
+@@ -626,7 +608,6 @@ DateImpl::QueryInterface(REFNSIID iid, v
          iid.Equals(kIRDFNodeIID) ||
          iid.Equals(kISupportsIID)) {
          *result = static_cast<nsIRDFDate*>(this);
 -        AddRef();
          return NS_OK;
      }
      return NS_NOINTERFACE;
-@@ -710,12 +691,6 @@
+@@ -710,12 +691,6 @@ IntImpl::~IntImpl()
  IntImpl::~IntImpl()
  {
      RDFServiceImpl::gRDFService->UnregisterInt(this);
 -
 -    // Use NS_RELEASE2() here, because we want to decrease the
 -    // refcount, but not null out the gRDFService pointer (which is
 -    // what a vanilla NS_RELEASE() would do).
 -    nsrefcnt refcnt;
 -    NS_RELEASE2(RDFServiceImpl::gRDFService, refcnt);
  }
  
  NS_IMPL_ADDREF(IntImpl)
-@@ -1188,7 +1163,7 @@
+@@ -1188,7 +1163,7 @@ RDFServiceImpl::GetBlobLiteral(const PRU
          return NS_OK;
      }
  
 -    BlobImpl *result = new BlobImpl(aBytes, aLength);
 +    BlobImpl *result = new (aLength) BlobImpl(aBytes, aLength);
      if (! result)
          return NS_ERROR_OUT_OF_MEMORY;
  
 diff --git a/toolkit/components/places/src/nsNavHistoryQuery.cpp b/toolkit/components/places/src/nsNavHistoryQuery.cpp
 --- a/toolkit/components/places/src/nsNavHistoryQuery.cpp
 +++ b/toolkit/components/places/src/nsNavHistoryQuery.cpp
-@@ -1147,7 +1147,6 @@
+@@ -1147,7 +1147,6 @@ NS_IMETHODIMP nsNavHistoryQuery::Clone(n
    nsNavHistoryQuery *clone = new nsNavHistoryQuery(*this);
    NS_ENSURE_TRUE(clone, NS_ERROR_OUT_OF_MEMORY);
  
 -  clone->mRefCnt = 0; // the clone doesn't inherit our refcount
    NS_ADDREF(*_retval = clone);
    return NS_OK;
  }
 diff --git a/toolkit/xre/nsAppRunner.cpp b/toolkit/xre/nsAppRunner.cpp
 --- a/toolkit/xre/nsAppRunner.cpp
 +++ b/toolkit/xre/nsAppRunner.cpp
-@@ -562,7 +562,8 @@
+@@ -562,7 +562,8 @@ PRBool gSafeMode = PR_FALSE;
   * The nsXULAppInfo object implements nsIFactory so that it can be its own
   * singleton.
   */
 -class nsXULAppInfo : public nsIXULAppInfo,
 +class nsXULAppInfo : public XPCOMGCObject,
 +                     public nsIXULAppInfo,
  #ifdef XP_WIN
                       public nsIWinAppHelper,
  #endif
-@@ -597,18 +598,6 @@
+@@ -597,18 +598,6 @@ NS_INTERFACE_MAP_BEGIN(nsXULAppInfo)
  #endif
    NS_INTERFACE_MAP_ENTRY_CONDITIONAL(nsIXULAppInfo, gAppData)
  NS_INTERFACE_MAP_END
 -
 -NS_IMETHODIMP_(nsrefcnt)
 -nsXULAppInfo::AddRef()
 -{
 -  return 1;
@@ -5635,81 +5677,81 @@ diff --git a/toolkit/xre/nsAppRunner.cpp
 -NS_IMETHODIMP_(nsrefcnt)
 -nsXULAppInfo::Release()
 -{
 -  return 1;
 -}
  
  NS_IMETHODIMP
  nsXULAppInfo::GetVendor(nsACString& aResult)
-@@ -844,14 +833,12 @@
+@@ -844,14 +833,12 @@ nsXULAppInfo::WriteMinidumpForException(
  }
  #endif
  
 -static const nsXULAppInfo kAppInfo;
  static NS_METHOD AppInfoConstructor(nsISupports* aOuter,
                                      REFNSIID aIID, void **aResult)
  {
    NS_ENSURE_NO_AGGREGATION(aOuter);
  
 -  return const_cast<nsXULAppInfo*>(&kAppInfo)->
 -    QueryInterface(aIID, aResult);
 +  return (new nsXULAppInfo())->QueryInterface(aIID, aResult);
  }
  
  PRBool gLogConsoleErrors
-@@ -1108,8 +1095,8 @@
+@@ -1108,8 +1095,8 @@ static void DumpArbitraryHelp()
    ScopedLogging log;
  
    {
 -    nsXREDirProvider dirProvider;
 -    dirProvider.Initialize(nsnull, gAppData->xreDirectory);
 +    nsXREDirProvider *dirProvider = new nsXREDirProvider();
 +    dirProvider->Initialize(nsnull, gAppData->xreDirectory);
  
      ScopedXPCOMStartup xpcom;
      xpcom.Initialize();
-@@ -2601,12 +2588,12 @@
+@@ -2617,12 +2604,12 @@ XRE_main(int argc, char* argv[], const n
      CrashReporter::SetRestartArgs(argc, argv);
  
      // annotate other data (user id etc)
 -    nsXREDirProvider dirProvider;
 +    nsXREDirProvider *dirProvider = new nsXREDirProvider();
      nsCOMPtr<nsILocalFile> userAppDataDir;
 -    rv = dirProvider.Initialize(gAppData->directory, gAppData->xreDirectory);
 +    rv = dirProvider->Initialize(gAppData->directory, gAppData->xreDirectory);
      if (NS_SUCCEEDED(rv) &&
 -        NS_SUCCEEDED(dirProvider.GetUserAppDataDirectory(
 -                                                         getter_AddRefs(userAppDataDir)))) {
 +        NS_SUCCEEDED(dirProvider->GetUserAppDataDirectory(
 +                                  getter_AddRefs(userAppDataDir)))) {
        CrashReporter::SetupExtraData(userAppDataDir,
                                      nsDependentCString(appData.buildID));
  
-@@ -2614,7 +2601,7 @@
+@@ -2630,7 +2617,7 @@ XRE_main(int argc, char* argv[], const n
        nsCOMPtr<nsIFile> overrideini;
        PRBool exists;
        static char overrideEnv[MAXPATHLEN];
 -      if (NS_SUCCEEDED(dirProvider.GetAppDir()->Clone(getter_AddRefs(overrideini))) &&
 +      if (NS_SUCCEEDED(dirProvider->GetAppDir()->Clone(getter_AddRefs(overrideini))) &&
            NS_SUCCEEDED(overrideini->AppendNative(NS_LITERAL_CSTRING("crashreporter-override.ini"))) &&
            NS_SUCCEEDED(overrideini->Exists(&exists)) &&
            exists) {
-@@ -2723,8 +2710,8 @@
+@@ -2739,8 +2726,8 @@ XRE_main(int argc, char* argv[], const n
  #endif
  
    {
 -    nsXREDirProvider dirProvider;
 -    rv = dirProvider.Initialize(gAppData->directory, gAppData->xreDirectory);
 +    nsXREDirProvider *dirProvider = new nsXREDirProvider();
 +    rv = dirProvider->Initialize(gAppData->directory, gAppData->xreDirectory);
      if (NS_FAILED(rv))
        return 1;
  
-@@ -2857,14 +2844,14 @@
+@@ -2873,14 +2860,14 @@ XRE_main(int argc, char* argv[], const n
    // Check for and process any available updates
    nsCOMPtr<nsIFile> updRoot;
    PRBool persistent;
 -  rv = dirProvider.GetFile(XRE_UPDATE_ROOT_DIR, &persistent,
 -                           getter_AddRefs(updRoot));
 +  rv = dirProvider->GetFile(XRE_UPDATE_ROOT_DIR, &persistent,
 +                            getter_AddRefs(updRoot));
    // XRE_UPDATE_ROOT_DIR may fail. Fallback to appDir if failed
@@ -5719,90 +5761,90 @@ diff --git a/toolkit/xre/nsAppRunner.cpp
  
 -  ProcessUpdates(dirProvider.GetGREDir(),
 -                 dirProvider.GetAppDir(),
 +  ProcessUpdates(dirProvider->GetGREDir(),
 +                 dirProvider->GetAppDir(),
                   updRoot,
                   gRestartArgc,
                   gRestartArgv);
-@@ -2888,7 +2875,7 @@
+@@ -2904,7 +2891,7 @@ XRE_main(int argc, char* argv[], const n
      rv = profileLock->GetLocalDirectory(getter_AddRefs(profLD));
      NS_ENSURE_SUCCESS(rv, 1);
  
 -    rv = dirProvider.SetProfile(profD, profLD);
 +    rv = dirProvider->SetProfile(profD, profLD);
      NS_ENSURE_SUCCESS(rv, 1);
  
      //////////////////////// NOW WE HAVE A PROFILE ////////////////////////
-@@ -2914,7 +2901,7 @@
+@@ -2930,7 +2917,7 @@ XRE_main(int argc, char* argv[], const n
      // profile was started with.  The format of the version stamp is defined
      // by the BuildVersion function.
      PRBool versionOK = CheckCompatibility(profD, version, osABI,
 -                                          dirProvider.GetGREDir(),
 +                                          dirProvider->GetGREDir(),
                                            gAppData->directory);
  
      // Every time a profile is loaded by a build with a different version,
-@@ -2927,7 +2914,7 @@
+@@ -2943,7 +2930,7 @@ XRE_main(int argc, char* argv[], const n
      if (gSafeMode) {
        RemoveComponentRegistries(profD, profLD, PR_FALSE);
        WriteVersion(profD, NS_LITERAL_CSTRING("Safe Mode"), osABI,
 -                   dirProvider.GetGREDir(), gAppData->directory);
 +                   dirProvider->GetGREDir(), gAppData->directory);
      }
      else if (versionOK) {
        if (ComponentsListChanged(profD)) {
-@@ -2951,7 +2938,7 @@
+@@ -2967,7 +2954,7 @@ XRE_main(int argc, char* argv[], const n
  
        // Write out version
        WriteVersion(profD, version, osABI,
 -                   dirProvider.GetGREDir(), gAppData->directory);
 +                   dirProvider->GetGREDir(), gAppData->directory);
      }
  
      PRBool needsRestart = PR_FALSE;
-@@ -2994,7 +2981,7 @@
+@@ -3010,7 +2997,7 @@ XRE_main(int argc, char* argv[], const n
  
          if (gDoMigration) {
            nsCOMPtr<nsIFile> file;
 -          dirProvider.GetAppDir()->Clone(getter_AddRefs(file));
 +          dirProvider->GetAppDir()->Clone(getter_AddRefs(file));
            file->AppendNative(NS_LITERAL_CSTRING("override.ini"));
            nsINIParser parser;
            nsCOMPtr<nsILocalFile> localFile(do_QueryInterface(file));
-@@ -3016,9 +3003,9 @@
+@@ -3032,9 +3019,9 @@ XRE_main(int argc, char* argv[], const n
            nsCOMPtr<nsIProfileMigrator> pm
              (do_CreateInstance(NS_PROFILEMIGRATOR_CONTRACTID));
            if (pm)
 -            pm->Migrate(&dirProvider);
 +            pm->Migrate(dirProvider);
          }
 -        dirProvider.DoStartup();
 +        dirProvider->DoStartup();
  
          nsCOMPtr<nsICommandLineRunner> cmdLine
            (do_CreateInstance("@mozilla.org/toolkit/command-line;1"));
 diff --git a/toolkit/xre/nsNativeAppSupportCocoa.mm b/toolkit/xre/nsNativeAppSupportCocoa.mm
 --- a/toolkit/xre/nsNativeAppSupportCocoa.mm
 +++ b/toolkit/xre/nsNativeAppSupportCocoa.mm
-@@ -80,7 +80,8 @@
+@@ -80,7 +80,8 @@ enum {
          eCarbonLibVersTooOldExplanationIndex
       };
  
 -class nsNativeAppSupportCocoa : public nsNativeAppSupportBase
 +class nsNativeAppSupportCocoa : public XPCOMGCFinalizedObject
 +                              , public nsNativeAppSupportBase
  {
  public:
    nsNativeAppSupportCocoa() :
 diff --git a/uriloader/exthandler/nsExternalHelperAppService.cpp b/uriloader/exthandler/nsExternalHelperAppService.cpp
 --- a/uriloader/exthandler/nsExternalHelperAppService.cpp
 +++ b/uriloader/exthandler/nsExternalHelperAppService.cpp
-@@ -1018,14 +1018,10 @@
+@@ -1024,14 +1024,10 @@ nsExternalAppHandler::nsExternalAppHandl
    
    // Make sure extension is correct.
    EnsureSuggestedFileName();
 -
 -  gExtProtSvc->AddRef();
  }
  
  nsExternalAppHandler::~nsExternalAppHandler()
@@ -5810,54 +5852,54 @@ diff --git a/uriloader/exthandler/nsExte
 -  // Not using NS_RELEASE, since we don't want to set gExtProtSvc to NULL
 -  gExtProtSvc->Release();
  }
  
  NS_IMETHODIMP nsExternalAppHandler::SetWebProgressListener(nsIWebProgressListener2 * aWebProgressListener)
 diff --git a/xpcom/base/Makefile.in b/xpcom/base/Makefile.in
 --- a/xpcom/base/Makefile.in
 +++ b/xpcom/base/Makefile.in
-@@ -49,6 +49,7 @@
+@@ -49,6 +49,7 @@ MOZILLA_INTERNAL_API =1
  MOZILLA_INTERNAL_API =1
  
  REQUIRES	= string \
 +		  js \
  		  $(NULL)
  
  CPPSRCS		= \
-@@ -106,7 +107,6 @@
+@@ -106,7 +107,6 @@ SDK_XPIDLSRCS   = \
  		nsIMemory.idl		   \
  		nsIProgrammingLanguage.idl \
  		nsISupports.idl		   \
 -		nsITraceRefcnt.idl         \
  		nsIWeakReference.idl	   \
  		nsrootidl.idl		   \
  		$(NULL)
-@@ -147,6 +147,8 @@
+@@ -147,6 +147,8 @@ FORCE_USE_PIC	= 1
  
  include $(topsrcdir)/config/rules.mk
  
 +LOCAL_INCLUDES += -I$(topsrcdir)/xpcom/build
 +
  DEFINES		+= -D_IMPL_NS_COM
  
  ifneq (,$(filter gtk2,$(MOZ_WIDGET_TOOLKIT)))
 diff --git a/xpcom/base/nsAgg.h b/xpcom/base/nsAgg.h
 --- a/xpcom/base/nsAgg.h
 +++ b/xpcom/base/nsAgg.h
-@@ -86,8 +86,6 @@
+@@ -86,8 +86,6 @@ private:                                
          Internal() {}                                                       \
                                                                              \
          NS_IMETHOD QueryInterface(const nsIID& aIID, void** aInstancePtr);  \
 -        NS_IMETHOD_(nsrefcnt) AddRef(void);                                 \
 -        NS_IMETHOD_(nsrefcnt) Release(void);                                \
                                                                              \
          NS_DECL_OWNINGTHREAD                                                \
      };                                                                      \
-@@ -110,35 +108,7 @@
+@@ -110,35 +108,7 @@ public:                                 
  
  // Put this in your class's implementation file:
  #define NS_IMPL_AGGREGATED(_class)                                          \
 -                                                                            \
 -NS_IMPL_AGGREGATED_HELPER(_class)                                           \
 -                                                                            \
 -NS_IMETHODIMP_(nsrefcnt)                                                    \
 -_class::Internal::AddRef(void)                                              \
@@ -5884,17 +5926,17 @@ diff --git a/xpcom/base/nsAgg.h b/xpcom/
 -        return 0;                                                           \
 -    }                                                                       \
 -    return agg->mRefCnt;                                                    \
 -}                                                                           \
 +  NS_IMPL_AGGREGATED_HELPER(_class)
  
  #define NS_IMPL_CYCLE_COLLECTING_AGGREGATED(_class)                         \
    NS_IMPL_AGGREGATED(_class)
-@@ -148,18 +118,6 @@
+@@ -148,18 +118,6 @@ _class::QueryInterface(const nsIID& aIID
  _class::QueryInterface(const nsIID& aIID, void** aInstancePtr)              \
  {                                                                           \
      return fOuter->QueryInterface(aIID, aInstancePtr);                      \
 -}                                                                           \
 -                                                                            \
 -NS_IMETHODIMP_(nsrefcnt)                                                    \
 -_class::AddRef(void)                                                        \
 -{                                                                           \
@@ -5915,140 +5957,140 @@ diff --git a/xpcom/base/nsAutoPtr.h b/xp
  
    // Wrapping includes can speed up compiles (see "Large Scale C++ Software Design")
  #ifndef nsCOMPtr_h___
 -  // For |already_AddRefed|, |nsDerivedSafe|, |NSCAP_Zero|,
 +  // For
    // |NSCAP_DONT_PROVIDE_NONCONST_OPEQ|,
    // |NSCAP_FEATURE_INLINE_STARTASSIGNMENT|
  #include "nsCOMPtr.h"
-@@ -333,7 +333,7 @@
+@@ -333,7 +333,7 @@ getter_Transfers( nsAutoPtr<T>& aSmartPt
  
  template <class T, class U>
  inline
 -NSCAP_BOOL
 +bool
  operator==( const nsAutoPtr<T>& lhs, const nsAutoPtr<U>& rhs )
    {
      return static_cast<const T*>(lhs.get()) == static_cast<const U*>(rhs.get());
-@@ -342,7 +342,7 @@
+@@ -342,7 +342,7 @@ operator==( const nsAutoPtr<T>& lhs, con
  
  template <class T, class U>
  inline
 -NSCAP_BOOL
 +bool
  operator!=( const nsAutoPtr<T>& lhs, const nsAutoPtr<U>& rhs )
    {
      return static_cast<const T*>(lhs.get()) != static_cast<const U*>(rhs.get());
-@@ -353,7 +353,7 @@
+@@ -353,7 +353,7 @@ operator!=( const nsAutoPtr<T>& lhs, con
  
  template <class T, class U>
  inline
 -NSCAP_BOOL
 +bool
  operator==( const nsAutoPtr<T>& lhs, const U* rhs )
    {
      return static_cast<const T*>(lhs.get()) == static_cast<const U*>(rhs);
-@@ -361,7 +361,7 @@
+@@ -361,7 +361,7 @@ operator==( const nsAutoPtr<T>& lhs, con
  
  template <class T, class U>
  inline
 -NSCAP_BOOL
 +bool
  operator==( const U* lhs, const nsAutoPtr<T>& rhs )
    {
      return static_cast<const U*>(lhs) == static_cast<const T*>(rhs.get());
-@@ -369,7 +369,7 @@
+@@ -369,7 +369,7 @@ operator==( const U* lhs, const nsAutoPt
  
  template <class T, class U>
  inline
 -NSCAP_BOOL
 +bool
  operator!=( const nsAutoPtr<T>& lhs, const U* rhs )
    {
      return static_cast<const T*>(lhs.get()) != static_cast<const U*>(rhs);
-@@ -377,7 +377,7 @@
+@@ -377,7 +377,7 @@ operator!=( const nsAutoPtr<T>& lhs, con
  
  template <class T, class U>
  inline
 -NSCAP_BOOL
 +bool
  operator!=( const U* lhs, const nsAutoPtr<T>& rhs )
    {
      return static_cast<const U*>(lhs) != static_cast<const T*>(rhs.get());
-@@ -393,7 +393,7 @@
+@@ -393,7 +393,7 @@ operator!=( const U* lhs, const nsAutoPt
  #ifndef NSCAP_DONT_PROVIDE_NONCONST_OPEQ
  template <class T, class U>
  inline
 -NSCAP_BOOL
 +bool
  operator==( const nsAutoPtr<T>& lhs, U* rhs )
    {
      return static_cast<const T*>(lhs.get()) == const_cast<const U*>(rhs);
-@@ -401,7 +401,7 @@
+@@ -401,7 +401,7 @@ operator==( const nsAutoPtr<T>& lhs, U* 
  
  template <class T, class U>
  inline
 -NSCAP_BOOL
 +bool
  operator==( U* lhs, const nsAutoPtr<T>& rhs )
    {
      return const_cast<const U*>(lhs) == static_cast<const T*>(rhs.get());
-@@ -409,7 +409,7 @@
+@@ -409,7 +409,7 @@ operator==( U* lhs, const nsAutoPtr<T>& 
  
  template <class T, class U>
  inline
 -NSCAP_BOOL
 +bool
  operator!=( const nsAutoPtr<T>& lhs, U* rhs )
    {
      return static_cast<const T*>(lhs.get()) != const_cast<const U*>(rhs);
-@@ -417,7 +417,7 @@
+@@ -417,7 +417,7 @@ operator!=( const nsAutoPtr<T>& lhs, U* 
  
  template <class T, class U>
  inline
 -NSCAP_BOOL
 +bool
  operator!=( U* lhs, const nsAutoPtr<T>& rhs )
    {
      return const_cast<const U*>(lhs) != static_cast<const T*>(rhs.get());
-@@ -430,8 +430,8 @@
+@@ -430,8 +430,8 @@ operator!=( U* lhs, const nsAutoPtr<T>& 
  
  template <class T>
  inline
 -NSCAP_BOOL
 -operator==( const nsAutoPtr<T>& lhs, NSCAP_Zero* rhs )
 +bool
 +operator==( const nsAutoPtr<T>& lhs, void* rhs )
      // specifically to allow |smartPtr == 0|
    {
      return static_cast<const void*>(lhs.get()) == reinterpret_cast<const void*>(rhs);
-@@ -439,8 +439,8 @@
+@@ -439,8 +439,8 @@ operator==( const nsAutoPtr<T>& lhs, NSC
  
  template <class T>
  inline
 -NSCAP_BOOL
 -operator==( NSCAP_Zero* lhs, const nsAutoPtr<T>& rhs )
 +bool
 +operator==( void* lhs, const nsAutoPtr<T>& rhs )
      // specifically to allow |0 == smartPtr|
    {
      return reinterpret_cast<const void*>(lhs) == static_cast<const void*>(rhs.get());
-@@ -448,8 +448,8 @@
+@@ -448,8 +448,8 @@ operator==( NSCAP_Zero* lhs, const nsAut
  
  template <class T>
  inline
 -NSCAP_BOOL
 -operator!=( const nsAutoPtr<T>& lhs, NSCAP_Zero* rhs )
 +bool
 +operator!=( const nsAutoPtr<T>& lhs, void* rhs )
      // specifically to allow |smartPtr != 0|
    {
      return static_cast<const void*>(lhs.get()) != reinterpret_cast<const void*>(rhs);
-@@ -457,38 +457,13 @@
+@@ -457,38 +457,13 @@ operator!=( const nsAutoPtr<T>& lhs, NSC
  
  template <class T>
  inline
 -NSCAP_BOOL
 -operator!=( NSCAP_Zero* lhs, const nsAutoPtr<T>& rhs )
 +bool
 +operator!=( void* lhs, const nsAutoPtr<T>& rhs )
      // specifically to allow |0 != smartPtr|
@@ -6079,140 +6121,140 @@ diff --git a/xpcom/base/nsAutoPtr.h b/xp
 -  {
 -    return reinterpret_cast<const void*>(lhs) == static_cast<const void*>(rhs.get());
 -  }
 -
 -#endif // !defined(HAVE_CPP_TROUBLE_COMPARING_TO_ZERO)
  
  /*****************************************************************************/
  
-@@ -753,7 +728,7 @@
+@@ -753,7 +728,7 @@ getter_Transfers( nsAutoArrayPtr<T>& aSm
  
  template <class T, class U>
  inline
 -NSCAP_BOOL
 +bool
  operator==( const nsAutoArrayPtr<T>& lhs, const nsAutoArrayPtr<U>& rhs )
    {
      return static_cast<const T*>(lhs.get()) == static_cast<const U*>(rhs.get());
-@@ -762,7 +737,7 @@
+@@ -762,7 +737,7 @@ operator==( const nsAutoArrayPtr<T>& lhs
  
  template <class T, class U>
  inline
 -NSCAP_BOOL
 +bool
  operator!=( const nsAutoArrayPtr<T>& lhs, const nsAutoArrayPtr<U>& rhs )
    {
      return static_cast<const T*>(lhs.get()) != static_cast<const U*>(rhs.get());
-@@ -773,7 +748,7 @@
+@@ -773,7 +748,7 @@ operator!=( const nsAutoArrayPtr<T>& lhs
  
  template <class T, class U>
  inline
 -NSCAP_BOOL
 +bool
  operator==( const nsAutoArrayPtr<T>& lhs, const U* rhs )
    {
      return static_cast<const T*>(lhs.get()) == static_cast<const U*>(rhs);
-@@ -781,7 +756,7 @@
+@@ -781,7 +756,7 @@ operator==( const nsAutoArrayPtr<T>& lhs
  
  template <class T, class U>
  inline
 -NSCAP_BOOL
 +bool
  operator==( const U* lhs, const nsAutoArrayPtr<T>& rhs )
    {
      return static_cast<const U*>(lhs) == static_cast<const T*>(rhs.get());
-@@ -789,7 +764,7 @@
+@@ -789,7 +764,7 @@ operator==( const U* lhs, const nsAutoAr
  
  template <class T, class U>
  inline
 -NSCAP_BOOL
 +bool
  operator!=( const nsAutoArrayPtr<T>& lhs, const U* rhs )
    {
      return static_cast<const T*>(lhs.get()) != static_cast<const U*>(rhs);
-@@ -797,7 +772,7 @@
+@@ -797,7 +772,7 @@ operator!=( const nsAutoArrayPtr<T>& lhs
  
  template <class T, class U>
  inline
 -NSCAP_BOOL
 +bool
  operator!=( const U* lhs, const nsAutoArrayPtr<T>& rhs )
    {
      return static_cast<const U*>(lhs) != static_cast<const T*>(rhs.get());
-@@ -813,7 +788,7 @@
+@@ -813,7 +788,7 @@ operator!=( const U* lhs, const nsAutoAr
  #ifndef NSCAP_DONT_PROVIDE_NONCONST_OPEQ
  template <class T, class U>
  inline
 -NSCAP_BOOL
 +bool
  operator==( const nsAutoArrayPtr<T>& lhs, U* rhs )
    {
      return static_cast<const T*>(lhs.get()) == const_cast<const U*>(rhs);
-@@ -821,7 +796,7 @@
+@@ -821,7 +796,7 @@ operator==( const nsAutoArrayPtr<T>& lhs
  
  template <class T, class U>
  inline
 -NSCAP_BOOL
 +bool
  operator==( U* lhs, const nsAutoArrayPtr<T>& rhs )
    {
      return const_cast<const U*>(lhs) == static_cast<const T*>(rhs.get());
-@@ -829,7 +804,7 @@
+@@ -829,7 +804,7 @@ operator==( U* lhs, const nsAutoArrayPtr
  
  template <class T, class U>
  inline
 -NSCAP_BOOL
 +bool
  operator!=( const nsAutoArrayPtr<T>& lhs, U* rhs )
    {
      return static_cast<const T*>(lhs.get()) != const_cast<const U*>(rhs);
-@@ -837,7 +812,7 @@
+@@ -837,7 +812,7 @@ operator!=( const nsAutoArrayPtr<T>& lhs
  
  template <class T, class U>
  inline
 -NSCAP_BOOL
 +bool
  operator!=( U* lhs, const nsAutoArrayPtr<T>& rhs )
    {
      return const_cast<const U*>(lhs) != static_cast<const T*>(rhs.get());
-@@ -850,8 +825,8 @@
+@@ -850,8 +825,8 @@ operator!=( U* lhs, const nsAutoArrayPtr
  
  template <class T>
  inline
 -NSCAP_BOOL
 -operator==( const nsAutoArrayPtr<T>& lhs, NSCAP_Zero* rhs )
 +bool
 +operator==( const nsAutoArrayPtr<T>& lhs, void* rhs )
      // specifically to allow |smartPtr == 0|
    {
      return static_cast<const void*>(lhs.get()) == reinterpret_cast<const void*>(rhs);
-@@ -859,8 +834,8 @@
+@@ -859,8 +834,8 @@ operator==( const nsAutoArrayPtr<T>& lhs
  
  template <class T>
  inline
 -NSCAP_BOOL
 -operator==( NSCAP_Zero* lhs, const nsAutoArrayPtr<T>& rhs )
 +bool
 +operator==( void* lhs, const nsAutoArrayPtr<T>& rhs )
      // specifically to allow |0 == smartPtr|
    {
      return reinterpret_cast<const void*>(lhs) == static_cast<const void*>(rhs.get());
-@@ -868,8 +843,8 @@
+@@ -868,8 +843,8 @@ operator==( NSCAP_Zero* lhs, const nsAut
  
  template <class T>
  inline
 -NSCAP_BOOL
 -operator!=( const nsAutoArrayPtr<T>& lhs, NSCAP_Zero* rhs )
 +bool
 +operator!=( const nsAutoArrayPtr<T>& lhs, void* rhs )
      // specifically to allow |smartPtr != 0|
    {
      return static_cast<const void*>(lhs.get()) != reinterpret_cast<const void*>(rhs);
-@@ -877,528 +852,15 @@
+@@ -877,528 +852,15 @@ operator!=( const nsAutoArrayPtr<T>& lhs
  
  template <class T>
  inline
 -NSCAP_BOOL
 -operator!=( NSCAP_Zero* lhs, const nsAutoArrayPtr<T>& rhs )
 +bool
 +operator!=( void* lhs, const nsAutoArrayPtr<T>& rhs )
      // specifically to allow |0 != smartPtr|
@@ -6737,17 +6779,17 @@ diff --git a/xpcom/base/nsAutoPtr.h b/xp
 -
 -/*****************************************************************************/
 +#define nsRefPtr nsCOMPtr
  
  #endif // !defined(nsAutoPtr_h___)
 diff --git a/xpcom/base/nsDebugImpl.cpp b/xpcom/base/nsDebugImpl.cpp
 --- a/xpcom/base/nsDebugImpl.cpp
 +++ b/xpcom/base/nsDebugImpl.cpp
-@@ -119,18 +119,6 @@
+@@ -119,18 +119,6 @@ PRBool InDebugger()
  #endif /* WIN32*/
  
  NS_IMPL_QUERY_INTERFACE1(nsDebugImpl, nsIDebug)
 -
 -NS_IMETHODIMP_(nsrefcnt)
 -nsDebugImpl::AddRef()
 -{
 -  return 2;
@@ -6787,29 +6829,29 @@ diff --git a/xpcom/base/nsISupportsBase.
   * and a reference counted memory model (AddRef/Release). This is
   * modelled after the win32 IUnknown API.
   */
 -class NS_NO_VTABLE nsISupports {
 +class NS_NO_VTABLE nsISupports : public MMgc::GCFinalizable {
  public:
  
    NS_DECLARE_STATIC_IID_ACCESSOR(NS_ISUPPORTS_IID)
-@@ -91,7 +96,10 @@
+@@ -91,7 +96,10 @@ public:
     *
     * @return The resulting reference count.
     */
 -  NS_IMETHOD_(nsrefcnt) AddRef(void) = 0;
 +  NS_IMETHOD_(nsrefcnt) AddRef(void) {
 +    NS_WARNING("Don't call AddRef, stupid");
 +    return 1;
 +  }
  
    /**
     * Decreases the reference count for this interface.
-@@ -100,7 +108,10 @@
+@@ -100,7 +108,10 @@ public:
     *
     * @return The resulting reference count.
     */
 -  NS_IMETHOD_(nsrefcnt) Release(void) = 0;
 +  NS_IMETHOD_(nsrefcnt) Release(void) {
 +    NS_WARNING("Don't call Release, stupid");
 +    return 1;
 +  }
@@ -6890,93 +6932,93 @@ deleted file mode 100644
 -
 -  void logAddCOMPtr(in voidPtr aPtr, in nsISupports aObject);
 -
 -  void logReleaseCOMPtr(in voidPtr aPtr, in nsISupports aObject);
 -};
 diff --git a/xpcom/base/nsMemoryImpl.cpp b/xpcom/base/nsMemoryImpl.cpp
 --- a/xpcom/base/nsMemoryImpl.cpp
 +++ b/xpcom/base/nsMemoryImpl.cpp
-@@ -150,7 +150,7 @@
+@@ -150,7 +150,7 @@ static MemoryFlusher sGlobalMemoryFlushe
  
  #endif // NS_MEMORY_FLUSHER
  
 -static nsMemoryImpl sGlobalMemory;
 +static nsMemoryImpl *sGlobalMemory;
  
  NS_IMPL_QUERY_INTERFACE1(nsMemoryImpl, nsIMemory)
  
-@@ -209,8 +209,11 @@
+@@ -209,8 +209,11 @@ nsMemoryImpl::InitFlusher()
  /*static*/ nsresult
  nsMemoryImpl::Create(nsISupports* outer, const nsIID& aIID, void **aResult)
  {
 +    if (!sGlobalMemory)
 +        sGlobalMemory = new nsMemoryImpl();
 +
      NS_ENSURE_NO_AGGREGATION(outer);
 -    return sGlobalMemory.QueryInterface(aIID, aResult);
 +    return sGlobalMemory->QueryInterface(aIID, aResult);
  }
  
  nsresult
-@@ -258,14 +261,12 @@
+@@ -258,14 +261,12 @@ nsMemoryImpl::RunFlushers(const PRUnicha
  }
  
  // XXX need NS_IMPL_STATIC_ADDREF/RELEASE
 -NS_IMETHODIMP_(nsrefcnt) nsMemoryImpl::FlushEvent::AddRef() { return 2; }
 -NS_IMETHODIMP_(nsrefcnt) nsMemoryImpl::FlushEvent::Release() { return 1; }
  NS_IMPL_QUERY_INTERFACE1(nsMemoryImpl::FlushEvent, nsIRunnable)
  
  NS_IMETHODIMP
  nsMemoryImpl::FlushEvent::Run()
  {
 -    sGlobalMemory.RunFlushers(mReason);
 +    sGlobalMemory->RunFlushers(mReason);
      return NS_OK;
  }
  
-@@ -281,7 +282,7 @@
+@@ -281,7 +282,7 @@ NS_Alloc(PRSize size)
      void* result = MALLOC1(size);
      if (! result) {
          // Request an asynchronous flush
 -        sGlobalMemory.FlushMemory(NS_LITERAL_STRING("alloc-failure").get(), PR_FALSE);
 +        sGlobalMemory->FlushMemory(NS_LITERAL_STRING("alloc-failure").get(), PR_FALSE);
      }
      return result;
  }
-@@ -292,7 +293,7 @@
+@@ -292,7 +293,7 @@ NS_Realloc(void* ptr, PRSize size)
      void* result = REALLOC1(ptr, size);
      if (! result && size != 0) {
          // Request an asynchronous flush
 -        sGlobalMemory.FlushMemory(NS_LITERAL_STRING("alloc-failure").get(), PR_FALSE);
 +        sGlobalMemory->FlushMemory(NS_LITERAL_STRING("alloc-failure").get(), PR_FALSE);
      }
      return result;
  }
-@@ -311,7 +312,7 @@
+@@ -311,7 +312,7 @@ MemoryFlusher::Notify(nsITimer *timer)
  MemoryFlusher::Notify(nsITimer *timer)
  {
      PRBool isLowMemory;
 -    sGlobalMemory.IsLowMemory(&isLowMemory);
 +    sGlobalMemory->IsLowMemory(&isLowMemory);
  
  #ifdef NS_TEST_MEMORY_FLUSHER
      // Fire the flusher *every* time
-@@ -319,8 +320,8 @@
+@@ -319,8 +320,8 @@ MemoryFlusher::Notify(nsITimer *timer)
  #endif
  
      if (isLowMemory)
 -        sGlobalMemory.FlushMemory(NS_LITERAL_STRING("low-memory").get(),
 -                                  PR_FALSE);
 +        sGlobalMemory->FlushMemory(NS_LITERAL_STRING("low-memory").get(),
 +                                   PR_FALSE);
      return NS_OK;
  }
  
-@@ -343,5 +344,9 @@
+@@ -343,5 +344,9 @@ nsresult
  nsresult
  NS_GetMemoryManager(nsIMemory* *result)
  {
 -    return sGlobalMemory.QueryInterface(NS_GET_IID(nsIMemory), (void**) result);
 +    if (!sGlobalMemory)
 +        sGlobalMemory = new nsMemoryImpl();
 +
 +    *result = sGlobalMemory;
@@ -7053,17 +7095,17 @@ diff --git a/xpcom/base/nsTraceRefcntImp
 -static PRBool gLogToLeaky;
 -static PRBool gLogLeaksOnly;
 -
 -static void (*leakyLogAddRef)(void* p, int oldrc, int newrc);
 -static void (*leakyLogRelease)(void* p, int oldrc, int newrc);
  
  #define BAD_TLS_INDEX ((PRUintn) -1)
  
-@@ -111,712 +63,11 @@
+@@ -111,712 +63,11 @@ static void (*leakyLogRelease)(void* p, 
  // activity is ok, otherwise not!
  static PRUintn gActivityTLS = BAD_TLS_INDEX;
  
 -static PRBool gInitialized;
 -static nsrefcnt gInitCount;
 -
 -static FILE *gBloatLog = nsnull;
 -static FILE *gRefcntsLog = nsnull;
@@ -7766,17 +7808,17 @@ diff --git a/xpcom/base/nsTraceRefcntImp
 -
 -  gTraceLock = PR_NewLock();
 -}
 -
 -#endif
  
  extern "C" {
  
-@@ -874,13 +125,26 @@
+@@ -874,13 +125,26 @@ nsTraceRefcntImpl::DemangleSymbol(const 
  
  //----------------------------------------------------------------------
  
 +static int gInitCount;
 +NS_COM JSRuntime *gJSRuntime;
 +
 +const uint32 kGCSize = 32L * 1024L * 1024L;
 +
@@ -7797,17 +7839,17 @@ diff --git a/xpcom/base/nsTraceRefcntImp
 +    // This leaves the maximum-JS_malloc-bytes threshold still in effect
 +    // to cause period, and we hope hygienic, last-ditch GCs from within
 +    // the GC's allocator.
 +    JS_SetGCParameter(gJSRuntime, JSGC_MAX_BYTES, 0xffffffff);
 +  }
  }
  
  EXPORT_XPCOM_API(void)
-@@ -888,18 +152,26 @@
+@@ -888,18 +152,26 @@ NS_LogTerm()
  {
    NS_ASSERTION(gInitCount > 0,
                 "NS_LogTerm without matching NS_LogInit");
 +  NS_ASSERTION(gJSRuntime,
 +               "gJSRuntime null in NS_LogTerm");
  
    if (--gInitCount == 0) {
 -    if (gInitialized) {
@@ -7829,17 +7871,17 @@ diff --git a/xpcom/base/nsTraceRefcntImp
 +{
 +  if (!gJSRuntime)
 +    return NULL;
 +
 +  return gJSRuntime->gc;
  }
  
  EXPORT_XPCOM_API(void)
-@@ -1215,68 +487,3 @@
+@@ -1215,68 +487,3 @@ nsTraceRefcntImpl::SetActivityIsLegal(PR
    PR_SetThreadPrivate(gActivityTLS, NS_INT32_TO_PTR(!aLegal));
  #endif
  }
 -
 -NS_IMPL_QUERY_INTERFACE1(nsTraceRefcntImpl, nsITraceRefcnt)
 -
 -NS_IMETHODIMP_(nsrefcnt) nsTraceRefcntImpl::AddRef(void)
 -{
@@ -7966,45 +8008,45 @@ diff --git a/xpcom/base/nsTraceRefcntImp
 +  NS_COM void SetActivityIsLegal(PRBool aLegal);
 +}
  
  ////////////////////////////////////////////////////////////////////////////////
  // And now for that utility that you've all been asking for...
 diff --git a/xpcom/build/Makefile.in b/xpcom/build/Makefile.in
 --- a/xpcom/build/Makefile.in
 +++ b/xpcom/build/Makefile.in
-@@ -71,6 +71,7 @@
+@@ -71,6 +71,7 @@ MOZILLA_INTERNAL_API = 1
  MOZILLA_INTERNAL_API = 1
  
  REQUIRES	= string \
 +		  js \
  		  $(NULL)
  
  # pull in MoreFiles for MacOSX
-@@ -144,6 +145,7 @@
+@@ -144,6 +145,7 @@ SDK_HEADERS =  \
  
  EXPORTS	= \
  		nsXPCOMCIDInternal.h \
 +		nsXPCOMPrivate.h \
  		$(NULL)
  
  # Force use of PIC
-@@ -168,7 +170,7 @@
+@@ -168,7 +170,7 @@ DEFINES		+= \
  		-DEXPORT_XPT_API \
  		-DEXPORT_XPTC_API
  
--EXTRA_DSO_LDOPTS += $(NSPR_LIBS) $(MMGC_LIBS)
+-EXTRA_DSO_LDOPTS += $(NSPR_LIBS)
 +EXTRA_DSO_LDOPTS += $(MOZ_JS_LIBS) $(NSPR_LIBS) $(MMGC_LIBS)
  
  ifdef GC_LEAK_DETECTOR
  DEFINES += -DGC_LEAK_DETECTOR
 diff --git a/xpcom/build/dlldeps.cpp b/xpcom/build/dlldeps.cpp
 --- a/xpcom/build/dlldeps.cpp
 +++ b/xpcom/build/dlldeps.cpp
-@@ -164,8 +164,6 @@
+@@ -164,8 +164,6 @@ void XXXNeverCalled()
      a.Free(0, 0);
      nsDeque d(nsnull);
      nsDequeIterator di(d);
 -    nsTraceRefcnt::LogAddCOMPtr(nsnull, nsnull);
 -    nsTraceRefcntImpl::DumpStatistics();
      NS_NewEmptyEnumerator(nsnull);
      NS_QuickSort(nsnull, 0, 0, nsnull, nsnull);
      nsString();
@@ -8022,17 +8064,17 @@ diff --git a/xpcom/build/nsXPCOM.h b/xpc
 @@ -66,6 +65,7 @@
  # define NS_LogCOMPtrRelease         NS_LogCOMPtrRelease_P
  # define NS_CycleCollectorSuspect    NS_CycleCollectorSuspect_P
  # define NS_CycleCollectorForget     NS_CycleCollectorForget_P
 +# define NS_GetGC                    NS_GetGC_P
  #endif
  
  #include "nscore.h"
-@@ -467,6 +467,19 @@
+@@ -467,6 +467,19 @@ NS_CycleCollectorForget(nsISupports *n);
  NS_CycleCollectorForget(nsISupports *n);
  
  /**
 + * Get a reference to the one-and-only GC used by XPCOM:
 + */
 +#ifdef __cplusplus
 +namespace MMgc
 +{
@@ -8042,17 +8084,17 @@ diff --git a/xpcom/build/nsXPCOM.h b/xpc
 +XPCOM_API(MMgc::GC*)
 +NS_GetGC();
 +#endif
 +
 +/**
   * Categories (in the category manager service) used by XPCOM:
   */
  
-@@ -550,7 +563,4 @@
+@@ -550,7 +563,4 @@ XPCOM_API(nsresult)
  XPCOM_API(nsresult)
  NS_GetDebug(nsIDebug* *result);
  
 -XPCOM_API(nsresult)
 -NS_GetTraceRefcnt(nsITraceRefcnt* *result);
 -
  #endif
 diff --git a/xpcom/build/nsXPCOMPrivate.h b/xpcom/build/nsXPCOMPrivate.h
@@ -8068,74 +8110,74 @@ diff --git a/xpcom/build/nsXPCOMPrivate.
 +
 +extern NS_COM JSRuntime *gJSRuntime;
  
  class nsStringContainer;
  class nsCStringContainer;
 diff --git a/xpcom/build/nsXPComInit.cpp b/xpcom/build/nsXPComInit.cpp
 --- a/xpcom/build/nsXPComInit.cpp
 +++ b/xpcom/build/nsXPComInit.cpp
-@@ -467,14 +467,6 @@
+@@ -467,14 +467,6 @@ NS_GetDebug(nsIDebug** result)
  }
  
  EXPORT_XPCOM_API(nsresult)
 -NS_GetTraceRefcnt(nsITraceRefcnt** result)
 -{
 -    return nsTraceRefcntImpl::Create(nsnull, 
 -                                     NS_GET_IID(nsITraceRefcnt), 
 -                                     (void**) result);
 -}
 -
 -EXPORT_XPCOM_API(nsresult)
  NS_InitXPCOM(nsIServiceManager* *result,
                               nsIFile* binDirectory)
  {
-@@ -820,11 +812,6 @@
+@@ -820,11 +812,6 @@ NS_ShutdownXPCOM(nsIServiceManager* serv
  
      // Finally, release the component manager last because it unloads the
      // libraries:
 -    if (nsComponentManagerImpl::gComponentManager) {
 -      nsrefcnt cnt;
 -      NS_RELEASE2(nsComponentManagerImpl::gComponentManager, cnt);
 -      NS_ASSERTION(cnt == 0, "Component Manager being held past XPCOM shutdown.");
 -    }
      nsComponentManagerImpl::gComponentManager = nsnull;
  
  #ifdef DEBUG
 diff --git a/xpcom/components/Makefile.in b/xpcom/components/Makefile.in
 --- a/xpcom/components/Makefile.in
 +++ b/xpcom/components/Makefile.in
-@@ -49,6 +49,7 @@
+@@ -49,6 +49,7 @@ MOZILLA_INTERNAL_API = 1
  MOZILLA_INTERNAL_API = 1
  
  REQUIRES	= string \
 +		  js \
  		  $(NULL)
  
  CPPSRCS		= \
 diff --git a/xpcom/components/nsComponentManager.cpp b/xpcom/components/nsComponentManager.cpp
 --- a/xpcom/components/nsComponentManager.cpp
 +++ b/xpcom/components/nsComponentManager.cpp
-@@ -163,12 +163,13 @@
+@@ -163,12 +163,13 @@ static void GetIDString(const nsID& aCID
                  (PRUint32) aCID.m3[6], (PRUint32) aCID.m3[7]);
  }
  
 -nsresult
 -nsGetServiceFromCategory::operator()(const nsIID& aIID, void** aInstancePtr) const
 +void*
 +nsGetServiceFromCategory::get(const nsIID& aIID) const
  {
      nsresult rv;
      nsXPIDLCString value;
      nsCOMPtr<nsICategoryManager> catman;
 +    void *result = NULL;
      nsComponentManagerImpl *compMgr = nsComponentManagerImpl::gComponentManager;
      if (!compMgr) {
          rv = NS_ERROR_NOT_INITIALIZED;
-@@ -197,14 +198,14 @@
+@@ -197,14 +198,14 @@ nsGetServiceFromCategory::operator()(con
  
      rv = compMgr->
          nsComponentManagerImpl::GetServiceByContractID(value,
 -                                                       aIID, aInstancePtr);
 +                                                       aIID, &result);
      if (NS_FAILED(rv)) {
      error:
 -        *aInstancePtr = 0;
@@ -8143,127 +8185,127 @@ diff --git a/xpcom/components/nsComponen
      }
      if (mErrorPtr)
          *mErrorPtr = rv;
 -    return rv;
 +    return result;
  }
  
  ////////////////////////////////////////////////////////////////////////////////
-@@ -3224,9 +3225,12 @@
+@@ -3227,9 +3228,12 @@ nsComponentManagerImpl::AutoRegister(nsI
      nsresult rv;
  
      if (!mCategoryManager) {
 -        mCategoryManager = do_GetService(NS_CATEGORYMANAGER_CONTRACTID, &rv);
 +        nsICategoryManager* catMan =
 +            do_GetService(NS_CATEGORYMANAGER_CONTRACTID, &rv);
          if (NS_FAILED(rv))
              return rv;
 +
 +        mCategoryManager = static_cast<nsCategoryManager*>(catMan);
      }
  
      GetAllLoaders();
 diff --git a/xpcom/ds/nsAtomTable.cpp b/xpcom/ds/nsAtomTable.cpp
 --- a/xpcom/ds/nsAtomTable.cpp
 +++ b/xpcom/ds/nsAtomTable.cpp
-@@ -454,7 +454,6 @@
+@@ -454,7 +454,6 @@ PermanentAtomImpl::~PermanentAtomImpl()
  PermanentAtomImpl::~PermanentAtomImpl()
  {
    // So we can tell if we were permanent while running the base class dtor.
 -  mRefCnt = REFCNT_PERMANENT_SENTINEL;
  }
  
  NS_IMETHODIMP_(nsrefcnt) PermanentAtomImpl::AddRef()
 diff --git a/xpcom/ds/nsAtomTable.h b/xpcom/ds/nsAtomTable.h
 --- a/xpcom/ds/nsAtomTable.h
 +++ b/xpcom/ds/nsAtomTable.h
-@@ -65,7 +65,8 @@
+@@ -65,7 +65,8 @@ public:
  
    // We can't use the virtual function in the base class destructor.
    PRBool IsPermanentInDestructor() {
 -    return mRefCnt == REFCNT_PERMANENT_SENTINEL;
 +    // XXXbsmedberg: going away next!
 +    return PR_TRUE;
    }
  
    void* operator new(size_t size, const nsACString& aString) CPP_THROW_NEW;
-@@ -75,7 +76,7 @@
+@@ -75,7 +76,7 @@ public:
    }
  
    // for |#ifdef NS_BUILD_REFCNT_LOGGING| access to reference count
 -  nsrefcnt GetRefCount() { return mRefCnt; }
 +  nsrefcnt GetRefCount() { return 1; }
  
    // The length of the string in the atom.
    PRUint32 mLength;
 diff --git a/xpcom/ds/nsIAtom.idl b/xpcom/ds/nsIAtom.idl
 --- a/xpcom/ds/nsIAtom.idl
 +++ b/xpcom/ds/nsIAtom.idl
-@@ -113,9 +113,9 @@
+@@ -113,9 +113,9 @@ extern NS_COM nsIAtom* NS_NewAtom(const 
  extern NS_COM nsIAtom* NS_NewAtom(const char* aUTF8String);
  extern NS_COM nsIAtom* NS_NewPermanentAtom(const char* aUTF8String);
  
 -inline already_AddRefed<nsIAtom> do_GetAtom(const char* aUTF8String)
 +inline nsIAtom* do_GetAtom(const char* aUTF8String)
      { return NS_NewAtom(aUTF8String); }
 -inline already_AddRefed<nsIAtom> do_GetPermanentAtom(const char* aUTF8String)
 +inline nsIAtom* do_GetPermanentAtom(const char* aUTF8String)
      { return NS_NewPermanentAtom(aUTF8String); }
   
  /**
-@@ -124,9 +124,9 @@
+@@ -124,9 +124,9 @@ extern NS_COM nsIAtom* NS_NewAtom(const 
  extern NS_COM nsIAtom* NS_NewAtom(const nsACString& aUTF8String);
  extern NS_COM nsIAtom* NS_NewPermanentAtom(const nsACString& aUTF8String);
  
 -inline already_AddRefed<nsIAtom> do_GetAtom(const nsACString& aUTF8String)
 +inline nsIAtom* do_GetAtom(const nsACString& aUTF8String)
      { return NS_NewAtom(aUTF8String); }
 -inline already_AddRefed<nsIAtom> do_GetPermanentAtom(const nsACString& aUTF8String)
 +inline nsIAtom* do_GetPermanentAtom(const nsACString& aUTF8String)
      { return NS_NewPermanentAtom(aUTF8String); }
  
  /**
-@@ -136,9 +136,9 @@
+@@ -136,9 +136,9 @@ extern NS_COM nsIAtom* NS_NewAtom(const 
  extern NS_COM nsIAtom* NS_NewAtom(const PRUnichar* aUTF16String);
  extern NS_COM nsIAtom* NS_NewPermanentAtom(const PRUnichar* aUTF16String);
  
 -inline already_AddRefed<nsIAtom> do_GetAtom(const PRUnichar* aUTF16String)
 +inline nsIAtom* do_GetAtom(const PRUnichar* aUTF16String)
      { return NS_NewAtom(aUTF16String); }
 -inline already_AddRefed<nsIAtom> do_GetPermanentAtom(const PRUnichar* aUTF16String)
 +inline nsIAtom* do_GetPermanentAtom(const PRUnichar* aUTF16String)
      { return NS_NewPermanentAtom(aUTF16String); }
  
  /**
-@@ -147,9 +147,9 @@
+@@ -147,9 +147,9 @@ extern NS_COM nsIAtom* NS_NewAtom(const 
  extern NS_COM nsIAtom* NS_NewAtom(const nsAString& aUTF16String);
  extern NS_COM nsIAtom* NS_NewPermanentAtom(const nsAString& aUTF16String);
  
 -inline already_AddRefed<nsIAtom> do_GetAtom(const nsAString& aUTF16String)
 +inline nsIAtom* do_GetAtom(const nsAString& aUTF16String)
      { return NS_NewAtom(aUTF16String); }
 -inline already_AddRefed<nsIAtom> do_GetPermanentAtom(const nsAString& aUTF16String)
 +inline nsIAtom* do_GetPermanentAtom(const nsAString& aUTF16String)
      { return NS_NewPermanentAtom(aUTF16String); }
  
  /**
 diff --git a/xpcom/ds/nsICollection.idl b/xpcom/ds/nsICollection.idl
 --- a/xpcom/ds/nsICollection.idl
 +++ b/xpcom/ds/nsICollection.idl
-@@ -63,7 +63,7 @@
+@@ -63,7 +63,7 @@ interface nsICollection : nsISerializabl
  #include "nsCOMPtr.h"
  #endif
  
 -class NS_COM nsQueryElementAt : public nsCOMPtr_helper
 +class NS_COM nsQueryElementAt
    {
      public:
        nsQueryElementAt( nsICollection* aCollection, PRUint32 aIndex, nsresult* aErrorPtr )
-@@ -74,9 +74,15 @@
+@@ -74,9 +74,15 @@ class NS_COM nsQueryElementAt : public n
            // nothing else to do here
          }
  
 -      virtual nsresult NS_FASTCALL operator()( const nsIID& aIID, void** ) const;
 +      template<class D>
 +      operator D*() const
 +      {
 +          return static_cast<D*>(get(NS_GET_TEMPLATE_IID(D)));
@@ -8273,17 +8315,17 @@ diff --git a/xpcom/ds/nsICollection.idl 
 +      void* get(const nsIID &aIID) const;
 +
        nsICollection*  mCollection;
        PRUint32        mIndex;
        nsresult*       mErrorPtr;
 diff --git a/xpcom/ds/nsSupportsArray.cpp b/xpcom/ds/nsSupportsArray.cpp
 --- a/xpcom/ds/nsSupportsArray.cpp
 +++ b/xpcom/ds/nsSupportsArray.cpp
-@@ -112,17 +112,18 @@
+@@ -112,17 +112,18 @@ SupportsStats gSupportsStats;
  SupportsStats gSupportsStats;
  #endif
  
 -nsresult
 -nsQueryElementAt::operator()( const nsIID& aIID, void** aResult ) const
 +void*
 +nsQueryElementAt::get(const nsIID &aIID) const
    {
@@ -8299,45 +8341,45 @@ diff --git a/xpcom/ds/nsSupportsArray.cp
 -    return status;
 +    return result;
    }
  
  static const PRInt32 kGrowArrayBy = 8;
 diff --git a/xpcom/glue/Makefile.in b/xpcom/glue/Makefile.in
 --- a/xpcom/glue/Makefile.in
 +++ b/xpcom/glue/Makefile.in
-@@ -51,6 +51,7 @@
+@@ -51,6 +51,7 @@ DIST_INSTALL	= 1
  
  REQUIRES = \
  		string \
 +		js \
  		$(NULL)
  
  LOCAL_INCLUDES	= \
 diff --git a/xpcom/glue/nsArrayEnumerator.cpp b/xpcom/glue/nsArrayEnumerator.cpp
 --- a/xpcom/glue/nsArrayEnumerator.cpp
 +++ b/xpcom/glue/nsArrayEnumerator.cpp
-@@ -136,14 +136,10 @@
+@@ -136,14 +136,10 @@ public:
      NS_DECL_NSISIMPLEENUMERATOR
  
      // nsSimpleArrayEnumerator methods
 -    nsCOMArrayEnumerator() : mIndex(0) {
 -    }
 +    nsCOMArrayEnumerator(const nsCOMArray_base &array);
  
      // specialized operator to make sure we make room for mValues
 -    void* operator new (size_t size, const nsCOMArray_base& aArray) CPP_THROW_NEW;
 -    void operator delete(void* ptr) {
 -        ::operator delete(ptr);
 -    }
 +    void* operator new (size_t size, PRUint32 item_count) CPP_THROW_NEW;
  
  private:
      ~nsCOMArrayEnumerator(void);
-@@ -157,6 +153,18 @@
+@@ -157,6 +153,18 @@ protected:
  };
  
  NS_IMPL_ISUPPORTS1(nsCOMArrayEnumerator, nsISimpleEnumerator)
 +
 +nsCOMArrayEnumerator::nsCOMArrayEnumerator(const nsCOMArray_base &array)
 +    : mIndex(0)
 +    , mArraySize(array.Count())
 +{
@@ -8346,17 +8388,17 @@ diff --git a/xpcom/glue/nsArrayEnumerato
 +            NS_GetGC()->WriteBarrier(&mValueArray[i], array[i]);
 +        else
 +            mValueArray[i] = NULL;
 +    }
 +}
  
  nsCOMArrayEnumerator::~nsCOMArrayEnumerator()
  {
-@@ -200,38 +208,22 @@
+@@ -200,38 +208,22 @@ nsCOMArrayEnumerator::GetNext(nsISupport
  }
  
  void*
 -nsCOMArrayEnumerator::operator new (size_t size, const nsCOMArray_base& aArray)
 +nsCOMArrayEnumerator::operator new (size_t size, PRUint32 item_count)
      CPP_THROW_NEW
  {
      // create enough space such that mValueArray points to a large
@@ -10750,17 +10792,17 @@ diff --git a/xpcom/glue/nsCOMPtr.h b/xpc
 -    return CallQueryInterface(aSourcePtr.get(), aDestPtr);
 -  }
  
  
  
 diff --git a/xpcom/glue/nsComponentManagerUtils.cpp b/xpcom/glue/nsComponentManagerUtils.cpp
 --- a/xpcom/glue/nsComponentManagerUtils.cpp
 +++ b/xpcom/glue/nsComponentManagerUtils.cpp
-@@ -193,103 +193,62 @@
+@@ -193,103 +193,62 @@ CallGetClassObject(const char *aContract
  
  #endif
  
 -nsresult
 -nsCreateInstanceByCID::operator()( const nsIID& aIID, void** aInstancePtr ) const
 +void*
 +nsCreateInstanceByCID::get(const nsIID& aIID) const
  {
@@ -10888,26 +10930,26 @@ diff --git a/xpcom/glue/nsComponentManag
 -    
 -    if ( mErrorPtr )
 -        *mErrorPtr = status;
 -    return status;
 -}
 diff --git a/xpcom/glue/nsComponentManagerUtils.h b/xpcom/glue/nsComponentManagerUtils.h
 --- a/xpcom/glue/nsComponentManagerUtils.h
 +++ b/xpcom/glue/nsComponentManagerUtils.h
-@@ -68,7 +68,7 @@
+@@ -68,7 +68,7 @@ CallGetClassObject
    (const char *aContractID, const nsIID &aIID, void **aResult);
  
  
 -class NS_COM_GLUE nsCreateInstanceByCID : public nsCOMPtr_helper
 +class NS_COM_GLUE nsCreateInstanceByCID
  {
  public:
      nsCreateInstanceByCID( const nsCID& aCID, nsISupports* aOuter, nsresult* aErrorPtr )
-@@ -79,15 +79,21 @@
+@@ -79,15 +79,21 @@ public:
          // nothing else to do here
      }
      
 -    virtual nsresult NS_FASTCALL operator()( const nsIID&, void** ) const;
 -    
 +    template<class D>
 +    operator D*() const
 +    {
@@ -10922,17 +10964,17 @@ diff --git a/xpcom/glue/nsComponentManag
      nsresult*       mErrorPtr;
  };
  
 -class NS_COM_GLUE nsCreateInstanceByContractID : public nsCOMPtr_helper
 +class NS_COM_GLUE nsCreateInstanceByContractID
  {
  public:
      nsCreateInstanceByContractID( const char* aContractID, nsISupports* aOuter, nsresult* aErrorPtr )
-@@ -98,15 +104,21 @@
+@@ -98,15 +104,21 @@ public:
          // nothing else to do here
      }
      
 -    virtual nsresult NS_FASTCALL operator()( const nsIID&, void** ) const;
 +    template<class D>
 +    operator D*() const
 +    {
 +        return static_cast<D*>(get(NS_GET_TEMPLATE_IID(D)));
@@ -10946,17 +10988,17 @@ diff --git a/xpcom/glue/nsComponentManag
      nsresult*     mErrorPtr;
  };
  
 -class NS_COM_GLUE nsCreateInstanceFromFactory : public nsCOMPtr_helper
 +class NS_COM_GLUE nsCreateInstanceFromFactory
  {
  public:
      nsCreateInstanceFromFactory( nsIFactory* aFactory, nsISupports* aOuter, nsresult* aErrorPtr )
-@@ -117,9 +129,15 @@
+@@ -117,9 +129,15 @@ public:
          // nothing else to do here
      }
      
 -    virtual nsresult NS_FASTCALL operator()( const nsIID&, void** ) const;
 -    
 +    template<class D>
 +    operator D*() const
 +    {
@@ -10964,26 +11006,26 @@ diff --git a/xpcom/glue/nsComponentManag
 +    }
 +        
  private:
 +    void* get(const nsIID &aIID) const;
 +
      nsIFactory*   mFactory;
      nsISupports*  mOuter;
      nsresult*     mErrorPtr;
-@@ -169,7 +187,7 @@
+@@ -169,7 +187,7 @@ do_CreateInstance( nsIFactory* aFactory,
  }
  
  
 -class NS_COM_GLUE nsGetClassObjectByCID : public nsCOMPtr_helper
 +class NS_COM_GLUE nsGetClassObjectByCID
  {
  public:
      nsGetClassObjectByCID( const nsCID& aCID, nsresult* aErrorPtr )
-@@ -179,14 +197,20 @@
+@@ -179,14 +197,20 @@ public:
          // nothing else to do here
      }
      
 -    virtual nsresult NS_FASTCALL operator()( const nsIID&, void** ) const;
 -    
 +    template<class D>
 +    operator D*() const
 +    {
@@ -10997,17 +11039,17 @@ diff --git a/xpcom/glue/nsComponentManag
      nsresult*       mErrorPtr;
  };
  
 -class NS_COM_GLUE nsGetClassObjectByContractID : public nsCOMPtr_helper
 +class NS_COM_GLUE nsGetClassObjectByContractID
  {
  public:
      nsGetClassObjectByContractID( const char* aContractID, nsresult* aErrorPtr )
-@@ -196,9 +220,15 @@
+@@ -196,9 +220,15 @@ public:
          // nothing else to do here
      }
      
 -    virtual nsresult NS_FASTCALL operator()( const nsIID&, void** ) const;
 -    
 +    template<class D>
 +    operator D*() const
 +    {
@@ -11074,17 +11116,17 @@ diff --git a/xpcom/glue/nsEnumeratorUtil
  #include "nsCOMPtr.h"
  
 -class EmptyEnumeratorImpl : public nsISimpleEnumerator,
 +class EmptyEnumeratorImpl : public XPCOMGCObject,
 +                            public nsISimpleEnumerator,
                              public nsIUTF8StringEnumerator,
                              public nsIStringEnumerator
  {
-@@ -63,23 +64,14 @@
+@@ -63,23 +64,14 @@ public:
      NS_IMETHOD GetNext(nsAString& aResult);
  
      static EmptyEnumeratorImpl* GetInstance() {
 -        return const_cast<EmptyEnumeratorImpl*>(&kInstance);
 +        if (!gInstance)
 +            gInstance = new EmptyEnumeratorImpl();
 +        return gInstance;
      }
@@ -11102,17 +11144,17 @@ diff --git a/xpcom/glue/nsEnumeratorUtil
 -
 -NS_IMETHODIMP_(nsrefcnt) EmptyEnumeratorImpl::Release(void)
 -{
 -    return 1;
 -}
  
  NS_IMPL_QUERY_INTERFACE1(EmptyEnumeratorImpl, nsISimpleEnumerator)
  
-@@ -111,7 +103,7 @@
+@@ -111,7 +103,7 @@ NS_IMETHODIMP EmptyEnumeratorImpl::GetNe
      return NS_ERROR_UNEXPECTED;
  }
  
 -const EmptyEnumeratorImpl EmptyEnumeratorImpl::kInstance;
 +EmptyEnumeratorImpl* EmptyEnumeratorImpl::gInstance;
  
  nsresult
  NS_NewEmptyEnumerator(nsISimpleEnumerator** aResult)
@@ -11127,17 +11169,17 @@ diff --git a/xpcom/glue/nsIInterfaceRequ
 -nsGetInterface::operator()( const nsIID& aIID, void** aInstancePtr ) const
 +void*
 +nsGetInterface::get(const nsIID& aIID) const
  {
 +  void *result = NULL;
    nsresult status;
  
    if ( mSource )
-@@ -49,17 +50,17 @@
+@@ -49,17 +50,17 @@ nsGetInterface::operator()( const nsIID&
      nsCOMPtr<nsIInterfaceRequestor> factoryPtr = do_QueryInterface(mSource, &status);
  
      if ( factoryPtr )
 -      status = factoryPtr->GetInterface(aIID, aInstancePtr);
 +      status = factoryPtr->GetInterface(aIID, &result);
      else
        status = NS_ERROR_NO_INTERFACE;
  
@@ -11151,26 +11193,26 @@ diff --git a/xpcom/glue/nsIInterfaceRequ
    if ( mErrorPtr )
      *mErrorPtr = status;
 -  return status;
 +  return result;
  }
 diff --git a/xpcom/glue/nsIInterfaceRequestorUtils.h b/xpcom/glue/nsIInterfaceRequestorUtils.h
 --- a/xpcom/glue/nsIInterfaceRequestorUtils.h
 +++ b/xpcom/glue/nsIInterfaceRequestorUtils.h
-@@ -55,7 +55,7 @@
+@@ -55,7 +55,7 @@ CallGetInterface( T* aSource, Destinatio
                                   reinterpret_cast<void**>(aDestination));
    }
  
 -class NS_COM_GLUE nsGetInterface : public nsCOMPtr_helper
 +class NS_COM_GLUE nsGetInterface
    {
      public:
        nsGetInterface( nsISupports* aSource, nsresult* error )
-@@ -65,9 +65,15 @@
+@@ -65,9 +65,15 @@ class NS_COM_GLUE nsGetInterface : publi
            // nothing else to do here
          }
  
 -      virtual nsresult NS_FASTCALL operator()( const nsIID&, void** ) const;
 +      template<class D>
 +      operator D*() const
 +      {
 +        return static_cast<D*>(get(NS_GET_TEMPLATE_IID(D)));
@@ -11180,17 +11222,17 @@ diff --git a/xpcom/glue/nsIInterfaceRequ
 +      void* get(const nsIID &aIID) const;
 +
        nsISupports*          mSource;
        nsresult*             mErrorPtr;
    };
 diff --git a/xpcom/glue/nsISupportsImpl.h b/xpcom/glue/nsISupportsImpl.h
 --- a/xpcom/glue/nsISupportsImpl.h
 +++ b/xpcom/glue/nsISupportsImpl.h
-@@ -88,31 +88,6 @@
+@@ -88,31 +88,6 @@ private:
  #define NS_CLEAR_PURPLE_BIT(x) ((x) &= (NS_PURPLE_MASK))
  #define NS_VALUE_WITHOUT_PURPLE_BIT(x) ((x) & (NS_PURPLE_MASK))
  
 -
 -// Support for ISupports classes which interact with cycle collector.
 -
 -class nsAutoRefCnt {
 -
@@ -11212,28 +11254,28 @@ diff --git a/xpcom/glue/nsISupportsImpl.
 -    nsrefcnt mValue;
 -};
 -
 -typedef nsAutoRefCnt nsCycleCollectingAutoRefCnt;
 -
  ///////////////////////////////////////////////////////////////////////////////
  
  /**
-@@ -124,10 +99,7 @@
+@@ -124,10 +99,7 @@ public:                                 
  public:                                                                       \
    NS_IMETHOD QueryInterface(REFNSIID aIID,                                    \
                              void** aInstancePtr);                             \
 -  NS_IMETHOD_(nsrefcnt) AddRef(void);                                         \
 -  NS_IMETHOD_(nsrefcnt) Release(void);                                        \
  protected:                                                                    \
 -  nsAutoRefCnt mRefCnt;                                                       \
    NS_DECL_OWNINGTHREAD                                                        \
  public:
  
-@@ -135,125 +107,21 @@
+@@ -135,125 +107,21 @@ public:
  
  ///////////////////////////////////////////////////////////////////////////////
  
 -/**
 - * Previously used to initialize the reference count, but no longer needed.
 - *
 - * DEPRECATED.
 - */
@@ -11362,37 +11404,37 @@ diff --git a/xpcom/glue/nsISupportsImpl.
 +#define NS_IMPL_CYCLE_COLLECTING_RELEASE_FULL(_class, _basetype, _destroy)
 +#define NS_IMPL_CYCLE_COLLECTING_RELEASE_WITH_DESTROY(_class, _destroy)
 +#define NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUOUS_WITH_DESTROY(_class, _basetype, _destroy)
 +#define NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUOUS(_class, _basetype)
 +#define NS_IMPL_CYCLE_COLLECTING_RELEASE(_class)
  
  ///////////////////////////////////////////////////////////////////////////////
  
-@@ -353,7 +221,7 @@
+@@ -353,7 +221,7 @@ NS_IMETHODIMP _class::QueryInterface(REF
  {                                                                             \
    NS_ASSERTION(aInstancePtr,                                                  \
                 "QueryInterface requires a non-NULL destination!");            \
 -  nsISupports* foundInterface;
 +  void* foundInterface;
  
  #define NS_IMPL_QUERY_BODY(_interface)                                        \
    if ( aIID.Equals(NS_GET_IID(_interface)) )                                  \
-@@ -669,9 +537,7 @@
+@@ -669,9 +537,7 @@ NS_IMETHODIMP _class::QueryInterface(REF
  #define NS_DECL_ISUPPORTS_INHERITED                                           \
  public:                                                                       \
    NS_IMETHOD QueryInterface(REFNSIID aIID,                                    \
 -                            void** aInstancePtr);                             \
 -  NS_IMETHOD_(nsrefcnt) AddRef(void);                                         \
 -  NS_IMETHOD_(nsrefcnt) Release(void);                                        \
 +                            void** aInstancePtr);
  
  /**
   * These macros can be used in conjunction with NS_DECL_ISUPPORTS_INHERITED
-@@ -681,21 +547,8 @@
+@@ -681,21 +547,8 @@ public:                                 
   * Note that I didn't make these inlined because they're virtual methods.
   */
  
 -#define NS_IMPL_ADDREF_INHERITED(Class, Super)                                \
 -NS_IMETHODIMP_(nsrefcnt) Class::AddRef(void)                                  \
 -{                                                                             \
 -  nsrefcnt r = Super::AddRef();                                               \
 -  NS_LOG_ADDREF(this, r, #Class, sizeof(*this));                              \
@@ -11406,17 +11448,17 @@ diff --git a/xpcom/glue/nsISupportsImpl.
 -  NS_LOG_RELEASE(this, r, #Class);                                            \
 -  return r;                                                                   \
 -}                                                                             \
 +#define NS_IMPL_ADDREF_INHERITED(Class, Super)
 +#define NS_IMPL_RELEASE_INHERITED(Class, Super)
  
  #define NS_INTERFACE_TABLE_INHERITED0(Class) /* Nothing to do here */
  
-@@ -953,54 +806,11 @@
+@@ -1016,54 +869,11 @@ NS_IMETHODIMP_(nsrefcnt) Class::Release(
   */
  #define NS_INTERFACE_TABLE_TO_MAP_SEGUE \
    if (rv == NS_OK) return rv; \
 -  nsISupports* foundInterface;
 +  void* foundInterface;
  
  
 -///////////////////////////////////////////////////////////////////////////////
@@ -11629,26 +11671,26 @@ diff --git a/xpcom/glue/nsISupportsUtils
 -  PR_END_MACRO
 +  THIS_MACRO_MUST_FAIL
  
  /*
   * Often you have to cast an implementation pointer, e.g., |this|, to an
 diff --git a/xpcom/glue/nsIWeakReferenceUtils.h b/xpcom/glue/nsIWeakReferenceUtils.h
 --- a/xpcom/glue/nsIWeakReferenceUtils.h
 +++ b/xpcom/glue/nsIWeakReferenceUtils.h
-@@ -64,7 +64,7 @@
+@@ -64,7 +64,7 @@ CallQueryReferent( T* aSource, Destinati
    }
  
  
 -class NS_COM_GLUE nsQueryReferent : public nsCOMPtr_helper
 +class NS_COM_GLUE nsQueryReferent
    {
      public:
        nsQueryReferent( nsIWeakReference* aWeakPtr, nsresult* error )
-@@ -74,9 +74,15 @@
+@@ -74,9 +74,15 @@ class NS_COM_GLUE nsQueryReferent : publ
            // nothing else to do here
          }
  
 -      virtual nsresult NS_FASTCALL operator()( const nsIID& aIID, void** ) const;
 -
 +      template<class D>
 +      operator D*() const
 +      {
@@ -11656,26 +11698,26 @@ diff --git a/xpcom/glue/nsIWeakReference
 +      }
 +        
      private:
 +      void* get(const nsIID &aIID) const;
 +      
        nsIWeakReference*  mWeakPtr;
        nsresult*          mErrorPtr;
    };
-@@ -104,7 +110,7 @@
+@@ -104,7 +110,7 @@ NS_GetWeakReference( nsISupports* , nsre
     * |nsWeakPtr myWeakPtr = do_GetWeakReference(aPtr);|.
     */
  inline
 -already_AddRefed<nsIWeakReference>
 +nsIWeakReference*
  do_GetWeakReference( nsISupports* aRawPtr, nsresult* error = 0 )
    {
      return NS_GetWeakReference(aRawPtr, error);
-@@ -119,24 +125,4 @@
+@@ -119,24 +125,4 @@ do_GetWeakReference( nsIWeakReference* a
      //  is very likely to be a programmer error.
    }
  
 -template <class T>
 -inline
 -void
 -do_GetWeakReference( already_AddRefed<T>& )
 -  {
@@ -11842,17 +11884,17 @@ diff --git a/xpcom/glue/nsServiceManager
 +
 +  const char*                 mContractID;
 +  nsresult*                   mErrorPtr;
 +};
 +
  inline
  const nsGetServiceByCID
  do_GetService(const nsCID& aCID)
-@@ -69,23 +205,32 @@
+@@ -69,23 +205,32 @@ do_GetService( const char* aContractID, 
      return nsGetServiceByContractIDWithError(aContractID, error);
  }
  
 -class nsGetServiceFromCategory : public nsCOMPtr_helper
 +#ifdef MOZILLA_INTERNAL_API
 +
 +class nsGetServiceFromCategory
  {
@@ -11891,33 +11933,33 @@ diff --git a/xpcom/glue/nsServiceManager
 +  void* get(const nsIID &aIID) const;
 +
 +  const char*                 mCategory;
 +  const char*                 mEntry;
 +  nsresult*                   mErrorPtr;
  };
  
  inline
-@@ -96,11 +241,7 @@
+@@ -96,11 +241,7 @@ do_GetServiceFromCategory( const char* c
      return nsGetServiceFromCategory(category, entry, error);
  }
  
 -NS_COM_GLUE nsresult
 -CallGetService(const nsCID &aClass, const nsIID &aIID, void **aResult);
 -
 -NS_COM_GLUE nsresult
 -CallGetService(const char *aContractID, const nsIID &aIID, void **aResult);
 +#endif // MOZILLA_INTERNAL_API
  
  // type-safe shortcuts for calling |GetService|
  template <class DestinationType>
 diff --git a/xpcom/glue/nsThreadUtils.h b/xpcom/glue/nsThreadUtils.h
 --- a/xpcom/glue/nsThreadUtils.h
 +++ b/xpcom/glue/nsThreadUtils.h
-@@ -193,18 +193,18 @@
+@@ -193,18 +193,18 @@ NS_ProcessNextEvent(nsIThread *thread = 
  //-----------------------------------------------------------------------------
  // Helpers that work with nsCOMPtr:
  
 -inline already_AddRefed<nsIThread>
 +inline nsIThread*
  do_GetCurrentThread() {
    nsIThread *thread = nsnull;
    NS_GetCurrentThread(&thread);
@@ -11933,17 +11975,17 @@ diff --git a/xpcom/glue/nsThreadUtils.h 
 -  return already_AddRefed<nsIThread>(thread);
 +  return thread;
  }
  
  //-----------------------------------------------------------------------------
 diff --git a/xpcom/glue/nsWeakReference.cpp b/xpcom/glue/nsWeakReference.cpp
 --- a/xpcom/glue/nsWeakReference.cpp
 +++ b/xpcom/glue/nsWeakReference.cpp
-@@ -79,21 +79,22 @@
+@@ -79,21 +79,22 @@ class nsWeakReference : public nsIWeakRe
        nsSupportsWeakReference*  mReferent;
    };
  
 -nsresult
 -nsQueryReferent::operator()( const nsIID& aIID, void** answer ) const
 +void*
 +nsQueryReferent::get(const nsIID& aIID) const
    {
@@ -11964,49 +12006,49 @@ diff --git a/xpcom/glue/nsWeakReference.
 -    return status;
 +    return result;
    }
  
  NS_COM_GLUE nsIWeakReference*  // or else |already_AddRefed<nsIWeakReference>|
 diff --git a/xpcom/glue/objs.mk b/xpcom/glue/objs.mk
 --- a/xpcom/glue/objs.mk
 +++ b/xpcom/glue/objs.mk
-@@ -44,7 +44,6 @@
+@@ -44,7 +44,6 @@ XPCOM_GLUE_SRC_LCPPSRCS =        \
    nsArrayEnumerator.cpp          \
    nsArrayUtils.cpp               \
    nsCategoryCache.cpp            \
 -  nsCOMPtr.cpp                   \
    nsCOMArray.cpp                 \
    nsCRTGlue.cpp                  \
    nsComponentManagerUtils.cpp    \
 diff --git a/xpcom/io/nsFastLoadFile.cpp b/xpcom/io/nsFastLoadFile.cpp
 --- a/xpcom/io/nsFastLoadFile.cpp
 +++ b/xpcom/io/nsFastLoadFile.cpp
-@@ -256,7 +256,7 @@
+@@ -256,7 +256,7 @@ static const char magic[] = MFL_FILE_MAG
  // -------------------------- nsFastLoadFileReader --------------------------
  
  nsID nsFastLoadFileReader::nsFastLoadFooter::gDummyID;
 -nsFastLoadFileReader::nsObjectMapEntry
 +nsFastLoadFileReader::nsObjectMapEntry*
      nsFastLoadFileReader::nsFastLoadFooter::gDummySharpObjectEntry;
  
  NS_IMPL_ISUPPORTS_INHERITED5(nsFastLoadFileReader,
 diff --git a/xpcom/io/nsFastLoadFile.h b/xpcom/io/nsFastLoadFile.h
 --- a/xpcom/io/nsFastLoadFile.h
 +++ b/xpcom/io/nsFastLoadFile.h
-@@ -338,7 +338,7 @@
+@@ -338,7 +338,7 @@ class nsFastLoadFileReader
          // time ("common symbols not allowed with MY_DHLIB output format", to
          // quote the OS X rev of gcc).
          static nsID gDummyID;
 -        static nsObjectMapEntry gDummySharpObjectEntry;
 +        static nsObjectMapEntry *gDummySharpObjectEntry;
  
          const nsID& GetID(NSFastLoadID aFastId) const {
              PRUint32 index = aFastId - 1;
-@@ -352,8 +352,12 @@
+@@ -352,8 +352,12 @@ class nsFastLoadFileReader
          GetSharpObjectEntry(NSFastLoadOID aOID) const {
              PRUint32 index = MFL_OID_TO_SHARP_INDEX(aOID);
              NS_ASSERTION(index < mNumSharpObjects, "aOID out of range");
 -            if (index >= mNumSharpObjects)
 -                return gDummySharpObjectEntry;
 +            if (index >= mNumSharpObjects) {
 +                if (!gDummySharpObjectEntry) {
 +                    gDummySharpObjectEntry = new nsObjectMapEntry;
@@ -12014,30 +12056,30 @@ diff --git a/xpcom/io/nsFastLoadFile.h b
 +                return *gDummySharpObjectEntry;
 +            }
              return mObjectMap[index];
          }
  
 diff --git a/xpcom/io/nsLocalFileOSX.h b/xpcom/io/nsLocalFileOSX.h
 --- a/xpcom/io/nsLocalFileOSX.h
 +++ b/xpcom/io/nsLocalFileOSX.h
-@@ -57,7 +57,8 @@
+@@ -57,7 +57,8 @@ class nsDirEnumerator;
  // for the conversion to NFC (composed Unicode) done in "non-Native" getters.
  //*****************************************************************************
  
 -class NS_COM nsLocalFile : public nsILocalFileMac,
 +class NS_COM nsLocalFile : public XPCOMGCFinalizedObject,
 +                           public nsILocalFileMac,
                             public nsIHashable
  {
      friend class nsDirEnumerator;
 diff --git a/xpcom/io/nsPipe3.cpp b/xpcom/io/nsPipe3.cpp
 --- a/xpcom/io/nsPipe3.cpp
 +++ b/xpcom/io/nsPipe3.cpp
-@@ -702,21 +702,6 @@
+@@ -702,21 +702,6 @@ nsPipeInputStream::OnInputException(nsre
      return result;
  }
  
 -NS_IMETHODIMP_(nsrefcnt)
 -nsPipeInputStream::AddRef(void)
 -{
 -    PR_AtomicIncrement((PRInt32*)&mReaderRefCnt);
 -    return mPipe->AddRef();
@@ -12049,17 +12091,17 @@ diff --git a/xpcom/io/nsPipe3.cpp b/xpco
 -    if (PR_AtomicDecrement((PRInt32 *)&mReaderRefCnt) == 0)
 -        Close();
 -    return mPipe->Release();
 -}
 -
  NS_IMETHODIMP
  nsPipeInputStream::CloseWithStatus(nsresult reason)
  {
-@@ -1058,21 +1043,6 @@
+@@ -1058,21 +1043,6 @@ nsPipeOutputStream::OnOutputException(ns
  }
  
  
 -NS_IMETHODIMP_(nsrefcnt)
 -nsPipeOutputStream::AddRef()
 -{
 -    PR_AtomicIncrement((PRInt32*)&mWriterRefCnt);
 -    return mPipe->AddRef();
@@ -12074,27 +12116,27 @@ diff --git a/xpcom/io/nsPipe3.cpp b/xpco
 -}
 -
  NS_IMETHODIMP
  nsPipeOutputStream::CloseWithStatus(nsresult reason)
  {
 diff --git a/xpcom/io/nsUnicharInputStream.cpp b/xpcom/io/nsUnicharInputStream.cpp
 --- a/xpcom/io/nsUnicharInputStream.cpp
 +++ b/xpcom/io/nsUnicharInputStream.cpp
-@@ -409,9 +409,6 @@
+@@ -409,9 +409,6 @@ NS_IMPL_QUERY_INTERFACE2(nsSimpleUnichar
                           nsIFactory,
                           nsISimpleUnicharStreamFactory)
  
 -NS_IMETHODIMP_(nsrefcnt) nsSimpleUnicharStreamFactory::AddRef() { return 2; }
 -NS_IMETHODIMP_(nsrefcnt) nsSimpleUnicharStreamFactory::Release() { return 1; }
 -
  NS_IMETHODIMP
  nsSimpleUnicharStreamFactory::CreateInstance(nsISupports* aOuter, REFNSIID aIID,
                                              void **aResult)
-@@ -460,8 +457,10 @@
+@@ -460,8 +457,10 @@ nsSimpleUnicharStreamFactory*
  nsSimpleUnicharStreamFactory*
  nsSimpleUnicharStreamFactory::GetInstance()
  {
 -  return const_cast<nsSimpleUnicharStreamFactory*>(&kInstance);
 +  if (!gInstance)
 +    gInstance = new nsSimpleUnicharStreamFactory;
 +  return gInstance;
  }
@@ -12110,44 +12152,44 @@ diff --git a/xpcom/io/nsUnicharInputStre
  { 0x428dca6f, 0x1a0f, 0x4cda, { 0xb5, 0x16, 0xd, 0x52, 0x44, 0x74, 0x5a, 0x6a } }
  
  class nsSimpleUnicharStreamFactory :
 -  public nsIFactory, nsISimpleUnicharStreamFactory
 +  public XPCOMGCFinalizedObject, public nsIFactory, nsISimpleUnicharStreamFactory
  {
  public:
    NS_DECL_ISUPPORTS_INHERITED
-@@ -57,7 +57,7 @@
+@@ -57,7 +57,7 @@ public:
    static NS_COM nsSimpleUnicharStreamFactory* GetInstance();
  
  private:
 -  static const nsSimpleUnicharStreamFactory kInstance;
 +  static nsSimpleUnicharStreamFactory *gInstance;
  };
  
  #endif // nsUnicharInputStream_h__
 diff --git a/xpcom/proxy/src/nsProxyEvent.cpp b/xpcom/proxy/src/nsProxyEvent.cpp
 --- a/xpcom/proxy/src/nsProxyEvent.cpp
 +++ b/xpcom/proxy/src/nsProxyEvent.cpp
-@@ -142,14 +142,12 @@
+@@ -142,14 +142,12 @@ nsProxyObjectCallInfo::nsProxyObjectCall
      NS_ASSERTION(owner, "No nsProxyObject!");
      NS_ASSERTION(methodInfo, "No nsXPTMethodInfo!");
  
 -    RefCountInInterfacePointers(PR_TRUE);
      if (mOwner->GetProxyType() & NS_PROXY_ASYNC)
          CopyStrings(PR_TRUE);
  }
  
  nsProxyObjectCallInfo::~nsProxyObjectCallInfo()
  {
 -    RefCountInInterfacePointers(PR_FALSE);
      if (mOwner->GetProxyType() & NS_PROXY_ASYNC)
          CopyStrings(PR_FALSE);
  
-@@ -185,34 +183,6 @@
+@@ -185,34 +183,6 @@ nsProxyObjectCallInfo::Run()
      }
  
      return NS_OK;
 -}
 -
 -void
 -nsProxyObjectCallInfo::RefCountInInterfacePointers(PRBool addRef)
 -{
@@ -12172,17 +12214,17 @@ diff --git a/xpcom/proxy/src/nsProxyEven
 -            
 -                }
 -            }
 -        }
 -    }
  }
  
  void
-@@ -355,54 +325,9 @@
+@@ -355,54 +325,9 @@ nsProxyObject::nsProxyObject(nsIEventTar
  
  nsProxyObject::~nsProxyObject()
  {
 -    // Proxy the release of mRealObject to protect against it being deleted on
 -    // the wrong thread.
 -    nsISupports *doomed = nsnull;
 -    mRealObject.swap(doomed);
 -    NS_ProxyRelease(mTarget, doomed);
@@ -12228,25 +12270,25 @@ diff --git a/xpcom/proxy/src/nsProxyEven
 -    nsAutoUnlock unlock(pom->GetLock());
 -    delete this;
 -    pom->Release();
 -
 -    return 0;
  }
  
  NS_IMETHODIMP
-@@ -438,7 +363,6 @@
+@@ -438,7 +363,6 @@ nsProxyObject::LockedFind(REFNSIID aIID,
      for (peo = mFirst; peo; peo = peo->mNext) {
          if (peo->GetClass()->GetProxiedIID().Equals(aIID)) {
              *aResult = static_cast<nsISupports*>(peo->mXPTCStub);
 -            peo->LockedAddRef();
              return NS_OK;
          }
      }
-@@ -479,15 +403,12 @@
+@@ -479,15 +403,12 @@ nsProxyObject::LockedFind(REFNSIID aIID,
          if (peo->GetClass()->GetProxiedIID().Equals(aIID)) {
              delete newpeo;
              *aResult = static_cast<nsISupports*>(peo->mXPTCStub);
 -            peo->LockedAddRef();
              return NS_OK;
          }
      }
  
@@ -12255,17 +12297,17 @@ diff --git a/xpcom/proxy/src/nsProxyEven
 -
 -    newpeo->LockedAddRef();
  
      *aResult = static_cast<nsISupports*>(newpeo->mXPTCStub);
      return NS_OK;
 diff --git a/xpcom/proxy/src/nsProxyEventObject.cpp b/xpcom/proxy/src/nsProxyEventObject.cpp
 --- a/xpcom/proxy/src/nsProxyEventObject.cpp
 +++ b/xpcom/proxy/src/nsProxyEventObject.cpp
-@@ -67,55 +67,13 @@
+@@ -67,55 +67,13 @@ nsProxyEventObject::nsProxyEventObject(n
  
  nsProxyEventObject::~nsProxyEventObject()
  {
 -    // This destructor must *not* be called within the POM lock
 -    // XXX assert this!
 -
 -    // mRealInterface must be released before mProxyObject so that the last
 -    // release of the proxied object is proxied to the correct thread.
@@ -12316,49 +12358,49 @@ diff --git a/xpcom/proxy/src/nsProxyEven
 -    return 0;
 -}
  
  NS_IMETHODIMP
  nsProxyEventObject::QueryInterface(REFNSIID aIID, void** aInstancePtr)
 diff --git a/xpcom/proxy/src/nsProxyEventPrivate.h b/xpcom/proxy/src/nsProxyEventPrivate.h
 --- a/xpcom/proxy/src/nsProxyEventPrivate.h
 +++ b/xpcom/proxy/src/nsProxyEventPrivate.h
-@@ -114,11 +114,6 @@
+@@ -114,11 +114,6 @@ public:
      nsIEventTarget*     GetTarget() const { return mTarget; }
      PRInt32             GetProxyType() const { return mProxyType; }
  
 -    // these are the equivalents of AddRef/Release, but must be called
 -    // while holding the global POM lock
 -    nsrefcnt LockedAddRef();
 -    nsrefcnt LockedRelease();
 -
      // LockedFind should be called holding the POM lock. It will
      // temporarily unlock the lock during execution.
      nsresult LockedFind(REFNSIID iid, void **aResult);
-@@ -184,8 +179,6 @@
+@@ -184,8 +179,6 @@ public:
                         already_AddRefed<nsISomeInterface> aRealInterface,
                         nsresult *rv);
  
 -    // AddRef, but you must be holding the global POM lock
 -    nsrefcnt LockedAddRef();
      friend class nsProxyObject;
  
  private:
-@@ -261,7 +254,6 @@
+@@ -261,7 +254,6 @@ private:
  
      nsRefPtr<nsProxyEventObject>   mOwner;       /* this is the strong referenced nsProxyObject */
     
 -    void RefCountInInterfacePointers(PRBool addRef);
      void CopyStrings(PRBool copy);
  };
  
 diff --git a/xpcom/proxy/src/nsProxyObjectManager.cpp b/xpcom/proxy/src/nsProxyObjectManager.cpp
 --- a/xpcom/proxy/src/nsProxyObjectManager.cpp
 +++ b/xpcom/proxy/src/nsProxyObjectManager.cpp
-@@ -148,36 +148,6 @@
+@@ -148,36 +148,6 @@ nsProxyObjectManager::Create(nsISupports
      return proxyObjectManager->QueryInterface(aIID, aInstancePtr);
  }
  
 -class nsProxyLockedRefPtr
 -{
 -public:
 -    nsProxyLockedRefPtr(nsProxyObject* aPtr) :
 -        mProxyObject(aPtr)
@@ -12385,83 +12427,83 @@ diff --git a/xpcom/proxy/src/nsProxyObje
 -
 -private:
 -    nsProxyObject *mProxyObject;
 -};
 -
  NS_IMETHODIMP 
  nsProxyObjectManager::GetProxyForObject(nsIEventTarget* aTarget, 
                                          REFNSIID aIID, 
-@@ -225,7 +195,7 @@
+@@ -225,7 +195,7 @@ nsProxyObjectManager::GetProxyForObject(
  
      {
          nsAutoLock lock(mProxyCreationLock);
 -        nsProxyLockedRefPtr root =
 +        nsProxyObject *root =
              (nsProxyObject*) mProxyObjectMap.Get(&rootKey);
          if (root)
              return root->LockedFind(aIID, aProxyObject);
-@@ -239,7 +209,7 @@
+@@ -239,7 +209,7 @@ nsProxyObjectManager::GetProxyForObject(
      // lock again, and check for a race putting into mProxyObjectMap
      {
          nsAutoLock lock(mProxyCreationLock);
 -        nsProxyLockedRefPtr root = 
 +        nsProxyObject *root = 
              (nsProxyObject*) mProxyObjectMap.Get(&rootKey);
          if (root) {
              delete newRoot;
-@@ -248,7 +218,6 @@
+@@ -248,7 +218,6 @@ nsProxyObjectManager::GetProxyForObject(
  
          mProxyObjectMap.Put(&rootKey, newRoot);
  
 -        nsProxyLockedRefPtr kungFuDeathGrip(newRoot);
          return newRoot->LockedFind(aIID, aProxyObject);
      }
  }
 diff --git a/xpcom/proxy/tests/proxy-create-threadsafety.cpp b/xpcom/proxy/tests/proxy-create-threadsafety.cpp
 --- a/xpcom/proxy/tests/proxy-create-threadsafety.cpp
 +++ b/xpcom/proxy/tests/proxy-create-threadsafety.cpp
-@@ -220,11 +220,7 @@
+@@ -220,11 +220,7 @@ public:
          return status;
      }
  
 -    NS_IMETHOD_(nsrefcnt) AddRef(void);
 -    NS_IMETHOD_(nsrefcnt) Release(void);
 -
  protected:
 -    nsAutoRefCnt mRefCnt;
      NS_DECL_OWNINGTHREAD
  
  private:
-@@ -234,9 +230,6 @@
+@@ -234,9 +230,6 @@ private:
      nsCOMPtr<nsIThread> mThreadOne;
      nsCOMPtr<nsIThread> mThreadTwo;
  };
 -
 -NS_IMPL_THREADSAFE_ADDREF(ProxyTest)
 -NS_IMPL_THREADSAFE_RELEASE(ProxyTest)
  
  int
  main(int argc, char **argv)
 diff --git a/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp b/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp
 --- a/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp
 +++ b/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp
-@@ -143,7 +143,7 @@
+@@ -143,7 +143,7 @@ NS_InvokeByIndex_P(nsISupports* that, PR
      "movl  (%%ecx), %%edx\n\t"
      "movl  %5, %%eax\n\t"   /* function index */
  #if defined(__GXX_ABI_VERSION) && __GXX_ABI_VERSION >= 100 /* G++ V3 ABI */
 -    "leal  (%%edx,%%eax,4), %%edx\n\t"
 +    "leal  12(%%edx,%%eax,4), %%edx\n\t" /* skip two destructors and CustomMark */
  #else /* not G++ V3 ABI  */
      "leal  8(%%edx,%%eax,4), %%edx\n\t"
  #endif /* G++ V3 ABI */
 diff --git a/xpcom/reflect/xptcall/src/xptcall.cpp b/xpcom/reflect/xptcall/src/xptcall.cpp
 --- a/xpcom/reflect/xptcall/src/xptcall.cpp
 +++ b/xpcom/reflect/xptcall/src/xptcall.cpp
-@@ -53,18 +53,6 @@
+@@ -53,18 +53,6 @@ nsXPTCStubBase::QueryInterface(REFNSIID 
      return mOuter->QueryInterface(aIID, aInstancePtr);
  }
  
 -NS_IMETHODIMP_(nsrefcnt)
 -nsXPTCStubBase::AddRef()
 -{
 -    return mOuter->AddRef();
 -}
@@ -12479,17 +12521,17 @@ diff --git a/xpcom/reflect/xptcall/tests
 --- a/xpcom/reflect/xptcall/tests/TestXPTCInvoke.cpp
 +++ b/xpcom/reflect/xptcall/tests/TestXPTCInvoke.cpp
 @@ -1,4 +1,4 @@
 -/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
 +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
  /* ***** BEGIN LICENSE BLOCK *****
   * Version: MPL 1.1/GPL 2.0/LGPL 2.1
   *
-@@ -302,8 +302,24 @@
+@@ -302,8 +302,24 @@ InvokeTestTarget::PassTwoStrings(const c
      return NS_OK;
  }
  
 +class XPCOMLog
 +{
 +public:
 +    XPCOMLog()
 +    {
@@ -12507,17 +12549,17 @@ diff --git a/xpcom/reflect/xptcall/tests
 +    XPCOMLog l;
 +
      InvokeTestTarget *test = new InvokeTestTarget();
  
      /* here we make the global 'check for alloc failure' checker happy */
 diff --git a/xpcom/reflect/xptinfo/src/xptiInterfaceInfo.cpp b/xpcom/reflect/xptinfo/src/xptiInterfaceInfo.cpp
 --- a/xpcom/reflect/xptinfo/src/xptiInterfaceInfo.cpp
 +++ b/xpcom/reflect/xptinfo/src/xptiInterfaceInfo.cpp
-@@ -766,54 +766,13 @@
+@@ -766,54 +766,13 @@ xptiInterfaceInfo::xptiInterfaceInfo(xpt
  
  xptiInterfaceInfo::~xptiInterfaceInfo() 
  {
 -    LOG_INFO_DESTROY(this);
 -    NS_IF_RELEASE(mParent); 
 -    NS_ASSERTION(!mEntry, "bad state in dtor");
 -}
 -
@@ -12569,93 +12611,93 @@ diff --git a/xpcom/reflect/xptinfo/src/x
 -    return cnt;
 +    LOG_INFO_DESTROY(this);
  }
  
  /***************************************************************************/
 diff --git a/xpcom/stub/Makefile.in b/xpcom/stub/Makefile.in
 --- a/xpcom/stub/Makefile.in
 +++ b/xpcom/stub/Makefile.in
-@@ -55,6 +55,7 @@
+@@ -55,6 +55,7 @@ MOZILLA_INTERNAL_API = 1
  MOZILLA_INTERNAL_API = 1
  
  REQUIRES	= string \
 +		  js \
  		  $(NULL)
  
  LOCAL_INCLUDES	= -I$(srcdir)/../build
 diff --git a/xpcom/stub/nsXPComStub.cpp b/xpcom/stub/nsXPComStub.cpp
 --- a/xpcom/stub/nsXPComStub.cpp
 +++ b/xpcom/stub/nsXPComStub.cpp
-@@ -72,7 +72,7 @@
+@@ -72,7 +72,7 @@ static const XPCOMFunctions kFrozenFunct
  
      // these functions were added post 1.4
      &NS_GetDebug_P,
 -    &NS_GetTraceRefcnt_P,
 +    nsnull,
  
      // these functions were added post 1.6
      &NS_StringContainerInit_P,
-@@ -226,13 +226,6 @@
+@@ -226,13 +226,6 @@ NS_GetDebug(nsIDebug **result)
  NS_GetDebug(nsIDebug **result)
  {
    return NS_GetDebug_P(result);
 -}
 -
 -#undef NS_GetTraceRefcnt
 -EXPORT_XPCOM_API(nsresult)
 -NS_GetTraceRefcnt(nsITraceRefcnt **result)
 -{
 -  return NS_GetTraceRefcnt_P(result);
  }
  
  #undef NS_Alloc
-@@ -553,3 +546,10 @@
+@@ -553,3 +546,10 @@ NS_CycleCollectorForget(nsISupports* obj
  {
    return NS_CycleCollectorForget_P(obj);
  }
 +
 +#undef NS_GetGC
 +EXPORT_XPCOM_API(MMgc::GC*)
 +NS_GetGC()
 +{
 +  return NS_GetGC_P();
 +}
 diff --git a/xpcom/tests/Makefile.in b/xpcom/tests/Makefile.in
 --- a/xpcom/tests/Makefile.in
 +++ b/xpcom/tests/Makefile.in
-@@ -49,9 +49,6 @@
+@@ -49,9 +49,6 @@ endif
  endif
  
  DIRS		= dynamic services external
 -ifeq ($(OS_ARCH),WINNT)
 -DIRS		+= windows
 -endif
  
  ifdef DEHYDRA_PATH
  DIRS += static-checker
 diff --git a/xpcom/tests/TestArray.cpp b/xpcom/tests/TestArray.cpp
 --- a/xpcom/tests/TestArray.cpp
 +++ b/xpcom/tests/TestArray.cpp
-@@ -52,13 +52,12 @@
+@@ -52,13 +52,12 @@ public:
  
    NS_DECLARE_STATIC_IID_ACCESSOR(NS_IFOO_IID)
  
 -  NS_IMETHOD_(nsrefcnt) RefCnt() = 0;
    NS_IMETHOD_(PRInt32) ID() = 0;
  };
  
  NS_DEFINE_STATIC_IID_ACCESSOR(IFoo, NS_IFOO_IID)
  
 -class Foo : public IFoo {
 +class Foo : public XPCOMGCObject, public IFoo {
  public:
  
    Foo(PRInt32 aID);
-@@ -67,30 +66,15 @@
+@@ -67,30 +66,15 @@ public:
    NS_DECL_ISUPPORTS
  
    // IFoo implementation
 -  NS_IMETHOD_(nsrefcnt) RefCnt() { return mRefCnt; }
    NS_IMETHOD_(PRInt32) ID() { return mID; }
  
 -  static PRInt32 gCount;
 -
@@ -12677,26 +12719,26 @@ diff --git a/xpcom/tests/TestArray.cpp b
 -Foo::~Foo()
 -{
 -  --gCount;
 -  fprintf(stdout, "destruct: %d (%p), %d remain)\n", mID, this, gCount);
 +  fprintf(stdout, "init: %d (%p))\n", mID, this);
  }
  
  NS_IMPL_ISUPPORTS1(Foo, IFoo)
-@@ -106,7 +90,7 @@
+@@ -106,7 +90,7 @@ const char* AssertEqual(PRInt32 aValue1,
    return "ERROR";
  }
  
 -void DumpArray(nsISupportsArray* aArray, PRInt32 aExpectedCount, PRInt32 aElementIDs[], PRInt32 aExpectedTotal)
 +void DumpArray(nsISupportsArray* aArray, PRInt32 aExpectedCount, PRInt32 aElementIDs[])
  {
    PRUint32 cnt = 0;
    nsresult rv = aArray->Count(&cnt);
-@@ -114,17 +98,14 @@
+@@ -114,17 +98,14 @@ void DumpArray(nsISupportsArray* aArray,
    PRInt32 count = cnt;
    PRInt32 index;
  
 -  fprintf(stdout, "object count %d = %d %s\n", Foo::gCount, aExpectedTotal, 
 -          AssertEqual(Foo::gCount, aExpectedTotal));
    fprintf(stdout, "array count %d = %d %s\n", count, aExpectedCount,
            AssertEqual(count, aExpectedCount));
    
@@ -12706,17 +12748,17 @@ diff --git a/xpcom/tests/TestArray.cpp b
 -            index, aElementIDs[index], foo->ID(), foo, foo->RefCnt() - 1,
 +    fprintf(stdout, "%2d: %d=%d (%p) c: %s\n", 
 +            index, aElementIDs[index], foo->ID(), foo,
              AssertEqual(foo->ID(), aElementIDs[index]));
 -    foo->Release();
    }
  }
  
-@@ -141,28 +122,29 @@
+@@ -141,28 +122,29 @@ int main(int argc, char *argv[])
  {
    nsISupportsArray* array;
    nsresult  rv;
 +
 +  NS_LogInit();
    
    if (NS_OK == (rv = NS_NewISupportsArray(&array))) {
      FillArray(array, 10);
@@ -12741,17 +12783,17 @@ diff --git a/xpcom/tests/TestArray.cpp b
      fprintf(stdout, "append 3:\n");
      array->AppendElement(foo);
      PRInt32   appendResult[13] = {3, 0, 1, 2, 3, 4, 3, 5, 6, 7, 8, 9, 3};
 -    DumpArray(array, 13, appendResult, 10);
 +    DumpArray(array, 13, appendResult);
  
  
      // test IndexOf && LastIndexOf
-@@ -187,38 +169,38 @@
+@@ -187,38 +169,38 @@ int main(int argc, char *argv[])
      fprintf(stdout, "ReplaceElementAt(8):\n");
      array->ReplaceElementAt(foo, 8);
      PRInt32   replaceResult[13] = {3, 0, 1, 2, 3, 4, 3, 5, 3, 7, 8, 9, 3};
 -    DumpArray(array, 13, replaceResult, 9);
 +    DumpArray(array, 13, replaceResult);
  
      // test RemoveElementAt, RemoveElement RemoveLastElement
      fprintf(stdout, "RemoveElementAt(0):\n");
@@ -12788,17 +12830,17 @@ diff --git a/xpcom/tests/TestArray.cpp b
      // test compact
      fprintf(stdout, "compact array:\n");
      array->Compact();
 -    DumpArray(array, 4, fillResult, 4);
 +    DumpArray(array, 4, fillResult);
  
      // test delete
      fprintf(stdout, "release array:\n");
-@@ -228,5 +210,7 @@
+@@ -228,5 +210,7 @@ int main(int argc, char *argv[])
      fprintf(stdout, "error can't create array: %x\n", rv);
    }
  
 +  NS_LogTerm();
 +
    return 0;
  }
 diff --git a/xpcom/tests/TestCOMPtr.cpp b/xpcom/tests/TestCOMPtr.cpp
@@ -12808,41 +12850,41 @@ diff --git a/xpcom/tests/TestCOMPtr.cpp 
  { 0x6f7652e0,  0xee43, 0x11d1, \
   { 0x9c, 0xc3, 0x00, 0x60, 0x08, 0x8c, 0xa6, 0xb3 } }
  
 -class IFoo : public nsISupports
 +class IFoo : public XPCOMGCFinalizedObject, public nsISupports
    {
  		public:
  			NS_DECLARE_STATIC_IID_ACCESSOR(NS_IFOO_IID)
-@@ -64,15 +64,11 @@
+@@ -64,15 +64,11 @@ class IFoo : public nsISupports
        // virtual dtor because IBar uses our Release()
        virtual ~IFoo();
  
 -      NS_IMETHOD_(nsrefcnt) AddRef();
 -      NS_IMETHOD_(nsrefcnt) Release();
        NS_IMETHOD QueryInterface( const nsIID&, void** );
  
        static void print_totals();
  
      private:
 -      unsigned int refcount_;
 -
        static unsigned int total_constructions_;
        static unsigned int total_destructions_;
    };
-@@ -129,7 +125,6 @@
+@@ -129,7 +125,6 @@ IFoo::print_totals()
    }
  
  IFoo::IFoo()
 -    : refcount_(0)
    {
      ++total_constructions_;
      printf("  new IFoo@%p [#%d]\n",
-@@ -143,40 +138,11 @@
+@@ -143,40 +138,11 @@ IFoo::~IFoo()
             STATIC_CAST(void*, this), total_destructions_);
    }
  
 -nsrefcnt
 -IFoo::AddRef()
 -  {
 -    ++refcount_;
 -    printf("IFoo@%p::AddRef(), refcount --> %d\n", 
@@ -12874,34 +12916,34 @@ diff --git a/xpcom/tests/TestCOMPtr.cpp 
  IFoo::QueryInterface( const nsIID& aIID, void** aResult )
  	{
      printf("IFoo@%p::QueryInterface()\n", STATIC_CAST(void*, this));
 -		nsISupports* rawPtr = 0;
 +		void* rawPtr = 0;
  		nsresult status = NS_OK;
  
  		if ( aIID.Equals(GetIID()) )
-@@ -190,7 +156,6 @@
+@@ -190,7 +156,6 @@ IFoo::QueryInterface( const nsIID& aIID,
  					status = NS_ERROR_NO_INTERFACE;
  			}
  
 -		NS_IF_ADDREF(rawPtr);
  		*aResult = rawPtr;
  
  		return status;
-@@ -266,7 +231,7 @@
+@@ -266,7 +231,7 @@ IBar::QueryInterface( const nsID& aIID, 
  IBar::QueryInterface( const nsID& aIID, void** aResult )
  	{
      printf("IBar@%p::QueryInterface()\n", STATIC_CAST(void*, this));
 -		nsISupports* rawPtr = 0;
 +		void* rawPtr = 0;
  		nsresult status = NS_OK;
  
  		if ( aIID.Equals(GetIID()) )
-@@ -410,15 +375,12 @@
+@@ -410,15 +375,12 @@ TestBloat_Smart()
  		return result;
  	}
  
 -
 -
 -
 -nsCOMPtr<IFoo> gFoop;
 -
@@ -12909,31 +12951,31 @@ diff --git a/xpcom/tests/TestCOMPtr.cpp 
  main()
    {
      printf(">>main()\n");
 +
 +    NS_LogInit();
  
  		printf("sizeof(nsCOMPtr<IFoo>) --> %d\n", sizeof(nsCOMPtr<IFoo>));
  
-@@ -446,10 +408,11 @@
+@@ -446,10 +408,11 @@ main()
  			//delete foop;
  
        printf("\n### Test  3: can you |AddRef| if you must?\n");
 -      STATIC_CAST(IFoo*, foop)->AddRef();
 +      IFoo* p = static_cast<IFoo*>(foop);
 +      p->AddRef();
  
        printf("\n### Test  4: can you |Release| if you must?\n");
 -      STATIC_CAST(IFoo*, foop)->Release();
 +      p->Release();
  
        printf("\n### Test  5: will a |nsCOMPtr| |Release| when it goes out of scope?\n");
      }
-@@ -581,17 +544,6 @@
+@@ -581,17 +544,6 @@ main()
      printf("### End Test 18\n");
  
  
 -    {
 -    	printf("\n### setup for Test 19, 20\n");
 -      nsCOMPtr<IFoo> foop;
 -      printf("### Test 19: reference parameter behavior?\n");
 -      set_a_IFoo(address_of(foop));
@@ -12941,53 +12983,53 @@ diff --git a/xpcom/tests/TestCOMPtr.cpp 
 -      printf("### Test 20: return value behavior?\n");
 -      foop = return_a_IFoo();
 -    }
 -    printf("### End Test 19, 20\n");
 -
  		{
      	printf("\n### setup for Test 21\n");
  			nsCOMPtr<IFoo> fooP;
-@@ -651,10 +603,8 @@
+@@ -651,10 +603,8 @@ main()
  			AnISupportsPtrPtrContext( getter_AddRefs(supportsP) );
  		}
  
 +    NS_LogTerm();
  
 -    printf("\n### Test 25: will a static |nsCOMPtr| |Release| before program termination?\n");
 -    gFoop = do_QueryInterface(new IFoo);
 -    
      printf("<<main()\n");
      return 0;
    }
 diff --git a/xpcom/tests/TestCOMPtrEq.cpp b/xpcom/tests/TestCOMPtrEq.cpp
 --- a/xpcom/tests/TestCOMPtrEq.cpp
 +++ b/xpcom/tests/TestCOMPtrEq.cpp
-@@ -87,7 +87,7 @@
+@@ -87,7 +87,7 @@ main()
      const nsICOMPtrEqTestFoo* rc = 0;
      nsICOMPtrEqTestFoo* const rk = 0;
      const nsICOMPtrEqTestFoo* const rkc = 0;
 -    nsDerivedSafe<nsICOMPtrEqTestFoo>* d = s;
 +    nsICOMPtrEqTestFoo* d = s;
      
  #ifdef NSCAP_EQTEST_TEST_ACROSS_TYPES
      nsCOMPtr<nsICOMPtrEqTestFoo2> s2;
-@@ -96,7 +96,7 @@
+@@ -96,7 +96,7 @@ main()
      const nsICOMPtrEqTestFoo2* rc2 = 0;
      nsICOMPtrEqTestFoo2* const rk2 = 0;
      const nsICOMPtrEqTestFoo2* const rkc2 = 0;
 -    nsDerivedSafe<nsICOMPtrEqTestFoo2>* d2 = s2;
 +    nsICOMPtrEqTestFoo2* d2 = s2;
  #endif
  
      return (!(PR_TRUE &&
 diff --git a/xpcom/tests/TestPermanentAtoms.cpp b/xpcom/tests/TestPermanentAtoms.cpp
 --- a/xpcom/tests/TestPermanentAtoms.cpp
 +++ b/xpcom/tests/TestPermanentAtoms.cpp
-@@ -56,31 +56,21 @@
+@@ -56,31 +56,21 @@ static void AssertString(nsIAtom *aAtom,
      Assert(nsDependentCString(str) == aString, "string is correct");
  }
  
 -static void AssertPermanence(nsIAtom *aAtom, PRBool aPermanence)
 -{
 -    Assert(static_cast<AtomImpl*>(aAtom)->IsPermanent() == aPermanence,
 -           aPermanence ? "atom is permanent" : "atom is not permanent");
 -}
@@ -13450,17 +13492,17 @@ deleted file mode 100644
 -			return 0;
 -		}
 -
 -	return DefWindowProc(wnd, msg, wParam, lParam);
 -}
 diff --git a/xpcom/threads/TimerThread.cpp b/xpcom/threads/TimerThread.cpp
 --- a/xpcom/threads/TimerThread.cpp
 +++ b/xpcom/threads/TimerThread.cpp
-@@ -285,26 +285,7 @@
+@@ -285,26 +285,7 @@ NS_IMETHODIMP TimerThread::Run()
            }
  #endif
  
 -          // We are going to let the call to PostTimerEvent here handle the
 -          // release of the timer so that we don't end up releasing the timer
 -          // on the TimerThread instead of on the thread it targets.
 -          if (NS_FAILED(timer->PostTimerEvent())) {
 -            nsrefcnt rc;
@@ -13481,93 +13523,93 @@ diff --git a/xpcom/threads/TimerThread.c
 -          }
 +          (void) timer->PostTimerEvent();
            timer = nsnull;
  
            lock.lock();
 diff --git a/xpcom/threads/nsThread.cpp b/xpcom/threads/nsThread.cpp
 --- a/xpcom/threads/nsThread.cpp
 +++ b/xpcom/threads/nsThread.cpp
-@@ -69,8 +69,6 @@
+@@ -69,8 +69,6 @@ public:
  
  static nsThreadClassInfo sThreadClassInfo;
  
 -NS_IMETHODIMP_(nsrefcnt) nsThreadClassInfo::AddRef() { return 2; }
 -NS_IMETHODIMP_(nsrefcnt) nsThreadClassInfo::Release() { return 1; }
  NS_IMPL_QUERY_INTERFACE1(nsThreadClassInfo, nsIClassInfo)
  
  NS_IMETHODIMP
 diff --git a/xpcom/threads/nsThread.h b/xpcom/threads/nsThread.h
 --- a/xpcom/threads/nsThread.h
 +++ b/xpcom/threads/nsThread.h
-@@ -85,10 +85,10 @@
+@@ -85,10 +85,10 @@ private:
    PR_STATIC_CALLBACK(void) ThreadFunc(void *arg);
  
    // Helper
 -  already_AddRefed<nsIThreadObserver> GetObserver() {
 +  nsIThreadObserver* GetObserver() {
      nsIThreadObserver *obs;
      nsThread::GetObserver(&obs);
 -    return already_AddRefed<nsIThreadObserver>(obs);
 +    return obs;
    }
  
    // Wrappers for event queue methods:
 diff --git a/xpcom/threads/nsThreadManager.cpp b/xpcom/threads/nsThreadManager.cpp
 --- a/xpcom/threads/nsThreadManager.cpp
 +++ b/xpcom/threads/nsThreadManager.cpp
-@@ -63,11 +63,9 @@
+@@ -63,11 +63,9 @@ AppendAndRemoveThread(const void *key, n
  
  //-----------------------------------------------------------------------------
  
 -nsThreadManager nsThreadManager::sInstance;
 +nsThreadManager* nsThreadManager::gInstance;
  
  // statically allocated instance
 -NS_IMETHODIMP_(nsrefcnt) nsThreadManager::AddRef() { return 2; }
 -NS_IMETHODIMP_(nsrefcnt) nsThreadManager::Release() { return 1; }
  NS_IMPL_QUERY_INTERFACE1_CI(nsThreadManager, nsIThreadManager)
  NS_IMPL_CI_INTERFACE_GETTER1(nsThreadManager, nsIThreadManager)
  
 diff --git a/xpcom/threads/nsThreadManager.h b/xpcom/threads/nsThreadManager.h
 --- a/xpcom/threads/nsThreadManager.h
 +++ b/xpcom/threads/nsThreadManager.h
-@@ -52,7 +52,10 @@
+@@ -52,7 +52,10 @@ public:
    NS_DECL_NSITHREADMANAGER
  
    static nsThreadManager *get() {
 -    return &sInstance;
 +    if (!gInstance) {
 +      gInstance = new nsThreadManager;
 +    }
 +    return gInstance;
    }
  
    nsresult Init();
-@@ -85,7 +88,7 @@
+@@ -85,7 +88,7 @@ private:
      , mInitialized(PR_FALSE) {
    }
    
 -  static nsThreadManager sInstance;
 +  static nsThreadManager *gInstance;
  
    nsRefPtrHashtable<nsVoidPtrHashKey, nsThread> mThreadsByPRThread;
    PRUintn             mCurThreadIndex;  // thread-local-storage index
 diff --git a/xpcom/threads/nsTimerImpl.cpp b/xpcom/threads/nsTimerImpl.cpp
 --- a/xpcom/threads/nsTimerImpl.cpp
 +++ b/xpcom/threads/nsTimerImpl.cpp
-@@ -80,6 +80,8 @@
+@@ -80,6 +80,8 @@ NS_IMPL_THREADSAFE_QUERY_INTERFACE1(nsTi
  NS_IMPL_THREADSAFE_QUERY_INTERFACE1(nsTimerImpl, nsITimer)
  NS_IMPL_THREADSAFE_ADDREF(nsTimerImpl)
  
 +#if 0
 +// XXXbsmedberg: replicate this logic in GC-land
  NS_IMETHODIMP_(nsrefcnt) nsTimerImpl::Release(void)
  {
    nsrefcnt count;
-@@ -135,6 +137,7 @@
+@@ -135,6 +137,7 @@ NS_IMETHODIMP_(nsrefcnt) nsTimerImpl::Re
  
    return count;
  }
 +#endif
  
  nsTimerImpl::nsTimerImpl() :
    mClosure(nsnull),
--- a/gc-hashtables.patch
+++ b/gc-hashtables.patch
@@ -11,17 +11,17 @@ diff --git a/caps/include/nsScriptSecuri
 -    PrincipalKey(const nsIPrincipal* key)
 +    PrincipalKey(const nsIPrincipal* key, const void *entryStore)
        : mKey(const_cast<nsIPrincipal*>(key))
      {
      }
 diff --git a/chrome/src/nsChromeRegistry.h b/chrome/src/nsChromeRegistry.h
 --- a/chrome/src/nsChromeRegistry.h
 +++ b/chrome/src/nsChromeRegistry.h
-@@ -212,9 +212,8 @@ public:
+@@ -217,9 +217,8 @@ public:
      typedef nsURIHashKey::KeyType        KeyType;
      typedef nsURIHashKey::KeyTypePointer KeyTypePointer;
  
 -    OverlayListEntry(KeyTypePointer aKey) : nsURIHashKey(aKey) { }
 -    OverlayListEntry(OverlayListEntry& toCopy) : nsURIHashKey(toCopy),
 -                                                 mArray(toCopy.mArray) { }
 +    OverlayListEntry(KeyTypePointer aKey, const char *entryStore)
 +      : nsURIHashKey(aKey, entryStore) { }
@@ -63,17 +63,17 @@ diff --git a/content/base/src/nsNameSpac
 +  nsNameSpaceKey(const nsNameSpaceKey& toCopy, const void *entryStore)
 +    : mKey(toCopy.mKey)
    {
    }
  
 diff --git a/content/html/content/src/nsHTMLFormElement.cpp b/content/html/content/src/nsHTMLFormElement.cpp
 --- a/content/html/content/src/nsHTMLFormElement.cpp
 +++ b/content/html/content/src/nsHTMLFormElement.cpp
-@@ -102,7 +102,9 @@ public:
+@@ -104,7 +104,9 @@ public:
    typedef const nsAString& KeyType;
    typedef const nsAString* KeyTypePointer;
    nsStringCaseInsensitiveHashKey(KeyTypePointer aStr) : mStr(*aStr) { } //take it easy just deal HashKey 
 -  nsStringCaseInsensitiveHashKey(const nsStringCaseInsensitiveHashKey& toCopy) : mStr(toCopy.mStr) { }
 +  nsStringCaseInsensitiveHashKey(const nsStringCaseInsensitiveHashKey& toCopy,
 +                                 const void *entryStore)
 +    : mStr(toCopy.mStr) { }
    ~nsStringCaseInsensitiveHashKey() { }
@@ -102,29 +102,29 @@ diff --git a/db/morkreader/nsMorkReader.
 -    IDKey(KeyTypePointer aStr) : mStr(*aStr) { }
 +    IDKey(KeyTypePointer aStr, const void *entryStore) : mStr(*aStr) { }
      IDKey(const IDKey& toCopy) : mStr(toCopy.mStr) { }
      ~IDKey() { }
  
 diff --git a/dom/src/storage/nsDOMStorage.cpp b/dom/src/storage/nsDOMStorage.cpp
 --- a/dom/src/storage/nsDOMStorage.cpp
 +++ b/dom/src/storage/nsDOMStorage.cpp
-@@ -154,8 +154,9 @@ GetQuota(const nsAString &aDomain, PRInt
+@@ -155,8 +155,9 @@ GetQuota(const nsAString &aDomain, PRInt
    *aWarnQuota = -1;
  }
  
 -nsSessionStorageEntry::nsSessionStorageEntry(KeyTypePointer aStr)
 -  : nsStringHashKey(aStr), mItem(nsnull)
 +nsSessionStorageEntry::nsSessionStorageEntry(KeyTypePointer aStr,
 +                                             const void *entryStore)
 +  : nsStringHashKey(aStr, entryStore), mItem(nsnull)
  {
  }
  
-@@ -348,8 +349,9 @@ nsDOMStorageDB* nsDOMStorage::gStorageDB
+@@ -349,8 +350,9 @@ nsDOMStorageDB* nsDOMStorage::gStorageDB
  nsDOMStorageDB* nsDOMStorage::gStorageDB = nsnull;
  #endif
  
 -nsDOMStorageEntry::nsDOMStorageEntry(KeyTypePointer aStr)
 -  : nsVoidPtrHashKey(aStr), mStorage(nsnull)
 +nsDOMStorageEntry::nsDOMStorageEntry(KeyTypePointer aStr,
 +                                     const void *entryStore)
 +  : nsVoidPtrHashKey(aStr, entryStore), mStorage(nsnull)
@@ -286,17 +286,17 @@ diff --git a/layout/style/nsCSSLoader.h 
    {
 -    MOZ_COUNT_DTOR(nsURIAndPrincipalHashKey);
    }
   
    nsURIAndPrincipalHashKey* GetKey() const {
 diff --git a/layout/svg/base/src/nsSVGFilterFrame.cpp b/layout/svg/base/src/nsSVGFilterFrame.cpp
 --- a/layout/svg/base/src/nsSVGFilterFrame.cpp
 +++ b/layout/svg/base/src/nsSVGFilterFrame.cpp
-@@ -132,7 +132,8 @@ private:
+@@ -134,7 +134,8 @@ private:
  
    class ImageAnalysisEntry : public nsStringHashKey {
    public:
 -    ImageAnalysisEntry(KeyTypePointer aStr) : nsStringHashKey(aStr) { }
 +    ImageAnalysisEntry(KeyTypePointer aStr, const void *entryStore)
 +      : nsStringHashKey(aStr, entryStore) { }
      ImageAnalysisEntry(const ImageAnalysisEntry& toCopy) : nsStringHashKey(toCopy),
        mInfo(toCopy.mInfo) { }
@@ -335,40 +335,40 @@ diff --git a/netwerk/dns/src/nsEffective
 -  nsDomainEntry(KeyTypePointer aEntry)
 +  nsDomainEntry(KeyTypePointer aEntry, const void *entryStore)
    {
    }
  
 diff --git a/security/manager/ssl/src/nsCertOverrideService.h b/security/manager/ssl/src/nsCertOverrideService.h
 --- a/security/manager/ssl/src/nsCertOverrideService.h
 +++ b/security/manager/ssl/src/nsCertOverrideService.h
-@@ -99,13 +99,8 @@ class nsCertOverrideEntry : public PLDHa
+@@ -102,13 +102,8 @@ class nsCertOverrideEntry : public PLDHa
      typedef const char* KeyTypePointer;
  
      // do nothing with aHost - we require mHead to be set before we're live!
 -    nsCertOverrideEntry(KeyTypePointer aHostWithPortUTF8)
 +    nsCertOverrideEntry(KeyTypePointer aHostWithPortUTF8, const void *entryStore)
      {
 -    }
 -
 -    nsCertOverrideEntry(const nsCertOverrideEntry& toCopy)
 -    {
 -      mSettings = toCopy.mSettings;
      }
  
      ~nsCertOverrideEntry()
-@@ -138,8 +133,6 @@ class nsCertOverrideEntry : public PLDHa
+@@ -141,8 +136,6 @@ class nsCertOverrideEntry : public PLDHa
        // pass nsnull
        return PL_DHashStringKey(nsnull, aKey);
      }
 -
 -    enum { ALLOW_MEMMOVE = PR_FALSE };
  
      // get methods
-     inline const nsCString &HostWithPort() const { return mSettings.mHostWithPortUTF8; }
+     inline const nsCString &HostWithPort() const { return mHostWithPort; }
 diff --git a/toolkit/components/places/src/nsNavHistoryResult.h b/toolkit/components/places/src/nsNavHistoryResult.h
 --- a/toolkit/components/places/src/nsNavHistoryResult.h
 +++ b/toolkit/components/places/src/nsNavHistoryResult.h
 @@ -75,8 +75,7 @@ public:
    typedef const PRInt64& KeyType;
    typedef const PRInt64* KeyTypePointer;
  
 -  nsTrimInt64HashKey(KeyTypePointer aKey) : mValue(*aKey) { }
@@ -821,26 +821,26 @@ diff --git a/xpcom/glue/nsBaseHashtable.
     * @return    number of entries
     */
    PRUint32 Count() const
 -  { return nsTHashtable<EntryType>::Count(); }
 +  { return nsTHashtable<EntryType, Allocator>::Count(); }
  
    /**
     * retrieve the value for a key.
-@@ -224,7 +221,7 @@ public:
+@@ -235,7 +232,7 @@ public:
    /**
     * reset the hashtable, removing all entries
     */
 -  void Clear() { nsTHashtable<EntryType>::Clear(); }
 +  void Clear() { nsTHashtable<EntryType, Allocator>::Clear(); }
  
  protected:
    /**
-@@ -255,56 +252,13 @@ protected:
+@@ -266,56 +263,13 @@ protected:
                                      void              *arg);
  };
  
 -/**
 - * This class is a thread-safe version of nsBaseHashtable.
 - */
 -template<class KeyClass,class DataType,class UserDataType>
 -class nsBaseHashtableMT :
@@ -889,41 +889,41 @@ diff --git a/xpcom/glue/nsBaseHashtable.
 -  (nsBaseHashtableET<KeyClass,DataType>& toCopy) :
 -  KeyClass(toCopy),
 -  mData(toCopy.mData)
 +nsBaseHashtableET<KeyClass,DataType>::nsBaseHashtableET(KeyTypePointer aKey, const void *entryStore) :
 +  KeyClass(aKey, entryStore)
  { }
  
  template<class KeyClass,class DataType>
-@@ -316,9 +270,9 @@ nsBaseHashtableET<KeyClass,DataType>::~n
+@@ -327,9 +281,9 @@ nsBaseHashtableET<KeyClass,DataType>::~n
  // nsBaseHashtable definitions
  //
  
 -template<class KeyClass,class DataType,class UserDataType>
 +template<class KeyClass,class DataType,class UserDataType,class Allocator>
  PLDHashOperator
 -nsBaseHashtable<KeyClass,DataType,UserDataType>::s_EnumReadStub
 +nsBaseHashtable<KeyClass,DataType,UserDataType,Allocator>::s_EnumReadStub
    (PLDHashTable *table, PLDHashEntryHdr *hdr, PRUint32 number, void* arg)
  {
    EntryType* ent = static_cast<EntryType*>(hdr);
-@@ -335,9 +289,9 @@ nsBaseHashtable<KeyClass,DataType,UserDa
+@@ -346,9 +300,9 @@ nsBaseHashtable<KeyClass,DataType,UserDa
    return PL_DHASH_NEXT;
  }
  
 -template<class KeyClass,class DataType,class UserDataType>
 +template<class KeyClass,class DataType,class UserDataType,class Allocator>
  PLDHashOperator
 -nsBaseHashtable<KeyClass,DataType,UserDataType>::s_EnumStub
 +nsBaseHashtable<KeyClass,DataType,UserDataType,Allocator>::s_EnumStub
    (PLDHashTable *table, PLDHashEntryHdr *hdr, PRUint32 number, void* arg)
  {
    EntryType* ent = static_cast<EntryType*>(hdr);
-@@ -346,110 +300,4 @@ nsBaseHashtable<KeyClass,DataType,UserDa
+@@ -357,110 +311,4 @@ nsBaseHashtable<KeyClass,DataType,UserDa
    return (eargs->func)(ent->GetKey(), ent->mData, eargs->userArg);
  }
  
 -
 -//
 -// nsBaseHashtableMT  definitions
 -//
 -
@@ -1402,17 +1402,17 @@ diff --git a/xpcom/glue/nsInterfaceHasht
 -  typedef typename KeyClass::KeyType KeyType;
 -  typedef Interface* UserDataType;
 -
 -  /**
 -   * @copydoc nsBaseHashtable::Get
 -   * @param pData This is an XPCOM getter, so pData is already_addrefed.
 -   *   If the key doesn't exist, pData will be set to nsnull.
 -   */
--  PRBool Get(KeyType aKey, UserDataType* pData) const;
+-  PRBool Get(KeyType aKey, UserDataType* pData NS_OUTPARAM) const;
 -
 -  // GetWeak does not make sense on a multi-threaded hashtable, where another
 -  // thread may remove the entry (and hence release it) as soon as GetWeak
 -  // returns
 -};
 -
 -
  //
--- a/gcobject-nodelete.patch
+++ b/gcobject-nodelete.patch
@@ -36,139 +36,139 @@ diff --git a/chrome/src/nsChromeRegistry
 +      mArray.Clear();
 +    }
  
    private:
      ProviderEntry* GetProvider(const nsACString& aPreferred, MatchType aType);
 diff --git a/content/html/content/src/nsHTMLFormElement.cpp b/content/html/content/src/nsHTMLFormElement.cpp
 --- a/content/html/content/src/nsHTMLFormElement.cpp
 +++ b/content/html/content/src/nsHTMLFormElement.cpp
-@@ -264,7 +264,7 @@ protected:
+@@ -265,7 +265,7 @@ protected:
     * @param aFormSubmission the submission object
     * @param aEvent the DOM event that was passed to us for the submit
     */
 -  nsresult BuildSubmission(nsCOMPtr<nsIFormSubmission>& aFormSubmission, 
 +  nsresult BuildSubmission(nsIFormSubmission*& aFormSubmission, 
                             nsEvent* aEvent);
    /**
     * Perform the submission (called by DoSubmit and FlushPendingSubmission)
-@@ -473,7 +473,6 @@ NS_NewHTMLFormElement(nsINodeInfo *aNode
+@@ -474,7 +474,6 @@ NS_NewHTMLFormElement(nsINodeInfo *aNode
    nsresult rv = it->Init();
  
    if (NS_FAILED(rv)) {
 -    delete it;
      return nsnull;
    }
  
-@@ -624,7 +623,7 @@ nsHTMLFormElement::Submit()
+@@ -625,7 +624,7 @@ nsHTMLFormElement::Submit()
  {
    // Send the submit event
    nsresult rv = NS_OK;
 -  nsCOMPtr<nsPresContext> presContext = GetPresContext();
 +  nsPresContext* presContext = GetPresContext();
    if (mPendingSubmission) {
      // aha, we have a pending submission that was not flushed
      // (this happens when form.submit() is called twice)
-@@ -688,7 +687,7 @@ nsHTMLFormElement::BindToTree(nsIDocumen
+@@ -689,7 +688,7 @@ nsHTMLFormElement::BindToTree(nsIDocumen
                                                   aCompileEventHandlers);
    NS_ENSURE_SUCCESS(rv, rv);
  
 -  nsCOMPtr<nsIHTMLDocument> htmlDoc(do_QueryInterface(aDocument));
 +  nsIHTMLDocument* htmlDoc(do_QueryInterface(aDocument));
    if (htmlDoc) {
      htmlDoc->AddedForm();
    }
-@@ -752,7 +751,7 @@ void
+@@ -753,7 +752,7 @@ void
  void
  nsHTMLFormElement::UnbindFromTree(PRBool aDeep, PRBool aNullParent)
  {
 -  nsCOMPtr<nsIHTMLDocument> oldDocument = do_QueryInterface(GetCurrentDoc());
 +  nsIHTMLDocument* oldDocument = do_QueryInterface(GetCurrentDoc());
  
    // Mark all of our controls as maybe being orphans
    MarkOrphans(mControls->mElements);
-@@ -895,8 +894,8 @@ nsHTMLFormElement::DoReset()
+@@ -911,8 +910,8 @@ nsHTMLFormElement::DoReset()
    PRUint32 numElements;
    GetElementCount(&numElements);
    for (PRUint32 elementX = 0; (elementX < numElements); elementX++) {
 -    nsCOMPtr<nsIFormControl> controlNode;
 -    GetElementAt(elementX, getter_AddRefs(controlNode));
 +    nsIFormControl* controlNode = nsnull;
 +    GetElementAt(elementX, &controlNode);
      if (controlNode) {
        controlNode->Reset();
      }
-@@ -926,7 +925,7 @@ nsHTMLFormElement::DoSubmit(nsEvent* aEv
+@@ -942,7 +941,7 @@ nsHTMLFormElement::DoSubmit(nsEvent* aEv
    mIsSubmitting = PR_TRUE;
    NS_ASSERTION(!mWebProgress && !mSubmittingRequest, "Web progress / submitting request should not exist here!");
  
 -  nsCOMPtr<nsIFormSubmission> submission;
 +  nsIFormSubmission* submission = nsnull;
     
    //
    // prepare the submission object
-@@ -962,7 +961,7 @@ nsHTMLFormElement::DoSubmit(nsEvent* aEv
+@@ -978,7 +977,7 @@ nsHTMLFormElement::DoSubmit(nsEvent* aEv
  }
  
  nsresult
 -nsHTMLFormElement::BuildSubmission(nsCOMPtr<nsIFormSubmission>& aFormSubmission, 
 +nsHTMLFormElement::BuildSubmission(nsIFormSubmission*& aFormSubmission, 
                                     nsEvent* aEvent)
  {
    NS_ASSERTION(!mPendingSubmission, "tried to build two submissions!");
-@@ -980,7 +979,7 @@ nsHTMLFormElement::BuildSubmission(nsCOM
+@@ -996,7 +995,7 @@ nsHTMLFormElement::BuildSubmission(nsCOM
    //
    // Get the submission object
    //
 -  rv = GetSubmissionFromForm(this, getter_AddRefs(aFormSubmission));
 +  rv = GetSubmissionFromForm(this, &aFormSubmission);
    NS_ENSURE_SUBMIT_SUCCESS(rv);
  
    //
-@@ -999,8 +998,8 @@ nsHTMLFormElement::SubmitSubmission(nsIF
+@@ -1015,8 +1014,8 @@ nsHTMLFormElement::SubmitSubmission(nsIF
    //
    // Get the action and target
    //
 -  nsCOMPtr<nsIURI> actionURI;
 -  rv = GetActionURL(getter_AddRefs(actionURI));
 +  nsIURI* actionURI = nsnull;
 +  rv = GetActionURL(&actionURI);
    NS_ENSURE_SUBMIT_SUCCESS(rv);
  
    if (!actionURI) {
-@@ -1010,8 +1009,8 @@ nsHTMLFormElement::SubmitSubmission(nsIF
+@@ -1026,8 +1025,8 @@ nsHTMLFormElement::SubmitSubmission(nsIF
  
    // If there is no link handler, then we won't actually be able to submit.
    nsIDocument* doc = GetCurrentDoc();
 -  nsCOMPtr<nsISupports> container = doc ? doc->GetContainer() : nsnull;
 -  nsCOMPtr<nsILinkHandler> linkHandler(do_QueryInterface(container));
 +  nsISupports* container = doc ? doc->GetContainer() : nsnull;
 +  nsILinkHandler* linkHandler(do_QueryInterface(container));
    if (!linkHandler || IsEditable()) {
      mIsSubmitting = PR_FALSE;
      return NS_OK;
-@@ -1066,7 +1065,7 @@ nsHTMLFormElement::SubmitSubmission(nsIF
+@@ -1082,7 +1081,7 @@ nsHTMLFormElement::SubmitSubmission(nsIF
    //
    // Submit
    //
 -  nsCOMPtr<nsIDocShell> docShell;
 +  nsIDocShell* docShell = nsnull;
  
    {
      nsAutoPopupStatePusher popupStatePusher(mSubmitPopupState);
-@@ -1074,7 +1073,7 @@ nsHTMLFormElement::SubmitSubmission(nsIF
+@@ -1090,7 +1089,7 @@ nsHTMLFormElement::SubmitSubmission(nsIF
      nsAutoHandlingUserInputStatePusher userInpStatePusher(mSubmitInitiatedFromUserInput);
  
      rv = aFormSubmission->SubmitTo(actionURI, target, this, linkHandler,
 -                                   getter_AddRefs(docShell),
 +                                   &docShell,
                                     getter_AddRefs(mSubmittingRequest));
    }
  
-@@ -1120,31 +1119,31 @@ nsHTMLFormElement::NotifySubmitObservers
+@@ -1136,31 +1135,31 @@ nsHTMLFormElement::NotifySubmitObservers
  
    // Notify observers that the form is being submitted.
    nsresult rv = NS_OK;
 -  nsCOMPtr<nsIObserverService> service =
 +  nsIObserverService* service =
      do_GetService("@mozilla.org/observer-service;1", &rv);
    NS_ENSURE_SUCCESS(rv, rv);
  
@@ -197,104 +197,104 @@ diff --git a/content/html/content/src/ns
 -      theEnum->GetNext(getter_AddRefs(inst));
 +      theEnum->GetNext(&inst);
  
 -      nsCOMPtr<nsIFormSubmitObserver> formSubmitObserver(
 +      nsIFormSubmitObserver* formSubmitObserver(
                        do_QueryInterface(inst));
        if (formSubmitObserver) {
          rv = formSubmitObserver->Notify(this,
-@@ -1222,8 +1221,8 @@ static PRInt32 CompareFormControlPositio
+@@ -1238,8 +1237,8 @@ static PRInt32 CompareFormControlPositio
  {
    NS_ASSERTION(aControl1 != aControl2, "Comparing a form control to itself");
  
 -  nsCOMPtr<nsIContent> content1 = do_QueryInterface(aControl1);
 -  nsCOMPtr<nsIContent> content2 = do_QueryInterface(aControl2);
 +  nsIContent* content1 = do_QueryInterface(aControl1);
 +  nsIContent* content2 = do_QueryInterface(aControl2);
  
    NS_ASSERTION(content1 && content2,
                 "We should be able to QI to nsIContent here!");
-@@ -1264,7 +1263,7 @@ nsHTMLFormElement::AddElement(nsIFormCon
+@@ -1280,7 +1279,7 @@ nsHTMLFormElement::AddElement(nsIFormCon
  {
  #ifdef DEBUG
    {
 -    nsCOMPtr<nsIContent> content = do_QueryInterface(aChild);
 +    nsIContent* content = do_QueryInterface(aChild);
      NS_ASSERTION(content->GetParent(),
                   "Form control should have a parent");
    }
-@@ -1280,7 +1279,7 @@ nsHTMLFormElement::AddElement(nsIFormCon
+@@ -1296,7 +1295,7 @@ nsHTMLFormElement::AddElement(nsIFormCon
                 "Form control already in form");
  
    PRUint32 count = controlList.Length();
 -  nsCOMPtr<nsIFormControl> element;
 +  nsIFormControl* element = nsnull;
    
    // Optimize most common case where we insert at the end.
    PRBool lastElement = PR_FALSE;
-@@ -1326,7 +1325,7 @@ nsHTMLFormElement::AddElement(nsIFormCon
+@@ -1342,7 +1341,7 @@ nsHTMLFormElement::AddElement(nsIFormCon
    //
    PRInt32 type = aChild->GetType();
    if (type == NS_FORM_INPUT_RADIO) {
 -    nsCOMPtr<nsIRadioControlElement> radio = do_QueryInterface(aChild);
 +    nsIRadioControlElement* radio = do_QueryInterface(aChild);
      nsresult rv = radio->AddedToRadioGroup();
      NS_ENSURE_SUCCESS(rv, rv);
    }
-@@ -1387,7 +1386,7 @@ nsHTMLFormElement::AddElement(nsIFormCon
+@@ -1403,7 +1402,7 @@ nsHTMLFormElement::AddElement(nsIFormCon
        nsIDocument* document = GetCurrentDoc();
        if (document) {
          MOZ_AUTO_DOC_UPDATE(document, UPDATE_CONTENT_STATE, PR_TRUE);
 -        nsCOMPtr<nsIContent> oldElement(do_QueryInterface(oldDefaultSubmit));
 +        nsIContent* oldElement(do_QueryInterface(oldDefaultSubmit));
          document->ContentStatesChanged(oldElement, nsnull,
                                         NS_EVENT_STATE_DEFAULT);
        }
-@@ -1414,7 +1413,7 @@ nsHTMLFormElement::RemoveElement(nsIForm
+@@ -1430,7 +1429,7 @@ nsHTMLFormElement::RemoveElement(nsIForm
    //
    nsresult rv = NS_OK;
    if (aChild->GetType() == NS_FORM_INPUT_RADIO) {
 -    nsCOMPtr<nsIRadioControlElement> radio = do_QueryInterface(aChild);
 +    nsIRadioControlElement* radio = do_QueryInterface(aChild);
      rv = radio->WillRemoveFromRadioGroup();
      NS_ENSURE_SUCCESS(rv, rv);
    }
-@@ -1479,7 +1478,7 @@ nsHTMLFormElement::RemoveElement(nsIForm
+@@ -1495,7 +1494,7 @@ nsHTMLFormElement::RemoveElement(nsIForm
        nsIDocument* document = GetCurrentDoc();
        if (document) {
          MOZ_AUTO_DOC_UPDATE(document, UPDATE_CONTENT_STATE, PR_TRUE);
 -        nsCOMPtr<nsIContent> newElement(do_QueryInterface(mDefaultSubmitElement));
 +        nsIContent* newElement(do_QueryInterface(mDefaultSubmitElement));
          document->ContentStatesChanged(newElement, nsnull,
                                         NS_EVENT_STATE_DEFAULT);
        }
-@@ -1520,10 +1519,10 @@ nsHTMLFormElement::OnSubmitClickBegin()
+@@ -1536,10 +1535,10 @@ nsHTMLFormElement::OnSubmitClickBegin()
    // Prepare to run NotifySubmitObservers early before the
    // scripts on the page get to modify the form data, possibly
    // throwing off any password manager. (bug 257781)
 -  nsCOMPtr<nsIURI> actionURI;
 +  nsIURI* actionURI = nsnull;
    nsresult rv;
  
 -  rv = GetActionURL(getter_AddRefs(actionURI));
 +  rv = GetActionURL(&actionURI);
    if (NS_FAILED(rv) || !actionURI)
      return NS_OK;
  
-@@ -1550,7 +1549,7 @@ NS_IMETHODIMP
+@@ -1566,7 +1565,7 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  nsHTMLFormElement::FlushPendingSubmission()
  {
 -  nsCOMPtr<nsIFormSubmission> kunkFuDeathGrip(mPendingSubmission);
 +  nsIFormSubmission* kunkFuDeathGrip(mPendingSubmission);
  
    if (!mPendingSubmission) {
      return NS_OK;
-@@ -1610,24 +1609,24 @@ nsHTMLFormElement::GetActionURL(nsIURI**
+@@ -1626,24 +1625,24 @@ nsHTMLFormElement::GetActionURL(nsIURI**
    // XUL, do nothing. This prevents undesirable reloading of
    // a document inside XUL.
  
 -  nsCOMPtr<nsIURI> actionURL;
 +  nsIURI* actionURL = nsnull;
    if (action.IsEmpty()) {
 -    nsCOMPtr<nsIHTMLDocument> htmlDoc(do_QueryInterface(document));
 +    nsIHTMLDocument* htmlDoc(do_QueryInterface(document));
@@ -314,40 +314,40 @@ diff --git a/content/html/content/src/ns
      if (!baseURL) {
        return NS_OK; // No base URL -> exit early, see Bug 30721
      }
 -    rv = NS_NewURI(getter_AddRefs(actionURL), action, nsnull, baseURL);
 +    rv = NS_NewURI(&actionURL, action, nsnull, baseURL);
      NS_ENSURE_SUCCESS(rv, rv);
    }
  
-@@ -1815,10 +1814,10 @@ nsHTMLFormElement::GetPositionInGroup(ns
+@@ -1831,10 +1830,10 @@ nsHTMLFormElement::GetPositionInGroup(ns
      return NS_OK;
    }
  
 -  nsCOMPtr<nsISupports> itemWithName;
 -  nsresult rv = ResolveName(name, getter_AddRefs(itemWithName));
 +  nsISupports* itemWithName = nsnull;
 +  nsresult rv = ResolveName(name, &itemWithName);
    NS_ENSURE_SUCCESS(rv, rv);
 -  nsCOMPtr<nsIDOMNodeList> radioNodeList(do_QueryInterface(itemWithName));
 +  nsIDOMNodeList* radioNodeList(do_QueryInterface(itemWithName));
  
    // XXX If ResolveName could return an nsContentList instead then we 
    //     could get an nsContentList instead of using this hacky upcast
-@@ -1829,7 +1828,7 @@ nsHTMLFormElement::GetPositionInGroup(ns
+@@ -1845,7 +1844,7 @@ nsHTMLFormElement::GetPositionInGroup(ns
      return NS_OK;
    }
  
 -  nsCOMPtr<nsIContent> currentRadioNode(do_QueryInterface(aRadio));
 +  nsIContent* currentRadioNode(do_QueryInterface(aRadio));
    NS_ASSERTION(currentRadioNode, "No nsIContent for current radio button");
    *aPositionIndex = radioGroup->IndexOf(currentRadioNode, PR_TRUE);
    NS_ASSERTION(*aPositionIndex >= 0, "Radio button not found in its own group");
-@@ -1850,17 +1849,17 @@ nsHTMLFormElement::GetNextRadioButton(co
+@@ -1866,17 +1865,17 @@ nsHTMLFormElement::GetNextRadioButton(co
    // If no radio is focused, get the radio relative to the selected one.
    *aRadioOut = nsnull;
  
 -  nsCOMPtr<nsIDOMHTMLInputElement> currentRadio;
 +  nsIDOMHTMLInputElement* currentRadio = nsnull;
    if (aFocusedRadio) {
      currentRadio = aFocusedRadio;
    }
@@ -360,65 +360,65 @@ diff --git a/content/html/content/src/ns
 -  ResolveName(aName, getter_AddRefs(itemWithName));
 -  nsCOMPtr<nsIDOMNodeList> radioNodeList(do_QueryInterface(itemWithName));
 +  nsISupports* itemWithName = nsnull;
 +  ResolveName(aName, &itemWithName);
 +  nsIDOMNodeList* radioNodeList(do_QueryInterface(itemWithName));
  
    // XXX If ResolveName could return an nsContentList instead then we 
    //     could get an nsContentList instead of using this hacky upcast
-@@ -1871,7 +1870,7 @@ nsHTMLFormElement::GetNextRadioButton(co
+@@ -1887,7 +1886,7 @@ nsHTMLFormElement::GetNextRadioButton(co
      return NS_ERROR_FAILURE;
    }
  
 -  nsCOMPtr<nsIContent> currentRadioNode(do_QueryInterface(currentRadio));
 +  nsIContent* currentRadioNode(do_QueryInterface(currentRadio));
    NS_ASSERTION(currentRadioNode, "No nsIContent for current radio button");
    PRInt32 index = radioGroup->IndexOf(currentRadioNode, PR_TRUE);
    if (index < 0) {
-@@ -1881,9 +1880,9 @@ nsHTMLFormElement::GetNextRadioButton(co
+@@ -1897,9 +1896,9 @@ nsHTMLFormElement::GetNextRadioButton(co
    PRUint32 numRadios;
    radioGroup->GetLength(&numRadios);
    PRBool disabled = PR_TRUE;
 -  nsCOMPtr<nsIDOMHTMLInputElement> radio;
 -  nsCOMPtr<nsIDOMNode> radioDOMNode;
 -  nsCOMPtr<nsIFormControl> formControl;
 +  nsIDOMHTMLInputElement* radio = nsnull;
 +  nsIDOMNode* radioDOMNode = nsnull;
 +  nsIFormControl* formControl = nsnull;
  
    do {
      if (aPrevious) {
-@@ -1894,7 +1893,7 @@ nsHTMLFormElement::GetNextRadioButton(co
+@@ -1910,7 +1909,7 @@ nsHTMLFormElement::GetNextRadioButton(co
      else if (++index >= (PRInt32)numRadios) {
        index = 0;
      }
 -    radioGroup->Item(index, getter_AddRefs(radioDOMNode));
 +    radioGroup->Item(index, &radioDOMNode);
      radio = do_QueryInterface(radioDOMNode);
      if (!radio)
        continue;
-@@ -1924,13 +1923,13 @@ nsHTMLFormElement::WalkRadioGroup(const 
+@@ -1940,13 +1939,13 @@ nsHTMLFormElement::WalkRadioGroup(const 
      // XXX If the name is empty, it's not stored in the control list.  There
      // *must* be a more efficient way to do this.
      //
 -    nsCOMPtr<nsIFormControl> control;
 +    nsIFormControl* control = nsnull;
      PRUint32 len = 0;
      GetElementCount(&len);
      for (PRUint32 i=0; i<len; i++) {
 -      GetElementAt(i, getter_AddRefs(control));
 +      GetElementAt(i, &control);
        if (control->GetType() == NS_FORM_INPUT_RADIO) {
 -        nsCOMPtr<nsIContent> controlContent(do_QueryInterface(control));
 +        nsIContent* controlContent(do_QueryInterface(control));
          if (controlContent) {
            if (controlContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::name,
                                            EmptyString(), eCaseMatters)) {
-@@ -1946,27 +1945,27 @@ nsHTMLFormElement::WalkRadioGroup(const 
+@@ -1962,27 +1961,27 @@ nsHTMLFormElement::WalkRadioGroup(const 
      //
      // Get the control / list of controls from the form using form["name"]
      //
 -    nsCOMPtr<nsISupports> item;
 -    rv = DoResolveName(aName, aFlushContent, getter_AddRefs(item));
 +    nsISupports* item = nsnull;
 +    rv = DoResolveName(aName, aFlushContent, &item);
  
@@ -443,38 +443,38 @@ diff --git a/content/html/content/src/ns
 -            nodeList->Item(i, getter_AddRefs(node));
 -            nsCOMPtr<nsIFormControl> formControl(do_QueryInterface(node));
 +            nsIDOMNode* node = nsnull;
 +            nodeList->Item(i, &node);
 +            nsIFormControl* formControl(do_QueryInterface(node));
              if (formControl) {
                if (formControl->GetType() == NS_FORM_INPUT_RADIO) {
                  aVisitor->Visit(formControl, &stopIterating);
-@@ -2112,9 +2111,9 @@ nsFormControlList::NamedItem(const nsASt
+@@ -2128,9 +2127,9 @@ nsFormControlList::NamedItem(const nsASt
  
    nsresult rv = NS_OK;
  
 -  nsCOMPtr<nsISupports> supports;
 +  nsISupports* supports = nsnull;
    
 -  if (!mNameLookupTable.Get(aName, getter_AddRefs(supports))) // key not found
 +  if (!mNameLookupTable.Get(aName, &supports)) // key not found
       return rv;
  
    if (supports) {
-@@ -2123,7 +2122,7 @@ nsFormControlList::NamedItem(const nsASt
+@@ -2139,7 +2138,7 @@ nsFormControlList::NamedItem(const nsASt
  
      if (!*aReturn) {
        // If not, we check if it's a node list.
 -      nsCOMPtr<nsIDOMNodeList> nodeList(do_QueryInterface(supports));
 +      nsIDOMNodeList* nodeList(do_QueryInterface(supports));
        NS_ASSERTION(nodeList, "Huh, what's going one here?");
  
        if (nodeList) {
-@@ -2165,18 +2164,18 @@ nsFormControlList::AddElementToTable(nsI
+@@ -2181,18 +2180,18 @@ nsFormControlList::AddElementToTable(nsI
      return NS_OK;
    }
  
 -  nsCOMPtr<nsISupports> supports;
 -  mNameLookupTable.Get(aName, getter_AddRefs(supports));
 +  nsISupports* supports = nsnull;
 +  mNameLookupTable.Get(aName, &supports);
  
@@ -488,17 +488,17 @@ diff --git a/content/html/content/src/ns
      // Found something in the hash, check its type
 -    nsCOMPtr<nsIContent> content(do_QueryInterface(supports));
 -    nsCOMPtr<nsIContent> newChild(do_QueryInterface(aChild));
 +    nsIContent* content(do_QueryInterface(supports));
 +    nsIContent* newChild(do_QueryInterface(aChild));
  
      if (content) {
        // Check if the new content is the same as the one we found in the
-@@ -2197,19 +2196,19 @@ nsFormControlList::AddElementToTable(nsI
+@@ -2213,19 +2212,19 @@ nsFormControlList::AddElementToTable(nsI
        // Add the new child too
        list->AppendElement(newChild);
  
 -      nsCOMPtr<nsISupports> listSupports = do_QueryInterface(list);
 +      nsISupports* listSupports = do_QueryInterface(list);
  
        // Replace the element with the list.
        NS_ENSURE_TRUE(mNameLookupTable.Put(aName, listSupports),
@@ -511,17 +511,17 @@ diff --git a/content/html/content/src/ns
  
        // Upcast, uggly, but it works!
        nsBaseContentList *list = static_cast<nsBaseContentList *>
 -                                           ((nsIDOMNodeList *)nodeList.get());
 +                                           ((nsIDOMNodeList *)nodeList);
  
        PRInt32 oldIndex = list->IndexOf(newChild, PR_FALSE);
        
-@@ -2244,17 +2243,17 @@ nsFormControlList::RemoveElementFromTabl
+@@ -2260,17 +2259,17 @@ nsFormControlList::RemoveElementFromTabl
      return NS_OK;
    }
  
 -  nsCOMPtr<nsIContent> content = do_QueryInterface(aChild);  
 +  nsIContent* content = do_QueryInterface(aChild);  
    if (!content) {
      return NS_OK;
    }
@@ -533,32 +533,32 @@ diff --git a/content/html/content/src/ns
 +  if (!mNameLookupTable.Get(aName, &supports))
      return NS_OK;
  
 -  nsCOMPtr<nsIFormControl> fctrl(do_QueryInterface(supports));
 +  nsIFormControl* fctrl(do_QueryInterface(supports));
  
    if (fctrl) {
      // Single element in the hash, just remove it if it's the one
-@@ -2266,12 +2265,12 @@ nsFormControlList::RemoveElementFromTabl
+@@ -2282,12 +2281,12 @@ nsFormControlList::RemoveElementFromTabl
      return NS_OK;
    }
  
 -  nsCOMPtr<nsIDOMNodeList> nodeList(do_QueryInterface(supports));
 +  nsIDOMNodeList* nodeList(do_QueryInterface(supports));
    NS_ENSURE_TRUE(nodeList, NS_ERROR_FAILURE);
  
    // Upcast, uggly, but it works!
    nsBaseContentList *list = static_cast<nsBaseContentList *>
 -                                       ((nsIDOMNodeList *)nodeList.get());
 +                                       ((nsIDOMNodeList *)nodeList);
  
    list->RemoveElement(content);
  
-@@ -2285,11 +2284,11 @@ nsFormControlList::RemoveElementFromTabl
+@@ -2301,11 +2300,11 @@ nsFormControlList::RemoveElementFromTabl
    } else if (length == 1) {
      // Only one element left, replace the list in the hash with the
      // single element.
 -    nsCOMPtr<nsIDOMNode> node;
 -    list->Item(0, getter_AddRefs(node));
 +    nsIDOMNode* node = nsnull;
 +    list->Item(0, &node);
  
@@ -596,170 +596,170 @@ diff --git a/content/xul/document/src/ns
 -          delete script;
 +          NS_GetGC()->Free(script);
            return rv;
        }
  
 diff --git a/docshell/shistory/src/nsSHEntry.cpp b/docshell/shistory/src/nsSHEntry.cpp
 --- a/docshell/shistory/src/nsSHEntry.cpp
 +++ b/docshell/shistory/src/nsSHEntry.cpp
-@@ -82,7 +82,6 @@ nsresult nsSHEntry::Startup()
+@@ -84,7 +84,6 @@ nsresult nsSHEntry::Startup()
  
  void nsSHEntry::Shutdown()
  {
 -  delete gHistoryTracker;
    gHistoryTracker = nsnull;
  }
  
-@@ -155,7 +154,7 @@ nsSHEntry::~nsSHEntry()
+@@ -157,7 +156,7 @@ nsSHEntry::~nsSHEntry()
    mChildren.EnumerateForwards(ClearParentPtr, nsnull);
    mChildren.Clear();
  
 -  nsCOMPtr<nsIContentViewer> viewer = mContentViewer;
 +  nsIContentViewer* viewer = mContentViewer;
    DropPresentationState();
    if (viewer) {
      viewer->Destroy();
-@@ -199,7 +198,6 @@ NS_IMETHODIMP nsSHEntry::GetURI(nsIURI**
+@@ -203,7 +202,6 @@ NS_IMETHODIMP nsSHEntry::GetURI(nsIURI**
  NS_IMETHODIMP nsSHEntry::GetURI(nsIURI** aURI)
  {
    *aURI = mURI;
 -  NS_IF_ADDREF(*aURI);
    return NS_OK;
  }
  
-@@ -212,7 +210,6 @@ NS_IMETHODIMP nsSHEntry::GetReferrerURI(
+@@ -216,7 +214,6 @@ NS_IMETHODIMP nsSHEntry::GetReferrerURI(
  NS_IMETHODIMP nsSHEntry::GetReferrerURI(nsIURI **aReferrerURI)
  {
    *aReferrerURI = mReferrerURI;
 -  NS_IF_ADDREF(*aReferrerURI);
    return NS_OK;
  }
  
-@@ -236,8 +233,8 @@ nsSHEntry::SetContentViewer(nsIContentVi
+@@ -240,8 +237,8 @@ nsSHEntry::SetContentViewer(nsIContentVi
    if (mContentViewer) {
      gHistoryTracker->AddObject(this);
  
 -    nsCOMPtr<nsIDOMDocument> domDoc;
 -    mContentViewer->GetDOMDocument(getter_AddRefs(domDoc));
 +    nsIDOMDocument* domDoc = nsnull;
 +    mContentViewer->GetDOMDocument(&domDoc);
      // Store observed document in strong pointer in case it is removed from
      // the contentviewer
      mDocument = do_QueryInterface(domDoc);
-@@ -254,7 +251,6 @@ nsSHEntry::GetContentViewer(nsIContentVi
+@@ -258,7 +255,6 @@ nsSHEntry::GetContentViewer(nsIContentVi
  nsSHEntry::GetContentViewer(nsIContentViewer **aResult)
  {
    *aResult = mContentViewer;
 -  NS_IF_ADDREF(*aResult);
    return NS_OK;
  }
  
-@@ -271,7 +267,6 @@ nsSHEntry::GetAnyContentViewer(nsISHEntr
+@@ -275,7 +271,6 @@ nsSHEntry::GetAnyContentViewer(nsISHEntr
      printf("Found content viewer\n");
  #endif
      *aOwnerEntry = this;
 -    NS_ADDREF(*aOwnerEntry);
      return NS_OK;
    }
    // The root SHEntry doesn't have a ContentViewer, so check child nodes
-@@ -327,7 +322,6 @@ NS_IMETHODIMP nsSHEntry::GetPostData(nsI
+@@ -331,7 +326,6 @@ NS_IMETHODIMP nsSHEntry::GetPostData(nsI
  NS_IMETHODIMP nsSHEntry::GetPostData(nsIInputStream** aResult)
  {
    *aResult = mPostData;
 -  NS_IF_ADDREF(*aResult);
    return NS_OK;
  }
  
-@@ -340,7 +334,6 @@ NS_IMETHODIMP nsSHEntry::GetLayoutHistor
+@@ -344,7 +338,6 @@ NS_IMETHODIMP nsSHEntry::GetLayoutHistor
  NS_IMETHODIMP nsSHEntry::GetLayoutHistoryState(nsILayoutHistoryState** aResult)
  {
    *aResult = mLayoutHistoryState;
 -  NS_IF_ADDREF(*aResult);
    return NS_OK;
  }
  
-@@ -402,7 +395,6 @@ NS_IMETHODIMP nsSHEntry::GetCacheKey(nsI
+@@ -406,7 +399,6 @@ NS_IMETHODIMP nsSHEntry::GetCacheKey(nsI
  NS_IMETHODIMP nsSHEntry::GetCacheKey(nsISupports** aResult)
  {
    *aResult = mCacheKey;
 -  NS_IF_ADDREF(*aResult);
    return NS_OK;
  }
  
-@@ -492,7 +484,6 @@ nsSHEntry::Clone(nsISHEntry ** aResult)
+@@ -496,7 +488,6 @@ nsSHEntry::Clone(nsISHEntry ** aResult)
    *aResult = new nsSHEntry(*this);
    if (!*aResult)
      return NS_ERROR_OUT_OF_MEMORY;
 -  NS_ADDREF(*aResult);
    return NS_OK;
  }
  
-@@ -501,7 +492,6 @@ nsSHEntry::GetParent(nsISHEntry ** aResu
+@@ -505,7 +496,6 @@ nsSHEntry::GetParent(nsISHEntry ** aResu
  {
    NS_ENSURE_ARG_POINTER(aResult);
    *aResult = mParent;
 -  NS_IF_ADDREF(*aResult);
    return NS_OK;
  }
  
-@@ -527,7 +517,7 @@ NS_IMETHODIMP
+@@ -531,7 +521,7 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  nsSHEntry::GetWindowState(nsISupports **aState)
  {
 -  NS_IF_ADDREF(*aState = mWindowState);
 +  *aState = mWindowState;
    return NS_OK;
  }
  
-@@ -548,7 +538,7 @@ NS_IMETHODIMP
+@@ -552,7 +542,7 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  nsSHEntry::GetOwner(nsISupports **aOwner)
  {
 -  NS_IF_ADDREF(*aOwner = mOwner);
 +  *aOwner = mOwner;
    return NS_OK;
  }
  
-@@ -620,7 +610,6 @@ nsSHEntry::GetChildAt(PRInt32 aIndex, ns
+@@ -624,7 +614,6 @@ nsSHEntry::GetChildAt(PRInt32 aIndex, ns
      *aResult = mChildren[aIndex];
      // yes, mChildren can have holes in it.  AddChild's offset parameter makes
      // that possible.
 -    NS_IF_ADDREF(*aResult);
    } else {
      *aResult = nsnull;
    }
-@@ -638,7 +627,7 @@ NS_IMETHODIMP
+@@ -642,7 +631,7 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  nsSHEntry::ChildShellAt(PRInt32 aIndex, nsIDocShellTreeItem **aShell)
  {
 -  NS_IF_ADDREF(*aShell = mChildShells.SafeObjectAt(aIndex));
 +  *aShell = mChildShells.SafeObjectAt(aIndex);
    return NS_OK;
  }
  
-@@ -652,7 +641,7 @@ NS_IMETHODIMP
+@@ -656,7 +645,7 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  nsSHEntry::GetRefreshURIList(nsISupportsArray **aList)
  {
 -  NS_IF_ADDREF(*aList = mRefreshURIList);
 +  *aList = mRefreshURIList;
    return NS_OK;
  }
  
-@@ -679,7 +668,7 @@ void
+@@ -683,7 +672,7 @@ void
  void
  nsSHEntry::DropPresentationState()
  {
 -  nsRefPtr<nsSHEntry> kungFuDeathGrip = this;
 +  nsSHEntry* kungFuDeathGrip = this;
  
    if (mDocument) {
      mDocument->SetShellsHidden(PR_FALSE);
-@@ -705,19 +694,19 @@ nsSHEntry::Expire()
+@@ -709,19 +698,19 @@ nsSHEntry::Expire()
    // get it evicted.
    if (!mContentViewer)
      return;
 -  nsCOMPtr<nsISupports> container;
 -  mContentViewer->GetContainer(getter_AddRefs(container));
 -  nsCOMPtr<nsIDocShellTreeItem> treeItem = do_QueryInterface(container);
 +  nsISupports* container = nsnull;
 +  mContentViewer->GetContainer(&container);
@@ -778,17 +778,17 @@ diff --git a/docshell/shistory/src/nsSHE
 +  treeItem->GetSameTypeRootTreeItem(&root);
 +  nsIWebNavigation* webNav = do_QueryInterface(root);
 +  nsISHistory* history = nsnull;
 +  webNav->GetSessionHistory(&history);
 +  nsISHistoryInternal* historyInt = do_QueryInterface(history);
    if (!historyInt)
      return;
    historyInt->EvictExpiredContentViewerForEntry(this);
-@@ -818,7 +807,7 @@ nsSHEntry::DocumentMutated()
+@@ -822,7 +811,7 @@ nsSHEntry::DocumentMutated()
    // Release the reference to the contentviewer asynchronously so that the
    // document doesn't get nuked mid-mutation.
  
 -  nsCOMPtr<nsIRunnable> evt =
 +  nsIRunnable* evt =
        new DestroyViewerEvent(mContentViewer, mDocument);
    nsresult rv = NS_DispatchToCurrentThread(evt);
    if (NS_FAILED(rv)) {
@@ -1998,103 +1998,103 @@ diff --git a/js/src/xpconnect/src/xpcwra
      // described by the nsIClassInfo, not for the class info object
      // itself.
      if(!isClassInfo &&
 -       NS_FAILED(GatherScriptableCreateInfo(identity, info.get(),
 +       NS_FAILED(GatherScriptableCreateInfo(identity, info,
                                              &sciProto, &sciWrapper)))
          return NS_ERROR_FAILURE;
  
-@@ -481,7 +481,7 @@ XPCWrappedNative::GetUsedOnly(XPCCallCon
+@@ -494,7 +494,7 @@ XPCWrappedNative::GetUsedOnly(XPCCallCon
                                XPCWrappedNative** resultWrapper)
  {
      NS_ASSERTION(Object, "XPCWrappedNative::GetUsedOnly was called with a null Object");
 -    nsCOMPtr<nsISupports> identity;
 +    nsISupports* identity = nsnull;
  #ifdef XPC_IDISPATCH_SUPPORT
      // XXX See GetNewOrUsed for more info on this
      if(Interface->GetIID()->Equals(NSID_IDISPATCH))
-@@ -584,13 +584,13 @@ XPCWrappedNative::GatherProtoScriptableC
+@@ -597,13 +597,13 @@ XPCWrappedNative::GatherProtoScriptableC
      NS_ASSERTION(classInfo, "bad param");
      NS_ASSERTION(sciProto && !sciProto->GetCallback(), "bad param");
  
 -    nsCOMPtr<nsISupports> possibleHelper;
 +    nsISupports* possibleHelper = nsnull;
      nsresult rv = classInfo->GetHelperForLanguage(
                                      nsIProgrammingLanguage::JAVASCRIPT,
 -                                    getter_AddRefs(possibleHelper));
 +                                    &possibleHelper);
      if(NS_SUCCEEDED(rv) && possibleHelper)
      {
 -        nsCOMPtr<nsIXPCScriptable> helper(do_QueryInterface(possibleHelper));
 +        nsIXPCScriptable* helper(do_QueryInterface(possibleHelper));
          if(helper)
          {
              JSUint32 flags;
-@@ -629,7 +629,7 @@ XPCWrappedNative::GatherScriptableCreate
+@@ -642,7 +642,7 @@ XPCWrappedNative::GatherScriptableCreate
      }
  
      // Do the same for the wrapper specific scriptable
 -    nsCOMPtr<nsIXPCScriptable> helper(do_QueryInterface(obj));
 +    nsIXPCScriptable* helper(do_QueryInterface(obj));
      if(helper)
      {
          JSUint32 flags;
-@@ -905,7 +905,6 @@ XPCWrappedNative::FlatJSObjectFinalized(
+@@ -918,7 +918,6 @@ XPCWrappedNative::FlatJSObjectFinalized(
             (!HasProto() ||
              (proto && proto->GetScriptableInfo() != mScriptableInfo)))
          {
 -            delete mScriptableInfo;
              mScriptableInfo = nsnull;
          }
  
-@@ -954,13 +953,6 @@ XPCWrappedNative::SystemIsBeingShutDown(
+@@ -967,13 +966,6 @@ XPCWrappedNative::SystemIsBeingShutDown(
  
      if(HasProto())
          proto->SystemIsBeingShutDown(cx);
 -
 -    if(mScriptableInfo &&
 -       (!HasProto() ||
 -        (proto && proto->GetScriptableInfo() != mScriptableInfo)))
 -    {
 -        delete mScriptableInfo;
 -    }
  
      // cleanup the tearoffs...
  
-@@ -1438,8 +1430,8 @@ XPCWrappedNative::InitTearOff(XPCCallCon
+@@ -1451,8 +1443,8 @@ XPCWrappedNative::InitTearOff(XPCCallCon
          // Guard against trying to build a tearoff for a shared nsIClassInfo.
          if(iid->Equals(NS_GET_IID(nsIClassInfo)))
          {
 -            nsCOMPtr<nsISupports> alternate_identity(do_QueryInterface(obj));
 -            if(alternate_identity.get() != identity)
 +            nsISupports* alternate_identity(do_QueryInterface(obj));
 +            if(alternate_identity != identity)
              {
                  NS_RELEASE(obj);
                  aTearOff->SetInterface(nsnull);
-@@ -1463,7 +1455,7 @@ XPCWrappedNative::InitTearOff(XPCCallCon
+@@ -1476,7 +1468,7 @@ XPCWrappedNative::InitTearOff(XPCCallCon
          // The code in this block also does a check for the double wrapped
          // nsIPropertyBag case.
  
 -        nsCOMPtr<nsIXPConnectWrappedJS> wrappedJS(do_QueryInterface(obj));
 +        nsIXPConnectWrappedJS* wrappedJS(do_QueryInterface(obj));
          if(wrappedJS)
          {
              JSObject* jso = nsnull;
-@@ -2428,7 +2420,7 @@ XPCWrappedNative::GetObjectPrincipal() c
+@@ -2441,7 +2433,7 @@ XPCWrappedNative::GetObjectPrincipal() c
  {
      nsIPrincipal* principal = GetScope()->GetPrincipal();
  #ifdef DEBUG
 -    nsCOMPtr<nsIScriptObjectPrincipal> objPrin(do_QueryInterface(mIdentity));
 +    nsIScriptObjectPrincipal* objPrin(do_QueryInterface(mIdentity));
      NS_ASSERTION(!objPrin || objPrin->GetPrincipal() == principal,
                   "Principal mismatch.  Expect bad things to happen");
  #endif
-@@ -2713,8 +2705,8 @@ XPCWrappedNative::HandlePossibleNameCase
+@@ -2726,8 +2718,8 @@ XPCWrappedNative::HandlePossibleNameCase
              if(e)
              {
                  nsresult rv;
 -                nsCOMPtr<nsIStackFrame> loc = nsnull;
 -                rv = e->GetLocation(getter_AddRefs(loc));
 +                nsIStackFrame* loc = nsnull;
 +                rv = e->GetLocation(&loc);
                  if(NS_SUCCEEDED(rv) && loc) {
@@ -2166,29 +2166,29 @@ diff --git a/layout/generic/nsTextFrameT
      }
    }
  
 -  nsCOMPtr<nsIAccessibilityService> accService = do_GetService("@mozilla.org/accessibilityService;1");
 +  nsIAccessibilityService* accService = do_GetService("@mozilla.org/accessibilityService;1");
  
    if (accService) {
      return accService->CreateHTMLTextAccessible(static_cast<nsIFrame*>(this), aAccessible);
-@@ -4224,9 +4222,9 @@ nsTextFrame::GetSelectionStatus(PRInt16*
+@@ -4228,9 +4226,9 @@ nsTextFrame::GetSelectionStatus(PRInt16*
  nsTextFrame::GetSelectionStatus(PRInt16* aSelectionFlags)
  {
    // get the selection controller
 -  nsCOMPtr<nsISelectionController> selectionController;
 +  nsISelectionController* selectionController = nsnull;
    nsresult rv = GetSelectionController(PresContext(),
 -                                       getter_AddRefs(selectionController));
 +                                       &selectionController);
    if (NS_FAILED(rv) || !selectionController)
      return nsISelectionController::SELECTION_OFF;
  
-@@ -4388,15 +4386,15 @@ nsTextFrame::SetSelected(nsPresContext* 
+@@ -4392,15 +4390,15 @@ nsTextFrame::SetSelected(nsPresContext* 
    PRBool found = PR_FALSE;
    if (aRange) {
      //lets see if the range contains us, if so we must redraw!
 -    nsCOMPtr<nsIDOMNode> endNode;
 +    nsIDOMNode* endNode = nsnull;
      PRInt32 endOffset;
 -    nsCOMPtr<nsIDOMNode> startNode;
 +    nsIDOMNode* startNode = nsnull;
@@ -2202,33 +2202,33 @@ diff --git a/layout/generic/nsTextFrameT
 -    nsCOMPtr<nsIDOMNode> thisNode = do_QueryInterface(GetContent());
 +    nsIDOMNode* thisNode = do_QueryInterface(GetContent());
  
      if (thisNode == startNode)
      {
 diff --git a/layout/mathml/base/src/nsMathMLChar.cpp b/layout/mathml/base/src/nsMathMLChar.cpp
 --- a/layout/mathml/base/src/nsMathMLChar.cpp
 +++ b/layout/mathml/base/src/nsMathMLChar.cpp
-@@ -154,12 +154,12 @@ static void
+@@ -156,12 +156,12 @@ static void
  static void
  AlertMissingFonts(nsString& aMissingFonts)
  {
 -  nsCOMPtr<nsIStringBundleService> sbs(do_GetService(NS_STRINGBUNDLE_CONTRACTID));
 +  nsIStringBundleService* sbs(do_GetService(NS_STRINGBUNDLE_CONTRACTID));
    if (!sbs)
      return;
  
 -  nsCOMPtr<nsIStringBundle> sb;
 -  sbs->CreateBundle("resource://gre/res/fonts/mathfont.properties", getter_AddRefs(sb));
 +  nsIStringBundle* sb = nsnull;
 +  sbs->CreateBundle("resource://gre/res/fonts/mathfont.properties", &sb);
    if (!sb)
      return;
  
-@@ -169,14 +169,14 @@ AlertMissingFonts(nsString& aMissingFont
+@@ -171,14 +171,14 @@ AlertMissingFonts(nsString& aMissingFont
    sb->FormatStringFromName(NS_LITERAL_STRING("mathfont_missing_dialog_message").get(),
                             strings, 1, getter_Copies(message));
  
 -  nsCOMPtr<nsIWindowWatcher> wwatch(do_GetService(NS_WINDOWWATCHER_CONTRACTID));
 +  nsIWindowWatcher* wwatch(do_GetService(NS_WINDOWWATCHER_CONTRACTID));
    if (!wwatch)
      return;
  
@@ -2237,189 +2237,167 @@ diff --git a/layout/mathml/base/src/nsMa
 +  nsIDOMWindow* parent = nsnull;
 +  wwatch->GetActiveWindow(&parent);
    nsresult rv;
 -  nsCOMPtr<nsINonBlockingAlertService> prompter =
 +  nsINonBlockingAlertService* prompter =
      do_GetService("@mozilla.org/embedcomp/nbalert-service;1", &rv);
  
    if (prompter && parent) {
-@@ -599,7 +599,7 @@ nsGlyphTableList::Finalize()
+@@ -601,7 +601,7 @@ nsGlyphTableList::Finalize()
  {
    // Remove our observer from the observer service
    nsresult rv = NS_OK;
 -  nsCOMPtr<nsIObserverService> obs = 
 +  nsIObserverService* obs = 
             do_GetService("@mozilla.org/observer-service;1", &rv);
    if (NS_SUCCEEDED(rv)) {
      rv = obs->RemoveObserver(this, NS_XPCOM_SHUTDOWN_OBSERVER_ID);
-@@ -662,10 +662,10 @@ GetPrefValue(nsIPrefBranch* aPrefBranch,
+@@ -664,10 +664,10 @@ GetPrefValue(nsIPrefBranch* aPrefBranch,
  {
    aPrefValue.Truncate();
    if (aPrefBranch) {
 -    nsCOMPtr<nsISupportsString> prefString;
 +    nsISupportsString* prefString = nsnull;
      aPrefBranch->GetComplexValue(aPrefKey,
                                   NS_GET_IID(nsISupportsString),
 -                                 getter_AddRefs(prefString));
 +                                 (void**)&prefString);
      if (prefString) {
        prefString->GetData(aPrefValue);
      }
-@@ -794,7 +794,7 @@ InitGlobals(nsPresContext* aPresContext)
+@@ -796,7 +796,7 @@ InitGlobals(nsPresContext* aPresContext)
    nsCAutoString key;
    nsAutoString value;
    nsIPersistentProperties* mathfontProp = nsnull;
 -  nsCOMPtr<nsIPrefBranch> prefBranch(do_GetService(NS_PREFSERVICE_CONTRACTID));
 +  nsIPrefBranch* prefBranch(do_GetService(NS_PREFSERVICE_CONTRACTID));
  
    // Add the math fonts in the gGlyphTableList in order of preference ...
    // Note: we only load font-names at this stage. The actual glyph tables will
-@@ -2298,8 +2298,8 @@ nsMathMLChar::PaintVertically(nsPresCont
-   else if (bmdata[3].ascent + bmdata[3].descent > 0) {
-     // glue is present
-     nscoord overlap;
--    nsCOMPtr<nsIFontMetrics> fm;
--    aRenderingContext.GetFontMetrics(*getter_AddRefs(fm));
-+    nsIFontMetrics* fm = nsnull;
-+    aRenderingContext.GetFontMetrics(*&fm);
-     nsMathMLFrame::GetRuleThickness(fm, overlap);
-     overlap = 2 * PR_MAX(overlap, onePixel);
-     // Ensure the stride for the glue is not reduced to less than onePixel
-@@ -2501,8 +2501,8 @@ nsMathMLChar::PaintHorizontally(nsPresCo
-   else if (bmdata[3].rightBearing - bmdata[3].leftBearing > 0) {
-     // glue is present
-     nscoord overlap;
--    nsCOMPtr<nsIFontMetrics> fm;
--    aRenderingContext.GetFontMetrics(*getter_AddRefs(fm));
-+    nsIFontMetrics* fm = nsnull;
-+    aRenderingContext.GetFontMetrics(*&fm);
-     nsMathMLFrame::GetRuleThickness(fm, overlap);
-     overlap = 2 * PR_MAX(overlap, onePixel);
-     // Ensure the stride for the glue is not reduced to less than onePixel
 diff --git a/modules/plugin/base/src/ns4xPlugin.cpp b/modules/plugin/base/src/ns4xPlugin.cpp
 --- a/modules/plugin/base/src/ns4xPlugin.cpp
 +++ b/modules/plugin/base/src/ns4xPlugin.cpp
-@@ -592,7 +592,6 @@ ns4xPlugin::CreatePlugin(nsIServiceManag
+@@ -612,7 +612,6 @@ ns4xPlugin::CreatePlugin(nsIServiceManag
    if (*aResult == NULL)
      return NS_ERROR_OUT_OF_MEMORY;
  
 -  NS_ADDREF(*aResult);
  
    if (!aFileName) //do not call NP_Initialize in this case, bug 74938
      return NS_OK;
-@@ -624,7 +623,6 @@ ns4xPlugin::CreatePlugin(nsIServiceManag
+@@ -644,7 +643,6 @@ ns4xPlugin::CreatePlugin(nsIServiceManag
    if (*aResult == NULL)
      return NS_ERROR_OUT_OF_MEMORY;
  
 -  NS_ADDREF(*aResult);
  
    // we must init here because the plugin may call NPN functions
    // when we call into the NP_Initialize entry point - NPN functions
-@@ -660,7 +658,6 @@ ns4xPlugin::CreatePlugin(nsIServiceManag
+@@ -680,7 +678,6 @@ ns4xPlugin::CreatePlugin(nsIServiceManag
    if (*aResult == NULL)
      return NS_ERROR_OUT_OF_MEMORY;
  
 -  NS_ADDREF(*aResult);
  
    // we must init here because the plugin may call NPN functions
    // when we call into the NP_Initialize entry point - NPN functions
-@@ -763,7 +760,6 @@ ns4xPlugin::CreatePlugin(nsIServiceManag
+@@ -783,7 +780,6 @@ ns4xPlugin::CreatePlugin(nsIServiceManag
    ::UseResFile(appRefNum);
    *aResult = plugin;
  
 -  NS_ADDREF(*aResult);
    if (NS_FAILED((*aResult)->Initialize())) {
      NS_RELEASE(*aResult);
      return NS_ERROR_FAILURE;
-@@ -792,7 +788,6 @@ ns4xPlugin::CreatePlugin(nsIServiceManag
+@@ -812,7 +808,6 @@ ns4xPlugin::CreatePlugin(nsIServiceManag
    if (*aResult == NULL)
      return NS_ERROR_OUT_OF_MEMORY;
  
 -  NS_ADDREF(*aResult);
  
    // we must init here because the plugin may call NPN functions
    // when we call into the NP_Initialize entry point - NPN functions
-@@ -831,7 +826,7 @@ ns4xPlugin::CreateInstance(nsISupports *
+@@ -851,7 +846,7 @@ ns4xPlugin::CreateInstance(nsISupports *
    *aResult = NULL;
  
    // XXX This is suspicuous!
 -  nsRefPtr<ns4xPluginInstance> inst =
 +  ns4xPluginInstance* inst =
      new ns4xPluginInstance(&fCallbacks, fLibrary);
  
    if (!inst)
-@@ -952,13 +947,13 @@ MakeNew4xStreamInternal(NPP npp, const c
+@@ -972,13 +967,13 @@ MakeNew4xStreamInternal(NPP npp, const c
    if (inst == NULL)
      return NPERR_INVALID_INSTANCE_ERROR;
  
 -  nsCOMPtr<nsIPluginManager> pm = do_GetService(kPluginManagerCID);
 +  nsIPluginManager* pm = do_GetService(kPluginManagerCID);
    NS_ASSERTION(pm, "failed to get plugin manager");
    if (!pm) return NPERR_GENERIC_ERROR;
  
 -  nsCOMPtr<nsIPluginStreamListener> listener;
 +  nsIPluginStreamListener* listener = nsnull;
    if (target == nsnull)
 -    ((ns4xPluginInstance*)inst)->NewNotifyStream(getter_AddRefs(listener),
 +    ((ns4xPluginInstance*)inst)->NewNotifyStream(&listener,
                                                   notifyData,
                                                   bDoNotify, relativeURL);
  
-@@ -1093,7 +1088,7 @@ _posturl(NPP npp, const char *relativeUR
+@@ -1113,7 +1108,7 @@ _posturl(NPP npp, const char *relativeUR
  // A little helper class used to wrap up plugin manager streams (that is,
  // streams from the plugin to the browser).
  
 -class ns4xStreamWrapper : nsISupports
 +class ns4xStreamWrapper : public XPCOMGCFinalizedObject, private nsISupports
  {
  public:
    NS_DECL_ISUPPORTS
-@@ -1118,7 +1113,6 @@ ns4xStreamWrapper::ns4xStreamWrapper(nsI
+@@ -1138,7 +1133,6 @@ ns4xStreamWrapper::ns4xStreamWrapper(nsI
    NS_ASSERTION(stream != NULL, "bad stream");
  
    fStream = stream;
 -  NS_ADDREF(fStream);
  
    memset(&fNPStream, 0, sizeof(fNPStream));
    fNPStream.ndata = (void*) this;
-@@ -1134,7 +1128,6 @@ ns4xStreamWrapper::GetStream(nsIOutputSt
+@@ -1154,7 +1148,6 @@ ns4xStreamWrapper::GetStream(nsIOutputSt
  ns4xStreamWrapper::GetStream(nsIOutputStream* &result)
  {
    result = fStream;
 -  NS_IF_ADDREF(fStream);
  }
  
  
-@@ -1254,7 +1247,6 @@ _destroystream(NPP npp, NPStream *pstrea
+@@ -1274,7 +1267,6 @@ _destroystream(NPP npp, NPStream *pstrea
        return NPERR_INVALID_PARAM;
  
      // This will release the wrapped nsIOutputStream.
 -    delete wrapper;
      pstream->ndata = nsnull;
    }
  
-@@ -1444,12 +1436,12 @@ GetDocumentFromNPP(NPP npp)
+@@ -1464,12 +1456,12 @@ GetDocumentFromNPP(NPP npp)
    nsCOMPtr<nsPIPluginInstancePeer> pp(do_QueryInterface(pip));
    NS_ENSURE_TRUE(pp, nsnull);
  
 -  nsCOMPtr<nsIPluginInstanceOwner> owner;
 -  pp->GetOwner(getter_AddRefs(owner));
 +  nsIPluginInstanceOwner* owner = nsnull;
 +  pp->GetOwner(&owner);
    NS_ENSURE_TRUE(owner, nsnull);
  
 -  nsCOMPtr<nsIDocument> doc;
 -  owner->GetDocument(getter_AddRefs(doc));
 +  nsIDocument* doc = nsnull;
 +  owner->GetDocument(&doc);
  
    return doc;
  }
-@@ -1506,19 +1498,19 @@ _getpluginelement(NPP npp)
+@@ -1526,19 +1518,19 @@ _getpluginelement(NPP npp)
    }
  
    // Pass ownership of elementp to element
 -  nsCOMPtr<nsIDOMElement> element;
 -  element.swap(elementp);
 +  nsIDOMElement* element = nsnull;
 +  swap(element, elementp);
  
@@ -2434,55 +2412,80 @@ diff --git a/modules/plugin/base/src/ns4
 +  nsIXPConnectJSObjectHolder* holder = nsnull;
    xpc->WrapNative(cx, ::JS_GetGlobalObject(cx), element,
                    NS_GET_IID(nsIDOMElement),
 -                  getter_AddRefs(holder));
 +                  &holder);
    NS_ENSURE_TRUE(holder, nsnull);
  
    JSObject* obj = nsnull;
-@@ -1818,7 +1810,7 @@ _evaluate(NPP npp, NPObject* npobj, NPSt
+@@ -1822,10 +1814,7 @@ _evaluate(NPP npp, NPObject* npobj, NPSt
+     return false;
+   }
+ 
+-  // Root obj and the rval (below).
+-  jsval vec[] = { OBJECT_TO_JSVAL(obj), JSVAL_NULL };
+-  JSAutoTempValueRooter tvr(cx, NS_ARRAY_LENGTH(vec), vec);
+-  jsval *rval = &vec[1];
++  jsval rval;
+ 
+   if (result) {
+     // Initialize the out param to void
+@@ -1841,7 +1830,7 @@ _evaluate(NPP npp, NPObject* npobj, NPSt
    NS_ConvertUTF8toUTF16 utf16script(script->utf8characters,
                                      script->utf8length);
  
 -  nsCOMPtr<nsIScriptContext> scx = GetScriptContextFromJSContext(cx);
 +  nsIScriptContext* scx = GetScriptContextFromJSContext(cx);
    NS_ENSURE_TRUE(scx, false);
  
    nsIPrincipal *principal = doc->NodePrincipal();
-@@ -2167,8 +2159,8 @@ _getvalue(NPP npp, NPNVariable variable,
+@@ -1880,10 +1869,10 @@ _evaluate(NPP npp, NPObject* npobj, NPSt
+                   npp, npobj, script->utf8characters));
+ 
+   nsresult rv = scx->EvaluateStringWithValue(utf16script, obj, principal,
+-                                             spec, 0, 0, rval, nsnull);
++                                             spec, 0, 0, &rval, nsnull);
+ 
+   return NS_SUCCEEDED(rv) &&
+-         (!result || JSValToNPVariant(npp, cx, *rval, result));
++         (!result || JSValToNPVariant(npp, cx, rval, result));
+ }
+ 
+ bool NP_CALLBACK
+@@ -2229,8 +2218,8 @@ _getvalue(NPP npp, NPNVariable variable,
  
      ns4xPluginInstance *inst = (ns4xPluginInstance *) npp->ndata;
  
 -    nsCOMPtr<nsIPluginInstancePeer> peer;
 -    if (NS_SUCCEEDED(inst->GetPeer(getter_AddRefs(peer))) &&
 +    nsIPluginInstancePeer* peer = nsnull;
 +    if (NS_SUCCEEDED(inst->GetPeer(&peer)) &&
          peer &&
          NS_SUCCEEDED(peer->GetValue(nsPluginInstancePeerVariable_NetscapeWindow,
                                      result))) {
-@@ -2180,7 +2172,7 @@ _getvalue(NPP npp, NPNVariable variable,
+@@ -2242,7 +2231,7 @@ _getvalue(NPP npp, NPNVariable variable,
  
    case NPNVjavascriptEnabledBool: {
      *(NPBool*)result = PR_FALSE;
 -    nsCOMPtr<nsIPrefBranch> prefs(do_GetService(NS_PREFSERVICE_CONTRACTID));
 +    nsIPrefBranch* prefs(do_GetService(NS_PREFSERVICE_CONTRACTID));
      if (prefs) {
        PRBool js = PR_FALSE;;
        res = prefs->GetBoolPref("javascript.enabled", &js);
-@@ -2196,7 +2188,7 @@ _getvalue(NPP npp, NPNVariable variable,
+@@ -2258,7 +2247,7 @@ _getvalue(NPP npp, NPNVariable variable,
  
    case NPNVisOfflineBool: {
      PRBool offline = PR_FALSE;
 -    nsCOMPtr<nsIIOService> ioservice =
 +    nsIIOService* ioservice =
        do_GetService(NS_IOSERVICE_CONTRACTID, &res);
      if (NS_SUCCEEDED(res))
        res = ioservice->GetOffline(&offline);
-@@ -2221,14 +2213,14 @@ _getvalue(NPP npp, NPNVariable variable,
+@@ -2283,14 +2272,14 @@ _getvalue(NPP npp, NPNVariable variable,
      ns4xPluginInstance *inst = (ns4xPluginInstance *) npp->ndata;
      NS_ENSURE_TRUE(inst, NPERR_GENERIC_ERROR);
  
 -    nsCOMPtr<nsIPluginInstancePeer> pip;
 -    inst->GetPeer(getter_AddRefs(pip));
 -    nsCOMPtr<nsIPluginTagInfo2> pti2 (do_QueryInterface(pip));
 +    nsIPluginInstancePeer* pip = nsnull;
 +    inst->GetPeer(&pip);
@@ -2493,35 +2496,35 @@ diff --git a/modules/plugin/base/src/ns4
 +      nsIDOMElement* e = nsnull;
 +      pti2->GetDOMElement(&e);
        if (e) {
 -        NS_ADDREF(*(nsIDOMElement**)result = e.get());
 +        *(nsIDOMElement**)result = e;
          return NPERR_NO_ERROR;
        }
      }
-@@ -2239,7 +2231,7 @@ _getvalue(NPP npp, NPNVariable variable,
+@@ -2301,7 +2290,7 @@ _getvalue(NPP npp, NPNVariable variable,
      ns4xPluginInstance *inst = (ns4xPluginInstance *)npp->ndata;
      NS_ENSURE_TRUE(inst, NPERR_GENERIC_ERROR);
  
 -    nsIDOMWindow *domWindow = inst->GetDOMWindow().get();
 +    nsIDOMWindow *domWindow = inst->GetDOMWindow();
  
      if (domWindow) {
        // Pass over ownership of domWindow to the caller.
-@@ -2366,7 +2358,7 @@ _setvalue(NPP npp, NPPVariable variable,
+@@ -2428,7 +2417,7 @@ _setvalue(NPP npp, NPPVariable variable,
      case NPPVjavascriptPushCallerBool:
        {
          nsresult rv;
 -        nsCOMPtr<nsIJSContextStack> contextStack =
 +        nsIJSContextStack* contextStack =
            do_GetService("@mozilla.org/js/xpc/ContextStack;1", &rv);
          if (NS_SUCCEEDED(rv)) {
            NPBool bPushCaller = (result != nsnull);
-@@ -2374,9 +2366,9 @@ _setvalue(NPP npp, NPPVariable variable,
+@@ -2436,9 +2425,9 @@ _setvalue(NPP npp, NPPVariable variable,
            if (bPushCaller) {
              rv = NS_ERROR_FAILURE;
  
 -            nsCOMPtr<nsIPluginInstancePeer> peer;
 -            if (NS_SUCCEEDED(inst->GetPeer(getter_AddRefs(peer))) && peer) {
 -              nsCOMPtr<nsIPluginInstancePeer2> peer2 =
 +            nsIPluginInstancePeer* peer = nsnull;
 +            if (NS_SUCCEEDED(inst->GetPeer(&peer)) && peer) {
--- a/gfx-refcounting
+++ b/gfx-refcounting
@@ -29,17 +29,17 @@ diff --git a/content/canvas/src/nsCanvas
  #include "gfxTextRunCache.h"
  
  #include "nsFrameManager.h"
 +
 +using namespace mozilla;
  
  #ifndef M_PI
  #define M_PI		3.14159265358979323846
-@@ -343,15 +345,15 @@ protected:
+@@ -344,15 +346,15 @@ protected:
      nsCOMPtr<nsICSSParser> mCSSParser;
  
      // yay cairo
 -    nsRefPtr<gfxContext> mThebesContext;
 -    nsRefPtr<gfxASurface> mThebesSurface;
 +    RefPtr<gfxContext> mThebesContext;
 +    RefPtr<gfxASurface> mThebesSurface;
  
@@ -48,17 +48,17 @@ diff --git a/content/canvas/src/nsCanvas
      cairo_surface_t *mSurface;
  
      nsString mTextStyle;
 -    nsRefPtr<gfxFontGroup> mFontGroup;
 +    RefPtr<gfxFontGroup> mFontGroup;
      gfxFontGroup *GetCurrentFontStyle();
   
      // style handling
-@@ -745,7 +747,7 @@ nsCanvasRenderingContext2D::Render(gfxCo
+@@ -746,7 +748,7 @@ nsCanvasRenderingContext2D::Render(gfxCo
      if (!mThebesSurface)
          return NS_ERROR_FAILURE;
  
 -    nsRefPtr<gfxPattern> pat = new gfxPattern(mThebesSurface);
 +    RefPtr<gfxPattern> pat = new gfxPattern(mThebesSurface);
  
      // XXX I don't want to use PixelSnapped here, but layout doesn't guarantee
      // pixel alignment for this stuff!
@@ -66,45 +66,66 @@ diff --git a/content/canvas/src/nsCanvas
  nsCanvasRenderingContext2D::MozTextAlongPath(const nsAString& textToDraw, PRBool stroke)
  {
      // Most of this code is copied from its svg equivalent
 -    nsRefPtr<gfxFlattenedPath> path(mThebesContext->GetFlattenedPath());
 +    RefPtr<gfxFlattenedPath> path(mThebesContext->GetFlattenedPath());
  
      const PRUnichar* textdata;
      textToDraw.GetData(&textdata);
-@@ -2202,9 +2204,9 @@ nsCanvasRenderingContext2D::CairoSurface
+@@ -2204,7 +2206,7 @@ nsCanvasRenderingContext2D::CairoSurface
              rv = canvas->GetSize(&w, &h);
              NS_ENSURE_SUCCESS(rv, rv);
  
--            nsRefPtr<gfxImageSurface> surf =
-+            RefPtr<gfxImageSurface> surf =
-                 new gfxImageSurface (gfxIntSize(w, h), gfxASurface::ImageFormatARGB32);
--            nsRefPtr<gfxContext> ctx = new gfxContext(surf);
-+            RefPtr<gfxContext> ctx = new gfxContext(surf);
-             ctx->SetOperator(gfxContext::OPERATOR_CLEAR);
-             ctx->Paint();
-             ctx->SetOperator(gfxContext::OPERATOR_OVER);
-@@ -2249,13 +2251,13 @@ nsCanvasRenderingContext2D::CairoSurface
+-            nsRefPtr<gfxASurface> sourceSurface;
++            RefPtr<gfxASurface> sourceSurface;
+ 
+             if (!forceCopy && canvas->CountContexts() == 1) {
+                 nsICanvasRenderingContextInternal *srcCanvas = canvas->GetContextAtIndex(0);
+@@ -2214,10 +2216,10 @@ nsCanvasRenderingContext2D::CairoSurface
+             }
+ 
+             if (sourceSurface == nsnull) {
+-                nsRefPtr<gfxASurface> surf =
++                RefPtr<gfxASurface> surf =
+                     gfxPlatform::GetPlatform()->CreateOffscreenSurface
+                     (gfxIntSize(w, h), gfxASurface::ImageFormatARGB32);
+-                nsRefPtr<gfxContext> ctx = new gfxContext(surf);
++                RefPtr<gfxContext> ctx = new gfxContext(surf);
+ 
+                 // we have to clear first, since some platform surfaces (X11, I'm
+                 // looking at you) don't follow the cleared-surface convention.
+@@ -2266,13 +2268,13 @@ nsCanvasRenderingContext2D::CairoSurface
      if (heightOut)
          *heightOut = imgHeight;
  
 -    nsRefPtr<gfxPattern> gfxpattern;
 +    RefPtr<gfxPattern> gfxpattern;
      img->GetPattern(getter_AddRefs(gfxpattern));
 -    nsRefPtr<gfxASurface> gfxsurf = gfxpattern->GetSurface();
 +    RefPtr<gfxASurface> gfxsurf = gfxpattern->GetSurface();
  
      if (!gfxsurf) {
          gfxsurf = new gfxImageSurface (gfxIntSize(imgWidth, imgHeight), gfxASurface::ImageFormatARGB32);
 -        nsRefPtr<gfxContext> ctx = new gfxContext(gfxsurf);
 +        RefPtr<gfxContext> ctx = new gfxContext(gfxsurf);
  
          ctx->SetOperator(gfxContext::OPERATOR_SOURCE);
          ctx->SetPattern(gfxpattern);
+@@ -2672,9 +2674,7 @@ nsCanvasRenderingContext2D::GetThebesSur
+         return NS_ERROR_NOT_AVAILABLE;
+     }
+ 
+-    *surface = mThebesSurface.get();
+-    NS_ADDREF(*surface);
+-
++    *surface = do_AddRef(mThebesSurface).get();
+     return NS_OK;
+ }
+ 
 diff --git a/content/events/src/nsEventListenerManager.h b/content/events/src/nsEventListenerManager.h
 --- a/content/events/src/nsEventListenerManager.h
 +++ b/content/events/src/nsEventListenerManager.h
 @@ -41,6 +41,7 @@
  #include "nsIEventListenerManager.h"
  #include "jsapi.h"
  #include "nsCOMPtr.h"
 +#include "nsAutoPtr.h"
@@ -327,26 +348,26 @@ diff --git a/editor/txtsvc/src/Makefile.
  		  lwbrk \
 +		  thebes \
  		  $(NULL)
  
  CPPSRCS		= \
 diff --git a/gfx/src/thebes/nsThebesDeviceContext.cpp b/gfx/src/thebes/nsThebesDeviceContext.cpp
 --- a/gfx/src/thebes/nsThebesDeviceContext.cpp
 +++ b/gfx/src/thebes/nsThebesDeviceContext.cpp
-@@ -89,6 +89,8 @@ static nsSystemFontsMac *gSystemFonts = 
+@@ -91,6 +91,8 @@ static nsSystemFontsMac *gSystemFonts = 
  #else
  #error Need to declare gSystemFonts!
  #endif
 +
 +using namespace mozilla;
  
  #ifdef MOZ_ENABLE_GTK2
  extern "C" {
-@@ -300,7 +302,7 @@ nsThebesDeviceContext::CreateRenderingCo
+@@ -303,7 +305,7 @@ nsThebesDeviceContext::CreateRenderingCo
      nsCOMPtr<nsIRenderingContext> pContext;
      rv = CreateRenderingContextInstance(*getter_AddRefs(pContext));
      if (NS_SUCCEEDED(rv)) {
 -        nsRefPtr<gfxASurface> surface(aWidget->GetThebesSurface());
 +        RefPtr<gfxASurface> surface(aWidget->GetThebesSurface());
          if (surface)
              rv = pContext->Init(this, surface);
          else
@@ -441,17 +462,17 @@ diff --git a/gfx/src/thebes/nsThebesImag
  
 -    nsRefPtr<gfxASurface> target = ctx->CurrentSurface();
 +    RefPtr<gfxASurface> target = ctx->CurrentSurface();
      switch (target->GetType()) {
      case gfxASurface::SurfaceTypeXlib:
      case gfxASurface::SurfaceTypeXcb:
 @@ -642,7 +644,7 @@ nsThebesImage::ThebesDrawTile(gfxContext
      if (mSinglePixel && !hasPadding) {
-         thebesContext->SetColor(mSinglePixelColor);
+         thebesContext->SetDeviceColor(mSinglePixelColor);
      } else {
 -        nsRefPtr<gfxASurface> surface;
 +        RefPtr<gfxASurface> surface;
          PRInt32 width, height;
  
          if (hasPadding) {
 @@ -701,7 +703,7 @@ nsThebesImage::ThebesDrawTile(gfxContext
              // tileWidth, tileHeight), with padX padding added to the left
@@ -506,17 +527,17 @@ diff --git a/gfx/src/thebes/nsThebesRend
 @@ -42,6 +42,7 @@
  
  #include "nsRect.h"
  #include "nsString.h"
 +#include "nsAutoPtr.h"
  #include "nsTransform2D.h"
  #include "nsIRegion.h"
  #include "nsIServiceManager.h"
-@@ -714,7 +715,7 @@ nsThebesRenderingContext::GetNativeGraph
+@@ -717,7 +718,7 @@ nsThebesRenderingContext::GetNativeGraph
          return mThebes->GetCairo();
  #ifdef XP_WIN
      if (aType == NATIVE_WINDOWS_DC) {
 -        nsRefPtr<gfxASurface> surf(mThebes->CurrentSurface());
 +        RefPtr<gfxASurface> surf(mThebes->CurrentSurface());
          if (!surf || surf->CairoStatus())
              return nsnull;
          return static_cast<gfxWindowsSurface*>(static_cast<gfxASurface*>(surf.get()))->GetDC();
@@ -646,44 +667,44 @@ diff --git a/gfx/thebes/public/gfxContex
       */
 -    already_AddRefed<gfxASurface> CurrentSurface(gfxFloat *dx, gfxFloat *dy);
 -    already_AddRefed<gfxASurface> CurrentSurface() {
 +    mozilla::AddRefed<gfxASurface> CurrentSurface(gfxFloat *dx, gfxFloat *dy);
 +    mozilla::AddRefed<gfxASurface> CurrentSurface() {
          return CurrentSurface(NULL, NULL);
      }
  
-@@ -341,7 +341,7 @@ public:
+@@ -349,7 +349,7 @@ public:
      /**
       * Get the source pattern (solid color, normal pattern, surface, etc)
       */
 -    already_AddRefed<gfxPattern> GetPattern();
 +    mozilla::AddRefed<gfxPattern> GetPattern();
  
      /**
       ** Painting
-@@ -526,7 +526,7 @@ public:
+@@ -534,7 +534,7 @@ public:
       * Groups
       */
      void PushGroup(gfxASurface::gfxContentType content = gfxASurface::CONTENT_COLOR);
 -    already_AddRefed<gfxPattern> PopGroup();
 +    mozilla::AddRefed<gfxPattern> PopGroup();
      void PopGroupToSource();
  
      /**
-@@ -545,7 +545,7 @@ public:
+@@ -553,7 +553,7 @@ public:
      /**
       ** Obtaining a "flattened" path - path converted to all line segments
       **/
 -    already_AddRefed<gfxFlattenedPath> GetFlattenedPath();
 +    mozilla::AddRefed<gfxFlattenedPath> GetFlattenedPath();
  
      /**
       ** Flags
-@@ -577,7 +577,7 @@ public:
+@@ -585,7 +585,7 @@ public:
  
  private:
      cairo_t *mCairo;
 -    nsRefPtr<gfxASurface> mSurface;
 +    mozilla::RefPtr<gfxASurface> mSurface;
      PRInt32 mFlags;
  };
  
@@ -862,17 +883,17 @@ diff --git a/gfx/thebes/public/gfxPlatfo
 +    mozilla::AddRefed<gfxASurface> CreateOffscreenSurface(const gfxIntSize& size,
 +                                                          gfxASurface::gfxImageFormat imageFormat);
  
      nsresult GetFontList(const nsACString& aLangGroup,
                           const nsACString& aGenericFamily,
 diff --git a/gfx/thebes/public/gfxPlatformMac.h b/gfx/thebes/public/gfxPlatformMac.h
 --- a/gfx/thebes/public/gfxPlatformMac.h
 +++ b/gfx/thebes/public/gfxPlatformMac.h
-@@ -50,11 +50,11 @@ public:
+@@ -53,11 +53,11 @@ public:
          return (gfxPlatformMac*) gfxPlatform::GetPlatform();
      }
  
 -    already_AddRefed<gfxASurface> CreateOffscreenSurface(const gfxIntSize& size,
 -                                                         gfxASurface::gfxImageFormat imageFormat);
 +    AddRefed<gfxASurface> CreateOffscreenSurface(const gfxIntSize& size,
 +                                                           gfxASurface::gfxImageFormat imageFormat);
  
@@ -959,35 +980,36 @@ diff --git a/gfx/thebes/public/gfxTypes.
 -protected:                                                                    \
 -    nsAutoRefCnt mRefCnt;                                                     \
 -public:
 -
  #endif /* GFX_TYPES_H */
 diff --git a/gfx/thebes/public/gfxWindowsFonts.h b/gfx/thebes/public/gfxWindowsFonts.h
 --- a/gfx/thebes/public/gfxWindowsFonts.h
 +++ b/gfx/thebes/public/gfxWindowsFonts.h
-@@ -287,7 +287,7 @@ private:
+@@ -319,8 +319,7 @@ private:
  
      LOGFONTW mLogFont;
  
 -    nsRefPtr<FontEntry> mFontEntry;
+-    PRPackedBool mIsValid;
 +    RefPtr<FontEntry> mFontEntry;
      
      virtual PRBool SetupCairoFont(gfxContext *aContext);
  };
-@@ -315,7 +315,7 @@ public:
+@@ -348,7 +347,7 @@ public:
          return mGenericFamily;
      }
  
 -    const nsTArray<nsRefPtr<FontEntry> >& GetFontList() const {
 +    const nsTArray<RefPtr<FontEntry> >& GetFontList() const {
          return mFontEntries;
      }
      PRUint32 FontListLength() const {
-@@ -342,7 +342,7 @@ private:
+@@ -375,7 +374,7 @@ private:
  private:
  
      nsCString mGenericFamily;
 -    nsTArray<nsRefPtr<FontEntry> > mFontEntries;
 +    nsTArray<RefPtr<FontEntry> > mFontEntries;
  };
  
  #endif /* GFX_WINDOWSFONTS_H */
@@ -1236,17 +1258,17 @@ diff --git a/gfx/thebes/src/gfxAlphaReco
 -    return resultSurf.get();
 +    return resultSurf.forget();
  }
  
  /** from cairo-xlib-utils.c, modified */
 diff --git a/gfx/thebes/src/gfxAtsuiFonts.cpp b/gfx/thebes/src/gfxAtsuiFonts.cpp
 --- a/gfx/thebes/src/gfxAtsuiFonts.cpp
 +++ b/gfx/thebes/src/gfxAtsuiFonts.cpp
-@@ -423,20 +423,19 @@ gfxAtsuiFont::GetFontEntry()
+@@ -430,20 +430,19 @@ gfxAtsuiFont::GetFontEntry()
   * except for OOM in which case we do nothing and return null.
   */
   
 -static already_AddRefed<gfxAtsuiFont>
 +static AddRefed<gfxAtsuiFont>
  GetOrMakeFont(MacOSFontEntry *aFontEntry, const gfxFontStyle *aStyle, PRBool aNeedsBold)
  {
      // the font entry name is the psname, not the family name
@@ -1262,135 +1284,135 @@ diff --git a/gfx/thebes/src/gfxAtsuiFont
 -    gfxFont *f = nsnull;
 -    font.swap(f);
 -    return static_cast<gfxAtsuiFont *>(f);
 +
 +    return AddRefed<gfxAtsuiFont>(static_cast<gfxAtsuiFont*>(font.forget().get()));
  }
  
  gfxAtsuiFontGroup::gfxAtsuiFontGroup(const nsAString& families,
-@@ -462,7 +461,7 @@ gfxAtsuiFontGroup::gfxAtsuiFontGroup(con
+@@ -469,7 +468,7 @@ gfxAtsuiFontGroup::gfxAtsuiFontGroup(con
          MacOSFontEntry *defaultFont = gfxQuartzFontCache::SharedFontCache()->GetDefaultFont(aStyle, needsBold);
          NS_ASSERTION(defaultFont, "invalid default font returned by GetDefaultFont");
  
 -        nsRefPtr<gfxAtsuiFont> font = GetOrMakeFont(defaultFont, aStyle, needsBold);
 +        RefPtr<gfxAtsuiFont> font = GetOrMakeFont(defaultFont, aStyle, needsBold);
  
          if (font) {
              mFonts.AppendElement(font);
-@@ -498,7 +497,7 @@ gfxAtsuiFontGroup::FindATSUFont(const ns
+@@ -505,7 +504,7 @@ gfxAtsuiFontGroup::FindATSUFont(const ns
      MacOSFontEntry *fe = fc->FindFontForFamily(aName, fontStyle, needsBold);
  
      if (fe && !fontGroup->HasFont(fe->GetFontID())) {
 -        nsRefPtr<gfxAtsuiFont> font = GetOrMakeFont(fe, fontStyle, needsBold);
 +        RefPtr<gfxAtsuiFont> font = GetOrMakeFont(fe, fontStyle, needsBold);
          if (font) {
              fontGroup->mFonts.AppendElement(font);
          }
-@@ -748,11 +747,11 @@ gfxAtsuiFontGroup::HasFont(ATSUFontID fi
+@@ -755,11 +754,11 @@ gfxAtsuiFontGroup::HasFont(ATSUFontID fi
  }
  
  struct PrefFontCallbackData {
 -    PrefFontCallbackData(nsTArray<nsRefPtr<MacOSFamilyEntry> >& aFamiliesArray) 
 +    PrefFontCallbackData(nsTArray<RefPtr<MacOSFamilyEntry> >& aFamiliesArray) 
          : mPrefFamilies(aFamiliesArray)
      {}
  
 -    nsTArray<nsRefPtr<MacOSFamilyEntry> >& mPrefFamilies;
 +    nsTArray<RefPtr<MacOSFamilyEntry> >& mPrefFamilies;
  
      static PRBool AddFontFamilyEntry(eFontPrefLang aLang, const nsAString& aName, void *aClosure)
      {
-@@ -767,12 +766,12 @@ struct PrefFontCallbackData {
+@@ -774,12 +773,12 @@ struct PrefFontCallbackData {
  };
  
  
 -already_AddRefed<gfxAtsuiFont>
 +AddRefed<gfxAtsuiFont>
  gfxAtsuiFontGroup::WhichPrefFontSupportsChar(PRUint32 aCh)
  {
      // FindCharUnicodeRange only supports BMP character points and there are no non-BMP fonts in prefs
      if (aCh > 0xFFFF)
 -        return nsnull;
 +        return AddRefed<gfxAtsuiFont>(nsnull);
  
      // get the pref font list if it hasn't been set up already
      PRUint32 unicodeRange = FindCharUnicodeRange(aCh);
-@@ -780,7 +779,7 @@ gfxAtsuiFontGroup::WhichPrefFontSupports
+@@ -787,7 +786,7 @@ gfxAtsuiFontGroup::WhichPrefFontSupports
  
      // if the last pref font was the first family in the pref list, no need to recheck through a list of families
      if (mLastPrefFont && charLang == mLastPrefLang && mLastPrefFirstFont && mLastPrefFont->TestCharacterMap(aCh)) {
 -        nsRefPtr<gfxAtsuiFont> prefFont = mLastPrefFont;
 +        RefPtr<gfxAtsuiFont> prefFont = mLastPrefFont;
          return prefFont.forget();
      }
      
-@@ -792,7 +791,7 @@ gfxAtsuiFontGroup::WhichPrefFontSupports
+@@ -799,7 +798,7 @@ gfxAtsuiFontGroup::WhichPrefFontSupports
      macPlatform->GetLangPrefs(prefLangs, numLangs, charLang, mPageLang);
      
      for (i = 0; i < numLangs; i++) {
 -        nsAutoTArray<nsRefPtr<MacOSFamilyEntry>, 5> families;
 +        nsAutoTArray<RefPtr<MacOSFamilyEntry>, 5> families;
          eFontPrefLang currentLang = prefLangs[i];
          
          gfxQuartzFontCache *fc = gfxQuartzFontCache::SharedFontCache();
-@@ -819,7 +818,7 @@ gfxAtsuiFontGroup::WhichPrefFontSupports
+@@ -826,7 +825,7 @@ gfxAtsuiFontGroup::WhichPrefFontSupports
              // GetOrMakeFont repeatedly.  speeds up FindFontForChar lookup times for subsequent
              // pref font lookups
              if (family == mLastPrefFamily && mLastPrefFont->TestCharacterMap(aCh)) {
 -                nsRefPtr<gfxAtsuiFont> prefFont = mLastPrefFont;
 +                RefPtr<gfxAtsuiFont> prefFont = mLastPrefFont;
                  return prefFont.forget();
              }
              
-@@ -827,7 +826,7 @@ gfxAtsuiFontGroup::WhichPrefFontSupports
+@@ -834,7 +833,7 @@ gfxAtsuiFontGroup::WhichPrefFontSupports
              MacOSFontEntry *fe = family->FindFont(&mStyle, needsBold);
              // if ch in cmap, create and return a gfxFont
              if (fe && fe->TestCharacterMap(aCh)) {
 -                nsRefPtr<gfxAtsuiFont> prefFont = GetOrMakeFont(fe, &mStyle, needsBold);
 +                RefPtr<gfxAtsuiFont> prefFont = GetOrMakeFont(fe, &mStyle, needsBold);
                  mLastPrefFamily = family;
                  mLastPrefFont = prefFont;
                  mLastPrefLang = charLang;
-@@ -838,13 +837,13 @@ gfxAtsuiFontGroup::WhichPrefFontSupports
+@@ -845,13 +844,13 @@ gfxAtsuiFontGroup::WhichPrefFontSupports
          }
      }
      
 -    return nsnull;
 +    return AddRefed<gfxAtsuiFont>(nsnull);
  }
  
 -already_AddRefed<gfxAtsuiFont>
 +AddRefed<gfxAtsuiFont>
  gfxAtsuiFontGroup::FindFontForChar(PRUint32 aCh, PRUint32 aPrevCh, PRUint32 aNextCh, gfxAtsuiFont* aPrevMatchedFont)
  {
 -    nsRefPtr<gfxAtsuiFont>    selectedFont;
 +    RefPtr<gfxAtsuiFont>    selectedFont;
      
      // if this character or the next one is a joiner use the
      // same font as the previous range if we can
-@@ -889,7 +888,7 @@ gfxAtsuiFontGroup::FindFontForChar(PRUin
+@@ -896,7 +895,7 @@ gfxAtsuiFontGroup::FindFontForChar(PRUin
          }
      }
  
 -    return nsnull;
 +    return AddRefed<gfxAtsuiFont>(nsnull);
  }
  
  /**
-@@ -1347,7 +1346,7 @@ public:
+@@ -1354,7 +1353,7 @@ public:
      PRUint32 MatchNextRange() 
      { 
          PRUint32                matchStartOffset, chStartOffset, ch, nextCh;
 -        nsRefPtr<gfxAtsuiFont>  font;
 +        RefPtr<gfxAtsuiFont>  font;
          
          matchStartOffset = mPrevOffset;
  
-@@ -1406,8 +1405,8 @@ private:
+@@ -1413,8 +1412,8 @@ private:
      PRUint32                mPrevCh;
      PRBool                  mFirstRange;
      gfxAtsuiFontGroup       *mFontGroup;
 -    nsRefPtr<gfxAtsuiFont>  mMatchedFont;
 -    nsRefPtr<gfxAtsuiFont>  mNextMatchedFont;
 +    RefPtr<gfxAtsuiFont> mMatchedFont;
 +    RefPtr<gfxAtsuiFont> mNextMatchedFont;
  };
@@ -1433,53 +1455,53 @@ diff --git a/gfx/thebes/src/gfxContext.c
              cairo_surface_get_device_offset(s, dx, dy);
 -        gfxASurface *ret = mSurface;
 -        NS_ADDREF(ret);
 -        return ret;
 +        return do_AddRef(mSurface);
      }
  
      if (dx && dy)
-@@ -667,7 +666,7 @@ gfxContext::SetPattern(gfxPattern *patte
+@@ -673,7 +672,7 @@ gfxContext::SetPattern(gfxPattern *patte
      cairo_set_source(mCairo, pattern->CairoPattern());
  }
  
 -already_AddRefed<gfxPattern>
 +AddRefed<gfxPattern>
  gfxContext::GetPattern()
  {
      cairo_pattern_t *pat = cairo_get_source(mCairo);
-@@ -679,8 +678,7 @@ gfxContext::GetPattern()
+@@ -685,8 +684,7 @@ gfxContext::GetPattern()
      else
          wrapper = new gfxPattern(gfxRGBA(0,0,0,0));
  
 -    NS_IF_ADDREF(wrapper);
 -    return wrapper;
 +    return do_AddRef(wrapper);
  }
  
  
-@@ -712,14 +710,13 @@ gfxContext::PushGroup(gfxASurface::gfxCo
+@@ -718,14 +716,13 @@ gfxContext::PushGroup(gfxASurface::gfxCo
      cairo_push_group_with_content(mCairo, (cairo_content_t) content);
  }
  
 -already_AddRefed<gfxPattern>
 +AddRefed<gfxPattern>
  gfxContext::PopGroup()
  {
      cairo_pattern_t *pat = cairo_pop_group(mCairo);
      gfxPattern *wrapper = new gfxPattern(pat);
      cairo_pattern_destroy(pat);
 -    NS_IF_ADDREF(wrapper);
 -    return wrapper;
 +    return do_AddRef(wrapper);
  }
  
  void
-@@ -764,13 +761,12 @@ gfxContext::GetUserStrokeExtent()
+@@ -770,13 +767,12 @@ gfxContext::GetUserStrokeExtent()
      return gfxRect(xmin, ymin, xmax - xmin, ymax - ymin);
  }
  
 -already_AddRefed<gfxFlattenedPath>
 +AddRefed<gfxFlattenedPath>
  gfxContext::GetFlattenedPath()
  {
      gfxFlattenedPath *path =
@@ -1839,26 +1861,26 @@ diff --git a/gfx/thebes/src/gfxPlatformG
 -        return nsnull;
 +        return AddRefed<gfxASurface>(nsnull);
  
      if (!UseGlitz()) {
          GdkPixmap* pixmap = nsnull;
 diff --git a/gfx/thebes/src/gfxPlatformMac.cpp b/gfx/thebes/src/gfxPlatformMac.cpp
 --- a/gfx/thebes/src/gfxPlatformMac.cpp
 +++ b/gfx/thebes/src/gfxPlatformMac.cpp
-@@ -66,7 +66,7 @@ gfxPlatformMac::gfxPlatformMac()
- #endif
+@@ -68,7 +68,7 @@ gfxPlatformMac::gfxPlatformMac()
+     mFontAntiAliasingThreshold = ReadAntiAliasingThreshold();
  }
  
 -already_AddRefed<gfxASurface>
 +AddRefed<gfxASurface>
  gfxPlatformMac::CreateOffscreenSurface(const gfxIntSize& size,
                                         gfxASurface::gfxImageFormat imageFormat)
  {
-@@ -141,28 +141,25 @@ gfxPlatformMac::CreateOffscreenSurface(c
+@@ -143,28 +143,25 @@ gfxPlatformMac::CreateOffscreenSurface(c
  #endif
      }
  
 -    NS_IF_ADDREF(newSurface);
 -    return newSurface;
 +    return do_AddRef(newSurface);
  }
  
@@ -1943,18 +1965,18 @@ diff --git a/gfx/thebes/src/gfxQuartzFon
      static PLDHashOperator PR_CALLBACK FindFontForCharProc(nsStringHashKey::KeyType aKey,
 -                                                             nsRefPtr<MacOSFamilyEntry>& aFamilyEntry,
 -                                                             void* userArg);
 +                                                           RefPtr<MacOSFamilyEntry>& aFamilyEntry,
 +                                                           void* userArg);
  
      static gfxQuartzFontCache *sSharedFontCache;
  
-@@ -270,16 +269,16 @@ private:
-     void EliminateDuplicateFaces(const nsAString& aFamilyName);
+@@ -273,16 +272,16 @@ private:
+     void SetFixedPitch(const nsAString& aFamilyName);
                                                               
      static PLDHashOperator PR_CALLBACK InitOtherFamilyNamesProc(nsStringHashKey::KeyType aKey,
 -                                                             nsRefPtr<MacOSFamilyEntry>& aFamilyEntry,
 -                                                             void* userArg);
 -
 +                                                                RefPtr<MacOSFamilyEntry>& aFamilyEntry,
 +                                                                void* userArg);
 +    
@@ -1964,17 +1986,17 @@ diff --git a/gfx/thebes/src/gfxQuartzFon
  
      static PLDHashOperator PR_CALLBACK
          HashEnumFuncForFamilies(nsStringHashKey::KeyType aKey,
 -                                nsRefPtr<MacOSFamilyEntry>& aFamilyEntry,
 +                                RefPtr<MacOSFamilyEntry>& aFamilyEntry,
                                  void* aUserArg);
  
      // gfxFontInfoLoader overrides, used to load in font cmaps
-@@ -288,15 +287,18 @@ private:
+@@ -291,15 +290,18 @@ private:
      virtual void FinishLoader();
  
      // canonical family name ==> family entry (unique, one name per family entry)
 -    nsRefPtrHashtable<nsStringHashKey, MacOSFamilyEntry> mFontFamilies;    
 +    nsDataHashtable< nsStringHashKey,
 +                     RefPtr<MacOSFamilyEntry> > mFontFamilies;
  
      // other family name ==> family entry (not unique, can have multiple names per 
@@ -1989,92 +2011,92 @@ diff --git a/gfx/thebes/src/gfxQuartzFon
 +    nsDataHashtable<nsUint32HashKey,
 +                    nsTArray<RefPtr<MacOSFamilyEntry> > > mPrefFonts;
  
      // when system-wide font lookup fails for a character, cache it to skip future searches
      gfxSparseBitSet mCodepointsWithNoFonts;
 diff --git a/gfx/thebes/src/gfxQuartzFontCache.mm b/gfx/thebes/src/gfxQuartzFontCache.mm
 --- a/gfx/thebes/src/gfxQuartzFontCache.mm
 +++ b/gfx/thebes/src/gfxQuartzFontCache.mm
-@@ -838,7 +838,7 @@ gfxQuartzFontCache::InitOtherFamilyNames
+@@ -846,7 +846,7 @@ gfxQuartzFontCache::InitOtherFamilyNames
  }
                                                           
  PLDHashOperator PR_CALLBACK gfxQuartzFontCache::InitOtherFamilyNamesProc(nsStringHashKey::KeyType aKey,
 -                                                         nsRefPtr<MacOSFamilyEntry>& aFamilyEntry,
 +                                                         RefPtr<MacOSFamilyEntry>& aFamilyEntry,
                                                           void* userArg)
  {
      gfxQuartzFontCache *fc = (gfxQuartzFontCache*) userArg;
-@@ -879,7 +879,6 @@ gfxQuartzFontCache::InitSingleFaceList()
+@@ -887,7 +887,6 @@ gfxQuartzFontCache::InitSingleFaceList()
              if (familyEntry) {
                  MacOSFontEntry *fontEntry = familyEntry->FindFont(singleFaceFonts[i]);
                  if (fontEntry) {
 -                    PRBool found;
                      nsAutoString displayName, key;
                      
                      // use the display name the canonical name
-@@ -888,7 +887,7 @@ gfxQuartzFontCache::InitSingleFaceList()
+@@ -896,7 +895,7 @@ gfxQuartzFontCache::InitSingleFaceList()
                      GenerateFontListKey(displayName, key);
  
                      // add only if doesn't exist already
 -                    if (!(familyEntry = mFontFamilies.GetWeak(key, &found))) {
 +                    if (!(familyEntry = mFontFamilies.Get(key, nsnull))) {
                          familyEntry = new SingleFaceFamily(displayName);
                          familyEntry->AddFontEntry(fontEntry);
                          mFontFamilies.Put(key, familyEntry);
-@@ -911,13 +910,12 @@ gfxQuartzFontCache::PreloadNamesList()
+@@ -919,13 +918,12 @@ gfxQuartzFontCache::PreloadNamesList()
      
      PRUint32 numFonts = preloadFonts.Length();
      for (PRUint32 i = 0; i < numFonts; i++) {
 -        PRBool found;
          nsAutoString key;
          GenerateFontListKey(preloadFonts[i], key);
          
          // only search canonical names!
 -        MacOSFamilyEntry *familyEntry = mFontFamilies.GetWeak(key, &found);
 -        if (familyEntry) {
 +        RefPtr<MacOSFamilyEntry> familyEntry;
 +        if (mFontFamilies.Get(key, &familyEntry)) {
              AddOtherFamilyNameFunctor addOtherNames(this);
              familyEntry->ReadOtherFamilyNames(addOtherNames);
          }
-@@ -931,8 +929,8 @@ gfxQuartzFontCache::EliminateDuplicateFa
+@@ -939,8 +937,8 @@ gfxQuartzFontCache::EliminateDuplicateFa
      MacOSFamilyEntry *family = FindFamily(aFamilyName);
      if (!family) return;
  
 -    nsTArray<nsRefPtr<MacOSFontEntry> >& fontlist = family->GetFontList();
 -
 +    nsTArray<RefPtr<MacOSFontEntry> >& fontlist = family->GetFontList();
 +    
      PRUint32 i, bold, numFonts, italicIndex;
      MacOSFontEntry *italic, *nonitalic;
      PRUint32 boldtraits[2] = { 0, NSBoldFontMask };
-@@ -1096,8 +1094,8 @@ struct FontListData {
+@@ -1119,8 +1117,8 @@ struct FontListData {
  
  PLDHashOperator PR_CALLBACK
  gfxQuartzFontCache::HashEnumFuncForFamilies(nsStringHashKey::KeyType aKey,
 -                                            nsRefPtr<MacOSFamilyEntry>& aFamilyEntry,
 -                                            void *aUserArg)
 +                                            RefPtr<MacOSFamilyEntry>& aFamilyEntry,
 +                                            void* aUserArg)
  {
      FontListData *data = (FontListData*)aUserArg;
  
-@@ -1184,8 +1182,8 @@ gfxQuartzFontCache::FindFontForChar(cons
+@@ -1207,8 +1205,8 @@ gfxQuartzFontCache::FindFontForChar(cons
  }
  
  PLDHashOperator PR_CALLBACK 
 -gfxQuartzFontCache::FindFontForCharProc(nsStringHashKey::KeyType aKey, nsRefPtr<MacOSFamilyEntry>& aFamilyEntry,
 -     void *userArg)
 +gfxQuartzFontCache::FindFontForCharProc(nsStringHashKey::KeyType aKey, RefPtr<MacOSFamilyEntry>& aFamilyEntry,
 +     void* userArg)
  {
      FontSearch *data = (FontSearch*)userArg;
  
-@@ -1199,16 +1197,15 @@ gfxQuartzFontCache::FindFamily(const nsA
+@@ -1222,16 +1220,15 @@ gfxQuartzFontCache::FindFamily(const nsA
  {
      nsAutoString key;
      MacOSFamilyEntry *familyEntry;
 -    PRBool found;
      GenerateFontListKey(aFamily, key);
  
      // lookup in canonical (i.e. English) family name list
 -    if ((familyEntry = mFontFamilies.GetWeak(key, &found))) {
@@ -2083,42 +2105,42 @@ diff --git a/gfx/thebes/src/gfxQuartzFon
      }
  
      // lookup in other family names list (mostly localized names)
 -    if ((familyEntry = mOtherFamilyNames.GetWeak(key, &found))) {
 +    if (mOtherFamilyNames.Get(key, &familyEntry)) {
          return familyEntry;
      }
  
-@@ -1217,7 +1214,7 @@ gfxQuartzFontCache::FindFamily(const nsA
+@@ -1240,7 +1237,7 @@ gfxQuartzFontCache::FindFamily(const nsA
      // since reading name table entries is expensive
      if (!mOtherFamilyNamesInitialized) {
          InitOtherFamilyNames();
 -        if ((familyEntry = mOtherFamilyNames.GetWeak(key, &found))) {
 +        if (mOtherFamilyNames.Get(key, &familyEntry)) {
              return familyEntry;
          }
      }
-@@ -1249,13 +1246,13 @@ gfxQuartzFontCache::AppleWeightToCSSWeig
+@@ -1272,13 +1269,13 @@ gfxQuartzFontCache::AppleWeightToCSSWeig
  }
  
  PRBool
 -gfxQuartzFontCache::GetPrefFontFamilyEntries(eFontPrefLang aLangGroup, nsTArray<nsRefPtr<MacOSFamilyEntry> > *array)
 +gfxQuartzFontCache::GetPrefFontFamilyEntries(eFontPrefLang aLangGroup, nsTArray<RefPtr<MacOSFamilyEntry> > *array)
  {
      return mPrefFonts.Get(PRUint32(aLangGroup), array);
  }
  
  void
 -gfxQuartzFontCache::SetPrefFontFamilyEntries(eFontPrefLang aLangGroup, nsTArray<nsRefPtr<MacOSFamilyEntry> >& array)
 +gfxQuartzFontCache::SetPrefFontFamilyEntries(eFontPrefLang aLangGroup, nsTArray<RefPtr<MacOSFamilyEntry> >& array)
  {
      mPrefFonts.Put(PRUint32(aLangGroup), array);
  }
-@@ -1264,10 +1261,9 @@ gfxQuartzFontCache::AddOtherFamilyName(M
+@@ -1287,10 +1284,9 @@ gfxQuartzFontCache::AddOtherFamilyName(M
  gfxQuartzFontCache::AddOtherFamilyName(MacOSFamilyEntry *aFamilyEntry, nsAString& aOtherFamilyName)
  {
      nsAutoString key;
 -    PRBool found;
      GenerateFontListKey(aOtherFamilyName, key);
  
 -    if (!mOtherFamilyNames.GetWeak(key, &found)) {
 +    if (!mOtherFamilyNames.Get(key, nsnull)) {
@@ -2164,35 +2186,35 @@ diff --git a/gfx/thebes/src/gfxQuartzNat
 -    nsRefPtr<gfxASurface> surf = mContext->CurrentSurface(&deviceOffset.x, &deviceOffset.y);
 +    RefPtr<gfxASurface> surf = mContext->CurrentSurface(&deviceOffset.x, &deviceOffset.y);
      if (!surf || surf->CairoStatus())
          return nsnull;
  
 diff --git a/gfx/thebes/src/gfxWindowsFonts.cpp b/gfx/thebes/src/gfxWindowsFonts.cpp
 --- a/gfx/thebes/src/gfxWindowsFonts.cpp
 +++ b/gfx/thebes/src/gfxWindowsFonts.cpp
-@@ -81,7 +81,7 @@ struct DCFromContext {
+@@ -112,7 +112,7 @@ struct DCFromContext {
  struct DCFromContext {
      DCFromContext(gfxContext *aContext) {
          dc = NULL;
 -        nsRefPtr<gfxASurface> aSurface = aContext->CurrentSurface();
 +        RefPtr<gfxASurface> aSurface = aContext->CurrentSurface();
          NS_ASSERTION(aSurface, "DCFromContext: null surface");
          if (aSurface &&
              (aSurface->GetType() == gfxASurface::SurfaceTypeWin32 ||
-@@ -671,7 +671,7 @@ gfxWindowsFont::SetupCairoFont(gfxContex
+@@ -743,7 +743,7 @@ gfxWindowsFont::SetupCairoFont(gfxContex
   * In either case, add a ref, append it to the aFonts array, and return it ---
   * except for OOM in which case we do nothing and return null.
   */
--static already_AddRefed<gfxWindowsFont>
-+static AddRefed<gfxWindowsFont>
- GetOrMakeFont(FontEntry *aFontEntry, const gfxFontStyle *aStyle)
+-already_AddRefed<gfxWindowsFont>
++AddRefed<gfxWindowsFont>
+ gfxWindowsFont::GetOrMakeFont(FontEntry *aFontEntry, const gfxFontStyle *aStyle)
  {
      // because we know the FontEntry has the weight we really want, use it for matching
-@@ -682,16 +682,14 @@ GetOrMakeFont(FontEntry *aFontEntry, con
+@@ -754,16 +754,14 @@ gfxWindowsFont::GetOrMakeFont(FontEntry 
      if (style.sizeAdjust == 0.0)
          style.size = ROUND(style.size);
  
 -    nsRefPtr<gfxFont> font = gfxFontCache::GetCache()->Lookup(aFontEntry->GetName(), &style);
 +    RefPtr<gfxFont> font = gfxFontCache::GetCache()->Lookup(aFontEntry->GetName(), &style);
      if (!font) {
          font = new gfxWindowsFont(aFontEntry->GetName(), &style, aFontEntry);
          if (!font)
@@ -2202,225 +2224,224 @@ diff --git a/gfx/thebes/src/gfxWindowsFo
      }
 -    gfxFont *f = nsnull;
 -    font.swap(f);
 -    return static_cast<gfxWindowsFont *>(f);
 +    return do_AddRef(static_cast<gfxWindowsFont*>(font.get()));
  }
  
  static PRBool
-@@ -710,14 +708,14 @@ AddFontNameToArray(const nsAString& aNam
+@@ -782,14 +780,14 @@ AddFontNameToArray(const nsAString& aNam
  }
  
  void
 -gfxWindowsFontGroup::GroupFamilyListToArrayList(nsTArray<nsRefPtr<FontEntry> > *list)
 +gfxWindowsFontGroup::GroupFamilyListToArrayList(nsTArray<RefPtr<FontEntry> > *list)
  {
-     nsAutoTArray<nsAutoString, 15> fonts;
+     nsAutoTArray<nsString, 15> fonts;
      ForEachFont(AddFontNameToArray, &fonts);
  
      PRUint32 len = fonts.Length();
      for (PRUint32 i = 0; i < len; ++i) {
 -        nsRefPtr<FontEntry> fe = gfxWindowsPlatform::GetPlatform()->FindFontEntry(fonts[i], mStyle);
 +        RefPtr<FontEntry> fe = gfxWindowsPlatform::GetPlatform()->FindFontEntry(fonts[i], mStyle);
          list->AppendElement(fe);
      }
  }
-@@ -725,7 +723,7 @@ void
+@@ -797,7 +795,7 @@ void
  void
  gfxWindowsFontGroup::FamilyListToArrayList(const nsString& aFamilies,
                                             const nsCString& aLangGroup,
 -                                           nsTArray<nsRefPtr<FontEntry> > *list)
 +                                           nsTArray<RefPtr<FontEntry> > *list)
  {
-     nsAutoTArray<nsAutoString, 15> fonts;
+     nsAutoTArray<nsString, 15> fonts;
      ForEachFont(aFamilies, aLangGroup, AddFontNameToArray, &fonts);
-@@ -733,7 +731,7 @@ gfxWindowsFontGroup::FamilyListToArrayLi
+@@ -805,7 +803,7 @@ gfxWindowsFontGroup::FamilyListToArrayLi
      PRUint32 len = fonts.Length();
      for (PRUint32 i = 0; i < len; ++i) {
-         const nsAutoString& str = fonts[i];
+         const nsString& str = fonts[i];
 -        nsRefPtr<FontEntry> fe = gfxWindowsPlatform::GetPlatform()->FindFontEntry(str, mStyle);
 +        RefPtr<FontEntry> fe = gfxWindowsPlatform::GetPlatform()->FindFontEntry(str, mStyle);
          list->AppendElement(fe);
      }
  }
-@@ -752,7 +750,7 @@ gfxWindowsFontGroup::gfxWindowsFontGroup
+@@ -840,7 +838,7 @@ gfxWindowsFontGroup::gfxWindowsFontGroup
              NS_ERROR("Failed to create font group");
              return;
          }
 -        nsRefPtr<FontEntry> fe = gfxWindowsPlatform::GetPlatform()->FindFontEntry(nsDependentString(logFont.lfFaceName), *aStyle);
 +        RefPtr<FontEntry> fe = gfxWindowsPlatform::GetPlatform()->FindFontEntry(nsDependentString(logFont.lfFaceName), *aStyle);
          mFontEntries.AppendElement(fe);
-     }
- 
-@@ -778,7 +776,7 @@ gfxWindowsFontGroup::GetFontAt(PRInt32 i
+         // Keep length of mFonts in sync with length of mFontEntries.
+         // Maybe we should eagerly set up mFonts[0] like we do above,
+@@ -872,7 +870,7 @@ gfxWindowsFontGroup::GetFontAt(PRInt32 i
  gfxWindowsFontGroup::GetFontAt(PRInt32 i)
  {
      if (!mFonts[i]) {
--        nsRefPtr<gfxWindowsFont> font = GetOrMakeFont(mFontEntries[i], &mStyle);
-+        RefPtr<gfxWindowsFont> font = GetOrMakeFont(mFontEntries[i], &mStyle);
+-        nsRefPtr<gfxWindowsFont> font =
++        RefPtr<gfxWindowsFont> font =
+             gfxWindowsFont::GetOrMakeFont(mFontEntries[i], &mStyle);
          mFonts[i] = font;
      }
- 
-@@ -960,7 +958,7 @@ gfxWindowsFontGroup::InitTextRunGDI(gfxC
+@@ -1055,7 +1053,7 @@ gfxWindowsFontGroup::InitTextRunGDI(gfxC
  gfxWindowsFontGroup::InitTextRunGDI(gfxContext *aContext, gfxTextRun *aRun,
                                      const char *aString, PRUint32 aLength)
  {
 -    nsRefPtr<gfxWindowsFont> font = GetFontAt(0);
 +    RefPtr<gfxWindowsFont> font = GetFontAt(0);
      DCFromContext dc(aContext);
      if (SetupDCFont(dc, font)) {
          nsAutoTArray<WCHAR,500> glyphArray;
-@@ -984,7 +982,7 @@ gfxWindowsFontGroup::InitTextRunGDI(gfxC
+@@ -1079,7 +1077,7 @@ gfxWindowsFontGroup::InitTextRunGDI(gfxC
  gfxWindowsFontGroup::InitTextRunGDI(gfxContext *aContext, gfxTextRun *aRun,
                                      const PRUnichar *aString, PRUint32 aLength)
  {
 -    nsRefPtr<gfxWindowsFont> font = GetFontAt(0);
 +    RefPtr<gfxWindowsFont> font = GetFontAt(0);
      DCFromContext dc(aContext);
      if (SetupDCFont(dc, font)) {
          nsAutoTArray<WCHAR,500> glyphArray;
-@@ -1498,18 +1496,18 @@ public:
+@@ -1595,12 +1593,12 @@ public:
      struct TextRange {
          TextRange(PRUint32 aStart,  PRUint32 aEnd) : start(aStart), end(aEnd) { }
          PRUint32 Length() const { return end - start; }
--        nsRefPtr<FontEntry> font;
-+        RefPtr<FontEntry> font;
+-        nsRefPtr<gfxWindowsFont> font;
++        RefPtr<gfxWindowsFont> font;
          PRUint32 start, end;
      };
  
      void SetRange(PRUint32 i) {
--        nsRefPtr<FontEntry> fe;
-+        RefPtr<FontEntry> fe;
+-        nsRefPtr<gfxWindowsFont> font;
++        RefPtr<gfxWindowsFont> font;
          if (mRanges[i].font)
-             fe = mRanges[i].font;
+             font = mRanges[i].font;
          else
-             fe = mGroup->GetFontEntryAt(0);
- 
--        nsRefPtr<gfxWindowsFont> font = GetOrMakeFont(fe, mGroup->GetStyle());
-+        RefPtr<gfxWindowsFont> font = GetOrMakeFont(fe, mGroup->GetStyle());
-         SetCurrentFont(font);
- 
-         mRangeString = mItemString + mRanges[i].start;
-@@ -1524,7 +1522,7 @@ public:
+@@ -1620,7 +1618,7 @@ public:
              if (ch > 0xFFFF)
                  return PR_FALSE;
  
--            nsRefPtr<gfxWindowsFont> font = GetOrMakeFont(aFontEntry, mGroup->GetStyle());
-+            RefPtr<gfxWindowsFont> font = GetOrMakeFont(aFontEntry, mGroup->GetStyle());
- 
-             HDC dc = GetDC((HWND)nsnull);
-             HFONT hfont = font->GetHFONT();
-@@ -1558,9 +1556,9 @@ public:
+-            nsRefPtr<gfxWindowsFont> font =
++            RefPtr<gfxWindowsFont> font =
+                 gfxWindowsFont::GetOrMakeFont(aFontEntry, mGroup->GetStyle());
+             if (!font->IsValid())
+                 return PR_FALSE;
+@@ -1658,10 +1656,10 @@ public:
          return PR_FALSE;
      }
  
--    inline FontEntry *WhichFontSupportsChar(const nsTArray<nsRefPtr<FontEntry> >& fonts, PRUint32 ch) {
-+    inline FontEntry *WhichFontSupportsChar(const nsTArray<RefPtr<FontEntry> >& fonts, PRUint32 ch) {
+-    inline already_AddRefed<gfxWindowsFont>
+-    WhichFontSupportsChar(const nsTArray<nsRefPtr<FontEntry> >& fonts, PRUint32 ch) {
++    inline AddRefed<gfxWindowsFont>
++    WhichFontSupportsChar(const nsTArray<RefPtr<FontEntry> >& fonts, PRUint32 ch) {
          for (PRUint32 i = 0; i < fonts.Length(); i++) {
 -            nsRefPtr<FontEntry> fe = fonts[i];
 +            RefPtr<FontEntry> fe = fonts[i];
              if (fe->mSymbolFont && !mGroup->GetStyle()->familyNameQuirks)
                  continue;
-             if (HasCharacter(fe, ch))
-@@ -1577,7 +1575,7 @@ public:
+             if (HasCharacter(fe, ch)) {
+@@ -1682,10 +1680,10 @@ public:
+                 ch == 0x2060);
      }
  
-     inline FontEntry *FindFontForChar(PRUint32 ch, PRUint32 prevCh, PRUint32 nextCh, FontEntry *aFont) {
--        nsRefPtr<FontEntry> selectedFont;
-+        RefPtr<FontEntry> selectedFont;
+-    inline already_AddRefed<gfxWindowsFont>
++    inline AddRefed<gfxWindowsFont>
+     FindFontForChar(PRUint32 ch, PRUint32 prevCh, PRUint32 nextCh,
+                     gfxWindowsFont *aFont) {
+-        nsRefPtr<gfxWindowsFont> selectedFont;
++        RefPtr<gfxWindowsFont> selectedFont;
  
          // if this character or the next one is a joiner use the
          // same font as the previous range if we can
-@@ -1611,7 +1609,7 @@ public:
+@@ -1721,7 +1719,7 @@ public:
                  if (langGroup) {
                      PR_LOG(gFontLog, PR_LOG_DEBUG, (" - Trying to find fonts for: %s (%s)", langGroup, gScriptToText[primaryId].value));
  
 -                    nsAutoTArray<nsRefPtr<FontEntry>, 5> fonts;
 +                    nsAutoTArray<RefPtr<FontEntry>, 5> fonts;
                      this->GetPrefFonts(langGroup, fonts);
                      selectedFont = WhichFontSupportsChar(fonts, ch);
                  }
-@@ -1623,7 +1621,7 @@ public:
+@@ -1733,7 +1731,7 @@ public:
                      if (PR_LOG_TEST(gFontLog, PR_LOG_DEBUG))
                          PR_LOG(gFontLog, PR_LOG_DEBUG, (" - Trying to find fonts for: CJK"));
  
 -                    nsAutoTArray<nsRefPtr<FontEntry>, 15> fonts;
 +                    nsAutoTArray<RefPtr<FontEntry>, 15> fonts;
                      this->GetCJKPrefFonts(fonts);
                      selectedFont = WhichFontSupportsChar(fonts, ch);
                  } else {
-@@ -1631,7 +1629,7 @@ public:
+@@ -1741,7 +1739,7 @@ public:
                      if (langGroup) {
                          PR_LOG(gFontLog, PR_LOG_DEBUG, (" - Trying to find fonts for: %s", langGroup));
  
 -                        nsAutoTArray<nsRefPtr<FontEntry>, 5> fonts;
 +                        nsAutoTArray<RefPtr<FontEntry>, 5> fonts;
                          this->GetPrefFonts(langGroup, fonts);
                          selectedFont = WhichFontSupportsChar(fonts, ch);
                      }
-@@ -1647,7 +1645,7 @@ public:
+@@ -1757,7 +1755,7 @@ public:
          if (!selectedFont) {
              PR_LOG(gFontLog, PR_LOG_DEBUG, (" - Looking for best match"));
  
 -            nsRefPtr<gfxWindowsFont> refFont = mGroup->GetFontAt(0);
 +            RefPtr<gfxWindowsFont> refFont = mGroup->GetFontAt(0);
              gfxWindowsPlatform *platform = gfxWindowsPlatform::GetPlatform();
              selectedFont = platform->FindFontForChar(ch, refFont);
          }
-@@ -1677,7 +1675,7 @@ public:
-                 if ((i+2 < mItemLength) && NS_IS_HIGH_SURROGATE(ch) && NS_IS_LOW_SURROGATE(mItemString[i+2]))
+@@ -1787,7 +1785,7 @@ public:
+                 if ((i+2 < mItemLength) && NS_IS_HIGH_SURROGATE(nextCh) && NS_IS_LOW_SURROGATE(mItemString[i+2]))
                      nextCh = SURROGATE_TO_UCS4(nextCh, mItemString[i+2]);
              }
--            nsRefPtr<FontEntry> fe = FindFontForChar(ch,
-+            RefPtr<FontEntry> fe = FindFontForChar(ch,
-                                                      prevCh,
-                                                      nextCh,
-                                                      (mRanges.Length() == 0) ? nsnull : mRanges[mRanges.Length() - 1].font);
-@@ -1724,10 +1722,10 @@ private:
+-            nsRefPtr<gfxWindowsFont> font =
++            RefPtr<gfxWindowsFont> font =
+                 FindFontForChar(ch,
+                                 prevCh,
+                                 nextCh,
+@@ -1835,10 +1833,10 @@ private:
      }
  
      // this function appends to the array passed in.
 -    void GetPrefFonts(const char *aLangGroup, nsTArray<nsRefPtr<FontEntry> >& array) {
 +    void GetPrefFonts(const char *aLangGroup, nsTArray<RefPtr<FontEntry> >& array) {
          NS_ASSERTION(aLangGroup, "aLangGroup is null");
          gfxWindowsPlatform *platform = gfxWindowsPlatform::GetPlatform();
 -        nsAutoTArray<nsRefPtr<FontEntry>, 5> fonts;
 +        nsAutoTArray<RefPtr<FontEntry>, 5> fonts;
          /* this lookup has to depend on weight and style */
          nsCAutoString key(aLangGroup);
          key.Append("-");
-@@ -1749,7 +1747,7 @@ private:
+@@ -1860,7 +1858,7 @@ private:
      }
  
      // this function assigns to the array passed in.
 -    void GetCJKPrefFonts(nsTArray<nsRefPtr<FontEntry> >& array) {
 +    void GetCJKPrefFonts(nsTArray<RefPtr<FontEntry> >& array) {
          gfxWindowsPlatform *platform = gfxWindowsPlatform::GetPlatform();
  
          nsCAutoString key("x-internal-cjk-");
-@@ -1836,7 +1834,7 @@ private:
+@@ -1947,7 +1945,7 @@ private:
      }
  
  private:
 -    nsRefPtr<gfxContext> mContext;
 +    RefPtr<gfxContext> mContext;
      HDC mDC;
  
      SCRIPT_ITEM *mScriptItem;
-@@ -1868,7 +1866,7 @@ private:
+@@ -1979,7 +1977,7 @@ private:
      int mMaxGlyphs;
      int mNumGlyphs;
  
 -    nsRefPtr<gfxWindowsFont> mCurrentFont;
 +    RefPtr<gfxWindowsFont> mCurrentFont;
  
      PRPackedBool mFontSelected;
  
-@@ -2028,7 +2026,7 @@ public:
+@@ -2139,7 +2137,7 @@ public:
      }
  
  private:
 -    nsRefPtr<gfxContext> mContext;
 +    RefPtr<gfxContext> mContext;
      HDC mDC;
      const PRUnichar *mString;
      const PRUint32 mLength;
@@ -2535,26 +2556,26 @@ diff --git a/gfx/thebes/src/gfxWindowsPl
  
  PLDHashOperator PR_CALLBACK
  gfxWindowsPlatform::FindFontForCharProc(nsStringHashKey::KeyType aKey,
 -                                        nsRefPtr<FontFamily>& aFontFamily,
 +                                        RefPtr<FontFamily>& aFontFamily,
                                          void* userArg)
  {
      FontSearch *data = (FontSearch*)userArg;
-@@ -524,7 +523,7 @@ gfxWindowsPlatform::FindFontFamily(const
+@@ -528,7 +527,7 @@ gfxWindowsPlatform::FindFontFamily(const
      nsAutoString name(aName);
      BuildKeyNameFromFontName(name);
  
 -    nsRefPtr<FontFamily> ff;
 +    RefPtr<FontFamily> ff;
      if (!mFonts.Get(name, &ff) &&
          !mFontSubstitutes.Get(name, &ff) &&
          !mFontAliases.Get(name, &ff)) {
-@@ -565,13 +564,13 @@ gfxWindowsPlatform::GetPlatformCMSOutput
+@@ -569,13 +568,13 @@ gfxWindowsPlatform::GetPlatformCMSOutput
  }
  
  PRBool
 -gfxWindowsPlatform::GetPrefFontEntries(const nsCString& aKey, nsTArray<nsRefPtr<FontEntry> > *array)
 +gfxWindowsPlatform::GetPrefFontEntries(const nsCString& aKey, nsTArray<RefPtr<FontEntry> > *array)
  {
      return mPrefFonts.Get(aKey, array);
  }
@@ -2844,53 +2865,53 @@ diff --git a/layout/base/nsCSSRendering.
  
  #include "gfxContext.h"
  
 +using namespace mozilla;
 +
  #define BORDER_FULL    0        //entire side
  #define BORDER_INSIDE  1        //inside half
  #define BORDER_OUTSIDE 2        //outside half
-@@ -2804,7 +2806,7 @@ nsCSSRendering::PaintBorder(nsPresContex
+@@ -2803,7 +2805,7 @@ nsCSSRendering::PaintBorder(nsPresContex
    SF(" borderStyles: %d %d %d %d\n", borderStyles[0], borderStyles[1], borderStyles[2], borderStyles[3]);
  
    // start drawing
 -  nsRefPtr<gfxContext> ctx = aRenderingContext.ThebesContext();
 +  RefPtr<gfxContext> ctx = aRenderingContext.ThebesContext();
  
    ctx->Save();
  
-@@ -2962,7 +2964,7 @@ nsCSSRendering::PaintOutline(nsPresConte
+@@ -2961,7 +2963,7 @@ nsCSSRendering::PaintOutline(nsPresConte
                                  width / twipsPerPixel };
  
    // start drawing
 -  nsRefPtr<gfxContext> ctx = aRenderingContext.ThebesContext();
 +  RefPtr<gfxContext> ctx = aRenderingContext.ThebesContext();
  
    ctx->Save();
  
-@@ -3706,7 +3708,7 @@ nsCSSRendering::PaintBackgroundWithSC(ns
+@@ -3705,7 +3707,7 @@ nsCSSRendering::PaintBackgroundWithSC(ns
      anchor.y += bgClipArea.y - aBorderArea.y;
    }
  
 -  nsRefPtr<gfxContext> ctx = aRenderingContext.ThebesContext();
 +  RefPtr<gfxContext> ctx = aRenderingContext.ThebesContext();
    ctx->Save();
  
    nscoord appUnitsPerPixel = aPresContext->DevPixelsToAppUnits(1);
-@@ -4000,7 +4002,7 @@ nsCSSRendering::PaintRoundedBackground(n
+@@ -3999,7 +4001,7 @@ nsCSSRendering::PaintRoundedBackground(n
                                         nscoord aTheRadius[4],
                                         PRBool aCanPaintNonWhite)
  {
 -  nsRefPtr<gfxContext> ctx = aRenderingContext.ThebesContext();
 +  RefPtr<gfxContext> ctx = aRenderingContext.ThebesContext();
  
    // needed for our border thickness
    nscoord appUnitsPerPixel = aPresContext->AppUnitsPerDevPixel();
-@@ -4473,7 +4475,7 @@ nsCSSRendering::PaintDecorationLine(gfxC
+@@ -4472,7 +4474,7 @@ nsCSSRendering::PaintDecorationLine(gfxC
    PRBool contextIsSaved = PR_FALSE;
  
    gfxFloat oldLineWidth;
 -  nsRefPtr<gfxPattern> oldPattern;
 +  RefPtr<gfxPattern> oldPattern;
  
    switch (aStyle) {
      case NS_STYLE_BORDER_STYLE_SOLID:
@@ -2961,17 +2982,17 @@ diff --git a/layout/base/nsLayoutUtils.c
  #include "nsSVGForeignObjectFrame.h"
  #include "nsSVGOuterSVGFrame.h"
  #endif
 +
 +using namespace mozilla;
  
  /**
   * A namespace class for static layout utilities.
-@@ -2436,7 +2438,7 @@ nsLayoutUtils::DrawImage(nsIRenderingCon
+@@ -2513,7 +2515,7 @@ nsLayoutUtils::DrawImage(nsIRenderingCon
    nsCOMPtr<nsIDeviceContext> dc;
    aRenderingContext->GetDeviceContext(*getter_AddRefs(dc));
  
 -  nsRefPtr<gfxContext> ctx = aRenderingContext->ThebesContext();
 +  RefPtr<gfxContext> ctx = aRenderingContext->ThebesContext();
  
    // the dest rect is affected by the current transform; that'll be
    // handled by Image::Draw(), when we actually set up the rectangle.
@@ -3014,97 +3035,97 @@ diff --git a/layout/base/nsPresShell.cpp
     * aScreenRect - [out] set to the area of the screen the painted area should
     *               be displayed at
     */
 -  already_AddRefed<gfxASurface>
 +  AddRefed<gfxASurface>
    PaintRangePaintInfo(nsTArray<nsAutoPtr<RangePaintInfo> >* aItems,
                        nsISelection* aSelection,
                        nsIRegion* aRegion,
-@@ -5205,7 +5207,7 @@ PresShell::CreateRangePaintInfo(nsIDOMRa
+@@ -5177,7 +5179,7 @@ PresShell::CreateRangePaintInfo(nsIDOMRa
    return info;
  }
  
 -already_AddRefed<gfxASurface>
 +AddRefed<gfxASurface>
  PresShell::PaintRangePaintInfo(nsTArray<nsAutoPtr<RangePaintInfo> >* aItems,
                                 nsISelection* aSelection,
                                 nsIRegion* aRegion,
-@@ -5215,7 +5217,7 @@ PresShell::PaintRangePaintInfo(nsTArray<
+@@ -5187,7 +5189,7 @@ PresShell::PaintRangePaintInfo(nsTArray<
  {
    nsPresContext* pc = GetPresContext();
    if (!pc || aArea.width == 0 || aArea.height == 0)
 -    return nsnull;
 +    return AddRefed<gfxASurface>(nsnull);
  
    nsIDeviceContext* deviceContext = pc->DeviceContext();
  
-@@ -5265,7 +5267,7 @@ PresShell::PaintRangePaintInfo(nsTArray<
+@@ -5237,7 +5239,7 @@ PresShell::PaintRangePaintInfo(nsTArray<
                          gfxImageSurface::ImageFormatARGB32);
    if (!surface || surface->CairoStatus()) {
      delete surface;
 -    return nsnull;
 +    return AddRefed<gfxASurface>(nsnull);
    }
  
    // clear the image
-@@ -5318,11 +5320,11 @@ PresShell::PaintRangePaintInfo(nsTArray<
+@@ -5290,11 +5292,11 @@ PresShell::PaintRangePaintInfo(nsTArray<
    // restore the old selection display state
    frameSelection->SetDisplaySelection(oldDisplaySelection);
  
 -  NS_ADDREF(surface);
 -  return surface;
 -}
 -
 -already_AddRefed<gfxASurface>
 +  surface->AddReference();
 +  return AddRefed<gfxASurface>(surface);
 +}
 +
 +AddRefed<gfxASurface>
  PresShell::RenderNode(nsIDOMNode* aNode,
                        nsIRegion* aRegion,
                        nsPoint& aPoint,
-@@ -5340,7 +5342,7 @@ PresShell::RenderNode(nsIDOMNode* aNode,
+@@ -5312,7 +5314,7 @@ PresShell::RenderNode(nsIDOMNode* aNode,
    RangePaintInfo* info = CreateRangePaintInfo(range, area);
    if (info && !rangeItems.AppendElement(info)) {
      delete info;
 -    return nsnull;
 +    return AddRefed<gfxASurface>(nsnull);
    }
  
    if (aRegion) {
-@@ -5355,7 +5357,7 @@ PresShell::RenderNode(nsIDOMNode* aNode,
+@@ -5327,7 +5329,7 @@ PresShell::RenderNode(nsIDOMNode* aNode,
      
      nsPresContext* pc = GetPresContext();
      if (!pc)
 -      return nsnull;
 +      return AddRefed<gfxASurface>(nsnull);
  
      // move the region so that it is offset from the topleft corner of the surface
      aRegion->Offset(-rrectPixels.x + (rrectPixels.x - pc->AppUnitsToDevPixels(area.x)),
-@@ -5366,7 +5368,7 @@ PresShell::RenderNode(nsIDOMNode* aNode,
+@@ -5338,7 +5340,7 @@ PresShell::RenderNode(nsIDOMNode* aNode,
                               aScreenRect);
  }
  
 -already_AddRefed<gfxASurface>
 +AddRefed<gfxASurface>
  PresShell::RenderSelection(nsISelection* aSelection,
                             nsPoint& aPoint,
                             nsRect* aScreenRect)
-@@ -5391,7 +5393,7 @@ PresShell::RenderSelection(nsISelection*
+@@ -5363,7 +5365,7 @@ PresShell::RenderSelection(nsISelection*
      RangePaintInfo* info = CreateRangePaintInfo(range, area);
      if (info && !rangeItems.AppendElement(info)) {
        delete info;
 -      return nsnull;
 +      return AddRefed<gfxASurface>(nsnull);
      }
    }
  
-@@ -7036,20 +7038,20 @@ DumpToPNG(nsIPresShell* shell, nsAString
+@@ -7007,20 +7009,20 @@ DumpToPNG(nsIPresShell* shell, nsAString
    nsRect r(0, 0, shell->GetPresContext()->DevPixelsToAppUnits(width),
                   shell->GetPresContext()->DevPixelsToAppUnits(height));
  
 -  nsRefPtr<gfxImageSurface> imgSurface =
 +  RefPtr<gfxImageSurface> imgSurface =
       new gfxImageSurface(gfxIntSize(width, height),
                           gfxImageSurface::ImageFormatARGB32);
    NS_ENSURE_TRUE(imgSurface, NS_ERROR_OUT_OF_MEMORY);
@@ -3132,17 +3153,17 @@ diff --git a/layout/generic/nsBlockFrame
  #ifdef DEBUG
  #include "nsPrintfCString.h"
  #include "nsBlockDebugFlags.h"
 +
 +using namespace mozilla;
  
  PRBool nsBlockFrame::gLamePaintMetrics;
  PRBool nsBlockFrame::gLameReflowMetrics;
-@@ -5923,7 +5925,7 @@ nsBlockFrame::PaintTextDecorationLine(ns
+@@ -5916,7 +5918,7 @@ nsBlockFrame::PaintTextDecorationLine(ns
        
    // Only paint if we have a positive width
    if (width > 0) {
 -    nsRefPtr<gfxContext> ctx = aRenderingContext.ThebesContext();
 +    RefPtr<gfxContext> ctx = aRenderingContext.ThebesContext();
      gfxPoint pt(PresContext()->AppUnitsToGfxUnits(start + aPt.x),
                  PresContext()->AppUnitsToGfxUnits(aLine->mBounds.y + aPt.y));
      gfxSize size(PresContext()->AppUnitsToGfxUnits(width), aSize);
@@ -3186,26 +3207,26 @@ diff --git a/layout/generic/nsHTMLContai
 -  nsRefPtr<gfxContext> ctx = aRenderingContext.ThebesContext();
 +  RefPtr<gfxContext> ctx = aRenderingContext.ThebesContext();
    gfxPoint pt(PresContext()->AppUnitsToGfxUnits(bp.left + aPt.x),
                PresContext()->AppUnitsToGfxUnits(bp.top + aPt.y));
    gfxSize size(PresContext()->AppUnitsToGfxUnits(innerWidth), aSize);
 diff --git a/layout/generic/nsObjectFrame.cpp b/layout/generic/nsObjectFrame.cpp
 --- a/layout/generic/nsObjectFrame.cpp
 +++ b/layout/generic/nsObjectFrame.cpp
-@@ -1410,7 +1410,7 @@ nsObjectFrame::PaintPlugin(nsIRenderingC
+@@ -1421,7 +1421,7 @@ nsObjectFrame::PaintPlugin(nsIRenderingC
         * to tell the plugin where it is, we dispatch a NPWindow through
         * |HandleEvent| to tell the plugin when its window moved
         */
 -      nsRefPtr<gfxContext> ctx = aRenderingContext.ThebesContext();
 +      RefPtr<gfxContext> ctx = aRenderingContext.ThebesContext();
        gfxMatrix ctxMatrix = ctx->CurrentMatrix();
        if (ctxMatrix.HasNonTranslation()) {
          // soo; in the future, we should be able to render
-@@ -1432,7 +1432,7 @@ nsObjectFrame::PaintPlugin(nsIRenderingC
+@@ -1443,7 +1443,7 @@ nsObjectFrame::PaintPlugin(nsIRenderingC
  
        /* Set the device offsets as appropriate, for whatever our current group offsets might be */
        gfxFloat xoff, yoff;
 -      nsRefPtr<gfxASurface> surf = ctx->CurrentSurface(&xoff, &yoff);
 +      RefPtr<gfxASurface> surf = ctx->CurrentSurface(&xoff, &yoff);
  
        if (surf->CairoStatus() != 0) {
          NS_WARNING("Plugin is being asked to render to a surface that's in error!");
@@ -3279,16 +3300,46 @@ diff --git a/layout/generic/nsTextRunTra
    gfxFontGroup* fontGroup = aTextRun->GetFontGroup();
    gfxFontStyle fontStyle = *fontGroup->GetStyle();
    fontStyle.size *= 0.8;
 -  nsRefPtr<gfxFontGroup> smallFont = fontGroup->Copy(&fontStyle);
 +  RefPtr<gfxFontGroup> smallFont = fontGroup->Copy(&fontStyle);
    if (!smallFont)
      return;
  
+diff --git a/layout/mathml/base/src/nsMathMLChar.cpp b/layout/mathml/base/src/nsMathMLChar.cpp
+--- a/layout/mathml/base/src/nsMathMLChar.cpp
++++ b/layout/mathml/base/src/nsMathMLChar.cpp
+@@ -74,6 +74,8 @@
+ 
+ #include "nsMathMLOperators.h"
+ #include "nsMathMLChar.h"
++
++using namespace mozilla;
+ 
+ //#define SHOW_BORDERS 1
+ //#define NOISY_SEARCH 1
+@@ -2226,7 +2228,7 @@ nsMathMLChar::PaintVertically(nsPresCont
+   }
+   nscoord dx = aRect.x;
+   nscoord offset[3], start[3], end[3];
+-  nsRefPtr<gfxContext> ctx = aRenderingContext.ThebesContext();
++  RefPtr<gfxContext> ctx = aRenderingContext.ThebesContext();
+   for (i = 0; i <= bottom; ++i) {
+     ch = chdata[i];
+     const nsBoundingMetrics& bm = bmdata[i];
+@@ -2456,7 +2458,7 @@ nsMathMLChar::PaintHorizontally(nsPresCo
+   }
+   nscoord dy = aRect.y + mBoundingMetrics.ascent;
+   nscoord offset[3], start[3], end[3];
+-  nsRefPtr<gfxContext> ctx = aRenderingContext.ThebesContext();
++  RefPtr<gfxContext> ctx = aRenderingContext.ThebesContext();
+   for (i = 0; i <= right; ++i) {
+     ch = chdata[i];
+     const nsBoundingMetrics& bm = bmdata[i];
 diff --git a/layout/svg/base/src/nsSVGFilterFrame.cpp b/layout/svg/base/src/nsSVGFilterFrame.cpp
 --- a/layout/svg/base/src/nsSVGFilterFrame.cpp
 +++ b/layout/svg/base/src/nsSVGFilterFrame.cpp
 @@ -47,6 +47,8 @@
  #include "gfxASurface.h"
  #include "gfxContext.h"
  #include "gfxImageSurface.h"
 +
@@ -3980,53 +4031,53 @@ diff --git a/view/src/nsViewManager.cpp 
 -    nsRefPtr<gfxContext> ctx = localcx->ThebesContext();
 +    RefPtr<gfxContext> ctx = localcx->ThebesContext();
  
      ctx->Save();
  
 diff --git a/widget/src/cocoa/nsChildView.h b/widget/src/cocoa/nsChildView.h
 --- a/widget/src/cocoa/nsChildView.h
 +++ b/widget/src/cocoa/nsChildView.h
-@@ -61,13 +61,13 @@
+@@ -62,13 +62,13 @@
  #include "nsString.h"
  #include "nsIDragService.h"
  #include "nsIMenuBar.h"
 +#include "gfxASurface.h"
  
  #include "nsplugindefs.h"
  
  #import <Carbon/Carbon.h>
  #import <Cocoa/Cocoa.h>
  
 -class gfxASurface;
  class nsChildView;
  union nsPluginPort;
  
-@@ -394,7 +394,7 @@ protected:
+@@ -404,7 +404,7 @@ protected:
    nsWeakPtr             mAccessible;
  #endif
  
 -  nsRefPtr<gfxASurface> mTempThebesSurface;
 +  RefPtr<gfxASurface> mTempThebesSurface;
  
    PRPackedBool          mVisible;
    PRPackedBool          mDrawing;
 diff --git a/widget/src/cocoa/nsChildView.mm b/widget/src/cocoa/nsChildView.mm
 --- a/widget/src/cocoa/nsChildView.mm
 +++ b/widget/src/cocoa/nsChildView.mm
-@@ -2495,7 +2495,7 @@ NSEvent* gLastDragEvent = nil;
+@@ -2661,7 +2661,7 @@ NSEvent* gLastDragEvent = nil;
    mGeckoChild->GetBounds(geckoBounds);
  
    NSRect bounds = [self bounds];
 -  nsRefPtr<gfxQuartzSurface> targetSurface =
 +  RefPtr<gfxQuartzSurface> targetSurface =
      new gfxQuartzSurface(cgContext, gfxSize(bounds.size.width, bounds.size.height));
  
  #ifdef DEBUG_UPDATE
-@@ -2508,7 +2508,7 @@ NSEvent* gLastDragEvent = nil;
+@@ -2674,7 +2674,7 @@ NSEvent* gLastDragEvent = nil;
    fprintf (stderr, "  xform in: [%f %f %f %f %f %f]\n", xform.a, xform.b, xform.c, xform.d, xform.tx, xform.ty);
  #endif
  
 -  nsRefPtr<gfxContext> targetContext = new gfxContext(targetSurface);
 +  RefPtr<gfxContext> targetContext = new gfxContext(targetSurface);
  
    nsCOMPtr<nsIRenderingContext> rc;
    mGeckoChild->GetDeviceContext()->CreateRenderingContextInstance(*getter_AddRefs(rc));
@@ -4261,17 +4312,17 @@ diff --git a/widget/src/gtk2/nsWindow.h 
  
 -#include "nsAutoPtr.h"
 -
  #include "nsCommonWidget.h"
 +#include "gfxTypes.h"
  
  #include "mozcontainer.h"
  #include "mozdrawingarea.h"
-@@ -385,7 +384,7 @@ private:
+@@ -398,7 +397,7 @@ private:
      PRInt32             mTransparencyBitmapWidth;
      PRInt32             mTransparencyBitmapHeight;
  
 -    nsRefPtr<gfxASurface> mThebesSurface;
 +    mozilla::RefPtr<gfxASurface> mThebesSurface;
  
  #ifdef ACCESSIBILITY
      nsCOMPtr<nsIAccessible> mRootAccessible;
@@ -4323,38 +4374,38 @@ diff --git a/widget/src/windows/nsDragSe
 -  nsRefPtr<gfxContext> context = new gfxContext(imgSurface);
 +  RefPtr<gfxContext> context = new gfxContext(imgSurface);
    if (!context)
      return PR_FALSE;
  
 diff --git a/widget/src/windows/nsNativeThemeWin.cpp b/widget/src/windows/nsNativeThemeWin.cpp
 --- a/widget/src/windows/nsNativeThemeWin.cpp
 +++ b/widget/src/windows/nsNativeThemeWin.cpp
-@@ -1239,7 +1239,7 @@ nsNativeThemeWin::DrawWidgetBackground(n
+@@ -1264,7 +1264,7 @@ nsNativeThemeWin::DrawWidgetBackground(n
      }
    }
  
 -  nsRefPtr<gfxContext> ctx = aContext->ThebesContext();
 +  RefPtr<gfxContext> ctx = aContext->ThebesContext();
  
    gfxWindowsNativeDrawing nativeDrawing(ctx, cr, GetWidgetNativeDrawingFlags(aWidgetType));
  
-@@ -2652,7 +2652,7 @@ nsresult nsNativeThemeWin::ClassicDrawWi
+@@ -2672,7 +2672,7 @@ nsresult nsNativeThemeWin::ClassicDrawWi
    tr.ScaleInverse(p2a);
    cr.ScaleInverse(p2a);
  
 -  nsRefPtr<gfxContext> ctx = aContext->ThebesContext();
 +  RefPtr<gfxContext> ctx = aContext->ThebesContext();
  
    gfxWindowsNativeDrawing nativeDrawing(ctx, cr, GetWidgetNativeDrawingFlags(aWidgetType));
  
 diff --git a/widget/src/windows/nsWindow.cpp b/widget/src/windows/nsWindow.cpp
 --- a/widget/src/windows/nsWindow.cpp
 +++ b/widget/src/windows/nsWindow.cpp
-@@ -5600,17 +5600,17 @@ PRBool nsWindow::OnPaint(HDC aDC)
+@@ -5813,17 +5813,17 @@ PRBool nsWindow::OnPaint(HDC aDC)
  #endif // NS_DEBUG
  
  #ifdef MOZ_XUL
 -      nsRefPtr<gfxASurface> targetSurface;
 +      RefPtr<gfxASurface> targetSurface;
        if (mIsTransparent) {
          targetSurface = mTransparentSurface;
        } else {
@@ -4370,17 +4421,17 @@ diff --git a/widget/src/windows/nsWindow
 +
 +      RefPtr<gfxContext> thebesContext = new gfxContext(targetSurface);
  
  #ifdef MOZ_XUL
        if (mIsTransparent) {
 diff --git a/widget/src/windows/nsWindow.h b/widget/src/windows/nsWindow.h
 --- a/widget/src/windows/nsWindow.h
 +++ b/widget/src/windows/nsWindow.h
-@@ -412,7 +412,7 @@ protected:
+@@ -421,7 +421,7 @@ protected:
  
  #ifdef MOZ_XUL
    // use layered windows to support full 256 level alpha translucency
 -  nsRefPtr<gfxWindowsSurface> mTransparentSurface;
 +  RefPtr<gfxWindowsSurface> mTransparentSurface;
  
    HDC           mMemoryDC;
    HBITMAP       mMemoryBitmap;
--- a/nscore-class-annotation-types
+++ b/nscore-class-annotation-types
@@ -1,17 +1,17 @@
 diff --git a/xpcom/base/nscore.h b/xpcom/base/nscore.h
 --- a/xpcom/base/nscore.h
 +++ b/xpcom/base/nscore.h
-@@ -500,9 +500,13 @@ typedef PRUint32 nsrefcnt;
+@@ -491,9 +491,13 @@ typedef PRUint32 nsrefcnt;
  #ifdef NS_STATIC_CHECKING
  #define NS_STACK_CLASS __attribute__((user("NS_stack")))
  #define NS_FINAL_CLASS __attribute__((user("NS_final")))
 +#define NS_GC_TYPE     __attribute__((user("NS_GC")))
 +#define NS_NOGC_TYPE   __attribute__((user("NS_NoGC")))
  #else
  #define NS_STACK_CLASS
  #define NS_FINAL_CLASS
 +#define NS_GC_TYPE
 +#define NS_NOGC_TYPE
  #endif
  
- #endif /* nscore_h___ */
+ /**
--- a/prerewrite_fixes.patch
+++ b/prerewrite_fixes.patch
@@ -1,42 +1,42 @@
 * * *
 
 diff --git a/accessible/src/base/nsAccessNode.h b/accessible/src/base/nsAccessNode.h
 --- a/accessible/src/base/nsAccessNode.h
 +++ b/accessible/src/base/nsAccessNode.h
-@@ -97,7 +97,8 @@
+@@ -97,7 +97,8 @@ class nsAccessNode: public nsIAccessNode
                                void* aUniqueID, nsIAccessNode **aAccessNode);
      static void ClearCache(nsAccessNodeHashtable& aCache);
  
 -    static PLDHashOperator PR_CALLBACK ClearCacheEntry(const void* aKey, nsCOMPtr<nsIAccessNode>& aAccessNode, void* aUserArg);
 +#define HIDE_FROM_GARBURATOR(x) x;
 +    HIDE_FROM_GARBURATOR(static PLDHashOperator PR_CALLBACK ClearCacheEntry(const void* aKey, nsCOMPtr<nsIAccessNode>& aAccessNode, void* aUserArg))
  
      // Static cache methods for global document cache
      static already_AddRefed<nsIAccessibleDocument> GetDocAccessibleFor(nsIDocument *aDocument);
 diff --git a/content/base/src/nsImageLoadingContent.cpp b/content/base/src/nsImageLoadingContent.cpp
 --- a/content/base/src/nsImageLoadingContent.cpp
 +++ b/content/base/src/nsImageLoadingContent.cpp
-@@ -441,10 +441,11 @@
+@@ -443,10 +443,11 @@ nsImageLoadingContent::LoadImageWithChan
    CancelImageRequests(NS_ERROR_IMAGE_SRC_CHANGED, PR_FALSE,
                        nsIContentPolicy::ACCEPT);
  
 -  nsCOMPtr<imgIRequest> & req = mCurrentRequest ? mPendingRequest : mCurrentRequest;
 -
    nsresult rv = nsContentUtils::GetImgLoader()->
 -    LoadImageWithChannel(aChannel, this, doc, aListener, getter_AddRefs(req));
 +    LoadImageWithChannel(aChannel, this, doc, aListener, 
 +                         getter_AddRefs(mCurrentRequest 
 +                                        ? mPendingRequest 
 +                                        : mCurrentRequest));
  
    // Make sure our state is up to date
    UpdateImageState(PR_TRUE);
-@@ -575,14 +576,14 @@
+@@ -577,14 +578,14 @@ nsImageLoadingContent::LoadImage(nsIURI*
      FireEvent(NS_LITERAL_STRING("error"));
      return NS_OK;
    }
 -
 -  nsCOMPtr<imgIRequest> & req = mCurrentRequest ? mPendingRequest : mCurrentRequest;
 -
 +  
    rv = nsContentUtils::LoadImage(aNewURI, aDocument,
@@ -48,54 +48,54 @@ diff --git a/content/base/src/nsImageLoa
 +                                                ? mPendingRequest
 +                                                : mCurrentRequest));
    if (NS_FAILED(rv)) {
      FireEvent(NS_LITERAL_STRING("error"));
      return NS_OK;
 diff --git a/content/base/src/nsXMLHttpRequest.cpp b/content/base/src/nsXMLHttpRequest.cpp
 --- a/content/base/src/nsXMLHttpRequest.cpp
 +++ b/content/base/src/nsXMLHttpRequest.cpp
-@@ -979,7 +979,7 @@
+@@ -982,7 +982,7 @@ nsXMLHttpRequest::CreateEvent(const nsAS
  }
  
  void
 -nsXMLHttpRequest::CopyEventListeners(nsCOMPtr<nsIDOMEventListener>& aListener,
 +nsXMLHttpRequest::CopyEventListeners(nsIDOMEventListener* aListener,
                                       const nsCOMArray<nsIDOMEventListener>& aListenerArray,
                                       nsCOMArray<nsIDOMEventListener>& aCopy)
  {
 diff --git a/content/base/src/nsXMLHttpRequest.h b/content/base/src/nsXMLHttpRequest.h
 --- a/content/base/src/nsXMLHttpRequest.h
 +++ b/content/base/src/nsXMLHttpRequest.h
-@@ -158,7 +158,7 @@
+@@ -158,7 +158,7 @@ protected:
    nsresult CreateEvent(const nsAString& aType, nsIDOMEvent** domevent);
  
    // Make a copy of a pair of members to be passed to NotifyEventListeners.
 -  void CopyEventListeners(nsCOMPtr<nsIDOMEventListener>& aListener,
 +  void CopyEventListeners(nsIDOMEventListener* aListener,
                            const nsCOMArray<nsIDOMEventListener>& aListenerArray,
                            nsCOMArray<nsIDOMEventListener>& aCopy);
  
 diff --git a/content/html/content/src/nsHTMLTableElement.cpp b/content/html/content/src/nsHTMLTableElement.cpp
 --- a/content/html/content/src/nsHTMLTableElement.cpp
 +++ b/content/html/content/src/nsHTMLTableElement.cpp
-@@ -831,7 +831,8 @@
+@@ -831,7 +831,8 @@ nsHTMLTableElement::InsertRow(PRInt32 aI
            }
          }
          
 -        nsCOMPtr<nsIDOMNode> retNode, newRowNode(do_QueryInterface(newRow));
 +        nsCOMPtr<nsIDOMNode> retNode;
 +        nsCOMPtr<nsIDOMNode> newRowNode(do_QueryInterface(newRow));
  
          rowGroup->InsertBefore(newRowNode, firstRow, getter_AddRefs(retNode));
  
 diff --git a/content/svg/content/src/nsSVGSVGElement.cpp b/content/svg/content/src/nsSVGSVGElement.cpp
 --- a/content/svg/content/src/nsSVGSVGElement.cpp
 +++ b/content/svg/content/src/nsSVGSVGElement.cpp
-@@ -739,7 +739,10 @@
+@@ -742,7 +742,10 @@ nsSVGSVGElement::GetCTM(nsIDOMSVGMatrix 
        break;
      }
  
 -    nsSVGSVGElement *viewportElement = QI_AND_CAST_TO_NSSVGSVGELEMENT(ancestor);
 +    nsSVGSVGElement *viewportElement = 
 +      nsCOMPtr<nsIDOMSVGSVGElement>(do_QueryInterface(ancestor)) 
 +      ? static_cast<nsSVGSVGElement*>(ancestor.get()) 
 +      : nsnull;
@@ -114,361 +114,361 @@ diff --git a/content/svg/content/src/nsS
 -  (nsCOMPtr<nsIDOMSVGSVGElement>(do_QueryInterface(base)) ?                   \
 -   static_cast<nsSVGSVGElement*>(base.get()) : nsnull)
  
  typedef nsSVGStylableElement nsSVGSVGElementBase;
  
 diff --git a/content/xslt/src/xslt/txStylesheet.cpp b/content/xslt/src/xslt/txStylesheet.cpp
 --- a/content/xslt/src/xslt/txStylesheet.cpp
 +++ b/content/xslt/src/xslt/txStylesheet.cpp
-@@ -558,7 +558,8 @@
+@@ -558,7 +558,8 @@ txStylesheet::addAttributeSet(txAttribut
  
      aAttributeSetItem->mFirstInstruction.forget();
  
 -    delete lastNonReturn->mNext;      // Delete the txReturn...
 +    instr = lastNonReturn->mNext;
 +    delete instr;      // Delete the txReturn...
      lastNonReturn->mNext = oldInstr;  // ...and link up the old instructions.
  
      return NS_OK;
 diff --git a/content/xul/templates/src/nsRDFBinding.cpp b/content/xul/templates/src/nsRDFBinding.cpp
 --- a/content/xul/templates/src/nsRDFBinding.cpp
 +++ b/content/xul/templates/src/nsRDFBinding.cpp
-@@ -106,7 +106,7 @@
+@@ -106,7 +106,7 @@ RDFBindingSet::SyncAssignments(nsIRDFRes
      NS_PRECONDITION(aResult, "Must have result");
  
      PRBool needSync = PR_FALSE;
 -    nsCOMPtr<nsIRDFNode>* valuesArray = aBindingValues.ValuesArray();
 +    nsIRDFNodeManualCOMPtrArray valuesArray = aBindingValues.ValuesArray();
      if (!valuesArray)
          return PR_FALSE;
  
-@@ -238,7 +238,7 @@
+@@ -238,7 +238,7 @@ nsBindingValues::SetBindingSet(RDFBindin
  
      PRInt32 count = aBindings->Count();
      if (count) {
 -        mValues = new nsCOMPtr<nsIRDFNode>[count];
 +        mValues = new nsIRDFNodeManualCOMPtr[count];
          if (!mValues)
              return NS_ERROR_OUT_OF_MEMORY;
  
 diff --git a/content/xul/templates/src/nsRDFBinding.h b/content/xul/templates/src/nsRDFBinding.h
 --- a/content/xul/templates/src/nsRDFBinding.h
 +++ b/content/xul/templates/src/nsRDFBinding.h
-@@ -201,6 +201,8 @@
+@@ -201,6 +201,8 @@ public:
   * XXX ndeakin We may want to revisit this later since it makes the code
   *             more complicated.
   */
 +typedef nsCOMPtr<nsIRDFNode> nsIRDFNodeManualCOMPtr;
 +typedef nsIRDFNodeManualCOMPtr* nsIRDFNodeManualCOMPtrArray;
  class nsBindingValues
  {
  protected:
-@@ -214,7 +216,8 @@
+@@ -214,7 +216,8 @@ protected:
       * Its index will correspond to the index in this array. The size of this
       * array is determined by the RDFBindingSet's Count().
       */
 -    nsCOMPtr<nsIRDFNode>* mValues;
 +
 +    nsIRDFNodeManualCOMPtrArray mValues;
  
  public:
  
-@@ -242,7 +245,7 @@
+@@ -242,7 +245,7 @@ public:
       */
      nsresult SetBindingSet(RDFBindingSet* aBindings);
  
 -    nsCOMPtr<nsIRDFNode>* ValuesArray() { return mValues; }
 +    nsIRDFNodeManualCOMPtrArray ValuesArray() { return mValues; }
  
      /*
       * Retrieve the assignment for a particular variable
 diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
 --- a/docshell/base/nsDocShell.cpp
 +++ b/docshell/base/nsDocShell.cpp
-@@ -948,10 +948,10 @@
+@@ -948,10 +948,10 @@ nsDocShell::LoadStream(nsIInputStream *a
  
      // build up a channel for this stream.
      nsCOMPtr<nsIChannel> channel;
 -    NS_ENSURE_SUCCESS(NS_NewInputStreamChannel
 -                      (getter_AddRefs(channel), uri, aStream,
 -                       aContentType, aContentCharset),
 -                      NS_ERROR_FAILURE);
 +    nsresult res = NS_NewInputStreamChannel(getter_AddRefs(channel), uri, 
 +                                            aStream, aContentType,
 +                                            aContentCharset);
 +    NS_ENSURE_SUCCESS(res, NS_ERROR_FAILURE);
  
      nsCOMPtr<nsIURILoader>
          uriLoader(do_GetService(NS_URI_LOADER_CONTRACTID));
-@@ -1913,9 +1913,9 @@
+@@ -1910,9 +1910,9 @@ nsDocShell::GetSameTypeRootTreeItem(nsID
                        NS_ERROR_FAILURE);
      while (parent) {
          *aRootTreeItem = parent;
 -        NS_ENSURE_SUCCESS((*aRootTreeItem)->
 -                          GetSameTypeParent(getter_AddRefs(parent)),
 -                          NS_ERROR_FAILURE);
 +        nsresult res = (*aRootTreeItem)->
 +            GetSameTypeParent(getter_AddRefs(parent));
 +        NS_ENSURE_SUCCESS(res, NS_ERROR_FAILURE);
      }
      NS_ADDREF(*aRootTreeItem);
      return NS_OK;
-@@ -5988,9 +5988,9 @@
+@@ -6083,9 +6083,9 @@ nsDocShell::CreateContentViewer(const ch
  
      // let's try resetting the load group if we need to...
      nsCOMPtr<nsILoadGroup> currentLoadGroup;
 -    NS_ENSURE_SUCCESS(aOpenedChannel->
 -                      GetLoadGroup(getter_AddRefs(currentLoadGroup)),
 -                      NS_ERROR_FAILURE);
 +    nsresult res = aOpenedChannel->
 +        GetLoadGroup(getter_AddRefs(currentLoadGroup));
 +    NS_ENSURE_SUCCESS(res, NS_ERROR_FAILURE);
  
      if (currentLoadGroup != mLoadGroup) {
          nsLoadFlags loadFlags = 0;
 diff --git a/dom/src/base/nsGlobalWindow.cpp b/dom/src/base/nsGlobalWindow.cpp
 --- a/dom/src/base/nsGlobalWindow.cpp
 +++ b/dom/src/base/nsGlobalWindow.cpp
-@@ -1128,6 +1128,8 @@
+@@ -1133,6 +1133,8 @@ nsGlobalWindow::SetScriptContext(PRUint3
    return NS_OK;
  }
  
 +typedef nsCOMPtr<nsISupports> nsISupportsCOMPtrArray;
 +
  nsresult
  nsGlobalWindow::EnsureScriptEnvironment(PRUint32 aLangID)
  {
-@@ -1157,12 +1159,14 @@
+@@ -1162,12 +1164,14 @@ nsGlobalWindow::EnsureScriptEnvironment(
      // We are being initialized after the document has been setup.
      // Do what would have been done in SetNewDocument had we been around then.
      NS_ASSERTION(!mInnerWindowHolders[lang_ndx], "already have a holder?");
 -    nsCOMPtr<nsISupports> &holder = mInnerWindowHolders[lang_ndx];
 +    nsISupportsCOMPtrArray &holder = mInnerWindowHolders[lang_ndx];
      PRBool isChrome = PR_FALSE; // xxxmarkh - what about this??
      void *&innerGlob = currentInner->mScriptGlobals[lang_ndx];
 +    //hack to avoid rewriting
 +#define GETTER_ADDREFS(x) (getter_AddRefs(x))
      rv = context->CreateNativeGlobalForInner(this, isChrome,
                                               &innerGlob,
 -                                             getter_AddRefs(holder));
 +                                             GETTER_ADDREFS(holder));
      NS_ENSURE_SUCCESS(rv, rv);
      NS_ASSERTION(innerGlob && holder, "Failed to get global and holder");
      rv = context->ConnectToInner(currentInner, mScriptGlobals[lang_ndx]);
-@@ -1373,7 +1377,7 @@
+@@ -1378,7 +1382,7 @@ public:
    NS_DECL_ISUPPORTS
  
    WindowStateHolder(nsGlobalWindow *aWindow,
 -                    nsCOMPtr<nsISupports> aHolders[],
 +                    nsISupportsCOMPtrArray aHolders[],
                      nsNavigator *aNavigator,
                      nsLocation *aLocation,
                      nsIXPConnectJSObjectHolder *aOuterProto);
-@@ -1421,7 +1425,7 @@
+@@ -1426,7 +1430,7 @@ NS_DEFINE_STATIC_IID_ACCESSOR(WindowStat
  NS_DEFINE_STATIC_IID_ACCESSOR(WindowStateHolder, WINDOWSTATEHOLDER_IID)
  
  WindowStateHolder::WindowStateHolder(nsGlobalWindow *aWindow,
 -                                     nsCOMPtr<nsISupports> aHolders[],
 +                                     nsISupportsCOMPtrArray aHolders[],
                                       nsNavigator *aNavigator,
                                       nsLocation *aLocation,
                                       nsIXPConnectJSObjectHolder *aOuterProto)
-@@ -1739,10 +1743,11 @@
+@@ -1748,10 +1752,11 @@ nsGlobalWindow::SetNewDocument(nsIDocume
            nsIScriptContext *this_ctx = GetScriptContextInternal(st_id);
            if (this_ctx) {
              void *&newGlobal = newInnerWindow->mScriptGlobals[st_ndx];
 -            nsCOMPtr<nsISupports> &holder = mInnerWindowHolders[st_ndx];
 +            nsISupportsCOMPtrArray &holder = mInnerWindowHolders[st_ndx];
              rv |= this_ctx->CreateNativeGlobalForInner(sgo, isChrome,
                                                         &newGlobal,
 -                                                       getter_AddRefs(holder));
 +                                                       GETTER_ADDREFS(holder));
 +#undef GETTER_ADDREFS
              NS_ASSERTION(NS_SUCCEEDED(rv) && newGlobal && holder, 
                          "Failed to get script global and holder");
              if (st_id == nsIProgrammingLanguage::JAVASCRIPT) {
 diff --git a/editor/libeditor/base/nsSelectionState.h b/editor/libeditor/base/nsSelectionState.h
 --- a/editor/libeditor/base/nsSelectionState.h
 +++ b/editor/libeditor/base/nsSelectionState.h
-@@ -139,11 +139,11 @@
+@@ -139,11 +139,11 @@ class nsAutoTrackDOMPoint
  {
    private:
      nsRangeUpdater &mRU;
 -    nsCOMPtr<nsIDOMNode> *mNode;
 +    nsIDOMNode **mNode;
      PRInt32 *mOffset;
      nsRangeStore mRangeItem;
    public:
 -    nsAutoTrackDOMPoint(nsRangeUpdater &aRangeUpdater, nsCOMPtr<nsIDOMNode> *aNode, PRInt32 *aOffset) :
 +    nsAutoTrackDOMPoint(nsRangeUpdater &aRangeUpdater, nsIDOMNode **aNode, PRInt32 *aOffset) :
      mRU(aRangeUpdater)
      ,mNode(aNode)
      ,mOffset(aOffset)
 diff --git a/editor/libeditor/html/nsHTMLDataTransfer.cpp b/editor/libeditor/html/nsHTMLDataTransfer.cpp
 --- a/editor/libeditor/html/nsHTMLDataTransfer.cpp
 +++ b/editor/libeditor/html/nsHTMLDataTransfer.cpp
-@@ -341,7 +341,7 @@
+@@ -341,7 +341,7 @@ nsHTMLEditor::InsertHTMLWithContext(cons
      {
        // Use an auto tracker so that our drop point is correctly
        // positioned after the delete.
 -      nsAutoTrackDOMPoint tracker(mRangeUpdater, &targetNode, &targetOffset);
 +      nsAutoTrackDOMPoint tracker(mRangeUpdater, getter_AddRefs(targetNode), &targetOffset);
        res = DeleteSelection(eNone);
        NS_ENSURE_SUCCESS(res, res);
      }
 diff --git a/editor/libeditor/html/nsHTMLEditRules.cpp b/editor/libeditor/html/nsHTMLEditRules.cpp
 --- a/editor/libeditor/html/nsHTMLEditRules.cpp
 +++ b/editor/libeditor/html/nsHTMLEditRules.cpp
-@@ -2216,7 +2216,7 @@
+@@ -2216,7 +2216,7 @@ nsHTMLEditRules::WillDeleteSelection(nsI
        nsCOMPtr<nsIDOMNode> selPointNode = startNode;
        PRInt32 selPointOffset = startOffset;
        {
 -        nsAutoTrackDOMPoint tracker(mHTMLEditor->mRangeUpdater, address_of(selPointNode), &selPointOffset);
 +        nsAutoTrackDOMPoint tracker(mHTMLEditor->mRangeUpdater, getter_AddRefs(selPointNode), &selPointOffset);
          res = JoinBlocks(address_of(leftParent), address_of(rightParent), aCancel);
          *aHandled = PR_TRUE;
        }
-@@ -2282,7 +2282,7 @@
+@@ -2282,7 +2282,7 @@ nsHTMLEditRules::WillDeleteSelection(nsI
        nsCOMPtr<nsIDOMNode> selPointNode = startNode;
        PRInt32 selPointOffset = startOffset;
        {
 -        nsAutoTrackDOMPoint tracker(mHTMLEditor->mRangeUpdater, address_of(selPointNode), &selPointOffset);
 +        nsAutoTrackDOMPoint tracker(mHTMLEditor->mRangeUpdater, getter_AddRefs(selPointNode), &selPointOffset);
          res = JoinBlocks(address_of(leftParent), address_of(rightParent), aCancel);
          *aHandled = PR_TRUE;
        }
-@@ -2323,7 +2323,7 @@
+@@ -2323,7 +2323,7 @@ nsHTMLEditRules::WillDeleteSelection(nsI
    
    {
      // track end location of where we are deleting
 -    nsAutoTrackDOMPoint tracker(mHTMLEditor->mRangeUpdater, address_of(endNode), &endOffset);
 +    nsAutoTrackDOMPoint tracker(mHTMLEditor->mRangeUpdater, getter_AddRefs(endNode), &endOffset);
      // we are handling all ranged deletions directly now.
      *aHandled = PR_TRUE;
      
-@@ -4427,7 +4427,7 @@
+@@ -4427,7 +4427,7 @@ nsHTMLEditRules::CreateStyleForInsertTex
          // This is so we can know where to put the selection after we call
          // RemoveStyleInside().  RemoveStyleInside() could remove any and all of those nodes,
          // so I have to use the range tracking system to find the right spot to put selection.
 -        nsAutoTrackDOMPoint tracker(mHTMLEditor->mRangeUpdater, address_of(newSelParent), &newSelOffset);
 +        nsAutoTrackDOMPoint tracker(mHTMLEditor->mRangeUpdater, getter_AddRefs(newSelParent), &newSelOffset);
          res = mHTMLEditor->RemoveStyleInside(leftNode, item->tag, &(item->attr));
          NS_ENSURE_SUCCESS(res, res);
        }
 diff --git a/editor/libeditor/html/nsHTMLEditorStyle.cpp b/editor/libeditor/html/nsHTMLEditorStyle.cpp
 --- a/editor/libeditor/html/nsHTMLEditorStyle.cpp
 +++ b/editor/libeditor/html/nsHTMLEditorStyle.cpp
-@@ -561,7 +561,7 @@
+@@ -561,7 +561,7 @@ nsresult nsHTMLEditor::SplitStyleAboveRa
    
    // split any matching style nodes above the start of range
    {
 -    nsAutoTrackDOMPoint tracker(mRangeUpdater, address_of(endNode), &endOffset);
 +    nsAutoTrackDOMPoint tracker(mRangeUpdater, getter_AddRefs(endNode), &endOffset);
      res = SplitStyleAbovePoint(address_of(startNode), &startOffset, aProperty, aAttribute);
      if (NS_FAILED(res)) return res;
    }
 diff --git a/editor/libeditor/html/nsWSRunObject.cpp b/editor/libeditor/html/nsWSRunObject.cpp
 --- a/editor/libeditor/html/nsWSRunObject.cpp
 +++ b/editor/libeditor/html/nsWSRunObject.cpp
-@@ -106,7 +106,7 @@
+@@ -106,7 +106,7 @@ nsWSRunObject::ScrubBlockBoundary(nsHTML
    // a block element.
    if (!aOffset) 
      return NS_ERROR_NULL_POINTER;
 -  nsAutoTrackDOMPoint tracker(aHTMLEd->mRangeUpdater, aBlock, aOffset);
 +  nsAutoTrackDOMPoint tracker(aHTMLEd->mRangeUpdater, getter_AddRefs(*aBlock), aOffset);
    nsWSRunObject theWSObj(aHTMLEd, *aBlock, *aOffset);
    return theWSObj.Scrub();
  }
-@@ -136,8 +136,8 @@
+@@ -136,8 +136,8 @@ nsWSRunObject::PrepareToDeleteRange(nsHT
    if (!aStartNode || !aEndNode || !*aStartNode || !*aEndNode || !aStartOffset || !aEndOffset || !aHTMLEd)
      return NS_ERROR_NULL_POINTER;
  
 -  nsAutoTrackDOMPoint trackerStart(aHTMLEd->mRangeUpdater, aStartNode, aStartOffset);
 -  nsAutoTrackDOMPoint trackerEnd(aHTMLEd->mRangeUpdater, aEndNode, aEndOffset);
 +  nsAutoTrackDOMPoint trackerStart(aHTMLEd->mRangeUpdater, getter_AddRefs(*aStartNode), aStartOffset);
 +  nsAutoTrackDOMPoint trackerEnd(aHTMLEd->mRangeUpdater, getter_AddRefs(*aEndNode), aEndOffset);
    
    nsWSRunObject leftWSObj(aHTMLEd, *aStartNode, *aStartOffset);
    nsWSRunObject rightWSObj(aHTMLEd, *aEndNode, *aEndOffset);
-@@ -172,7 +172,7 @@
+@@ -172,7 +172,7 @@ nsWSRunObject::PrepareToSplitAcrossBlock
    if (!aSplitNode || !aSplitOffset || !*aSplitNode || !aHTMLEd)
      return NS_ERROR_NULL_POINTER;
  
 -  nsAutoTrackDOMPoint tracker(aHTMLEd->mRangeUpdater, aSplitNode, aSplitOffset);
 +  nsAutoTrackDOMPoint tracker(aHTMLEd->mRangeUpdater, getter_AddRefs(*aSplitNode), aSplitOffset);
    
    nsWSRunObject wsObj(aHTMLEd, *aSplitNode, *aSplitOffset);
  
-@@ -202,7 +202,7 @@
+@@ -202,7 +202,7 @@ nsWSRunObject::InsertBreak(nsCOMPtr<nsID
    {
      // some scoping for nsAutoTrackDOMPoint.  This will track our insertion point
      // while we tweak any surrounding whitespace
 -    nsAutoTrackDOMPoint tracker(mHTMLEditor->mRangeUpdater, aInOutParent, aInOutOffset);
 +    nsAutoTrackDOMPoint tracker(mHTMLEditor->mRangeUpdater, getter_AddRefs(*aInOutParent), aInOutOffset);
  
      // handle any changes needed to ws run after inserted br
      if (!afterRun)
-@@ -299,7 +299,7 @@
+@@ -299,7 +299,7 @@ nsWSRunObject::InsertText(const nsAStrin
    {
      // some scoping for nsAutoTrackDOMPoint.  This will track our insertion point
      // while we tweak any surrounding whitespace
 -    nsAutoTrackDOMPoint tracker(mHTMLEditor->mRangeUpdater, aInOutParent, aInOutOffset);
 +    nsAutoTrackDOMPoint tracker(mHTMLEditor->mRangeUpdater, getter_AddRefs(*aInOutParent), aInOutOffset);
  
      // handle any changes needed to ws run after inserted text
      if (!afterRun)
 diff --git a/editor/libeditor/text/nsPlaintextDataTransfer.cpp b/editor/libeditor/text/nsPlaintextDataTransfer.cpp
 --- a/editor/libeditor/text/nsPlaintextDataTransfer.cpp
 +++ b/editor/libeditor/text/nsPlaintextDataTransfer.cpp
-@@ -98,7 +98,7 @@
+@@ -98,7 +98,7 @@ nsresult nsPlaintextEditor::InsertTextAt
      {
        // Use an auto tracker so that our drop point is correctly
        // positioned after the delete.
 -      nsAutoTrackDOMPoint tracker(mRangeUpdater, &targetNode, &targetOffset);
 +      nsAutoTrackDOMPoint tracker(mRangeUpdater, getter_AddRefs(targetNode), &targetOffset);
        res = DeleteSelection(eNone);
        NS_ENSURE_SUCCESS(res, res);
      }
 diff --git a/embedding/browser/webBrowser/nsWebBrowser.cpp b/embedding/browser/webBrowser/nsWebBrowser.cpp
 --- a/embedding/browser/webBrowser/nsWebBrowser.cpp
 +++ b/embedding/browser/webBrowser/nsWebBrowser.cpp
-@@ -1167,7 +1167,7 @@
+@@ -1168,7 +1168,7 @@ NS_IMETHODIMP nsWebBrowser::Create()
     // nsIWebProgressListener.
     nsCOMPtr<nsISupports> supports = nsnull;
     (void)mDocShellTreeOwner->QueryInterface(NS_GET_IID(nsIWebProgressListener),
 -                             static_cast<void**>(getter_AddRefs(supports)));
 +                             getter_AddRefs(supports));
     (void)BindListener(supports, NS_GET_IID(nsIWebProgressListener));
  
     NS_ENSURE_SUCCESS(mDocShellAsWin->InitWindow(nsnull,
 diff --git a/extensions/cookie/nsPermissionManager.cpp b/extensions/cookie/nsPermissionManager.cpp
 --- a/extensions/cookie/nsPermissionManager.cpp
 +++ b/extensions/cookie/nsPermissionManager.cpp
-@@ -215,7 +215,8 @@
+@@ -215,7 +215,8 @@ nsPermissionManager::InitDB()
          // check if all the expected columns exist
          nsCOMPtr<mozIStorageStatement> stmt;
          rv = mDBConn->CreateStatement(NS_LITERAL_CSTRING(
 -          "SELECT host, type, permission FROM moz_hosts"), getter_AddRefs(stmt));
 +          "SELECT host, type, permission FROM moz_hosts"),
 +                                      getter_AddRefs(stmt));
          if (NS_SUCCEEDED(rv))
            break;
  
-@@ -242,7 +243,8 @@
+@@ -242,7 +243,8 @@ nsPermissionManager::InitDB()
  
    rv = mDBConn->CreateStatement(NS_LITERAL_CSTRING(
      "DELETE FROM moz_hosts "
 -    "WHERE id = ?1"), getter_AddRefs(mStmtDelete));
 +    "WHERE id = ?1"),
 +                                getter_AddRefs(mStmtDelete));
    NS_ENSURE_SUCCESS(rv, rv);
  
    rv = mDBConn->CreateStatement(NS_LITERAL_CSTRING(
-@@ -674,7 +676,8 @@
+@@ -674,7 +676,8 @@ nsPermissionManager::Read()
    nsCOMPtr<mozIStorageStatement> stmt;
    rv = mDBConn->CreateStatement(NS_LITERAL_CSTRING(
      "SELECT id, host, type, permission "
 -    "FROM moz_hosts"), getter_AddRefs(stmt));
 +    "FROM moz_hosts"),
 +                                getter_AddRefs(stmt));
    NS_ENSURE_SUCCESS(rv, rv);
  
@@ -503,278 +503,278 @@ diff --git a/js/src/xpconnect/src/xpclog
 +
 +#endif
  JS_BEGIN_EXTERN_C
  
  void   XPC_Log_print(const char *fmt, ...);
 diff --git a/layout/style/nsCSSLoader.cpp b/layout/style/nsCSSLoader.cpp
 --- a/layout/style/nsCSSLoader.cpp
 +++ b/layout/style/nsCSSLoader.cpp
-@@ -996,7 +996,7 @@
+@@ -996,7 +996,7 @@ CSSLoaderImpl::CreateSheet(nsIURI* aURI,
        if (cache) {
          if (cache->IsEnabled()) {
            sheet = cache->GetStyleSheet(aURI);
 -          LOG(("  From XUL cache: %p", sheet.get()));
 +          //LOG(("  From XUL cache: %p", sheet.get()));
          }
        }
      }
-@@ -1007,7 +1007,7 @@
+@@ -1007,7 +1007,7 @@ CSSLoaderImpl::CreateSheet(nsIURI* aURI,
        nsURIAndPrincipalHashKey key(aURI, aLoaderPrincipal);
        
        mCompleteSheets.Get(&key, getter_AddRefs(sheet));
 -      LOG(("  From completed: %p", sheet.get()));
 +      //LOG(("  From completed: %p", sheet.get()));
      
        // Then loading sheets
        if (!sheet && !aSyncLoad) {
-@@ -1016,7 +1016,7 @@
+@@ -1016,7 +1016,7 @@ CSSLoaderImpl::CreateSheet(nsIURI* aURI,
          mLoadingDatas.Get(&key, &loadData);
          if (loadData) {
            sheet = loadData->mSheet;
 -          LOG(("  From loading: %p", sheet.get()));
 +          //LOG(("  From loading: %p", sheet.get()));
  
  #ifdef DEBUG
            PRBool debugEqual;
-@@ -1036,7 +1036,7 @@
+@@ -1036,7 +1036,7 @@ CSSLoaderImpl::CreateSheet(nsIURI* aURI,
            mPendingDatas.Get(&key, &loadData);
            if (loadData) {
              sheet = loadData->mSheet;
 -            LOG(("  From pending: %p", sheet.get()));
 +            //LOG(("  From pending: %p", sheet.get()));
  
  #ifdef DEBUG
              PRBool debugEqual;
-@@ -1789,8 +1789,8 @@
+@@ -1789,8 +1789,8 @@ CSSLoaderImpl::LoadStyleLink(nsIContent*
    NS_ENSURE_SUCCESS(rv, rv);
  
    if (state == eSheetComplete) {
 -    LOG(("  Sheet already complete: 0x%p",
 -         static_cast<void*>(sheet.get())));
 +    /*LOG(("  Sheet already complete: 0x%p",
 +      static_cast<void*>(sheet.get())));*/
      if (aObserver) {
        rv = PostLoadEvent(aURL, sheet, aObserver, *aIsAlternate);
        return rv;
 diff --git a/layout/style/nsCSSStyleSheet.cpp b/layout/style/nsCSSStyleSheet.cpp
 --- a/layout/style/nsCSSStyleSheet.cpp
 +++ b/layout/style/nsCSSStyleSheet.cpp
-@@ -266,6 +266,7 @@
+@@ -267,6 +267,7 @@ nsMediaList::GetMediaText(nsAString& aMe
  
  // "sheet" should be an nsCSSStyleSheet and "doc" should be an
  // nsCOMPtr<nsIDocument>
 +#if 0
  #define BEGIN_MEDIA_CHANGE(sheet, doc)                         \
    if (sheet) {                                                 \
      rv = sheet->GetOwningDocument(*getter_AddRefs(doc));       \
-@@ -285,7 +286,10 @@
+@@ -286,7 +287,10 @@ nsMediaList::GetMediaText(nsAString& aMe
    if (doc) {                                                   \
      doc->StyleRuleChanged(sheet, nsnull, nsnull);              \
    }
 -
 +#else
 +#define BEGIN_MEDIA_CHANGE(sheet, doc)                         
 +#define END_MEDIA_CHANGE(sheet, doc)                           
 +#endif
  
  NS_IMETHODIMP
  nsMediaList::SetMediaText(const nsAString& aMediaText)
 diff --git a/netwerk/cookie/src/nsCookieService.cpp b/netwerk/cookie/src/nsCookieService.cpp
 --- a/netwerk/cookie/src/nsCookieService.cpp
 +++ b/netwerk/cookie/src/nsCookieService.cpp
-@@ -535,7 +535,8 @@
+@@ -535,7 +535,8 @@ nsCookieService::InitDB()
          nsCOMPtr<mozIStorageStatement> stmt;
          rv = mDBConn->CreateStatement(NS_LITERAL_CSTRING(
            "SELECT id, name, value, host, path, expiry, isSecure, isHttpOnly "
 -          "FROM moz_cookies"), getter_AddRefs(stmt));
 +          "FROM moz_cookies"),
 +				      getter_AddRefs(stmt));
          if (NS_SUCCEEDED(rv))
            break;
  
-@@ -907,7 +908,8 @@
+@@ -916,7 +917,8 @@ nsCookieService::Read()
    nsCOMPtr<mozIStorageStatement> stmt;
    rv = mDBConn->CreateStatement(NS_LITERAL_CSTRING(
      "SELECT id, name, value, host, path, expiry, lastAccessed, isSecure, isHttpOnly "
 -    "FROM moz_cookies"), getter_AddRefs(stmt));
 +    "FROM moz_cookies"),
 +				getter_AddRefs(stmt));
    NS_ENSURE_SUCCESS(rv, rv);
  
    nsCAutoString name, value, host, path;
 diff --git a/storage/src/mozStorageConnection.cpp b/storage/src/mozStorageConnection.cpp
 --- a/storage/src/mozStorageConnection.cpp
 +++ b/storage/src/mozStorageConnection.cpp
-@@ -243,7 +243,8 @@
+@@ -243,7 +243,8 @@ mozStorageConnection::GetSchemaVersion(P
  
      nsCOMPtr<mozIStorageStatement> stmt;
      nsresult rv = CreateStatement(NS_LITERAL_CSTRING(
 -        "PRAGMA user_version"), getter_AddRefs(stmt));
 +        "PRAGMA user_version"), 
 +                                  getter_AddRefs(stmt));
      if (NS_FAILED(rv)) return rv;
  
      *version = 0;
 diff --git a/toolkit/components/downloads/src/nsDownloadManager.cpp b/toolkit/components/downloads/src/nsDownloadManager.cpp
 --- a/toolkit/components/downloads/src/nsDownloadManager.cpp
 +++ b/toolkit/components/downloads/src/nsDownloadManager.cpp
-@@ -482,7 +482,8 @@
+@@ -520,7 +520,8 @@ nsDownloadManager::InitDB(PRBool *aDoImp
          "SELECT id, name, source, target, tempPath, startTime, endTime, state, "
                 "referrer, entityID, currBytes, maxBytes, mimeType, "
                 "preferredApplication, preferredAction, autoResume "
 -        "FROM moz_downloads"), getter_AddRefs(stmt));
 +        "FROM moz_downloads"),
 +                                    getter_AddRefs(stmt));
        if (NS_SUCCEEDED(rv))
          break;
  
-@@ -701,7 +702,8 @@
+@@ -739,7 +740,8 @@ nsDownloadManager::RestoreDatabaseState(
      "SET autoResume = ?1 "
      "WHERE state = ?2 "
        "OR state = ?3 "
 -      "OR state = ?4"), getter_AddRefs(stmt));
 +      "OR state = ?4"),
 +                                getter_AddRefs(stmt));
    NS_ENSURE_SUCCESS(rv, rv);
  
    i = 0;
-@@ -749,7 +751,8 @@
+@@ -787,7 +789,8 @@ nsDownloadManager::RestoreActiveDownload
      "SELECT id "
      "FROM moz_downloads "
      "WHERE (state = ?1 AND LENGTH(entityID) > 0) "
 -      "OR autoResume != ?2"), getter_AddRefs(stmt));
 +    "OR autoResume != ?2"),
 +                                         getter_AddRefs(stmt));
    NS_ENSURE_SUCCESS(rv, rv);
  
    rv = stmt->BindInt32Parameter(0, nsIDownloadManager::DOWNLOAD_PAUSED);
-@@ -793,7 +796,8 @@
+@@ -831,7 +834,8 @@ nsDownloadManager::AddDownloadToDB(const
      "INSERT INTO moz_downloads "
      "(name, source, target, tempPath, startTime, endTime, state, "
       "mimeType, preferredApplication, preferredAction) "
 -    "VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10)"), getter_AddRefs(stmt));
 +    "VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10)"),
 +                                         getter_AddRefs(stmt));
    NS_ENSURE_SUCCESS(rv, 0);
  
    PRInt32 i = 0;
-@@ -887,7 +891,8 @@
+@@ -925,7 +929,8 @@ nsDownloadManager::Init()
      "SET tempPath = ?1, startTime = ?2, endTime = ?3, state = ?4, "
          "referrer = ?5, entityID = ?6, currBytes = ?7, maxBytes = ?8, "
          "autoResume = ?9 "
 -    "WHERE id = ?10"), getter_AddRefs(mUpdateDownloadStatement));
 +    "WHERE id = ?10"),
 +                                getter_AddRefs(mUpdateDownloadStatement));
    NS_ENSURE_SUCCESS(rv, rv);
  
-   // Do things *after* initializing various download manager properties such as
-@@ -966,7 +971,8 @@
+   rv = mDBConn->CreateStatement(NS_LITERAL_CSTRING(
+@@ -1016,7 +1021,8 @@ nsDownloadManager::GetDownloadFromDB(PRU
             "entityID, currBytes, maxBytes, mimeType, preferredAction, "
             "preferredApplication, autoResume "
      "FROM moz_downloads "
 -    "WHERE id = ?1"), getter_AddRefs(stmt));
 +    "WHERE id = ?1"), 
 +                                         getter_AddRefs(stmt));
    NS_ENSURE_SUCCESS(rv, rv);
  
    rv = stmt->BindInt64Parameter(0, aID);
-@@ -1521,7 +1527,8 @@
+@@ -1595,7 +1601,8 @@ nsDownloadManager::RemoveDownload(PRUint
    nsCOMPtr<mozIStorageStatement> stmt;
    nsresult rv = mDBConn->CreateStatement(NS_LITERAL_CSTRING(
      "DELETE FROM moz_downloads "
 -    "WHERE id = ?1"), getter_AddRefs(stmt));
 +    "WHERE id = ?1"), 
 +                                         getter_AddRefs(stmt));
    NS_ENSURE_SUCCESS(rv, rv);
  
    rv = stmt->BindInt64Parameter(0, aID); // unsigned; 64-bit to prevent overflow
-@@ -1560,7 +1567,8 @@
+@@ -1634,7 +1641,8 @@ nsDownloadManager::CleanUp()
        "OR state = ?3 "
        "OR state = ?4 "
        "OR state = ?5 "
 -      "OR state = ?6"), getter_AddRefs(stmt));
 +      "OR state = ?6"),
 +                                         getter_AddRefs(stmt));
    NS_ENSURE_SUCCESS(rv, rv);
    for (PRUint32 i = 0; i < NS_ARRAY_LENGTH(states); ++i) {
      rv = stmt->BindInt32Parameter(i, states[i]);
-@@ -1610,7 +1618,8 @@
+@@ -1684,7 +1692,8 @@ nsDownloadManager::GetCanCleanUp(PRBool 
        "OR state = ?3 "
        "OR state = ?4 "
        "OR state = ?5 "
 -      "OR state = ?6"), getter_AddRefs(stmt));
 +      "OR state = ?6"),
 +                                         getter_AddRefs(stmt));
    NS_ENSURE_SUCCESS(rv, rv);
    for (PRUint32 i = 0; i < NS_ARRAY_LENGTH(states); ++i) {
      rv = stmt->BindInt32Parameter(i, states[i]);
 diff --git a/toolkit/components/places/src/nsMaybeWeakPtr.h b/toolkit/components/places/src/nsMaybeWeakPtr.h
 --- a/toolkit/components/places/src/nsMaybeWeakPtr.h
 +++ b/toolkit/components/places/src/nsMaybeWeakPtr.h
-@@ -64,7 +64,10 @@
+@@ -60,7 +60,10 @@ class nsMaybeWeakPtr : private nsMaybeWe
  {
  public:
    nsMaybeWeakPtr(nsISupports *ref) { mPtr = ref; }
 -  nsMaybeWeakPtr(const nsCOMPtr<nsIWeakReference> &ref) { mPtr = ref; }
 +#define GARBURATOR_HATES_THIS(x) x
 +  GARBURATOR_HATES_THIS(
 +  nsMaybeWeakPtr(const nsCOMPtr < nsIWeakReference> &ref) { mPtr = ref; }
 +                        )
    nsMaybeWeakPtr(const nsCOMPtr<T> &ref) { mPtr = ref; }
  
    PRBool operator==(const nsMaybeWeakPtr<T> &other) const {
-@@ -113,12 +116,9 @@
+@@ -109,12 +112,9 @@ public:
  
  // Call a method on each element in the array, but only if the element is
  // non-null.
 -
 +// hack..removed comptr& code that was confusing elsa
  #define ENUMERATE_WEAKARRAY(array, type, method)                           \
    for (PRUint32 array_idx = 0; array_idx < array.Length(); ++array_idx) {  \
 -    const nsCOMPtr<type> &e = array.ElementAt(array_idx);                  \
 -    if (e)                                                                 \
 -      e->method;                                                           \
    }
  
  #endif
 diff --git a/toolkit/components/places/src/nsNavHistory.cpp b/toolkit/components/places/src/nsNavHistory.cpp
 --- a/toolkit/components/places/src/nsNavHistory.cpp
 +++ b/toolkit/components/places/src/nsNavHistory.cpp
-@@ -1426,7 +1426,8 @@
+@@ -1498,7 +1498,8 @@ nsNavHistory::CleanUpOnQuit()
    // test for moz_places.user_title
    nsCOMPtr<mozIStorageStatement> statement2;
    nsresult rv = mDBConn->CreateStatement(NS_LITERAL_CSTRING(
 -    "SELECT user_title FROM moz_places"), getter_AddRefs(statement2));
 +    "SELECT user_title FROM moz_places"), 
 +                                         getter_AddRefs(statement2));
    if (NS_SUCCEEDED(rv)) {
      mozStorageTransaction transaction(mDBConn, PR_FALSE);
      // 1. Indexes are moved along with the renamed table. Since we're dropping
 diff --git a/toolkit/crashreporter/test/TestCrashReporterAPI.cpp b/toolkit/crashreporter/test/TestCrashReporterAPI.cpp
 --- a/toolkit/crashreporter/test/TestCrashReporterAPI.cpp
 +++ b/toolkit/crashreporter/test/TestCrashReporterAPI.cpp
-@@ -65,9 +65,10 @@
+@@ -65,9 +65,10 @@ test_init_exception_handler()
    nsCOMPtr<nsILocalFile> lf;
    // we don't plan on launching the crash reporter in this app anyway,
    // so it's ok to pass a bogus nsILocalFile
 -  mu_assert("NS_NewNativeLocalFile", NS_NewNativeLocalFile(EmptyCString(),
 -                                                           PR_TRUE,
 -                                                           getter_AddRefs(lf)));
 +  nsresult rv = NS_NewNativeLocalFile(EmptyCString(),
 +                                      PR_TRUE,
 +                                      getter_AddRefs(lf));
 +  mu_assert("NS_NewNativeLocalFile", rv);
  
    mu_assert("CrashReporter::SetExceptionHandler",
              CrashReporter::SetExceptionHandler(lf, nsnull));
 diff --git a/xpcom/glue/nsCOMPtr.h b/xpcom/glue/nsCOMPtr.h
 --- a/xpcom/glue/nsCOMPtr.h
 +++ b/xpcom/glue/nsCOMPtr.h
-@@ -1701,4 +1701,20 @@
+@@ -1701,4 +1701,20 @@ CallQueryInterface( nsCOMPtr<SourceType>
      return CallQueryInterface(aSourcePtr.get(), aDestPtr);
    }
  
 +
 +
 +// This is used instead of nsCOMPtr::swap
 +// need to remove nsCOMPtr::swap and have a specialized version if needed
 +template <class T> void swap(T* &a, T* &b) {
@@ -788,47 +788,47 @@ diff --git a/xpcom/glue/nsCOMPtr.h b/xpc
 +  a = b.get();
 +  b = tmp;
 +}
 +
  #endif // !defined(nsCOMPtr_h___)
 diff --git a/xpfe/appshell/src/nsChromeTreeOwner.cpp b/xpfe/appshell/src/nsChromeTreeOwner.cpp
 --- a/xpfe/appshell/src/nsChromeTreeOwner.cpp
 +++ b/xpfe/appshell/src/nsChromeTreeOwner.cpp
-@@ -210,8 +210,9 @@
+@@ -210,8 +210,9 @@ NS_IMETHODIMP nsChromeTreeOwner::FindIte
     NS_ENSURE_TRUE(windowMediator, NS_ERROR_FAILURE);
  
     nsCOMPtr<nsISimpleEnumerator> windowEnumerator;
 -   NS_ENSURE_SUCCESS(windowMediator->GetXULWindowEnumerator(nsnull, 
 -      getter_AddRefs(windowEnumerator)), NS_ERROR_FAILURE);
 +   nsresult res = windowMediator->
 +     GetXULWindowEnumerator(nsnull, getter_AddRefs(windowEnumerator));
 +   NS_ENSURE_SUCCESS(res, NS_ERROR_FAILURE);
     
     PRBool more;
     
 diff --git a/xpfe/appshell/src/nsContentTreeOwner.cpp b/xpfe/appshell/src/nsContentTreeOwner.cpp
 --- a/xpfe/appshell/src/nsContentTreeOwner.cpp
 +++ b/xpfe/appshell/src/nsContentTreeOwner.cpp
-@@ -243,8 +243,9 @@
+@@ -243,8 +243,9 @@ NS_IMETHODIMP nsContentTreeOwner::FindIt
     NS_ENSURE_TRUE(windowMediator, NS_ERROR_FAILURE);
  
     nsCOMPtr<nsISimpleEnumerator> windowEnumerator;
 -   NS_ENSURE_SUCCESS(windowMediator->GetXULWindowEnumerator(nsnull, 
 -      getter_AddRefs(windowEnumerator)), NS_ERROR_FAILURE);
 +   nsresult res = windowMediator->
 +     GetXULWindowEnumerator(nsnull, getter_AddRefs(windowEnumerator));
 +   NS_ENSURE_SUCCESS(res, NS_ERROR_FAILURE);
     
     PRBool more;
     
 diff --git a/xpfe/appshell/src/nsWindowMediator.cpp b/xpfe/appshell/src/nsWindowMediator.cpp
 --- a/xpfe/appshell/src/nsWindowMediator.cpp
 +++ b/xpfe/appshell/src/nsWindowMediator.cpp
-@@ -79,7 +79,7 @@
+@@ -79,7 +79,7 @@ struct windowData {
  
  
  nsresult
 -GetDOMWindow( nsIXULWindow* inWindow, nsCOMPtr< nsIDOMWindowInternal>& outDOMWindow)
 +GetDOMWindow( nsIXULWindow* inWindow, nsCOMPtr<nsIDOMWindowInternal>& outDOMWindow)
  {
    nsCOMPtr<nsIDocShell> docShell;
  
--- a/remove-cyclec.patch
+++ b/remove-cyclec.patch
@@ -1,14 +1,14 @@
 Get rid of the cycle collector.
 
 diff --git a/content/base/public/nsContentUtils.h b/content/base/public/nsContentUtils.h
 --- a/content/base/public/nsContentUtils.h
 +++ b/content/base/public/nsContentUtils.h
-@@ -857,20 +857,6 @@ public:
+@@ -858,20 +858,6 @@ public:
    static PRUint32 GetEventId(nsIAtom* aName);
  
    /**
 -   * Used only during traversal of the XPCOM graph by the cycle
 -   * collector: push a pointer to the listener manager onto the
 -   * children deque, if it exists. Do nothing if there is no listener
 -   * manager.
 -   *
@@ -19,17 +19,17 @@ diff --git a/content/base/public/nsConte
 -   */
 -  static void TraverseListenerManager(nsINode *aNode,
 -                                      nsCycleCollectionTraversalCallback &cb);
 -
 -  /**
     * Get the eventlistener manager for aNode. If a new eventlistener manager
     * was created, aCreated is set to PR_TRUE.
     *
-@@ -1016,74 +1002,6 @@ public:
+@@ -1017,74 +1003,6 @@ public:
     * Unbinds the content from the tree and nulls it out if it's not null.
     */
    static void DestroyAnonymousContent(nsCOMPtr<nsIContent>* aContent);
 -
 -  /**
 -   * Keep script object aNewObject, held by aScriptObjectHolder, alive.
 -   *
 -   * NOTE: This currently only supports objects that hold script objects of one
@@ -94,17 +94,17 @@ diff --git a/content/base/public/nsConte
 -   *
 -   * @param aScriptObjectHolder the object that holds JS objects that we want to
 -   *                            drop
 -   */
 -  static nsresult DropJSObjects(void* aScriptObjectHolder);
  
    /**
     * Convert nsIContent::IME_STATUS_* to nsIKBStateControll::IME_STATUS_*
-@@ -1354,13 +1272,8 @@ private:
+@@ -1355,13 +1273,8 @@ private:
    static PRUint32 sRunnersCountAtFirstBlocker;
  };
  
 -#define NS_HOLD_JS_OBJECTS(obj, clazz)                                         \
 -  nsContentUtils::HoldJSObjects(NS_CYCLE_COLLECTION_UPCAST(obj, clazz),        \
 -                                &NS_CYCLE_COLLECTION_NAME(clazz))
 -
 -#define NS_DROP_JS_OBJECTS(obj, clazz)                                         \
@@ -189,17 +189,17 @@ diff --git a/content/base/src/nsContentS
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 -
  
  nsContentSink::nsContentSink()
  {
 diff --git a/content/base/src/nsContentUtils.cpp b/content/base/src/nsContentUtils.cpp
 --- a/content/base/src/nsContentUtils.cpp
 +++ b/content/base/src/nsContentUtils.cpp
-@@ -3253,26 +3253,6 @@ nsContentUtils::HasMutationListeners(nsI
+@@ -3269,26 +3269,6 @@ nsContentUtils::HasMutationListeners(nsI
    return PR_FALSE;
  }
  
 -/* static */
 -void
 -nsContentUtils::TraverseListenerManager(nsINode *aNode,
 -                                        nsCycleCollectionTraversalCallback &cb)
 -{
@@ -216,17 +216,17 @@ diff --git a/content/base/src/nsContentU
 -    NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "[via hash] mListenerManager");
 -    cb.NoteXPCOMChild(entry->mListenerManager);
 -  }
 -}
 -
  nsresult
  nsContentUtils::GetListenerManager(nsINode *aNode,
                                     PRBool aCreateIfNotFound,
-@@ -3770,33 +3750,6 @@ nsContentUtils::DropScriptObject(PRUint3
+@@ -3786,33 +3766,6 @@ nsContentUtils::DropScriptObject(PRUint3
    if (--sScriptRootCount[langIndex] == 0) {
      NS_RELEASE(sScriptRuntimes[langIndex]);
    }
 -}
 -
 -/* static */
 -nsresult
 -nsContentUtils::HoldJSObjects(void* aScriptObjectHolder,
@@ -550,17 +550,17 @@ diff --git a/content/base/src/nsGenericE
 -  }
 -
 -  if (mAttributeMap) {
 -    mAttributeMap->DropReference();
 -  }
  }
  
  nsGenericElement::nsGenericElement(nsINodeInfo *aNodeInfo)
-@@ -3452,103 +3445,6 @@ nsGenericElement::doRemoveChild(nsIDOMNo
+@@ -3448,103 +3441,6 @@ nsGenericElement::doRemoveChild(nsIDOMNo
  // nsISupports implementation
  
  NS_IMPL_CYCLE_COLLECTION_CLASS(nsGenericElement)
 -
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsGenericElement)
 -  NS_IMPL_CYCLE_COLLECTION_UNLINK_LISTENERMANAGER
 -  NS_IMPL_CYCLE_COLLECTION_UNLINK_USERDATA
 -  NS_IMPL_CYCLE_COLLECTION_UNLINK_PRESERVED_WRAPPER
@@ -712,17 +712,17 @@ diff --git a/content/base/src/nsNodeUtil
 -
 -  /**
     * A basic implementation of the DOM cloneNode method. Calls nsINode::Clone to
     * do the actual cloning of the node.
     *
 diff --git a/content/base/src/nsObjectLoadingContent.cpp b/content/base/src/nsObjectLoadingContent.cpp
 --- a/content/base/src/nsObjectLoadingContent.cpp
 +++ b/content/base/src/nsObjectLoadingContent.cpp
-@@ -1326,12 +1326,6 @@ nsObjectLoadingContent::RemovedFromDocum
+@@ -1323,12 +1323,6 @@ nsObjectLoadingContent::RemovedFromDocum
    }
  }
  
 -void
 -nsObjectLoadingContent::Traverse(nsCycleCollectionTraversalCallback &cb)
 -{
 -  cb.NoteXPCOMChild(mFrameLoader);
 -}
@@ -884,17 +884,17 @@ diff --git a/content/events/src/nsEventL
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 -
  
  const EventTypeData*
  nsEventListenerManager::GetTypeDataForIID(const nsIID& aIID)
 diff --git a/content/events/src/nsEventStateManager.cpp b/content/events/src/nsEventStateManager.cpp
 --- a/content/events/src/nsEventStateManager.cpp
 +++ b/content/events/src/nsEventStateManager.cpp
-@@ -677,66 +677,6 @@ NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOU
+@@ -678,66 +678,6 @@ NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOU
  NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOUS(nsEventStateManager, nsIEventStateManager)
  NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUOUS(nsEventStateManager, nsIEventStateManager)
  
 -PR_STATIC_CALLBACK(PRBool)
 -TraverseAccessKeyContent(nsHashKey *aKey, void *aData, void* aClosure)
 -{
 -  nsCycleCollectionTraversalCallback *cb =
 -    static_cast<nsCycleCollectionTraversalCallback*>(aClosure);
@@ -954,17 +954,17 @@ diff --git a/content/events/src/nsEventS
 -
 -
  NS_IMETHODIMP
  nsEventStateManager::PreHandleEvent(nsPresContext* aPresContext,
                                      nsEvent *aEvent,
 diff --git a/content/html/content/src/nsHTMLFormElement.cpp b/content/html/content/src/nsHTMLFormElement.cpp
 --- a/content/html/content/src/nsHTMLFormElement.cpp
 +++ b/content/html/content/src/nsHTMLFormElement.cpp
-@@ -527,25 +527,6 @@ nsHTMLFormElement::Init()
+@@ -528,25 +528,6 @@ nsHTMLFormElement::Init()
  
  
  // nsISupports
 -
 -PR_STATIC_CALLBACK(PLDHashOperator)
 -ElementTraverser(const nsAString& key, nsIDOMHTMLInputElement* element,
 -                 void* userArg)
 -{
@@ -980,17 +980,17 @@ diff --git a/content/html/content/src/ns
 -                                                  nsGenericHTMLElement)
 -  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR_AMBIGUOUS(mControls,
 -                                                       nsIDOMHTMLCollection)
 -  tmp->mSelectedRadioButtons.EnumerateRead(ElementTraverser, &cb);
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  NS_IMPL_ADDREF_INHERITED(nsHTMLFormElement, nsGenericElement) 
  NS_IMPL_RELEASE_INHERITED(nsHTMLFormElement, nsGenericElement) 
-@@ -2078,23 +2059,7 @@ nsFormControlList::FlushPendingNotificat
+@@ -2094,23 +2075,7 @@ nsFormControlList::FlushPendingNotificat
    }
  }
  
 -PR_STATIC_CALLBACK(PLDHashOperator)
 -ControlTraverser(const nsAString& key, nsISupports* control, void* userArg)
 -{
 -  nsCycleCollectionTraversalCallback *cb = 
 -    static_cast<nsCycleCollectionTraversalCallback*>(userArg);
@@ -1619,17 +1619,17 @@ diff --git a/content/xbl/src/nsXBLProtot
 -  void Trace(TraceCallback aCallback, void *aClosure) const;
 -
  // Static members
    static PRUint32 gRefCnt;
   
 diff --git a/content/xml/document/src/nsXMLContentSink.cpp b/content/xml/document/src/nsXMLContentSink.cpp
 --- a/content/xml/document/src/nsXMLContentSink.cpp
 +++ b/content/xml/document/src/nsXMLContentSink.cpp
-@@ -189,18 +189,6 @@ NS_INTERFACE_MAP_END_INHERITING(nsConten
+@@ -190,18 +190,6 @@ NS_INTERFACE_MAP_END_INHERITING(nsConten
  
  NS_IMPL_ADDREF_INHERITED(nsXMLContentSink, nsContentSink)
  NS_IMPL_RELEASE_INHERITED(nsXMLContentSink, nsContentSink)
 -
 -NS_IMPL_CYCLE_COLLECTION_CLASS(nsXMLContentSink)
 -
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(nsXMLContentSink,
 -                                                  nsContentSink)
@@ -1702,46 +1702,46 @@ diff --git a/content/xul/content/src/nsX
 -    if (aIID.Equals(NS_GET_IID(nsXPCOMCycleCollectionParticipant))) {
 -      *aInstancePtr = &NS_CYCLE_COLLECTION_NAME(nsXULElement);
 -      return NS_OK;
 -    }
 -
      nsresult rv = nsGenericElement::QueryInterface(aIID, aInstancePtr);
      if (NS_SUCCEEDED(rv))
          return rv;
-@@ -711,12 +706,6 @@ nsXULElement::PerformAccesskey(PRBool aK
+@@ -712,12 +707,6 @@ nsXULElement::PerformAccesskey(PRBool aK
  // nsIScriptEventHandlerOwner interface
  
  NS_IMPL_CYCLE_COLLECTION_CLASS(nsScriptEventHandlerOwnerTearoff)
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsScriptEventHandlerOwnerTearoff)
 -  tmp->mElement = nsnull;
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsScriptEventHandlerOwnerTearoff)
 -  cb.NoteXPCOMChild(static_cast<nsIContent*>(tmp->mElement));
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsScriptEventHandlerOwnerTearoff)
    NS_INTERFACE_MAP_ENTRY(nsIScriptEventHandlerOwner)
-@@ -818,15 +807,6 @@ nsScriptEventHandlerOwnerTearoff::Compil
+@@ -819,15 +808,6 @@ nsScriptEventHandlerOwnerTearoff::Compil
          // take a copy of the event handler, and tell the language about it.
          if (aHandler) {
              NS_ASSERTION(!attr->mEventHandler, "Leaking handler.");
 -
 -            rv = nsContentUtils::HoldScriptObject(aContext->GetScriptTypeID(),
 -                                                  elem,
 -                                                  &NS_CYCLE_COLLECTION_NAME(nsXULPrototypeNode),
 -                                                  aHandler,
 -                                                  elem->mHoldsScriptObject);
 -            if (NS_FAILED(rv)) return rv;
 -
 -            elem->mHoldsScriptObject = PR_TRUE;
          }
          attr->mEventHandler = (void *)aHandler;
      }
-@@ -2543,62 +2523,6 @@ nsXULElement::RecompileScriptEventListen
+@@ -2544,62 +2524,6 @@ nsXULElement::RecompileScriptEventListen
      }
  }
  
 -NS_IMPL_CYCLE_COLLECTION_CLASS(nsXULPrototypeNode)
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_NATIVE(nsXULPrototypeNode)
 -    if (tmp->mType == nsXULPrototypeNode::eType_Element) {
 -        static_cast<nsXULPrototypeElement*>(tmp)->Unlink();
 -    }
@@ -1794,17 +1794,17 @@ diff --git a/content/xul/content/src/nsX
 -    }
 -NS_IMPL_CYCLE_COLLECTION_ROOT_END
 -//NS_IMPL_CYCLE_COLLECTION_ROOT_NATIVE(nsXULPrototypeNode, AddRef)
 -NS_IMPL_CYCLE_COLLECTION_UNROOT_NATIVE(nsXULPrototypeNode, Release)
 -
  //----------------------------------------------------------------------
  //
  // nsXULPrototypeAttribute
-@@ -2893,24 +2817,6 @@ nsXULPrototypeElement::SetAttrAt(PRUint3
+@@ -2894,24 +2818,6 @@ nsXULPrototypeElement::SetAttrAt(PRUint3
      return NS_OK;
  }
  
 -void
 -nsXULPrototypeElement::UnlinkJSObjects()
 -{
 -    if (mHoldsScriptObject) {
 -        nsContentUtils::DropScriptObjects(mScriptTypeID, this,
@@ -1819,17 +1819,17 @@ diff --git a/content/xul/content/src/nsX
 -    mNumAttributes = 0;
 -    delete[] mAttributes;
 -    mAttributes = nsnull;
 -}
 -
  //----------------------------------------------------------------------
  //
  // nsXULPrototypeScript
-@@ -2933,7 +2839,6 @@ nsXULPrototypeScript::nsXULPrototypeScri
+@@ -2934,7 +2840,6 @@ nsXULPrototypeScript::nsXULPrototypeScri
  
  nsXULPrototypeScript::~nsXULPrototypeScript()
  {
 -    UnlinkJSObjects();
  }
  
  nsresult
 diff --git a/content/xul/content/src/nsXULElement.h b/content/xul/content/src/nsXULElement.h
@@ -1947,17 +1947,17 @@ diff --git a/content/xul/document/src/ns
 -  }
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsXULControllers)
    NS_INTERFACE_MAP_ENTRY(nsIControllers)
 diff --git a/content/xul/document/src/nsXULDocument.cpp b/content/xul/document/src/nsXULDocument.cpp
 --- a/content/xul/document/src/nsXULDocument.cpp
 +++ b/content/xul/document/src/nsXULDocument.cpp
-@@ -288,73 +288,6 @@ NS_NewXULDocument(nsIXULDocument** resul
+@@ -290,73 +290,6 @@ NS_NewXULDocument(nsIXULDocument** resul
  
  NS_IMPL_CYCLE_COLLECTION_CLASS(nsXULDocument)
  
 -static PRIntn
 -TraverseElement(const PRUnichar* aID, nsIContent* aElement, void* aContext)
 -{
 -    nsCycleCollectionTraversalCallback *cb =
 -        static_cast<nsCycleCollectionTraversalCallback*>(aContext);
@@ -2237,28 +2237,28 @@ diff --git a/dom/src/base/nsGlobalWindow
 @@ -79,7 +79,6 @@
  #endif
  #include "nsContentCID.h"
  #include "nsLayoutStatics.h"
 -#include "nsCycleCollector.h"
  #include "nsCCUncollectableMarker.h"
  
  // Interfaces Needed
-@@ -747,10 +746,6 @@ nsGlobalWindow::~nsGlobalWindow()
+@@ -752,10 +751,6 @@ nsGlobalWindow::~nsGlobalWindow()
  
    CleanUp();
  
 -#ifdef DEBUG
 -  nsCycleCollector_DEBUG_wasFreed(static_cast<nsIScriptGlobalObject*>(this));
 -#endif
 -
    delete mPendingStorageEvents;
  
    nsLayoutStatics::Release();
-@@ -767,17 +762,6 @@ void
+@@ -772,17 +767,6 @@ void
  void
  nsGlobalWindow::CleanupCachedXBLHandlers(nsGlobalWindow* aWindow)
  {
 -  if (aWindow->mCachedXBLPrototypeHandlers.IsInitialized() &&
 -      aWindow->mCachedXBLPrototypeHandlers.Count() > 0) {
 -    aWindow->mCachedXBLPrototypeHandlers.Clear();
 -
 -    nsCOMPtr<nsISupports> supports;
@@ -2266,61 +2266,61 @@ diff --git a/dom/src/base/nsGlobalWindow
 -                            getter_AddRefs(supports));
 -    NS_ASSERTION(supports, "Failed to QI to nsCycleCollectionISupports?!");
 -
 -    nsContentUtils::DropJSObjects(supports);
 -  }
  }
  
  void
-@@ -800,9 +784,6 @@ nsGlobalWindow::CleanUp()
+@@ -805,9 +789,6 @@ nsGlobalWindow::CleanUp()
  
    mOpener = nsnull;             // Forces Release
    if (mContext) {
 -#ifdef DEBUG
 -    nsCycleCollector_DEBUG_shouldBeFreed(mContext);
 -#endif
      mContext = nsnull;            // Forces Release
    }
    mChromeEventHandler = nsnull; // Forces Release
-@@ -826,10 +807,6 @@ nsGlobalWindow::CleanUp()
+@@ -831,10 +812,6 @@ nsGlobalWindow::CleanUp()
    mArgumentsLast = nsnull;
  
    CleanupCachedXBLHandlers(this);
 -
 -#ifdef DEBUG
 -  nsCycleCollector_DEBUG_shouldBeFreed(static_cast<nsIScriptGlobalObject*>(this));
 -#endif
  }
  
  void
-@@ -872,11 +849,6 @@ nsGlobalWindow::FreeInnerObjects(PRBool 
+@@ -877,11 +854,6 @@ nsGlobalWindow::FreeInnerObjects(PRBool 
      // Remember the document's principal.
      mDocumentPrincipal = mDoc->NodePrincipal();
    }
 -
 -#ifdef DEBUG
 -  if (mDocument)
 -    nsCycleCollector_DEBUG_shouldBeFreed(nsCOMPtr<nsISupports>(do_QueryInterface(mDocument)));
 -#endif
  
    // Make sure that this is called before we null out the document.
    NotifyDOMWindowDestroyed(this);
-@@ -915,10 +887,6 @@ nsGlobalWindow::FreeInnerObjects(PRBool 
+@@ -920,10 +892,6 @@ nsGlobalWindow::FreeInnerObjects(PRBool 
  #endif
  
    CleanupCachedXBLHandlers(this);
 -
 -#ifdef DEBUG
 -  nsCycleCollector_DEBUG_shouldBeFreed(static_cast<nsIScriptGlobalObject*>(this));
 -#endif
  }
  
  //*****************************************************************************
-@@ -955,125 +923,6 @@ NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUO
+@@ -960,125 +928,6 @@ NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUO
  NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUOUS(nsGlobalWindow,
                                             nsIScriptGlobalObject)
  
 -
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsGlobalWindow)
 -  if (tmp->mDoc && nsCCUncollectableMarker::InGeneration(
 -                     tmp->mDoc->GetMarkedCCGeneration())) {
 -    return NS_OK;
@@ -2436,28 +2436,28 @@ diff --git a/dom/src/base/nsGlobalWindow
 -
 -NS_IMPL_CYCLE_COLLECTION_ROOT_BEGIN(nsGlobalWindow)
 -  nsGlobalWindow::CleanupCachedXBLHandlers(tmp);
 -NS_IMPL_CYCLE_COLLECTION_ROOT_END
 -
  //*****************************************************************************
  // nsGlobalWindow::nsIScriptGlobalObject
  //*****************************************************************************
-@@ -2087,10 +1936,6 @@ nsGlobalWindow::SetDocShell(nsIDocShell*
+@@ -2096,10 +1945,6 @@ nsGlobalWindow::SetDocShell(nsIDocShell*
          mScriptContexts[st_ndx] = nsnull;
        }
      }
 -#ifdef DEBUG
 -    nsCycleCollector_DEBUG_shouldBeFreed(mContext);
 -    nsCycleCollector_DEBUG_shouldBeFreed(static_cast<nsIScriptGlobalObject*>(this));
 -#endif
      mContext = nsnull; // we nuked it above also
    }
  
-@@ -5720,26 +5565,6 @@ nsGlobalWindow::CacheXBLPrototypeHandler
+@@ -5861,26 +5706,6 @@ nsGlobalWindow::CacheXBLPrototypeHandler
      return;
    }
  
 -  if (!mCachedXBLPrototypeHandlers.Count()) {
 -    // Can't use macros to get the participant because nsGlobalChromeWindow also
 -    // runs through this code. Use QueryInterface to get the correct objects.
 -    nsXPCOMCycleCollectionParticipant* participant;
 -    CallQueryInterface(this, &participant);
@@ -2527,44 +2527,93 @@ diff --git a/dom/src/base/nsJSEnvironmen
      }
      return NS_OK;
    }
 -  nsJSContext::MaybeCC(higherProbability);
 +  nsJSContext::MaybeCC();
    return NS_OK;
  }
  
-@@ -1172,9 +1164,6 @@ nsJSContext::nsJSContext(JSRuntime *aRun
+@@ -842,22 +834,6 @@ PrintWinCodebase(nsGlobalWindow *win)
+ // The accumulated operation weight before we call MaybeGC
+ const PRUint32 MAYBE_GC_OPERATION_WEIGHT = 5000 * JS_OPERATION_WEIGHT_BASE;
+ 
+-static void
+-MaybeGC(JSContext *cx)
+-{
+-  size_t bytes = cx->runtime->gcBytes;
+-  size_t lastBytes = cx->runtime->gcLastBytes;
+-
+-  if ((bytes > 8192 && bytes / 16 > lastBytes)
+-#ifdef DEBUG
+-      || cx->runtime->gcZeal > 0
+-#endif
+-      ) {
+-    ++sGCCount;
+-    JS_GC(cx);
+-  }
+-}
+-
+ JSBool JS_DLL_CALLBACK
+ nsJSContext::DOMOperationCallback(JSContext *cx)
+ {
+@@ -875,7 +851,7 @@ nsJSContext::DOMOperationCallback(JSCont
+   // See bug 302333.
+   PRTime callbackTime = ctx->mOperationCallbackTime;
+ 
+-  MaybeGC(cx);
++  JS_MaybeGC(cx);
+ 
+   // Now restore the callback time and count, in case they got reset.
+   ctx->mOperationCallbackTime = callbackTime;
+@@ -1188,9 +1164,6 @@ nsJSContext::nsJSContext(JSRuntime *aRun
  
  nsJSContext::~nsJSContext()
  {
 -#ifdef DEBUG
 -  nsCycleCollector_DEBUG_wasFreed(static_cast<nsIScriptContext*>(this));
 -#endif
    NS_PRECONDITION(!mTerminations, "Shouldn't have termination funcs by now");
  
    Unlink();
-@@ -1226,16 +1215,6 @@ nsJSContext::Unlink()
+@@ -1242,16 +1215,6 @@ nsJSContext::Unlink()
  }
  
  // QueryInterface implementation for nsJSContext
 -NS_IMPL_CYCLE_COLLECTION_CLASS(nsJSContext)
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsJSContext)
 -  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mGlobalWrapperRef)
 -  tmp->Unlink();
 -  tmp->mIsInitialized = PR_FALSE;
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsJSContext)
 -  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mGlobalWrapperRef)
 -  nsContentUtils::XPConnect()->NoteJSContext(tmp->mContext, cb);
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsJSContext)
    NS_INTERFACE_MAP_ENTRY(nsIScriptContext)
-@@ -3317,77 +3296,15 @@ nsJSContext::CC()
+@@ -3247,13 +3210,13 @@ nsJSContext::ScriptEvaluated(PRBool aTer
+   mNumEvaluations++;
+ 
+ #ifdef JS_GC_ZEAL
+-  if (mContext->runtime->gcZeal >= 2) {
+-    MaybeGC(mContext);
++  if (mContext->runtime->gc->greedy) {
++    JS_MaybeGC(mContext);
+   } else
+ #endif
+   if (mNumEvaluations > 20) {
+     mNumEvaluations = 0;
+-    MaybeGC(mContext);
++    JS_MaybeGC(mContext);
+   }
+ 
+   mOperationCallbackTime = LL_ZERO;
+@@ -3333,77 +3296,15 @@ nsJSContext::CC()
  nsJSContext::CC()
  {
    ++sCCollectCount;
 -#ifdef DEBUG_smaug
 -  printf("Will run cycle collector (%i), %lldms since previous.\n",
 -         sCCollectCount, (PR_Now() - sPreviousCCTime) / PR_USEC_PER_MSEC);
 -#endif
 -  sPreviousCCTime = PR_Now();
@@ -2637,37 +2686,37 @@ diff --git a/dom/src/base/nsJSEnvironmen
 -    }
 -#endif
 -  }
 -  return PR_FALSE;
 +  // add future call to NS_GetGC()->MaybeGC(true);
  }
  
  //static
-@@ -3395,7 +3312,7 @@ nsJSContext::CCIfUserInactive()
+@@ -3411,7 +3312,7 @@ nsJSContext::CCIfUserInactive()
  nsJSContext::CCIfUserInactive()
  {
    if (sUserIsActive) {
 -    MaybeCC(PR_TRUE);
 +    MaybeCC();
    } else {
      CC();
    }
-@@ -3598,10 +3515,6 @@ nsJSRuntime::Startup()
+@@ -3614,10 +3515,6 @@ nsJSRuntime::Startup()
    sCCollectCount = 0;
    sUserIsActive = PR_FALSE;
    sPreviousCCTime = 0;
 -  sCollectedObjectsCounts = 0;
 -  sGCCount = 0;
 -  sCCSuspectChanges = 0;
 -  sCCSuspectedCount = 0;
    sGCTimer = nsnull;
    sReadyForGC = PR_FALSE;
    sLoadInProgressGCTimer = PR_FALSE;
-@@ -3916,27 +3829,6 @@ nsJSArgArray::ReleaseJSObjects()
+@@ -3932,27 +3829,6 @@ nsJSArgArray::ReleaseJSObjects()
  }
  
  // QueryInterface implementation for nsJSArgArray
 -NS_IMPL_CYCLE_COLLECTION_CLASS(nsJSArgArray)
 -NS_IMPL_CYCLE_COLLECTION_ROOT_BEGIN(nsJSArgArray)
 -  tmp->ReleaseJSObjects();
 -NS_IMPL_CYCLE_COLLECTION_ROOT_END
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_0(nsJSArgArray)
@@ -3068,17 +3117,17 @@ diff --git a/js/src/xpconnect/src/nsXPCo
 -
 -            gDidCollection = PR_TRUE;
 -            gInCollection = nsCycleCollector_beginCollection();
 -        }
 -
 -        // Mark JS objects that are held by XPCOM objects that are in cycles
 -        // that will not be collected.
 -        nsXPConnect::GetRuntime()->
--            TraceXPConnectRoots(cx->runtime->gc->GetTracer());
+-            TraceXPConnectRoots(cx->runtime->gcMarkingTracer);
 -    }
 -    else if(status == JSGC_END)
 -    {
 -        if(gInCollection)
 -        {
 -            gInCollection = PR_FALSE;
 -            gCollected = nsCycleCollector_finishCollection();
 -        }
--- a/success-macros.patch
+++ b/success-macros.patch
@@ -1,27 +1,33 @@
 diff --git a/xpcom/base/nsError.h b/xpcom/base/nsError.h
 --- a/xpcom/base/nsError.h
 +++ b/xpcom/base/nsError.h
-@@ -112,8 +112,21 @@
+@@ -112,18 +112,21 @@
   * @return 0 or 1
   */
  
--#define NS_FAILED(_nsresult) (NS_UNLIKELY((_nsresult) & 0x80000000))
--#define NS_SUCCEEDED(_nsresult) (NS_LIKELY(!((_nsresult) & 0x80000000)))
+-#if defined(NS_STATIC_CHECKING) && defined(__cplusplus)
+-inline int NS_FAILED(nsresult _nsresult) {
+-  return _nsresult & 0x80000000;
 +#if !defined(__cplusplus) && defined(_MSC_VER)
 +#define NS_INLINE __inline
 +#else
 +#define NS_INLINE inline
 +#endif
 +
 +NS_INLINE PRBool NS_FAILED(nsresult _nsresult)
 +{
 +  return !!(_nsresult & 0x80000000);
-+}
-+
+ }
+ 
+-inline int NS_SUCCEEDED(nsresult _nsresult) {
 +NS_INLINE PRBool NS_SUCCEEDED(nsresult _nsresult)
 +{
-+  return !(_nsresult & 0x80000000);
-+}
+   return !(_nsresult & 0x80000000);
+ }
+-#else
+-#define NS_FAILED(_nsresult) (NS_UNLIKELY((_nsresult) & 0x80000000))
+-#define NS_SUCCEEDED(_nsresult) (NS_LIKELY(!((_nsresult) & 0x80000000)))
+-#endif
  
  /**
   * @name Severity Code.  This flag identifies the level of warning
--- a/xpcomproxy-gcalloc.patch
+++ b/xpcomproxy-gcalloc.patch
@@ -170,60 +170,60 @@ diff --git a/xpcom/proxy/src/nsProxyEven
          
 -    *fullParam = (nsXPTCVariant*)malloc(sizeof(nsXPTCVariant) * paramCount);
 +    *fullParam = static_cast<nsXPTCVariant*>(
 +        NS_GetGC()->Alloc(sizeof(nsXPTCVariant) * paramCount,
 +                          MMgc::GC::kContainsPointers));
      
      if (*fullParam == nsnull)
          return NS_ERROR_OUT_OF_MEMORY;
-@@ -115,7 +110,6 @@ nsProxyEventObject::convertMiniVariantTo
-         if ((GetProxyType() & NS_PROXY_ASYNC) && paramInfo.IsDipper())
+@@ -116,7 +111,6 @@ nsProxyEventObject::convertMiniVariantTo
+             (paramInfo.IsOut() || paramInfo.IsDipper()))
          {
              NS_WARNING("Async proxying of out parameters is not supported"); 
 -            free(*fullParam);
              return NS_ERROR_PROXY_INVALID_OUT_PARAMETER;
          }
          uint8 flags = paramInfo.IsOut() ? nsXPTCVariant::PTR_IS_DATA : 0;
-@@ -125,7 +119,7 @@ nsProxyEventObject::convertMiniVariantTo
+@@ -126,7 +120,7 @@ nsProxyEventObject::convertMiniVariantTo
      return NS_OK;
  }
  
 -class nsProxyThreadFilter : public nsIThreadEventFilter
 +class nsProxyThreadFilter : public XPCOMGCFinalizedObject, public nsIThreadEventFilter
  {
  public:
      NS_DECL_ISUPPORTS
-@@ -146,8 +140,8 @@ nsProxyThreadFilter::AcceptEvent(nsIRunn
+@@ -147,8 +141,8 @@ nsProxyThreadFilter::AcceptEvent(nsIRunn
      // we want to allow the event to be dispatched to the thread's event queue
      // for processing later once we complete the current sync method call.
      
 -    nsRefPtr<nsProxyObjectCallInfo> poci;
 -    event->QueryInterface(kFilterIID, getter_AddRefs(poci));
 +    nsProxyObjectCallInfo* poci = nsnull;
 +    event->QueryInterface(kFilterIID, (void**)&poci);
      return poci && poci->IsSync();
  }
  
-@@ -180,12 +174,12 @@ nsProxyEventObject::CallMethod(PRUint16 
+@@ -181,12 +175,12 @@ nsProxyEventObject::CallMethod(PRUint16 
                                paramCount, fullParam);
  
          if (fullParam)
 -            free(fullParam);
 +            NS_GetGC()->Free(fullParam);
  
          return rv;
      }
  
 -    nsRefPtr<nsProxyObjectCallInfo> proxyInfo =
 +    nsProxyObjectCallInfo* proxyInfo =
          new nsProxyObjectCallInfo(this, methodInfo, methodIndex,
                                    fullParam, paramCount);
      if (!proxyInfo)
-@@ -198,12 +192,12 @@ nsProxyEventObject::CallMethod(PRUint16 
+@@ -199,12 +193,12 @@ nsProxyEventObject::CallMethod(PRUint16 
      // Post synchronously
  
      nsIThread *thread = NS_GetCurrentThread();
 -    nsCOMPtr<nsIThreadInternal> threadInt = do_QueryInterface(thread);
 +    nsIThreadInternal* threadInt = do_QueryInterface(thread);
      NS_ENSURE_STATE(threadInt);
  
      // Install  thread filter to limit event processing only to 
--- a/xpconnect-allocations
+++ b/xpconnect-allocations
@@ -1,160 +1,177 @@
 * * *
 
 diff --git a/js/src/xpconnect/src/XPCCrossOriginWrapper.cpp b/js/src/xpconnect/src/XPCCrossOriginWrapper.cpp
 --- a/js/src/xpconnect/src/XPCCrossOriginWrapper.cpp
 +++ b/js/src/xpconnect/src/XPCCrossOriginWrapper.cpp
-@@ -862,6 +862,10 @@ JS_STATIC_DLL_CALLBACK(void)
+@@ -41,7 +41,6 @@
+ #include "nsDOMError.h"
+ #include "jsdbgapi.h"
+ #include "jsobj.h"    // For OBJ_GET_PROPERTY.
+-#include "jscntxt.h"  // For JSAutoTempValueRooter.
+ #include "XPCWrapper.h"
+ #include "nsIDOMWindow.h"
+ #include "nsIDOMWindowCollection.h"
+@@ -903,6 +902,10 @@ JS_STATIC_DLL_CALLBACK(void)
  JS_STATIC_DLL_CALLBACK(void)
  XPC_XOW_Finalize(JSContext *cx, JSObject *obj)
  {
 +  // TODO: I know that this is a JSAPI finalizer and not an MMgc finalizer, but
 +  // it seems that it accesses all kinds of things that may have already
 +  // been finalized. TODO bsmedberg
 +
    JSObject *wrappedObj = GetWrappedObject(cx, obj);
    if (!wrappedObj) {
      return;
+@@ -1125,8 +1128,6 @@ XPC_XOW_Iterator(JSContext *cx, JSObject
+     return nsnull;
+   }
+ 
+-  JSAutoTempValueRooter tvr(cx, OBJECT_TO_JSVAL(wrapperIter));
+-
+   // Initialize our XOW.
+   jsval v = OBJECT_TO_JSVAL(wrappedObj);
+   if (!JS_SetReservedSlot(cx, wrapperIter, XPCWrapper::sWrappedObjSlot, v) ||
 diff --git a/js/src/xpconnect/src/nsXPConnect.cpp b/js/src/xpconnect/src/nsXPConnect.cpp
 --- a/js/src/xpconnect/src/nsXPConnect.cpp
 +++ b/js/src/xpconnect/src/nsXPConnect.cpp
-@@ -178,7 +178,6 @@ nsXPConnect::GetXPConnect()
+@@ -181,7 +181,6 @@ nsXPConnect::GetXPConnect()
          {
              // Initial extra ref to keep the singleton alive
              // balanced by explicit call to ReleaseXPConnectSingleton()
 -            NS_ADDREF(gSelf);
              if (NS_FAILED(NS_SetGlobalThreadObserver(gSelf))) {
                  NS_RELEASE(gSelf);
                  // Fall through to returning null
-@@ -193,7 +192,6 @@ nsXPConnect::GetSingleton()
+@@ -196,7 +195,6 @@ nsXPConnect::GetSingleton()
  nsXPConnect::GetSingleton()
  {
      nsXPConnect* xpc = nsXPConnect::GetXPConnect();
 -    NS_IF_ADDREF(xpc);
      return xpc;
  }
  
-@@ -254,7 +252,6 @@ nsXPConnect::GetInterfaceInfoManager(nsI
+@@ -257,7 +255,6 @@ nsXPConnect::GetInterfaceInfoManager(nsI
          return NS_ERROR_FAILURE;
  
      *iim = xpc->mInterfaceInfoManager;
 -    NS_IF_ADDREF(*iim);
      return NS_OK;
  }
  
-@@ -269,7 +266,6 @@ nsXPConnect::GetContextStack(nsIThreadJS
+@@ -272,7 +269,6 @@ nsXPConnect::GetContextStack(nsIThreadJS
          return NS_ERROR_FAILURE;
  
      *stack = temp = xpc->mContextStack;
 -    NS_IF_ADDREF(temp);
      return NS_OK;
  }
  
-@@ -574,7 +570,7 @@ nsXPConnect::InitClassesWithNewWrappedGl
+@@ -577,7 +573,7 @@ nsXPConnect::InitClassesWithNewWrappedGl
      if (!XPC_SJOW_AttachNewConstructorObject(ccx, globalJSObj))
          return UnexpectedFailure(NS_ERROR_FAILURE);
  
 -    NS_ADDREF(*_retval = holder);
 +    *_retval = holder;
  
      return NS_OK;
  }
-@@ -682,7 +678,6 @@ nsXPConnect::GetWrappedNativeOfJSObject(
+@@ -685,7 +681,6 @@ nsXPConnect::GetWrappedNativeOfJSObject(
          XPCWrappedNative::GetWrappedNativeOfJSObject(aJSContext, aJSObj);
      if(wrapper)
      {
 -        NS_ADDREF(wrapper);
          *_retval = wrapper;
          return NS_OK;
      }
-@@ -715,7 +710,7 @@ nsXPConnect::GetWrappedNativeOfNativeObj
+@@ -718,7 +713,7 @@ nsXPConnect::GetWrappedNativeOfNativeObj
      if(!scope)
          return UnexpectedFailure(NS_ERROR_FAILURE);
  
 -    AutoMarkingNativeInterfacePtr iface(ccx);
 +    XPCNativeInterface* iface;
      iface = XPCNativeInterface::GetNewOrUsed(ccx, &aIID);
      if(!iface)
          return NS_ERROR_FAILURE;
-@@ -887,7 +882,6 @@ nsXPConnect::SetSecurityManagerForJSCont
+@@ -890,7 +885,6 @@ nsXPConnect::SetSecurityManagerForJSCont
  
      XPCContext* xpcc = ccx.GetXPCContext();
  
 -    NS_IF_ADDREF(aManager);
      nsIXPCSecurityManager* oldManager = xpcc->GetSecurityManager();
      NS_IF_RELEASE(oldManager);
  
-@@ -913,7 +907,6 @@ nsXPConnect::GetSecurityManagerForJSCont
+@@ -916,7 +910,6 @@ nsXPConnect::GetSecurityManagerForJSCont
      XPCContext* xpcc = ccx.GetXPCContext();
  
      nsIXPCSecurityManager* manager = xpcc->GetSecurityManager();
 -    NS_IF_ADDREF(manager);
      *aManager = manager;
      *flags = xpcc->GetSecurityManagerFlags();
      return NS_OK;
-@@ -924,7 +917,6 @@ nsXPConnect::SetDefaultSecurityManager(n
+@@ -927,7 +920,6 @@ nsXPConnect::SetDefaultSecurityManager(n
  nsXPConnect::SetDefaultSecurityManager(nsIXPCSecurityManager *aManager,
                                         PRUint16 flags)
  {
 -    NS_IF_ADDREF(aManager);
      NS_IF_RELEASE(mDefaultSecurityManager);
      mDefaultSecurityManager = aManager;
      mDefaultSecurityManagerFlags = flags;
-@@ -947,7 +939,6 @@ nsXPConnect::GetDefaultSecurityManager(n
+@@ -950,7 +942,6 @@ nsXPConnect::GetDefaultSecurityManager(n
      NS_ASSERTION(aManager, "bad param");
      NS_ASSERTION(flags, "bad param");
  
 -    NS_IF_ADDREF(mDefaultSecurityManager);
      *aManager = mDefaultSecurityManager;
      *flags = mDefaultSecurityManagerFlags;
      return NS_OK;
-@@ -998,7 +989,7 @@ nsXPConnect::GetCurrentJSStack(nsIStackF
+@@ -1001,7 +992,7 @@ nsXPConnect::GetCurrentJSStack(nsIStackF
              {
                  stack = caller;
              }
 -            NS_IF_ADDREF(*aCurrentJSStack = stack);
 +            *aCurrentJSStack = stack;
          }
      }
      return NS_OK;
-@@ -1076,7 +1067,6 @@ nsXPConnect::SetFunctionThisTranslator(c
+@@ -1079,7 +1070,6 @@ nsXPConnect::SetFunctionThisTranslator(c
          if(_retval)
          {
              old = map->Find(aIID);
 -            NS_IF_ADDREF(old);
              *_retval = old;
          }
          map->Add(aIID, aTranslator);
-@@ -1099,7 +1089,6 @@ nsXPConnect::GetFunctionThisTranslator(c
+@@ -1102,7 +1092,6 @@ nsXPConnect::GetFunctionThisTranslator(c
      {
          XPCAutoLock lock(rt->GetMapLock()); // scoped lock
          old = map->Find(aIID);
 -        NS_IF_ADDREF(old);
          *_retval = old;
      }
      return NS_OK;
-@@ -1242,7 +1231,6 @@ nsXPConnect::CreateSandbox(JSContext *cx
+@@ -1245,7 +1234,6 @@ nsXPConnect::CreateSandbox(JSContext *cx
          *_retval = XPCJSObjectHolder::newHolder(ccx, JSVAL_TO_OBJECT(rval));
          NS_ENSURE_TRUE(*_retval, NS_ERROR_OUT_OF_MEMORY);
  
 -        NS_ADDREF(*_retval);
      }
  
      return rv;
-@@ -1306,7 +1294,7 @@ nsXPConnect::GetWrappedNativePrototype(J
+@@ -1309,7 +1297,7 @@ nsXPConnect::GetWrappedNativePrototype(J
      XPCNativeScriptableCreateInfo sciProto;
      XPCWrappedNative::GatherProtoScriptableCreateInfo(aClassInfo, &sciProto);
  
 -    AutoMarkingWrappedNativeProtoPtr proto(ccx);
 +    XPCWrappedNativeProto* proto;
      proto = XPCWrappedNativeProto::GetNewOrUsed(ccx, scope, aClassInfo, 
                                                  &sciProto, JS_FALSE,
                                                  OBJ_IS_NOT_GLOBAL);
-@@ -1319,7 +1307,6 @@ nsXPConnect::GetWrappedNativePrototype(J
+@@ -1322,7 +1310,6 @@ nsXPConnect::GetWrappedNativePrototype(J
      if(!holder)
          return UnexpectedFailure(NS_ERROR_FAILURE);
  
 -    NS_ADDREF(holder);
      return NS_OK;
  }
  
 diff --git a/js/src/xpconnect/src/xpccomponents.cpp b/js/src/xpconnect/src/xpccomponents.cpp
@@ -366,41 +383,41 @@ diff --git a/js/src/xpconnect/src/xpccon
          if(!xpcscope)
              return JS_FALSE;
  
 -        AutoMarkingNativeInterfacePtr iface(ccx);
 +        XPCNativeInterface* iface;
          iface = XPCNativeInterface::GetNewOrUsed(ccx, iid);
          if(!iface)
              return JS_FALSE;
-@@ -1238,7 +1238,6 @@ XPCConvert::NativeInterface2JSObject(XPC
+@@ -1256,7 +1256,6 @@ XPCConvert::NativeInterface2JSObject(XPC
                      return JS_FALSE;
                  }
  
 -                NS_ADDREF(objHolder);
                  NS_RELEASE(wrapper);
                  *dest = objHolder;
                  return JS_TRUE;
-@@ -1289,7 +1288,6 @@ XPCConvert::JSObject2NativeInterface(XPC
+@@ -1307,7 +1306,6 @@ XPCConvert::JSObject2NativeInterface(XPC
              // is the underlying object the right interface?
              if(wrappedNative->GetIID().Equals(*iid))
              {
 -                NS_ADDREF(iface);
                  *dest = iface;
                  return JS_TRUE;
              }
-@@ -1409,7 +1407,6 @@ XPCConvert::JSValToXPCException(XPCCallC
+@@ -1427,7 +1425,6 @@ XPCConvert::JSValToXPCException(XPCCallC
              {
                  // just pass through the exception (with extra ref and all)
                  nsIException* temp = iface;
 -                NS_ADDREF(temp);
                  *exceptn = temp;
                  return NS_OK;
              }
-@@ -1585,7 +1582,6 @@ XPCConvert::JSErrorToXPCException(XPCCal
+@@ -1603,7 +1600,6 @@ XPCConvert::JSErrorToXPCException(XPCCal
          if(!data)
              return NS_ERROR_OUT_OF_MEMORY;
  
 -        NS_ADDREF(data);
          data->Init(bestMessage.get(),
                     NS_ConvertASCIItoUTF16(report->filename).get(),
                     (const PRUnichar *)report->uclinebuf, report->lineno,
 diff --git a/js/src/xpconnect/src/xpcinlines.h b/js/src/xpconnect/src/xpcinlines.h
@@ -687,17 +704,17 @@ diff --git a/js/src/xpconnect/src/xpcjsr
 -    XPCWrappedNativeProto* proto = 
 -        (XPCWrappedNativeProto*)((JSDHashEntryStub*)hdr)->key;
 -
 -    proto->Mark();
 -    return JS_DHASH_NEXT;
  }
  
  // GCCallback calls are chained
-@@ -283,24 +222,6 @@ JSBool XPCJSRuntime::GCCallback(JSContex
+@@ -285,24 +224,6 @@ JSBool XPCJSRuntime::GCCallback(JSContex
                      self->mThreadRunningGC = PR_GetCurrentThread();
                  }
  
 -                dyingWrappedJSArray = &self->mWrappedJSToReleaseArray;
 -
 -                {
 -                    JSDyingJSObjectData data = {cx, dyingWrappedJSArray};
 -
@@ -712,44 +729,44 @@ diff --git a/js/src/xpconnect/src/xpcjsr
 -                    self->mWrappedJSMap->
 -                        Enumerate(WrappedJSDyingJSObjectFinder, &data);
 -#endif
 -                }
 -
                  // Do cleanup in NativeInterfaces. This part just finds 
                  // member cloned function objects that are about to be 
                  // collected. It does not deal with collection of interfaces or
-@@ -310,7 +231,9 @@ JSBool XPCJSRuntime::GCCallback(JSContex
+@@ -312,7 +233,9 @@ JSBool XPCJSRuntime::GCCallback(JSContex
                  self->mIID2NativeInterfaceMap->
                      Enumerate(NativeInterfaceGC, &data);
  
 -                // Find dying scopes...
 +                self->mNativeSetMap->
 +                    Enumerate(NativeSetGC, nsnull);
 +
                  XPCWrappedNativeScope::FinishedMarkPhaseOfGC(cx, self);
  
                  self->mDoingFinalization = JS_TRUE;
-@@ -347,15 +270,6 @@ JSBool XPCJSRuntime::GCCallback(JSContex
+@@ -349,15 +272,6 @@ JSBool XPCJSRuntime::GCCallback(JSContex
                  int ifacesBefore = (int) self->mIID2NativeInterfaceMap->Count();
  #endif
  
 -                // We use this occasion to mark and sweep NativeInterfaces,
 -                // NativeSets, and the WrappedNativeJSClasses...
 -
 -                // Do the marking...
 -                XPCWrappedNativeScope::MarkAllWrappedNativesAndProtos();
 -
 -                self->mDetachedWrappedNativeProtoMap->
 -                    Enumerate(DetachedWrappedNativeProtoMarker, nsnull);
 -
                  // Mark the sets used in the call contexts. There is a small
                  // chance that a wrapper's set will change *while* a call is
                  // happening which uses that wrapper's old interfface set. So,
-@@ -380,28 +294,6 @@ JSBool XPCJSRuntime::GCCallback(JSContex
+@@ -382,28 +296,6 @@ JSBool XPCJSRuntime::GCCallback(JSContex
                          {
                              // Mark those AutoMarkingPtr lists!
                              thread->MarkAutoRootsAfterJSFinalize();
 -
 -                            XPCCallContext* ccxp = thread->GetCallContext();
 -                            while(ccxp)
 -                            {
 -                                // Deal with the strictness of callcontext that
@@ -768,17 +785,17 @@ diff --git a/js/src/xpconnect/src/xpcjsr
 -                                    if(iface)
 -                                        iface->Mark();
 -                                }
 -                                ccxp = ccxp->GetPrevCallContext();
 -                            }
                          }
                      }
                  }
-@@ -420,18 +312,6 @@ JSBool XPCJSRuntime::GCCallback(JSContex
+@@ -422,18 +314,6 @@ JSBool XPCJSRuntime::GCCallback(JSContex
                  self->mClassInfo2NativeSetMap->
                      Enumerate(NativeUnMarkedSetRemover, nsnull);
  
 -                self->mNativeSetMap->
 -                    Enumerate(NativeSetSweeper, nsnull);
 -
 -                CX_AND_XPCRT_Data data = {cx, self};
 -
@@ -787,17 +804,17 @@ diff --git a/js/src/xpconnect/src/xpcjsr
 -
 -#ifdef DEBUG
 -                XPCWrappedNativeScope::ASSERT_NoInterfaceSetsAreMarked();
 -#endif
 -
  #ifdef XPC_REPORT_NATIVE_INTERFACE_AND_SET_FLUSHING
                  int setsAfter = (int) self->mNativeSetMap->Count();
                  int ifacesAfter = (int) self->mIID2NativeInterfaceMap->Count();
-@@ -443,81 +323,6 @@ JSBool XPCJSRuntime::GCCallback(JSContex
+@@ -445,81 +325,6 @@ JSBool XPCJSRuntime::GCCallback(JSContex
                         ifacesBefore, ifacesBefore - ifacesAfter, ifacesAfter);
                  printf("--------------------------------------------------------------\n");
  #endif
 -
 -                // Sweep scopes needing cleanup
 -                XPCWrappedNativeScope::FinishedFinalizationPhaseOfGC(cx);
 -
 -                // Now we are going to recycle any unused WrappedNativeTearoffs.
@@ -869,17 +886,17 @@ diff --git a/js/src/xpconnect/src/xpcjsr
 -                // So, we can safely delete all the protos in the list.
 -
 -                self->mDyingWrappedNativeProtoMap->
 -                    Enumerate(DyingProtoKiller, nsnull);
 -
  
                  // mThreadRunningGC indicates that GC is running.
                  // Clear it and notify waiters.
-@@ -532,35 +337,6 @@ JSBool XPCJSRuntime::GCCallback(JSContex
+@@ -534,35 +339,6 @@ JSBool XPCJSRuntime::GCCallback(JSContex
              }
              case JSGC_END:
              {
 -                // NOTE that this event happens outside of the gc lock in
 -                // the js engine. So this could be simultaneous with the
 -                // events above.
 -
 -                // Do any deferred released of native objects.
@@ -905,29 +922,29 @@ diff --git a/js/src/xpconnect/src/xpcjsr
 -                    NS_RELEASE(obj);
 -                }
 -#ifdef XPC_TRACK_DEFERRED_RELEASES
 -                printf("XPC - End deferred Releases\n");
 -#endif
                  break;
              }
              default:
-@@ -797,11 +573,6 @@ XPCJSRuntime::XPCJSRuntime(nsXPConnect* 
+@@ -799,11 +575,6 @@ XPCJSRuntime::XPCJSRuntime(nsXPConnect* 
      // these jsids filled in later when we have a JSContext to work with.
      mStrIDs[0] = 0;
  
 -    if(mJSRuntimeService)
 -    {
 -        NS_ADDREF(mJSRuntimeService);
 -    }
 -
      NS_ASSERTION(!gOldJSGCCallback, "XPCJSRuntime created more than once");
      gOldJSContextCallback = JS_SetContextCallback(gJSRuntime,
                                                    ContextCallback);
-@@ -967,21 +738,6 @@ XPCJSRuntime::GenerateStringIDs(JSContex
+@@ -969,21 +740,6 @@ XPCJSRuntime::GenerateStringIDs(JSContex
          mStrJSVals[i] = STRING_TO_JSVAL(str);
      }
      return JS_TRUE;
 -}
 -
 -JSBool
 -XPCJSRuntime::DeferredRelease(nsISupports* obj)
 -{
@@ -1034,86 +1051,86 @@ diff --git a/js/src/xpconnect/src/xpcmap
 +
 +    return JS_DHASH_REMOVE;
 +}
 +
  /***************************************************************************/
 diff --git a/js/src/xpconnect/src/xpcmaps.h b/js/src/xpconnect/src/xpcmaps.h
 --- a/js/src/xpconnect/src/xpcmaps.h
 +++ b/js/src/xpconnect/src/xpcmaps.h
-@@ -207,6 +207,11 @@ public:
+@@ -214,6 +214,11 @@ public:
          JS_DHashTableOperate(mTable, wrapper->GetIdentityObject(), JS_DHASH_REMOVE);
      }
  
 +    inline void UnmapDyingNatives()
 +    {
 +        JS_DHashTableEnumerate(mTable, DyingUnmapper, nsnull);
 +    }
 +
      inline uint32 Count() {return mTable->entryCount;}
      inline uint32 Enumerate(JSDHashEnumerator f, void *arg)
          {return JS_DHashTableEnumerate(mTable, f, arg);}
-@@ -215,6 +220,11 @@ private:
+@@ -222,6 +227,11 @@ private:
  private:
      Native2WrappedNativeMap();    // no implementation
      Native2WrappedNativeMap(int size);
 +
 +    static JSDHashOperator DyingUnmapper(JSDHashTable *table,
 +                                         JSDHashEntryHdr *hdr,
 +                                         uint32 number,
 +                                         void *arg);
  private:
      JSDHashTable *mTable;
  };
-@@ -429,6 +439,11 @@ public:
+@@ -436,6 +446,11 @@ public:
          JS_DHashTableOperate(mTable, info, JS_DHASH_REMOVE);
      }
  
 +    inline void UnmapDyingNatives()
 +    {
 +        JS_DHashTableEnumerate(mTable, DyingUnmapper, nsnull);
 +    }
 +
      inline uint32 Count() {return mTable->entryCount;}
      inline uint32 Enumerate(JSDHashEnumerator f, void *arg)
          {return JS_DHashTableEnumerate(mTable, f, arg);}
-@@ -437,6 +452,12 @@ private:
+@@ -444,6 +459,12 @@ private:
  private:
      ClassInfo2WrappedNativeProtoMap();    // no implementation
      ClassInfo2WrappedNativeProtoMap(int size);
 +
 +    static JSDHashOperator DyingUnmapper(JSDHashTable *table,
 +                                         JSDHashEntryHdr *hdr,
 +                                         uint32 number,
 +                                         void *arg);
 +
  private:
      JSDHashTable *mTable;
  };
-@@ -549,7 +570,6 @@ public:
+@@ -556,7 +577,6 @@ public:
              JS_DHashTableOperate(mTable, &iid, JS_DHASH_ADD);
          if(!entry)
              return nsnull;
 -        NS_IF_ADDREF(obj);
          NS_IF_RELEASE(entry->value);
          entry->value = obj;
          entry->key = iid;
-@@ -743,6 +763,11 @@ public:
+@@ -750,6 +770,11 @@ public:
          JS_DHashTableOperate(mTable, wrapper, JS_DHASH_REMOVE);
      }
  
 +    inline void UnmapDyingNatives()
 +    {
 +        JS_DHashTableEnumerate(mTable, DyingUnmapper, nsnull);
 +    }
 +
      inline uint32 Count() {return mTable->entryCount;}
      inline uint32 Enumerate(JSDHashEnumerator f, void *arg)
          {return JS_DHashTableEnumerate(mTable, f, arg);}
-@@ -753,6 +778,10 @@ private:
+@@ -760,6 +785,10 @@ private:
      WrappedNative2WrapperMap();    // no implementation
      WrappedNative2WrapperMap(int size);
  
 +    static JSDHashOperator DyingUnmapper(JSDHashTable *table,
 +                                         JSDHashEntryHdr *hdr,
 +                                         uint32 number,
 +                                         void *arg);
  private:
@@ -1127,81 +1144,81 @@ diff --git a/js/src/xpconnect/src/xpcpri
  const PRBool OBJ_IS_NOT_GLOBAL = PR_FALSE;
  
 -class nsXPConnect : public nsIXPConnect,
 +class nsXPConnect : public XPCOMGCFinalizedObject,
 +                    public nsIXPConnect,
                      public nsIThreadObserver,
                      public nsSupportsWeakReference
  {
-@@ -611,8 +612,6 @@ public:
+@@ -617,8 +618,6 @@ public:
      XPCContext* GetXPCContext(JSContext* cx);
      XPCContext* SyncXPCContextList(JSContext* cx = nsnull);
  
 -    JSBool DeferredRelease(nsISupports* obj);
 -
      JSBool GetDoingFinalization() const {return mDoingFinalization;}
  
      // Mapping of often used strings to jsid atoms that live 'forever'.
-@@ -777,13 +776,11 @@ public:
+@@ -783,13 +782,11 @@ public:
  
      nsresult GetException(nsIException** e)
          {
 -            NS_IF_ADDREF(mException);
              *e = mException;
              return NS_OK;
          }
      void SetException(nsIException* e)
          {
 -            NS_IF_ADDREF(e);
              NS_IF_RELEASE(mException);
              mException = e;
          }
-@@ -826,8 +823,6 @@ public:
+@@ -832,8 +829,6 @@ public:
          }
  
      void DebugDump(PRInt16 depth);
 -    void AddScope(PRCList *scope) { PR_INSERT_AFTER(scope, &mScopes); }
 -    void RemoveScope(PRCList *scope) { PR_REMOVE_LINK(scope); }
  
      ~XPCContext();
  
-@@ -845,9 +840,6 @@ private:
+@@ -851,9 +846,6 @@ private:
      LangType mCallingLangType;
      PRUint16 mSecurityManagerFlags;
      JSPackedBool mMarked;
 -
 -    // A linked list of scopes to notify when we are destroyed.
 -    PRCList mScopes;
  };
  
  /***************************************************************************/
-@@ -1149,7 +1141,7 @@ xpc_TraceForValidWrapper(JSTracer *trc, 
+@@ -1155,7 +1147,7 @@ xpc_TraceForValidWrapper(JSTracer *trc, 
  /***************************************************************************/
  // XPCWrappedNativeScope is one-to-one with a JS global object.
  
 -class XPCWrappedNativeScope : public PRCList
 +class XPCWrappedNativeScope : XPCOMGCFinalizedObject, MMgc::GCFinalizable
  {
  public:
  
-@@ -1194,6 +1186,12 @@ public:
+@@ -1200,6 +1192,12 @@ public:
  
      void RemoveWrappedNativeProtos();
  
 +    /**
 +     * Called at the end of marking: enumerates the wrappednatives in the map
 +     * and removes those which are about to be finalized.
 +     */
 +    inline void UnmapDyingNatives();
 +
      static XPCWrappedNativeScope*
      FindInJSObjectScope(XPCCallContext& ccx, JSObject* obj,
                          JSBool OKIfNotInitialized = JS_FALSE);
-@@ -1204,22 +1202,8 @@ public:
+@@ -1210,22 +1208,8 @@ public:
      static void
      FinishedMarkPhaseOfGC(JSContext* cx, XPCJSRuntime* rt);
  
 -    static void
 -    FinishedFinalizationPhaseOfGC(JSContext* cx);
 -
 -    static void
 -    MarkAllWrappedNativesAndProtos();
@@ -1214,64 +1231,64 @@ diff --git a/js/src/xpconnect/src/xpcpri
 -    ASSERT_NoInterfaceSetsAreMarked();
 -#endif
 -
 -    static void
 -    SweepAllWrappedNativeTearOffs();
  
      static void
      DebugDumpAllScopes(PRInt16 depth);