Started the laborious test/assert-crash/fix cycle... yuck
authorbenjamin@smedbergs.us
Mon, 12 Nov 2007 16:02:21 -0500
changeset 51 582be821e1d70635bcc04f7cb7ab588f2ddf464e
parent 50 e3f23db3ec2213343262434cb811173f1d3d5bfc
child 52 ebc8ffe5a3009a1c6c10c324d3e9066f18486d87
push id1
push userbsmedberg@mozilla.com
push dateTue, 15 Apr 2008 21:51:22 +0000
Started the laborious test/assert-crash/fix cycle... yuck
64bit
automatic-garburator.patch
compmgr-more
console-heapallocate
content-hashtables
disable-gc
embedding-print64
imgcache
jscomponentloader-gc2
layout-suck
layout-suck2
more-xptcall
pork-rules.mk
series
shell-loginit
uconverter-suck
new file mode 100644
--- /dev/null
+++ b/64bit
@@ -0,0 +1,24 @@
+diff --git a/configure.in b/configure.in
+--- a/configure.in
++++ b/configure.in
+@@ -7923,7 +7923,7 @@ unset CONFIG_FILES
+ 
+ export PYTHON
+ 
+-ac_configure_args="$_SUBDIR_CONFIG_ARGS --with-mmgc-shared"
++ac_configure_args="$_SUBDIR_CONFIG_ARGS --with-mmgc-shared --without-tamarin "
+ AC_OUTPUT_SUBDIRS(js/tamarin)
+ ac_configure_args="$_SUBDIR_CONFIG_ARGS"
+ 
+diff --git a/js/src/jsatom.h b/js/src/jsatom.h
+--- a/js/src/jsatom.h
++++ b/js/src/jsatom.h
+@@ -74,7 +74,7 @@ JS_STATIC_ASSERT(sizeof(JSAtom *) == JS_
+ #if JS_BYTES_PER_WORD == 4
+ # define ATOM_HASH(atom)          ((JSHashNumber)(atom) >> 2)
+ #elif JS_BYTES_PER_WORD == 8
+-# define ATOM_HASH(atom)          (((JSHashNumber)(atom) >> 3) ^              \
++# define ATOM_HASH(atom)          (((JSHashNumber)(jsuword)(atom) >> 3) ^ \
+                                    (JSHashNumber)((jsuword)(atom) >> 32))
+ #else
+ # error "Unsupported configuration"
--- a/automatic-garburator.patch
+++ b/automatic-garburator.patch
@@ -1,223 +1,223 @@
 diff --git a/accessible/src/atk/nsAccessibleWrap.cpp b/accessible/src/atk/nsAccessibleWrap.cpp
 --- a/accessible/src/atk/nsAccessibleWrap.cpp
 +++ b/accessible/src/atk/nsAccessibleWrap.cpp
 @@ -428,74 +428,74 @@ nsAccessibleWrap::CreateMaiInterfaces(vo
      }
  
      //nsIAccessibleText
 -    nsCOMPtr<nsIAccessibleText> accessInterfaceText;
-+    nsIAccessibleText* accessInterfaceText;
++    nsIAccessibleText* accessInterfaceText = nsnull;
      QueryInterface(NS_GET_IID(nsIAccessibleText),
 -                   getter_AddRefs(accessInterfaceText));
 +                   (void**)&accessInterfaceText);
      if (accessInterfaceText) {
          interfacesBits |= 1 << MAI_INTERFACE_TEXT;
      }
  
      //nsIAccessibleEditableText
 -    nsCOMPtr<nsIAccessibleEditableText> accessInterfaceEditableText;
-+    nsIAccessibleEditableText* accessInterfaceEditableText;
++    nsIAccessibleEditableText* accessInterfaceEditableText = nsnull;
      QueryInterface(NS_GET_IID(nsIAccessibleEditableText),
 -                   getter_AddRefs(accessInterfaceEditableText));
 +                   (void**)&accessInterfaceEditableText);
      if (accessInterfaceEditableText) {
          interfacesBits |= 1 << MAI_INTERFACE_EDITABLE_TEXT;
      }
  
      //nsIAccessibleValue
 -    nsCOMPtr<nsIAccessibleValue> accessInterfaceValue;
-+    nsIAccessibleValue* accessInterfaceValue;
++    nsIAccessibleValue* accessInterfaceValue = nsnull;
      QueryInterface(NS_GET_IID(nsIAccessibleValue),
 -                   getter_AddRefs(accessInterfaceValue));
 +                   (void**)&accessInterfaceValue);
      if (accessInterfaceValue) {
         interfacesBits |= 1 << MAI_INTERFACE_VALUE; 
      }
  
      //nsIAccessibleDocument
 -    nsCOMPtr<nsIAccessibleDocument> accessInterfaceDocument;
-+    nsIAccessibleDocument* accessInterfaceDocument;
++    nsIAccessibleDocument* accessInterfaceDocument = nsnull;
      QueryInterface(NS_GET_IID(nsIAccessibleDocument),
 -                              getter_AddRefs(accessInterfaceDocument));
 +                              (void**)&accessInterfaceDocument);
      if (accessInterfaceDocument) {
          interfacesBits |= 1 << MAI_INTERFACE_DOCUMENT;
      }
  
      //nsIAccessibleImage
 -    nsCOMPtr<nsIAccessibleImage> accessInterfaceImage;
-+    nsIAccessibleImage* accessInterfaceImage;
++    nsIAccessibleImage* accessInterfaceImage = nsnull;
      QueryInterface(NS_GET_IID(nsIAccessibleImage),
 -                              getter_AddRefs(accessInterfaceImage));
 +                              (void**)&accessInterfaceImage);
      if (accessInterfaceImage) {
          interfacesBits |= 1 << MAI_INTERFACE_IMAGE;
      }
  
      //nsIAccessibleHyperLink
 -    nsCOMPtr<nsIAccessibleHyperLink> accessInterfaceHyperlink;
-+    nsIAccessibleHyperLink* accessInterfaceHyperlink;
++    nsIAccessibleHyperLink* accessInterfaceHyperlink = nsnull;
      QueryInterface(NS_GET_IID(nsIAccessibleHyperLink),
 -                   getter_AddRefs(accessInterfaceHyperlink));
 +                   (void**)&accessInterfaceHyperlink);
      if (accessInterfaceHyperlink) {
         interfacesBits |= 1 << MAI_INTERFACE_HYPERLINK_IMPL;
      }
  
      if (!MustPrune(this)) {  // These interfaces require children
        //nsIAccessibleHypertext
 -      nsCOMPtr<nsIAccessibleHyperText> accessInterfaceHypertext;
-+      nsIAccessibleHyperText* accessInterfaceHypertext;
++      nsIAccessibleHyperText* accessInterfaceHypertext = nsnull;
        QueryInterface(NS_GET_IID(nsIAccessibleHyperText),
 -                     getter_AddRefs(accessInterfaceHypertext));
 +                     (void**)&accessInterfaceHypertext);
        if (accessInterfaceHypertext) {
            interfacesBits |= 1 << MAI_INTERFACE_HYPERTEXT;
        }
  
        //nsIAccessibleTable
 -      nsCOMPtr<nsIAccessibleTable> accessInterfaceTable;
-+      nsIAccessibleTable* accessInterfaceTable;
++      nsIAccessibleTable* accessInterfaceTable = nsnull;
        QueryInterface(NS_GET_IID(nsIAccessibleTable),
 -                     getter_AddRefs(accessInterfaceTable));
 +                     (void**)&accessInterfaceTable);
        if (accessInterfaceTable) {
            interfacesBits |= 1 << MAI_INTERFACE_TABLE;
        }
        
        //nsIAccessibleSelection
 -      nsCOMPtr<nsIAccessibleSelectable> accessInterfaceSelection;
-+      nsIAccessibleSelectable* accessInterfaceSelection;
++      nsIAccessibleSelectable* accessInterfaceSelection = nsnull;
        QueryInterface(NS_GET_IID(nsIAccessibleSelectable),
 -                     getter_AddRefs(accessInterfaceSelection));
 +                     (void**)&accessInterfaceSelection);
        if (accessInterfaceSelection) {
            interfacesBits |= 1 << MAI_INTERFACE_SELECTION;
        }
 @@ -788,8 +788,8 @@ GetAttributeSet(nsIAccessible* aAccessib
  GetAttributeSet(nsIAccessible* aAccessible)
  {
      AtkAttributeSet *objAttributeSet = nsnull;
 -    nsCOMPtr<nsIPersistentProperties> attributes;
 -    aAccessible->GetAttributes(getter_AddRefs(attributes));
-+    nsIPersistentProperties* attributes;
++    nsIPersistentProperties* attributes = nsnull;
 +    aAccessible->GetAttributes(&attributes);
      
      if (attributes) {
          // Deal with attributes that we only need to expose in ATK
 @@ -808,15 +808,15 @@ GetAttributeSet(nsIAccessible* aAccessib
                                          oldValueUnused);
          }
  
 -        nsCOMPtr<nsISimpleEnumerator> propEnum;
 -        nsresult rv = attributes->Enumerate(getter_AddRefs(propEnum));
-+        nsISimpleEnumerator* propEnum;
++        nsISimpleEnumerator* propEnum = nsnull;
 +        nsresult rv = attributes->Enumerate(&propEnum);
          NS_ENSURE_SUCCESS(rv, nsnull);
  
          PRBool hasMore;
          while (NS_SUCCEEDED(propEnum->HasMoreElements(&hasMore)) && hasMore) {
 -            nsCOMPtr<nsISupports> sup;
 -            rv = propEnum->GetNext(getter_AddRefs(sup));
 -            nsCOMPtr<nsIPropertyElement> propElem(do_QueryInterface(sup));
-+            nsISupports* sup;
++            nsISupports* sup = nsnull;
 +            rv = propEnum->GetNext(&sup);
 +            nsIPropertyElement* propElem(do_QueryInterface(sup));
              NS_ENSURE_TRUE(propElem, nsnull);
  
              nsCAutoString name;
 @@ -854,8 +854,8 @@ getParentCB(AtkObject *aAtkObj)
              return nsnull;
          }
  
 -        nsCOMPtr<nsIAccessible> accParent;
 -        nsresult rv = accWrap->GetParent(getter_AddRefs(accParent));
-+        nsIAccessible* accParent;
++        nsIAccessible* accParent = nsnull;
 +        nsresult rv = accWrap->GetParent(&accParent);
          if (NS_FAILED(rv) || !accParent)
              return nsnull;
  
 @@ -874,15 +874,15 @@ getChildCountCB(AtkObject *aAtkObj)
      }
  
      PRInt32 count = 0;
 -    nsCOMPtr<nsIAccessibleHyperText> hyperText;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleHyperText), getter_AddRefs(hyperText));
-+    nsIAccessibleHyperText* hyperText;
++    nsIAccessibleHyperText* hyperText = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleHyperText), (void**)&hyperText);
      if (hyperText) {
          // If HyperText, then number of links matches number of children
          hyperText->GetLinks(&count);
      }
      else {
 -        nsCOMPtr<nsIAccessibleText> accText;
 -        accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText), getter_AddRefs(accText));
-+        nsIAccessibleText* accText;
++        nsIAccessibleText* accText = nsnull;
 +        accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText), (void**)&accText);
          if (!accText) {    // Accessible text that is not a HyperText has no children
              accWrap->GetChildCount(&count);
          }
 @@ -907,20 +907,20 @@ refChildCB(AtkObject *aAtkObj, gint aChi
          return nsnull;
      }
  
 -    nsCOMPtr<nsIAccessible> accChild;
 -    nsCOMPtr<nsIAccessibleHyperText> hyperText;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleHyperText), getter_AddRefs(hyperText));
-+    nsIAccessible* accChild;
-+    nsIAccessibleHyperText* hyperText;
++    nsIAccessible* accChild = nsnull;
++    nsIAccessibleHyperText* hyperText = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleHyperText), (void**)&hyperText);
      if (hyperText) {
          // If HyperText, then number of links matches number of children
 -        nsCOMPtr<nsIAccessibleHyperLink> hyperLink;
 -        hyperText->GetLink(aChildIndex, getter_AddRefs(hyperLink));
-+        nsIAccessibleHyperLink* hyperLink;
++        nsIAccessibleHyperLink* hyperLink = nsnull;
 +        hyperText->GetLink(aChildIndex, &hyperLink);
          accChild = do_QueryInterface(hyperLink);
      }
      else {
 -        nsCOMPtr<nsIAccessibleText> accText;
 -        accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText), getter_AddRefs(accText));
-+        nsIAccessibleText* accText;
++        nsIAccessibleText* accText = nsnull;
 +        accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText), (void**)&accText);
          if (!accText) {  // Accessible Text that is not HyperText has no children
 -            accWrap->GetChildAt(aChildIndex, getter_AddRefs(accChild));
 +            accWrap->GetChildAt(aChildIndex, &accChild);
          }
      }
  
 @@ -949,14 +949,14 @@ getIndexInParentCB(AtkObject *aAtkObj)
          return -1;
      }
  
 -    nsCOMPtr<nsIAccessible> parent;
 -    accWrap->GetParent(getter_AddRefs(parent));
-+    nsIAccessible* parent;
++    nsIAccessible* parent = nsnull;
 +    accWrap->GetParent(&parent);
      if (!parent) {
          return -1; // No parent
      }
  
 -    nsCOMPtr<nsIAccessible> sibling;
 -    parent->GetFirstChild(getter_AddRefs(sibling));
-+    nsIAccessible* sibling;
++    nsIAccessible* sibling = nsnull;
 +    parent->GetFirstChild(&sibling);
      if (!sibling) {
          return -1;  // Error, parent has no children
      }
 @@ -973,9 +973,9 @@ getIndexInParentCB(AtkObject *aAtkObj)
          ++ currentIndex;
        }
  
 -      nsCOMPtr<nsIAccessible> tempAccessible;
 -      sibling->GetNextSibling(getter_AddRefs(tempAccessible));
 -      sibling.swap(tempAccessible);
-+      nsIAccessible* tempAccessible;
++      nsIAccessible* tempAccessible = nsnull;
 +      sibling->GetNextSibling(&tempAccessible);
 +      swap(sibling, tempAccessible);
      }
  
      return currentIndex;
 @@ -1089,10 +1089,10 @@ nsAccessibleWrap *GetAccessibleWrap(AtkO
  
      NS_ENSURE_TRUE(tmpAccWrap->GetAtkObject() == aAtkObj, nsnull);
@@ -232,17 +232,17 @@ diff --git a/accessible/src/atk/nsAccess
      if (tmpAppAccWrap != tmpAccWrap && !tmpAccWrap->IsValidObject())
          return nsnull;
 @@ -1106,8 +1106,8 @@ nsAccessibleWrap::FireAccessibleEvent(ns
      nsresult rv = nsAccessible::FireAccessibleEvent(aEvent);
      NS_ENSURE_SUCCESS(rv, rv);
  
 -    nsCOMPtr<nsIAccessible> accessible;
 -    aEvent->GetAccessible(getter_AddRefs(accessible));
-+    nsIAccessible* accessible;
++    nsIAccessible* accessible = nsnull;
 +    aEvent->GetAccessible(&accessible);
      NS_ENSURE_TRUE(accessible, NS_ERROR_FAILURE);
  
      PRUint32 type = 0;
 @@ -1151,11 +1151,11 @@ nsAccessibleWrap::FireAccessibleEvent(ns
      case nsIAccessibleEvent::EVENT_FOCUS:
        {
          MAI_LOG_DEBUG(("\n\nReceived: EVENT_FOCUS\n"));
@@ -311,23 +311,23 @@ diff --git a/accessible/src/atk/nsAccess
      NS_ENSURE_TRUE(event, NS_ERROR_FAILURE);
  
 @@ -1515,12 +1515,12 @@ nsAccessibleWrap::FireAtkShowHideEvent(n
      else
          MAI_LOG_DEBUG(("\n\nReceived: Hide event\n"));
  
 -    nsCOMPtr<nsIAccessible> accessible;
 -    aEvent->GetAccessible(getter_AddRefs(accessible));
-+    nsIAccessible* accessible;
++    nsIAccessible* accessible = nsnull;
 +    aEvent->GetAccessible(&accessible);
      NS_ENSURE_STATE(accessible);
  
 -    nsCOMPtr<nsIAccessible> parentAccessible;
 -    accessible->GetParent(getter_AddRefs(parentAccessible));
-+    nsIAccessible* parentAccessible;
++    nsIAccessible* parentAccessible = nsnull;
 +    accessible->GetParent(&parentAccessible);
      NS_ENSURE_STATE(parentAccessible);
  
      PRInt32 indexInParent = -1;
 diff --git a/accessible/src/atk/nsAppRootAccessible.cpp b/accessible/src/atk/nsAppRootAccessible.cpp
 --- a/accessible/src/atk/nsAppRootAccessible.cpp
 +++ b/accessible/src/atk/nsAppRootAccessible.cpp
 @@ -435,7 +435,7 @@ AtkObject *
@@ -370,42 +370,42 @@ diff --git a/accessible/src/atk/nsMaiHyp
          return nsnull;
  
 @@ -225,8 +225,8 @@ getUriCB(AtkHyperlink *aLink, gint aLink
      if (maiAtkHyperlink->uri)
          return g_strdup(maiAtkHyperlink->uri);
  
 -    nsCOMPtr<nsIURI> uri;
 -    nsresult rv = accHyperlink->GetURI(aLinkIndex,getter_AddRefs(uri));
-+    nsIURI* uri;
++    nsIURI* uri = nsnull;
 +    nsresult rv = accHyperlink->GetURI(aLinkIndex,&uri);
      if (NS_FAILED(rv) || !uri)
          return nsnull;
      nsCAutoString cautoStr;
 @@ -242,8 +242,8 @@ getObjectCB(AtkHyperlink *aLink, gint aL
      nsIAccessibleHyperLink *accHyperlink = get_accessible_hyperlink(aLink);
      NS_ENSURE_TRUE(accHyperlink, nsnull);
  
 -    nsCOMPtr<nsIAccessible> accObj;
 -    accHyperlink->GetObject(aLinkIndex, getter_AddRefs(accObj));
-+    nsIAccessible* accObj;
++    nsIAccessible* accObj = nsnull;
 +    accHyperlink->GetObject(aLinkIndex, &accObj);
      NS_ENSURE_TRUE(accObj, nsnull);
  
      AtkObject *atkObj = nsAccessibleWrap::GetAtkObject(accObj);
 diff --git a/accessible/src/atk/nsMaiInterfaceAction.cpp b/accessible/src/atk/nsMaiInterfaceAction.cpp
 --- a/accessible/src/atk/nsMaiInterfaceAction.cpp
 +++ b/accessible/src/atk/nsMaiInterfaceAction.cpp
 @@ -119,8 +119,8 @@ getKeyBindingCB(AtkAction *aAction, gint
      nsresult rv = accWrap->GetKeyboardShortcut(accessKey);
  
      if (NS_SUCCEEDED(rv) && !accessKey.IsEmpty()) {
 -        nsCOMPtr<nsIAccessible> parentAccessible;
 -        accWrap->GetParent(getter_AddRefs(parentAccessible));
-+        nsIAccessible* parentAccessible;
++        nsIAccessible* parentAccessible = nsnull;
 +        accWrap->GetParent(&parentAccessible);
          if (parentAccessible) {
              PRUint32 role;
              parentAccessible->GetRole(&role);
 @@ -135,7 +135,7 @@ getKeyBindingCB(AtkAction *aAction, gint
              else if ((role == ATK_ROLE_MENU) || (role == ATK_ROLE_MENU_ITEM)) {
                  //it is submenu, change from "s" to "s;<Alt>f:s"
                  nsAutoString allKey = accessKey;
@@ -426,387 +426,387 @@ diff --git a/accessible/src/atk/nsMaiInt
                          grandParentAcc->GetRole(&role);
                  }
 @@ -168,8 +168,8 @@ getKeyBindingCB(AtkAction *aAction, gint
  
      //get shortcut
      nsAutoString subShortcut;
 -    nsCOMPtr<nsIDOMDOMStringList> keyBindings;
 -    rv = accWrap->GetKeyBindings(aActionIndex, getter_AddRefs(keyBindings));
-+    nsIDOMDOMStringList* keyBindings;
++    nsIDOMDOMStringList* keyBindings = nsnull;
 +    rv = accWrap->GetKeyBindings(aActionIndex, &keyBindings);
  
      if (NS_SUCCEEDED(rv) && keyBindings) {
          PRUint32 length = 0;
 diff --git a/accessible/src/atk/nsMaiInterfaceComponent.cpp b/accessible/src/atk/nsMaiInterfaceComponent.cpp
 --- a/accessible/src/atk/nsMaiInterfaceComponent.cpp
 +++ b/accessible/src/atk/nsMaiInterfaceComponent.cpp
 @@ -74,15 +74,15 @@ refAccessibleAtPointCB(AtkComponent *aCo
  
      // nsIAccessible getChildAtPoint (x,y) is in screen pixels.
      if (aCoordType == ATK_XY_WINDOW) {
 -        nsCOMPtr<nsIDOMNode> domNode;
 -        accWrap->GetDOMNode(getter_AddRefs(domNode));
-+        nsIDOMNode* domNode;
++        nsIDOMNode* domNode = nsnull;
 +        accWrap->GetDOMNode(&domNode);
          nsIntPoint winCoords = nsAccUtils::GetScreenCoordsForWindow(domNode);
          aAccX += winCoords.x;
          aAccY += winCoords.y;
      }
  
 -    nsCOMPtr<nsIAccessible> pointAcc;
 -    accWrap->GetChildAtPoint(aAccX, aAccY, getter_AddRefs(pointAcc));
-+    nsIAccessible* pointAcc;
++    nsIAccessible* pointAcc = nsnull;
 +    accWrap->GetChildAtPoint(aAccX, aAccY, &pointAcc);
      if (!pointAcc) {
          return nsnull;
      }
 @@ -115,8 +115,8 @@ getExtentsCB(AtkComponent *aComponent,
      if (NS_FAILED(rv))
          return;
      if (aCoordType == ATK_XY_WINDOW) {
 -        nsCOMPtr<nsIDOMNode> domNode;
 -        accWrap->GetDOMNode(getter_AddRefs(domNode));
-+        nsIDOMNode* domNode;
++        nsIDOMNode* domNode = nsnull;
 +        accWrap->GetDOMNode(&domNode);
          nsIntPoint winCoords = nsAccUtils::GetScreenCoordsForWindow(domNode);
          nsAccX -= winCoords.x;
          nsAccY -= winCoords.y;
 diff --git a/accessible/src/atk/nsMaiInterfaceDocument.cpp b/accessible/src/atk/nsMaiInterfaceDocument.cpp
 --- a/accessible/src/atk/nsMaiInterfaceDocument.cpp
 +++ b/accessible/src/atk/nsMaiInterfaceDocument.cpp
 @@ -70,9 +70,9 @@ getDocumentLocaleCB(AtkDocument *aDocume
      if (!accWrap)
          return nsnull;
  
 -    nsCOMPtr<nsIAccessNode> docAccessNode;
-+    nsIAccessNode* docAccessNode;
++    nsIAccessNode* docAccessNode = nsnull;
      accWrap->QueryInterface(NS_GET_IID(nsIAccessNode),
 -                            getter_AddRefs(docAccessNode));
 +                            (void**)&docAccessNode);
      NS_ENSURE_TRUE(docAccessNode, nsnull);
  
      nsAutoString locale;
 @@ -90,9 +90,9 @@ getDocumentTypeCB(AtkDocument *aDocument
      if (!accWrap)
          return nsnull;
  
 -    nsCOMPtr<nsIAccessibleDocument> accDocument;
-+    nsIAccessibleDocument* accDocument;
++    nsIAccessibleDocument* accDocument = nsnull;
      accWrap->QueryInterface(NS_GET_IID(nsIAccessibleDocument),
 -                            getter_AddRefs(accDocument));
 +                            (void**)&accDocument);
      NS_ENSURE_TRUE(accDocument, nsnull);
  
      nsAutoString mimeType;
 @@ -118,9 +118,9 @@ getDocumentAttributesCB(AtkDocument *aDo
      if (!accWrap)
          return nsnull;
  
 -    nsCOMPtr<nsIAccessibleDocument> accDocument;
-+    nsIAccessibleDocument* accDocument;
++    nsIAccessibleDocument* accDocument = nsnull;
      accWrap->QueryInterface(NS_GET_IID(nsIAccessibleDocument),
 -                            getter_AddRefs(accDocument));
 +                            (void**)&accDocument);
      NS_ENSURE_TRUE(accDocument, nsnull);
  
      // according to atkobject.h, AtkAttributeSet is a GSList
 @@ -153,9 +153,9 @@ getDocumentAttributeValueCB(AtkDocument 
      if (!accWrap)
          return nsnull;
  
 -    nsCOMPtr<nsIAccessibleDocument> accDocument;
-+    nsIAccessibleDocument* accDocument;
++    nsIAccessibleDocument* accDocument = nsnull;
      accWrap->QueryInterface(NS_GET_IID(nsIAccessibleDocument),
 -                            getter_AddRefs(accDocument));
 +                            (void**)&accDocument);
      NS_ENSURE_TRUE(accDocument, nsnull);
  
      nsresult rv;
 diff --git a/accessible/src/atk/nsMaiInterfaceEditableText.cpp b/accessible/src/atk/nsMaiInterfaceEditableText.cpp
 --- a/accessible/src/atk/nsMaiInterfaceEditableText.cpp
 +++ b/accessible/src/atk/nsMaiInterfaceEditableText.cpp
 @@ -68,12 +68,12 @@ setRunAttributesCB(AtkEditableText *aTex
      if (!accWrap)
          return FALSE;
  
 -    nsCOMPtr<nsIAccessibleEditableText> accText;
-+    nsIAccessibleEditableText* accText;
++    nsIAccessibleEditableText* accText = nsnull;
      accWrap->QueryInterface(NS_GET_IID(nsIAccessibleEditableText),
 -                            getter_AddRefs(accText));
 +                            (void**)&accText);
      NS_ENSURE_TRUE(accText, FALSE);
  
 -    nsCOMPtr<nsISupports> attrSet;
-+    nsISupports* attrSet;
++    nsISupports* attrSet = nsnull;
      /* how to insert attributes into nsISupports ??? */
  
      nsresult rv = accText->SetAttributes(aStartOffset, aEndOffset,
 @@ -88,9 +88,9 @@ setTextContentsCB(AtkEditableText *aText
      if (!accWrap)
          return;
  
 -    nsCOMPtr<nsIAccessibleEditableText> accText;
-+    nsIAccessibleEditableText* accText;
++    nsIAccessibleEditableText* accText = nsnull;
      accWrap->QueryInterface(NS_GET_IID(nsIAccessibleEditableText),
 -                            getter_AddRefs(accText));
 +                            (void**)&accText);
      if (!accText)
          return;
  
 @@ -108,9 +108,9 @@ insertTextCB(AtkEditableText *aText,
      if (!accWrap)
          return;
  
 -    nsCOMPtr<nsIAccessibleEditableText> accText;
-+    nsIAccessibleEditableText* accText;
++    nsIAccessibleEditableText* accText = nsnull;
      accWrap->QueryInterface(NS_GET_IID(nsIAccessibleEditableText),
 -                            getter_AddRefs(accText));
 +                            (void**)&accText);
      if (!accText)
          return;
  
 @@ -135,9 +135,9 @@ copyTextCB(AtkEditableText *aText, gint 
      if (!accWrap)
          return;
  
 -    nsCOMPtr<nsIAccessibleEditableText> accText;
-+    nsIAccessibleEditableText* accText;
++    nsIAccessibleEditableText* accText = nsnull;
      accWrap->QueryInterface(NS_GET_IID(nsIAccessibleEditableText),
 -                            getter_AddRefs(accText));
 +                            (void**)&accText);
      if (!accText)
          return;
  
 @@ -153,9 +153,9 @@ cutTextCB(AtkEditableText *aText, gint a
      if (!accWrap)
          return;
  
 -    nsCOMPtr<nsIAccessibleEditableText> accText;
-+    nsIAccessibleEditableText* accText;
++    nsIAccessibleEditableText* accText = nsnull;
      accWrap->QueryInterface(NS_GET_IID(nsIAccessibleEditableText),
 -                            getter_AddRefs(accText));
 +                            (void**)&accText);
      if (!accText)
          return;
      MAI_LOG_DEBUG(("EditableText: cutTextCB, aStartPos=%d, aEndPos=%d",
 @@ -170,9 +170,9 @@ deleteTextCB(AtkEditableText *aText, gin
      if (!accWrap)
          return;
  
 -    nsCOMPtr<nsIAccessibleEditableText> accText;
-+    nsIAccessibleEditableText* accText;
++    nsIAccessibleEditableText* accText = nsnull;
      accWrap->QueryInterface(NS_GET_IID(nsIAccessibleEditableText),
 -                            getter_AddRefs(accText));
 +                            (void**)&accText);
      if (!accText)
          return;
  
 @@ -188,9 +188,9 @@ pasteTextCB(AtkEditableText *aText, gint
      if (!accWrap)
          return;
  
 -    nsCOMPtr<nsIAccessibleEditableText> accText;
-+    nsIAccessibleEditableText* accText;
++    nsIAccessibleEditableText* accText = nsnull;
      accWrap->QueryInterface(NS_GET_IID(nsIAccessibleEditableText),
 -                            getter_AddRefs(accText));
 +                            (void**)&accText);
      if (!accText)
          return;
  
 diff --git a/accessible/src/atk/nsMaiInterfaceHyperlinkImpl.cpp b/accessible/src/atk/nsMaiInterfaceHyperlinkImpl.cpp
 --- a/accessible/src/atk/nsMaiInterfaceHyperlinkImpl.cpp
 +++ b/accessible/src/atk/nsMaiInterfaceHyperlinkImpl.cpp
 @@ -56,9 +56,9 @@ getHyperlinkCB(AtkHyperlinkImpl *aImpl)
      if (!accWrap)
          return nsnull;
  
 -    nsCOMPtr<nsIAccessibleHyperLink> accHyperlink;
-+    nsIAccessibleHyperLink* accHyperlink;
++    nsIAccessibleHyperLink* accHyperlink = nsnull;
      accWrap->QueryInterface(NS_GET_IID(nsIAccessibleHyperLink),
 -                            getter_AddRefs(accHyperlink));
 +                            (void**)&accHyperlink);
      NS_ENSURE_TRUE(accHyperlink, nsnull);
      
      MaiHyperlink *maiHyperlink = accWrap->GetMaiHyperlink();
 diff --git a/accessible/src/atk/nsMaiInterfaceHypertext.cpp b/accessible/src/atk/nsMaiInterfaceHypertext.cpp
 --- a/accessible/src/atk/nsMaiInterfaceHypertext.cpp
 +++ b/accessible/src/atk/nsMaiInterfaceHypertext.cpp
 @@ -59,17 +59,17 @@ getLinkCB(AtkHypertext *aText, gint aLin
      if (!accWrap)
          return nsnull;
  
 -    nsCOMPtr<nsIAccessibleHyperText> hyperText;
-+    nsIAccessibleHyperText* hyperText;
++    nsIAccessibleHyperText* hyperText = nsnull;
      accWrap->QueryInterface(NS_GET_IID(nsIAccessibleHyperText),
 -                            getter_AddRefs(hyperText));
 +                            (void**)&hyperText);
      NS_ENSURE_TRUE(hyperText, nsnull);
  
 -    nsCOMPtr<nsIAccessibleHyperLink> hyperLink;
 -    nsresult rv = hyperText->GetLink(aLinkIndex, getter_AddRefs(hyperLink));
-+    nsIAccessibleHyperLink* hyperLink;
++    nsIAccessibleHyperLink* hyperLink = nsnull;
 +    nsresult rv = hyperText->GetLink(aLinkIndex, &hyperLink);
      if (NS_FAILED(rv) || !hyperLink)
          return nsnull;
  
 -    nsCOMPtr<nsIAccessible> hyperLinkAcc(do_QueryInterface(hyperLink));
 +    nsIAccessible* hyperLinkAcc(do_QueryInterface(hyperLink));
      AtkObject *hyperLinkAtkObj = nsAccessibleWrap::GetAtkObject(hyperLinkAcc);
      nsAccessibleWrap *accChild = GetAccessibleWrap(hyperLinkAtkObj);
      NS_ENSURE_TRUE(accChild, nsnull);
 @@ -86,9 +86,9 @@ getLinkCountCB(AtkHypertext *aText)
      if (!accWrap)
          return -1;
  
 -    nsCOMPtr<nsIAccessibleHyperText> hyperText;
-+    nsIAccessibleHyperText* hyperText;
++    nsIAccessibleHyperText* hyperText = nsnull;
      accWrap->QueryInterface(NS_GET_IID(nsIAccessibleHyperText),
 -                            getter_AddRefs(hyperText));
 +                            (void**)&hyperText);
      NS_ENSURE_TRUE(hyperText, -1);
  
      PRInt32 count = -1;
 @@ -105,9 +105,9 @@ getLinkIndexCB(AtkHypertext *aText, gint
      if (!accWrap)
          return -1;
  
 -    nsCOMPtr<nsIAccessibleHyperText> hyperText;
-+    nsIAccessibleHyperText* hyperText;
++    nsIAccessibleHyperText* hyperText = nsnull;
      accWrap->QueryInterface(NS_GET_IID(nsIAccessibleHyperText),
 -                            getter_AddRefs(hyperText));
 +                            (void**)&hyperText);
      NS_ENSURE_TRUE(hyperText, -1);
  
      PRInt32 index = -1;
 diff --git a/accessible/src/atk/nsMaiInterfaceImage.cpp b/accessible/src/atk/nsMaiInterfaceImage.cpp
 --- a/accessible/src/atk/nsMaiInterfaceImage.cpp
 +++ b/accessible/src/atk/nsMaiInterfaceImage.cpp
 @@ -62,9 +62,9 @@ getImagePositionCB(AtkImage *aImage, gin
      if (!accWrap) 
        return;
  
 -    nsCOMPtr<nsIAccessibleImage> image;
-+    nsIAccessibleImage* image;
++    nsIAccessibleImage* image = nsnull;
      accWrap->QueryInterface(NS_GET_IID(nsIAccessibleImage),
 -                            getter_AddRefs(image));
 +                            (void**)&image);
      if (!image)
        return;
  
 @@ -75,8 +75,8 @@ getImagePositionCB(AtkImage *aImage, gin
        return;
      
      if (aCoordType == ATK_XY_WINDOW) {
 -        nsCOMPtr<nsIDOMNode> domNode;
 -        accWrap->GetDOMNode(getter_AddRefs(domNode));
-+        nsIDOMNode* domNode;
++        nsIDOMNode* domNode = nsnull;
 +        accWrap->GetDOMNode(&domNode);
          nsIntPoint winCoords = nsAccUtils::GetScreenCoordsForWindow(domNode);
          *aAccX -= winCoords.x;
          *aAccY -= winCoords.y;
 @@ -96,9 +96,9 @@ getImageSizeCB(AtkImage *aImage, gint *a
      if (!accWrap) 
        return;
  
 -    nsCOMPtr<nsIAccessibleImage> image;
-+    nsIAccessibleImage* image;
++    nsIAccessibleImage* image = nsnull;
      accWrap->QueryInterface(NS_GET_IID(nsIAccessibleImage),
 -                            getter_AddRefs(image));
 +                            (void**)&image);
      if (!image)
        return;
  
 diff --git a/accessible/src/atk/nsMaiInterfaceSelection.cpp b/accessible/src/atk/nsMaiInterfaceSelection.cpp
 --- a/accessible/src/atk/nsMaiInterfaceSelection.cpp
 +++ b/accessible/src/atk/nsMaiInterfaceSelection.cpp
 @@ -63,9 +63,9 @@ addSelectionCB(AtkSelection *aSelection,
      if (!accWrap)
          return FALSE;
  
 -    nsCOMPtr<nsIAccessibleSelectable> accSelection;
-+    nsIAccessibleSelectable* accSelection;
++    nsIAccessibleSelectable* accSelection = nsnull;
      accWrap->QueryInterface(NS_GET_IID(nsIAccessibleSelectable),
 -                            getter_AddRefs(accSelection));
 +                            (void**)&accSelection);
      NS_ENSURE_TRUE(accSelection, FALSE);
  
      return NS_SUCCEEDED(accSelection->AddChildToSelection(i));
 @@ -78,9 +78,9 @@ clearSelectionCB(AtkSelection *aSelectio
      if (!accWrap)
          return FALSE;
  
 -    nsCOMPtr<nsIAccessibleSelectable> accSelection;
-+    nsIAccessibleSelectable* accSelection;
++    nsIAccessibleSelectable* accSelection = nsnull;
      accWrap->QueryInterface(NS_GET_IID(nsIAccessibleSelectable),
 -                            getter_AddRefs(accSelection));
 +                            (void**)&accSelection);
      NS_ENSURE_TRUE(accSelection, FALSE);
  
      return NS_SUCCEEDED(accSelection->ClearSelection());
 @@ -93,13 +93,13 @@ refSelectionCB(AtkSelection *aSelection,
      if (!accWrap)
          return nsnull;
  
 -    nsCOMPtr<nsIAccessibleSelectable> accSelection;
-+    nsIAccessibleSelectable* accSelection;
++    nsIAccessibleSelectable* accSelection = nsnull;
      accWrap->QueryInterface(NS_GET_IID(nsIAccessibleSelectable),
 -                            getter_AddRefs(accSelection));
 +                            (void**)&accSelection);
      NS_ENSURE_TRUE(accSelection, nsnull);
  
 -    nsCOMPtr<nsIAccessible> accSelect;
 -    accSelection->RefSelection(i, getter_AddRefs(accSelect));
-+    nsIAccessible* accSelect;
++    nsIAccessible* accSelect = nsnull;
 +    accSelection->RefSelection(i, &accSelect);
      if (!accSelect) {
          return nsnull;
      }
 @@ -118,9 +118,9 @@ getSelectionCountCB(AtkSelection *aSelec
      if (!accWrap)
          return -1;
  
 -    nsCOMPtr<nsIAccessibleSelectable> accSelection;
-+    nsIAccessibleSelectable* accSelection;
++    nsIAccessibleSelectable* accSelection = nsnull;
      accWrap->QueryInterface(NS_GET_IID(nsIAccessibleSelectable),
 -                            getter_AddRefs(accSelection));
 +                            (void**)&accSelection);
      NS_ENSURE_TRUE(accSelection, -1);
  
      PRInt32 num = 0;
 @@ -135,9 +135,9 @@ isChildSelectedCB(AtkSelection *aSelecti
      if (!accWrap)
          return FALSE;
  
 -    nsCOMPtr<nsIAccessibleSelectable> accSelection;
-+    nsIAccessibleSelectable* accSelection;
++    nsIAccessibleSelectable* accSelection = nsnull;
      accWrap->QueryInterface(NS_GET_IID(nsIAccessibleSelectable),
 -                            getter_AddRefs(accSelection));
 +                            (void**)&accSelection);
      NS_ENSURE_TRUE(accSelection, FALSE);
  
      PRBool result = FALSE;
 @@ -152,9 +152,9 @@ removeSelectionCB(AtkSelection *aSelecti
      if (!accWrap)
          return FALSE;
  
 -    nsCOMPtr<nsIAccessibleSelectable> accSelection;
-+    nsIAccessibleSelectable* accSelection;
++    nsIAccessibleSelectable* accSelection = nsnull;
      accWrap->QueryInterface(NS_GET_IID(nsIAccessibleSelectable),
 -                            getter_AddRefs(accSelection));
 +                            (void**)&accSelection);
      NS_ENSURE_TRUE(accSelection, FALSE);
  
      nsresult rv = accSelection->RemoveChildFromSelection(i);
 @@ -168,9 +168,9 @@ selectAllSelectionCB(AtkSelection *aSele
      if (!accWrap)
          return FALSE;
  
 -    nsCOMPtr<nsIAccessibleSelectable> accSelection;
-+    nsIAccessibleSelectable* accSelection;
++    nsIAccessibleSelectable* accSelection = nsnull;
      accWrap->QueryInterface(NS_GET_IID(nsIAccessibleSelectable),
 -                            getter_AddRefs(accSelection));
 +                            (void**)&accSelection);
      NS_ENSURE_TRUE(accSelection, FALSE);
  
      PRBool result = FALSE;
 diff --git a/accessible/src/atk/nsMaiInterfaceTable.cpp b/accessible/src/atk/nsMaiInterfaceTable.cpp
 --- a/accessible/src/atk/nsMaiInterfaceTable.cpp
@@ -817,624 +817,624 @@ diff --git a/accessible/src/atk/nsMaiInt
  
 -    nsCOMPtr<nsIAccessibleTable> accTable;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 -                            getter_AddRefs(accTable));
 -    NS_ENSURE_TRUE(accTable, nsnull);
 -
 -    nsCOMPtr<nsIAccessible> cell;
 -    nsresult rv = accTable->CellRefAt(aRow, aColumn,getter_AddRefs(cell));
-+    nsIAccessibleTable* accTable;
++    nsIAccessibleTable* accTable = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 +                            (void**)&accTable);
 +    NS_ENSURE_TRUE(accTable, nsnull);
 +
-+    nsIAccessible* cell;
++    nsIAccessible* cell = nsnull;
 +    nsresult rv = accTable->CellRefAt(aRow, aColumn,&cell);
      if (NS_FAILED(rv) || !cell)
          return nsnull;
  
 @@ -99,9 +99,9 @@ getIndexAtCB(AtkTable *aTable, gint aRow
      if (!accWrap)
          return -1;
  
 -    nsCOMPtr<nsIAccessibleTable> accTable;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 -                            getter_AddRefs(accTable));
-+    nsIAccessibleTable* accTable;
++    nsIAccessibleTable* accTable = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 +                            (void**)&accTable);
      NS_ENSURE_TRUE(accTable, -1);
  
      PRInt32 index;
 @@ -118,9 +118,9 @@ getColumnAtIndexCB(AtkTable *aTable, gin
      if (!accWrap)
          return -1;
  
 -    nsCOMPtr<nsIAccessibleTable> accTable;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 -                            getter_AddRefs(accTable));
-+    nsIAccessibleTable* accTable;
++    nsIAccessibleTable* accTable = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 +                            (void**)&accTable);
      NS_ENSURE_TRUE(accTable, -1);
  
      PRInt32 col;
 @@ -137,9 +137,9 @@ getRowAtIndexCB(AtkTable *aTable, gint a
      if (!accWrap)
          return -1;
  
 -    nsCOMPtr<nsIAccessibleTable> accTable;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 -                            getter_AddRefs(accTable));
-+    nsIAccessibleTable* accTable;
++    nsIAccessibleTable* accTable = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 +                            (void**)&accTable);
      NS_ENSURE_TRUE(accTable, -1);
  
      PRInt32 row;
 @@ -156,9 +156,9 @@ getColumnCountCB(AtkTable *aTable)
      if (!accWrap)
          return -1;
  
 -    nsCOMPtr<nsIAccessibleTable> accTable;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 -                            getter_AddRefs(accTable));
-+    nsIAccessibleTable* accTable;
++    nsIAccessibleTable* accTable = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 +                            (void**)&accTable);
      NS_ENSURE_TRUE(accTable, -1);
  
      PRInt32 count;
 @@ -175,9 +175,9 @@ getRowCountCB(AtkTable *aTable)
      if (!accWrap)
          return -1;
  
 -    nsCOMPtr<nsIAccessibleTable> accTable;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 -                            getter_AddRefs(accTable));
-+    nsIAccessibleTable* accTable;
++    nsIAccessibleTable* accTable = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 +                            (void**)&accTable);
      NS_ENSURE_TRUE(accTable, -1);
  
      PRInt32 count;
 @@ -195,9 +195,9 @@ getColumnExtentAtCB(AtkTable *aTable,
      if (!accWrap)
          return -1;
  
 -    nsCOMPtr<nsIAccessibleTable> accTable;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 -                            getter_AddRefs(accTable));
-+    nsIAccessibleTable* accTable;
++    nsIAccessibleTable* accTable = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 +                            (void**)&accTable);
      NS_ENSURE_TRUE(accTable, -1);
  
      PRInt32 extent;
 @@ -215,9 +215,9 @@ getRowExtentAtCB(AtkTable *aTable,
      if (!accWrap)
          return -1;
  
 -    nsCOMPtr<nsIAccessibleTable> accTable;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 -                            getter_AddRefs(accTable));
-+    nsIAccessibleTable* accTable;
++    nsIAccessibleTable* accTable = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 +                            (void**)&accTable);
      NS_ENSURE_TRUE(accTable, -1);
  
      PRInt32 extent;
 @@ -234,13 +234,13 @@ getCaptionCB(AtkTable *aTable)
      if (!accWrap)
          return nsnull;
  
 -    nsCOMPtr<nsIAccessibleTable> accTable;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 -                            getter_AddRefs(accTable));
 -    NS_ENSURE_TRUE(accTable, nsnull);
 -
 -    nsCOMPtr<nsIAccessible> caption;
 -    nsresult rv = accTable->GetCaption(getter_AddRefs(caption));
-+    nsIAccessibleTable* accTable;
++    nsIAccessibleTable* accTable = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 +                            (void**)&accTable);
 +    NS_ENSURE_TRUE(accTable, nsnull);
 +
-+    nsIAccessible* caption;
++    nsIAccessible* caption = nsnull;
 +    nsresult rv = accTable->GetCaption(&caption);
      if (NS_FAILED(rv) || !caption)
          return nsnull;
  
 @@ -254,9 +254,9 @@ getColumnDescriptionCB(AtkTable *aTable,
      if (!accWrap)
          return nsnull;
  
 -    nsCOMPtr<nsIAccessibleTable> accTable;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 -                            getter_AddRefs(accTable));
-+    nsIAccessibleTable* accTable;
++    nsIAccessibleTable* accTable = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 +                            (void**)&accTable);
      NS_ENSURE_TRUE(accTable, nsnull);
  
      nsAutoString autoStr;
 @@ -273,13 +273,13 @@ getColumnHeaderCB(AtkTable *aTable, gint
      if (!accWrap)
          return nsnull;
  
 -    nsCOMPtr<nsIAccessibleTable> accTable;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 -                            getter_AddRefs(accTable));
 -    NS_ENSURE_TRUE(accTable, nsnull);
 -
 -    nsCOMPtr<nsIAccessibleTable> header;
 -    nsresult rv = accTable->GetColumnHeader(getter_AddRefs(header));
-+    nsIAccessibleTable* accTable;
++    nsIAccessibleTable* accTable = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 +                            (void**)&accTable);
 +    NS_ENSURE_TRUE(accTable, nsnull);
 +
-+    nsIAccessibleTable* header;
++    nsIAccessibleTable* header = nsnull;
 +    nsresult rv = accTable->GetColumnHeader(&header);
      NS_ENSURE_SUCCESS(rv, nsnull);
      NS_ENSURE_TRUE(header, nsnull);
  
 @@ -292,8 +292,8 @@ getColumnHeaderCB(AtkTable *aTable, gint
      // 2. "GetColumnHeader" defined in nsIAccessibleTable returns
      // nsXULTreeColumnsAccessibleWrap, which exports nsIAccessibleTable and is
      // "ROLE_LIST".
 -    nsCOMPtr<nsIAccessible> accHeader;
 -    header->CellRefAt(0, aColumn, getter_AddRefs(accHeader));
-+    nsIAccessible* accHeader;
++    nsIAccessible* accHeader = nsnull;
 +    header->CellRefAt(0, aColumn, &accHeader);
      NS_ENSURE_TRUE(accHeader, nsnull);
  
      return nsAccessibleWrap::GetAtkObject(accHeader);
 @@ -306,9 +306,9 @@ getRowDescriptionCB(AtkTable *aTable, gi
      if (!accWrap)
          return nsnull;
  
 -    nsCOMPtr<nsIAccessibleTable> accTable;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 -                            getter_AddRefs(accTable));
-+    nsIAccessibleTable* accTable;
++    nsIAccessibleTable* accTable = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 +                            (void**)&accTable);
      NS_ENSURE_TRUE(accTable, nsnull);
  
      nsAutoString autoStr;
 @@ -325,16 +325,16 @@ getRowHeaderCB(AtkTable *aTable, gint aR
      if (!accWrap)
          return nsnull;
  
 -    nsCOMPtr<nsIAccessibleTable> accTable;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 -                            getter_AddRefs(accTable));
 -    NS_ENSURE_TRUE(accTable, nsnull);
 -
 -    nsCOMPtr<nsIAccessibleTable> header;
 -    nsresult rv = accTable->GetRowHeader(getter_AddRefs(header));
-+    nsIAccessibleTable* accTable;
++    nsIAccessibleTable* accTable = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 +                            (void**)&accTable);
 +    NS_ENSURE_TRUE(accTable, nsnull);
 +
-+    nsIAccessibleTable* header;
++    nsIAccessibleTable* header = nsnull;
 +    nsresult rv = accTable->GetRowHeader(&header);
      NS_ENSURE_SUCCESS(rv, nsnull);
  
 -    nsCOMPtr<nsIAccessible> accHeader(do_QueryInterface(header));
 +    nsIAccessible* accHeader(do_QueryInterface(header));
      NS_ENSURE_TRUE(accHeader, nsnull);
  
      return nsAccessibleWrap::GetAtkObject(accHeader);
 @@ -354,9 +354,9 @@ getSelectedColumnsCB(AtkTable *aTable, g
      if (!accWrap)
          return 0;
  
 -    nsCOMPtr<nsIAccessibleTable> accTable;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 -                            getter_AddRefs(accTable));
-+    nsIAccessibleTable* accTable;
++    nsIAccessibleTable* accTable = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 +                            (void**)&accTable);
      NS_ENSURE_TRUE(accTable, 0);
  
      PRUint32 size = 0;
 @@ -389,9 +389,9 @@ getSelectedRowsCB(AtkTable *aTable, gint
      if (!accWrap)
          return 0;
  
 -    nsCOMPtr<nsIAccessibleTable> accTable;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 -                            getter_AddRefs(accTable));
-+    nsIAccessibleTable* accTable;
++    nsIAccessibleTable* accTable = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 +                            (void**)&accTable);
      NS_ENSURE_TRUE(accTable, 0);
  
      PRUint32 size = 0;
 @@ -424,9 +424,9 @@ isColumnSelectedCB(AtkTable *aTable, gin
      if (!accWrap)
          return FALSE;
  
 -    nsCOMPtr<nsIAccessibleTable> accTable;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 -                            getter_AddRefs(accTable));
-+    nsIAccessibleTable* accTable;
++    nsIAccessibleTable* accTable = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 +                            (void**)&accTable);
      NS_ENSURE_TRUE(accTable, FALSE);
  
      PRBool outValue;
 @@ -441,9 +441,9 @@ isRowSelectedCB(AtkTable *aTable, gint a
      if (!accWrap)
          return FALSE;
  
 -    nsCOMPtr<nsIAccessibleTable> accTable;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 -                            getter_AddRefs(accTable));
-+    nsIAccessibleTable* accTable;
++    nsIAccessibleTable* accTable = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 +                            (void**)&accTable);
      NS_ENSURE_TRUE(accTable, FALSE);
  
      PRBool outValue;
 @@ -458,9 +458,9 @@ isCellSelectedCB(AtkTable *aTable, gint 
      if (!accWrap)
          return FALSE;
  
 -    nsCOMPtr<nsIAccessibleTable> accTable;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 -                            getter_AddRefs(accTable));
-+    nsIAccessibleTable* accTable;
++    nsIAccessibleTable* accTable = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
 +                            (void**)&accTable);
      NS_ENSURE_TRUE(accTable, FALSE);
  
      PRBool outValue;
 diff --git a/accessible/src/atk/nsMaiInterfaceText.cpp b/accessible/src/atk/nsMaiInterfaceText.cpp
 --- a/accessible/src/atk/nsMaiInterfaceText.cpp
 +++ b/accessible/src/atk/nsMaiInterfaceText.cpp
 @@ -92,9 +92,9 @@ getTextCB(AtkText *aText, gint aStartOff
      if (!accWrap)
          return nsnull;
  
 -    nsCOMPtr<nsIAccessibleText> accText;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
 -                            getter_AddRefs(accText));
-+    nsIAccessibleText* accText;
++    nsIAccessibleText* accText = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
 +                            (void**)&accText);
      NS_ENSURE_TRUE(accText, nsnull);
  
      nsAutoString autoStr;
 @@ -117,9 +117,9 @@ getTextAfterOffsetCB(AtkText *aText, gin
      if (!accWrap)
          return nsnull;
  
 -    nsCOMPtr<nsIAccessibleText> accText;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
 -                            getter_AddRefs(accText));
-+    nsIAccessibleText* accText;
++    nsIAccessibleText* accText = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
 +                            (void**)&accText);
      NS_ENSURE_TRUE(accText, nsnull);
  
      nsAutoString autoStr;
 @@ -146,9 +146,9 @@ getTextAtOffsetCB(AtkText *aText, gint a
      if (!accWrap)
          return nsnull;
  
 -    nsCOMPtr<nsIAccessibleText> accText;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
 -                            getter_AddRefs(accText));
-+    nsIAccessibleText* accText;
++    nsIAccessibleText* accText = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
 +                            (void**)&accText);
      NS_ENSURE_TRUE(accText, nsnull);
  
      nsAutoString autoStr;
 @@ -173,9 +173,9 @@ getCharacterAtOffsetCB(AtkText *aText, g
      if (!accWrap)
          return 0;
  
 -    nsCOMPtr<nsIAccessibleText> accText;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
 -                            getter_AddRefs(accText));
-+    nsIAccessibleText* accText;
++    nsIAccessibleText* accText = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
 +                            (void**)&accText);
      NS_ENSURE_TRUE(accText, 0);
  
      /* PRUnichar is unsigned short in Mozilla */
 @@ -203,9 +203,9 @@ getTextBeforeOffsetCB(AtkText *aText, gi
      if (!accWrap)
          return nsnull;
  
 -    nsCOMPtr<nsIAccessibleText> accText;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
 -                            getter_AddRefs(accText));
-+    nsIAccessibleText* accText;
++    nsIAccessibleText* accText = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
 +                            (void**)&accText);
      NS_ENSURE_TRUE(accText, nsnull);
  
      nsAutoString autoStr;
 @@ -230,9 +230,9 @@ getCaretOffsetCB(AtkText *aText)
      if (!accWrap)
          return 0;
  
 -    nsCOMPtr<nsIAccessibleText> accText;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
 -                            getter_AddRefs(accText));
-+    nsIAccessibleText* accText;
++    nsIAccessibleText* accText = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
 +                            (void**)&accText);
      NS_ENSURE_TRUE(accText, 0);
  
      PRInt32 offset;
 @@ -249,16 +249,16 @@ getRunAttributesCB(AtkText *aText, gint 
      if (!accWrap)
          return nsnull;
  
 -    nsCOMPtr<nsIAccessibleText> accText;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
 -                            getter_AddRefs(accText));
 -    NS_ENSURE_TRUE(accText, nsnull);
 -
 -    nsCOMPtr<nsIAccessible> accessibleWithAttrs;
-+    nsIAccessibleText* accText;
++    nsIAccessibleText* accText = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
 +                            (void**)&accText);
 +    NS_ENSURE_TRUE(accText, nsnull);
 +
-+    nsIAccessible* accessibleWithAttrs;
++    nsIAccessible* accessibleWithAttrs = nsnull;
      PRInt32 startOffset = 0, endOffset = 0;
      nsresult rv =
          accText->GetAttributeRange(aOffset, &startOffset, &endOffset,
 -                                   getter_AddRefs(accessibleWithAttrs));
 +                                   &accessibleWithAttrs);
      *aStartOffset = startOffset;
      *aEndOffset = endOffset;
      if (NS_FAILED(rv))
 @@ -284,9 +284,9 @@ getCharacterExtentsCB(AtkText *aText, gi
      if(!accWrap || !aX || !aY || !aWidth || !aHeight)
          return;
  
 -    nsCOMPtr<nsIAccessibleText> accText;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
 -                            getter_AddRefs(accText));
-+    nsIAccessibleText* accText;
++    nsIAccessibleText* accText = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
 +                            (void**)&accText);
      if (!accText)
          return;
  
 @@ -318,9 +318,9 @@ getRangeExtentsCB(AtkText *aText, gint a
      if(!accWrap || !aRect)
          return;
  
 -    nsCOMPtr<nsIAccessibleText> accText;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
 -                            getter_AddRefs(accText));
-+    nsIAccessibleText* accText;
++    nsIAccessibleText* accText = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
 +                            (void**)&accText);
      if (!accText)
          return;
  
 @@ -352,9 +352,9 @@ getCharacterCountCB(AtkText *aText)
      if (!accWrap)
          return 0;
  
 -    nsCOMPtr<nsIAccessibleText> accText;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
 -                            getter_AddRefs(accText));
-+    nsIAccessibleText* accText;
++    nsIAccessibleText* accText = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
 +                            (void**)&accText);
      NS_ENSURE_TRUE(accText, 0);
  
      PRInt32 count = 0;
 @@ -371,9 +371,9 @@ getOffsetAtPointCB(AtkText *aText,
      if (!accWrap)
          return -1;
  
 -    nsCOMPtr<nsIAccessibleText> accText;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
 -                            getter_AddRefs(accText));
-+    nsIAccessibleText* accText;
++    nsIAccessibleText* accText = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
 +                            (void**)&accText);
      NS_ENSURE_TRUE(accText, -1);
  
      PRInt32 offset = 0;
 @@ -394,9 +394,9 @@ getTextSelectionCountCB(AtkText *aText)
      if (!accWrap)
          return nsnull;
  
 -    nsCOMPtr<nsIAccessibleText> accText;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
 -                            getter_AddRefs(accText));
-+    nsIAccessibleText* accText;
++    nsIAccessibleText* accText = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
 +                            (void**)&accText);
      NS_ENSURE_TRUE(accText, nsnull);
  
      PRInt32 selectionCount;
 @@ -413,9 +413,9 @@ getTextSelectionCB(AtkText *aText, gint 
      if (!accWrap)
          return nsnull;
  
 -    nsCOMPtr<nsIAccessibleText> accText;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
 -                            getter_AddRefs(accText));
-+    nsIAccessibleText* accText;
++    nsIAccessibleText* accText = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
 +                            (void**)&accText);
      NS_ENSURE_TRUE(accText, nsnull);
  
      PRInt32 startOffset = 0, endOffset = 0;
 @@ -440,9 +440,9 @@ addTextSelectionCB(AtkText *aText,
      if (!accWrap)
          return FALSE;
  
 -    nsCOMPtr<nsIAccessibleText> accText;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
 -                            getter_AddRefs(accText));
-+    nsIAccessibleText* accText;
++    nsIAccessibleText* accText = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
 +                            (void**)&accText);
      NS_ENSURE_TRUE(accText, FALSE);
  
      nsresult rv = accText->AddSelection(aStartOffset, aEndOffset);
 @@ -458,9 +458,9 @@ removeTextSelectionCB(AtkText *aText,
      if (!accWrap)
          return FALSE;
  
 -    nsCOMPtr<nsIAccessibleText> accText;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
 -                            getter_AddRefs(accText));
-+    nsIAccessibleText* accText;
++    nsIAccessibleText* accText = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
 +                            (void**)&accText);
      NS_ENSURE_TRUE(accText, FALSE);
  
      nsresult rv = accText->RemoveSelection(aSelectionNum);
 @@ -476,9 +476,9 @@ setTextSelectionCB(AtkText *aText, gint 
      if (!accWrap)
          return FALSE;
  
 -    nsCOMPtr<nsIAccessibleText> accText;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
 -                            getter_AddRefs(accText));
-+    nsIAccessibleText* accText;
++    nsIAccessibleText* accText = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
 +                            (void**)&accText);
      NS_ENSURE_TRUE(accText, FALSE);
  
      nsresult rv = accText->SetSelectionBounds(aSelectionNum,
 @@ -493,9 +493,9 @@ setCaretOffsetCB(AtkText *aText, gint aO
      if (!accWrap)
          return FALSE;
  
 -    nsCOMPtr<nsIAccessibleText> accText;
 -    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
 -                            getter_AddRefs(accText));
-+    nsIAccessibleText* accText;
++    nsIAccessibleText* accText = nsnull;
 +    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
 +                            (void**)&accText);
      NS_ENSURE_TRUE(accText, FALSE);
  
      nsresult rv = accText->SetCaretOffset(aOffset);
 diff --git a/accessible/src/atk/nsMaiInterfaceValue.cpp b/accessible/src/atk/nsMaiInterfaceValue.cpp
 --- a/accessible/src/atk/nsMaiInterfaceValue.cpp
 +++ b/accessible/src/atk/nsMaiInterfaceValue.cpp
 @@ -61,9 +61,9 @@ getCurrentValueCB(AtkValue *obj, GValue 
      if (!accWrap)
          return;
  
 -    nsCOMPtr<nsIAccessibleValue> accValue;
-+    nsIAccessibleValue* accValue;
++    nsIAccessibleValue* accValue = nsnull;
      accWrap->QueryInterface(NS_GET_IID(nsIAccessibleValue),
 -                            getter_AddRefs(accValue));
 +                            (void**)&accValue);
      if (!accValue)
          return;
  
 @@ -82,9 +82,9 @@ getMaximumValueCB(AtkValue *obj, GValue 
      if (!accWrap)
          return;
  
 -    nsCOMPtr<nsIAccessibleValue> accValue;
-+    nsIAccessibleValue* accValue;
++    nsIAccessibleValue* accValue = nsnull;
      accWrap->QueryInterface(NS_GET_IID(nsIAccessibleValue),
 -                            getter_AddRefs(accValue));
 +                            (void**)&accValue);
      if (!accValue)
          return;
  
 @@ -103,9 +103,9 @@ getMinimumValueCB(AtkValue *obj, GValue 
      if (!accWrap)
          return;
  
 -    nsCOMPtr<nsIAccessibleValue> accValue;
-+    nsIAccessibleValue* accValue;
++    nsIAccessibleValue* accValue = nsnull;
      accWrap->QueryInterface(NS_GET_IID(nsIAccessibleValue),
 -                            getter_AddRefs(accValue));
 +                            (void**)&accValue);
      if (!accValue)
          return;
  
 @@ -124,9 +124,9 @@ getMinimumIncrementCB(AtkValue *obj, GVa
      if (!accWrap)
          return;
  
 -    nsCOMPtr<nsIAccessibleValue> accValue;
-+    nsIAccessibleValue* accValue;
++    nsIAccessibleValue* accValue = nsnull;
      accWrap->QueryInterface(NS_GET_IID(nsIAccessibleValue),
 -                            getter_AddRefs(accValue));
 +                            (void**)&accValue);
      if (!accValue)
          return;
  
 @@ -145,9 +145,9 @@ setCurrentValueCB(AtkValue *obj, const G
      if (!accWrap)
          return FALSE;
  
 -    nsCOMPtr<nsIAccessibleValue> accValue;
-+    nsIAccessibleValue* accValue;
++    nsIAccessibleValue* accValue = nsnull;
      accWrap->QueryInterface(NS_GET_IID(nsIAccessibleValue),
 -                            getter_AddRefs(accValue));
 +                            (void**)&accValue);
      NS_ENSURE_TRUE(accValue, FALSE);
  
      double accDouble =g_value_get_double (value);
 diff --git a/accessible/src/atk/nsXULTreeAccessibleWrap.cpp b/accessible/src/atk/nsXULTreeAccessibleWrap.cpp
 --- a/accessible/src/atk/nsXULTreeAccessibleWrap.cpp
 +++ b/accessible/src/atk/nsXULTreeAccessibleWrap.cpp
 @@ -91,21 +91,21 @@ NS_IMETHODIMP nsXULTreeAccessibleWrap::G
  {
    nsresult rv = NS_OK;
  
 -  nsCOMPtr<nsIAccessible> acc;
 -  rv = nsAccessible::GetFirstChild(getter_AddRefs(acc));
-+  nsIAccessible* acc;
++  nsIAccessible* acc = nsnull;
 +  rv = nsAccessible::GetFirstChild(&acc);
    NS_ENSURE_TRUE(acc, NS_ERROR_FAILURE);
  
    rv = acc->GetChildCount(aColumns);
  
    // The last child could be column picker. In that case, we need to minus the
    // number of columns by 1
 -  nsCOMPtr<nsIAccessible> lastChildAccessible;
 -  acc->GetLastChild(getter_AddRefs(lastChildAccessible));
 -  nsCOMPtr<nsIAccessNode> accessNode = do_QueryInterface(lastChildAccessible);
-+  nsIAccessible* lastChildAccessible;
++  nsIAccessible* lastChildAccessible = nsnull;
 +  acc->GetLastChild(&lastChildAccessible);
 +  nsIAccessNode* accessNode = do_QueryInterface(lastChildAccessible);
    NS_ENSURE_TRUE(accessNode, NS_ERROR_FAILURE);
 -  nsCOMPtr<nsIDOMNode> domNode;
 -  accessNode->GetDOMNode(getter_AddRefs(domNode));
 -  nsCOMPtr<nsIContent> content = do_QueryInterface(domNode);
-+  nsIDOMNode* domNode;
++  nsIDOMNode* domNode = nsnull;
 +  accessNode->GetDOMNode(&domNode);
 +  nsIContent* content = do_QueryInterface(domNode);
    NS_ENSURE_TRUE(content, NS_ERROR_FAILURE);
    // it's menupopup inside column picker
    if (content->NodeInfo()->Equals(nsAccessibilityAtoms::menupopup,
 @@ -120,11 +120,11 @@ NS_IMETHODIMP nsXULTreeAccessibleWrap::G
  {
    nsresult rv = NS_OK;
  
 -  nsCOMPtr<nsIAccessible> acc;
 -  nsAccessible::GetFirstChild(getter_AddRefs(acc));
-+  nsIAccessible* acc;
++  nsIAccessible* acc = nsnull;
 +  nsAccessible::GetFirstChild(&acc);
    NS_ENSURE_TRUE(acc, NS_ERROR_FAILURE);
  
 -  nsCOMPtr<nsIAccessibleTable> accTable(do_QueryInterface(acc, &rv));
 +  nsIAccessibleTable* accTable(do_QueryInterface(acc, &rv));
    NS_ENSURE_SUCCESS(rv, rv);
  
    *aColumnHeader = accTable;
@@ -1443,89 +1443,89 @@ diff --git a/accessible/src/atk/nsXULTre
    NS_ENSURE_TRUE(outArray, NS_ERROR_OUT_OF_MEMORY);
  
 -  nsCOMPtr<nsITreeView> view;
 -  rv = mTree->GetView(getter_AddRefs(view));
 -  NS_ENSURE_SUCCESS(rv, rv);
 -
 -  nsCOMPtr<nsITreeSelection> selection;
 -  rv = view->GetSelection(getter_AddRefs(selection));
-+  nsITreeView* view;
++  nsITreeView* view = nsnull;
 +  rv = mTree->GetView(&view);
 +  NS_ENSURE_SUCCESS(rv, rv);
 +
-+  nsITreeSelection* selection;
++  nsITreeSelection* selection = nsnull;
 +  rv = view->GetSelection(&selection);
    NS_ENSURE_SUCCESS(rv, rv);
  
    PRInt32 rowCount;
 @@ -331,8 +331,8 @@ NS_IMETHODIMP nsXULTreeAccessibleWrap::G
  
  NS_IMETHODIMP nsXULTreeAccessibleWrap::GetColumnDescription(PRInt32 aColumn, nsAString & _retval)
  {
 -  nsCOMPtr<nsIAccessibleTable> columnHeader;
 -  nsresult rv = GetColumnHeader(getter_AddRefs(columnHeader));
-+  nsIAccessibleTable* columnHeader;
++  nsIAccessibleTable* columnHeader = nsnull;
 +  nsresult rv = GetColumnHeader(&columnHeader);
    if (NS_SUCCEEDED(rv) && columnHeader) {
      return columnHeader->GetColumnDescription(aColumn, _retval);
    }
 @@ -371,12 +371,12 @@ NS_IMETHODIMP nsXULTreeAccessibleWrap::I
  
    nsresult rv = NS_OK;
  
 -  nsCOMPtr<nsITreeView> view;
 -  rv = mTree->GetView(getter_AddRefs(view));
 -  NS_ENSURE_SUCCESS(rv, rv);
 -
 -  nsCOMPtr<nsITreeSelection> selection;
 -  rv = view->GetSelection(getter_AddRefs(selection));
-+  nsITreeView* view;
++  nsITreeView* view = nsnull;
 +  rv = mTree->GetView(&view);
 +  NS_ENSURE_SUCCESS(rv, rv);
 +
-+  nsITreeSelection* selection;
++  nsITreeSelection* selection = nsnull;
 +  rv = view->GetSelection(&selection);
    NS_ENSURE_SUCCESS(rv, rv);
  
    return selection->IsSelected(aRow, _retval);
 @@ -418,8 +418,8 @@ NS_IMETHODIMP nsXULTreeAccessibleWrap::C
    PRInt32 rowIndex;
    nsresult rv = GetRowAtIndex(aIndex, &rowIndex);
  
 -  nsCOMPtr<nsITreeSelection> selection;
 -  rv = mTreeView->GetSelection(getter_AddRefs(selection));
-+  nsITreeSelection* selection;
++  nsITreeSelection* selection = nsnull;
 +  rv = mTreeView->GetSelection(&selection);
    NS_ASSERTION(selection, "Can't get selection from mTreeView");
  
    if (selection) {
 @@ -532,12 +532,12 @@ NS_IMETHODIMP nsXULTreeColumnsAccessible
  
  NS_IMETHODIMP nsXULTreeColumnsAccessibleWrap::CellRefAt(PRInt32 aRow, PRInt32 aColumn, nsIAccessible **_retval)
  {
 -  nsCOMPtr<nsIAccessible> next, temp;
 -  GetFirstChild(getter_AddRefs(next));
-+  nsIAccessible* next, *temp;
++  nsIAccessible* next = nsnull, *temp = nsnull;
 +  GetFirstChild(&next);
    NS_ENSURE_TRUE(next, NS_ERROR_FAILURE);
  
    for (PRInt32 col = 0; col < aColumn; col++) {
 -    next->GetNextSibling(getter_AddRefs(temp));
 +    next->GetNextSibling(&temp);
      NS_ENSURE_TRUE(temp, NS_ERROR_FAILURE);
  
      next = temp;
 @@ -590,8 +590,8 @@ NS_IMETHODIMP nsXULTreeColumnsAccessible
  
  NS_IMETHODIMP nsXULTreeColumnsAccessibleWrap::GetColumnDescription(PRInt32 aColumn, nsAString & _retval)
  {
 -  nsCOMPtr<nsIAccessible> column;  
 -  nsresult rv = CellRefAt(0, aColumn, getter_AddRefs(column));
-+  nsIAccessible* column;  
++  nsIAccessible* column = nsnull;  
 +  nsresult rv = CellRefAt(0, aColumn, &column);
    if (NS_SUCCEEDED(rv) && column) {
      return column->GetName(_retval);
    }
 diff --git a/accessible/src/base/nsAccessNode.cpp b/accessible/src/base/nsAccessNode.cpp
 --- a/accessible/src/base/nsAccessNode.cpp
 +++ b/accessible/src/base/nsAccessNode.cpp
 @@ -143,21 +143,21 @@ NS_IMETHODIMP nsAccessNode::Init()
@@ -1543,17 +1543,17 @@ diff --git a/accessible/src/base/nsAcces
 +    nsIPresShell* presShell(do_QueryReferent(mWeakShell));
      if (presShell) {
 -      nsCOMPtr<nsIDOMNode> docNode(do_QueryInterface(presShell->GetDocument()));
 +      nsIDOMNode* docNode(do_QueryInterface(presShell->GetDocument()));
        if (docNode) {
          nsIAccessibilityService *accService = GetAccService();
          if (accService) {
 -          nsCOMPtr<nsIAccessible> accessible;
-+          nsIAccessible* accessible;
++          nsIAccessible* accessible = nsnull;
            accService->GetAccessibleInShell(docNode, presShell,
 -                                           getter_AddRefs(accessible));
 +                                           &accessible);
            docAccessible = do_QueryInterface(accessible);
          }
        }
 @@ -169,7 +169,7 @@ NS_IMETHODIMP nsAccessNode::Init()
    }
@@ -1641,17 +1641,17 @@ diff --git a/accessible/src/base/nsAcces
 +  nsIDocShellTreeItem* docShellTreeItem =
      nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
    NS_ASSERTION(docShellTreeItem, "No docshell tree item for mDOMNode");
    if (!docShellTreeItem) {
      return nsnull;
    }
 -  nsCOMPtr<nsIDocShellTreeItem> root;
 -  docShellTreeItem->GetRootTreeItem(getter_AddRefs(root));
-+  nsIDocShellTreeItem* root;
++  nsIDocShellTreeItem* root = nsnull;
 +  docShellTreeItem->GetRootTreeItem(&root);
    NS_ASSERTION(root, "No root content tree item");
    if (!root) {
      return nsnull;
    }
  
 -  nsCOMPtr<nsIAccessibleDocument> accDoc = GetDocAccessibleFor(root);
 +  nsIAccessibleDocument* accDoc = GetDocAccessibleFor(root);
@@ -1716,79 +1716,79 @@ diff --git a/accessible/src/base/nsAcces
  
    PRInt16 vPercent, hPercent;
 @@ -454,13 +454,13 @@ nsAccessNode::MakeAccessNode(nsIDOMNode 
    nsIAccessibilityService *accService = GetAccService();
    NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
  
 -  nsCOMPtr<nsIAccessNode> accessNode;
 -  accService->GetCachedAccessNode(aNode, mWeakShell, getter_AddRefs(accessNode));
-+  nsIAccessNode* accessNode;
++  nsIAccessNode* accessNode = nsnull;
 +  accService->GetCachedAccessNode(aNode, mWeakShell, &accessNode);
  
    if (!accessNode) {
 -    nsCOMPtr<nsIAccessible> accessible;
-+    nsIAccessible* accessible;
++    nsIAccessible* accessible = nsnull;
      accService->GetAccessibleInWeakShell(aNode, mWeakShell,
 -                                         getter_AddRefs(accessible));
 +                                         &accessible);
  
      accessNode = do_QueryInterface(accessible);
    }
 @@ -488,8 +488,8 @@ nsAccessNode::GetFirstChildNode(nsIAcces
    *aAccessNode = nsnull;
    NS_ENSURE_TRUE(mDOMNode, NS_ERROR_NULL_POINTER);
  
 -  nsCOMPtr<nsIDOMNode> domNode;
 -  mDOMNode->GetFirstChild(getter_AddRefs(domNode));
-+  nsIDOMNode* domNode;
++  nsIDOMNode* domNode = nsnull;
 +  mDOMNode->GetFirstChild(&domNode);
  
    return domNode ? MakeAccessNode(domNode, aAccessNode) : NS_OK;
  }
 @@ -501,8 +501,8 @@ nsAccessNode::GetLastChildNode(nsIAccess
    *aAccessNode = nsnull;
    NS_ENSURE_TRUE(mDOMNode, NS_ERROR_NULL_POINTER);
  
 -  nsCOMPtr<nsIDOMNode> domNode;
 -  mDOMNode->GetLastChild(getter_AddRefs(domNode));
-+  nsIDOMNode* domNode;
++  nsIDOMNode* domNode = nsnull;
 +  mDOMNode->GetLastChild(&domNode);
  
    return domNode ? MakeAccessNode(domNode, aAccessNode) : NS_OK;
  }
 @@ -514,8 +514,8 @@ nsAccessNode::GetParentNode(nsIAccessNod
    *aAccessNode = nsnull;
    NS_ENSURE_TRUE(mDOMNode, NS_ERROR_NULL_POINTER);
  
 -  nsCOMPtr<nsIDOMNode> domNode;
 -  mDOMNode->GetParentNode(getter_AddRefs(domNode));
-+  nsIDOMNode* domNode;
++  nsIDOMNode* domNode = nsnull;
 +  mDOMNode->GetParentNode(&domNode);
  
    return domNode ? MakeAccessNode(domNode, aAccessNode) : NS_OK;
  }
 @@ -527,8 +527,8 @@ nsAccessNode::GetPreviousSiblingNode(nsI
    *aAccessNode = nsnull;
    NS_ENSURE_TRUE(mDOMNode, NS_ERROR_NULL_POINTER);
  
 -  nsCOMPtr<nsIDOMNode> domNode;
 -  mDOMNode->GetPreviousSibling(getter_AddRefs(domNode));
-+  nsIDOMNode* domNode;
++  nsIDOMNode* domNode = nsnull;
 +  mDOMNode->GetPreviousSibling(&domNode);
  
    return domNode ? MakeAccessNode(domNode, aAccessNode) : NS_OK;
  }
 @@ -540,8 +540,8 @@ nsAccessNode::GetNextSiblingNode(nsIAcce
    *aAccessNode = nsnull;
    NS_ENSURE_TRUE(mDOMNode, NS_ERROR_NULL_POINTER);
  
 -  nsCOMPtr<nsIDOMNode> domNode;
 -  mDOMNode->GetNextSibling(getter_AddRefs(domNode));
-+  nsIDOMNode* domNode;
++  nsIDOMNode* domNode = nsnull;
 +  mDOMNode->GetNextSibling(&domNode);
  
    return domNode ? MakeAccessNode(domNode, aAccessNode) : NS_OK;
  }
 @@ -552,10 +552,10 @@ nsAccessNode::GetChildNodeAt(PRInt32 aCh
    NS_ENSURE_ARG_POINTER(aAccessNode);
    *aAccessNode = nsnull;
  
@@ -1807,40 +1807,40 @@ diff --git a/accessible/src/base/nsAcces
  {
 -  nsCOMPtr<nsIDOMElement> domElement(do_QueryInterface(mDOMNode));
 +  nsIDOMElement* domElement(do_QueryInterface(mDOMNode));
    if (!domElement) {
      return NS_ERROR_FAILURE;
    }
 -  nsCOMPtr<nsIDOMCSSStyleDeclaration> styleDecl;
 -  GetComputedStyleDeclaration(aPseudoElt, domElement, getter_AddRefs(styleDecl));
-+  nsIDOMCSSStyleDeclaration* styleDecl;
++  nsIDOMCSSStyleDeclaration* styleDecl = nsnull;
 +  GetComputedStyleDeclaration(aPseudoElt, domElement, &styleDecl);
    NS_ENSURE_TRUE(styleDecl, NS_ERROR_FAILURE);
    
    return styleDecl->GetPropertyValue(aPropertyName, aValue);
 @@ -584,17 +584,17 @@ nsAccessNode::GetComputedStyleCSSValue(c
  
    *aCSSValue = nsnull;
  
 -  nsCOMPtr<nsIDOMElement> domElement(do_QueryInterface(mDOMNode));
 +  nsIDOMElement* domElement(do_QueryInterface(mDOMNode));
    if (!domElement)
      return NS_ERROR_FAILURE;
  
 -  nsCOMPtr<nsIDOMCSSStyleDeclaration> styleDecl;
-+  nsIDOMCSSStyleDeclaration* styleDecl;
++  nsIDOMCSSStyleDeclaration* styleDecl = nsnull;
    GetComputedStyleDeclaration(aPseudoElt, domElement,
 -                              getter_AddRefs(styleDecl));
 +                              &styleDecl);
    NS_ENSURE_STATE(styleDecl);
  
 -  nsCOMPtr<nsIDOMCSSValue> cssValue;
 -  styleDecl->GetPropertyCSSValue(aPropertyName, getter_AddRefs(cssValue));
-+  nsIDOMCSSValue* cssValue;
++  nsIDOMCSSValue* cssValue = nsnull;
 +  styleDecl->GetPropertyCSSValue(aPropertyName, &cssValue);
    NS_ENSURE_TRUE(cssValue, NS_ERROR_FAILURE);
  
    return CallQueryInterface(cssValue, aCSSValue);
 @@ -606,58 +606,58 @@ void nsAccessNode::GetComputedStyleDecla
  {
    *aCssDecl = nsnull;
    // Returns number of items in style declaration
@@ -1858,31 +1858,31 @@ diff --git a/accessible/src/base/nsAcces
 -  nsCOMPtr<nsIDOMViewCSS> viewCSS(do_QueryInterface(doc->GetWindow()));
 +  nsIDOMViewCSS* viewCSS(do_QueryInterface(doc->GetWindow()));
    if (!viewCSS) {
      return;
    }
  
 -  nsCOMPtr<nsIDOMCSSStyleDeclaration> cssDecl;
 -  viewCSS->GetComputedStyle(aElement, aPseudoElt, getter_AddRefs(cssDecl));
-+  nsIDOMCSSStyleDeclaration* cssDecl;
++  nsIDOMCSSStyleDeclaration* cssDecl = nsnull;
 +  viewCSS->GetComputedStyle(aElement, aPseudoElt, &cssDecl);
    *aCssDecl = cssDecl;
  }
  
  /***************** Hashtable of nsIAccessNode's *****************/
  
 -already_AddRefed<nsIAccessibleDocument>
 +nsIAccessibleDocument*
  nsAccessNode::GetDocAccessibleFor(nsIWeakReference *aPresShell)
  {
    nsIAccessibleDocument *docAccessible = nsnull;
 -  nsCOMPtr<nsIAccessNode> accessNode;
 -  gGlobalDocAccessibleCache.Get(static_cast<void*>(aPresShell), getter_AddRefs(accessNode));
-+  nsIAccessNode* accessNode;
++  nsIAccessNode* accessNode = nsnull;
 +  gGlobalDocAccessibleCache.Get(static_cast<void*>(aPresShell), &accessNode);
    if (accessNode) {
      CallQueryInterface(accessNode, &docAccessible);
    }
    return docAccessible;
  }
   
 -already_AddRefed<nsIAccessibleDocument>
@@ -1891,31 +1891,31 @@ diff --git a/accessible/src/base/nsAcces
  {
    if (!aCanCreate) {
 -    nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(aContainer));
 +    nsIDocShell* docShell(do_QueryInterface(aContainer));
      NS_ASSERTION(docShell, "This method currently only supports docshells");
 -    nsCOMPtr<nsIPresShell> presShell;
 -    docShell->GetPresShell(getter_AddRefs(presShell));
 -    nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(presShell));
-+    nsIPresShell* presShell;
++    nsIPresShell* presShell = nsnull;
 +    docShell->GetPresShell(&presShell);
 +    nsIWeakReference* weakShell(do_GetWeakReference(presShell));
      return weakShell ? GetDocAccessibleFor(weakShell) : nsnull;
    }
  
 -  nsCOMPtr<nsIDOMNode> node = GetDOMNodeForContainer(aContainer);
 +  nsIDOMNode* node = GetDOMNodeForContainer(aContainer);
    if (!node) {
      return nsnull;
    }
  
 -  nsCOMPtr<nsIAccessible> accessible;
 -  GetAccService()->GetAccessibleFor(node, getter_AddRefs(accessible));
-+  nsIAccessible* accessible;
++  nsIAccessible* accessible = nsnull;
 +  GetAccService()->GetAccessibleFor(node, &accessible);
    nsIAccessibleDocument *docAccessible = nsnull;
    if (accessible) {
      CallQueryInterface(accessible, &docAccessible);
 @@ -665,20 +665,20 @@ nsAccessNode::GetDocAccessibleFor(nsISup
    return docAccessible;
  }
   
@@ -1932,17 +1932,17 @@ diff --git a/accessible/src/base/nsAcces
  
 -already_AddRefed<nsIPresShell>
 +nsIPresShell*
  nsAccessNode::GetPresShellFor(nsIDOMNode *aNode)
  {
 -  nsCOMPtr<nsIDOMDocument> domDocument;
 -  aNode->GetOwnerDocument(getter_AddRefs(domDocument));
 -  nsCOMPtr<nsIDocument> doc(do_QueryInterface(domDocument));
-+  nsIDOMDocument* domDocument;
++  nsIDOMDocument* domDocument = nsnull;
 +  aNode->GetOwnerDocument(&domDocument);
 +  nsIDocument* doc(do_QueryInterface(domDocument));
    if (!doc) {   // This is necessary when the node is the document node
      doc = do_QueryInterface(aNode);
    }
 @@ -689,20 +689,20 @@ nsAccessNode::GetPresShellFor(nsIDOMNode
    return presShell;
  }
@@ -1951,25 +1951,25 @@ diff --git a/accessible/src/base/nsAcces
 +nsIDOMNode*
  nsAccessNode::GetDOMNodeForContainer(nsISupports *aContainer)
  {
    nsIDOMNode* node = nsnull;
 -  nsCOMPtr<nsIDocShell> shell = do_QueryInterface(aContainer);
 -  nsCOMPtr<nsIContentViewer> cv;
 -  shell->GetContentViewer(getter_AddRefs(cv));
 +  nsIDocShell* shell = do_QueryInterface(aContainer);
-+  nsIContentViewer* cv;
++  nsIContentViewer* cv = nsnull;
 +  shell->GetContentViewer(&cv);
    if (cv) {
 -    nsCOMPtr<nsIDocumentViewer> docv(do_QueryInterface(cv));
 +    nsIDocumentViewer* docv(do_QueryInterface(cv));
      if (docv) {
 -      nsCOMPtr<nsIDocument> doc;
 -      docv->GetDocument(getter_AddRefs(doc));
-+      nsIDocument* doc;
++      nsIDocument* doc = nsnull;
 +      docv->GetDocument(&doc);
        if (doc) {
 -        CallQueryInterface(doc.get(), &node);
 +        CallQueryInterface(doc, &node);
        }
      }
    }
 @@ -733,7 +733,7 @@ nsAccessNode::GetCacheEntry(nsAccessNode
@@ -2002,31 +2002,31 @@ diff --git a/accessible/src/base/nsAcces
      return nsnull;
    }
 @@ -760,18 +760,18 @@ already_AddRefed<nsIDOMNode> nsAccessNod
    if (!focusController) {
      return nsnull;
    }
 -  nsCOMPtr<nsIDOMElement> focusedElement;
 -  focusController->GetFocusedElement(getter_AddRefs(focusedElement));
-+  nsIDOMElement* focusedElement;
++  nsIDOMElement* focusedElement = nsnull;
 +  focusController->GetFocusedElement(&focusedElement);
    nsIDOMNode *focusedNode = nsnull;
    if (!focusedElement) {
      // Document itself has focus
 -    nsCOMPtr<nsIDOMWindowInternal> focusedWinInternal;
 -    focusController->GetFocusedWindow(getter_AddRefs(focusedWinInternal));
-+    nsIDOMWindowInternal* focusedWinInternal;
++    nsIDOMWindowInternal* focusedWinInternal = nsnull;
 +    focusController->GetFocusedWindow(&focusedWinInternal);
      if (!focusedWinInternal) {
        return nsnull;
      }
 -    nsCOMPtr<nsIDOMDocument> focusedDOMDocument;
 -    focusedWinInternal->GetDocument(getter_AddRefs(focusedDOMDocument));
-+    nsIDOMDocument* focusedDOMDocument;
++    nsIDOMDocument* focusedDOMDocument = nsnull;
 +    focusedWinInternal->GetDocument(&focusedDOMDocument);
      if (!focusedDOMDocument) {
        return nsnull;
      }
 @@ -788,22 +788,22 @@ nsAccessNode::GetLanguage(nsAString& aLa
  nsAccessNode::GetLanguage(nsAString& aLanguage)
  {
    aLanguage.Truncate();
@@ -2039,24 +2039,24 @@ diff --git a/accessible/src/base/nsAcces
 +    nsIDOMDocument* domDoc(do_QueryInterface(mDOMNode));
      if (domDoc) {
 -      nsCOMPtr<nsIDOMHTMLDocument> htmlDoc(do_QueryInterface(mDOMNode));
 +      nsIDOMHTMLDocument* htmlDoc(do_QueryInterface(mDOMNode));
        if (htmlDoc) {
          // Make sure we look for lang attribute on HTML <body>
 -        nsCOMPtr<nsIDOMHTMLElement> bodyElement;
 -        htmlDoc->GetBody(getter_AddRefs(bodyElement));
-+        nsIDOMHTMLElement* bodyElement;
++        nsIDOMHTMLElement* bodyElement = nsnull;
 +        htmlDoc->GetBody(&bodyElement);
          content = do_QueryInterface(bodyElement);
        }
        if (!content) {
 -        nsCOMPtr<nsIDOMElement> docElement;
 -        domDoc->GetDocumentElement(getter_AddRefs(docElement));
-+        nsIDOMElement* docElement;
++        nsIDOMElement* docElement = nsnull;
 +        domDoc->GetDocumentElement(&docElement);
          content = do_QueryInterface(docElement);
        }
      }
 @@ -839,7 +839,7 @@ nsAccessNode::GetARIARole(nsIContent *aC
      if (!aContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::role, aRole)) {
        return PR_FALSE;
      }
@@ -2161,37 +2161,37 @@ diff --git a/accessible/src/base/nsAcces
        progress->RemoveProgressListener(static_cast<nsIWebProgressListener*>(this));
      }
 @@ -172,23 +172,23 @@ NS_IMETHODIMP nsAccessibilityService::On
      return NS_OK;
    }
  
 -  nsCOMPtr<nsIDOMWindow> domWindow;
 -  aWebProgress->GetDOMWindow(getter_AddRefs(domWindow));
-+  nsIDOMWindow* domWindow;
++  nsIDOMWindow* domWindow = nsnull;
 +  aWebProgress->GetDOMWindow(&domWindow);
    NS_ASSERTION(domWindow, "DOM Window for state change is null");
    NS_ENSURE_TRUE(domWindow, NS_ERROR_FAILURE);
  
 -  nsCOMPtr<nsIDOMDocument> domDoc;
 -  domWindow->GetDocument(getter_AddRefs(domDoc));
 -  nsCOMPtr<nsIDOMNode> domDocRootNode(do_QueryInterface(domDoc));
-+  nsIDOMDocument* domDoc;
++  nsIDOMDocument* domDoc = nsnull;
 +  domWindow->GetDocument(&domDoc);
 +  nsIDOMNode* domDocRootNode(do_QueryInterface(domDoc));
    NS_ENSURE_TRUE(domDocRootNode, NS_ERROR_FAILURE);
  
    // Get the accessible for the new document.
    // If it not created yet this will create it & cache it, as well as 
    // set up event listeners so that MSAA/ATK toolkit and internal 
    // accessibility events will get fired.
 -  nsCOMPtr<nsIAccessible> accessible;
 -  GetAccessibleFor(domDocRootNode, getter_AddRefs(accessible));
 -  nsCOMPtr<nsPIAccessibleDocument> docAccessible =
-+  nsIAccessible* accessible;
++  nsIAccessible* accessible = nsnull;
 +  GetAccessibleFor(domDocRootNode, &accessible);
 +  nsPIAccessibleDocument* docAccessible =
      do_QueryInterface(accessible);
    NS_ENSURE_TRUE(docAccessible, NS_ERROR_FAILURE);
  
 @@ -199,8 +199,8 @@ NS_IMETHODIMP nsAccessibilityService::On
      eventType = nsIAccessibleEvent::EVENT_DOCUMENT_LOAD_STOPPED;
    } else if (aStateFlags & STATE_START) {
@@ -2204,25 +2204,25 @@ diff --git a/accessible/src/base/nsAcces
      PRUint32 loadType;
      docShell->GetLoadType(&loadType);
 @@ -238,19 +238,19 @@ NS_IMETHODIMP nsAccessibilityService::On
    // If there is no accessible for the document, we will ignore
    // this and the anchor jump event will be fired via OnStateChange
    // and nsIAccessibleStates::STATE_STOP
 -  nsCOMPtr<nsIDOMWindow> domWindow;
 -  aWebProgress->GetDOMWindow(getter_AddRefs(domWindow));
-+  nsIDOMWindow* domWindow;
++  nsIDOMWindow* domWindow = nsnull;
 +  aWebProgress->GetDOMWindow(&domWindow);
    NS_ASSERTION(domWindow, "DOM Window for state change is null");
    NS_ENSURE_TRUE(domWindow, NS_ERROR_FAILURE);
  
 -  nsCOMPtr<nsIDOMDocument> domDoc;
 -  domWindow->GetDocument(getter_AddRefs(domDoc));
 -  nsCOMPtr<nsIDOMNode> domDocRootNode(do_QueryInterface(domDoc));
-+  nsIDOMDocument* domDoc;
++  nsIDOMDocument* domDoc = nsnull;
 +  domWindow->GetDocument(&domDoc);
 +  nsIDOMNode* domDocRootNode(do_QueryInterface(domDoc));
    NS_ENSURE_TRUE(domDocRootNode, NS_ERROR_FAILURE);
  
 -  nsCOMPtr<nsIAccessibleDocument> accessibleDoc =
 +  nsIAccessibleDocument* accessibleDoc =
      nsAccessNode::GetDocAccessibleFor(domDocRootNode);
 -  nsCOMPtr<nsPIAccessibleDocument> privateAccessibleDoc =
@@ -2257,17 +2257,17 @@ diff --git a/accessible/src/base/nsAcces
  
 @@ -303,9 +303,9 @@ nsresult
  nsresult
  nsAccessibilityService::GetShellFromNode(nsIDOMNode *aNode, nsIWeakReference **aWeakShell)
  {
 -  nsCOMPtr<nsIDOMDocument> domDoc;
 -  aNode->GetOwnerDocument(getter_AddRefs(domDoc));
 -  nsCOMPtr<nsIDocument> doc(do_QueryInterface(domDoc));
-+  nsIDOMDocument* domDoc;
++  nsIDOMDocument* domDoc = nsnull;
 +  aNode->GetOwnerDocument(&domDoc);
 +  nsIDocument* doc(do_QueryInterface(domDoc));
    if (!doc)
      return NS_ERROR_INVALID_ARG;
  
 @@ -314,7 +314,7 @@ nsAccessibilityService::GetShellFromNode
    if (!shell)
      return NS_ERROR_FAILURE;
@@ -2278,17 +2278,17 @@ diff --git a/accessible/src/base/nsAcces
    *aWeakShell = weakRef;
  
 @@ -333,8 +333,8 @@ nsAccessibilityService::CreateOuterDocAc
    
    *aOuterDocAccessible = nsnull;
  
 -  nsCOMPtr<nsIWeakReference> outerWeakShell;
 -  GetShellFromNode(aDOMNode, getter_AddRefs(outerWeakShell));
-+  nsIWeakReference* outerWeakShell;
++  nsIWeakReference* outerWeakShell = nsnull;
 +  GetShellFromNode(aDOMNode, &outerWeakShell);
    NS_ENSURE_TRUE(outerWeakShell, NS_ERROR_FAILURE);
  
    nsOuterDocAccessible *outerDocAccessible =
 @@ -353,22 +353,22 @@ nsAccessibilityService::CreateRootAccess
  {
    *aRootAcc = nsnull;
  
@@ -2308,17 +2308,17 @@ diff --git a/accessible/src/base/nsAcces
 +
 +  nsISupports* container = aDocument->GetContainer();
 +  nsIDocShellTreeItem* docShellTreeItem =
      do_QueryInterface(container);
    NS_ENSURE_TRUE(docShellTreeItem, NS_ERROR_FAILURE);
    
 -  nsCOMPtr<nsIDocShellTreeItem> parentTreeItem;
 -  docShellTreeItem->GetParent(getter_AddRefs(parentTreeItem));
-+  nsIDocShellTreeItem* parentTreeItem;
++  nsIDocShellTreeItem* parentTreeItem = nsnull;
 +  docShellTreeItem->GetParent(&parentTreeItem);
  
    if (parentTreeItem) {
      // We only create root accessibles for the true root, othewise create a
 @@ -381,7 +381,7 @@ nsAccessibilityService::CreateRootAccess
    if (!*aRootAcc)
      return NS_ERROR_OUT_OF_MEMORY;
  
@@ -2329,31 +2329,31 @@ diff --git a/accessible/src/base/nsAcces
  
 @@ -395,9 +395,9 @@ nsAccessibilityService::CreateHTML4Butto
  nsAccessibilityService::CreateHTML4ButtonAccessible(nsISupports *aFrame, nsIAccessible **_retval)
  {
    nsIFrame* frame;
 -  nsCOMPtr<nsIDOMNode> node;
 -  nsCOMPtr<nsIWeakReference> weakShell;
 -  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
-+  nsIDOMNode* node;
-+  nsIWeakReference* weakShell;
++  nsIDOMNode* node = nsnull;
++  nsIWeakReference* weakShell = nsnull;
 +  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
    if (NS_FAILED(rv))
      return rv;
  
 @@ -412,9 +412,9 @@ nsAccessibilityService::CreateHTMLButton
  nsAccessibilityService::CreateHTMLButtonAccessible(nsISupports *aFrame, nsIAccessible **_retval)
  {
    nsIFrame* frame;
 -  nsCOMPtr<nsIDOMNode> node;
 -  nsCOMPtr<nsIWeakReference> weakShell;
 -  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
-+  nsIDOMNode* node;
-+  nsIWeakReference* weakShell;
++  nsIDOMNode* node = nsnull;
++  nsIWeakReference* weakShell = nsnull;
 +  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
    if (NS_FAILED(rv))
      return rv;
  
 @@ -433,7 +433,7 @@ nsAccessibilityService::CreateHTMLAccess
  {
    // This method assumes we're in an HTML namespace.
    *aAccessible = nsnull;
@@ -2364,62 +2364,62 @@ diff --git a/accessible/src/base/nsAcces
      *aAccessible = new nsHTMLLegendAccessible(aNode, aWeakShell);
 @@ -486,9 +486,9 @@ nsAccessibilityService::CreateHTMLLIAcce
                                                 nsIAccessible **_retval)
  {
    nsIFrame* frame;
 -  nsCOMPtr<nsIDOMNode> node;
 -  nsCOMPtr<nsIWeakReference> weakShell;
 -  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
-+  nsIDOMNode* node;
-+  nsIWeakReference* weakShell;
++  nsIDOMNode* node = nsnull;
++  nsIWeakReference* weakShell = nsnull;
 +  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
    if (NS_FAILED(rv))
      return rv;
  
 @@ -503,13 +503,13 @@ nsAccessibilityService::CreateHyperTextA
  nsAccessibilityService::CreateHyperTextAccessible(nsISupports *aFrame, nsIAccessible **aAccessible)
  {
    nsIFrame* frame;
 -  nsCOMPtr<nsIDOMNode> node;
 -  nsCOMPtr<nsIWeakReference> weakShell;
 -  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
-+  nsIDOMNode* node;
-+  nsIWeakReference* weakShell;
++  nsIDOMNode* node = nsnull;
++  nsIWeakReference* weakShell = nsnull;
 +  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
    if (NS_FAILED(rv))
      return rv;
  
 -  nsCOMPtr<nsIContent> content(do_QueryInterface(node));
 +  nsIContent* content(do_QueryInterface(node));
    NS_ENSURE_TRUE(content, NS_ERROR_FAILURE);
    
    if (nsAccUtils::HasListener(content, NS_LITERAL_STRING("click"))) {
 @@ -530,9 +530,9 @@ nsAccessibilityService::CreateHTMLCheckb
  nsAccessibilityService::CreateHTMLCheckboxAccessible(nsISupports *aFrame, nsIAccessible **_retval)
  {
    nsIFrame* frame;
 -  nsCOMPtr<nsIDOMNode> node;
 -  nsCOMPtr<nsIWeakReference> weakShell;
 -  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
-+  nsIDOMNode* node;
-+  nsIWeakReference* weakShell;
++  nsIDOMNode* node = nsnull;
++  nsIWeakReference* weakShell = nsnull;
 +  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
    if (NS_FAILED(rv))
      return rv;
  
 @@ -557,14 +557,14 @@ nsAccessibilityService::CreateHTMLImageA
  nsAccessibilityService::CreateHTMLImageAccessible(nsISupports *aFrame, nsIAccessible **_retval)
  {
    nsIFrame* frame;
 -  nsCOMPtr<nsIDOMNode> node;
 -  nsCOMPtr<nsIWeakReference> weakShell;
 -  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
-+  nsIDOMNode* node;
-+  nsIWeakReference* weakShell;
++  nsIDOMNode* node = nsnull;
++  nsIWeakReference* weakShell = nsnull;
 +  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
    if (NS_FAILED(rv))
      return rv;
  
    *_retval = nsnull;
 -  nsCOMPtr<nsIDOMElement> domElement(do_QueryInterface(node));
 +  nsIDOMElement* domElement(do_QueryInterface(node));
    if (domElement) {
@@ -2427,185 +2427,185 @@ diff --git a/accessible/src/base/nsAcces
    }
 @@ -585,9 +585,9 @@ nsAccessibilityService::CreateHTMLGroupb
  nsAccessibilityService::CreateHTMLGroupboxAccessible(nsISupports *aFrame, nsIAccessible **_retval)
  {
    nsIFrame* frame;
 -  nsCOMPtr<nsIDOMNode> node;
 -  nsCOMPtr<nsIWeakReference> weakShell;
 -  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
-+  nsIDOMNode* node;
-+  nsIWeakReference* weakShell;
++  nsIDOMNode* node = nsnull;
++  nsIWeakReference* weakShell = nsnull;
 +  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
    if (NS_FAILED(rv))
      return rv;
  
 @@ -621,20 +621,20 @@ nsAccessibilityService::CreateHTMLObject
  nsAccessibilityService::CreateHTMLObjectFrameAccessible(nsObjectFrame *aFrame,
                                                          nsIAccessible **aAccessible)
  {
 -  nsCOMPtr<nsIDOMNode> node;
 -  nsCOMPtr<nsIWeakReference> weakShell;
-+  nsIDOMNode* node;
-+  nsIWeakReference* weakShell;
++  nsIDOMNode* node = nsnull;
++  nsIWeakReference* weakShell = nsnull;
    nsIFrame *frame;
 -  GetInfo(static_cast<nsIFrame*>(aFrame), &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
 +  GetInfo(static_cast<nsIFrame*>(aFrame), &frame, &weakShell, &node);
  
    *aAccessible = nsnull;
    if (!frame || frame->GetRect().IsEmpty()) {
      return NS_ERROR_FAILURE;
    }
    // 1) for object elements containing either HTML or TXT documents
 -  nsCOMPtr<nsIDOMDocument> domDoc;
 -  nsCOMPtr<nsIDOMHTMLObjectElement> obj(do_QueryInterface(node));
-+  nsIDOMDocument* domDoc;
++  nsIDOMDocument* domDoc = nsnull;
 +  nsIDOMHTMLObjectElement* obj(do_QueryInterface(node));
    if (obj)
 -    obj->GetContentDocument(getter_AddRefs(domDoc));
 +    obj->GetContentDocument(&domDoc);
    else
      domDoc = do_QueryInterface(node);
    if (domDoc)
 @@ -669,9 +669,9 @@ nsAccessibilityService::CreateHTMLRadioB
  nsAccessibilityService::CreateHTMLRadioButtonAccessible(nsISupports *aFrame, nsIAccessible **_retval)
  {
    nsIFrame* frame;
 -  nsCOMPtr<nsIDOMNode> node;
 -  nsCOMPtr<nsIWeakReference> weakShell;
 -  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
-+  nsIDOMNode* node;
-+  nsIWeakReference* weakShell;
++  nsIDOMNode* node = nsnull;
++  nsIWeakReference* weakShell = nsnull;
 +  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
    if (NS_FAILED(rv))
      return rv;
  
 @@ -699,9 +699,9 @@ nsAccessibilityService::CreateHTMLTableA
  nsAccessibilityService::CreateHTMLTableAccessible(nsISupports *aFrame, nsIAccessible **_retval)
  {
    nsIFrame* frame;
 -  nsCOMPtr<nsIDOMNode> node;
 -  nsCOMPtr<nsIWeakReference> weakShell;
 -  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
-+  nsIDOMNode* node;
-+  nsIWeakReference* weakShell;
++  nsIDOMNode* node = nsnull;
++  nsIWeakReference* weakShell = nsnull;
 +  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
    if (NS_FAILED(rv))
      return rv;
  
 @@ -723,8 +723,8 @@ nsAccessibilityService::CreateHTMLTableH
  
    nsresult rv = NS_OK;
  
 -  nsCOMPtr<nsIWeakReference> weakShell;
 -  rv = GetShellFromNode(aDOMNode, getter_AddRefs(weakShell));
-+  nsIWeakReference* weakShell;
++  nsIWeakReference* weakShell = nsnull;
 +  rv = GetShellFromNode(aDOMNode, &weakShell);
    NS_ENSURE_SUCCESS(rv, rv);
  
    nsHTMLTableHeadAccessibleWrap* accTableHead =
 @@ -742,9 +742,9 @@ nsAccessibilityService::CreateHTMLTableC
  nsAccessibilityService::CreateHTMLTableCellAccessible(nsISupports *aFrame, nsIAccessible **_retval)
  {
    nsIFrame* frame;
 -  nsCOMPtr<nsIDOMNode> node;
 -  nsCOMPtr<nsIWeakReference> weakShell;
 -  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
-+  nsIDOMNode* node;
-+  nsIWeakReference* weakShell;
++  nsIDOMNode* node = nsnull;
++  nsIWeakReference* weakShell = nsnull;
 +  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
    if (NS_FAILED(rv))
      return rv;
  
 @@ -761,9 +761,9 @@ nsAccessibilityService::CreateHTMLTextAc
    *_retval = nsnull;
  
    nsIFrame* frame;
 -  nsCOMPtr<nsIDOMNode> node;
 -  nsCOMPtr<nsIWeakReference> weakShell;
 -  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
-+  nsIDOMNode* node;
-+  nsIWeakReference* weakShell;
++  nsIDOMNode* node = nsnull;
++  nsIWeakReference* weakShell = nsnull;
 +  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
    if (NS_FAILED(rv))
      return rv;
  
 @@ -779,9 +779,9 @@ nsAccessibilityService::CreateHTMLTextFi
  nsAccessibilityService::CreateHTMLTextFieldAccessible(nsISupports *aFrame, nsIAccessible **_retval)
  {
    nsIFrame* frame;
 -  nsCOMPtr<nsIDOMNode> node;
 -  nsCOMPtr<nsIWeakReference> weakShell;
 -  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
-+  nsIDOMNode* node;
-+  nsIWeakReference* weakShell;
++  nsIDOMNode* node = nsnull;
++  nsIWeakReference* weakShell = nsnull;
 +  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
    if (NS_FAILED(rv))
      return rv;
  
 @@ -796,9 +796,9 @@ nsAccessibilityService::CreateHTMLLabelA
  nsAccessibilityService::CreateHTMLLabelAccessible(nsISupports *aFrame, nsIAccessible **_retval)
  {
    nsIFrame* frame;
 -  nsCOMPtr<nsIDOMNode> node;
 -  nsCOMPtr<nsIWeakReference> weakShell;
 -  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
-+  nsIDOMNode* node;
-+  nsIWeakReference* weakShell;
++  nsIDOMNode* node = nsnull;
++  nsIWeakReference* weakShell = nsnull;
 +  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
    if (NS_FAILED(rv))
      return rv;
  
 @@ -813,9 +813,9 @@ nsAccessibilityService::CreateHTMLHRAcce
  nsAccessibilityService::CreateHTMLHRAccessible(nsISupports *aFrame, nsIAccessible **_retval)
  {
    nsIFrame* frame;
 -  nsCOMPtr<nsIDOMNode> node;
 -  nsCOMPtr<nsIWeakReference> weakShell;
 -  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
-+  nsIDOMNode* node;
-+  nsIWeakReference* weakShell;
++  nsIDOMNode* node = nsnull;
++  nsIWeakReference* weakShell = nsnull;
 +  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
    if (NS_FAILED(rv))
      return rv;
  
 @@ -830,9 +830,9 @@ nsAccessibilityService::CreateHTMLBRAcce
  nsAccessibilityService::CreateHTMLBRAccessible(nsISupports *aFrame, nsIAccessible **_retval)
  {
    nsIFrame* frame;
 -  nsCOMPtr<nsIDOMNode> node;
 -  nsCOMPtr<nsIWeakReference> weakShell;
 -  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
-+  nsIDOMNode* node;
-+  nsIWeakReference* weakShell;
++  nsIDOMNode* node = nsnull;
++  nsIWeakReference* weakShell = nsnull;
 +  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
    if (NS_FAILED(rv))
      return rv;
  
 @@ -847,9 +847,9 @@ nsAccessibilityService::CreateHTMLCaptio
  nsAccessibilityService::CreateHTMLCaptionAccessible(nsISupports *aFrame, nsIAccessible **_retval)
  {
    nsIFrame* frame;
 -  nsCOMPtr<nsIDOMNode> node;
 -  nsCOMPtr<nsIWeakReference> weakShell;
 -  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
-+  nsIDOMNode* node;
-+  nsIWeakReference* weakShell;
++  nsIDOMNode* node = nsnull;
++  nsIWeakReference* weakShell = nsnull;
 +  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
    if (NS_FAILED(rv))
      return rv;
  
 @@ -864,9 +864,9 @@ NS_IMETHODIMP nsAccessibilityService::Ge
                                                            nsIWeakReference *aWeakShell,
                                                            nsIAccessible **aAccessible)
  {
 -  nsCOMPtr<nsIAccessNode> accessNode;
 -  nsresult rv = GetCachedAccessNode(aNode, aWeakShell, getter_AddRefs(accessNode));
 -  nsCOMPtr<nsIAccessible> accessible(do_QueryInterface(accessNode));
-+  nsIAccessNode* accessNode;
++  nsIAccessNode* accessNode = nsnull;
 +  nsresult rv = GetCachedAccessNode(aNode, aWeakShell, &accessNode);
 +  nsIAccessible* accessible(do_QueryInterface(accessNode));
    *aAccessible = accessible;
    return rv;
  }
 @@ -875,7 +875,7 @@ NS_IMETHODIMP nsAccessibilityService::Ge
                                                            nsIWeakReference *aWeakShell,
                                                            nsIAccessNode **aAccessNode)
@@ -2617,27 +2617,27 @@ diff --git a/accessible/src/base/nsAcces
    if (!accessibleDoc) {
 @@ -1061,8 +1061,8 @@ nsAccessibilityService::GetAccessibleFor
  
    // We use presentation shell #0 because we assume that is presentation of
    // given node window.
 -  nsCOMPtr<nsIContent> content(do_QueryInterface(aNode));
 -  nsCOMPtr<nsIDocument> doc;
 +  nsIContent* content(do_QueryInterface(aNode));
-+  nsIDocument* doc;
++  nsIDocument* doc = nsnull;
    if (content) {
      doc = content->GetDocument();
    }
 @@ -1085,8 +1085,8 @@ nsAccessibilityService::GetAttachedAcces
  
    *aAccessible = nsnull;
  
 -  nsCOMPtr<nsIDOMNode> relevantNode;
 -  nsresult rv = GetRelevantContentNodeFor(aNode, getter_AddRefs(relevantNode));
-+  nsIDOMNode* relevantNode;
++  nsIDOMNode* relevantNode = nsnull;
 +  nsresult rv = GetRelevantContentNodeFor(aNode, &relevantNode);
    NS_ENSURE_SUCCESS(rv, rv);
  
    if (relevantNode != aNode)
 @@ -1105,13 +1105,13 @@ NS_IMETHODIMP nsAccessibilityService::Ge
    NS_ENSURE_ARG(aNode);
    NS_ENSURE_ARG(aWin);
  
@@ -2645,17 +2645,17 @@ diff --git a/accessible/src/base/nsAcces
 -  nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(webNav));
 +  nsIWebNavigation* webNav(do_GetInterface(aWin));
 +  nsIDocShell* docShell(do_QueryInterface(webNav));
    if (!docShell)
      return NS_ERROR_FAILURE;
  
 -  nsCOMPtr<nsIPresShell> presShell;
 -  docShell->GetPresShell(getter_AddRefs(presShell));
-+  nsIPresShell* presShell;
++  nsIPresShell* presShell = nsnull;
 +  docShell->GetPresShell(&presShell);
    return GetAccessibleInShell(aNode, presShell, aAccessible);
  }
  
 @@ -1125,7 +1125,7 @@ NS_IMETHODIMP nsAccessibilityService::Ge
    NS_ENSURE_ARG(aNode);
    NS_ENSURE_ARG(aPresShell);
  
@@ -2694,29 +2694,29 @@ diff --git a/accessible/src/base/nsAcces
 @@ -1211,10 +1211,10 @@ NS_IMETHODIMP nsAccessibilityService::Ge
  
    // Check to see if we already have an accessible for this
    // node in the cache
 -  nsCOMPtr<nsIAccessNode> accessNode;
 -  GetCachedAccessNode(aNode, aWeakShell, getter_AddRefs(accessNode));
 -
 -  nsCOMPtr<nsIAccessible> newAcc;
-+  nsIAccessNode* accessNode;
++  nsIAccessNode* accessNode = nsnull;
 +  GetCachedAccessNode(aNode, aWeakShell, &accessNode);
 +
-+  nsIAccessible* newAcc;
++  nsIAccessible* newAcc = nsnull;
    if (accessNode) {
      // Retrieved from cache
      // QI might not succeed if it's a node that's not accessible
 @@ -1225,21 +1225,21 @@ NS_IMETHODIMP nsAccessibilityService::Ge
  
    // No cache entry, so we must create the accessible
    // Check to see if hidden first
 -  nsCOMPtr<nsIDocument> nodeIsDoc;
-+  nsIDocument* nodeIsDoc;
++  nsIDocument* nodeIsDoc = nsnull;
    if (!content) {
      // This happens when we're on the document node, which will not QI to an
      // nsIContent.
      nodeIsDoc = do_QueryInterface(aNode);
      NS_ENSURE_TRUE(nodeIsDoc, NS_ERROR_FAILURE); // No content, and not doc node
  
 -    nsCOMPtr<nsIAccessibleDocument> accessibleDoc =
 +    nsIAccessibleDocument* accessibleDoc =
@@ -2735,17 +2735,17 @@ diff --git a/accessible/src/base/nsAcces
          // Check if frame is an image frame, and content is <area>
          nsIImageFrame *imageFrame;
          CallQueryInterface(frame, &imageFrame);
 -        nsCOMPtr<nsIDOMHTMLAreaElement> areaElmt = do_QueryInterface(content);
 +        nsIDOMHTMLAreaElement* areaElmt = do_QueryInterface(content);
          if (imageFrame && areaElmt) {
 -          nsCOMPtr<nsIAccessible> imageAcc;
 -          CreateHTMLImageAccessible(frame, getter_AddRefs(imageAcc));
-+          nsIAccessible* imageAcc;
++          nsIAccessible* imageAcc = nsnull;
 +          CreateHTMLImageAccessible(frame, &imageAcc);
            if (imageAcc) {
              // cache children
              PRInt32 childCount;
 @@ -1324,7 +1324,7 @@ NS_IMETHODIMP nsAccessibilityService::Ge
        *aIsHidden = PR_TRUE;
        return NS_OK;
      }
@@ -2821,17 +2821,17 @@ diff --git a/accessible/src/base/nsAcces
        bindingParent = bindingsStack[index];
 -      nsCOMPtr<nsIDOMNode> bindingNode(do_QueryInterface(bindingParent));
 +      nsIDOMNode* bindingNode(do_QueryInterface(bindingParent));
        if (bindingNode) {
          // Try to get an accessible by type since XBL widget can be accessible
          // only if it implements nsIAccessibleProvider interface.
 -        nsCOMPtr<nsIAccessible> accessible;
 -        rv = GetAccessibleByType(bindingNode, getter_AddRefs(accessible));
-+        nsIAccessible* accessible;
++        nsIAccessible* accessible = nsnull;
 +        rv = GetAccessibleByType(bindingNode, &accessible);
  
          if (NS_SUCCEEDED(rv)) {
 -          nsCOMPtr<nsPIAccessible> paccessible(do_QueryInterface(accessible));
 +          nsPIAccessible* paccessible(do_QueryInterface(accessible));
            if (paccessible) {
              PRBool allowsAnonChildren = PR_FALSE;
              paccessible->GetAllowsAnonChildAccessibles(&allowsAnonChildren);
@@ -2845,17 +2845,17 @@ diff --git a/accessible/src/base/nsAcces
      return NS_OK;
  
 @@ -1561,8 +1561,8 @@ nsresult nsAccessibilityService::GetAcce
    if (type == nsIAccessibleProvider::OuterDoc)
      return CreateOuterDocAccessible(aNode, aAccessible);
  
 -  nsCOMPtr<nsIWeakReference> weakShell;
 -  GetShellFromNode(aNode, getter_AddRefs(weakShell));
-+  nsIWeakReference* weakShell;
++  nsIWeakReference* weakShell = nsnull;
 +  GetShellFromNode(aNode, &weakShell);
  
    switch (type)
    {
 @@ -1595,7 +1595,7 @@ nsresult nsAccessibilityService::GetAcce
      case nsIAccessibleProvider::XULImage:
      {
        // Don't include nameless images in accessible tree
@@ -2906,17 +2906,17 @@ diff --git a/accessible/src/base/nsAcces
    if (!privateAccessibleDoc) {
      return NS_OK;
 @@ -1873,15 +1873,15 @@ nsresult
  nsresult
  nsAccessibilityService::GetAccessibleForDeckChildren(nsIDOMNode *aNode, nsIAccessible** aAccessible)
  {
 -  nsCOMPtr<nsIWeakReference> weakShell;
 -  GetShellFromNode(aNode, getter_AddRefs(weakShell));
-+  nsIWeakReference* weakShell;
++  nsIWeakReference* weakShell = nsnull;
 +  GetShellFromNode(aNode, &weakShell);
    NS_ENSURE_TRUE(weakShell, NS_ERROR_FAILURE);
 -  nsCOMPtr<nsIPresShell> shell(do_QueryReferent(weakShell));
 +  nsIPresShell* shell(do_QueryReferent(weakShell));
    NS_ENSURE_TRUE(shell, NS_ERROR_FAILURE);
    
    nsIFrame* frame = nsnull;
    nsIFrame* parentFrame = nsnull;
@@ -2934,48 +2934,48 @@ diff --git a/accessible/src/base/nsAcces
  {
 -  nsCOMPtr<nsIDOMXULSelectControlItemElement> item(do_QueryInterface(aNode));
 +  nsIDOMXULSelectControlItemElement* item(do_QueryInterface(aNode));
    if (!item)
      return;
  
 -  nsCOMPtr<nsIDOMXULSelectControlElement> control;
 -  item->GetControl(getter_AddRefs(control));
-+  nsIDOMXULSelectControlElement* control;
++  nsIDOMXULSelectControlElement* control = nsnull;
 +  item->GetControl(&control);
    if (!control)
      return;
  
 @@ -184,13 +184,13 @@ nsAccUtils::SetAccAttrsForXULSelectContr
  
    PRUint32 setSize = itemsCount, posInSet = indexOf;
    for (PRUint32 index = 0; index < itemsCount; index++) {
 -    nsCOMPtr<nsIDOMXULSelectControlItemElement> currItem;
 -    control->GetItemAtIndex(index, getter_AddRefs(currItem));
 -    nsCOMPtr<nsIDOMNode> currNode(do_QueryInterface(currItem));
 -
 -    nsCOMPtr<nsIAccessible> itemAcc;
-+    nsIDOMXULSelectControlItemElement* currItem;
++    nsIDOMXULSelectControlItemElement* currItem = nsnull;
 +    control->GetItemAtIndex(index, &currItem);
 +    nsIDOMNode* currNode(do_QueryInterface(currItem));
 +
-+    nsIAccessible* itemAcc;
++    nsIAccessible* itemAcc = nsnull;
      nsAccessNode::GetAccService()->GetAccessibleFor(currNode,
 -                                                    getter_AddRefs(itemAcc));
 +                                                    &itemAcc);
      if (!itemAcc ||
          nsAccessible::State(itemAcc) & nsIAccessibleStates::STATE_INVISIBLE) {
        setSize--;
 @@ -206,8 +206,8 @@ nsAccUtils::HasListener(nsIContent *aCon
  nsAccUtils::HasListener(nsIContent *aContent, const nsAString& aEventType)
  {
    NS_ENSURE_ARG_POINTER(aContent);
 -  nsCOMPtr<nsIEventListenerManager> listenerManager;
 -  aContent->GetListenerManager(PR_FALSE, getter_AddRefs(listenerManager));
-+  nsIEventListenerManager* listenerManager;
++  nsIEventListenerManager* listenerManager = nsnull;
 +  aContent->GetListenerManager(PR_FALSE, &listenerManager);
  
    return listenerManager && listenerManager->HasListenersFor(aEventType);  
  }
 @@ -224,11 +224,11 @@ nsAccUtils::GetAccessKeyFor(nsIContent *
    if (!aContent->HasAttr(kNameSpaceID_None, nsAccessibilityAtoms::accesskey))
      return 0;
  
@@ -3005,17 +3005,17 @@ diff --git a/accessible/src/base/nsAcces
 @@ -268,23 +268,23 @@ nsAccUtils::IsAncestorOf(nsIDOMNode *aPo
    NS_ENSURE_ARG_POINTER(aPossibleAncestorNode);
    NS_ENSURE_ARG_POINTER(aPossibleDescendantNode);
  
 -  nsCOMPtr<nsIDOMNode> loopNode = aPossibleDescendantNode;
 -  nsCOMPtr<nsIDOMNode> parentNode;
 -  while (NS_SUCCEEDED(loopNode->GetParentNode(getter_AddRefs(parentNode))) &&
 +  nsIDOMNode* loopNode = aPossibleDescendantNode;
-+  nsIDOMNode* parentNode;
++  nsIDOMNode* parentNode = nsnull;
 +  while (NS_SUCCEEDED(loopNode->GetParentNode(&parentNode)) &&
           parentNode) {
      if (parentNode == aPossibleAncestorNode) {
        return PR_TRUE;
      }
 -    loopNode.swap(parentNode);
 +    swap(loopNode, parentNode);
    }
@@ -3023,17 +3023,17 @@ diff --git a/accessible/src/base/nsAcces
  }
  
 -already_AddRefed<nsIAccessible>
 +nsIAccessible*
  nsAccUtils::GetAncestorWithRole(nsIAccessible *aDescendant, PRUint32 aRole)
  {
 -  nsCOMPtr<nsIAccessible> parentAccessible = aDescendant, testRoleAccessible;
 -  while (NS_SUCCEEDED(parentAccessible->GetParent(getter_AddRefs(testRoleAccessible))) &&
-+  nsIAccessible* parentAccessible = aDescendant, *testRoleAccessible;
++  nsIAccessible* parentAccessible = aDescendant, *testRoleAccessible = nsnull;
 +  while (NS_SUCCEEDED(parentAccessible->GetParent(&testRoleAccessible)) &&
           testRoleAccessible) {
      PRUint32 testRole;
      testRoleAccessible->GetFinalRole(&testRole);
 @@ -292,11 +292,11 @@ nsAccUtils::GetAncestorWithRole(nsIAcces
        nsIAccessible *returnAccessible = testRoleAccessible;
        return returnAccessible;
      }
@@ -3052,64 +3052,64 @@ diff --git a/accessible/src/base/nsAcces
    nsPresContext *presContext = aFrame->PresContext();
  
 -  nsCOMPtr<nsIDOMRange> scrollToRange = do_CreateInstance(kRangeCID);
 +  nsIDOMRange* scrollToRange = do_CreateInstance(kRangeCID);
    NS_ENSURE_TRUE(scrollToRange, NS_ERROR_FAILURE);
  
 -  nsCOMPtr<nsISelectionController> selCon;
 -  aFrame->GetSelectionController(presContext, getter_AddRefs(selCon));
-+  nsISelectionController* selCon;
++  nsISelectionController* selCon = nsnull;
 +  aFrame->GetSelectionController(presContext, &selCon);
    NS_ENSURE_TRUE(selCon, NS_ERROR_FAILURE);
  
    scrollToRange->SetStart(aStartNode, aStartIndex);
    scrollToRange->SetEnd(aEndNode, aEndIndex);
  
 -  nsCOMPtr<nsISelection> selection1;
-+  nsISelection* selection1;
++  nsISelection* selection1 = nsnull;
    selCon->GetSelection(nsISelectionController::SELECTION_ACCESSIBILITY,
 -                       getter_AddRefs(selection1));
 -
 -  nsCOMPtr<nsISelection2> selection(do_QueryInterface(selection1));
 +                       &selection1);
 +
 +  nsISelection2* selection(do_QueryInterface(selection1));
    if (selection) {
      selection->RemoveAllRanges();
      selection->AddRange(scrollToRange);
 @@ -434,8 +434,8 @@ nsAccUtils::ConvertToScreenCoords(PRInt3
      {
        NS_ENSURE_ARG(aAccessNode);
  
 -      nsCOMPtr<nsIDOMNode> DOMNode;
 -      aAccessNode->GetDOMNode(getter_AddRefs(DOMNode));
-+      nsIDOMNode* DOMNode;
++      nsIDOMNode* DOMNode = nsnull;
 +      aAccessNode->GetDOMNode(&DOMNode);
        NS_ENSURE_STATE(DOMNode);
  
        nsIntPoint wndCoords = nsAccUtils::GetScreenCoordsForWindow(DOMNode);
 @@ -447,15 +447,15 @@ nsAccUtils::ConvertToScreenCoords(PRInt3
      {
        NS_ENSURE_ARG(aAccessNode);
  
 -      nsCOMPtr<nsPIAccessNode> parent;
 -      nsCOMPtr<nsIAccessible> accessible(do_QueryInterface(aAccessNode));
-+      nsPIAccessNode* parent;
++      nsPIAccessNode* parent = nsnull;
 +      nsIAccessible* accessible(do_QueryInterface(aAccessNode));
        if (accessible) {
 -        nsCOMPtr<nsIAccessible> parentAccessible;
 -        accessible->GetParent(getter_AddRefs(parentAccessible));
-+        nsIAccessible* parentAccessible;
++        nsIAccessible* parentAccessible = nsnull;
 +        accessible->GetParent(&parentAccessible);
          parent = do_QueryInterface(parentAccessible);
        } else {
 -        nsCOMPtr<nsIAccessNode> parentAccessNode;
 -        aAccessNode->GetParentNode(getter_AddRefs(parentAccessNode));
-+        nsIAccessNode* parentAccessNode;
++        nsIAccessNode* parentAccessNode = nsnull;
 +        aAccessNode->GetParentNode(&parentAccessNode);
          parent = do_QueryInterface(parentAccessNode);
        }
  
 @@ -481,20 +481,20 @@ nsAccUtils::GetScreenCoordsForWindow(nsI
  nsAccUtils::GetScreenCoordsForWindow(nsIDOMNode *aNode)
  {
    nsIntPoint coords(0, 0);
@@ -3117,27 +3117,27 @@ diff --git a/accessible/src/base/nsAcces
 +  nsIDocShellTreeItem* treeItem(GetDocShellTreeItemFor(aNode));
    if (!treeItem)
      return coords;
  
 -  nsCOMPtr<nsIDocShellTreeItem> rootTreeItem;
 -  treeItem->GetRootTreeItem(getter_AddRefs(rootTreeItem));
 -  nsCOMPtr<nsIDOMDocument> domDoc = do_GetInterface(rootTreeItem);
 -  nsCOMPtr<nsIDOMDocumentView> docView(do_QueryInterface(domDoc));
-+  nsIDocShellTreeItem* rootTreeItem;
++  nsIDocShellTreeItem* rootTreeItem = nsnull;
 +  treeItem->GetRootTreeItem(&rootTreeItem);
 +  nsIDOMDocument* domDoc = do_GetInterface(rootTreeItem);
 +  nsIDOMDocumentView* docView(do_QueryInterface(domDoc));
    if (!docView)
      return coords;
  
 -  nsCOMPtr<nsIDOMAbstractView> abstractView;
 -  docView->GetDefaultView(getter_AddRefs(abstractView));
 -  nsCOMPtr<nsIDOMWindowInternal> windowInter(do_QueryInterface(abstractView));
-+  nsIDOMAbstractView* abstractView;
++  nsIDOMAbstractView* abstractView = nsnull;
 +  docView->GetDefaultView(&abstractView);
 +  nsIDOMWindowInternal* windowInter(do_QueryInterface(abstractView));
    if (!windowInter)
      return coords;
  
 @@ -503,22 +503,22 @@ nsAccUtils::GetScreenCoordsForWindow(nsI
    return coords;
  }
@@ -3147,17 +3147,17 @@ diff --git a/accessible/src/base/nsAcces
  nsAccUtils::GetDocShellTreeItemFor(nsIDOMNode *aNode)
  {
    if (!aNode)
      return nsnull;
  
 -  nsCOMPtr<nsIDOMDocument> domDoc;
 -  aNode->GetOwnerDocument(getter_AddRefs(domDoc));
 -  nsCOMPtr<nsIDocument> doc(do_QueryInterface(domDoc));
-+  nsIDOMDocument* domDoc;
++  nsIDOMDocument* domDoc = nsnull;
 +  aNode->GetOwnerDocument(&domDoc);
 +  nsIDocument* doc(do_QueryInterface(domDoc));
    if (!doc)
      doc = do_QueryInterface(aNode);
  
    NS_ASSERTION(doc, "No document for node passed in");
    NS_ENSURE_TRUE(doc, nsnull);
  
@@ -3166,32 +3166,32 @@ diff --git a/accessible/src/base/nsAcces
    nsIDocShellTreeItem *docShellTreeItem = nsnull;
    if (container)
      CallQueryInterface(container, &docShellTreeItem);
 @@ -541,12 +541,12 @@ nsAccUtils::GetAriaPropTypes(nsIContent 
    PRUint32 ariaPropTypes = 0;
  
    // Get the doc accessible using the optimsal methodology
 -  nsCOMPtr<nsIAccessibleDocument> docAccessible;
-+  nsIAccessibleDocument* docAccessible;
++  nsIAccessibleDocument* docAccessible = nsnull;
    if (aWeakShell) {
      docAccessible = nsAccessNode::GetDocAccessibleFor(aWeakShell);
    }
    else {
 -      nsCOMPtr<nsIDOMNode> node = do_QueryInterface(aContent);
 +      nsIDOMNode* node = do_QueryInterface(aContent);
      if (node) {
        docAccessible = nsAccessNode::GetDocAccessibleFor(node);
      }
 @@ -605,7 +605,7 @@ nsAccUtils::FindNeighbourPointingToNode(
                 "Cannot pass in both an ARIA relation property and an atom relation. Choose one");
    NS_ASSERTION(aAriaProperty == eAria_none || !aTagName,
                 "Cannot use aTagName with ARIA relation property, because ARIA relations apply to any tag");
 -  nsCOMPtr<nsIContent> binding;
-+  nsIContent* binding;
++  nsIContent* binding = nsnull;
    nsAutoString controlID;
    if (!nsAccUtils::GetID(aForNode, controlID)) {
      binding = aForNode->GetBindingParent();
 @@ -628,14 +628,14 @@ nsAccUtils::FindNeighbourPointingToNode(
      if (aForNode == binding) {
        // When we reach the binding parent, make sure to check
        // all of its anonymous child subtrees
 -      nsCOMPtr<nsIDocument> doc = aForNode->GetCurrentDoc();
@@ -3199,29 +3199,29 @@ diff --git a/accessible/src/base/nsAcces
 +      nsIDocument* doc = aForNode->GetCurrentDoc();
 +      nsIDOMDocumentXBL* xblDoc(do_QueryInterface(doc));
        if (!xblDoc)
          return nsnull;
  
 -      nsCOMPtr<nsIDOMNodeList> nodes;
 -      nsCOMPtr<nsIDOMElement> forElm(do_QueryInterface(aForNode));
 -      xblDoc->GetAnonymousNodes(forElm, getter_AddRefs(nodes));
-+      nsIDOMNodeList* nodes;
++      nsIDOMNodeList* nodes = nsnull;
 +      nsIDOMElement* forElm(do_QueryInterface(aForNode));
 +      xblDoc->GetAnonymousNodes(forElm, &nodes);
        if (!nodes)
          return nsnull;
  
 @@ -645,12 +645,12 @@ nsAccUtils::FindNeighbourPointingToNode(
          return nsnull;
  
        for (PRUint32 index = 0; index < length && !labelContent; index++) {
 -        nsCOMPtr<nsIDOMNode> node;
 -        rv = nodes->Item(index, getter_AddRefs(node));
-+        nsIDOMNode* node;
++        nsIDOMNode* node = nsnull;
 +        rv = nodes->Item(index, &node);
          if (NS_FAILED(rv))
            return nsnull;
  
 -        nsCOMPtr<nsIContent> content = do_QueryInterface(node);
 +        nsIContent* content = do_QueryInterface(node);
          if (!content)
            return nsnull;
@@ -3338,31 +3338,31 @@ diff --git a/accessible/src/base/nsAcces
  {
  #ifdef DEBUG
    if (aParent && aParent != mParent) {
 -    nsCOMPtr<nsPIAccessible> privParent = do_QueryInterface(mParent);
 +    nsPIAccessible* privParent = do_QueryInterface(mParent);
      if (privParent) {
 -      nsCOMPtr<nsIAccessible> firstChild;
 -      privParent->GetCachedFirstChild(getter_AddRefs(firstChild));
-+      nsIAccessible* firstChild;
++      nsIAccessible* firstChild = nsnull;
 +      privParent->GetCachedFirstChild(&firstChild);
        NS_ASSERTION(firstChild != this, "Reparenting other node's first child!");
      }
    }
 @@ -463,10 +463,10 @@ NS_IMETHODIMP nsAccessible::SetFirstChil
  {
  #ifdef DEBUG
    // If there's parent of this child already, make sure it's us!
 -  nsCOMPtr<nsPIAccessible> privChild = do_QueryInterface(aFirstChild);
 +  nsPIAccessible* privChild = do_QueryInterface(aFirstChild);
    if (privChild) {
 -    nsCOMPtr<nsIAccessible> parent;
 -    privChild->GetCachedParent(getter_AddRefs(parent));
-+    nsIAccessible* parent;
++    nsIAccessible* parent = nsnull;
 +    privChild->GetCachedParent(&parent);
      NS_ASSERTION(!parent || parent == this, "Stealing child!");
    }
  #endif
 @@ -511,19 +511,19 @@ nsIContent *nsAccessible::GetRoleContent
    // For doc accessibles, first try the <body> if it's HTML and there is
    // a role attribute used there.
    // For any other doc accessible , this is the document element.
@@ -3372,34 +3372,34 @@ diff --git a/accessible/src/base/nsAcces
 -    nsCOMPtr<nsIDOMDocument> domDoc(do_QueryInterface(aDOMNode));
 +    nsIDOMDocument* domDoc(do_QueryInterface(aDOMNode));
      if (domDoc) {
 -      nsCOMPtr<nsIDOMHTMLDocument> htmlDoc(do_QueryInterface(aDOMNode));
 +      nsIDOMHTMLDocument* htmlDoc(do_QueryInterface(aDOMNode));
        if (htmlDoc) {
 -        nsCOMPtr<nsIDOMHTMLElement> bodyElement;
 -        htmlDoc->GetBody(getter_AddRefs(bodyElement));
-+        nsIDOMHTMLElement* bodyElement;
++        nsIDOMHTMLElement* bodyElement = nsnull;
 +        htmlDoc->GetBody(&bodyElement);
          content = do_QueryInterface(bodyElement);
        }
        if (!content || !HasRoleAttribute(content)) {
 -        nsCOMPtr<nsIDOMElement> docElement;
 -        domDoc->GetDocumentElement(getter_AddRefs(docElement));
-+        nsIDOMElement* docElement;
++        nsIDOMElement* docElement = nsnull;
 +        domDoc->GetDocumentElement(&docElement);
          content = do_QueryInterface(docElement);
        }
      }
 @@ -536,10 +536,10 @@ NS_IMETHODIMP nsAccessible::Shutdown()
    mNextSibling = nsnull;
    // Make sure none of it's children point to this parent
    if (mFirstChild) {
 -    nsCOMPtr<nsIAccessible> current(mFirstChild), next;
-+    nsIAccessible* current(mFirstChild), *next;
++    nsIAccessible* current(mFirstChild), *next = nsnull;
      while (current) {
 -      nsCOMPtr<nsPIAccessible> privateAcc(do_QueryInterface(current));
 -      current->GetNextSibling(getter_AddRefs(next));
 +      nsPIAccessible* privateAcc(do_QueryInterface(current));
 +      current->GetNextSibling(&next);
        privateAcc->SetParent(nsnull);
        current = next;
      }
@@ -3431,24 +3431,24 @@ diff --git a/accessible/src/base/nsAcces
        PRInt32 numChildren;
        parent->GetChildCount(&numChildren);  // Make sure we cache all of the children
 @@ -648,16 +648,16 @@ NS_IMETHODIMP nsAccessible::GetPreviousS
      return NS_ERROR_FAILURE;
    }
  
 -  nsCOMPtr<nsIAccessible> parent;
 -  if (NS_FAILED(GetParent(getter_AddRefs(parent))) || !parent) {
-+  nsIAccessible* parent;
++  nsIAccessible* parent = nsnull;
 +  if (NS_FAILED(GetParent(&parent)) || !parent) {
      return NS_ERROR_FAILURE;
    }
  
 -  nsCOMPtr<nsIAccessible> testAccessible, prevSibling;
 -  parent->GetFirstChild(getter_AddRefs(testAccessible));
-+  nsIAccessible* testAccessible, *prevSibling;
++  nsIAccessible* testAccessible = nsnull, *prevSibling = nsnull;
 +  parent->GetFirstChild(&testAccessible);
    while (testAccessible && this != testAccessible) {
      prevSibling = testAccessible;
 -    prevSibling->GetNextSibling(getter_AddRefs(testAccessible));
 +    prevSibling->GetNextSibling(&testAccessible);
    }
  
    if (!prevSibling) {
@@ -3456,27 +3456,27 @@ diff --git a/accessible/src/base/nsAcces
    GetChildCount(&numChildren);  // Make sure we cache all of the children
  
  #ifdef DEBUG
 -  nsCOMPtr<nsPIAccessible> firstChild(do_QueryInterface(mFirstChild));
 +  nsPIAccessible* firstChild(do_QueryInterface(mFirstChild));
    if (firstChild) {
 -    nsCOMPtr<nsIAccessible> realParent;
 -    firstChild->GetCachedParent(getter_AddRefs(realParent));
-+    nsIAccessible* realParent;
++    nsIAccessible* realParent = nsnull;
 +    firstChild->GetCachedParent(&realParent);
      NS_ASSERTION(!realParent || realParent == this,
                   "Two accessibles have the same first child accessible.");
    }
 @@ -715,7 +715,7 @@ NS_IMETHODIMP nsAccessible::GetChildAt(P
      aChildNum = numChildren - 1;
    }
  
 -  nsCOMPtr<nsIAccessible> current(mFirstChild), nextSibling;
-+  nsIAccessible* current(mFirstChild), *nextSibling;
++  nsIAccessible* current(mFirstChild), *nextSibling = nsnull;
    PRInt32 index = 0;
  
    while (current) {
 @@ -723,7 +723,7 @@ NS_IMETHODIMP nsAccessible::GetChildAt(P
      if (++index > aChildNum) {
        break;
      }
 -    nextSibling->GetNextSibling(getter_AddRefs(current));
@@ -3489,75 +3489,75 @@ diff --git a/accessible/src/base/nsAcces
  NS_IMETHODIMP nsAccessible::GetChildren(nsIArray **aOutChildren)
  {
 -  nsCOMPtr<nsIMutableArray> children = do_CreateInstance(NS_ARRAY_CONTRACTID);
 +  nsIMutableArray* children = do_CreateInstance(NS_ARRAY_CONTRACTID);
    if (!children)
      return NS_ERROR_FAILURE;
  
 -  nsCOMPtr<nsIAccessible> curChild;
-+  nsIAccessible* curChild;
++  nsIAccessible* curChild = nsnull;
    while (NextChild(curChild)) {
      children->AppendElement(curChild, PR_FALSE);
    }
 @@ -747,14 +747,14 @@ NS_IMETHODIMP nsAccessible::GetChildren(
    return NS_OK;
  }
  
 -nsIAccessible *nsAccessible::NextChild(nsCOMPtr<nsIAccessible>& aAccessible)
 -{
 -  nsCOMPtr<nsIAccessible> nextChild;
 +nsIAccessible *nsAccessible::NextChild(nsIAccessible*& aAccessible)
 +{
-+  nsIAccessible* nextChild;
++  nsIAccessible* nextChild = nsnull;
    if (!aAccessible) {
 -    GetFirstChild(getter_AddRefs(nextChild));
 +    GetFirstChild(&nextChild);
    }
    else {
 -    aAccessible->GetNextSibling(getter_AddRefs(nextChild));
 +    aAccessible->GetNextSibling(&nextChild);
    }
    return (aAccessible = nextChild);
  }
 @@ -776,7 +776,7 @@ void nsAccessible::CacheChildren()
      // a text node, because text nodes aren't in the frame map.
      walker.mState.frame = GetFrame();
  
 -    nsCOMPtr<nsPIAccessible> privatePrevAccessible;
-+    nsPIAccessible* privatePrevAccessible;
++    nsPIAccessible* privatePrevAccessible = nsnull;
      PRInt32 childCount = 0;
      walker.GetFirstChild();
      SetFirstChild(walker.mState.accessible);
 @@ -814,14 +814,14 @@ NS_IMETHODIMP nsAccessible::GetIndexInPa
      return NS_ERROR_FAILURE;
    }
  
 -  nsCOMPtr<nsIAccessible> parent;
 -  GetParent(getter_AddRefs(parent));
-+  nsIAccessible* parent;
++  nsIAccessible* parent = nsnull;
 +  GetParent(&parent);
    if (!parent) {
      return NS_ERROR_FAILURE;
    }
  
 -  nsCOMPtr<nsIAccessible> sibling;
 -  parent->GetFirstChild(getter_AddRefs(sibling));
-+  nsIAccessible* sibling;
++  nsIAccessible* sibling = nsnull;
 +  parent->GetFirstChild(&sibling);
    if (!sibling) {
      return NS_ERROR_FAILURE;
    }
 @@ -834,8 +834,8 @@ NS_IMETHODIMP nsAccessible::GetIndexInPa
        return NS_ERROR_FAILURE;
  
      ++*aIndexInParent;
 -    nsCOMPtr<nsIAccessible> tempAccessible;
 -    sibling->GetNextSibling(getter_AddRefs(tempAccessible));
-+    nsIAccessible* tempAccessible;
++    nsIAccessible* tempAccessible = nsnull;
 +    sibling->GetNextSibling(&tempAccessible);
      sibling = tempAccessible;
    }
  
 @@ -907,7 +907,7 @@ PRBool nsAccessible::IsVisible(PRBool *a
  
    const PRUint16 kMinPixels  = 12;
     // Set up the variables we need, return false if we can't get at them all
@@ -3568,17 +3568,17 @@ diff --git a/accessible/src/base/nsAcces
  
 @@ -984,9 +984,9 @@ PRBool nsAccessible::IsVisible(PRBool *a
    // nsRectVisibility_kLeftOfViewport, 
    // nsRectVisibility_kRightOfViewport
    // This view says it is visible, but we need to check the parent view chain :(
 -  nsCOMPtr<nsIDOMDocument> domDoc;
 -  mDOMNode->GetOwnerDocument(getter_AddRefs(domDoc));
 -  nsCOMPtr<nsIDocument> doc(do_QueryInterface(domDoc));
-+  nsIDOMDocument* domDoc;
++  nsIDOMDocument* domDoc = nsnull;
 +  mDOMNode->GetOwnerDocument(&domDoc);
 +  nsIDocument* doc(do_QueryInterface(domDoc));
    if (!doc)  {
      return PR_FALSE;
    }
 @@ -1011,7 +1011,7 @@ nsAccessible::GetState(PRUint32 *aState,
      return NS_OK; // Node shut down
    }
@@ -3588,53 +3588,53 @@ diff --git a/accessible/src/base/nsAcces
    if (!content) {
      return NS_OK;  // On document, this is not an error
    }
 @@ -1066,20 +1066,20 @@ nsAccessible::GetState(PRUint32 *aState,
    /* readonly attribute boolean focusedChild; */
  NS_IMETHODIMP nsAccessible::GetFocusedChild(nsIAccessible **aFocusedChild) 
  { 
 -  nsCOMPtr<nsIAccessible> focusedChild;
-+  nsIAccessible* focusedChild;
++  nsIAccessible* focusedChild = nsnull;
    if (gLastFocusedNode == mDOMNode) {
      focusedChild = this;
    }
    else if (gLastFocusedNode) {
 -    nsCOMPtr<nsIAccessibilityService> accService =
 +    nsIAccessibilityService* accService =
        do_GetService("@mozilla.org/accessibilityService;1");
      NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
  
      accService->GetAccessibleFor(gLastFocusedNode,
 -                                 getter_AddRefs(focusedChild));
 +                                 &focusedChild);
      if (focusedChild) {
 -      nsCOMPtr<nsIAccessible> focusedParentAccessible;
 -      focusedChild->GetParent(getter_AddRefs(focusedParentAccessible));
-+      nsIAccessible* focusedParentAccessible;
++      nsIAccessible* focusedParentAccessible = nsnull;
 +      focusedChild->GetParent(&focusedParentAccessible);
        if (focusedParentAccessible != this) {
          focusedChild = nsnull;
        }
 @@ -1104,7 +1104,7 @@ nsAccessible::GetChildAtPoint(PRInt32 aX
  
    // If we can't find the point in a child, we will return the fallback answer:
    // we return |this| if the point is within it, otherwise nsnull
 -  nsCOMPtr<nsIAccessible> fallbackAnswer;
-+  nsIAccessible* fallbackAnswer;
++  nsIAccessible* fallbackAnswer = nsnull;
    PRInt32 x, y, width, height;
    GetBounds(&x, &y, &width, &height);
    if (aX >= x && aX < x + width &&
 @@ -1122,12 +1122,12 @@ nsAccessible::GetChildAtPoint(PRInt32 aX
    // therefore accessible for containing block may be different from accessible
    // for DOM parent but GetFrameForPoint() should be called for containing block
    // to get an out of flow element.
 -  nsCOMPtr<nsIAccessibleDocument> accDocument;
 -  nsresult rv = GetAccessibleDocument(getter_AddRefs(accDocument));
-+  nsIAccessibleDocument* accDocument;
++  nsIAccessibleDocument* accDocument = nsnull;
 +  nsresult rv = GetAccessibleDocument(&accDocument);
    NS_ENSURE_SUCCESS(rv, rv);
    NS_ENSURE_TRUE(accDocument, NS_ERROR_FAILURE);
  
 -  nsCOMPtr<nsPIAccessNode> accessNodeDocument(do_QueryInterface(accDocument));
 +  nsPIAccessNode* accessNodeDocument(do_QueryInterface(accDocument));
    NS_ASSERTION(accessNodeDocument,
                 "nsIAccessibleDocument doesn't implement nsPIAccessNode");
@@ -3642,65 +3642,65 @@ diff --git a/accessible/src/base/nsAcces
 @@ -1140,31 +1140,31 @@ nsAccessible::GetChildAtPoint(PRInt32 aX
    nsPoint offset(presContext->DevPixelsToAppUnits(aX - screenRect.x),
                   presContext->DevPixelsToAppUnits(aY - screenRect.y));
  
 -  nsCOMPtr<nsIPresShell> presShell = presContext->PresShell();
 +  nsIPresShell* presShell = presContext->PresShell();
    nsIFrame *foundFrame = presShell->GetFrameForPoint(frame, offset);
 -  nsCOMPtr<nsIContent> content;
-+  nsIContent* content;
++  nsIContent* content = nsnull;
    if (!foundFrame || !(content = foundFrame->GetContent())) {
      *aAccessible = fallbackAnswer;
      return NS_OK;
    }
  
 -  nsCOMPtr<nsIDOMNode> node(do_QueryInterface(content));
 -  nsCOMPtr<nsIAccessibilityService> accService = GetAccService();
 -
 -  nsCOMPtr<nsIDOMNode> relevantNode;
 -  accService->GetRelevantContentNodeFor(node, getter_AddRefs(relevantNode));
 +  nsIDOMNode* node(do_QueryInterface(content));
 +  nsIAccessibilityService* accService = GetAccService();
 +
-+  nsIDOMNode* relevantNode;
++  nsIDOMNode* relevantNode = nsnull;
 +  accService->GetRelevantContentNodeFor(node, &relevantNode);
    if (!relevantNode) {
      *aAccessible = fallbackAnswer;
      return NS_OK;
    }
  
 -  nsCOMPtr<nsIAccessible> accessible;
 -  accService->GetAccessibleFor(relevantNode, getter_AddRefs(accessible));
-+  nsIAccessible* accessible;
++  nsIAccessible* accessible = nsnull;
 +  accService->GetAccessibleFor(relevantNode, &accessible);
    if (!accessible) {
      // No accessible for the node with the point, so find the first
      // accessible in the DOM parent chain
      accDocument->GetAccessibleInParentChain(relevantNode, PR_TRUE,
 -                                            getter_AddRefs(accessible));
 +                                            &accessible);
      if (!accessible) {
        *aAccessible = fallbackAnswer;
        return NS_OK;
 @@ -1176,7 +1176,7 @@ nsAccessible::GetChildAtPoint(PRInt32 aX
      // the are within this point.
      // This takes care of cases where layout won't walk into
      // things for us, such as image map areas and sub documents
 -    nsCOMPtr<nsIAccessible> child;
-+    nsIAccessible* child;
++    nsIAccessible* child = nsnull;
      while (NextChild(child)) {
        PRInt32 childX, childY, childWidth, childHeight;
        child->GetBounds(&childX, &childY, &childWidth, &childHeight);
 @@ -1192,9 +1192,9 @@ nsAccessible::GetChildAtPoint(PRInt32 aX
      // We are allowed to return |this| as the answer
    }
    else {
 -    nsCOMPtr<nsIAccessible> parent;
-+    nsIAccessible* parent;
++    nsIAccessible* parent = nsnull;
      while (PR_TRUE) {
 -      accessible->GetParent(getter_AddRefs(parent));
 +      accessible->GetParent(&parent);
        if (!parent) {
          // Reached the top of the hierarchy
          // these bounds were inside an accessible that is not a descendant of this one
 @@ -1206,7 +1206,7 @@ nsAccessible::GetChildAtPoint(PRInt32 aX
          // child we want to return
@@ -3730,17 +3730,17 @@ diff --git a/accessible/src/base/nsAcces
  {
    NS_ENSURE_TRUE(aNode, nsnull);
 -  nsCOMPtr<nsIAccessibilityService> accService =
 +  nsIAccessibilityService* accService =
      do_GetService("@mozilla.org/accessibilityService;1");
    NS_ENSURE_TRUE(accService, nsnull);
 -  nsCOMPtr<nsIAccessible> accessible;
 -  accService->GetAccessibleFor(aNode, getter_AddRefs(accessible));
-+  nsIAccessible* accessible;
++  nsIAccessible* accessible = nsnull;
 +  accService->GetAccessibleFor(aNode, &accessible);
    if (!accessible) {
      return nsnull;
    }
 @@ -1379,7 +1379,7 @@ nsAccessible::GetMultiSelectFor(nsIDOMNo
    PRUint32 containerRole;
    while (0 == (state & nsIAccessibleStates::STATE_MULTISELECTABLE)) {
      nsIAccessible *current = accessible;
@@ -3802,17 +3802,17 @@ diff --git a/accessible/src/base/nsAcces
    }
 @@ -1490,8 +1490,8 @@ nsresult nsAccessible::AppendNameFromAcc
  {
    nsAutoString textEquivalent, value;
  
 -  nsCOMPtr<nsIDOMNode> domNode(do_QueryInterface(aContent));
 -  nsCOMPtr<nsIAccessible> accessible;
 +  nsIDOMNode* domNode(do_QueryInterface(aContent));
-+  nsIAccessible* accessible;
++  nsIAccessible* accessible = nsnull;
    if (domNode == mDOMNode) {
      accessible = this;
      if (!aFromValue) {
 @@ -1500,10 +1500,10 @@ nsresult nsAccessible::AppendNameFromAcc
      }
    }
    else {
 -    nsCOMPtr<nsIAccessibilityService> accService =
@@ -3895,17 +3895,17 @@ diff --git a/accessible/src/base/nsAcces
    
    nsresult rv = NS_ERROR_FAILURE;
 @@ -1762,8 +1762,8 @@ nsresult nsAccessible::GetTextFromRelati
      if (!aName.IsEmpty()) {
        aName += ' '; // Need whitespace between multiple labels or descriptions
      }
 -    nsCOMPtr<nsIDOMElement> labelElement;
 -    domDoc->GetElementById(id, getter_AddRefs(labelElement));
-+    nsIDOMElement* labelElement;
++    nsIDOMElement* labelElement = nsnull;
 +    domDoc->GetElementById(id, &labelElement);
      content = do_QueryInterface(labelElement);
      if (!content) {
        return NS_OK;
 @@ -1785,7 +1785,7 @@ nsresult nsAccessible::GetTextFromRelati
    */
  nsresult nsAccessible::GetHTMLName(nsAString& aLabel, PRBool aCanAggregateSubtree)
  {
@@ -3963,17 +3963,17 @@ diff --git a/accessible/src/base/nsAcces
    // Can this node be accessible and attached to
    // the document's accessible tree?
 -  nsCOMPtr<nsIAccessibilityService> accService =
 +  nsIAccessibilityService* accService =
      do_GetService("@mozilla.org/accessibilityService;1");
    NS_ENSURE_TRUE(accService, PR_FALSE);
 -  nsCOMPtr<nsIDOMNode> relevantNode;
 -  accService->GetRelevantContentNodeFor(aNode, getter_AddRefs(relevantNode));
-+  nsIDOMNode* relevantNode;
++  nsIDOMNode* relevantNode = nsnull;
 +  accService->GetRelevantContentNodeFor(aNode, &relevantNode);
    return aNode == relevantNode;
  }
  
 @@ -1941,7 +1941,7 @@ nsAccessible::FireToolkitEvent(PRUint32 
    if (!mWeakShell)
      return NS_ERROR_FAILURE;
  
@@ -3983,17 +3983,17 @@ diff --git a/accessible/src/base/nsAcces
    NS_ENSURE_TRUE(accEvent, NS_ERROR_OUT_OF_MEMORY);
  
 @@ -1952,11 +1952,11 @@ nsAccessible::FireAccessibleEvent(nsIAcc
  nsAccessible::FireAccessibleEvent(nsIAccessibleEvent *aEvent)
  {
    NS_ENSURE_ARG_POINTER(aEvent);
 -  nsCOMPtr<nsIDOMNode> eventNode;
 -  aEvent->GetDOMNode(getter_AddRefs(eventNode));
-+  nsIDOMNode* eventNode;
++  nsIDOMNode* eventNode = nsnull;
 +  aEvent->GetDOMNode(&eventNode);
    NS_ENSURE_TRUE(IsNodeRelevant(eventNode), NS_ERROR_FAILURE);
  
 -  nsCOMPtr<nsIObserverService> obsService =
 +  nsIObserverService* obsService =
      do_GetService("@mozilla.org/observer-service;1");
    NS_ENSURE_TRUE(obsService, NS_ERROR_FAILURE);
  
@@ -4041,17 +4041,17 @@ diff --git a/accessible/src/base/nsAcces
 +      nsIAccessible* parent = GetParent();
        NS_ENSURE_TRUE(parent, NS_ERROR_FAILURE);
  
        PRInt32 positionInGroup = 0;
        PRInt32 setSize = 0;
  
 -      nsCOMPtr<nsIAccessible> sibling, nextSibling;
 -      parent->GetFirstChild(getter_AddRefs(sibling));
-+      nsIAccessible* sibling, *nextSibling;
++      nsIAccessible* sibling = nsnull, *nextSibling = nsnull;
 +      parent->GetFirstChild(&sibling);
        NS_ENSURE_TRUE(sibling, NS_ERROR_FAILURE);
  
        PRBool foundCurrent = PR_FALSE;
 @@ -2115,14 +2115,14 @@ nsAccessible::GetAttributes(nsIPersisten
                foundCurrent = PR_TRUE;
            }
          }
@@ -4059,17 +4059,17 @@ diff --git a/accessible/src/base/nsAcces
 +        sibling->GetNextSibling(&nextSibling);
          sibling = nextSibling;
        }
  
        PRInt32 groupLevel = 0;
        if (role == nsIAccessibleRole::ROLE_OUTLINEITEM) {
          groupLevel = 1;
 -        nsCOMPtr<nsIAccessible> nextParent;
-+        nsIAccessible* nextParent;
++        nsIAccessible* nextParent = nsnull;
          while (parent) {
            parent->GetFinalRole(&role);
  
 @@ -2131,8 +2131,8 @@ nsAccessible::GetAttributes(nsIPersisten
            if (role == nsIAccessibleRole::ROLE_GROUPING)
              ++ groupLevel;
  
 -          parent->GetParent(getter_AddRefs(nextParent));
@@ -4098,38 +4098,38 @@ diff --git a/accessible/src/base/nsAcces
  
    nsAutoString tagName;
 @@ -2183,8 +2183,8 @@ nsAccessible::GroupPosition(PRInt32 *aGr
    *aSimilarItemsInGroup = 0;
    *aPositionInGroup = 0;
  
 -  nsCOMPtr<nsIPersistentProperties> attributes;
 -  nsresult rv = GetAttributes(getter_AddRefs(attributes));
-+  nsIPersistentProperties* attributes;
++  nsIPersistentProperties* attributes = nsnull;
 +  nsresult rv = GetAttributes(&attributes);
    NS_ENSURE_SUCCESS(rv, rv);
    if (!attributes) {
      return NS_ERROR_FAILURE;
 @@ -2247,15 +2247,15 @@ nsAccessible::GetFinalState(PRUint32 *aS
      } else {
        // Expose 'selected' state on ARIA tab if the focus is on internal element
        // of related tabpanel.
 -      nsCOMPtr<nsIAccessible> tabPanel;
-+      nsIAccessible* tabPanel;
++      nsIAccessible* tabPanel = nsnull;
        rv = GetAccessibleRelated(nsIAccessibleRelation::RELATION_LABEL_FOR,
 -                                getter_AddRefs(tabPanel));
 +                                &tabPanel);
        NS_ENSURE_SUCCESS(rv, rv);
  
        if (tabPanel && Role(tabPanel) == nsIAccessibleRole::ROLE_PROPERTYPAGE) {
 -        nsCOMPtr<nsIAccessNode> tabPanelAccessNode(do_QueryInterface(tabPanel));
 -        nsCOMPtr<nsIDOMNode> tabPanelNode;
 -        tabPanelAccessNode->GetDOMNode(getter_AddRefs(tabPanelNode));
 +        nsIAccessNode* tabPanelAccessNode(do_QueryInterface(tabPanel));
-+        nsIDOMNode* tabPanelNode;
++        nsIDOMNode* tabPanelNode = nsnull;
 +        tabPanelAccessNode->GetDOMNode(&tabPanelNode);
          NS_ENSURE_STATE(tabPanelNode);
  
          if (nsAccUtils::IsAncestorOf(tabPanelNode, gLastFocusedNode))
 @@ -2295,7 +2295,7 @@ nsAccessible::GetFinalState(PRUint32 *aS
        role == nsIAccessibleRole::ROLE_PASSWORD_TEXT ||
        role == nsIAccessibleRole::ROLE_COMBOBOX) {
  
@@ -4165,105 +4165,105 @@ diff --git a/accessible/src/base/nsAcces
    nsIContent *loopContent = content;
    nsAutoString atomic;
    PRUint32 ariaPropTypes = nsAccUtils::GetAriaPropTypes(content, mWeakShell);
 @@ -2589,7 +2589,7 @@ nsIDOMNode* nsAccessible::GetAtomicRegio
      loopContent = loopContent->GetParent();
    }
  
 -  nsCOMPtr<nsIDOMNode> atomicRegion;
-+  nsIDOMNode* atomicRegion;
++  nsIDOMNode* atomicRegion = nsnull;
    if (atomic.EqualsLiteral("true")) {
      atomicRegion = do_QueryInterface(loopContent);
    }
 @@ -2610,7 +2610,7 @@ NS_IMETHODIMP nsAccessible::GetAccessibl
      return NS_ERROR_FAILURE;  // Node already shut down
    }
  
 -  nsCOMPtr<nsIDOMNode> relatedNode;
-+  nsIDOMNode* relatedNode;
++  nsIDOMNode* relatedNode = nsnull;
    nsAutoString relatedID;
  
    // Search for the related DOM node according to the specified "relation type"
 @@ -2694,47 +2694,47 @@ NS_IMETHODIMP nsAccessible::GetAccessibl
      {
        if (content->IsNodeOfType(nsINode::eHTML)) {
          // HTML form controls implements nsIFormControl interface.
 -        nsCOMPtr<nsIFormControl> control(do_QueryInterface(content));
 +        nsIFormControl* control(do_QueryInterface(content));
          if (control) {
 -          nsCOMPtr<nsIDOMHTMLFormElement> htmlform;
 -          control->GetForm(getter_AddRefs(htmlform));
 -          nsCOMPtr<nsIForm> form(do_QueryInterface(htmlform));
-+          nsIDOMHTMLFormElement* htmlform;
++          nsIDOMHTMLFormElement* htmlform = nsnull;
 +          control->GetForm(&htmlform);
 +          nsIForm* form(do_QueryInterface(htmlform));
            if (form)
              relatedNode = do_QueryInterface(form->GetDefaultSubmitElement());
          }
        }
        else {
          // In XUL, use first <button default="true" .../> in the document
 -        nsCOMPtr<nsIDOMXULDocument> xulDoc = do_QueryInterface(content->GetDocument());
 -        nsCOMPtr<nsIDOMXULButtonElement> buttonEl;
 +        nsIDOMXULDocument* xulDoc = do_QueryInterface(content->GetDocument());
-+        nsIDOMXULButtonElement* buttonEl;
++        nsIDOMXULButtonElement* buttonEl = nsnull;
          if (xulDoc) {
 -          nsCOMPtr<nsIDOMNodeList> possibleDefaultButtons;
-+          nsIDOMNodeList* possibleDefaultButtons;
++          nsIDOMNodeList* possibleDefaultButtons = nsnull;
            xulDoc->GetElementsByAttribute(NS_LITERAL_STRING("default"),
                                           NS_LITERAL_STRING("true"),
 -                                         getter_AddRefs(possibleDefaultButtons));
 +                                         &possibleDefaultButtons);
            if (possibleDefaultButtons) {
              PRUint32 length;
              possibleDefaultButtons->GetLength(&length);
 -            nsCOMPtr<nsIDOMNode> possibleButton;
-+            nsIDOMNode* possibleButton;
++            nsIDOMNode* possibleButton = nsnull;
              // Check for button in list of default="true" elements
              for (PRUint32 count = 0; count < length && !buttonEl; count ++) {
 -              possibleDefaultButtons->Item(count, getter_AddRefs(possibleButton));
 +              possibleDefaultButtons->Item(count, &possibleButton);
                buttonEl = do_QueryInterface(possibleButton);
              }
            }
            if (!buttonEl) { // Check for anonymous accept button in <dialog>
 -            nsCOMPtr<nsIDOMDocumentXBL> xblDoc(do_QueryInterface(xulDoc));
 +            nsIDOMDocumentXBL* xblDoc(do_QueryInterface(xulDoc));
              if (xblDoc) {
 -              nsCOMPtr<nsIDOMDocument> domDoc = do_QueryInterface(xulDoc);
 +              nsIDOMDocument* domDoc = do_QueryInterface(xulDoc);
                NS_ASSERTION(domDoc, "No DOM document");
 -              nsCOMPtr<nsIDOMElement> rootEl;
 -              domDoc->GetDocumentElement(getter_AddRefs(rootEl));
-+              nsIDOMElement* rootEl;
++              nsIDOMElement* rootEl = nsnull;
 +              domDoc->GetDocumentElement(&rootEl);
                if (rootEl) {
 -                nsCOMPtr<nsIDOMElement> possibleButtonEl;
-+                nsIDOMElement* possibleButtonEl;
++                nsIDOMElement* possibleButtonEl = nsnull;
                  xblDoc->GetAnonymousElementByAttribute(rootEl,
                                                        NS_LITERAL_STRING("default"),
                                                        NS_LITERAL_STRING("true"),
 -                                                      getter_AddRefs(possibleButtonEl));
 +                                                      &possibleButtonEl);
                  buttonEl = do_QueryInterface(possibleButtonEl);
                }
              }
 @@ -2755,17 +2755,17 @@ NS_IMETHODIMP nsAccessible::GetAccessibl
  
    if (!relatedID.IsEmpty()) {
      // In some cases we need to get the relatedNode from an ID-style attribute
 -    nsCOMPtr<nsIDOMDocument> domDoc;
 -    mDOMNode->GetOwnerDocument(getter_AddRefs(domDoc));
-+    nsIDOMDocument* domDoc;
++    nsIDOMDocument* domDoc = nsnull;
 +    mDOMNode->GetOwnerDocument(&domDoc);
      NS_ENSURE_TRUE(domDoc, NS_ERROR_FAILURE);
 -    nsCOMPtr<nsIDOMElement> relatedEl;
 -    domDoc->GetElementById(relatedID, getter_AddRefs(relatedEl));
-+    nsIDOMElement* relatedEl;
++    nsIDOMElement* relatedEl = nsnull;
 +    domDoc->GetElementById(relatedID, &relatedEl);
      relatedNode = do_QueryInterface(relatedEl);
    }
  
    // Return the corresponding accessible if the related DOM node is found
    if (relatedNode) {
 -    nsCOMPtr<nsIAccessibilityService> accService = GetAccService();
 +    nsIAccessibilityService* accService = GetAccService();
@@ -4271,33 +4271,33 @@ diff --git a/accessible/src/base/nsAcces
      accService->GetAccessibleInWeakShell(relatedNode, mWeakShell, aRelated);
    }
 @@ -2778,8 +2778,8 @@ nsAccessible::GetRelationsCount(PRUint32
    NS_ENSURE_ARG_POINTER(aCount);
    *aCount = 0;
  
 -  nsCOMPtr<nsIArray> relations;
 -  nsresult rv = GetRelations(getter_AddRefs(relations));
-+  nsIArray* relations;
++  nsIArray* relations = nsnull;
 +  nsresult rv = GetRelations(&relations);
    NS_ENSURE_SUCCESS(rv, rv);
  
    return relations->GetLength(aCount);
 @@ -2791,13 +2791,13 @@ nsAccessible::GetRelation(PRUint32 aInde
    NS_ENSURE_ARG_POINTER(aRelation);
    *aRelation = nsnull;
  
 -  nsCOMPtr<nsIArray> relations;
 -  nsresult rv = GetRelations(getter_AddRefs(relations));
-+  nsIArray* relations;
++  nsIArray* relations = nsnull;
 +  nsresult rv = GetRelations(&relations);
    NS_ENSURE_SUCCESS(rv, rv);
  
 -  nsCOMPtr<nsIAccessibleRelation> relation;
-+  nsIAccessibleRelation* relation;
++  nsIAccessibleRelation* relation = nsnull;
    rv = relations->QueryElementAt(aIndex, NS_GET_IID(nsIAccessibleRelation),
 -                                 getter_AddRefs(relation));
 +                                 (void**)&relation);
    NS_ENSURE_SUCCESS(rv, rv);
  
    *aRelation = relation;
 @@ -2809,17 +2809,17 @@ nsAccessible::GetRelations(nsIArray **aR
  {
@@ -4307,17 +4307,17 @@ diff --git a/accessible/src/base/nsAcces
 +  nsIMutableArray* relations = do_CreateInstance(NS_ARRAY_CONTRACTID);
    NS_ENSURE_TRUE(relations, NS_ERROR_OUT_OF_MEMORY);
  
    for (PRUint32 relType = nsIAccessibleRelation::RELATION_FIRST;
         relType < nsIAccessibleRelation::RELATION_LAST;
         ++relType) {
 -    nsCOMPtr<nsIAccessible> accessible;
 -    GetAccessibleRelated(relType, getter_AddRefs(accessible));
-+    nsIAccessible* accessible;
++    nsIAccessible* accessible = nsnull;
 +    GetAccessibleRelated(relType, &accessible);
  
      if (accessible) {
 -      nsCOMPtr<nsIAccessibleRelation> relation =
 +      nsIAccessibleRelation* relation =
          new nsAccessibleRelationWrap(relType, accessible);
        NS_ENSURE_TRUE(relation, NS_ERROR_OUT_OF_MEMORY);
  
@@ -4365,17 +4365,17 @@ diff --git a/accessible/src/base/nsAcces
 +nsIAccessible*
  nsAccessible::GetNextWithState(nsIAccessible *aStart, PRUint32 matchState)
  {
    // Return the next descendant that matches one of the states in matchState
    // Uses depth first search
    NS_ASSERTION(matchState, "GetNextWithState() not called with a state to match");
    NS_ASSERTION(aStart, "GetNextWithState() not called with an accessible to start with");
 -  nsCOMPtr<nsIAccessible> look, current = aStart;
-+  nsIAccessible* look, *current = aStart;
++  nsIAccessible* look = nsnull, *current = aStart;
    PRUint32 state = 0;
    while (0 == (state & matchState)) {
 -    current->GetFirstChild(getter_AddRefs(look));
 +    current->GetFirstChild(&look);
      while (!look) {
        if (current == this) {
          return nsnull; // At top of subtree
        }
@@ -4433,39 +4433,39 @@ diff --git a/accessible/src/base/nsAcces
      ++ *aSelectionCount;
    }
 @@ -3006,8 +3006,8 @@ NS_IMETHODIMP nsAccessible::AddChildToSe
  
    NS_ENSURE_TRUE(aIndex >= 0, NS_ERROR_FAILURE);
  
 -  nsCOMPtr<nsIAccessible> child;
 -  GetChildAt(aIndex, getter_AddRefs(child));
-+  nsIAccessible* child;
++  nsIAccessible* child = nsnull;
 +  GetChildAt(aIndex, &child);
  
    PRUint32 state = State(child);
    if (!(state & nsIAccessibleStates::STATE_SELECTABLE)) {
 @@ -3025,8 +3025,8 @@ NS_IMETHODIMP nsAccessible::RemoveChildF
  
    NS_ENSURE_TRUE(aIndex >= 0, NS_ERROR_FAILURE);
  
 -  nsCOMPtr<nsIAccessible> child;
 -  GetChildAt(aIndex, getter_AddRefs(child));
-+  nsIAccessible* child;
++  nsIAccessible* child = nsnull;
 +  GetChildAt(aIndex, &child);
  
    PRUint32 state = State(child);
    if (!(state & nsIAccessibleStates::STATE_SELECTED)) {
 @@ -3045,8 +3045,8 @@ NS_IMETHODIMP nsAccessible::IsChildSelec
    *aIsSelected = PR_FALSE;
    NS_ENSURE_TRUE(aIndex >= 0, NS_ERROR_FAILURE);
  
 -  nsCOMPtr<nsIAccessible> child;
 -  GetChildAt(aIndex, getter_AddRefs(child));
-+  nsIAccessible* child;
++  nsIAccessible* child = nsnull;
 +  GetChildAt(aIndex, &child);
  
    PRUint32 state = State(child);
    if (state & nsIAccessibleStates::STATE_SELECTED) {
 @@ -3057,7 +3057,7 @@ NS_IMETHODIMP nsAccessible::IsChildSelec
  
  NS_IMETHODIMP nsAccessible::ClearSelection()
  {
@@ -4489,17 +4489,17 @@ diff --git a/accessible/src/base/nsAcces
    *aStartOffset = *aEndOffset = 0;
 -  nsCOMPtr<nsIAccessible> parent(GetParent());
 +  nsIAccessible* parent(GetParent());
    if (!parent) {
      return NS_ERROR_FAILURE;
    }
  
 -  nsCOMPtr<nsIAccessible> accessible, nextSibling;
-+  nsIAccessible* accessible, *nextSibling;
++  nsIAccessible* accessible = nsnull, *nextSibling = nsnull;
    PRInt32 characterCount = 0;
 -  parent->GetFirstChild(getter_AddRefs(accessible));
 +  parent->GetFirstChild(&accessible);
  
    while (accessible) {
      if (IsText(accessible)) {
 @@ -3157,8 +3157,8 @@ nsresult nsAccessible::GetLinkOffset(PRI
      else {
@@ -4537,34 +4537,34 @@ diff --git a/accessible/src/base/nsAcces
 -already_AddRefed<nsIAccessible>
 +nsIAccessible*
  nsAccessible::GetFirstAvailableAccessible(nsIDOMNode *aStartNode, PRBool aRequireLeaf)
  {
    nsIAccessibilityService *accService = GetAccService();
 -  nsCOMPtr<nsIAccessible> accessible;
 -  nsCOMPtr<nsIDOMTreeWalker> walker; 
 -  nsCOMPtr<nsIDOMNode> currentNode(aStartNode);
-+  nsIAccessible* accessible;
-+  nsIDOMTreeWalker* walker; 
++  nsIAccessible* accessible = nsnull;
++  nsIDOMTreeWalker* walker = nsnull; 
 +  nsIDOMNode* currentNode(aStartNode);
  
    while (currentNode) {
 -    accService->GetAccessibleInWeakShell(currentNode, mWeakShell, getter_AddRefs(accessible)); // AddRef'd
 +    accService->GetAccessibleInWeakShell(currentNode, mWeakShell, &accessible); // AddRef'd
      if (accessible && (!aRequireLeaf || IsLeaf(accessible))) {
        nsIAccessible *retAccessible = accessible;
        return retAccessible;
 @@ -3218,18 +3218,18 @@ nsAccessible::GetFirstAvailableAccessibl
      if (!walker) {
        // Instantiate walker lazily since we won't need it in 90% of the cases
        // where the first DOM node we're given provides an accessible
 -      nsCOMPtr<nsIDOMDocument> document;
 -      currentNode->GetOwnerDocument(getter_AddRefs(document));
 -      nsCOMPtr<nsIDOMDocumentTraversal> trav = do_QueryInterface(document);
-+      nsIDOMDocument* document;
++      nsIDOMDocument* document = nsnull;
 +      currentNode->GetOwnerDocument(&document);
 +      nsIDOMDocumentTraversal* trav = do_QueryInterface(document);
        NS_ASSERTION(trav, "No DOM document traversal for document");
        NS_ENSURE_TRUE(trav, nsnull);
        trav->CreateTreeWalker(mDOMNode, nsIDOMNodeFilter::SHOW_ELEMENT | nsIDOMNodeFilter::SHOW_TEXT,
 -                            nsnull, PR_FALSE, getter_AddRefs(walker));
 +                            nsnull, PR_FALSE, &walker);
        NS_ENSURE_TRUE(walker, nsnull);
@@ -4626,39 +4626,39 @@ diff --git a/accessible/src/base/nsAcces
 --- a/accessible/src/base/nsAccessibleEventData.cpp
 +++ b/accessible/src/base/nsAccessibleEventData.cpp
 @@ -87,8 +87,8 @@ void nsAccEvent::GetLastEventAttributes(
  
  void nsAccEvent::CaptureIsFromUserInput(PRBool aIsAsynch)
  {
 -  nsCOMPtr<nsIDOMNode> eventNode;
 -  GetDOMNode(getter_AddRefs(eventNode));
-+  nsIDOMNode* eventNode;
++  nsIDOMNode* eventNode = nsnull;
 +  GetDOMNode(&eventNode);
    if (!eventNode) {
      NS_NOTREACHED("There should always be a DOM node for an event");
      return;
 @@ -114,8 +114,8 @@ nsAccEvent::GetIsFromUserInput(PRBool *a
  
  void nsAccEvent::PrepareForEvent(nsIAccessibleEvent *aEvent)
  {
 -  nsCOMPtr<nsIDOMNode> eventNode;
 -  aEvent->GetDOMNode(getter_AddRefs(eventNode));
-+  nsIDOMNode* eventNode;
++  nsIDOMNode* eventNode = nsnull;
 +  aEvent->GetDOMNode(&eventNode);
    PRBool isFromUserInput;
    aEvent->GetIsFromUserInput(&isFromUserInput);
    PrepareForEvent(eventNode, isFromUserInput);
 @@ -130,18 +130,18 @@ void nsAccEvent::PrepareForEvent(nsIDOMN
      return;
    }
  
 -  nsCOMPtr<nsIDOMDocument> domDoc;
 -  aEventNode->GetOwnerDocument(getter_AddRefs(domDoc));
-+  nsIDOMDocument* domDoc;
++  nsIDOMDocument* domDoc = nsnull;
 +  aEventNode->GetOwnerDocument(&domDoc);
    if (!domDoc) {  // IF the node is a document itself
      domDoc = do_QueryInterface(aEventNode);
    }
 -  nsCOMPtr<nsIDocument> doc = do_QueryInterface(domDoc);
 +  nsIDocument* doc = do_QueryInterface(domDoc);
    if (!doc) {
      NS_NOTREACHED("There should always be a document for an event");
@@ -4680,17 +4680,17 @@ diff --git a/accessible/src/base/nsAcces
      accessNode->GetDOMNode(getter_AddRefs(mDOMNode));
    }
 @@ -200,11 +200,11 @@ nsAccEvent::GetAccessibleDocument(nsIAcc
  
    if (!mDocAccessible) {
      if (!mAccessible) {
 -      nsCOMPtr<nsIAccessible> accessible;
 -      GetAccessible(getter_AddRefs(accessible));
-+      nsIAccessible* accessible;
++      nsIAccessible* accessible = nsnull;
 +      GetAccessible(&accessible);
      }
  
 -    nsCOMPtr<nsIAccessNode> accessNode(do_QueryInterface(mAccessible));
 +    nsIAccessNode* accessNode(do_QueryInterface(mAccessible));
      NS_ENSURE_TRUE(accessNode, NS_ERROR_FAILURE);
      accessNode->GetAccessibleDocument(getter_AddRefs(mDocAccessible));
    }
@@ -4720,17 +4720,17 @@ diff --git a/accessible/src/base/nsAcces
      if (multiSelect) {
        PRInt32 treeIndex = -1;
        multiSelect->GetCurrentIndex(&treeIndex);
        if (treeIndex >= 0) {
 -        nsCOMPtr<nsIAccessibleTreeCache> treeCache(do_QueryInterface(accessible));
 +        nsIAccessibleTreeCache* treeCache(do_QueryInterface(accessible));
          NS_IF_RELEASE(accessible);
 -        nsCOMPtr<nsIAccessible> treeItemAccessible;
-+        nsIAccessible* treeItemAccessible;
++        nsIAccessible* treeItemAccessible = nsnull;
          if (!treeCache ||
              NS_FAILED(treeCache->GetCachedTreeitemAccessible(
                        treeIndex,
                        nsnull,
 -                      getter_AddRefs(treeItemAccessible))) ||
 +                      &treeItemAccessible)) ||
                        !treeItemAccessible) {
            return nsnull;
@@ -4817,29 +4817,29 @@ diff --git a/accessible/src/base/nsAppli
 -  nsCOMPtr<nsIStringBundleService> bundleService =
 +  nsIStringBundleService* bundleService =
      do_GetService(NS_STRINGBUNDLE_CONTRACTID);
  
    NS_ASSERTION(bundleService, "String bundle service must be present!");
    NS_ENSURE_STATE(bundleService);
  
 -  nsCOMPtr<nsIStringBundle> bundle;
-+  nsIStringBundle* bundle;
++  nsIStringBundle* bundle = nsnull;
    bundleService->CreateBundle("chrome://branding/locale/brand.properties",
 -                              getter_AddRefs(bundle));
 +                              &bundle);
  
    nsXPIDLString appName;
    if (bundle) {
 @@ -149,13 +149,13 @@ nsApplicationAccessible::GetChildAt(PRIn
    if (aChildNum < 0)
      aChildNum = count - 1;
  
 -  nsCOMPtr<nsIWeakReference> childWeakRef;
-+  nsIWeakReference* childWeakRef;
++  nsIWeakReference* childWeakRef = nsnull;
    rv = mChildren->QueryElementAt(aChildNum, NS_GET_IID(nsIWeakReference),
 -                                 getter_AddRefs(childWeakRef));
 +                                 (void**)&childWeakRef);
    NS_ENSURE_SUCCESS(rv, rv);
  
    if (childWeakRef) {
 -    nsCOMPtr<nsIAccessible> childAcc(do_QueryReferent(childWeakRef));
 +    nsIAccessible* childAcc(do_QueryReferent(childWeakRef));
@@ -4851,22 +4851,22 @@ diff --git a/accessible/src/base/nsAppli
  
    if (mAccChildCount == eChildCountUninitialized) {
 -    nsCOMPtr<nsISimpleEnumerator> enumerator;
 -    mChildren->Enumerate(getter_AddRefs(enumerator));
 -
 -    nsCOMPtr<nsIWeakReference> childWeakRef;
 -    nsCOMPtr<nsIAccessible> accessible;
 -    nsCOMPtr<nsPIAccessible> previousAccessible;
-+    nsISimpleEnumerator* enumerator;
++    nsISimpleEnumerator* enumerator = nsnull;
 +    mChildren->Enumerate(&enumerator);
 +
-+    nsIWeakReference* childWeakRef;
-+    nsIAccessible* accessible;
-+    nsPIAccessible* previousAccessible;
++    nsIWeakReference* childWeakRef = nsnull;
++    nsIAccessible* accessible = nsnull;
++    nsPIAccessible* previousAccessible = nsnull;
      PRBool hasMoreElements;
      while(NS_SUCCEEDED(enumerator->HasMoreElements(&hasMoreElements))
            && hasMoreElements) {
 -      enumerator->GetNext(getter_AddRefs(childWeakRef));
 +      enumerator->GetNext((class nsISupports**)&childWeakRef);
        accessible = do_QueryReferent(childWeakRef);
        if (accessible) {
          if (previousAccessible)
@@ -4926,17 +4926,17 @@ diff --git a/accessible/src/base/nsBaseW
  NS_IMETHODIMP nsLinkableAccessible::GetKeyboardShortcut(nsAString& aKeyboardShortcut)
  {
    if (mActionContent) {
 -    nsCOMPtr<nsIDOMNode> actionNode(do_QueryInterface(mActionContent));
 +    nsIDOMNode* actionNode(do_QueryInterface(mActionContent));
      if (actionNode && mDOMNode != actionNode) {
 -      nsCOMPtr<nsIAccessible> accessible;
 -      nsCOMPtr<nsIAccessibilityService> accService = 
-+      nsIAccessible* accessible;
++      nsIAccessible* accessible = nsnull;
 +      nsIAccessibilityService* accService = 
          do_GetService("@mozilla.org/accessibilityService;1");
        accService->GetAccessibleInWeakShell(actionNode, mWeakShell,
 -                                           getter_AddRefs(accessible));
 +                                           &accessible);
        if (accessible) {
          accessible->GetKeyboardShortcut(aKeyboardShortcut);
        }
@@ -4955,17 +4955,17 @@ diff --git a/accessible/src/base/nsBaseW
 -      nsCOMPtr<nsILink> link = do_QueryInterface(walkUpContent);
 +      nsILink* link = do_QueryInterface(walkUpContent);
        if (link) {
          // Currently we do not expose <link> tags, because they are not typically
          // in <body> and rendered.
          // We do not yet support xlinks
 -        nsCOMPtr<nsIURI> uri;
 -        link->GetHrefURI(getter_AddRefs(uri));
-+        nsIURI* uri;
++        nsIURI* uri = nsnull;
 +        link->GetHrefURI(&uri);
          if (uri) {
            mActionContent = walkUpContent;
            mIsLink = PR_TRUE;
 @@ -269,7 +269,7 @@ NS_IMETHODIMP nsLinkableAccessible::GetU
      return NS_ERROR_FAILURE;
    }
  
@@ -5012,21 +5012,21 @@ diff --git a/accessible/src/base/nsCaret
    NS_ENSURE_TRUE(presContext, NS_ERROR_FAILURE);
  
 -  nsCOMPtr<nsISelectionController> selCon;
 -  frame->GetSelectionController(presContext, getter_AddRefs(selCon));
 -  NS_ENSURE_TRUE(selCon, NS_ERROR_FAILURE);
 -  
 -  nsCOMPtr<nsISelection> domSel;
 -  selCon->GetSelection(nsISelectionController::SELECTION_NORMAL, getter_AddRefs(domSel));
-+  nsISelectionController* selCon;
++  nsISelectionController* selCon = nsnull;
 +  frame->GetSelectionController(presContext, &selCon);
 +  NS_ENSURE_TRUE(selCon, NS_ERROR_FAILURE);
 +  
-+  nsISelection* domSel;
++  nsISelection* domSel = nsnull;
 +  selCon->GetSelection(nsISelectionController::SELECTION_NORMAL, &domSel);
  
    ClearControlSelectionListener();
 -  nsCOMPtr<nsISelectionPrivate> selPrivate(do_QueryInterface(domSel));
 +  nsISelectionPrivate* selPrivate(do_QueryInterface(domSel));
    NS_ENSURE_TRUE(selPrivate, NS_ERROR_FAILURE);
  
    mCurrentControlSelection = do_GetWeakReference(domSel);
@@ -5042,17 +5042,17 @@ diff --git a/accessible/src/base/nsCaret
 -  nsCOMPtr<nsISelection> domSel;
 -  selCon->GetSelection(nsISelectionController::SELECTION_NORMAL, getter_AddRefs(domSel));
 -  nsCOMPtr<nsISelectionPrivate> selPrivate = do_QueryInterface(domSel);
 +  nsIDocument* doc = do_QueryInterface(aDoc);
 +  NS_ENSURE_TRUE(doc, NS_ERROR_FAILURE);
 +  nsISelectionController* selCon = do_QueryInterface(doc->GetPrimaryShell());
 +  NS_ENSURE_TRUE(selCon, NS_ERROR_FAILURE);
 +
-+  nsISelection* domSel;
++  nsISelection* domSel = nsnull;
 +  selCon->GetSelection(nsISelectionController::SELECTION_NORMAL, &domSel);
 +  nsISelectionPrivate* selPrivate = do_QueryInterface(domSel);
    NS_ENSURE_TRUE(selPrivate, NS_ERROR_FAILURE);
  
    return selPrivate->AddSelectionListener(this);
 @@ -145,15 +145,15 @@ nsresult nsCaretAccessible::AddDocSelect
  
  nsresult nsCaretAccessible::RemoveDocSelectionListener(nsIDOMDocument *aDoc)
@@ -5067,56 +5067,56 @@ diff --git a/accessible/src/base/nsCaret
 -  selCon->GetSelection(nsISelectionController::SELECTION_NORMAL, getter_AddRefs(domSel));
 -  nsCOMPtr<nsISelectionPrivate> selPrivate = do_QueryInterface(domSel);
 +  nsIDocument* doc = do_QueryInterface(aDoc);
 +  NS_ENSURE_TRUE(doc, NS_ERROR_FAILURE);
 +
 +  nsISelectionController* selCon = do_QueryInterface(doc->GetPrimaryShell());
 +  NS_ENSURE_TRUE(selCon, NS_ERROR_FAILURE);
 +
-+  nsISelection* domSel;
++  nsISelection* domSel = nsnull;
 +  selCon->GetSelection(nsISelectionController::SELECTION_NORMAL, &domSel);
 +  nsISelectionPrivate* selPrivate = do_QueryInterface(domSel);
    NS_ENSURE_TRUE(selPrivate, NS_ERROR_FAILURE);
  
    return selPrivate->RemoveSelectionListener(this);
 @@ -163,42 +163,42 @@ NS_IMETHODIMP nsCaretAccessible::NotifyS
  {
    mLastUsedSelection = do_GetWeakReference(aSel);
  
 -  nsCOMPtr<nsIDocument> doc = do_QueryInterface(aDoc);
 +  nsIDocument* doc = do_QueryInterface(aDoc);
    nsIPresShell *presShell = doc->GetPrimaryShell();
    NS_ENSURE_TRUE(presShell, NS_OK);
  
    // Get first nnsIAccessibleText in parent chain and fire caret-move, selection-change event for it
 -  nsCOMPtr<nsIAccessible> accessible;
-+  nsIAccessible* accessible;
++  nsIAccessible* accessible = nsnull;
    nsIAccessibilityService *accService = mRootAccessible->GetAccService();
    NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
    // Get accessible from selection's focus node or its parent
 -  nsCOMPtr<nsIDOMNode> focusNode;
 -  aSel->GetFocusNode(getter_AddRefs(focusNode));
-+  nsIDOMNode* focusNode;
++  nsIDOMNode* focusNode = nsnull;
 +  aSel->GetFocusNode(&focusNode);
    if (!focusNode) {
      mLastTextAccessible = nsnull;
      return NS_OK; // No selection
    }
 -  nsCOMPtr<nsIDOMNode> nodeWithCaret = focusNode;
 -
 -  nsCOMPtr<nsIAccessibleText> textAcc;
 +  nsIDOMNode* nodeWithCaret = focusNode;
 +
-+  nsIAccessibleText* textAcc;
++  nsIAccessibleText* textAcc = nsnull;
    while (focusNode) {
      // Make sure to get the correct starting node for selection events inside XBL content trees
 -    nsCOMPtr<nsIDOMNode> relevantNode;
 -    if (NS_SUCCEEDED(accService->GetRelevantContentNodeFor(focusNode, getter_AddRefs(relevantNode))) && relevantNode) {
-+    nsIDOMNode* relevantNode;
++    nsIDOMNode* relevantNode = nsnull;
 +    if (NS_SUCCEEDED(accService->GetRelevantContentNodeFor(focusNode, &relevantNode)) && relevantNode) {
        focusNode  = relevantNode;
      }
  
 -    nsCOMPtr<nsIContent> content = do_QueryInterface(focusNode);
 +    nsIContent* content = do_QueryInterface(focusNode);
      if (!content || !content->IsNodeOfType(nsINode::eTEXT)) {
 -      accService->GetAccessibleInShell(focusNode, presShell,  getter_AddRefs(accessible));
@@ -5124,17 +5124,17 @@ diff --git a/accessible/src/base/nsCaret
        textAcc = do_QueryInterface(accessible);
        if (textAcc) {
          break;
        }
      }
 -    nsCOMPtr<nsIDOMNode> parentNode;
 -    focusNode->GetParentNode(getter_AddRefs(parentNode));
 -    focusNode.swap(parentNode);
-+    nsIDOMNode* parentNode;
++    nsIDOMNode* parentNode = nsnull;
 +    focusNode->GetParentNode(&parentNode);
 +    swap(focusNode, parentNode);
    }
    NS_ASSERTION(textAcc, "No nsIAccessibleText for caret move event!"); // No nsIAccessibleText for caret move event!
    NS_ENSURE_TRUE(textAcc, NS_ERROR_FAILURE);
 @@ -217,7 +217,7 @@ NS_IMETHODIMP nsCaretAccessible::NotifyS
    mLastCaretOffset = caretOffset;
    mLastTextAccessible = textAcc;
@@ -5149,27 +5149,27 @@ diff --git a/accessible/src/base/nsCaret
    }
  
 -  nsCOMPtr<nsIAccessNode> lastAccessNode(do_QueryInterface(mLastTextAccessible));
 +  nsIAccessNode* lastAccessNode(do_QueryInterface(mLastTextAccessible));
    NS_ENSURE_TRUE(lastAccessNode, caretRect);
  
 -  nsCOMPtr<nsIDOMNode> lastNodeWithCaret;
 -  lastAccessNode->GetDOMNode(getter_AddRefs(lastNodeWithCaret));
-+  nsIDOMNode* lastNodeWithCaret;
++  nsIDOMNode* lastNodeWithCaret = nsnull;
 +  lastAccessNode->GetDOMNode(&lastNodeWithCaret);
    NS_ENSURE_TRUE(lastNodeWithCaret, caretRect);
  
 -  nsCOMPtr<nsIPresShell> presShell = mRootAccessible->GetPresShellFor(lastNodeWithCaret);
 +  nsIPresShell* presShell = mRootAccessible->GetPresShellFor(lastNodeWithCaret);
    NS_ENSURE_TRUE(presShell, caretRect);
  
 -  nsCOMPtr<nsICaret> caret;
 -  presShell->GetCaret(getter_AddRefs(caret));
-+  nsICaret* caret;
++  nsICaret* caret = nsnull;
 +  presShell->GetCaret(&caret);
    NS_ENSURE_TRUE(caret, caretRect);
  
    PRBool isCollapsed;
    nsIView *view;
 -  nsCOMPtr<nsISelection> caretSelection(do_QueryReferent(mLastUsedSelection));
 +  nsISelection* caretSelection(do_QueryReferent(mLastUsedSelection));
    NS_ENSURE_TRUE(caretSelection, caretRect);
@@ -5197,17 +5197,17 @@ diff --git a/accessible/src/base/nsDocAc
        nsAutoString mimeType;
        GetMimeType(mimeType);
 @@ -118,8 +118,8 @@ nsDocAccessible::nsDocAccessible(nsIDOMN
      // Find mWnd
      nsIViewManager* vm = shell->GetViewManager();
      if (vm) {
 -      nsCOMPtr<nsIWidget> widget;
 -      vm->GetWidget(getter_AddRefs(widget));
-+      nsIWidget* widget;
++      nsIWidget* widget = nsnull;
 +      vm->GetWidget(&widget);
        if (widget) {
          mWnd = widget->GetNativeData(NS_NATIVE_WINDOW);
        }
 @@ -129,9 +129,9 @@ nsDocAccessible::nsDocAccessible(nsIDOMN
    // XXX aaronl should we use an algorithm for the initial cache size?
    mAccessNodeCache.Init(kDefaultCacheSize);
  
@@ -5224,17 +5224,17 @@ diff --git a/accessible/src/base/nsDocAc
    *aRole = nsIAccessibleRole::ROLE_PANE; // Fall back
  
 -  nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem =
 +  nsIDocShellTreeItem* docShellTreeItem =
      nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
    if (docShellTreeItem) {
 -    nsCOMPtr<nsIDocShellTreeItem> sameTypeRoot;
 -    docShellTreeItem->GetSameTypeRootTreeItem(getter_AddRefs(sameTypeRoot));
-+    nsIDocShellTreeItem* sameTypeRoot;
++    nsIDocShellTreeItem* sameTypeRoot = nsnull;
 +    docShellTreeItem->GetSameTypeRootTreeItem(&sameTypeRoot);
      PRInt32 itemType;
      docShellTreeItem->GetItemType(&itemType);
      if (sameTypeRoot == docShellTreeItem) {
 @@ -197,7 +197,7 @@ NS_IMETHODIMP nsDocAccessible::GetRole(P
        }
        else if (itemType == nsIDocShellTreeItem::typeContent) {
  #ifdef MOZ_XUL
@@ -5253,17 +5253,17 @@ diff --git a/accessible/src/base/nsDocAc
  #endif
    {
 @@ -265,8 +265,8 @@ nsDocAccessible::GetState(PRUint32 *aSta
      }
    }
  
 -  nsCOMPtr<nsIEditor> editor;
 -  GetAssociatedEditor(getter_AddRefs(editor));
-+  nsIEditor* editor;
++  nsIEditor* editor = nsnull;
 +  GetAssociatedEditor(&editor);
    if (!editor) {
      *aState |= nsIAccessibleStates::STATE_READONLY;
    }
 @@ -286,7 +286,7 @@ NS_IMETHODIMP nsDocAccessible::GetFocuse
  
    // Return an accessible for the current global focus, which does not have to
    // be contained within the current document.
@@ -5295,17 +5295,17 @@ diff --git a/accessible/src/base/nsDocAc
 -  nsCOMPtr<nsISupports> container = mDocument->GetContainer();
 -  nsCOMPtr<nsIWebNavigation> webNav(do_GetInterface(container));
 +  nsISupports* container = mDocument->GetContainer();
 +  nsIWebNavigation* webNav(do_GetInterface(container));
    nsCAutoString theURL;
    if (webNav) {
 -    nsCOMPtr<nsIURI> pURI;
 -    webNav->GetCurrentURI(getter_AddRefs(pURI));
-+    nsIURI* pURI;
++    nsIURI* pURI = nsnull;
 +    webNav->GetCurrentURI(&pURI);
      if (pURI)
        pURI->GetSpec(theURL);
    }
 @@ -353,7 +353,7 @@ NS_IMETHODIMP nsDocAccessible::GetTitle(
  
  NS_IMETHODIMP nsDocAccessible::GetMimeType(nsAString& aMimeType)
  {
@@ -5316,17 +5316,17 @@ diff --git a/accessible/src/base/nsDocAc
    }
 @@ -362,17 +362,17 @@ NS_IMETHODIMP nsDocAccessible::GetMimeTy
  
  NS_IMETHODIMP nsDocAccessible::GetDocType(nsAString& aDocType)
  {
 -  nsCOMPtr<nsIDOMDocument> domDoc(do_QueryInterface(mDocument));
 -  nsCOMPtr<nsIDOMDocumentType> docType;
 +  nsIDOMDocument* domDoc(do_QueryInterface(mDocument));
-+  nsIDOMDocumentType* docType;
++  nsIDOMDocumentType* docType = nsnull;
  
  #ifdef MOZ_XUL
 -  nsCOMPtr<nsIXULDocument> xulDoc(do_QueryInterface(mDocument));
 +  nsIXULDocument* xulDoc(do_QueryInterface(mDocument));
    if (xulDoc) {
      aDocType.AssignLiteral("window"); // doctype not implemented for XUL at time of writing - causes assertion
      return NS_OK;
    } else
@@ -5362,17 +5362,17 @@ diff --git a/accessible/src/base/nsDocAc
 -  nsCOMPtr<nsIEditingSession> editingSession(do_GetInterface(container));
 +  nsISupports* container = mDocument->GetContainer();
 +  nsIEditingSession* editingSession(do_GetInterface(container));
    if (!editingSession)
      return NS_OK; // No editing session interface
  
 -  nsCOMPtr<nsIEditor> editor;
 -  editingSession->GetEditorForWindow(mDocument->GetWindow(), getter_AddRefs(editor));
-+  nsIEditor* editor;
++  nsIEditor* editor = nsnull;
 +  editingSession->GetEditorForWindow(mDocument->GetWindow(), &editor);
    if (!editor) {
      return NS_OK;
    }
 @@ -488,9 +488,9 @@ NS_IMETHODIMP nsDocAccessible::GetParent
      nsIDocument *parentDoc = mDocument->GetParentDocument();
      NS_ENSURE_TRUE(parentDoc, NS_ERROR_FAILURE);
      nsIContent *ownerContent = parentDoc->FindContentForSubDocument(mDocument);
@@ -5400,17 +5400,17 @@ diff --git a/accessible/src/base/nsDocAc
 -  nsCOMPtr<nsIDocShellTreeNode> treeNode(do_QueryInterface(aStart));
 +  nsIDocShellTreeNode* treeNode(do_QueryInterface(aStart));
    if (treeNode) {
      PRInt32 subDocuments;
      treeNode->GetChildCount(&subDocuments);
      for (PRInt32 count = 0; count < subDocuments; count ++) {
 -      nsCOMPtr<nsIDocShellTreeItem> treeItemChild;
 -      treeNode->GetChildAt(count, getter_AddRefs(treeItemChild));
-+      nsIDocShellTreeItem* treeItemChild;
++      nsIDocShellTreeItem* treeItemChild = nsnull;
 +      treeNode->GetChildAt(count, &treeItemChild);
        NS_ASSERTION(treeItemChild, "No tree item when there should be");
        if (!treeItemChild) {
          continue;
        }
 -      nsCOMPtr<nsIAccessibleDocument> docAccessible =
 +      nsIAccessibleDocument* docAccessible =
          GetDocAccessibleFor(treeItemChild);
@@ -5451,17 +5451,17 @@ diff --git a/accessible/src/base/nsDocAc
 +    nsICommandManager* commandManager = do_GetInterface(docShellTreeItem);
      if (commandManager) {
        commandManager->AddCommandObserver(this, "obs_documentCreated");
      }
    }
  
 -  nsCOMPtr<nsIDocShellTreeItem> rootTreeItem;
 -  docShellTreeItem->GetRootTreeItem(getter_AddRefs(rootTreeItem));
-+  nsIDocShellTreeItem* rootTreeItem;
++  nsIDocShellTreeItem* rootTreeItem = nsnull;
 +  docShellTreeItem->GetRootTreeItem(&rootTreeItem);
    if (rootTreeItem) {
 -    nsCOMPtr<nsIAccessibleDocument> rootAccDoc =
 +    nsIAccessibleDocument* rootAccDoc =
        GetDocAccessibleFor(rootTreeItem, PR_TRUE); // Ensure root accessible is created;
 -    nsRefPtr<nsRootAccessible> rootAccessible = GetRootAccessible(); // Then get it as ref ptr
 +    nsRootAccessible* rootAccessible = GetRootAccessible(); // Then get it as ref ptr
      NS_ENSURE_TRUE(rootAccessible, NS_ERROR_FAILURE);
@@ -5510,17 +5510,17 @@ diff --git a/accessible/src/base/nsDocAc
 -  nsCOMPtr<nsISupports> container = mDocument->GetContainer();
 -  nsCOMPtr<nsIWebNavigation> webNav(do_GetInterface(container));
 +  nsISupports* container = mDocument->GetContainer();
 +  nsIWebNavigation* webNav(do_GetInterface(container));
    nsCAutoString theURL;
    if (webNav) {
 -    nsCOMPtr<nsIURI> pURI;
 -    webNav->GetCurrentURI(getter_AddRefs(pURI));
-+    nsIURI* pURI;
++    nsIURI* pURI = nsnull;
 +    webNav->GetCurrentURI(&pURI);
      if (pURI) {
        pURI->GetSpec(theURL);
      }
 @@ -792,8 +792,8 @@ NS_IMETHODIMP nsDocAccessible::FireDocLo
    if (isFinished) {
      // Need to wait until scrollable view is available
      AddScrollListener();
@@ -5539,17 +5539,17 @@ diff --git a/accessible/src/base/nsDocAc
 +    nsIDocShellTreeItem* treeItem =
        nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
      if (!treeItem) {
        return NS_OK;
      }
  
 -    nsCOMPtr<nsIDocShellTreeItem> sameTypeRoot;
 -    treeItem->GetSameTypeRootTreeItem(getter_AddRefs(sameTypeRoot));
-+    nsIDocShellTreeItem* sameTypeRoot;
++    nsIDocShellTreeItem* sameTypeRoot = nsnull;
 +    treeItem->GetSameTypeRootTreeItem(&sameTypeRoot);
      if (sameTypeRoot != treeItem) {
        return NS_OK; 
      }
  
      // Loading document: fire EVENT_STATE_CHANGE to set STATE_BUSY
 -    nsCOMPtr<nsIAccessibleStateChangeEvent> accEvent =
 +    nsIAccessibleStateChangeEvent* accEvent =
@@ -5587,17 +5587,17 @@ diff --git a/accessible/src/base/nsDocAc
    AttributeChangedImpl(aContent, aNameSpaceID, aAttribute);
  
    // If it was the focused node, cache the new state
 -  nsCOMPtr<nsIDOMNode> targetNode = do_QueryInterface(aContent);
 +  nsIDOMNode* targetNode = do_QueryInterface(aContent);
    if (targetNode == gLastFocusedNode) {
 -    nsCOMPtr<nsIAccessible> focusedAccessible;
 -    GetAccService()->GetAccessibleFor(targetNode, getter_AddRefs(focusedAccessible));
-+    nsIAccessible* focusedAccessible;
++    nsIAccessible* focusedAccessible = nsnull;
 +    GetAccService()->GetAccessibleFor(targetNode, &focusedAccessible);
      if (focusedAccessible) {
        gLastFocusedAccessiblesState = State(focusedAccessible);
      }
 @@ -968,8 +968,8 @@ nsDocAccessible::AttributeChangedImpl(ns
    // Otherwise it may just be a state change, for example an object changing
    // its visibility
  
@@ -5638,17 +5638,17 @@ diff --git a/accessible/src/base/nsDocAc
        new nsAccStateChangeEvent(targetNode,
                                  nsIAccessibleStates::EXT_STATE_SENSITIVE,
                                  PR_TRUE);
 @@ -1026,7 +1026,7 @@ nsDocAccessible::AttributeChangedImpl(ns
    }
  
    // Check for namespaced ARIA attribute
 -  nsCOMPtr<nsIAtom> ariaAttribute;
-+  nsIAtom* ariaAttribute;
++  nsIAtom* ariaAttribute = nsnull;
    if (aNameSpaceID == kNameSpaceID_WAIProperties) {
      ariaAttribute = aAttribute;
    }
 @@ -1057,7 +1057,7 @@ nsDocAccessible::AttributeChangedImpl(ns
  
    if (aAttribute == nsAccessibilityAtoms::selected) {
      // DHTML or XUL selection
 -    nsCOMPtr<nsIAccessible> multiSelect = GetMultiSelectFor(targetNode);
@@ -5660,17 +5660,17 @@ diff --git a/accessible/src/base/nsDocAc
      if (multiSelect) {
        // Need to find the right event to use here, SELECTION_WITHIN would
        // seem right but we had started using it for something else
 -      nsCOMPtr<nsIAccessNode> multiSelectAccessNode =
 +      nsIAccessNode* multiSelectAccessNode =
          do_QueryInterface(multiSelect);
 -      nsCOMPtr<nsIDOMNode> multiSelectDOMNode;
 -      multiSelectAccessNode->GetDOMNode(getter_AddRefs(multiSelectDOMNode));
-+      nsIDOMNode* multiSelectDOMNode;
++      nsIDOMNode* multiSelectDOMNode = nsnull;
 +      multiSelectAccessNode->GetDOMNode(&multiSelectDOMNode);
        NS_ASSERTION(multiSelectDOMNode, "A new accessible without a DOM node!");
        FireDelayedToolkitEvent(nsIAccessibleEvent::EVENT_SELECTION_WITHIN,
                                multiSelectDOMNode, nsnull, eAllowDupes);
 @@ -1092,7 +1092,7 @@ nsDocAccessible::AttributeChangedImpl(ns
    }
  
    if (aAttribute == nsAccessibilityAtoms::contenteditable) {
@@ -5725,17 +5725,17 @@ diff --git a/accessible/src/base/nsDocAc
      FireDelayedAccessibleEvent(event);
      if (targetNode == gLastFocusedNode) {
 @@ -1159,13 +1159,13 @@ nsDocAccessible::ARIAAttributeChanged(ns
        // otherwise we would need access to the old attribute value in this listener.
        // This is because we don't know if the previous value of aaa:checked or aaa:pressed was "mixed"
        // without caching that info.
 -      nsCOMPtr<nsIAccessible> accessible;
 -      event->GetAccessible(getter_AddRefs(accessible));
-+      nsIAccessible* accessible;
++      nsIAccessible* accessible = nsnull;
 +      event->GetAccessible(&accessible);
        if (accessible) {
          PRBool wasMixed = (gLastFocusedAccessiblesState & nsIAccessibleStates::STATE_MIXED) != 0;
          PRBool isMixed  = (State(accessible) & nsIAccessibleStates::STATE_MIXED) != 0;
          if (wasMixed != isMixed) {
 -          nsCOMPtr<nsIAccessibleStateChangeEvent> event =
 +          nsIAccessibleStateChangeEvent* event =
              new nsAccStateChangeEvent(targetNode,
@@ -5774,23 +5774,23 @@ diff --git a/accessible/src/base/nsDocAc
  
 -  nsCOMPtr<nsIDOMNode> node(do_QueryInterface(aContent));
 +  nsIDOMNode* node(do_QueryInterface(aContent));
    if (!node)
      return;
  
 -  nsCOMPtr<nsIAccessible> accessible;
 -  nsresult rv = GetAccessibleInParentChain(node, PR_TRUE, getter_AddRefs(accessible));
-+  nsIAccessible* accessible;
++  nsIAccessible* accessible = nsnull;
 +  nsresult rv = GetAccessibleInParentChain(node, PR_TRUE, &accessible);
    if (NS_FAILED(rv) || !accessible)
      return;
  
 -  nsRefPtr<nsHyperTextAccessible> textAccessible;
-+  nsHyperTextAccessible* textAccessible;
++  nsHyperTextAccessible* textAccessible = nsnull;
    rv = accessible->QueryInterface(NS_GET_IID(nsHyperTextAccessible),
 -                                  getter_AddRefs(textAccessible));
 +                                  (void**)&textAccessible);
    if (NS_FAILED(rv) || !textAccessible)
      return;
  
 @@ -1323,7 +1323,7 @@ nsDocAccessible::FireTextChangeEventForT
      aInfo->mChangeEnd - start; // text has been removed
@@ -5818,28 +5818,28 @@ diff --git a/accessible/src/base/nsDocAc
 +nsIAccessibleTextChangeEvent*
  nsDocAccessible::CreateTextChangeEventForNode(nsIAccessible *aContainerAccessible,
                                                nsIDOMNode *aChangeNode,
                                                nsIAccessible *aAccessibleForChangeNode,
                                                PRBool aIsInserting,
                                                PRBool aIsAsynch)
  {
 -  nsRefPtr<nsHyperTextAccessible> textAccessible;
-+  nsHyperTextAccessible* textAccessible;
++  nsHyperTextAccessible* textAccessible = nsnull;
    aContainerAccessible->QueryInterface(NS_GET_IID(nsHyperTextAccessible),
 -                                       getter_AddRefs(textAccessible));
 +                                       (void**)&textAccessible);
    if (!textAccessible) {
      return nsnull;
    }
  
    PRInt32 offset;
    PRInt32 length = 0;
 -  nsCOMPtr<nsIAccessible> changeAccessible;
-+  nsIAccessible* changeAccessible;
++  nsIAccessible* changeAccessible = nsnull;
    nsresult rv = textAccessible->DOMPointToHypertextOffset(aChangeNode, -1, &offset,
 -                                                          getter_AddRefs(changeAccessible));
 +                                                          &changeAccessible);
    NS_ENSURE_SUCCESS(rv, nsnull);
  
    if (!aAccessibleForChangeNode) {
 @@ -1378,21 +1378,21 @@ nsDocAccessible::CreateTextChangeEventFo
      if (!changeAccessible) {
@@ -5848,17 +5848,17 @@ diff --git a/accessible/src/base/nsDocAc
 -    nsCOMPtr<nsIAccessible> child = changeAccessible;
 +    nsIAccessible* child = changeAccessible;
      while (PR_TRUE) {
 -      nsCOMPtr<nsIAccessNode> childAccessNode =
 +      nsIAccessNode* childAccessNode =
          do_QueryInterface(changeAccessible);
 -      nsCOMPtr<nsIDOMNode> childNode;
 -      childAccessNode->GetDOMNode(getter_AddRefs(childNode));
-+      nsIDOMNode* childNode;
++      nsIDOMNode* childNode = nsnull;
 +      childAccessNode->GetDOMNode(&childNode);
        if (!nsAccUtils::IsAncestorOf(aChangeNode, childNode)) {
          break;  // We only want accessibles with DOM nodes as children of this node
        }
        length += TextLength(child);
 -      child->GetNextSibling(getter_AddRefs(changeAccessible));
 +      child->GetNextSibling(&changeAccessible);
        if (!changeAccessible) {
@@ -5870,17 +5870,17 @@ diff --git a/accessible/src/base/nsDocAc
    }
    else {
 @@ -1401,8 +1401,8 @@ nsDocAccessible::CreateTextChangeEventFo
      length = TextLength(aAccessibleForChangeNode);
      if (Role(aAccessibleForChangeNode) == nsIAccessibleRole::ROLE_WHITESPACE) {  // newline
        // Don't fire event for the first html:br in an editor.
 -      nsCOMPtr<nsIEditor> editor;
 -      textAccessible->GetAssociatedEditor(getter_AddRefs(editor));
-+      nsIEditor* editor;
++      nsIEditor* editor = nsnull;
 +      textAccessible->GetAssociatedEditor(&editor);
        if (editor) {
          PRBool isEmpty = PR_FALSE;
          editor->GetDocumentIsEmpty(&isEmpty);
 @@ -1429,7 +1429,7 @@ nsresult nsDocAccessible::FireDelayedToo
                                                    EDupeEventRule aAllowDupes,
                                                    PRBool aIsAsynch)
  {
@@ -5890,95 +5890,95 @@ diff --git a/accessible/src/base/nsDocAc
    NS_ENSURE_TRUE(event, NS_ERROR_OUT_OF_MEMORY);
  
 @@ -1454,8 +1454,8 @@ nsDocAccessible::FireDelayedAccessibleEv
    PRUint32 newEventType;
    aEvent->GetEventType(&newEventType);
  
 -  nsCOMPtr<nsIDOMNode> newEventDOMNode;
 -  aEvent->GetDOMNode(getter_AddRefs(newEventDOMNode));
-+  nsIDOMNode* newEventDOMNode;
++  nsIDOMNode* newEventDOMNode = nsnull;
 +  aEvent->GetDOMNode(&newEventDOMNode);
  
    if (!aIsAsynch) {
      // If already asynchronous don't call PrepareFromEvent() -- it
 @@ -1479,8 +1479,8 @@ nsDocAccessible::FireDelayedAccessibleEv
        PRUint32 eventType;
        accessibleEvent->GetEventType(&eventType);
        if (eventType == newEventType) {
 -        nsCOMPtr<nsIDOMNode> domNode;
 -        accessibleEvent->GetDOMNode(getter_AddRefs(domNode));
-+        nsIDOMNode* domNode;
++        nsIDOMNode* domNode = nsnull;
 +        accessibleEvent->GetDOMNode(&domNode);
          if (newEventDOMNode == domNode || nsAccUtils::IsAncestorOf(newEventDOMNode, domNode)) {
            mEventsToFire.RemoveObjectAt(index);
            // The other event is the same type, but in a descendant of this
 @@ -1508,8 +1508,8 @@ nsDocAccessible::FireDelayedAccessibleEv
        PRUint32 eventType;
        accessibleEvent->GetEventType(&eventType);
        if (eventType == newEventType) {
 -        nsCOMPtr<nsIDOMNode> domNode;
 -        accessibleEvent->GetDOMNode(getter_AddRefs(domNode));
-+        nsIDOMNode* domNode;
++        nsIDOMNode* domNode = nsnull;
 +        accessibleEvent->GetDOMNode(&domNode);
          if (domNode == newEventDOMNode) {
            mEventsToFire.RemoveObjectAt(index);
            -- index;
 @@ -1537,21 +1537,21 @@ NS_IMETHODIMP nsDocAccessible::FlushPend
    NS_ASSERTION(length, "How did we get here without events to fire?");
    PRUint32 index;
    for (index = 0; index < length; index ++) {
 -    nsCOMPtr<nsIAccessibleEvent> accessibleEvent(
 +    nsIAccessibleEvent* accessibleEvent(
        do_QueryInterface(mEventsToFire[index]));
      NS_ASSERTION(accessibleEvent, "Array item is not an accessible event");
  
 -    nsCOMPtr<nsIAccessible> accessible;
 -    accessibleEvent->GetAccessible(getter_AddRefs(accessible));
-+    nsIAccessible* accessible;
++    nsIAccessible* accessible = nsnull;
 +    accessibleEvent->GetAccessible(&accessible);
  
      PRUint32 eventType;
      accessibleEvent->GetEventType(&eventType);
      if (eventType == nsIAccessibleEvent::EVENT_DOM_CREATE || 
          eventType == nsIAccessibleEvent::EVENT_ASYNCH_SHOW) {
 -      nsCOMPtr<nsIAccessible> containerAccessible;
-+      nsIAccessible* containerAccessible;
++      nsIAccessible* containerAccessible = nsnull;
        if (accessible) {
 -        accessible->GetParent(getter_AddRefs(containerAccessible));
 -        nsCOMPtr<nsPIAccessible> privateContainerAccessible =
 +        accessible->GetParent(&containerAccessible);
 +        nsPIAccessible* privateContainerAccessible =
            do_QueryInterface(containerAccessible);
          if (privateContainerAccessible)
            privateContainerAccessible->InvalidateChildren();
 @@ -1562,20 +1562,20 @@ NS_IMETHODIMP nsDocAccessible::FlushPend
        // At this point we now have the frame and accessible for this node if there is one. That is why we
        // wait to fire this here, instead of in InvalidateCacheSubtree(), where we wouldn't be able to calculate
        // the offset, length and text for the text change.
 -      nsCOMPtr<nsIDOMNode> domNode;
 -      accessibleEvent->GetDOMNode(getter_AddRefs(domNode));
-+      nsIDOMNode* domNode;
++      nsIDOMNode* domNode = nsnull;
 +      accessibleEvent->GetDOMNode(&domNode);
        PRBool isFromUserInput;
        accessibleEvent->GetIsFromUserInput(&isFromUserInput);
        if (domNode && domNode != mDOMNode) {
          if (!containerAccessible)
            GetAccessibleInParentChain(domNode, PR_TRUE,
 -                                     getter_AddRefs(containerAccessible));
 -
 -        nsCOMPtr<nsIAccessibleTextChangeEvent> textChangeEvent =
 +                                     &containerAccessible);
 +
 +        nsIAccessibleTextChangeEvent* textChangeEvent =
            CreateTextChangeEventForNode(containerAccessible, domNode, accessible, PR_TRUE, PR_TRUE);
          if (textChangeEvent) {
 -          nsCOMPtr<nsIDOMNode> hyperTextNode;
 -          textChangeEvent->GetDOMNode(getter_AddRefs(hyperTextNode));
-+          nsIDOMNode* hyperTextNode;
++          nsIDOMNode* hyperTextNode = nsnull;
 +          textChangeEvent->GetDOMNode(&hyperTextNode);
            nsAccEvent::PrepareForEvent(hyperTextNode, isFromUserInput);
            // XXX Queue them up and merge the text change events
            // XXX We need a way to ignore SplitNode and JoinNode() when they
 @@ -1591,7 +1591,7 @@ NS_IMETHODIMP nsDocAccessible::FlushPend
  
      if (accessible) {
        if (eventType == nsIAccessibleEvent::EVENT_INTERNAL_LOAD) {
@@ -6007,39 +6007,39 @@ diff --git a/accessible/src/base/nsDocAc
  
 @@ -1630,16 +1630,16 @@ NS_IMETHODIMP nsDocAccessible::FlushPend
          if (eventType == nsIAccessibleEvent::EVENT_ASYNCH_HIDE ||
              eventType == nsIAccessibleEvent::EVENT_DOM_DESTROY) {
            // Invalidate children
 -          nsCOMPtr<nsIAccessible> containerAccessible;
 -          accessible->GetParent(getter_AddRefs(containerAccessible));
 -          nsCOMPtr<nsPIAccessible> privateContainerAccessible =
-+          nsIAccessible* containerAccessible;
++          nsIAccessible* containerAccessible = nsnull;
 +          accessible->GetParent(&containerAccessible);
 +          nsPIAccessible* privateContainerAccessible =
              do_QueryInterface(containerAccessible);
            if (privateContainerAccessible) {
              privateContainerAccessible->InvalidateChildren();
            }
            // Shutdown nsIAccessNode's or nsIAccessibles for any DOM nodes in this subtree
 -          nsCOMPtr<nsIDOMNode> hidingNode;
 -          accessibleEvent->GetDOMNode(getter_AddRefs(hidingNode));
-+          nsIDOMNode* hidingNode;
++          nsIDOMNode* hidingNode = nsnull;
 +          accessibleEvent->GetDOMNode(&hidingNode);
            if (hidingNode) {
              RefreshNodes(hidingNode); // Will this bite us with asynch events
            }
 @@ -1660,11 +1660,11 @@ void nsDocAccessible::FlushEventsCallbac
  
  void nsDocAccessible::RefreshNodes(nsIDOMNode *aStartNode)
  {
 -  nsCOMPtr<nsIDOMNode> iterNode(aStartNode), nextNode;
 -  nsCOMPtr<nsIAccessNode> accessNode;
-+  nsIDOMNode* iterNode(aStartNode), *nextNode;
-+  nsIAccessNode* accessNode;
++  nsIDOMNode* iterNode(aStartNode), *nextNode = nsnull;
++  nsIAccessNode* accessNode = nsnull;
  
    do {
 -    GetCachedAccessNode(iterNode, getter_AddRefs(accessNode));
 +    GetCachedAccessNode(iterNode, &accessNode);
      if (accessNode) {
        // Accessibles that implement their own subtrees,
        // like html combo boxes and xul trees must shutdown all of their own
 @@ -1673,14 +1673,14 @@ void nsDocAccessible::RefreshNodes(nsIDO
@@ -6050,17 +6050,17 @@ diff --git a/accessible/src/base/nsDocAc
 +        nsIAccessible* accessible(do_QueryInterface(accessNode));
          if (accessible) {
            // Fire menupopupend events for menu popups that go away
            PRUint32 role = Role(accessible);
            if (role == nsIAccessibleRole::ROLE_MENUPOPUP) {
 -            nsCOMPtr<nsIDOMNode> domNode;
 -            accessNode->GetDOMNode(getter_AddRefs(domNode));
 -            nsCOMPtr<nsIDOMXULPopupElement> popup(do_QueryInterface(domNode));
-+            nsIDOMNode* domNode;
++            nsIDOMNode* domNode = nsnull;
 +            accessNode->GetDOMNode(&domNode);
 +            nsIDOMXULPopupElement* popup(do_QueryInterface(domNode));
              if (!popup) {
                // Popup elements already fire these via DOMMenuInactive
                // handling in nsRootAccessible::HandleEvent
 @@ -1692,14 +1692,14 @@ void nsDocAccessible::RefreshNodes(nsIDO
  
          void *uniqueID;
@@ -6119,34 +6119,34 @@ diff --git a/accessible/src/base/nsDocAc
        nsIEventStateManager *esm = presShell->GetPresContext()->EventStateManager();
        NS_ENSURE_TRUE(esm, NS_ERROR_FAILURE);
 @@ -1779,12 +1779,12 @@ NS_IMETHODIMP nsDocAccessible::Invalidat
          // Adding content during page load, but not caused by user input
          // Just invalidate accessible hierarchy and return,
          // otherwise the page load time slows down way too much
 -        nsCOMPtr<nsIAccessible> containerAccessible;
 -        GetAccessibleInParentChain(childNode, PR_FALSE, getter_AddRefs(containerAccessible));
-+        nsIAccessible* containerAccessible;
++        nsIAccessible* containerAccessible = nsnull;
 +        GetAccessibleInParentChain(childNode, PR_FALSE, &containerAccessible);
          if (!containerAccessible) {
            containerAccessible = this;
          }
 -        nsCOMPtr<nsPIAccessible> privateContainer = do_QueryInterface(containerAccessible);
 +        nsPIAccessible* privateContainer = do_QueryInterface(containerAccessible);
          return privateContainer->InvalidateChildren();
        }     
        // else: user input, so we must fall through and for full handling,
 @@ -1794,14 +1794,14 @@ NS_IMETHODIMP nsDocAccessible::Invalidat
    }
  
    // Update last change state information
 -  nsCOMPtr<nsIAccessNode> childAccessNode;
 -  GetCachedAccessNode(childNode, getter_AddRefs(childAccessNode));
 -  nsCOMPtr<nsIAccessible> childAccessible = do_QueryInterface(childAccessNode);
-+  nsIAccessNode* childAccessNode;
++  nsIAccessNode* childAccessNode = nsnull;
 +  GetCachedAccessNode(childNode, &childAccessNode);
 +  nsIAccessible* childAccessible = do_QueryInterface(childAccessNode);
    if (!childAccessible && !isHiding) {
      // If not about to hide it, make sure there's an accessible so we can fire an
      // event for it
      GetAccService()->GetAttachedAccessibleFor(childNode,
 -                                              getter_AddRefs(childAccessible));
 +                                              &childAccessible);
@@ -6154,17 +6154,17 @@ diff --git a/accessible/src/base/nsDocAc
  
  #ifdef DEBUG_A11Y
 @@ -1828,17 +1828,17 @@ NS_IMETHODIMP nsDocAccessible::Invalidat
    }
  #endif
  
 -  nsCOMPtr<nsIAccessible> containerAccessible;
 -  GetAccessibleInParentChain(childNode, PR_TRUE, getter_AddRefs(containerAccessible));
-+  nsIAccessible* containerAccessible;
++  nsIAccessible* containerAccessible = nsnull;
 +  GetAccessibleInParentChain(childNode, PR_TRUE, &containerAccessible);
    if (!containerAccessible) {
      containerAccessible = this;
    }
  
    if (!isShowing) {
      // Fire EVENT_ASYNCH_HIDE or EVENT_DOM_DESTROY
 -    nsCOMPtr<nsIContent> content(do_QueryInterface(childNode));
@@ -6203,60 +6203,60 @@ diff --git a/accessible/src/base/nsDocAc
        NS_ENSURE_TRUE(reorderEvent, NS_ERROR_OUT_OF_MEMORY);
        FireDelayedAccessibleEvent(reorderEvent, eCoalesceFromSameSubtree, isAsynch);
 @@ -1936,30 +1936,30 @@ nsDocAccessible::GetAccessibleInParentCh
  {
    // Find accessible in parent chain of DOM nodes, or return null
    *aAccessible = nsnull;
 -  nsCOMPtr<nsIDOMNode> currentNode(aNode), parentNode;
 -  nsCOMPtr<nsIAccessNode> accessNode;
-+  nsIDOMNode* currentNode(aNode), *parentNode;
-+  nsIAccessNode* accessNode;
++  nsIDOMNode* currentNode(aNode), *parentNode = nsnull;
++  nsIAccessNode* accessNode = nsnull;
  
    nsIAccessibilityService *accService = GetAccService();
    NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
  
    do {
 -    currentNode->GetParentNode(getter_AddRefs(parentNode));
 +    currentNode->GetParentNode(&parentNode);
      currentNode = parentNode;
      if (!currentNode) {
        *aAccessible = this;
        break;
      }
  
 -    nsCOMPtr<nsIDOMNode> relevantNode;
 -    if (NS_SUCCEEDED(accService->GetRelevantContentNodeFor(currentNode, getter_AddRefs(relevantNode))) && relevantNode) {
-+    nsIDOMNode* relevantNode;
++    nsIDOMNode* relevantNode = nsnull;
 +    if (NS_SUCCEEDED(accService->GetRelevantContentNodeFor(currentNode, &relevantNode)) && relevantNode) {
        currentNode = relevantNode;
      }
      if (aCanCreate) {
        accService->GetAccessibleInWeakShell(currentNode, mWeakShell, aAccessible);
      }
      else { // Only return cached accessibles, don't create anything
 -      nsCOMPtr<nsIAccessNode> accessNode;
 -      GetCachedAccessNode(currentNode, getter_AddRefs(accessNode)); // AddRefs
-+      nsIAccessNode* accessNode;
++      nsIAccessNode* accessNode = nsnull;
 +      GetCachedAccessNode(currentNode, &accessNode); // AddRefs
        if (accessNode) {
          CallQueryInterface(accessNode, aAccessible); // AddRefs
        }
 @@ -1975,17 +1975,17 @@ nsDocAccessible::FireShowHideEvents(nsID
  {
    NS_ENSURE_ARG(aDOMNode);
  
 -  nsCOMPtr<nsIAccessible> accessible;
-+  nsIAccessible* accessible;
++  nsIAccessible* accessible = nsnull;
    if (aEventType == nsIAccessibleEvent::EVENT_ASYNCH_HIDE ||
        aEventType == nsIAccessibleEvent::EVENT_DOM_DESTROY) {
      // Don't allow creation for accessibles when nodes going away
 -    nsCOMPtr<nsIAccessNode> accessNode;
 -    GetCachedAccessNode(aDOMNode, getter_AddRefs(accessNode));
-+    nsIAccessNode* accessNode;
++    nsIAccessNode* accessNode = nsnull;
 +    GetCachedAccessNode(aDOMNode, &accessNode);
      accessible = do_QueryInterface(accessNode);
    } else {
      // Allow creation of new accessibles for show events
      GetAccService()->GetAttachedAccessibleFor(aDOMNode,
 -                                              getter_AddRefs(accessible));
 +                                              &accessible);
    }
@@ -6286,45 +6286,45 @@ diff --git a/accessible/src/base/nsDocAc
      NS_ENSURE_SUCCESS(rv, rv);
 @@ -2035,17 +2035,17 @@ void nsDocAccessible::DocLoadCallback(ns
    }
  
    // Fire doc finished event
 -  nsCOMPtr<nsIDOMNode> docDomNode;
 -  docAcc->GetDOMNode(getter_AddRefs(docDomNode));
 -  nsCOMPtr<nsIDocument> doc(do_QueryInterface(docDomNode));
-+  nsIDOMNode* docDomNode;
++  nsIDOMNode* docDomNode = nsnull;
 +  docAcc->GetDOMNode(&docDomNode);
 +  nsIDocument* doc(do_QueryInterface(docDomNode));
    if (doc) {
 -    nsCOMPtr<nsISupports> container = doc->GetContainer();
 -    nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem = do_QueryInterface(container);
 +    nsISupports* container = doc->GetContainer();
 +    nsIDocShellTreeItem* docShellTreeItem = do_QueryInterface(container);
      if (!docShellTreeItem) {
        return;
      }
 -    nsCOMPtr<nsIDocShellTreeItem> sameTypeRoot;
 -    docShellTreeItem->GetSameTypeRootTreeItem(getter_AddRefs(sameTypeRoot));
-+    nsIDocShellTreeItem* sameTypeRoot;
++    nsIDocShellTreeItem* sameTypeRoot = nsnull;
 +    docShellTreeItem->GetSameTypeRootTreeItem(&sameTypeRoot);
      if (sameTypeRoot != docShellTreeItem) {
        // A frame or iframe has finished loading new content
        docAcc->InvalidateCacheSubtree(nsnull, nsIAccessibleEvent::EVENT_DOM_SIGNIFICANT_CHANGE);
 @@ -2054,13 +2054,13 @@ void nsDocAccessible::DocLoadCallback(ns
  
      // Fire STATE_CHANGE event for doc load finish if focus is in same doc tree
      if (gLastFocusedNode) {
 -      nsCOMPtr<nsIDocShellTreeItem> focusedTreeItem =
 +      nsIDocShellTreeItem* focusedTreeItem =
          nsAccUtils::GetDocShellTreeItemFor(gLastFocusedNode);
        if (focusedTreeItem) {
 -        nsCOMPtr<nsIDocShellTreeItem> sameTypeRootOfFocus;
 -        focusedTreeItem->GetSameTypeRootTreeItem(getter_AddRefs(sameTypeRootOfFocus));
-+        nsIDocShellTreeItem* sameTypeRootOfFocus;
++        nsIDocShellTreeItem* sameTypeRootOfFocus = nsnull;
 +        focusedTreeItem->GetSameTypeRootTreeItem(&sameTypeRootOfFocus);
          if (sameTypeRoot == sameTypeRootOfFocus) {
 -          nsCOMPtr<nsIAccessibleStateChangeEvent> accEvent =
 +          nsIAccessibleStateChangeEvent* accEvent =
              new nsAccStateChangeEvent(docAcc, nsIAccessibleStates::STATE_BUSY,
                                        PR_FALSE, PR_FALSE);
            docAcc->FireAccessibleEvent(accEvent);
 diff --git a/accessible/src/base/nsDocAccessible.h b/accessible/src/base/nsDocAccessible.h
@@ -6344,17 +6344,17 @@ diff --git a/accessible/src/base/nsOuter
 +++ b/accessible/src/base/nsOuterDocAccessible.cpp
 @@ -55,9 +55,9 @@ nsOuterDocAccessible::nsOuterDocAccessib
    /* attribute wstring accName; */
  NS_IMETHODIMP nsOuterDocAccessible::GetName(nsAString& aName) 
  {
 -  nsCOMPtr<nsIAccessible> accessible;
 -  GetFirstChild(getter_AddRefs(accessible));
 -  nsCOMPtr<nsIAccessibleDocument> accDoc(do_QueryInterface(accessible));
-+  nsIAccessible* accessible;
++  nsIAccessible* accessible = nsnull;
 +  GetFirstChild(&accessible);
 +  nsIAccessibleDocument* accDoc(do_QueryInterface(accessible));
    if (!accDoc) {
      return NS_ERROR_FAILURE;
    }
 @@ -123,27 +123,27 @@ void nsOuterDocAccessible::CacheChildren
    // The outer node is a something like a <browser>, <frame>, <iframe>, <page> or
    // <editor> tag, whereas the inner node corresponds to the inner document root.
@@ -6375,17 +6375,17 @@ diff --git a/accessible/src/base/nsOuter
 +  nsIDOMNode* innerNode(do_QueryInterface(innerDoc));
    if (!innerNode) {
      mAccChildCount = 0;
      return;
    }
  
 -  nsCOMPtr<nsIAccessible> innerAccessible;
 -  nsCOMPtr<nsIAccessibilityService> accService = 
-+  nsIAccessible* innerAccessible;
++  nsIAccessible* innerAccessible = nsnull;
 +  nsIAccessibilityService* accService = 
      do_GetService("@mozilla.org/accessibilityService;1");
 -  accService->GetAccessibleFor(innerNode, getter_AddRefs(innerAccessible));
 -  nsCOMPtr<nsPIAccessible> privateInnerAccessible = 
 +  accService->GetAccessibleFor(innerNode, &innerAccessible);
 +  nsPIAccessible* privateInnerAccessible = 
      do_QueryInterface(innerAccessible);
    if (!privateInnerAccessible) {
@@ -6401,17 +6401,17 @@ diff --git a/accessible/src/base/nsRootA
 +  nsIDocShellTreeItem* docShellAsItem =
      nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
    NS_ENSURE_TRUE(docShellAsItem, NS_ERROR_FAILURE);
  
 -  nsCOMPtr<nsIDocShellTreeOwner> treeOwner;
 -  docShellAsItem->GetTreeOwner(getter_AddRefs(treeOwner));
 -
 -  nsCOMPtr<nsIBaseWindow> baseWindow(do_QueryInterface(treeOwner));
-+  nsIDocShellTreeOwner* treeOwner;
++  nsIDocShellTreeOwner* treeOwner = nsnull;
 +  docShellAsItem->GetTreeOwner(&treeOwner);
 +
 +  nsIBaseWindow* baseWindow(do_QueryInterface(treeOwner));
    if (baseWindow) {
      nsXPIDLString title;
      baseWindow->GetTitle(getter_Copies(title));
 @@ -155,7 +155,7 @@ NS_IMETHODIMP nsRootAccessible::GetParen
    NS_ENSURE_ARG_POINTER(aParent);
@@ -6436,49 +6436,49 @@ diff --git a/accessible/src/base/nsRootA
    // by nsIWebBrowserChrome::CHROME_WINDOW_[FLAGNAME]
    // Not simple: nsIXULWindow is not just a QI from nsIDOMWindow
 -  nsCOMPtr<nsIDocShellTreeItem> treeItem =
 +  nsIDocShellTreeItem* treeItem =
      nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
    NS_ENSURE_TRUE(treeItem, 0);
 -  nsCOMPtr<nsIDocShellTreeOwner> treeOwner;
 -  treeItem->GetTreeOwner(getter_AddRefs(treeOwner));
-+  nsIDocShellTreeOwner* treeOwner;
++  nsIDocShellTreeOwner* treeOwner = nsnull;
 +  treeItem->GetTreeOwner(&treeOwner);
    NS_ENSURE_TRUE(treeOwner, 0);
 -  nsCOMPtr<nsIXULWindow> xulWin(do_GetInterface(treeOwner));
 +  nsIXULWindow* xulWin(do_GetInterface(treeOwner));
    if (!xulWin) {
      return 0;
    }
 @@ -229,9 +229,9 @@ nsRootAccessible::GetState(PRUint32 *aSt
    if (!aExtraState)
      return NS_OK;
  
 -  nsCOMPtr<nsIDOMWindow> domWin;
 -  GetWindow(getter_AddRefs(domWin));
 -  nsCOMPtr<nsPIDOMWindow> privateDOMWindow(do_QueryInterface(domWin));
-+  nsIDOMWindow* domWin;
++  nsIDOMWindow* domWin = nsnull;
 +  GetWindow(&domWin);
 +  nsPIDOMWindow* privateDOMWindow(do_QueryInterface(domWin));
    if (privateDOMWindow) {
      nsIFocusController *focusController =
        privateDOMWindow->GetRootFocusController();
 @@ -253,15 +253,15 @@ void
  void
  nsRootAccessible::GetChromeEventHandler(nsIDOMEventTarget **aChromeTarget)
  {
 -  nsCOMPtr<nsIDOMWindow> domWin;
 -  GetWindow(getter_AddRefs(domWin));
 -  nsCOMPtr<nsPIDOMWindow> privateDOMWindow(do_QueryInterface(domWin));
 -  nsCOMPtr<nsPIDOMEventTarget> chromeEventHandler;
-+  nsIDOMWindow* domWin;
++  nsIDOMWindow* domWin = nsnull;
 +  GetWindow(&domWin);
 +  nsPIDOMWindow* privateDOMWindow(do_QueryInterface(domWin));
-+  nsPIDOMEventTarget* chromeEventHandler;
++  nsPIDOMEventTarget* chromeEventHandler = nsnull;
    if (privateDOMWindow) {
      chromeEventHandler = privateDOMWindow->GetChromeEventHandler();
    }
  
 -  nsCOMPtr<nsIDOMEventTarget> target(do_QueryInterface(chromeEventHandler));
 +  nsIDOMEventTarget* target(do_QueryInterface(chromeEventHandler));
  
    *aChromeTarget = target;
@@ -6493,17 +6493,17 @@ diff --git a/accessible/src/base/nsRootA
    if (nstarget) {
      for (const char* const* e = docEvents,
 @@ -312,8 +312,8 @@ nsresult nsRootAccessible::AddEventListe
      }
    }
  
 -  nsCOMPtr<nsIDOMEventTarget> target;
 -  GetChromeEventHandler(getter_AddRefs(target));
-+  nsIDOMEventTarget* target;
++  nsIDOMEventTarget* target = nsnull;
 +  GetChromeEventHandler(&target);
    if (target) {
      target->AddEventListener(NS_LITERAL_STRING("pagehide"), this, PR_TRUE);
    }
 @@ -327,7 +327,7 @@ nsresult nsRootAccessible::AddEventListe
  
  nsresult nsRootAccessible::RemoveEventListeners()
  {
@@ -6533,30 +6533,30 @@ diff --git a/accessible/src/base/nsRootA
 @@ -382,10 +382,10 @@ void nsRootAccessible::TryFireEarlyLoadE
  
    // At minimum, create doc accessible so that events are listened to,
    // allowing us to see any mutations from a page load handler
 -  nsCOMPtr<nsIAccessible> docAccessible;
 -  GetAccService()->GetAccessibleFor(aDocNode, getter_AddRefs(docAccessible));
 -
 -  nsCOMPtr<nsIDocShellTreeNode> treeNode(do_QueryInterface(treeItem));
-+  nsIAccessible* docAccessible;
++  nsIAccessible* docAccessible = nsnull;
 +  GetAccService()->GetAccessibleFor(aDocNode, &docAccessible);
 +
 +  nsIDocShellTreeNode* treeNode(do_QueryInterface(treeItem));
    if (treeNode) {
      PRInt32 subDocuments;
      treeNode->GetChildCount(&subDocuments);
 @@ -393,16 +393,16 @@ void nsRootAccessible::TryFireEarlyLoadE
        return;
      }
    }
 -  nsCOMPtr<nsIDocShellTreeItem> rootContentTreeItem;
 -  treeItem->GetSameTypeRootTreeItem(getter_AddRefs(rootContentTreeItem));
-+  nsIDocShellTreeItem* rootContentTreeItem;
++  nsIDocShellTreeItem* rootContentTreeItem = nsnull;
 +  treeItem->GetSameTypeRootTreeItem(&rootContentTreeItem);
    NS_ASSERTION(rootContentTreeItem, "No root content tree item");
    if (!rootContentTreeItem) { // Not at root of content
      return;
    }
    if (rootContentTreeItem != treeItem) {
 -    nsCOMPtr<nsIAccessibleDocument> rootContentDocAccessible =
 +    nsIAccessibleDocument* rootContentDocAccessible =
@@ -6577,17 +6577,17 @@ diff --git a/accessible/src/base/nsRootA
        // For example, use the anonymous HTML:input instead of the containing
 @@ -436,9 +436,9 @@ PRBool nsRootAccessible::FireAccessibleF
        // This happens because when some bindings handle focus, they retarget
        // focus to the appropriate child inside of themselves, but DOM focus
        // stays outside on that binding parent.
 -      nsCOMPtr<nsIDOMEventTarget> domEventTarget;
 -      nsevent->GetOriginalTarget(getter_AddRefs(domEventTarget));
 -      nsCOMPtr<nsIDOMNode> realFocusedNode(do_QueryInterface(domEventTarget));
-+      nsIDOMEventTarget* domEventTarget;
++      nsIDOMEventTarget* domEventTarget = nsnull;
 +      nsevent->GetOriginalTarget(&domEventTarget);
 +      nsIDOMNode* realFocusedNode(do_QueryInterface(domEventTarget));
        if (!realFocusedNode) {
          // When FireCurrentFocusEvent() synthesizes a focus event,
          // the orignal target does not exist, so use the passed-in node
 @@ -452,24 +452,24 @@ PRBool nsRootAccessible::FireAccessibleF
    }
  
@@ -6598,24 +6598,24 @@ diff --git a/accessible/src/base/nsRootA
 +  nsIDOMNode* finalFocusNode = aNode;
 +  nsIAccessible* finalFocusAccessible = aAccessible;
 +  nsIContent* finalFocusContent  = do_QueryInterface(aNode);
    if (finalFocusContent) {
      nsAutoString id;
      if (nsAccUtils::GetAriaProperty(finalFocusContent, nsnull, eAria_activedescendant, id)) {
 -      nsCOMPtr<nsIDOMDocument> domDoc;
 -      aNode->GetOwnerDocument(getter_AddRefs(domDoc));
-+      nsIDOMDocument* domDoc;
++      nsIDOMDocument* domDoc = nsnull;
 +      aNode->GetOwnerDocument(&domDoc);
        if (!domDoc) {
          return PR_FALSE;
        }
 -      nsCOMPtr<nsIDOMElement> relatedEl;
 -      domDoc->GetElementById(id, getter_AddRefs(relatedEl));
-+      nsIDOMElement* relatedEl;
++      nsIDOMElement* relatedEl = nsnull;
 +      domDoc->GetElementById(id, &relatedEl);
        finalFocusNode = do_QueryInterface(relatedEl);
        if (!finalFocusNode) {
          return PR_FALSE;
        }
 -      GetAccService()->GetAccessibleFor(finalFocusNode, getter_AddRefs(finalFocusAccessible));      
 +      GetAccService()->GetAccessibleFor(finalFocusNode, &finalFocusAccessible);      
        // For activedescendant, the ARIA spec does not require that the user agent
@@ -6653,39 +6653,39 @@ diff --git a/accessible/src/base/nsRootA
      return; // No current focus
    }
  
    // Simulate a focus event so that we can reuse code that fires focus for container children like treeitems
 -  nsCOMPtr<nsIDOMDocumentEvent> docEvent = do_QueryInterface(mDocument);
 +  nsIDOMDocumentEvent* docEvent = do_QueryInterface(mDocument);
    if (docEvent) {
 -    nsCOMPtr<nsIDOMEvent> event;
-+    nsIDOMEvent* event;
++    nsIDOMEvent* event = nsnull;
      if (NS_SUCCEEDED(docEvent->CreateEvent(NS_LITERAL_STRING("Events"),
 -                                           getter_AddRefs(event))) &&
 +                                           &event)) &&
          NS_SUCCEEDED(event->InitEvent(NS_LITERAL_STRING("focus"), PR_TRUE, PR_TRUE))) {
        // Get the target node we really want for the event.
        nsIAccessibilityService* accService = GetAccService();
        if (accService) {
 -        nsCOMPtr<nsIDOMNode> targetNode;
-+        nsIDOMNode* targetNode;
++        nsIDOMNode* targetNode = nsnull;
          accService->GetRelevantContentNodeFor(focusedNode,
 -                                            getter_AddRefs(targetNode));
 +                                            &targetNode);
          if (targetNode) {
            HandleEventWithTarget(event, targetNode);
          }
 @@ -563,8 +563,8 @@ NS_IMETHODIMP nsRootAccessible::HandleEv
  {
    // Turn DOM events in accessibility events
    // Get info about event and target
 -  nsCOMPtr<nsIDOMNode> targetNode;
 -  GetTargetNode(aEvent, getter_AddRefs(targetNode));
-+  nsIDOMNode* targetNode;
++  nsIDOMNode* targetNode = nsnull;
 +  GetTargetNode(aEvent, &targetNode);
    if (!targetNode)
      return NS_ERROR_FAILURE;
    
 @@ -588,7 +588,7 @@ nsresult nsRootAccessible::HandleEventWi
    }
  #endif
  
@@ -6698,17 +6698,17 @@ diff --git a/accessible/src/base/nsRootA
      // so that we don't destroy something still in use, like wizard page. 
      // And we only get cached document accessible to destroy, so that we don't
      // create it just to destroy it.
 -    nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(eventShell));
 -    nsCOMPtr<nsIAccessible> accessible;
 -    accService->GetCachedAccessible(aTargetNode, weakShell, getter_AddRefs(accessible));
 -    nsCOMPtr<nsPIAccessibleDocument> privateAccDoc = do_QueryInterface(accessible);
 +    nsIWeakReference* weakShell(do_GetWeakReference(eventShell));
-+    nsIAccessible* accessible;
++    nsIAccessible* accessible = nsnull;
 +    accService->GetCachedAccessible(aTargetNode, weakShell, &accessible);
 +    nsPIAccessibleDocument* privateAccDoc = do_QueryInterface(accessible);
      if (privateAccDoc) {
        privateAccDoc->Destroy();
      }
 @@ -623,16 +623,16 @@ nsresult nsRootAccessible::HandleEventWi
  
    if (eventType.EqualsLiteral("TreeViewChanged")) { // Always asynch, always from user input
@@ -6716,17 +6716,17 @@ diff --git a/accessible/src/base/nsRootA
 -    nsCOMPtr<nsIContent> treeContent = do_QueryInterface(aTargetNode);
 +    nsIContent* treeContent = do_QueryInterface(aTargetNode);
      nsAccEvent::PrepareForEvent(aTargetNode, PR_TRUE);
      return accService->InvalidateSubtreeFor(eventShell, treeContent,
                                              nsIAccessibleEvent::EVENT_ASYNCH_SIGNIFICANT_CHANGE);
    }
  
 -  nsCOMPtr<nsIAccessible> accessible;
-+  nsIAccessible* accessible;
++  nsIAccessible* accessible = nsnull;
    accService->GetAccessibleInShell(aTargetNode, eventShell,
 -                                   getter_AddRefs(accessible));
 -  nsCOMPtr<nsPIAccessible> privAcc(do_QueryInterface(accessible));
 +                                   &accessible);
 +  nsPIAccessible* privAcc(do_QueryInterface(accessible));
    if (!privAcc)
      return NS_OK;
  
@@ -6748,17 +6748,17 @@ diff --git a/accessible/src/base/nsRootA
        new nsAccStateChangeEvent(accessible,
                                  nsIAccessibleStates::STATE_CHECKED,
                                  PR_FALSE, isEnabled);
 @@ -670,22 +670,22 @@ nsresult nsRootAccessible::HandleEventWi
      return privAcc->FireAccessibleEvent(accEvent);
    }
  
 -  nsCOMPtr<nsIAccessible> treeItemAccessible;
-+  nsIAccessible* treeItemAccessible;
++  nsIAccessible* treeItemAccessible = nsnull;
  #ifdef MOZ_XUL
    // If it's a tree element, need the currently selected item
    if (localName.EqualsLiteral("tree")) {
 -    nsCOMPtr<nsIDOMXULMultiSelectControlElement> multiSelect =
 +    nsIDOMXULMultiSelectControlElement* multiSelect =
        do_QueryInterface(aTargetNode);
      if (multiSelect) {
        PRInt32 treeIndex = -1;
@@ -6808,17 +6808,17 @@ diff --git a/accessible/src/base/nsRootA
 -        nsCOMPtr<nsIDOMXULMenuListElement> menuList =
 +        nsIDOMXULMenuListElement* menuList =
            do_QueryInterface(aTargetNode);
          if (!menuList) {
            // Don't do this for menu lists, the items only get focused
            // when the list is open, based on DOMMenuitemActive events
 -          nsCOMPtr<nsIDOMXULSelectControlItemElement> selectedItem;
 -          selectControl->GetSelectedItem(getter_AddRefs(selectedItem));
-+          nsIDOMXULSelectControlItemElement* selectedItem;
++          nsIDOMXULSelectControlItemElement* selectedItem = nsnull;
 +          selectControl->GetSelectedItem(&selectedItem);
            if (selectedItem)
              focusedItem = do_QueryInterface(selectedItem);
  
 @@ -765,7 +765,7 @@ nsresult nsRootAccessible::HandleEventWi
              return NS_OK;
  
            accService->GetAccessibleInShell(focusedItem, eventShell,
@@ -6828,17 +6828,17 @@ diff --git a/accessible/src/base/nsRootA
              return NS_OK;
          }
 @@ -810,8 +810,8 @@ nsresult nsRootAccessible::HandleEventWi
      }
      if (gLastFocusedNode != aTargetNode) {
        // Was not focused on popup
 -      nsCOMPtr<nsIDOMNode> parentOfFocus;
 -      gLastFocusedNode->GetParentNode(getter_AddRefs(parentOfFocus));
-+      nsIDOMNode* parentOfFocus;
++      nsIDOMNode* parentOfFocus = nsnull;
 +      gLastFocusedNode->GetParentNode(&parentOfFocus);
        if (parentOfFocus != aTargetNode) {
          return NS_OK;  // And was not focused on an item inside the popup
        }
 @@ -827,7 +827,7 @@ nsresult nsRootAccessible::HandleEventWi
    }
    else if (eventType.EqualsLiteral("DOMMenuItemActive")) {
      if (!treeItemAccessible) {
@@ -6848,17 +6848,17 @@ diff --git a/accessible/src/base/nsRootA
        nsIFrame* menuFrame = menuAccessNode->GetFrame();
        NS_ENSURE_TRUE(menuFrame, NS_ERROR_FAILURE);
 @@ -840,8 +840,8 @@ nsresult nsRootAccessible::HandleEventWi
          // is active.
          return NS_OK;
        } else {
 -        nsCOMPtr<nsIAccessible> containerAccessible;
 -        accessible->GetParent(getter_AddRefs(containerAccessible));
-+        nsIAccessible* containerAccessible;
++        nsIAccessible* containerAccessible = nsnull;
 +        accessible->GetParent(&containerAccessible);
          NS_ENSURE_TRUE(containerAccessible, NS_ERROR_FAILURE);
          // It is not top level menuitem
          // Only fire focus event if it is not inside collapsed popup
 @@ -871,14 +871,14 @@ void nsRootAccessible::GetTargetNode(nsI
  {
    *aTargetNode = nsnull;
  
@@ -6866,17 +6866,17 @@ diff --git a/accessible/src/base/nsRootA
 +  nsIDOMNSEvent* nsevent(do_QueryInterface(aEvent));
  
    if (!nsevent)
      return;
  
 -  nsCOMPtr<nsIDOMEventTarget> domEventTarget;
 -  nsevent->GetOriginalTarget(getter_AddRefs(domEventTarget));
 -  nsCOMPtr<nsIDOMNode> eventTarget(do_QueryInterface(domEventTarget));
-+  nsIDOMEventTarget* domEventTarget;
++  nsIDOMEventTarget* domEventTarget = nsnull;
 +  nsevent->GetOriginalTarget(&domEventTarget);
 +  nsIDOMNode* eventTarget(do_QueryInterface(domEventTarget));
    if (!eventTarget)
      return;
  
 @@ -906,7 +906,7 @@ nsRootAccessible::Init()
    nsresult rv = nsDocAccessibleWrap::Init();
    NS_ENSURE_SUCCESS(rv, rv);
@@ -6917,17 +6917,17 @@ diff --git a/accessible/src/base/nsRootA
      // don't use this one. This happens for example if it's inside
      // a background tab (tabbed browsing)
 @@ -955,23 +955,23 @@ nsRootAccessible::GetContentDocShell(nsI
        if (State(accessible) & nsIAccessibleStates::STATE_INVISIBLE) {
          return nsnull;
        }
 -      nsCOMPtr<nsIAccessible> ancestor;
 -      accessible->GetParent(getter_AddRefs(ancestor));
-+      nsIAccessible* ancestor;
++      nsIAccessible* ancestor = nsnull;
 +      accessible->GetParent(&ancestor);
        if (ancestor == this) {
          break; // Don't check past original root accessible we started with
        }
 -      accessible.swap(ancestor);
 +      swap(accessible, ancestor);
      }
  
@@ -6936,17 +6936,17 @@ diff --git a/accessible/src/base/nsRootA
 -  nsCOMPtr<nsIDocShellTreeNode> treeNode(do_QueryInterface(aStart));
 +  nsIDocShellTreeNode* treeNode(do_QueryInterface(aStart));
    if (treeNode) {
      PRInt32 subDocuments;
      treeNode->GetChildCount(&subDocuments);
      for (PRInt32 count = 0; count < subDocuments; count ++) {
 -      nsCOMPtr<nsIDocShellTreeItem> treeItemChild, contentTreeItem;
 -      treeNode->GetChildAt(count, getter_AddRefs(treeItemChild));
-+      nsIDocShellTreeItem* treeItemChild, *contentTreeItem;
++      nsIDocShellTreeItem* treeItemChild = nsnull, *contentTreeItem = nsnull;
 +      treeNode->GetChildAt(count, &treeItemChild);
        NS_ENSURE_TRUE(treeItemChild, nsnull);
        contentTreeItem = GetContentDocShell(treeItemChild);
        if (contentTreeItem) {
 @@ -992,12 +992,12 @@ NS_IMETHODIMP nsRootAccessible::GetAcces
      return nsDocAccessibleWrap::GetAccessibleRelated(aRelationType, aRelated);
    }
  
@@ -7014,17 +7014,17 @@ diff --git a/accessible/src/html/nsHTMLA
  
    nsIFrame *frame = GetFrame();
 @@ -136,8 +136,8 @@ NS_IMETHODIMP nsHTMLAreaAccessible::GetB
    nsresult rv = frame->QueryInterface(NS_GET_IID(nsIImageFrame), (void**)&imageFrame);
    NS_ENSURE_SUCCESS(rv, rv);
  
 -  nsCOMPtr<nsIImageMap> map;
 -  imageFrame->GetImageMap(presContext, getter_AddRefs(map));
-+  nsIImageMap* map;
++  nsIImageMap* map = nsnull;
 +  imageFrame->GetImageMap(presContext, &map);
    NS_ENSURE_TRUE(map, NS_ERROR_FAILURE);
  
    nsRect rect, orgRectPixels;
 diff --git a/accessible/src/html/nsHTMLFormControlAccessible.cpp b/accessible/src/html/nsHTMLFormControlAccessible.cpp
 --- a/accessible/src/html/nsHTMLFormControlAccessible.cpp
 +++ b/accessible/src/html/nsHTMLFormControlAccessible.cpp
 @@ -111,7 +111,7 @@ nsHTMLCheckboxAccessible::GetState(PRUin
@@ -7058,44 +7058,44 @@ diff --git a/accessible/src/html/nsHTMLF
    nsAutoString name;
    content->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::name, name);
  
 -  nsCOMPtr<nsIDOMNodeList> inputs;
 -
 -  nsCOMPtr<nsIDOMHTMLInputElement> radio(do_QueryInterface(mDOMNode));
 -  nsCOMPtr<nsIDOMHTMLFormElement> form;
 -  radio->GetForm(getter_AddRefs(form));
-+  nsIDOMNodeList* inputs;
++  nsIDOMNodeList* inputs = nsnull;
 +
 +  nsIDOMHTMLInputElement* radio(do_QueryInterface(mDOMNode));
-+  nsIDOMHTMLFormElement* form;
++  nsIDOMHTMLFormElement* form = nsnull;
 +  radio->GetForm(&form);
    if (form) {
 -    form->GetElementsByTagNameNS(nsURI, tagName, getter_AddRefs(inputs));
 +    form->GetElementsByTagNameNS(nsURI, tagName, &inputs);
    } else {
 -    nsCOMPtr<nsIDOMDocument> document;
 -    mDOMNode->GetOwnerDocument(getter_AddRefs(document));
-+    nsIDOMDocument* document;
++    nsIDOMDocument* document = nsnull;
 +    mDOMNode->GetOwnerDocument(&document);
      if (document)
 -      document->GetElementsByTagNameNS(nsURI, tagName, getter_AddRefs(inputs));
 +      document->GetElementsByTagNameNS(nsURI, tagName, &inputs);
    }
  
    NS_ENSURE_TRUE(inputs, NS_OK);
 @@ -194,10 +194,10 @@ nsHTMLRadioButtonAccessible::GetAttribut
    PRInt32 count = 0;
  
    for (PRUint32 index = 0; index < inputsCount; index++) {
 -    nsCOMPtr<nsIDOMNode> itemNode;
 -    inputs->Item(index, getter_AddRefs(itemNode));
 -
 -    nsCOMPtr<nsIContent> item(do_QueryInterface(itemNode));
-+    nsIDOMNode* itemNode;
++    nsIDOMNode* itemNode = nsnull;
 +    inputs->Item(index, &itemNode);
 +
 +    nsIContent* item(do_QueryInterface(itemNode));
      if (item &&
          item->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::type,
                            type, eCaseMatters) &&
 @@ -249,7 +249,7 @@ NS_IMETHODIMP
  NS_IMETHODIMP
@@ -7143,17 +7143,17 @@ diff --git a/accessible/src/html/nsHTMLF
      return NS_ERROR_FAILURE;
    }
 @@ -400,8 +400,8 @@ NS_IMETHODIMP nsHTMLTextFieldAccessible:
    // This means we're part of another control, so use parent accessible for name.
    // This ensures that a textbox inside of a XUL widget gets
    // an accessible name.
 -  nsCOMPtr<nsIAccessible> parent;
 -  rv = GetParent(getter_AddRefs(parent));
-+  nsIAccessible* parent;
++  nsIAccessible* parent = nsnull;
 +  rv = GetParent(&parent);
    return parent ? parent->GetName(aName) : rv;
  }
  
 @@ -412,12 +412,12 @@ NS_IMETHODIMP nsHTMLTextFieldAccessible:
    if (state & nsIAccessibleStates::STATE_PROTECTED)    // Don't return password text!
      return NS_ERROR_FAILURE;
  
@@ -7178,17 +7178,17 @@ diff --git a/accessible/src/html/nsHTMLF
  
    if (content->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::type,
 @@ -440,8 +440,8 @@ nsHTMLTextFieldAccessible::GetState(PRUi
      *aState |= nsIAccessibleStates::STATE_PROTECTED;
    }
    else {
 -    nsCOMPtr<nsIAccessible> parent;
 -    GetParent(getter_AddRefs(parent));
-+    nsIAccessible* parent;
++    nsIAccessible* parent = nsnull;
 +    GetParent(&parent);
      if (parent && Role(parent) == nsIAccessibleRole::ROLE_AUTOCOMPLETE) {
        *aState |= nsIAccessibleStates::STATE_HASPOPUP;
      }
 @@ -454,7 +454,7 @@ nsHTMLTextFieldAccessible::GetState(PRUi
    if (!aExtraState || !(*aExtraState & nsIAccessibleStates::EXT_STATE_EDITABLE))
      return NS_OK;
  
@@ -7208,17 +7208,17 @@ diff --git a/accessible/src/html/nsHTMLF
                                           kNameSpaceID_XUL) &&
 @@ -485,9 +485,9 @@ nsHTMLTextFieldAccessible::GetState(PRUi
                       autocomplete);
  
      if (!autocomplete.LowerCaseEqualsLiteral("off")) {
 -      nsCOMPtr<nsIDOMHTMLFormElement> form;
 -      htmlInput->GetForm(getter_AddRefs(form));
 -      nsCOMPtr<nsIContent> formContent(do_QueryInterface(form));
-+      nsIDOMHTMLFormElement* form;
++      nsIDOMHTMLFormElement* form = nsnull;
 +      htmlInput->GetForm(&form);
 +      nsIContent* formContent(do_QueryInterface(form));
        if (formContent) {
          formContent->GetAttr(kNameSpaceID_None,
                       nsAccessibilityAtoms::autocomplete, autocomplete);
 @@ -519,7 +519,7 @@ NS_IMETHODIMP nsHTMLTextFieldAccessible:
  NS_IMETHODIMP nsHTMLTextFieldAccessible::DoAction(PRUint8 index)
  {
@@ -7240,17 +7240,17 @@ diff --git a/accessible/src/html/nsHTMLF
    // Make sure we're not restricted by the permissions of
    // whatever script is currently running.
 -  nsCOMPtr<nsIJSContextStack> stack =
 +  nsIJSContextStack* stack =
      do_GetService("@mozilla.org/js/xpc/ContextStack;1");
    PRBool pushed = stack && NS_SUCCEEDED(stack->Push(nsnull));
  
 -  nsCOMPtr<nsIEditor> editor;
-+  nsIEditor* editor;
++  nsIEditor* editor = nsnull;
    nsresult rv = editableElt->GetEditor(aEditor);
  
    if (pushed) {
 @@ -572,7 +572,7 @@ NS_IMETHODIMP nsHTMLGroupboxAccessible::
  
  nsIContent* nsHTMLGroupboxAccessible::GetLegend()
  {
 -  nsCOMPtr<nsIContent> content = do_QueryInterface(mDOMNode);
@@ -7276,17 +7276,17 @@ diff --git a/accessible/src/html/nsHTMLF
      if (!content) {
        return NS_ERROR_FAILURE;  // Node already shut down
      }
 -    nsCOMPtr<nsIAccessible> groupboxAccessible = GetParent();
 +    nsIAccessible* groupboxAccessible = GetParent();
      if (groupboxAccessible &&
          Role(groupboxAccessible) == nsIAccessibleRole::ROLE_GROUPING) {
 -      nsCOMPtr<nsIAccessible> testLabelAccessible;
-+      nsIAccessible* testLabelAccessible;
++      nsIAccessible* testLabelAccessible = nsnull;
        groupboxAccessible->GetAccessibleRelated(nsIAccessibleRelation::RELATION_LABELLED_BY,
 -                                               getter_AddRefs(testLabelAccessible));
 +                                               &testLabelAccessible);
        if (testLabelAccessible == this) {
          // We're the first child of the parent groupbox
          *aRelated = groupboxAccessible;
 diff --git a/accessible/src/html/nsHTMLImageAccessible.cpp b/accessible/src/html/nsHTMLImageAccessible.cpp
 --- a/accessible/src/html/nsHTMLImageAccessible.cpp
@@ -7313,26 +7313,26 @@ diff --git a/accessible/src/html/nsHTMLI
        if (mapElementName.CharAt(0) == '#')
 @@ -95,16 +95,16 @@ nsHTMLImageAccessible::GetState(PRUint32
    nsresult rv = nsLinkableAccessible::GetState(aState, aExtraState);
    NS_ENSURE_SUCCESS(rv, rv);
  
 -  nsCOMPtr<nsIImageLoadingContent> content(do_QueryInterface(mDOMNode));
 -  nsCOMPtr<imgIRequest> imageRequest;
 +  nsIImageLoadingContent* content(do_QueryInterface(mDOMNode));
-+  imgIRequest* imageRequest;
++  imgIRequest* imageRequest = nsnull;
  
    if (content)
      content->GetRequest(nsIImageLoadingContent::CURRENT_REQUEST,
 -                        getter_AddRefs(imageRequest));
 -
 -  nsCOMPtr<imgIContainer> imgContainer;
 +                        &imageRequest);
 +
-+  imgIContainer* imgContainer;
++  imgIContainer* imgContainer = nsnull;
    if (imageRequest)
 -    imageRequest->GetImage(getter_AddRefs(imgContainer));
 +    imageRequest->GetImage(&imgContainer);
  
    if (imgContainer) {
      PRUint32 numFrames;
 @@ -120,7 +120,7 @@ nsHTMLImageAccessible::GetState(PRUint32
  /* wstring getName (); */
@@ -7351,30 +7351,30 @@ diff --git a/accessible/src/html/nsHTMLI
 +nsIAccessible*
  nsHTMLImageAccessible::GetAreaAccessible(PRInt32 aAreaNum)
  {
    if (!mMapElement)
      return nsnull;
  
 -  nsCOMPtr<nsIDOMHTMLCollection> mapAreas;
 -  mMapElement->GetAreas(getter_AddRefs(mapAreas));
-+  nsIDOMHTMLCollection* mapAreas;
++  nsIDOMHTMLCollection* mapAreas = nsnull;
 +  mMapElement->GetAreas(&mapAreas);
    if (!mapAreas)
      return nsnull;
  
 -  nsCOMPtr<nsIDOMNode> domNode;
 -  mapAreas->Item(aAreaNum,getter_AddRefs(domNode));
-+  nsIDOMNode* domNode;
++  nsIDOMNode* domNode = nsnull;
 +  mapAreas->Item(aAreaNum,&domNode);
    if (!domNode)
      return nsnull;
  
 -  nsCOMPtr<nsIAccessNode> accessNode;
-+  nsIAccessNode* accessNode;
++  nsIAccessNode* accessNode = nsnull;
    GetCacheEntry(*mAccessNodeCache, (void*)(aAreaNum),
 -                getter_AddRefs(accessNode));
 +                &accessNode);
  
    if (!accessNode) {
      accessNode = new nsHTMLAreaAccessible(domNode, this, mWeakShell);
      if (!accessNode)
        return nsnull;
@@ -7393,58 +7393,58 @@ diff --git a/accessible/src/html/nsHTMLI
    nsIAccessible *accPtr;
    accPtr = accessible;
    return accPtr;
 @@ -205,9 +205,9 @@ void nsHTMLImageAccessible::CacheChildre
      return;
    }
  
 -  nsCOMPtr<nsIDOMHTMLCollection> mapAreas;
-+  nsIDOMHTMLCollection* mapAreas;
++  nsIDOMHTMLCollection* mapAreas = nsnull;
    if (mMapElement) {
 -    mMapElement->GetAreas(getter_AddRefs(mapAreas));
 +    mMapElement->GetAreas(&mapAreas);
    }
    if (!mapAreas) {
      mAccChildCount = 0;
 @@ -218,8 +218,8 @@ void nsHTMLImageAccessible::CacheChildre
    mapAreas->GetLength(&numMapAreas);
    PRInt32 childCount = 0;
    
 -  nsCOMPtr<nsIAccessible> areaAccessible;
 -  nsCOMPtr<nsPIAccessible> privatePrevAccessible;
-+  nsIAccessible* areaAccessible;
-+  nsPIAccessible* privatePrevAccessible;
++  nsIAccessible* areaAccessible = nsnull;
++  nsPIAccessible* privatePrevAccessible = nsnull;
    while (childCount < (PRInt32)numMapAreas && 
           (areaAccessible = GetAreaAccessible(childCount)) != nsnull) {
      if (privatePrevAccessible) {
 @@ -242,21 +242,21 @@ NS_IMETHODIMP nsHTMLImageAccessible::DoA
  {
    if (index == eAction_ShowLongDescription) {
      //get the long description uri and open in a new window
 -    nsCOMPtr<nsIDOMHTMLImageElement> element(do_QueryInterface(mDOMNode));
 +    nsIDOMHTMLImageElement* element(do_QueryInterface(mDOMNode));
      NS_ENSURE_TRUE(element, NS_ERROR_FAILURE);
      nsAutoString longDesc;
      nsresult rv = element->GetLongDesc(longDesc);
      NS_ENSURE_SUCCESS(rv, rv);
 -    nsCOMPtr<nsIDOMDocument> domDocument;
 -    rv = mDOMNode->GetOwnerDocument(getter_AddRefs(domDocument));
-+    nsIDOMDocument* domDocument;
++    nsIDOMDocument* domDocument = nsnull;
 +    rv = mDOMNode->GetOwnerDocument(&domDocument);
      NS_ENSURE_SUCCESS(rv, rv);
 -    nsCOMPtr<nsIDocument> document(do_QueryInterface(domDocument));
 -    nsCOMPtr<nsPIDOMWindow> piWindow = document->GetWindow();
 -    nsCOMPtr<nsIDOMWindowInternal> win(do_QueryInterface(piWindow));
 +    nsIDocument* document(do_QueryInterface(domDocument));
 +    nsPIDOMWindow* piWindow = document->GetWindow();
 +    nsIDOMWindowInternal* win(do_QueryInterface(piWindow));
      NS_ENSURE_TRUE(win, NS_ERROR_FAILURE);
 -    nsCOMPtr<nsIDOMWindow> tmp;
-+    nsIDOMWindow* tmp;
++    nsIDOMWindow* tmp = nsnull;
      return win->Open(longDesc, NS_LITERAL_STRING(""), NS_LITERAL_STRING(""),
 -                     getter_AddRefs(tmp));
 +                     &tmp);
    }
    return nsLinkableAccessible::DoAction(index);
  }
 diff --git a/accessible/src/html/nsHTMLImageAccessible.h b/accessible/src/html/nsHTMLImageAccessible.h
 --- a/accessible/src/html/nsHTMLImageAccessible.h
@@ -7482,29 +7482,29 @@ diff --git a/accessible/src/html/nsHTMLS
    if (htmlSelect) {
      htmlSelect->GetOptions(getter_AddRefs(mOptions));
      if (mOptions)
 @@ -94,9 +94,9 @@ PRBool nsHTMLSelectableAccessible::itera
  PRBool nsHTMLSelectableAccessible::iterator::Advance() 
  {
    if (mIndex < mLength) {
 -    nsCOMPtr<nsIDOMNode> tempNode;
-+    nsIDOMNode* tempNode;
++    nsIDOMNode* tempNode = nsnull;
      if (mOptions) {
 -      mOptions->Item(mIndex, getter_AddRefs(tempNode));
 +      mOptions->Item(mIndex, &tempNode);
        mOption = do_QueryInterface(tempNode);
      }
      mIndex++;
 @@ -121,13 +121,13 @@ void nsHTMLSelectableAccessible::iterato
                                                                     nsPresContext *aContext)
  {
    PRBool isSelected = PR_FALSE;
 -  nsCOMPtr<nsIAccessible> tempAccess;
-+  nsIAccessible* tempAccess;
++  nsIAccessible* tempAccess = nsnull;
  
    if (mOption) {
      mOption->GetSelected(&isSelected);
      if (isSelected) {
 -      nsCOMPtr<nsIDOMNode> optionNode(do_QueryInterface(mOption));
 -      aAccService->GetAccessibleInWeakShell(optionNode, mWeakShell, getter_AddRefs(tempAccess));
 +      nsIDOMNode* optionNode(do_QueryInterface(mOption));
 +      aAccService->GetAccessibleInWeakShell(optionNode, mWeakShell, &tempAccess);
@@ -7526,25 +7526,25 @@ diff --git a/accessible/src/html/nsHTMLS
  
 -  nsCOMPtr<nsIDOMHTMLSelectElement> htmlSelect(do_QueryInterface(mDOMNode));
 +  nsIDOMHTMLSelectElement* htmlSelect(do_QueryInterface(mDOMNode));
    if (!htmlSelect)
      return NS_ERROR_FAILURE;
  
 -  nsCOMPtr<nsIDOMHTMLOptionsCollection> options;
 -  htmlSelect->GetOptions(getter_AddRefs(options));
-+  nsIDOMHTMLOptionsCollection* options;
++  nsIDOMHTMLOptionsCollection* options = nsnull;
 +  htmlSelect->GetOptions(&options);
    if (!options)
      return NS_ERROR_FAILURE;
  
 -  nsCOMPtr<nsIDOMNode> tempNode;
 -  options->Item(aIndex, getter_AddRefs(tempNode));
 -  nsCOMPtr<nsIDOMHTMLOptionElement> tempOption(do_QueryInterface(tempNode));
-+  nsIDOMNode* tempNode;
++  nsIDOMNode* tempNode = nsnull;
 +  options->Item(aIndex, &tempNode);
 +  nsIDOMHTMLOptionElement* tempOption(do_QueryInterface(tempNode));
    if (!tempOption)
      return NS_ERROR_FAILURE;
  
 @@ -207,11 +207,11 @@ NS_IMETHODIMP nsHTMLSelectableAccessible
  {
    *_retval = nsnull;
@@ -7599,17 +7599,17 @@ diff --git a/accessible/src/html/nsHTMLS
  {
 -  nsCOMPtr<nsIDOMNode> domNode(do_QueryInterface(aContent));
 +  nsIDOMNode* domNode(do_QueryInterface(aContent));
    NS_ASSERTION(domNode, "DOM node is null");
    // Accessibility service will initialize & cache any accessibles created
 -  nsCOMPtr<nsIAccessible> accessible;
 -  aAccService->GetAccessibleInWeakShell(domNode, mWeakShell, getter_AddRefs(accessible));
 -  nsCOMPtr<nsPIAccessible> privateAccessible(do_QueryInterface(accessible));
-+  nsIAccessible* accessible;
++  nsIAccessible* accessible = nsnull;
 +  aAccService->GetAccessibleInWeakShell(domNode, mWeakShell, &accessible);
 +  nsPIAccessible* privateAccessible(do_QueryInterface(accessible));
    if (!privateAccessible) {
      return nsnull;
    }
  
    ++ *aChildCount;
    privateAccessible->SetParent(this);
@@ -7629,17 +7629,17 @@ diff --git a/accessible/src/html/nsHTMLS
                                               nsIAccessible *aLastGoodAccessible,
 @@ -391,15 +391,15 @@ nsHTMLSelectListAccessible::CacheOptSibl
    // Recursive helper for CacheChildren()
  
    PRUint32 numChildren = aParentContent->GetChildCount();
 -  nsCOMPtr<nsIAccessible> lastGoodAccessible(aLastGoodAccessible);
 -  nsCOMPtr<nsIAccessible> newAccessible;
 +  nsIAccessible* lastGoodAccessible(aLastGoodAccessible);
-+  nsIAccessible* newAccessible;
++  nsIAccessible* newAccessible = nsnull;
  
    for (PRUint32 count = 0; count < numChildren; count ++) {
      nsIContent *childContent = aParentContent->GetChildAt(count);
      if (!childContent->IsNodeOfType(nsINode::eHTML)) {
        continue;
      }
 -    nsCOMPtr<nsIAtom> tag = childContent->Tag();
 +    nsIAtom* tag = childContent->Tag();
@@ -7678,19 +7678,19 @@ diff --git a/accessible/src/html/nsHTMLS
  nsHTMLSelectOptionAccessible::nsHTMLSelectOptionAccessible(nsIDOMNode* aDOMNode, nsIWeakReference* aShell):
  nsHyperTextAccessibleWrap(aDOMNode, aShell)
  {
 -  nsCOMPtr<nsIAccessibilityService> accService(do_GetService("@mozilla.org/accessibilityService;1"));
 -  nsCOMPtr<nsIDOMNode> parentNode;
 -  aDOMNode->GetParentNode(getter_AddRefs(parentNode));
 -  nsCOMPtr<nsIAccessible> parentAccessible;
 +  nsIAccessibilityService* accService(do_GetService("@mozilla.org/accessibilityService;1"));
-+  nsIDOMNode* parentNode;
++  nsIDOMNode* parentNode = nsnull;
 +  aDOMNode->GetParentNode(&parentNode);
-+  nsIAccessible* parentAccessible;
++  nsIAccessible* parentAccessible = nsnull;
    if (parentNode) {
      // If the parent node is a Combobox, then the option's accessible parent
      // is nsHTMLComboboxListAccessible, not the nsHTMLComboboxAccessible that
      // GetParent would normally return. This is because the 
      // nsHTMLComboboxListAccessible is inserted into the accessible hierarchy
      // where there is no DOM node for it.
 -    accService->GetAccessibleInWeakShell(parentNode, mWeakShell, getter_AddRefs(parentAccessible));
 +    accService->GetAccessibleInWeakShell(parentNode, mWeakShell, &parentAccessible);
@@ -7715,53 +7715,53 @@ diff --git a/accessible/src/html/nsHTMLS
      return NS_ERROR_FAILURE;
  
 @@ -509,11 +509,11 @@ NS_IMETHODIMP nsHTMLSelectOptionAccessib
    
    // CASE #2 -- no label parameter, get the first child, 
    // use it if it is a text node
 -  nsCOMPtr<nsIDOMNode> child;
 -  mDOMNode->GetFirstChild(getter_AddRefs(child));
-+  nsIDOMNode* child;
++  nsIDOMNode* child = nsnull;
 +  mDOMNode->GetFirstChild(&child);
  
    if (child) {
 -    nsCOMPtr<nsIContent> text = do_QueryInterface(child);
 +    nsIContent* text = do_QueryInterface(child);
      if (text && text->IsNodeOfType(nsINode::eTEXT)) {
        nsAutoString txtValue;
        rv = AppendFlatStringFromContentNode(text, &txtValue);
 @@ -541,9 +541,9 @@ nsHTMLSelectOptionAccessible::GetAttribu
    nsresult rv = nsHyperTextAccessibleWrap::GetAttributesInternal(aAttributes);
    NS_ENSURE_SUCCESS(rv, rv);
  
 -  nsCOMPtr<nsIDOMNode> parentNode;
 -  mDOMNode->GetParentNode(getter_AddRefs(parentNode));
 -  nsCOMPtr<nsIDOMElement> parentElement(do_QueryInterface(parentNode));
-+  nsIDOMNode* parentNode;
++  nsIDOMNode* parentNode = nsnull;
 +  mDOMNode->GetParentNode(&parentNode);
 +  nsIDOMElement* parentElement(do_QueryInterface(parentNode));
    NS_ENSURE_TRUE(parentElement, NS_ERROR_FAILURE);
    nsAutoString parentTagName;
    parentNode->GetLocalName(parentTagName);
 @@ -555,14 +555,14 @@ nsHTMLSelectOptionAccessible::GetAttribu
  
    nsAutoString tagName;
    mDOMNode->GetLocalName(tagName);  // Will be looking for similar DOM siblings
 -  nsCOMPtr<nsIDOMNodeList> siblings;
 -  parentElement->GetElementsByTagName(tagName, getter_AddRefs(siblings));
-+  nsIDOMNodeList* siblings;
++  nsIDOMNodeList* siblings = nsnull;
 +  parentElement->GetElementsByTagName(tagName, &siblings);
    PRInt32 posInSet = 0;
    PRUint32 setSize = 0;
    if (siblings) {
      siblings->GetLength(&setSize);
 -    nsCOMPtr<nsIDOMNode> itemNode;
 -    while (NS_SUCCEEDED(siblings->Item(posInSet ++, getter_AddRefs(itemNode))) &&
-+    nsIDOMNode* itemNode;
++    nsIDOMNode* itemNode = nsnull;
 +    while (NS_SUCCEEDED(siblings->Item(posInSet ++, &itemNode)) &&
             itemNode != mDOMNode) {
        // Keep looping, to increment posInSet
      }
 @@ -576,9 +576,9 @@ nsIFrame* nsHTMLSelectOptionAccessible::
  nsIFrame* nsHTMLSelectOptionAccessible::GetBoundsFrame()
  {
    PRUint32 state;
@@ -7814,17 +7814,17 @@ diff --git a/accessible/src/html/nsHTMLS
 -    nsCOMPtr<nsIDOMHTMLOptionElement> newHTMLOption(do_QueryInterface(mDOMNode));
 +    nsIDOMHTMLOptionElement* newHTMLOption(do_QueryInterface(mDOMNode));
      if (!newHTMLOption) 
        return NS_ERROR_FAILURE;
      // Clear old selection
 -    nsCOMPtr<nsIDOMNode> oldHTMLOptionNode, selectNode;
 -    nsCOMPtr<nsIAccessible> parent(GetParent());
 -    nsCOMPtr<nsIAccessNode> accessNode(do_QueryInterface(parent));
-+    nsIDOMNode* oldHTMLOptionNode, *selectNode;
++    nsIDOMNode* oldHTMLOptionNode = nsnull, *selectNode = nsnull;
 +    nsIAccessible* parent(GetParent());
 +    nsIAccessNode* accessNode(do_QueryInterface(parent));
      NS_ASSERTION(accessNode, "Unable to QI to nsIAccessNode");
 -    accessNode->GetDOMNode(getter_AddRefs(selectNode));
 -    GetFocusedOptionNode(selectNode, getter_AddRefs(oldHTMLOptionNode));
 -    nsCOMPtr<nsIDOMHTMLOptionElement> oldHTMLOption(do_QueryInterface(oldHTMLOptionNode));
 +    accessNode->GetDOMNode(&selectNode);
 +    GetFocusedOptionNode(selectNode, &oldHTMLOptionNode);
@@ -7833,17 +7833,17 @@ diff --git a/accessible/src/html/nsHTMLS
        oldHTMLOption->SetSelected(PR_FALSE);
      // Set new selection
 @@ -706,19 +706,19 @@ NS_IMETHODIMP nsHTMLSelectOptionAccessib
  
      // If combo box, and open, close it
      // First, get the <select> widgets list control frame
 -    nsCOMPtr<nsIDOMNode> testSelectNode;
 -    nsCOMPtr<nsIDOMNode> thisNode(do_QueryInterface(mDOMNode));
-+    nsIDOMNode* testSelectNode;
++    nsIDOMNode* testSelectNode = nsnull;
 +    nsIDOMNode* thisNode(do_QueryInterface(mDOMNode));
      do {
 -      thisNode->GetParentNode(getter_AddRefs(testSelectNode));
 -      nsCOMPtr<nsIDOMHTMLSelectElement> selectControl(do_QueryInterface(testSelectNode));
 +      thisNode->GetParentNode(&testSelectNode);
 +      nsIDOMHTMLSelectElement* selectControl(do_QueryInterface(testSelectNode));
        if (selectControl)
          break;
@@ -7875,17 +7875,17 @@ diff --git a/accessible/src/html/nsHTMLS
  
    // Get options
 -  nsCOMPtr<nsIDOMHTMLSelectElement> selectElement(do_QueryInterface(aListNode));
 +  nsIDOMHTMLSelectElement* selectElement(do_QueryInterface(aListNode));
    NS_ASSERTION(selectElement, "No select element where it should be");
  
 -  nsCOMPtr<nsIDOMHTMLOptionsCollection> options;
 -  nsresult rv = selectElement->GetOptions(getter_AddRefs(options));
-+  nsIDOMHTMLOptionsCollection* options;
++  nsIDOMHTMLOptionsCollection* options = nsnull;
 +  nsresult rv = selectElement->GetOptions(&options);
    
    if (NS_SUCCEEDED(rv)) {
      nsIListControlFrame *listFrame = nsnull;
 @@ -806,19 +806,19 @@ void nsHTMLSelectOptionAccessible::Selec
      return;
    }
  
@@ -7901,17 +7901,17 @@ diff --git a/accessible/src/html/nsHTMLS
      return;
    }
  
 -  nsCOMPtr<nsIAccessibilityService> accService = 
 +  nsIAccessibilityService* accService = 
      do_GetService("@mozilla.org/accessibilityService;1");
 -  nsCOMPtr<nsIAccessible> optionAccessible;
 -  accService->GetAccessibleFor(optionNode, getter_AddRefs(optionAccessible));
-+  nsIAccessible* optionAccessible;
++  nsIAccessible* optionAccessible = nsnull;
 +  accService->GetAccessibleFor(optionNode, &optionAccessible);
    if (!optionAccessible) {
      return;
    }
 @@ -841,17 +841,17 @@ nsIContent* nsHTMLSelectOptionAccessible
  nsIContent* nsHTMLSelectOptionAccessible::GetSelectState(PRUint32* aState,
                                                           PRUint32* aExtraState)
  {
@@ -7924,17 +7924,17 @@ diff --git a/accessible/src/html/nsHTMLS
 -  nsCOMPtr<nsIDOMNode> selectNode(do_QueryInterface(content));
 +  nsIDOMNode* selectNode(do_QueryInterface(content));
    if (selectNode) {
 -    nsCOMPtr<nsIAccessibilityService> accService = GetAccService();
 +    nsIAccessibilityService* accService = GetAccService();
      if (accService) {
 -      nsCOMPtr<nsIAccessible> selAcc;
 -      accService->GetAccessibleFor(selectNode, getter_AddRefs(selAcc));
-+      nsIAccessible* selAcc;
++      nsIAccessible* selAcc = nsnull;
 +      accService->GetAccessibleFor(selectNode, &selAcc);
        if (selAcc) {
          selAcc->GetFinalState(aState, aExtraState);
          return content;
 @@ -1067,18 +1067,18 @@ NS_IMETHODIMP nsHTMLComboboxAccessible::
      return NS_OK;
    }
    // Use description of currently focused option
@@ -7947,17 +7947,17 @@ diff --git a/accessible/src/html/nsHTMLS
 +nsIAccessible*
  nsHTMLComboboxAccessible::GetFocusedOptionAccessible()
  {
    if (!mWeakShell) {
      return nsnull;  // Shut down
    }
 -  nsCOMPtr<nsIDOMNode> focusedOptionNode;
 -  nsHTMLSelectOptionAccessible::GetFocusedOptionNode(mDOMNode, getter_AddRefs(focusedOptionNode));
-+  nsIDOMNode* focusedOptionNode;
++  nsIDOMNode* focusedOptionNode = nsnull;
 +  nsHTMLSelectOptionAccessible::GetFocusedOptionNode(mDOMNode, &focusedOptionNode);
    nsIAccessibilityService *accService = GetAccService();
    if (!focusedOptionNode || !accService) {
      return nsnull;
 @@ -1098,7 +1098,7 @@ NS_IMETHODIMP nsHTMLComboboxAccessible::
  NS_IMETHODIMP nsHTMLComboboxAccessible::GetValue(nsAString& aValue)
  {
    // Use label of currently focused option
@@ -7967,28 +7967,28 @@ diff --git a/accessible/src/html/nsHTMLS
    return optionAccessible->GetName(aValue);
  }
 @@ -1446,8 +1446,8 @@ void nsHTMLComboboxListAccessible::GetBo
  {
    *aBoundingFrame = nsnull;
  
 -  nsCOMPtr<nsIAccessible> comboAccessible;
 -  GetParent(getter_AddRefs(comboAccessible));
-+  nsIAccessible* comboAccessible;
++  nsIAccessible* comboAccessible = nsnull;
 +  GetParent(&comboAccessible);
    if (!comboAccessible) {
      return;
    }
 @@ -1456,16 +1456,16 @@ void nsHTMLComboboxListAccessible::GetBo
      return;
    }
     // get our first option
 -  nsCOMPtr<nsIDOMNode> child;
 -  mDOMNode->GetFirstChild(getter_AddRefs(child));
-+  nsIDOMNode* child;
++  nsIDOMNode* child = nsnull;
 +  mDOMNode->GetFirstChild(&child);
  
    // now get its frame
 -  nsCOMPtr<nsIPresShell> shell = GetPresShell();
 +  nsIPresShell* shell = GetPresShell();
    if (!shell) {
      return;
    }
@@ -8028,37 +8028,37 @@ diff --git a/accessible/src/html/nsHTMLS
 diff --git a/accessible/src/html/nsHTMLTableAccessible.cpp b/accessible/src/html/nsHTMLTableAccessible.cpp
 --- a/accessible/src/html/nsHTMLTableAccessible.cpp
 +++ b/accessible/src/html/nsHTMLTableAccessible.cpp
 @@ -103,24 +103,24 @@ void nsHTMLTableAccessible::CacheChildre
    
    if (mAccChildCount == eChildCountUninitialized) {
      nsAccessible::CacheChildren();
 -    nsCOMPtr<nsIAccessible> captionAccessible;
-+    nsIAccessible* captionAccessible;
++    nsIAccessible* captionAccessible = nsnull;
      while (NextChild(captionAccessible)) {
        if (Role(captionAccessible) == nsIAccessibleRole::ROLE_CAPTION) {
 -        nsCOMPtr<nsIAccessible> captionParentAccessible;
 -        captionAccessible->GetParent(getter_AddRefs(captionParentAccessible));
-+        nsIAccessible* captionParentAccessible;
++        nsIAccessible* captionParentAccessible = nsnull;
 +        captionAccessible->GetParent(&captionParentAccessible);
          if (captionParentAccessible != this) {
            NS_WARNING("Should not happen: parser ensures caption is the table's child, not the tbody's");
            return;
          }
 -        nsCOMPtr<nsIAccessible> beforeCaptionAccessible;
 -        captionAccessible->GetPreviousSibling(getter_AddRefs(beforeCaptionAccessible));
-+        nsIAccessible* beforeCaptionAccessible;
++        nsIAccessible* beforeCaptionAccessible = nsnull;
 +        captionAccessible->GetPreviousSibling(&beforeCaptionAccessible);
          if (beforeCaptionAccessible) {
            // Move caption accessible so that it's the first child
 -          nsCOMPtr<nsIAccessible> afterCaptionAccessible;
 -          captionAccessible->GetNextSibling(getter_AddRefs(afterCaptionAccessible));
 -          nsCOMPtr<nsPIAccessible> privateAcc = do_QueryInterface(beforeCaptionAccessible);
-+          nsIAccessible* afterCaptionAccessible;
++          nsIAccessible* afterCaptionAccessible = nsnull;
 +          captionAccessible->GetNextSibling(&afterCaptionAccessible);
 +          nsPIAccessible* privateAcc = do_QueryInterface(beforeCaptionAccessible);
            privateAcc->SetNextSibling(afterCaptionAccessible);
 -          GetFirstChild(getter_AddRefs(afterCaptionAccessible));
 +          GetFirstChild(&afterCaptionAccessible);
            SetFirstChild(captionAccessible);
            privateAcc = do_QueryInterface(captionAccessible);
            privateAcc->SetNextSibling(afterCaptionAccessible);        
@@ -8072,17 +8072,17 @@ diff --git a/accessible/src/html/nsHTMLT
        content->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::summary, aName);
      }
 @@ -217,8 +217,8 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  nsHTMLTableAccessible::GetCaption(nsIAccessible **aCaption)
  {
 -  nsCOMPtr<nsIAccessible> firstChild;
 -  GetFirstChild(getter_AddRefs(firstChild));
-+  nsIAccessible* firstChild;
++  nsIAccessible* firstChild = nsnull;
 +  GetFirstChild(&firstChild);
    if (firstChild && Role(firstChild) == nsIAccessibleRole::ROLE_CAPTION) {
      *aCaption = firstChild;
    }
 @@ -228,7 +228,7 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  nsHTMLTableAccessible::GetSummary(nsAString &aSummary)
  {
@@ -8099,27 +8099,27 @@ diff --git a/accessible/src/html/nsHTMLT
 +  nsIDOMHTMLTableElement* table(do_QueryInterface(mDOMNode));
    NS_ENSURE_TRUE(table, NS_ERROR_FAILURE);
  
 -  nsCOMPtr<nsIDOMHTMLTableSectionElement> section;
 -  rv = table->GetTHead(getter_AddRefs(section));
 -  NS_ENSURE_SUCCESS(rv, rv);
 -
 -  nsCOMPtr<nsIAccessibilityService>
-+  nsIDOMHTMLTableSectionElement* section;
++  nsIDOMHTMLTableSectionElement* section = nsnull;
 +  rv = table->GetTHead(&section);
 +  NS_ENSURE_SUCCESS(rv, rv);
 +
 +  nsIAccessibilityService*
      accService(do_GetService("@mozilla.org/accessibilityService;1"));
    NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
  
 -  nsCOMPtr<nsIAccessible> accHead;
 -  nsCOMPtr<nsIDOMNode> sectionNode(do_QueryInterface(section));
-+  nsIAccessible* accHead;
++  nsIAccessible* accHead = nsnull;
 +  nsIDOMNode* sectionNode(do_QueryInterface(section));
    if (sectionNode) {
      rv = accService->GetCachedAccessible(sectionNode, mWeakShell,
 -                                         getter_AddRefs(accHead));
 +                                         &accHead);
      NS_ENSURE_SUCCESS(rv, rv);
    }
  
@@ -8144,17 +8144,17 @@ diff --git a/accessible/src/html/nsHTMLT
  {
    nsresult rv = NS_OK;
  
 -  nsCOMPtr<nsIDOMElement> cellElement;
 -  rv = GetCellAt(aRow, aColumn, *getter_AddRefs(cellElement));
 -  NS_ENSURE_SUCCESS(rv, rv);
 -
 -  nsCOMPtr<nsIAccessibilityService>
-+  nsIDOMElement* cellElement;
++  nsIDOMElement* cellElement = nsnull;
 +  rv = GetCellAt(aRow, aColumn, *&cellElement);
 +  NS_ENSURE_SUCCESS(rv, rv);
 +
 +  nsIAccessibilityService*
      accService(do_GetService("@mozilla.org/accessibilityService;1"));
    NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
  
 @@ -542,12 +542,12 @@ nsHTMLTableAccessible::GetIndexAt(PRInt3
@@ -8162,49 +8162,49 @@ diff --git a/accessible/src/html/nsHTMLT
  
    nsresult rv = NS_OK;
 -  nsCOMPtr<nsIDOMElement> domElement;
 -  rv = GetCellAt(aRow, aColumn, *getter_AddRefs(domElement));
 -  NS_ENSURE_SUCCESS(rv, rv);
 -
 -  nsCOMPtr<nsIAccessible> accessible;
 -  GetAccService()->GetCachedAccessible(domElement, mWeakShell, getter_AddRefs(accessible));
-+  nsIDOMElement* domElement;
++  nsIDOMElement* domElement = nsnull;
 +  rv = GetCellAt(aRow, aColumn, *&domElement);
 +  NS_ENSURE_SUCCESS(rv, rv);
 +
-+  nsIAccessible* accessible;
++  nsIAccessible* accessible = nsnull;
 +  GetAccService()->GetCachedAccessible(domElement, mWeakShell, &accessible);
    if (accessible) {
      rv = accessible->GetIndexInParent(aIndex);
    } else {
 @@ -562,11 +562,11 @@ nsHTMLTableAccessible::GetColumnAtIndex(
  {
    NS_ENSURE_ARG_POINTER(aColumn);
  
 -  nsCOMPtr<nsIAccessible> child;
 -  GetChildAt(aIndex, getter_AddRefs(child));
 -  nsCOMPtr<nsPIAccessNode> childNode(do_QueryInterface(child));
-+  nsIAccessible* child;
++  nsIAccessible* child = nsnull;
 +  GetChildAt(aIndex, &child);
 +  nsPIAccessNode* childNode(do_QueryInterface(child));
    nsIFrame* frame = childNode->GetFrame();
 -  nsCOMPtr<nsITableCellLayout> cellLayout(do_QueryInterface(frame));
 +  nsITableCellLayout* cellLayout(do_QueryInterface(frame));
    NS_ENSURE_TRUE(cellLayout, NS_ERROR_FAILURE);
    return cellLayout->GetColIndex(*aColumn);
  }
 @@ -576,11 +576,11 @@ nsHTMLTableAccessible::GetRowAtIndex(PRI
  {
    NS_ENSURE_ARG_POINTER(aRow);
  
 -  nsCOMPtr<nsIAccessible> child;
 -  GetChildAt(aIndex, getter_AddRefs(child));
 -  nsCOMPtr<nsPIAccessNode> childNode(do_QueryInterface(child));
-+  nsIAccessible* child;
++  nsIAccessible* child = nsnull;
 +  GetChildAt(aIndex, &child);
 +  nsPIAccessNode* childNode(do_QueryInterface(child));
    nsIFrame* frame = childNode->GetFrame();
 -  nsCOMPtr<nsITableCellLayout> cellLayout(do_QueryInterface(frame));
 +  nsITableCellLayout* cellLayout(do_QueryInterface(frame));
    NS_ENSURE_TRUE(cellLayout, NS_ERROR_FAILURE);
    return cellLayout->GetRowIndex(*aRow);
  }
@@ -8212,47 +8212,47 @@ diff --git a/accessible/src/html/nsHTMLT
  {
    nsresult rv = NS_OK;
  
 -  nsCOMPtr<nsIDOMElement> domElement;
 -  rv = GetCellAt(aRow, aColumn, *getter_AddRefs(domElement));
 -  NS_ENSURE_SUCCESS(rv, rv);
 -
 -  nsCOMPtr<nsIDOMHTMLTableCellElement> cell(do_QueryInterface(domElement));
-+  nsIDOMElement* domElement;
++  nsIDOMElement* domElement = nsnull;
 +  rv = GetCellAt(aRow, aColumn, *&domElement);
 +  NS_ENSURE_SUCCESS(rv, rv);
 +
 +  nsIDOMHTMLTableCellElement* cell(do_QueryInterface(domElement));
    NS_ENSURE_TRUE(cell, NS_ERROR_FAILURE);
  
    return cell->GetColSpan(_retval);
 @@ -607,11 +607,11 @@ nsHTMLTableAccessible::GetRowExtentAt(PR
  {
    nsresult rv = NS_OK;
  
 -  nsCOMPtr<nsIDOMElement> domElement;
 -  rv = GetCellAt(aRow, aColumn, *getter_AddRefs(domElement));
 -  NS_ENSURE_SUCCESS(rv, rv);
 -
 -  nsCOMPtr<nsIDOMHTMLTableCellElement> cell(do_QueryInterface(domElement));
-+  nsIDOMElement* domElement;
++  nsIDOMElement* domElement = nsnull;
 +  rv = GetCellAt(aRow, aColumn, *&domElement);
 +  NS_ENSURE_SUCCESS(rv, rv);
 +
 +  nsIDOMHTMLTableCellElement* cell(do_QueryInterface(domElement));
    NS_ENSURE_TRUE(cell, NS_ERROR_FAILURE);
  
    return cell->GetRowSpan(_retval);
 @@ -681,12 +681,12 @@ nsHTMLTableAccessible::IsCellSelected(PR
    nsresult rv = GetTableLayout(&tableLayout);
    NS_ENSURE_SUCCESS(rv, rv);
  
 -  nsCOMPtr<nsIDOMElement> domElement;
-+  nsIDOMElement* domElement;
++  nsIDOMElement* domElement = nsnull;
    PRInt32 startRowIndex = 0, startColIndex = 0,
            rowSpan, colSpan, actualRowSpan, actualColSpan;
  
    return tableLayout->GetCellDataAt(aRow, aColumn,
 -                                    *getter_AddRefs(domElement),
 +                                    *&domElement,
                                      startRowIndex, startColIndex, rowSpan,
                                      colSpan, actualRowSpan, actualColSpan,
@@ -8271,29 +8271,29 @@ diff --git a/accessible/src/html/nsHTMLT
    NS_ENSURE_STATE(document);
  
 -  nsCOMPtr<nsISelectionController> selController(
 +  nsISelectionController* selController(
      do_QueryInterface(document->GetPrimaryShell()));
    NS_ENSURE_STATE(selController);
  
 -  nsCOMPtr<nsISelection> selection;
-+  nsISelection* selection;
++  nsISelection* selection = nsnull;
    selController->GetSelection(nsISelectionController::SELECTION_NORMAL,
 -                              getter_AddRefs(selection));
 +                              &selection);
    NS_ENSURE_STATE(selection);
  
    PRInt32 count = 0;
 @@ -747,11 +747,11 @@ nsHTMLTableAccessible::SelectRowOrColumn
    NS_ENSURE_SUCCESS(rv, rv);
  
    for (PRInt32 index = 0; index < count; index++) {
 -    nsCOMPtr<nsIDOMElement> cellElm;
-+    nsIDOMElement* cellElm;
++    nsIDOMElement* cellElm = nsnull;
      PRInt32 column = doSelectRow ? index : aIndex;
      PRInt32 row = doSelectRow ? aIndex : index;
  
 -    rv = GetCellAt(row, column, *getter_AddRefs(cellElm));
 +    rv = GetCellAt(row, column, *&cellElm);
      NS_ENSURE_SUCCESS(rv, rv);
  
      rv = SelectCell(selection, document, cellElm, aDoSelect);
@@ -8304,17 +8304,17 @@ diff --git a/accessible/src/html/nsHTMLT
 -    nsCOMPtr<nsIDOMDocumentRange> documentRange(do_QueryInterface(aDocument));
 +    nsIDOMDocumentRange* documentRange(do_QueryInterface(aDocument));
      NS_ENSURE_STATE(documentRange);
  
 -    nsCOMPtr<nsIDOMRange> range;
 -    documentRange->CreateRange(getter_AddRefs(range));
 -
 -    nsCOMPtr<nsIDOMNode> cellNode(do_QueryInterface(aCellElement));
-+    nsIDOMRange* range;
++    nsIDOMRange* range = nsnull;
 +    documentRange->CreateRange(&range);
 +
 +    nsIDOMNode* cellNode(do_QueryInterface(aCellElement));
      NS_ENSURE_STATE(cellNode);
  
      range->SelectNode(cellNode);
      return aSelection->AddRange(range);
    }
@@ -8350,89 +8350,89 @@ diff --git a/accessible/src/html/nsHTMLT
      return rv;
    }
  
 -  nsCOMPtr<nsIDOMHTMLTableSectionElement> section(do_QueryInterface(mDOMNode));
 +  nsIDOMHTMLTableSectionElement* section(do_QueryInterface(mDOMNode));
    if (section) {
 -    nsCOMPtr<nsIDOMNode> parent;
 -    rv = section->GetParentNode(getter_AddRefs(parent));
-+    nsIDOMNode* parent;
++    nsIDOMNode* parent = nsnull;
 +    rv = section->GetParentNode(&parent);
      NS_ENSURE_SUCCESS(rv, rv);
  
      *_retval = parent;
 @@ -839,17 +839,17 @@ nsHTMLTableAccessible::GetTableLayout(ns
  
    nsresult rv = NS_OK;
  
 -  nsCOMPtr<nsIDOMNode> tableNode;
 -  rv = GetTableNode(getter_AddRefs(tableNode));
 -  NS_ENSURE_SUCCESS(rv, rv);
 -
 -  nsCOMPtr<nsIContent> content(do_QueryInterface(tableNode));
-+  nsIDOMNode* tableNode;
++  nsIDOMNode* tableNode = nsnull;
 +  rv = GetTableNode(&tableNode);
 +  NS_ENSURE_SUCCESS(rv, rv);
 +
 +  nsIContent* content(do_QueryInterface(tableNode));
    NS_ENSURE_TRUE(content, NS_ERROR_FAILURE);
  
    nsIPresShell *presShell = content->GetDocument()->GetPrimaryShell();
  
 -  nsCOMPtr<nsISupports> layoutObject;
 -  rv = presShell->GetLayoutObjectFor(content, getter_AddRefs(layoutObject));
-+  nsISupports* layoutObject;
++  nsISupports* layoutObject = nsnull;
 +  rv = presShell->GetLayoutObjectFor(content, &layoutObject);
    NS_ENSURE_SUCCESS(rv, rv);
  
    return CallQueryInterface(layoutObject, aLayoutObject);
 @@ -884,13 +884,13 @@ NS_IMETHODIMP nsHTMLTableAccessible::Get
      return NS_OK;
    }
  
 -  nsCOMPtr<nsIAccessible> captionAccessible;
 -  GetCaption(getter_AddRefs(captionAccessible));
 -  nsCOMPtr<nsIAccessNode> captionAccessNode = do_QueryInterface(captionAccessible);
-+  nsIAccessible* captionAccessible;
++  nsIAccessible* captionAccessible = nsnull;
 +  GetCaption(&captionAccessible);
 +  nsIAccessNode* captionAccessNode = do_QueryInterface(captionAccessible);
    if (captionAccessNode) {
 -    nsCOMPtr<nsIDOMNode> captionNode;
 -    captionAccessNode->GetDOMNode(getter_AddRefs(captionNode));
 -    nsCOMPtr<nsIContent> captionContent = do_QueryInterface(captionNode);
-+    nsIDOMNode* captionNode;
++    nsIDOMNode* captionNode = nsnull;
 +    captionAccessNode->GetDOMNode(&captionNode);
 +    nsIContent* captionContent = do_QueryInterface(captionNode);
      if (captionContent) {
        AppendFlatStringFromSubtree(captionContent, &aDescription);
      }
 @@ -911,21 +911,21 @@ NS_IMETHODIMP nsHTMLTableAccessible::Get
  
  PRBool nsHTMLTableAccessible::HasDescendant(char *aTagName, PRBool aAllowEmpty)
  {
 -  nsCOMPtr<nsIDOMElement> tableElt(do_QueryInterface(mDOMNode));
 +  nsIDOMElement* tableElt(do_QueryInterface(mDOMNode));
    NS_ENSURE_TRUE(tableElt, PR_FALSE);
  
 -  nsCOMPtr<nsIDOMNodeList> nodeList;
-+  nsIDOMNodeList* nodeList;
++  nsIDOMNodeList* nodeList = nsnull;
    nsAutoString tagName;
    tagName.AssignWithConversion(aTagName);
 -  tableElt->GetElementsByTagName(tagName, getter_AddRefs(nodeList));
 +  tableElt->GetElementsByTagName(tagName, &nodeList);
    NS_ENSURE_TRUE(nodeList, NS_ERROR_FAILURE);
    PRUint32 length;
    nodeList->GetLength(&length);
    
    if (length == 1) {
      // Make sure it's not the table itself
 -    nsCOMPtr<nsIDOMNode> foundItem;
 -    nodeList->Item(0, getter_AddRefs(foundItem));
-+    nsIDOMNode* foundItem;
++    nsIDOMNode* foundItem = nsnull;
 +    nodeList->Item(0, &foundItem);
      if (foundItem == mDOMNode) {
        return PR_FALSE;
      }
 @@ -933,7 +933,7 @@ PRBool nsHTMLTableAccessible::HasDescend
        // Make sure that the item we found has contents
        // and either has multiple children or the
        // found item is not a whitespace-only text node
@@ -8458,49 +8458,49 @@ diff --git a/accessible/src/html/nsHTMLT
      docAccessible->GetFinalState(&state, &extState);
 @@ -1026,11 +1026,11 @@ NS_IMETHODIMP nsHTMLTableAccessible::IsP
    // Now we know there are 2-4 columns and 2 or more rows
    // Check to see if there are visible borders on the cells
    // XXX currently, we just check the first cell -- do we really need to do more?
 -  nsCOMPtr<nsIDOMElement> cellElement;
 -  GetCellAt(0, 0, *getter_AddRefs(cellElement));
 -  nsCOMPtr<nsIContent> cellContent(do_QueryInterface(cellElement));
-+  nsIDOMElement* cellElement;
++  nsIDOMElement* cellElement = nsnull;
 +  GetCellAt(0, 0, *&cellElement);
 +  nsIContent* cellContent(do_QueryInterface(cellElement));
    NS_ENSURE_TRUE(cellContent, NS_ERROR_FAILURE);
 -  nsCOMPtr<nsIPresShell> shell(GetPresShell());
 +  nsIPresShell* shell(GetPresShell());
    nsIFrame *cellFrame = shell->GetPrimaryFrameFor(cellContent);
    if (!cellFrame) {
      return NS_OK;
 @@ -1047,19 +1047,19 @@ NS_IMETHODIMP nsHTMLTableAccessible::IsP
  
    // Check for styled background color across the row
    // Alternating background color is a common way 
 -  nsCOMPtr<nsIDOMNodeList> nodeList;
 -  nsCOMPtr<nsIDOMElement> tableElt(do_QueryInterface(mDOMNode));    
 -  tableElt->GetElementsByTagName(NS_LITERAL_STRING("tr"), getter_AddRefs(nodeList));
-+  nsIDOMNodeList* nodeList;
++  nsIDOMNodeList* nodeList = nsnull;
 +  nsIDOMElement* tableElt(do_QueryInterface(mDOMNode));    
 +  tableElt->GetElementsByTagName(NS_LITERAL_STRING("tr"), &nodeList);
    NS_ENSURE_TRUE(nodeList, NS_ERROR_FAILURE);
    PRUint32 length;
    nodeList->GetLength(&length);
    nsAutoString color, lastRowColor;
    for (PRInt32 rowCount = 0; rowCount < rows; rowCount ++) {
 -    nsCOMPtr<nsIDOMNode> rowNode;
 -    nodeList->Item(rowCount, getter_AddRefs(rowNode));
 -    nsCOMPtr<nsIDOMElement> rowElement = do_QueryInterface(rowNode);
 -    nsCOMPtr<nsIDOMCSSStyleDeclaration> styleDecl;
 -    GetComputedStyleDeclaration(EmptyString(), rowElement, getter_AddRefs(styleDecl));
-+    nsIDOMNode* rowNode;
++    nsIDOMNode* rowNode = nsnull;
 +    nodeList->Item(rowCount, &rowNode);
 +    nsIDOMElement* rowElement = do_QueryInterface(rowNode);
-+    nsIDOMCSSStyleDeclaration* styleDecl;
++    nsIDOMCSSStyleDeclaration* styleDecl = nsnull;
 +    GetComputedStyleDeclaration(EmptyString(), rowElement, &styleDecl);
      NS_ENSURE_TRUE(styleDecl, NS_ERROR_FAILURE);
      lastRowColor = color;
      styleDecl->GetPropertyValue(NS_LITERAL_STRING("background-color"), color);
 @@ -1084,8 +1084,8 @@ NS_IMETHODIMP nsHTMLTableAccessible::IsP
      nsIFrame *tableFrame = GetFrame();
      NS_ENSURE_TRUE(tableFrame , NS_ERROR_FAILURE);
      nsSize tableSize  = tableFrame->GetSize();
@@ -8516,17 +8516,17 @@ diff --git a/accessible/src/html/nsHTMLT
    nsresult rv = NS_OK;
  
 -  nsCOMPtr<nsIDOMHTMLTableSectionElement> head(do_QueryInterface(mDOMNode));
 +  nsIDOMHTMLTableSectionElement* head(do_QueryInterface(mDOMNode));
    NS_ENSURE_TRUE(head, NS_ERROR_FAILURE);
  
 -  nsCOMPtr<nsIDOMHTMLCollection> rows;
 -  rv = head->GetRows(getter_AddRefs(rows));
-+  nsIDOMHTMLCollection* rows;
++  nsIDOMHTMLCollection* rows = nsnull;
 +  rv = head->GetRows(&rows);
    NS_ENSURE_SUCCESS(rv, rv);
  
    return rows->GetLength((PRUint32 *)aRows);
 diff --git a/accessible/src/html/nsHTMLTextAccessible.cpp b/accessible/src/html/nsHTMLTextAccessible.cpp
 --- a/accessible/src/html/nsHTMLTextAccessible.cpp
 +++ b/accessible/src/html/nsHTMLTextAccessible.cpp
 @@ -78,8 +78,8 @@ nsHTMLTextAccessible::GetState(PRUint32 
@@ -8572,17 +8572,17 @@ diff --git a/accessible/src/html/nsHyper
      // inherit from nsHyperTextAccessible in order for HTML document accessibles
 @@ -105,9 +105,9 @@ nsresult nsHyperTextAccessible::QueryInt
      if (aIID.Equals(NS_GET_IID(nsIAccessibleHyperText))) {
        if (role == nsIAccessibleRole::ROLE_ENTRY ||
            role == nsIAccessibleRole::ROLE_PASSWORD_TEXT) {
 -        nsCOMPtr<nsIEditor> editor;
 -        GetAssociatedEditor(getter_AddRefs(editor));
 -        nsCOMPtr<nsIPlaintextEditor> peditor(do_QueryInterface(editor));
-+        nsIEditor* editor;
++        nsIEditor* editor = nsnull;
 +        GetAssociatedEditor(&editor);
 +        nsIPlaintextEditor* peditor(do_QueryInterface(editor));
          if (peditor) {
            return NS_ERROR_NO_INTERFACE; // No embedded objects ever in plain text
          }
 @@ -132,7 +132,7 @@ nsAccessibleWrap(aNode, aShell)
  
  NS_IMETHODIMP nsHyperTextAccessible::GetRole(PRUint32 *aRole)
@@ -8593,69 +8593,69 @@ diff --git a/accessible/src/html/nsHyper
      return NS_ERROR_FAILURE;
    }
 @@ -175,8 +175,8 @@ nsHyperTextAccessible::GetState(PRUint32
    if (!aExtraState)
      return NS_OK;
  
 -  nsCOMPtr<nsIEditor> editor;
 -  GetAssociatedEditor(getter_AddRefs(editor));
-+  nsIEditor* editor;
++  nsIEditor* editor = nsnull;
 +  GetAssociatedEditor(&editor);
    if (editor) {
      PRUint32 flags;
      editor->GetFlags(&flags);
 @@ -210,20 +210,20 @@ void nsHyperTextAccessible::CacheChildre
        nsAccessible::CacheChildren();
        return;
      }
 -    nsCOMPtr<nsIEditor> editor;
 -    GetAssociatedEditor(getter_AddRefs(editor));
-+    nsIEditor* editor;
++    nsIEditor* editor = nsnull;
 +    GetAssociatedEditor(&editor);
      if (!editor) {
        nsAccessible::CacheChildren();
        return;
      }
 -    nsCOMPtr<nsIDOMElement> editorRoot;
 -    editor->GetRootElement(getter_AddRefs(editorRoot));
 -    nsCOMPtr<nsIDOMNode> editorRootDOMNode = do_QueryInterface(editorRoot);
-+    nsIDOMElement* editorRoot;
++    nsIDOMElement* editorRoot = nsnull;
 +    editor->GetRootElement(&editorRoot);
 +    nsIDOMNode* editorRootDOMNode = do_QueryInterface(editorRoot);
      if (!editorRootDOMNode) {
        return;
      }
      nsAccessibleTreeWalker walker(mWeakShell, editorRootDOMNode, PR_TRUE);
 -    nsCOMPtr<nsPIAccessible> privatePrevAccessible;
-+    nsPIAccessible* privatePrevAccessible;
++    nsPIAccessible* privatePrevAccessible = nsnull;
      PRInt32 childCount = 0;
      walker.GetFirstChild();
      SetFirstChild(walker.mState.accessible);
 @@ -265,11 +265,11 @@ nsIntRect nsHyperTextAccessible::GetBoun
                                               &startContentOffsetInFrame, &frame);
    NS_ENSURE_SUCCESS(rv, screenRect);
  
 -  nsCOMPtr<nsIPresShell> shell = GetPresShell();
 +  nsIPresShell* shell = GetPresShell();
    NS_ENSURE_TRUE(shell, screenRect);
  
 -  nsCOMPtr<nsIRenderingContext> rc;
 -  shell->CreateRenderingContext(frame, getter_AddRefs(rc));
-+  nsIRenderingContext* rc;
++  nsIRenderingContext* rc = nsnull;
 +  shell->CreateRenderingContext(frame, &rc);
    NS_ENSURE_TRUE(rc, screenRect);
  
    const nsStyleFont *font = frame->GetStyleFont();
 @@ -362,7 +362,7 @@ nsHyperTextAccessible::GetPosAndText(PRI
      *aEndAcc = nsnull;
  
    nsIntRect unionRect;
 -  nsCOMPtr<nsIAccessible> accessible, lastAccessible;
-+  nsIAccessible* accessible, *lastAccessible;
++  nsIAccessible* accessible = nsnull, *lastAccessible = nsnull;
  
    gfxSkipChars skipChars;
    gfxSkipCharsIterator iter;
 @@ -371,7 +371,7 @@ nsHyperTextAccessible::GetPosAndText(PRI
    // depending on what we need for out parameters
    while (NextChild(accessible)) {
      lastAccessible = accessible;
 -    nsCOMPtr<nsPIAccessNode> accessNode(do_QueryInterface(accessible));
@@ -8672,26 +8672,26 @@ diff --git a/accessible/src/html/nsHyper
            pAcc->AppendTextTo(*aText, startOffset,
                               substringEndOffset - startOffset);
          }
 @@ -514,7 +514,7 @@ NS_IMETHODIMP nsHyperTextAccessible::Get
      return NS_ERROR_FAILURE;
    }
  
 -  nsCOMPtr<nsIAccessible> accessible;
-+  nsIAccessible* accessible;
++  nsIAccessible* accessible = nsnull;
  
    while (NextChild(accessible)) {
      PRInt32 textLength = TextLength(accessible);
 @@ -560,7 +560,7 @@ nsresult nsHyperTextAccessible::DOMPoint
    }
  
    PRUint32 addTextOffset = 0;
 -  nsCOMPtr<nsIDOMNode> findNode;
-+  nsIDOMNode* findNode;
++  nsIDOMNode* findNode = nsnull;
  
    unsigned short nodeType;
    aNode->GetNodeType(&nodeType);
 @@ -571,9 +571,9 @@ nsresult nsHyperTextAccessible::DOMPoint
      // For text nodes, aNodeOffset comes in as a character offset
      // Text offset will be added at the end, if we find the offset in this hypertext
      // We want the "skipped" offset into the text (rendered text without the extra whitespace)
 -    nsCOMPtr<nsIContent> content = do_QueryInterface(aNode);
@@ -8711,57 +8711,57 @@ diff --git a/accessible/src/html/nsHyper
      // Should not happen, but better to protect against crash if doc node is somehow passed in
      NS_ENSURE_TRUE(parentContent, NS_ERROR_FAILURE);
      // findNode could be null if aNodeOffset == # of child nodes, which means one of two things:
 @@ -606,15 +606,15 @@ nsresult nsHyperTextAccessible::DOMPoint
  
    // Get accessible for this findNode, or if that node isn't accessible, use the
    // accessible for the next DOM node which has one (based on forward depth first search)
 -  nsCOMPtr<nsIAccessible> descendantAccessible;
-+  nsIAccessible* descendantAccessible;
++  nsIAccessible* descendantAccessible = nsnull;
    if (findNode) {
      descendantAccessible = GetFirstAvailableAccessible(findNode);
    }
    // From the descendant, go up and get the immediate child of this hypertext
 -  nsCOMPtr<nsIAccessible> childAccessible;
-+  nsIAccessible* childAccessible;
++  nsIAccessible* childAccessible = nsnull;
    while (descendantAccessible) {
 -    nsCOMPtr<nsIAccessible> parentAccessible;
 -    descendantAccessible->GetParent(getter_AddRefs(parentAccessible));
-+    nsIAccessible* parentAccessible;
++    nsIAccessible* parentAccessible = nsnull;
 +    descendantAccessible->GetParent(&parentAccessible);
      if (this == parentAccessible) {
        childAccessible = descendantAccessible;
        break;
 @@ -644,7 +644,7 @@ nsresult nsHyperTextAccessible::DOMPoint
    // If childAccessible is null we will end up adding up the entire length of
    // the hypertext, which is good -- it just means our offset node
    // came after the last accessible child's node
 -  nsCOMPtr<nsIAccessible> accessible;
-+  nsIAccessible* accessible;
++  nsIAccessible* accessible = nsnull;
    while (NextChild(accessible) && accessible != childAccessible) {
      PRInt32 textLength = TextLength(accessible);
      NS_ENSURE_TRUE(textLength >= 0, nsnull);
 @@ -682,24 +682,24 @@ nsHyperTextAccessible::HypertextOffsetsT
    NS_ENSURE_ARG_POINTER(aEndOffset);
    *aEndOffset = -1;
  
 -  nsCOMPtr<nsIAccessible> startAcc, endAcc;
-+  nsIAccessible* startAcc, *endAcc;
++  nsIAccessible* startAcc = nsnull, *endAcc = nsnull;
    PRInt32 startOffset = aStartHTOffset, endOffset = aEndHTOffset;
    nsIFrame *startFrame = nsnull, *endFrame = nsnull;
  
    startFrame = GetPosAndText(startOffset, endOffset, nsnull, &endFrame, nsnull,
 -                             getter_AddRefs(startAcc), getter_AddRefs(endAcc));
 +                             &startAcc, &endAcc);
    if (!startAcc || !endAcc)
      return NS_ERROR_FAILURE;
  
 -  nsCOMPtr<nsIDOMNode> startNode, endNode;
-+  nsIDOMNode* startNode, *endNode;
++  nsIDOMNode* startNode = nsnull, *endNode = nsnull;
    nsresult rv = GetDOMPointByFrameOffset(startFrame, startOffset, startAcc,
 -                                         getter_AddRefs(startNode),
 +                                         &startNode,
                                           &startOffset);
    NS_ENSURE_SUCCESS(rv, rv);
  
    if (aStartHTOffset != aEndHTOffset) {
      rv = GetDOMPointByFrameOffset(endFrame, endOffset, endAcc,
@@ -8783,17 +8783,17 @@ diff --git a/accessible/src/html/nsHyper
  
    // Turn the resulting node and offset into a hyperTextOffset
    PRInt32 hyperTextOffset;
 -  nsCOMPtr<nsIDOMNode> resultNode = do_QueryInterface(pos.mResultContent);
 +  nsIDOMNode* resultNode = do_QueryInterface(pos.mResultContent);
    NS_ENSURE_TRUE(resultNode, -1);
  
 -  nsCOMPtr<nsIAccessible> finalAccessible;
-+  nsIAccessible* finalAccessible;
++  nsIAccessible* finalAccessible = nsnull;
    rv = DOMPointToHypertextOffset(resultNode, pos.mContentOffset, &hyperTextOffset,
 -                                 getter_AddRefs(finalAccessible),
 +                                 &finalAccessible,
                                   aDirection == eDirNext);
    // If finalAccessible == nsnull, then DOMPointToHypertextOffset() searched through the hypertext
    // children without finding the node/offset position
 @@ -835,7 +835,7 @@ nsresult nsHyperTextAccessible::GetTextH
    aText.Truncate();
@@ -8804,17 +8804,17 @@ diff --git a/accessible/src/html/nsHyper
    if (!presShell) {
      return NS_ERROR_FAILURE;
    }
 @@ -849,16 +849,16 @@ nsresult nsHyperTextAccessible::GetTextH
      ++ endOffset;
    }
    // Convert offsets to frame-relative
 -  nsCOMPtr<nsIAccessible> startAcc;
-+  nsIAccessible* startAcc;
++  nsIAccessible* startAcc = nsnull;
    nsIFrame *startFrame = GetPosAndText(startOffset, endOffset, nsnull, nsnull,
 -                                       nsnull, getter_AddRefs(startAcc));
 +                                       nsnull, &startAcc);
  
    if (!startFrame) {
      PRInt32 textLength;
      GetCharacterCount(&textLength);
      if (aBoundaryType == BOUNDARY_LINE_START && aOffset > 0 && aOffset == textLength) {
@@ -8824,29 +8824,29 @@ diff --git a/accessible/src/html/nsHyper
        if (startAccessNode) {
          startFrame = startAccessNode->GetFrame();
        }
 @@ -944,9 +944,9 @@ nsresult nsHyperTextAccessible::GetTextH
      // 2 words/lines if the offset occured on whitespace boundary
      // Careful, startOffset and endOffset are passed by reference to GetPosAndText() and changed
      startOffset = endOffset = finalStartOffset;
 -    nsCOMPtr<nsIAccessible> endAcc;
-+    nsIAccessible* endAcc;
++    nsIAccessible* endAcc = nsnull;
      nsIFrame *endFrame = GetPosAndText(startOffset, endOffset, nsnull, nsnull,
 -                                       nsnull, getter_AddRefs(endAcc));
 +                                       nsnull, &endAcc);
      if (!endFrame) {
        return NS_ERROR_FAILURE;
      }
 @@ -1013,7 +1013,7 @@ NS_IMETHODIMP nsHyperTextAccessible::Get
      return NS_ERROR_FAILURE;
    }
  
 -  nsCOMPtr<nsIAccessible> accessible;
-+  nsIAccessible* accessible;
++  nsIAccessible* accessible = nsnull;
    
    while (NextChild(accessible)) {
      PRInt32 length = TextLength(accessible);
 @@ -1039,7 +1039,7 @@ nsHyperTextAccessible::GetAttributesInte
    nsresult rv = nsAccessibleWrap::GetAttributesInternal(aAttributes);
    NS_ENSURE_SUCCESS(rv, rv);
  
 -  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
@@ -8864,17 +8864,17 @@ diff --git a/accessible/src/html/nsHyper
 -    nsCOMPtr<nsIDocument> doc = shell->GetDocument();
 -    nsCOMPtr<nsIDOMDocumentView> docView(do_QueryInterface(doc));
 +    nsIDocument* doc = shell->GetDocument();
 +    nsIDOMDocumentView* docView(do_QueryInterface(doc));
      NS_ENSURE_TRUE(docView, NS_ERROR_FAILURE);
  
 -    nsCOMPtr<nsIDOMAbstractView> abstractView;
 -    docView->GetDefaultView(getter_AddRefs(abstractView));
-+    nsIDOMAbstractView* abstractView;
++    nsIDOMAbstractView* abstractView = nsnull;
 +    docView->GetDefaultView(&abstractView);
      NS_ENSURE_TRUE(abstractView, NS_ERROR_FAILURE);
  
 -    nsCOMPtr<nsIDOMWindowInternal> windowInter(do_QueryInterface(abstractView));
 +    nsIDOMWindowInternal* windowInter(do_QueryInterface(abstractView));
      NS_ENSURE_TRUE(windowInter, NS_ERROR_FAILURE);
  
      PRInt32 screenX, screenY;
@@ -8894,119 +8894,119 @@ diff --git a/accessible/src/html/nsHyper
 -    nsCOMPtr<nsIDocument> doc = shell->GetDocument();
 -    nsCOMPtr<nsIDOMDocumentView> docView(do_QueryInterface(doc));
 +    nsIDocument* doc = shell->GetDocument();
 +    nsIDOMDocumentView* docView(do_QueryInterface(doc));
      NS_ENSURE_TRUE(docView, NS_ERROR_FAILURE);
  
 -    nsCOMPtr<nsIDOMAbstractView> abstractView;
 -    docView->GetDefaultView(getter_AddRefs(abstractView));
-+    nsIDOMAbstractView* abstractView;
++    nsIDOMAbstractView* abstractView = nsnull;
 +    docView->GetDefaultView(&abstractView);
      NS_ENSURE_TRUE(abstractView, NS_ERROR_FAILURE);
  
 -    nsCOMPtr<nsIDOMWindowInternal> windowInter(do_QueryInterface(abstractView));
 +    nsIDOMWindowInternal* windowInter(do_QueryInterface(abstractView));
      NS_ENSURE_TRUE(windowInter, NS_ERROR_FAILURE);
  
      PRInt32 windowX, windowY;
 @@ -1189,11 +1189,11 @@ nsHyperTextAccessible::GetOffsetAtPoint(
  
    // We have an point in an accessible child of this, now we need to add up the
    // offsets before it to what we already have
 -  nsCOMPtr<nsIAccessible> accessible;
-+  nsIAccessible* accessible;
++  nsIAccessible* accessible = nsnull;
    PRInt32 offset = 0;
  
    while (NextChild(accessible)) {
 -    nsCOMPtr<nsPIAccessNode> accessNode(do_QueryInterface(accessible));
 +    nsPIAccessNode* accessNode(do_QueryInterface(accessible));
      nsIFrame *primaryFrame = accessNode->GetFrame();
      NS_ENSURE_TRUE(primaryFrame, NS_ERROR_FAILURE);
  
 @@ -1238,7 +1238,7 @@ NS_IMETHODIMP nsHyperTextAccessible::Get
      return NS_ERROR_FAILURE;
    }
  
 -  nsCOMPtr<nsIAccessible> accessible;
-+  nsIAccessible* accessible;
++  nsIAccessible* accessible = nsnull;
  
    while (NextChild(accessible)) {
      if (IsEmbeddedObject(accessible)) {
 @@ -1256,7 +1256,7 @@ NS_IMETHODIMP nsHyperTextAccessible::Get
      return NS_ERROR_FAILURE;
    }
  
 -  nsCOMPtr<nsIAccessible> accessible;
-+  nsIAccessible* accessible;
++  nsIAccessible* accessible = nsnull;
  
    while (NextChild(accessible)) {
      if (IsEmbeddedObject(accessible) && aIndex-- == 0) {
 @@ -1277,7 +1277,7 @@ NS_IMETHODIMP nsHyperTextAccessible::Get
      return NS_ERROR_FAILURE;
    }
  
 -  nsCOMPtr<nsIAccessible> accessible;
-+  nsIAccessible* accessible;
++  nsIAccessible* accessible = nsnull;
  
    while (NextChild(accessible) && characterCount <= aCharIndex) {
      PRUint32 role = Role(accessible);
 @@ -1322,9 +1322,9 @@ NS_IMETHODIMP nsHyperTextAccessible::Ins
  NS_IMETHODIMP nsHyperTextAccessible::InsertText(const nsAString &aText, PRInt32 aPosition)
  {
    if (NS_SUCCEEDED(SetCaretOffset(aPosition))) {
 -    nsCOMPtr<nsIEditor> editor;
 -    GetAssociatedEditor(getter_AddRefs(editor));
 -    nsCOMPtr<nsIPlaintextEditor> peditor(do_QueryInterface(editor));
-+    nsIEditor* editor;
++    nsIEditor* editor = nsnull;
 +    GetAssociatedEditor(&editor);
 +    nsIPlaintextEditor* peditor(do_QueryInterface(editor));
      return peditor ? peditor->InsertText(aText) : NS_ERROR_FAILURE;
    }
  
 @@ -1333,8 +1333,8 @@ NS_IMETHODIMP nsHyperTextAccessible::Ins
  
  NS_IMETHODIMP nsHyperTextAccessible::CopyText(PRInt32 aStartPos, PRInt32 aEndPos)
  {
 -  nsCOMPtr<nsIEditor> editor;
 -  GetAssociatedEditor(getter_AddRefs(editor));
-+  nsIEditor* editor;
++  nsIEditor* editor = nsnull;
 +  GetAssociatedEditor(&editor);
    if (editor && NS_SUCCEEDED(SetSelectionRange(aStartPos, aEndPos)))
      return editor->Copy();
  
 @@ -1343,8 +1343,8 @@ NS_IMETHODIMP nsHyperTextAccessible::Cop
  
  NS_IMETHODIMP nsHyperTextAccessible::CutText(PRInt32 aStartPos, PRInt32 aEndPos)
  {
 -  nsCOMPtr<nsIEditor> editor;
 -  GetAssociatedEditor(getter_AddRefs(editor));
-+  nsIEditor* editor;
++  nsIEditor* editor = nsnull;
 +  GetAssociatedEditor(&editor);
    if (editor && NS_SUCCEEDED(SetSelectionRange(aStartPos, aEndPos)))
      return editor->Cut();
  
 @@ -1353,8 +1353,8 @@ NS_IMETHODIMP nsHyperTextAccessible::Cut
  
  NS_IMETHODIMP nsHyperTextAccessible::DeleteText(PRInt32 aStartPos, PRInt32 aEndPos)
  {
 -  nsCOMPtr<nsIEditor> editor;
 -  GetAssociatedEditor(getter_AddRefs(editor));
-+  nsIEditor* editor;
++  nsIEditor* editor = nsnull;
 +  GetAssociatedEditor(&editor);
    if (editor && NS_SUCCEEDED(SetSelectionRange(aStartPos, aEndPos)))
      return editor->DeleteSelection(nsIEditor::eNone);
  
 @@ -1363,8 +1363,8 @@ NS_IMETHODIMP nsHyperTextAccessible::Del
  
  NS_IMETHODIMP nsHyperTextAccessible::PasteText(PRInt32 aPosition)
  {
 -  nsCOMPtr<nsIEditor> editor;
 -  GetAssociatedEditor(getter_AddRefs(editor));
-+  nsIEditor* editor;
++  nsIEditor* editor = nsnull;
 +  GetAssociatedEditor(&editor);
    if (editor && NS_SUCCEEDED(SetCaretOffset(aPosition)))
      return editor->Paste(nsIClipboard::kGlobalClipboard);
  
 @@ -1377,16 +1377,16 @@ nsHyperTextAccessible::GetAssociatedEdit
    NS_ENSURE_ARG_POINTER(aEditor);
  
    *aEditor = nsnull;
@@ -9014,19 +9014,19 @@ diff --git a/accessible/src/html/nsHyper
 +  nsIContent* content = do_QueryInterface(mDOMNode);
    NS_ENSURE_TRUE(content, NS_ERROR_FAILURE);
  
    if (!content->HasFlag(NODE_IS_EDITABLE)) {
      // If we're inside an editable container, then return that container's editor
 -    nsCOMPtr<nsIAccessible> ancestor, current = this;
 -    while (NS_SUCCEEDED(current->GetParent(getter_AddRefs(ancestor))) && ancestor) {
 -      nsRefPtr<nsHyperTextAccessible> ancestorTextAccessible;
-+    nsIAccessible* ancestor, *current = this;
++    nsIAccessible* ancestor = nsnull, *current = this;
 +    while (NS_SUCCEEDED(current->GetParent(&ancestor)) && ancestor) {
-+      nsHyperTextAccessible* ancestorTextAccessible;
++      nsHyperTextAccessible* ancestorTextAccessible = nsnull;
        ancestor->QueryInterface(NS_GET_IID(nsHyperTextAccessible),
 -                               getter_AddRefs(ancestorTextAccessible));
 +                               (void**)&ancestorTextAccessible);
        if (ancestorTextAccessible) {
          // Recursion will stop at container doc because it has its own impl
          // of GetAssociatedEditor()
 @@ -1397,19 +1397,19 @@ nsHyperTextAccessible::GetAssociatedEdit
      return NS_OK;
@@ -9044,75 +9044,75 @@ diff --git a/accessible/src/html/nsHyper
 +  nsIPresShell* shell = GetPresShell();
    NS_ENSURE_TRUE(shell, NS_ERROR_FAILURE);
  
 -  nsCOMPtr<nsIDocument> doc = shell->GetDocument();
 +  nsIDocument* doc = shell->GetDocument();
    NS_ENSURE_TRUE(doc, NS_ERROR_FAILURE);
  
 -  nsCOMPtr<nsIEditor> editor;
-+  nsIEditor* editor;
++  nsIEditor* editor = nsnull;
    return editingSession->GetEditorForWindow(doc->GetWindow(), aEditor);
  }
  
 @@ -1425,16 +1425,16 @@ nsresult nsHyperTextAccessible::SetSelec
  
    // If range 0 was successfully set, clear any additional selection 
    // ranges remaining from previous selection
 -  nsCOMPtr<nsISelection> domSel;
 -  nsCOMPtr<nsISelectionController> selCon;
 -  GetSelections(getter_AddRefs(selCon), getter_AddRefs(domSel));
-+  nsISelection* domSel;
-+  nsISelectionController* selCon;
++  nsISelection* domSel = nsnull;
++  nsISelectionController* selCon = nsnull;
 +  GetSelections(&selCon, &domSel);
    if (domSel) {
      PRInt32 numRanges;
      domSel->GetRangeCount(&numRanges);
  
      for (PRInt32 count = 0; count < numRanges - 1; count ++) {
 -      nsCOMPtr<nsIDOMRange> range;
 -      domSel->GetRangeAt(1, getter_AddRefs(range));
-+      nsIDOMRange* range;
++      nsIDOMRange* range = nsnull;
 +      domSel->GetRangeAt(1, &range);
        domSel->RemoveRange(range);
      }
    }
 @@ -1459,12 +1459,12 @@ NS_IMETHODIMP nsHyperTextAccessible::Get
  {
    *aCaretOffset = 0;
  
 -  nsCOMPtr<nsISelection> domSel;
 -  nsresult rv = GetSelections(nsnull, getter_AddRefs(domSel));
 -  NS_ENSURE_SUCCESS(rv, rv);
 -
 -  nsCOMPtr<nsIDOMNode> caretNode;
 -  rv = domSel->GetFocusNode(getter_AddRefs(caretNode));
-+  nsISelection* domSel;
++  nsISelection* domSel = nsnull;
 +  nsresult rv = GetSelections(nsnull, &domSel);
 +  NS_ENSURE_SUCCESS(rv, rv);
 +
-+  nsIDOMNode* caretNode;
++  nsIDOMNode* caretNode = nsnull;
 +  rv = domSel->GetFocusNode(&caretNode);
    NS_ENSURE_SUCCESS(rv, rv);
  
    PRInt32 caretOffset;
 @@ -1490,23 +1490,23 @@ nsresult nsHyperTextAccessible::GetSelec
      aRanges->Clear();
    }
    
 -  nsCOMPtr<nsISelection> domSel;
 -  nsCOMPtr<nsISelectionController> selCon;
 -
 -  nsCOMPtr<nsIEditor> editor;
 -  GetAssociatedEditor(getter_AddRefs(editor));
 -  nsCOMPtr<nsIPlaintextEditor> peditor(do_QueryInterface(editor));
-+  nsISelection* domSel;
-+  nsISelectionController* selCon;
-+
-+  nsIEditor* editor;
++  nsISelection* domSel = nsnull;
++  nsISelectionController* selCon = nsnull;
++
++  nsIEditor* editor = nsnull;
 +  GetAssociatedEditor(&editor);
 +  nsIPlaintextEditor* peditor(do_QueryInterface(editor));
    if (peditor) {
      // Case 1: plain text editor
      // This is for form controls which have their own
      // selection controller separate from the document, for example
      // HTML:input, HTML:textarea, XUL:textbox, etc.
      if (aSelCon) {
@@ -9144,60 +9144,60 @@ diff --git a/accessible/src/html/nsHyper
    }
    if (aRanges) {
 -    nsCOMPtr<nsISelection2> selection2(do_QueryInterface(domSel));
 +    nsISelection2* selection2(do_QueryInterface(domSel));
      NS_ENSURE_TRUE(selection2, NS_ERROR_FAILURE);
  
 -    nsCOMPtr<nsIDOMNodeList> childNodes;
 -    nsresult rv = mDOMNode->GetChildNodes(getter_AddRefs(childNodes));
-+    nsIDOMNodeList* childNodes;
++    nsIDOMNodeList* childNodes = nsnull;
 +    nsresult rv = mDOMNode->GetChildNodes(&childNodes);
      NS_ENSURE_SUCCESS(rv, rv);
      PRUint32 numChildren; 
      rv = childNodes->GetLength(&numChildren);
 @@ -1565,7 +1565,7 @@ nsresult nsHyperTextAccessible::GetSelec
   */
  NS_IMETHODIMP nsHyperTextAccessible::GetSelectionCount(PRInt32 *aSelectionCount)
  {
 -  nsCOMPtr<nsISelection> domSel;
-+  nsISelection* domSel;
++  nsISelection* domSel = nsnull;
    nsCOMArray<nsIDOMRange> ranges;
    nsresult rv = GetSelections(nsnull, nsnull, &ranges);
    NS_ENSURE_SUCCESS(rv, rv);
 @@ -1582,26 +1582,26 @@ NS_IMETHODIMP nsHyperTextAccessible::Get
  {
    *aStartOffset = *aEndOffset = 0;
  
 -  nsCOMPtr<nsISelection> domSel;
-+  nsISelection* domSel;
++  nsISelection* domSel = nsnull;
    nsCOMArray<nsIDOMRange> ranges;
 -  nsresult rv = GetSelections(nsnull, getter_AddRefs(domSel), &ranges);
 +  nsresult rv = GetSelections(nsnull, &domSel, &ranges);
    NS_ENSURE_SUCCESS(rv, rv);
  
    PRInt32 rangeCount = ranges.Count();
    if (aSelectionNum < 0 || aSelectionNum >= rangeCount)
      return NS_ERROR_INVALID_ARG;
  
 -  nsCOMPtr<nsIDOMRange> range = ranges[aSelectionNum];
 +  nsIDOMRange* range = ranges[aSelectionNum];
  
    // Get start point
 -  nsCOMPtr<nsIDOMNode> startNode;
 -  range->GetStartContainer(getter_AddRefs(startNode));
-+  nsIDOMNode* startNode;
++  nsIDOMNode* startNode = nsnull;
 +  range->GetStartContainer(&startNode);
    PRInt32 startOffset;
    range->GetStartOffset(&startOffset);
  
    // Get end point
 -  nsCOMPtr<nsIDOMNode> endNode;
 -  range->GetEndContainer(getter_AddRefs(endNode));
-+  nsIDOMNode* endNode;
++  nsIDOMNode* endNode = nsnull;
 +  range->GetEndContainer(&endNode);
    PRInt32 endOffset;
    range->GetEndOffset(&endOffset);
  
 @@ -1612,14 +1612,14 @@ NS_IMETHODIMP nsHyperTextAccessible::Get
    if (rangeCompareResult < 0) {
      // Make sure start is before end, by swapping offsets
      // This occurs when the user selects backwards in the text
@@ -9205,144 +9205,144 @@ diff --git a/accessible/src/html/nsHyper
 +    swap(startNode, endNode);
      PRInt32 tempOffset = startOffset;
      startOffset = endOffset;
      endOffset = tempOffset;
    }
  
 -  nsCOMPtr<nsIAccessible> startAccessible;
 -  rv = DOMPointToHypertextOffset(startNode, startOffset, aStartOffset, getter_AddRefs(startAccessible));
-+  nsIAccessible* startAccessible;
++  nsIAccessible* startAccessible = nsnull;
 +  rv = DOMPointToHypertextOffset(startNode, startOffset, aStartOffset, &startAccessible);
    NS_ENSURE_SUCCESS(rv, rv);
    if (!startAccessible) {
      *aStartOffset = 0; // Could not find start point within this hypertext, so starts before
 @@ -1636,8 +1636,8 @@ nsHyperTextAccessible::SetSelectionBound
                                            PRInt32 aStartOffset,
                                            PRInt32 aEndOffset)
  {
 -  nsCOMPtr<nsISelection> domSel;
 -  nsresult rv = GetSelections(nsnull, getter_AddRefs(domSel));
-+  nsISelection* domSel;
++  nsISelection* domSel = nsnull;
 +  nsresult rv = GetSelections(nsnull, &domSel);
    NS_ENSURE_SUCCESS(rv, rv);
  
    // Caret is a collapsed selection
 @@ -1645,7 +1645,7 @@ nsHyperTextAccessible::SetSelectionBound
  
    PRInt32 rangeCount;
    domSel->GetRangeCount(&rangeCount);
 -  nsCOMPtr<nsIDOMRange> range;
-+  nsIDOMRange* range;
++  nsIDOMRange* range = nsnull;
    if (aSelectionNum == rangeCount) { // Add a range
      range = do_CreateInstance(kRangeCID);
      NS_ENSURE_TRUE(range, NS_ERROR_OUT_OF_MEMORY);
 @@ -1654,16 +1654,16 @@ nsHyperTextAccessible::SetSelectionBound
      return NS_ERROR_INVALID_ARG;
    }
    else {
 -    domSel->GetRangeAt(aSelectionNum, getter_AddRefs(range));
 +    domSel->GetRangeAt(aSelectionNum, &range);
      NS_ENSURE_TRUE(range, NS_ERROR_FAILURE);
    }
  
    PRInt32 startOffset, endOffset;
 -  nsCOMPtr<nsIDOMNode> startNode, endNode;
-+  nsIDOMNode* startNode, *endNode;
++  nsIDOMNode* startNode = nsnull, *endNode = nsnull;
  
    rv = HypertextOffsetsToDOMRange(aStartOffset, aEndOffset,
 -                                  getter_AddRefs(startNode), &startOffset,
 -                                  getter_AddRefs(endNode), &endOffset);
 +                                  &startNode, &startOffset,
 +                                  &endNode, &endOffset);
    NS_ENSURE_SUCCESS(rv, rv);
  
    rv = range->SetStart(startNode, startOffset);
 @@ -1684,8 +1684,8 @@ nsHyperTextAccessible::SetSelectionBound
   */
  NS_IMETHODIMP nsHyperTextAccessible::AddSelection(PRInt32 aStartOffset, PRInt32 aEndOffset)
  {
 -  nsCOMPtr<nsISelection> domSel;
 -  nsresult rv = GetSelections(nsnull, getter_AddRefs(domSel));
-+  nsISelection* domSel;
++  nsISelection* domSel = nsnull;
 +  nsresult rv = GetSelections(nsnull, &domSel);
    NS_ENSURE_SUCCESS(rv, rv);
  
    PRInt32 rangeCount;
 @@ -1699,8 +1699,8 @@ NS_IMETHODIMP nsHyperTextAccessible::Add
   */
  NS_IMETHODIMP nsHyperTextAccessible::RemoveSelection(PRInt32 aSelectionNum)
  {
 -  nsCOMPtr<nsISelection> domSel;
 -  nsresult rv = GetSelections(nsnull, getter_AddRefs(domSel));
-+  nsISelection* domSel;
++  nsISelection* domSel = nsnull;
 +  nsresult rv = GetSelections(nsnull, &domSel);
    NS_ENSURE_SUCCESS(rv, rv);
  
    PRInt32 rangeCount;
 @@ -1708,8 +1708,8 @@ NS_IMETHODIMP nsHyperTextAccessible::Rem
    if (aSelectionNum < 0 || aSelectionNum >= rangeCount)
      return NS_ERROR_INVALID_ARG;
  
 -  nsCOMPtr<nsIDOMRange> range;
 -  domSel->GetRangeAt(aSelectionNum, getter_AddRefs(range));
-+  nsIDOMRange* range;
++  nsIDOMRange* range = nsnull;
 +  domSel->GetRangeAt(aSelectionNum, &range);
    return domSel->RemoveRange(range);
  }
  
 @@ -1721,12 +1721,12 @@ nsHyperTextAccessible::ScrollSubstringTo
                                           PRUint32 aScrollType)
  {
    PRInt32 startOffset, endOffset;
 -  nsCOMPtr<nsIDOMNode> startNode, endNode;
-+  nsIDOMNode* startNode, *endNode;
++  nsIDOMNode* startNode = nsnull, *endNode = nsnull;
  
    nsresult rv = HypertextOffsetsToDOMRange(aStartIndex, aEndIndex,
 -                                           getter_AddRefs(startNode),
 +                                           &startNode,
                                             &startOffset,
 -                                           getter_AddRefs(endNode),
 +                                           &endNode,
                                             &endOffset);
    NS_ENSURE_SUCCESS(rv, rv);
  
 @@ -1754,11 +1754,11 @@ nsHyperTextAccessible::ScrollSubstringTo
    NS_ENSURE_SUCCESS(rv, rv);
  
    PRInt32 startOffset, endOffset;
 -  nsCOMPtr<nsIDOMNode> startNode, endNode;
-+  nsIDOMNode* startNode, *endNode;
++  nsIDOMNode* startNode = nsnull, *endNode = nsnull;
  
    rv = HypertextOffsetsToDOMRange(aStartIndex, aEndIndex,
 -                                  getter_AddRefs(startNode), &startOffset,
 -                                  getter_AddRefs(endNode), &endOffset);
 +                                  &startNode, &startOffset,
 +                                  &endNode, &endOffset);
    NS_ENSURE_SUCCESS(rv, rv);
  
    nsPresContext *presContext = frame->PresContext();
 @@ -1857,29 +1857,29 @@ nsHyperTextAccessible::GetDOMPointByFram
  {
    NS_ENSURE_ARG(aAccessible);
  
 -  nsCOMPtr<nsIDOMNode> node;
-+  nsIDOMNode* node;
++  nsIDOMNode* node = nsnull;
  
    if (!aFrame) {
      // If the given frame is null then set offset after the DOM node of the
      // given accessible.
 -    nsCOMPtr<nsIAccessNode> accessNode(do_QueryInterface(aAccessible));
 -
 -    nsCOMPtr<nsIDOMNode> DOMNode;
 -    accessNode->GetDOMNode(getter_AddRefs(DOMNode));
 -    nsCOMPtr<nsIContent> content(do_QueryInterface(DOMNode));
 +    nsIAccessNode* accessNode(do_QueryInterface(aAccessible));
 +
-+    nsIDOMNode* DOMNode;
++    nsIDOMNode* DOMNode = nsnull;
 +    accessNode->GetDOMNode(&DOMNode);
 +    nsIContent* content(do_QueryInterface(DOMNode));
      NS_ENSURE_STATE(content);
  
 -    nsCOMPtr<nsIContent> parent(content->GetParent());
 +    nsIContent* parent(content->GetParent());
      NS_ENSURE_STATE(parent);
  
@@ -9376,28 +9376,28 @@ diff --git a/accessible/src/xforms/nsXFo
 --- a/accessible/src/xforms/nsXFormsAccessible.cpp
 +++ b/accessible/src/xforms/nsXFormsAccessible.cpp
 @@ -76,8 +76,8 @@ nsXFormsAccessible::GetBoundChildElement
    NS_ENSURE_TRUE(sXFormsService, NS_ERROR_FAILURE);
    NS_ENSURE_TRUE(mDOMNode, NS_ERROR_FAILURE);
  
 -  nsCOMPtr<nsIDOMNodeList> nodes;
 -  nsresult rv = mDOMNode->GetChildNodes(getter_AddRefs(nodes));
-+  nsIDOMNodeList* nodes;
++  nsIDOMNodeList* nodes = nsnull;
 +  nsresult rv = mDOMNode->GetChildNodes(&nodes);
    NS_ENSURE_SUCCESS(rv, rv);
  
    PRUint32 length;
 @@ -85,11 +85,11 @@ nsXFormsAccessible::GetBoundChildElement
    NS_ENSURE_SUCCESS(rv, rv);
  
    for (PRUint32 index = 0; index < length; index++) {
 -    nsCOMPtr<nsIDOMNode> node;
 -    rv = nodes->Item(index, getter_AddRefs(node));
-+    nsIDOMNode* node;
++    nsIDOMNode* node = nsnull;
 +    rv = nodes->Item(index, &node);
      NS_ENSURE_SUCCESS(rv, rv);
  
 -    nsCOMPtr<nsIContent> content = do_QueryInterface(node);
 +    nsIContent* content = do_QueryInterface(node);
      NS_ENSURE_TRUE(content, NS_ERROR_FAILURE);
  
      if (content->NodeInfo()->Equals(aTagName) &&
@@ -9407,37 +9407,37 @@ diff --git a/accessible/src/xforms/nsXFo
  
 -  nsCOMPtr<nsIDOMNode> container(aContainerNode);
 +  nsIDOMNode* container(aContainerNode);
    if (!container)
      container = mDOMNode;
  
 -  nsCOMPtr<nsIDOMNodeList> children;
 -  sXFormsService->GetSelectChildrenFor(container, getter_AddRefs(children));
-+  nsIDOMNodeList* children;
++  nsIDOMNodeList* children = nsnull;
 +  sXFormsService->GetSelectChildrenFor(container, &children);
  
    if (!children)
      return;
 @@ -131,18 +131,18 @@ nsXFormsAccessible::CacheSelectChildren(
    PRUint32 length = 0;
    children->GetLength(&length);
  
 -  nsCOMPtr<nsIAccessible> accessible;
 -  nsCOMPtr<nsPIAccessible> currAccessible;
 -  nsCOMPtr<nsPIAccessible> prevAccessible;
-+  nsIAccessible* accessible;
-+  nsPIAccessible* currAccessible;
-+  nsPIAccessible* prevAccessible;
++  nsIAccessible* accessible = nsnull;
++  nsPIAccessible* currAccessible = nsnull;
++  nsPIAccessible* prevAccessible = nsnull;
  
    PRUint32 childLength = 0;
    for (PRUint32 index = 0; index < length; index++) {
 -    nsCOMPtr<nsIDOMNode> child;
 -    children->Item(index, getter_AddRefs(child));
-+    nsIDOMNode* child;
++    nsIDOMNode* child = nsnull;
 +    children->Item(index, &child);
      if (!child)
        continue;
  
 -    accService->GetAttachedAccessibleFor(child, getter_AddRefs(accessible));
 +    accService->GetAttachedAccessibleFor(child, &accessible);
      currAccessible = do_QueryInterface(accessible);
      if (!currAccessible)
@@ -9452,17 +9452,17 @@ diff --git a/accessible/src/xforms/nsXFo
    }
  
 @@ -326,8 +326,8 @@ nsXFormsEditableAccessible::GetState(PRU
      }
    }
  
 -  nsCOMPtr<nsIEditor> editor;
 -  GetAssociatedEditor(getter_AddRefs(editor));
-+  nsIEditor* editor;
++  nsIEditor* editor = nsnull;
 +  GetAssociatedEditor(&editor);
    NS_ENSURE_TRUE(editor, NS_ERROR_FAILURE);
    PRUint32 flags;
    editor->GetFlags(&flags);
 @@ -356,7 +356,7 @@ nsXFormsSelectableAccessible::
    nsXFormsSelectableAccessible(nsIDOMNode* aNode, nsIWeakReference* aShell) :
    nsXFormsEditableAccessible(aNode, aShell)
  {
@@ -9480,79 +9480,79 @@ diff --git a/accessible/src/xforms/nsXFo
      do_CreateInstance(NS_ARRAY_CONTRACTID);
    NS_ENSURE_TRUE(accessibles, NS_ERROR_OUT_OF_MEMORY);
  
 @@ -381,16 +381,16 @@ nsXFormsSelectableAccessible::GetSelecte
    nsresult rv;
  
    if (mIsSelect1Element) {
 -    nsCOMPtr<nsIDOMNode> item;
-+    nsIDOMNode* item;
++    nsIDOMNode* item = nsnull;
      rv = sXFormsService->GetSelectedItemForSelect1(mDOMNode,
 -                                                   getter_AddRefs(item));
 +                                                   &item);
      NS_ENSURE_SUCCESS(rv, rv);
  
      if (!item)
        return NS_OK;
  
 -    nsCOMPtr<nsIAccessible> accessible;
 -    accService->GetAccessibleFor(item, getter_AddRefs(accessible));
-+    nsIAccessible* accessible;
++    nsIAccessible* accessible = nsnull;
 +    accService->GetAccessibleFor(item, &accessible);
      NS_ENSURE_TRUE(accessible, NS_ERROR_FAILURE);
  
      accessibles->AppendElement(accessible, PR_FALSE);
 @@ -398,9 +398,9 @@ nsXFormsSelectableAccessible::GetSelecte
      return NS_OK;
    }
  
 -  nsCOMPtr<nsIDOMNodeList> items;
-+  nsIDOMNodeList* items;
++  nsIDOMNodeList* items = nsnull;
    rv = sXFormsService->GetSelectedItemsForSelect(mDOMNode,
 -                                                 getter_AddRefs(items));
 +                                                 &items);
    NS_ENSURE_SUCCESS(rv, rv);
  
    if (!items)
 @@ -412,12 +412,12 @@ nsXFormsSelectableAccessible::GetSelecte
      return NS_OK;
  
    for (PRUint32 index = 0; index < length; index++) {
 -    nsCOMPtr<nsIDOMNode> item;
 -    items->Item(index, getter_AddRefs(item));
-+    nsIDOMNode* item;
++    nsIDOMNode* item = nsnull;
 +    items->Item(index, &item);
      NS_ENSURE_TRUE(item, NS_ERROR_FAILURE);
  
 -    nsCOMPtr<nsIAccessible> accessible;
 -    accService->GetAccessibleFor(item, getter_AddRefs(accessible));
-+    nsIAccessible* accessible;
++    nsIAccessible* accessible = nsnull;
 +    accService->GetAccessibleFor(item, &accessible);
      NS_ENSURE_TRUE(accessible, NS_ERROR_FAILURE);
  
      accessibles->AppendElement(accessible, PR_FALSE);
 @@ -436,9 +436,9 @@ nsXFormsSelectableAccessible::GetSelecti
  
    nsresult rv;
    if (mIsSelect1Element) {
 -    nsCOMPtr<nsIDOMNode> item;
-+    nsIDOMNode* item;
++    nsIDOMNode* item = nsnull;
      rv = sXFormsService->GetSelectedItemForSelect1(mDOMNode,
 -                                                   getter_AddRefs(item));
 +                                                   &item);
      NS_ENSURE_SUCCESS(rv, rv);
  
      if (item)
 @@ -447,9 +447,9 @@ nsXFormsSelectableAccessible::GetSelecti
      return NS_OK;
    }
  
 -  nsCOMPtr<nsIDOMNodeList> items;
-+  nsIDOMNodeList* items;
++  nsIDOMNodeList* items = nsnull;
    rv = sXFormsService->GetSelectedItemsForSelect(mDOMNode,
 -                                                 getter_AddRefs(items));
 +                                                 &items);
    NS_ENSURE_SUCCESS(rv, rv);
  
    if (!items)
 @@ -466,7 +466,7 @@ NS_IMETHODIMP
  NS_IMETHODIMP
@@ -9570,77 +9570,77 @@ diff --git a/accessible/src/xforms/nsXFo
 -  nsCOMPtr<nsIDOMNode> item = GetItemByIndex(&aIndex);
 +  nsIDOMNode* item = GetItemByIndex(&aIndex);
    if (!item)
      return NS_OK;
  
    nsresult rv;
    if (mIsSelect1Element) {
 -    nsCOMPtr<nsIDOMNode> selitem;
-+    nsIDOMNode* selitem;
++    nsIDOMNode* selitem = nsnull;
      rv = sXFormsService->GetSelectedItemForSelect1(mDOMNode,
 -                                                   getter_AddRefs(selitem));
 +                                                   &selitem);
      NS_ENSURE_SUCCESS(rv, NS_ERROR_FAILURE);
  
      if (selitem != item)
 @@ -513,9 +513,9 @@ nsXFormsSelectableAccessible::RefSelecti
      if (aIndex != 0)
        return NS_OK;
  
 -    nsCOMPtr<nsIDOMNode> item;
-+    nsIDOMNode* item;
++    nsIDOMNode* item = nsnull;
      rv = sXFormsService->GetSelectedItemForSelect1(mDOMNode,
 -                                                   getter_AddRefs(item));
 +                                                   &item);
      NS_ENSURE_SUCCESS(rv, rv);
  
      if (item)
 @@ -523,9 +523,9 @@ nsXFormsSelectableAccessible::RefSelecti
      return NS_OK;
    }
  
 -  nsCOMPtr<nsIDOMNodeList> items;
-+  nsIDOMNodeList* items;
++  nsIDOMNodeList* items = nsnull;
    rv = sXFormsService->GetSelectedItemsForSelect(mDOMNode,
 -                                                 getter_AddRefs(items));
 +                                                 &items);
    NS_ENSURE_SUCCESS(rv, rv);
  
    if (!items)
 @@ -536,11 +536,11 @@ nsXFormsSelectableAccessible::RefSelecti
    if (aIndex < 0 || PRUint32(aIndex) >= length)
      return NS_OK;
  
 -  nsCOMPtr<nsIDOMNode> item;
 -  items->Item(aIndex, getter_AddRefs(item));
 -
 -  nsCOMPtr<nsIAccessible> accessible;
 -  return accService->GetAccessibleFor(item, getter_AddRefs(accessible));
-+  nsIDOMNode* item;
++  nsIDOMNode* item = nsnull;
 +  items->Item(aIndex, &item);
 +
-+  nsIAccessible* accessible;
++  nsIAccessible* accessible = nsnull;
 +  return accService->GetAccessibleFor(item, &accessible);
  }
  
  NS_IMETHODIMP
 @@ -550,15 +550,15 @@ nsXFormsSelectableAccessible::IsChildSel
    NS_ENSURE_ARG_POINTER(aIsSelected);
    *aIsSelected = PR_FALSE;
  
 -  nsCOMPtr<nsIDOMNode> item = GetItemByIndex(&aIndex);
 +  nsIDOMNode* item = GetItemByIndex(&aIndex);
    if (!item)
      return NS_OK;
  
    nsresult rv;
    if (mIsSelect1Element) {
 -    nsCOMPtr<nsIDOMNode> selitem;
-+    nsIDOMNode* selitem;
++    nsIDOMNode* selitem = nsnull;
      rv = sXFormsService->GetSelectedItemForSelect1(mDOMNode,
 -                                                   getter_AddRefs(selitem));
 +                                                   &selitem);
      NS_ENSURE_SUCCESS(rv, rv);
  
      if (selitem == item)
 @@ -592,33 +592,33 @@ nsXFormsSelectableAccessible::SelectAllS
    return sXFormsService->SelectAllItemsForSelect(mDOMNode);
@@ -9652,27 +9652,27 @@ diff --git a/accessible/src/xforms/nsXFo
                                               nsIAccessible *aAccessible)
  {
 -  nsCOMPtr<nsIAccessible> accessible(aAccessible ? aAccessible : this);
 -
 -  nsCOMPtr<nsIAccessible> curAccChild;
 -  accessible->GetFirstChild(getter_AddRefs(curAccChild));
 +  nsIAccessible* accessible(aAccessible ? aAccessible : this);
 +
-+  nsIAccessible* curAccChild;
++  nsIAccessible* curAccChild = nsnull;
 +  accessible->GetFirstChild(&curAccChild);
  
    while (curAccChild) {
 -    nsCOMPtr<nsIAccessNode> curAccNodeChild(do_QueryInterface(curAccChild));
 +    nsIAccessNode* curAccNodeChild(do_QueryInterface(curAccChild));
      if (curAccNodeChild) {
 -      nsCOMPtr<nsIDOMNode> curChildNode;
 -      curAccNodeChild->GetDOMNode(getter_AddRefs(curChildNode));
 -      nsCOMPtr<nsIContent> curChildContent(do_QueryInterface(curChildNode));
-+      nsIDOMNode* curChildNode;
++      nsIDOMNode* curChildNode = nsnull;
 +      curAccNodeChild->GetDOMNode(&curChildNode);
 +      nsIContent* curChildContent(do_QueryInterface(curChildNode));
        if (curChildContent) {
 -        nsCOMPtr<nsINodeInfo> nodeInfo = curChildContent->NodeInfo();
 +        nsINodeInfo* nodeInfo = curChildContent->NodeInfo();
          if (nodeInfo->NamespaceEquals(NS_LITERAL_STRING(NS_NAMESPACE_XFORMS))) {
            if (nodeInfo->Equals(nsAccessibilityAtoms::item)) {
              if (!*aIndex) {
@@ -9690,17 +9690,17 @@ diff --git a/accessible/src/xforms/nsXFo
            }
 @@ -626,9 +626,9 @@ nsXFormsSelectableAccessible::GetItemByI
        }
      }
  
 -    nsCOMPtr<nsIAccessible> nextAccChild;
 -    curAccChild->GetNextSibling(getter_AddRefs(nextAccChild));
 -    curAccChild.swap(nextAccChild);
-+    nsIAccessible* nextAccChild;
++    nsIAccessible* nextAccChild = nsnull;
 +    curAccChild->GetNextSibling(&nextAccChild);
 +    swap(curAccChild, nextAccChild);
    }
  
    return nsnull;
 @@ -672,17 +672,17 @@ nsXFormsSelectableItemAccessible::IsItem
  {
    nsresult rv;
@@ -9723,17 +9723,17 @@ diff --git a/accessible/src/xforms/nsXFo
      if (!select)
        continue;
  
 @@ -693,9 +693,9 @@ nsXFormsSelectableItemAccessible::IsItem
      }
  
      if (nodeinfo->Equals(nsAccessibilityAtoms::select1)) {
 -      nsCOMPtr<nsIDOMNode> selitem;
-+      nsIDOMNode* selitem;
++      nsIDOMNode* selitem = nsnull;
        rv = sXFormsService->GetSelectedItemForSelect1(select,
 -                                                     getter_AddRefs(selitem));
 +                                                     &selitem);
        return NS_SUCCEEDED(rv) && (selitem == mDOMNode);
      }
    }
 diff --git a/accessible/src/xforms/nsXFormsAccessible.h b/accessible/src/xforms/nsXFormsAccessible.h
 --- a/accessible/src/xforms/nsXFormsAccessible.h
@@ -9751,17 +9751,17 @@ diff --git a/accessible/src/xforms/nsXFo
 --- a/accessible/src/xforms/nsXFormsWidgetsAccessible.cpp
 +++ b/accessible/src/xforms/nsXFormsWidgetsAccessible.cpp
 @@ -195,8 +195,8 @@ void
  void
  nsXFormsComboboxPopupWidgetAccessible::CacheChildren()
  {
 -  nsCOMPtr<nsIDOMNode> parent;
 -  mDOMNode->GetParentNode(getter_AddRefs(parent));
-+  nsIDOMNode* parent;
++  nsIDOMNode* parent = nsnull;
 +  mDOMNode->GetParentNode(&parent);
  
    // Parent node must be an xforms:select1 element.
    CacheSelectChildren(parent);
 diff --git a/accessible/src/xul/nsXULColorPickerAccessible.cpp b/accessible/src/xul/nsXULColorPickerAccessible.cpp
 --- a/accessible/src/xul/nsXULColorPickerAccessible.cpp
 +++ b/accessible/src/xul/nsXULColorPickerAccessible.cpp
 @@ -75,7 +75,7 @@ nsXULColorPickerTileAccessible::GetState
@@ -9812,17 +9812,17 @@ diff --git a/accessible/src/xul/nsXULFor
    if (element) {
      PRBool isDefault = PR_FALSE;
      element->HasAttribute(NS_LITERAL_STRING("default"), &isDefault) ;
 @@ -182,7 +182,7 @@ void nsXULButtonAccessible::CacheChildre
      GetAllowsAnonChildAccessibles(&allowsAnonChildren);
      nsAccessibleTreeWalker walker(mWeakShell, mDOMNode, allowsAnonChildren);
      walker.GetFirstChild();
 -    nsCOMPtr<nsIAccessible> dropMarkerAccessible;
-+    nsIAccessible* dropMarkerAccessible;
++    nsIAccessible* dropMarkerAccessible = nsnull;
      while (walker.mState.accessible) {
        dropMarkerAccessible = walker.mState.accessible;
        walker.GetNextSibling();
 @@ -197,7 +197,7 @@ void nsXULButtonAccessible::CacheChildre
        if (NS_SUCCEEDED(dropMarkerAccessible->GetRole(&role)) &&
            role == nsIAccessibleRole::ROLE_PUSHBUTTON) {
          SetFirstChild(dropMarkerAccessible);
 -        nsCOMPtr<nsPIAccessible> privChildAcc = do_QueryInterface(dropMarkerAccessible);
@@ -9832,17 +9832,17 @@ diff --git a/accessible/src/xul/nsXULFor
          mAccChildCount = 1;
 @@ -231,9 +231,9 @@ PRBool nsXULDropmarkerAccessible::Dropma
  {
    PRBool isOpen = PR_FALSE;
  
 -  nsCOMPtr<nsIDOMNode> parentButtonNode;
 -  mDOMNode->GetParentNode(getter_AddRefs(parentButtonNode));
 -  nsCOMPtr<nsIDOMXULButtonElement> parentButtonElement(do_QueryInterface(parentButtonNode));
-+  nsIDOMNode* parentButtonNode;
++  nsIDOMNode* parentButtonNode = nsnull;
 +  mDOMNode->GetParentNode(&parentButtonNode);
 +  nsIDOMXULButtonElement* parentButtonElement(do_QueryInterface(parentButtonNode));
  
    if (parentButtonElement) {
      parentButtonElement->GetOpen(&isOpen);
 @@ -241,7 +241,7 @@ PRBool nsXULDropmarkerAccessible::Dropma
        parentButtonElement->SetOpen(!isOpen);
    }
@@ -9861,34 +9861,34 @@ diff --git a/accessible/src/xul/nsXULFor
    if (xulCheckboxElement) {
      PRBool checked = PR_FALSE;
      xulCheckboxElement->GetChecked(&checked);
 @@ -412,9 +412,9 @@ nsXULGroupboxAccessible::GetName(nsAStri
  {
    aName.Truncate();
  
 -  nsCOMPtr<nsIAccessible> label;
-+  nsIAccessible* label;
++  nsIAccessible* label = nsnull;
    GetAccessibleRelated(nsIAccessibleRelation::RELATION_LABELLED_BY,
 -                       getter_AddRefs(label));
 +                       &label);
    if (label) {
      return label->GetName(aName);
    }
 @@ -438,13 +438,13 @@ nsXULGroupboxAccessible::GetAccessibleRe
      // The label for xul:groupbox is generated from xul:label that is
      // inside the anonymous content of the xul:caption.
      // The xul:label has an accessible object but the xul:caption does not
 -    nsCOMPtr<nsIAccessible> testLabelAccessible;
-+    nsIAccessible* testLabelAccessible;
++    nsIAccessible* testLabelAccessible = nsnull;
      while (NextChild(testLabelAccessible)) {
        if (Role(testLabelAccessible) == nsIAccessibleRole::ROLE_LABEL) {
          // Ensure that it's our label
 -        nsCOMPtr<nsIAccessible> testGroupboxAccessible;
-+        nsIAccessible* testGroupboxAccessible;
++        nsIAccessible* testGroupboxAccessible = nsnull;
          testLabelAccessible->GetAccessibleRelated(nsIAccessibleRelation::RELATION_LABEL_FOR,
 -                                                  getter_AddRefs(testGroupboxAccessible));
 +                                                  &testGroupboxAccessible);
          if (testGroupboxAccessible == this) {
            // The <label> points back to this groupbox
            *aRelated = testLabelAccessible;
 @@ -490,7 +490,7 @@ NS_IMETHODIMP nsXULProgressMeterAccessib
    if (!aValue.IsEmpty()) {
@@ -9925,18 +9925,18 @@ diff --git a/accessible/src/xul/nsXULFor
 +  nsIAccessible* parent(GetParent());
    PRInt32 setSize = 0;
    PRInt32 posInSet = 0;
  
    if (parent) {
 -    nsCOMPtr<nsIAccessible> sibling;
 -    nsCOMPtr<nsIAccessible> tempSibling;
 -    parent->GetFirstChild(getter_AddRefs(sibling));
-+    nsIAccessible* sibling;
-+    nsIAccessible* tempSibling;
++    nsIAccessible* sibling = nsnull;
++    nsIAccessible* tempSibling = nsnull;
 +    parent->GetFirstChild(&sibling);
      while (sibling) {
        if (IsSeparator(sibling)) { // end of a group of buttons
          if (posInSet)
 @@ -678,8 +678,8 @@ nsXULToolbarButtonAccessible::GetAttribu
          if (sibling == this)
            posInSet = setSize; // we've found our button
        }
@@ -9950,17 +9950,17 @@ diff --git a/accessible/src/xul/nsXULFor
 @@ -691,10 +691,10 @@ PRBool
  PRBool
  nsXULToolbarButtonAccessible::IsSeparator(nsIAccessible *aAccessible)
  {
 -  nsCOMPtr<nsIDOMNode> domNode;
 -  nsCOMPtr<nsIAccessNode> accessNode(do_QueryInterface(aAccessible));
 -  accessNode->GetDOMNode(getter_AddRefs(domNode));
 -  nsCOMPtr<nsIContent> contentDomNode(do_QueryInterface(domNode));
-+  nsIDOMNode* domNode;
++  nsIDOMNode* domNode = nsnull;
 +  nsIAccessNode* accessNode(do_QueryInterface(aAccessible));
 +  accessNode->GetDOMNode(&domNode);
 +  nsIContent* contentDomNode(do_QueryInterface(domNode));
  
    if (!contentDomNode)
      return PR_FALSE;
 @@ -771,26 +771,26 @@ NS_IMETHODIMP nsXULTextFieldAccessible::
    if (state & nsIAccessibleStates::STATE_PROTECTED)    // Don't return password text!
@@ -10071,25 +10071,25 @@ diff --git a/accessible/src/xul/nsXULMen
 +++ b/accessible/src/xul/nsXULMenuAccessible.cpp
 @@ -79,14 +79,14 @@ nsresult nsXULSelectableAccessible::Chan
    if (!mSelectControl) {
      return NS_ERROR_FAILURE;
    }
 -  nsCOMPtr<nsIAccessible> childAcc;
 -  GetChildAt(aIndex, getter_AddRefs(childAcc));
 -  nsCOMPtr<nsIAccessNode> accNode = do_QueryInterface(childAcc);
-+  nsIAccessible* childAcc;
++  nsIAccessible* childAcc = nsnull;
 +  GetChildAt(aIndex, &childAcc);
 +  nsIAccessNode* accNode = do_QueryInterface(childAcc);
    NS_ENSURE_TRUE(accNode, NS_ERROR_FAILURE);
  
 -  nsCOMPtr<nsIDOMNode> childNode;
 -  accNode->GetDOMNode(getter_AddRefs(childNode));
 -  nsCOMPtr<nsIDOMXULSelectControlItemElement> item(do_QueryInterface(childNode));
-+  nsIDOMNode* childNode;
++  nsIDOMNode* childNode = nsnull;
 +  accNode->GetDOMNode(&childNode);
 +  nsIDOMXULSelectControlItemElement* item(do_QueryInterface(childNode));
    NS_ENSURE_TRUE(item, NS_ERROR_FAILURE);
  
    item->GetSelected(aSelState);
 @@ -94,7 +94,7 @@ nsresult nsXULSelectableAccessible::Chan
      return NS_OK;
    }
@@ -10112,55 +10112,55 @@ diff --git a/accessible/src/xul/nsXULMen
      do_CreateInstance(NS_ARRAY_CONTRACTID);
    NS_ENSURE_STATE(selectedAccessibles);
  
    // For XUL multi-select control
 -  nsCOMPtr<nsIDOMXULMultiSelectControlElement> xulMultiSelect =
 +  nsIDOMXULMultiSelectControlElement* xulMultiSelect =
      do_QueryInterface(mSelectControl);
 -  nsCOMPtr<nsIAccessible> selectedAccessible;
-+  nsIAccessible* selectedAccessible;
++  nsIAccessible* selectedAccessible = nsnull;
    if (xulMultiSelect) {
      PRInt32 length = 0;
      xulMultiSelect->GetSelectedCount(&length);
      for (PRInt32 index = 0; index < length; index++) {
 -      nsCOMPtr<nsIDOMXULSelectControlItemElement> selectedItem;
 -      xulMultiSelect->GetSelectedItem(index, getter_AddRefs(selectedItem));
 -      nsCOMPtr<nsIDOMNode> selectedNode(do_QueryInterface(selectedItem));
-+      nsIDOMXULSelectControlItemElement* selectedItem;
++      nsIDOMXULSelectControlItemElement* selectedItem = nsnull;
 +      xulMultiSelect->GetSelectedItem(index, &selectedItem);
 +      nsIDOMNode* selectedNode(do_QueryInterface(selectedItem));
        accService->GetAccessibleInWeakShell(selectedNode, mWeakShell,
 -                                           getter_AddRefs(selectedAccessible));
 +                                           &selectedAccessible);
        if (selectedAccessible)
          selectedAccessibles->AppendElement(selectedAccessible, PR_FALSE);
      }
    }
    else {  // Single select?
 -    nsCOMPtr<nsIDOMXULSelectControlItemElement> selectedItem;
 -    mSelectControl->GetSelectedItem(getter_AddRefs(selectedItem));
 -    nsCOMPtr<nsIDOMNode> selectedNode(do_QueryInterface(selectedItem));
-+    nsIDOMXULSelectControlItemElement* selectedItem;
++    nsIDOMXULSelectControlItemElement* selectedItem = nsnull;
 +    mSelectControl->GetSelectedItem(&selectedItem);
 +    nsIDOMNode* selectedNode(do_QueryInterface(selectedItem));
      if(selectedNode) {
        accService->GetAccessibleInWeakShell(selectedNode, mWeakShell,
 -                                           getter_AddRefs(selectedAccessible));
 +                                           &selectedAccessible);
        if (selectedAccessible)
          selectedAccessibles->AppendElement(selectedAccessible, PR_FALSE);
      }
 @@ -169,17 +169,17 @@ NS_IMETHODIMP nsXULSelectableAccessible:
      return NS_ERROR_FAILURE;
    }
  
 -  nsCOMPtr<nsIDOMXULSelectControlItemElement> selectedItem;
 -  nsCOMPtr<nsIDOMXULMultiSelectControlElement> xulMultiSelect =
-+  nsIDOMXULSelectControlItemElement* selectedItem;
++  nsIDOMXULSelectControlItemElement* selectedItem = nsnull;
 +  nsIDOMXULMultiSelectControlElement* xulMultiSelect =
      do_QueryInterface(mSelectControl);
    if (xulMultiSelect)
 -    xulMultiSelect->GetSelectedItem(aIndex, getter_AddRefs(selectedItem));
 +    xulMultiSelect->GetSelectedItem(aIndex, &selectedItem);
  
    if (aIndex == 0)
 -    mSelectControl->GetSelectedItem(getter_AddRefs(selectedItem));
@@ -10226,17 +10226,17 @@ diff --git a/accessible/src/xul/nsXULMen
          State(parentAccessible) & nsIAccessibleStates::STATE_INVISIBLE) {
        isCollapsed = PR_TRUE;
 @@ -345,8 +345,8 @@ nsXULMenuitemAccessible::GetState(PRUint
        // Selected and collapsed?
        if (isCollapsed) {
          // Set selected option offscreen/invisible according to combobox state
 -        nsCOMPtr<nsIAccessible> grandParentAcc;
 -        parentAccessible->GetParent(getter_AddRefs(grandParentAcc));
-+        nsIAccessible* grandParentAcc;
++        nsIAccessible* grandParentAcc = nsnull;
 +        parentAccessible->GetParent(&grandParentAcc);
          NS_ENSURE_TRUE(grandParentAcc, NS_ERROR_FAILURE);
          NS_ASSERTION((Role(grandParentAcc) == nsIAccessibleRole::ROLE_COMBOBOX),
                       "grandparent of combobox listitem is not combobox");
 @@ -369,7 +369,7 @@ nsXULMenuitemAccessible::GetState(PRUint
  
  NS_IMETHODIMP nsXULMenuitemAccessible::GetName(nsAString& _retval)
  {
@@ -10300,17 +10300,17 @@ diff --git a/accessible/src/xul/nsXULMen
      return NS_ERROR_FAILURE;
    nsAutoString menuItemType;
 @@ -587,8 +587,8 @@ nsXULMenupopupAccessible::nsXULMenupopup
    nsXULSelectableAccessible(aDOMNode, aShell)
  { 
    // May be the anonymous <menupopup> inside <menulist> (a combobox)
 -  nsCOMPtr<nsIDOMNode> parentNode;
 -  aDOMNode->GetParentNode(getter_AddRefs(parentNode));
-+  nsIDOMNode* parentNode;
++  nsIDOMNode* parentNode = nsnull;
 +  aDOMNode->GetParentNode(&parentNode);
    mSelectControl = do_QueryInterface(parentNode);
  }
  
 @@ -625,7 +625,7 @@ nsXULMenupopupAccessible::GetState(PRUin
    return NS_OK;
  }
  
@@ -10319,34 +10319,34 @@ diff --git a/accessible/src/xul/nsXULMen
  nsXULMenupopupAccessible::FindInNodeList(nsIDOMNodeList *aNodeList, 
                                           nsIAtom *aAtom, PRUint32 aNameSpaceID)
  {
 @@ -633,10 +633,10 @@ nsXULMenupopupAccessible::FindInNodeList
    if (!aNodeList || NS_FAILED(aNodeList->GetLength(&numChildren))) {
      return nsnull;
    }
 -  nsCOMPtr<nsIDOMNode> childNode;
-+  nsIDOMNode* childNode;
++  nsIDOMNode* childNode = nsnull;
    for (PRUint32 childIndex = 0; childIndex < numChildren; childIndex++) {
 -    aNodeList->Item(childIndex, getter_AddRefs(childNode));
 -    nsCOMPtr<nsIContent> content = do_QueryInterface(childNode);
 +    aNodeList->Item(childIndex, &childNode);
 +    nsIContent* content = do_QueryInterface(childNode);
      if (content && content->NodeInfo()->Equals(aAtom, kNameSpaceID_XUL)) {
        nsIDOMNode *matchNode = childNode;
        return matchNode;
 @@ -649,12 +649,12 @@ void nsXULMenupopupAccessible::GenerateM
  {
    // Set menugenerated="true" on the menupopup node to generate the
    // sub-menu items if they have not been generated
 -  nsCOMPtr<nsIDOMNodeList> nodeList;
 -  aNode->GetChildNodes(getter_AddRefs(nodeList));
 -
 -  nsCOMPtr<nsIDOMNode> menuPopup = FindInNodeList(nodeList, nsAccessibilityAtoms::menupopup,
-+  nsIDOMNodeList* nodeList;
++  nsIDOMNodeList* nodeList = nsnull;
 +  aNode->GetChildNodes(&nodeList);
 +
 +  nsIDOMNode* menuPopup = FindInNodeList(nodeList, nsAccessibilityAtoms::menupopup,
                                                    kNameSpaceID_XUL);
 -  nsCOMPtr<nsIDOMElement> popupElement(do_QueryInterface(menuPopup));
 +  nsIDOMElement* popupElement(do_QueryInterface(menuPopup));
    if (popupElement) {
      nsAutoString attr;
@@ -10397,17 +10397,17 @@ diff --git a/accessible/src/xul/nsXULSel
  NS_IMETHODIMP nsXULListboxAccessible::GetValue(nsAString& _retval)
  {
    _retval.Truncate();
 -  nsCOMPtr<nsIDOMXULSelectControlElement> select(do_QueryInterface(mDOMNode));
 +  nsIDOMXULSelectControlElement* select(do_QueryInterface(mDOMNode));
    if (select) {
 -    nsCOMPtr<nsIDOMXULSelectControlItemElement> selectedItem;
 -    select->GetSelectedItem(getter_AddRefs(selectedItem));
-+    nsIDOMXULSelectControlItemElement* selectedItem;
++    nsIDOMXULSelectControlItemElement* selectedItem = nsnull;
 +    select->GetSelectedItem(&selectedItem);
      if (selectedItem)
        return selectedItem->GetLabel(_retval);
    }
 @@ -206,7 +206,7 @@ nsXULMenuitemAccessible(aDOMNode, aShell
  nsXULMenuitemAccessible(aDOMNode, aShell)
  {
    mIsCheckbox = PR_FALSE;
@@ -10418,17 +10418,17 @@ diff --git a/accessible/src/xul/nsXULSel
      nsresult res = listItem->GetAttribute(NS_LITERAL_STRING("type"), typeString);
 @@ -227,9 +227,9 @@ NS_IMETHODIMP nsXULListitemAccessible::G
    if (!mDOMNode)
      return NS_ERROR_FAILURE;
  
 -  nsCOMPtr<nsIDOMNode> child;
 -  if (NS_SUCCEEDED(mDOMNode->GetFirstChild(getter_AddRefs(child)))) {
 -    nsCOMPtr<nsIDOMElement> childElement (do_QueryInterface(child));
-+  nsIDOMNode* child;
++  nsIDOMNode* child = nsnull;
 +  if (NS_SUCCEEDED(mDOMNode->GetFirstChild(&child))) {
 +    nsIDOMElement* childElement (do_QueryInterface(child));
      if (childElement) {
        nsAutoString tagName;
        childElement->GetLocalName(tagName);
 @@ -267,7 +267,7 @@ nsXULListitemAccessible::GetState(PRUint
  
    *aState = nsIAccessibleStates::STATE_FOCUSABLE |
@@ -10472,26 +10472,26 @@ diff --git a/accessible/src/xul/nsXULSel
 -  nsCOMPtr<nsIDOMXULMenuListElement> menuList(do_QueryInterface(mDOMNode));
 +  nsIDOMXULMenuListElement* menuList(do_QueryInterface(mDOMNode));
    if (!menuList) {
      return NS_ERROR_FAILURE;  // Shut down
    }
 -  nsCOMPtr<nsIDOMXULSelectControlItemElement> focusedOption;
 -  menuList->GetSelectedItem(getter_AddRefs(focusedOption));
 -  nsCOMPtr<nsIDOMNode> focusedOptionNode(do_QueryInterface(focusedOption));
-+  nsIDOMXULSelectControlItemElement* focusedOption;
++  nsIDOMXULSelectControlItemElement* focusedOption = nsnull;
 +  menuList->GetSelectedItem(&focusedOption);
 +  nsIDOMNode* focusedOptionNode(do_QueryInterface(focusedOption));
    if (focusedOptionNode) {
 -    nsCOMPtr<nsIAccessibilityService> accService = 
 +    nsIAccessibilityService* accService = 
        do_GetService("@mozilla.org/accessibilityService;1");
      NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
 -    nsCOMPtr<nsIAccessible> focusedOptionAccessible;
-+    nsIAccessible* focusedOptionAccessible;
++    nsIAccessible* focusedOptionAccessible = nsnull;
      accService->GetAccessibleInWeakShell(focusedOptionNode, mWeakShell, 
 -                                        getter_AddRefs(focusedOptionAccessible));
 +                                        &focusedOptionAccessible);
      NS_ENSURE_TRUE(focusedOptionAccessible, NS_ERROR_FAILURE);
      return focusedOptionAccessible->GetDescription(aDescription);
    }
 @@ -423,7 +423,7 @@ nsXULComboboxAccessible::GetAllowsAnonCh
    if (!mDOMNode)
@@ -10532,17 +10532,17 @@ diff --git a/accessible/src/xul/nsXULSli
  nsXULSliderAccessible::GetSliderNode()
  {
    if (!mDOMNode)
      return nsnull;
  
    if (!mSliderNode) {
 -    nsCOMPtr<nsIDOMDocument> document;
 -    mDOMNode->GetOwnerDocument(getter_AddRefs(document));
-+    nsIDOMDocument* document;
++    nsIDOMDocument* document = nsnull;
 +    mDOMNode->GetOwnerDocument(&document);
      if (!document)
        return nsnull;
  
 -    nsCOMPtr<nsIDOMDocumentXBL> xblDoc(do_QueryInterface(document));
 +    nsIDOMDocumentXBL* xblDoc(do_QueryInterface(document));
      if (!xblDoc)
        return nsnull;
@@ -10637,17 +10637,17 @@ diff --git a/accessible/src/xul/nsXULTex
      return NS_ERROR_FAILURE;  // Node shut down
    }
 @@ -101,10 +101,10 @@ nsXULTextAccessible::GetAccessibleRelate
      // Caption is the label for groupbox
      nsIContent *parent = content->GetParent();
      if (parent && parent->Tag() == nsAccessibilityAtoms::caption) {
 -      nsCOMPtr<nsIAccessible> parentAccessible;
 -      GetParent(getter_AddRefs(parentAccessible));
-+      nsIAccessible* parentAccessible;
++      nsIAccessible* parentAccessible = nsnull;
 +      GetParent(&parentAccessible);
        if (Role(parentAccessible) == nsIAccessibleRole::ROLE_GROUPING) {
 -        parentAccessible.swap(*aRelated);
 +        swap(parentAccessible, *aRelated);
        }
      }
    }
 @@ -161,7 +161,7 @@ NS_IMETHODIMP nsXULLinkAccessible::GetVa
@@ -10673,37 +10673,37 @@ diff --git a/accessible/src/xul/nsXULTre
 +++ b/accessible/src/xul/nsXULTreeAccessible.cpp
 @@ -54,38 +54,38 @@
  /* static */
  PRBool nsXULTreeAccessible::IsColumnHidden(nsITreeColumn *aColumn)
  {
 -  nsCOMPtr<nsIDOMElement> element;
 -  aColumn->GetElement(getter_AddRefs(element));
 -  nsCOMPtr<nsIContent> content = do_QueryInterface(element);
-+  nsIDOMElement* element;
++  nsIDOMElement* element = nsnull;
 +  aColumn->GetElement(&element);
 +  nsIContent* content = do_QueryInterface(element);
    return content->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::hidden,
                                nsAccessibilityAtoms::_true, eCaseMatters);
  }
  
  /* static */
 -already_AddRefed<nsITreeColumn> nsXULTreeAccessible::GetNextVisibleColumn(nsITreeColumn *aColumn)
 +nsITreeColumn* nsXULTreeAccessible::GetNextVisibleColumn(nsITreeColumn *aColumn)
  {
    // Skip hidden columns.
 -  nsCOMPtr<nsITreeColumn> nextColumn;
 -  aColumn->GetNext(getter_AddRefs(nextColumn));
-+  nsITreeColumn* nextColumn;
++  nsITreeColumn* nextColumn = nsnull;
 +  aColumn->GetNext(&nextColumn);
    while (nextColumn && IsColumnHidden(nextColumn)) {
 -    nsCOMPtr<nsITreeColumn> tempColumn;
 -    nextColumn->GetNext(getter_AddRefs(tempColumn));
 -    nextColumn.swap(tempColumn);
-+    nsITreeColumn* tempColumn;
++    nsITreeColumn* tempColumn = nsnull;
 +    nextColumn->GetNext(&tempColumn);
 +    swap(nextColumn, tempColumn);
    }
  
    nsITreeColumn *retCol = nsnull;
 -  nextColumn.swap(retCol);
 +  swap(nextColumn, retCol);
    return retCol;
@@ -10712,18 +10712,18 @@ diff --git a/accessible/src/xul/nsXULTre
  /* static */
 -already_AddRefed<nsITreeColumn> nsXULTreeAccessible::GetFirstVisibleColumn(nsITreeBoxObject *aTree)
 -{
 -  nsCOMPtr<nsITreeColumns> cols;
 -  nsCOMPtr<nsITreeColumn> column;
 -  aTree->GetColumns(getter_AddRefs(cols));
 +nsITreeColumn* nsXULTreeAccessible::GetFirstVisibleColumn(nsITreeBoxObject *aTree)
 +{
-+  nsITreeColumns* cols;
-+  nsITreeColumn* column;
++  nsITreeColumns* cols = nsnull;
++  nsITreeColumn* column = nsnull;
 +  aTree->GetColumns(&cols);
    if (cols) {
 -    cols->GetFirstColumn(getter_AddRefs(column));
 +    cols->GetFirstColumn(&column);
    }
  
    if (column && IsColumnHidden(column)) {
 @@ -94,30 +94,30 @@ already_AddRefed<nsITreeColumn> nsXULTre
@@ -10738,61 +10738,61 @@ diff --git a/accessible/src/xul/nsXULTre
  /* static */
 -already_AddRefed<nsITreeColumn> nsXULTreeAccessible::GetLastVisibleColumn(nsITreeBoxObject *aTree)
 -{
 -  nsCOMPtr<nsITreeColumns> cols;
 -  nsCOMPtr<nsITreeColumn> column;
 -  aTree->GetColumns(getter_AddRefs(cols));
 +nsITreeColumn* nsXULTreeAccessible::GetLastVisibleColumn(nsITreeBoxObject *aTree)
 +{
-+  nsITreeColumns* cols;
-+  nsITreeColumn* column;
++  nsITreeColumns* cols = nsnull;
++  nsITreeColumn* column = nsnull;
 +  aTree->GetColumns(&cols);
    if (cols) {
 -    cols->GetLastColumn(getter_AddRefs(column));
 +    cols->GetLastColumn(&column);
    }
  
    // Skip hidden columns.
    while (column && IsColumnHidden(column)) {
 -    nsCOMPtr<nsITreeColumn> tempColumn;
 -    column->GetPrevious(getter_AddRefs(tempColumn));
 -    column.swap(tempColumn);
-+    nsITreeColumn* tempColumn;
++    nsITreeColumn* tempColumn = nsnull;
 +    column->GetPrevious(&tempColumn);
 +    swap(column, tempColumn);
    }
    NS_ENSURE_TRUE(column, nsnull);
  
    nsITreeColumn *retCol = nsnull;
 -  column.swap(retCol);
 +  swap(column, retCol);
    return retCol;
  }
  
 @@ -144,7 +144,7 @@ void nsXULTreeAccessible::GetTreeBoxObje
  void nsXULTreeAccessible::GetTreeBoxObject(nsIDOMNode *aDOMNode, nsITreeBoxObject **aBoxObject)
  {
    nsAutoString name;
 -  nsCOMPtr<nsIDOMNode> parentNode, currentNode;
-+  nsIDOMNode* parentNode, *currentNode;
++  nsIDOMNode* parentNode = nsnull, *currentNode = nsnull;
  
    // Find DOMNode's parents recursively until reach the <tree> tag
    currentNode = aDOMNode;
 @@ -152,18 +152,18 @@ void nsXULTreeAccessible::GetTreeBoxObje
      currentNode->GetLocalName(name);
      if (name.EqualsLiteral("tree")) {
        // We will get the nsITreeBoxObject from the tree node
 -      nsCOMPtr<nsIDOMXULElement> xulElement(do_QueryInterface(currentNode));
 +      nsIDOMXULElement* xulElement(do_QueryInterface(currentNode));
        if (xulElement) {
 -        nsCOMPtr<nsIBoxObject> box;
 -        xulElement->GetBoxObject(getter_AddRefs(box));
 -        nsCOMPtr<nsITreeBoxObject> treeBox(do_QueryInterface(box));
-+        nsIBoxObject* box;
++        nsIBoxObject* box = nsnull;
 +        xulElement->GetBoxObject(&box);
 +        nsITreeBoxObject* treeBox(do_QueryInterface(box));
          if (treeBox) {
            *aBoxObject = treeBox;
            return;
          }
        }
      }
@@ -10811,33 +10811,33 @@ diff --git a/accessible/src/xul/nsXULTre
      // the default selection type is multiple
      nsAutoString selType;
 @@ -200,21 +200,21 @@ NS_IMETHODIMP nsXULTreeAccessible::GetVa
  
    NS_ENSURE_TRUE(mTree && mTreeView, NS_ERROR_FAILURE);
  
 -  nsCOMPtr<nsITreeSelection> selection;
 -  mTreeView->GetSelection(getter_AddRefs(selection));
-+  nsITreeSelection* selection;
++  nsITreeSelection* selection = nsnull;
 +  mTreeView->GetSelection(&selection);
    if (! selection)
      return NS_ERROR_FAILURE;
  
    PRInt32 currentIndex;
 -  nsCOMPtr<nsIDOMElement> selectItem;
-+  nsIDOMElement* selectItem;
++  nsIDOMElement* selectItem = nsnull;
    selection->GetCurrentIndex(&currentIndex);
    if (currentIndex >= 0) {
 -    nsCOMPtr<nsITreeColumn> keyCol;
 -
 -    nsCOMPtr<nsITreeColumns> cols;
 -    mTree->GetColumns(getter_AddRefs(cols));
-+    nsITreeColumn* keyCol;
-+
-+    nsITreeColumns* cols;
++    nsITreeColumn* keyCol = nsnull;
++
++    nsITreeColumns* cols = nsnull;
 +    mTree->GetColumns(&cols);
      if (cols)
 -      cols->GetKeyColumn(getter_AddRefs(keyCol));
 +      cols->GetKeyColumn(&keyCol);
  
      return mTreeView->GetCellText(currentIndex, keyCol, _retval);
    }
 @@ -261,7 +261,7 @@ NS_IMETHODIMP nsXULTreeAccessible::GetFi
@@ -10876,89 +10876,89 @@ diff --git a/accessible/src/xul/nsXULTre
  
    nsIFrame *rootFrame = presShell->GetRootFrame();
    NS_ENSURE_STATE(rootFrame);
 @@ -341,9 +341,9 @@ nsXULTreeAccessible::GetChildAtPoint(PRI
      presContext->DevPixelsToAppUnits(aY - rootRect.y));
  
    PRInt32 row = -1;
 -  nsCOMPtr<nsITreeColumn> column;
-+  nsITreeColumn* column;
++  nsITreeColumn* column = nsnull;
    nsCAutoString childEltUnused;
 -  mTree->GetCellAt(clientX, clientY, &row, getter_AddRefs(column),
 +  mTree->GetCellAt(clientX, clientY, &row, &column,
                     childEltUnused);
  
    // If we failed to find tree cell for the given point then it might be
 @@ -361,11 +361,11 @@ NS_IMETHODIMP nsXULTreeAccessible::GetSe
  
    NS_ENSURE_TRUE(mTree && mTreeView, NS_ERROR_FAILURE);
  
 -  nsCOMPtr<nsITreeSelection> selection;
 -  mTreeView->GetSelection(getter_AddRefs(selection));
-+  nsITreeSelection* selection;
++  nsITreeSelection* selection = nsnull;
 +  mTreeView->GetSelection(&selection);
    if (!selection)
      return NS_ERROR_FAILURE;
 -  nsCOMPtr<nsIMutableArray> selectedAccessibles =
 +  nsIMutableArray* selectedAccessibles =
      do_CreateInstance(NS_ARRAY_CONTRACTID);
    NS_ENSURE_STATE(selectedAccessibles);
  
 @@ -375,8 +375,8 @@ NS_IMETHODIMP nsXULTreeAccessible::GetSe
    for (rowIndex = 0; rowIndex < rowCount; rowIndex++) {
      selection->IsSelected(rowIndex, &isSelected);
      if (isSelected) {
 -      nsCOMPtr<nsIAccessible> tempAccess;
 -      if (NS_FAILED(GetCachedTreeitemAccessible(rowIndex, nsnull, getter_AddRefs(tempAccess))) || !tempAccess)
-+      nsIAccessible* tempAccess;
++      nsIAccessible* tempAccess = nsnull;
 +      if (NS_FAILED(GetCachedTreeitemAccessible(rowIndex, nsnull, &tempAccess)) || !tempAccess)
  
          return NS_ERROR_OUT_OF_MEMORY;
        selectedAccessibles->AppendElement(tempAccess, PR_FALSE);
 @@ -398,8 +398,8 @@ NS_IMETHODIMP nsXULTreeAccessible::GetSe
  
    NS_ENSURE_TRUE(mTree && mTreeView, NS_ERROR_FAILURE);
  
 -  nsCOMPtr<nsITreeSelection> selection;
 -  mTreeView->GetSelection(getter_AddRefs(selection));
-+  nsITreeSelection* selection;
++  nsITreeSelection* selection = nsnull;
 +  mTreeView->GetSelection(&selection);
    if (selection)
      selection->GetCount(aSelectionCount);
  
 @@ -410,8 +410,8 @@ NS_IMETHODIMP nsXULTreeAccessible::Chang
  {
    NS_ENSURE_TRUE(mTree && mTreeView, NS_ERROR_FAILURE);
  
 -  nsCOMPtr<nsITreeSelection> selection;
 -  mTreeView->GetSelection(getter_AddRefs(selection));
-+  nsITreeSelection* selection;
++  nsITreeSelection* selection = nsnull;
 +  mTreeView->GetSelection(&selection);
    if (selection) {
      selection->IsSelected(aIndex, aSelState);
      if ((!(*aSelState) && eSelection_Add == aMethod) || 
 @@ -443,8 +443,8 @@ NS_IMETHODIMP nsXULTreeAccessible::Clear
  {
    NS_ENSURE_TRUE(mTree && mTreeView, NS_ERROR_FAILURE);
  
 -  nsCOMPtr<nsITreeSelection> selection;
 -  mTreeView->GetSelection(getter_AddRefs(selection));
-+  nsITreeSelection* selection;
++  nsITreeSelection* selection = nsnull;
 +  mTreeView->GetSelection(&selection);
    if (selection)
      selection->ClearSelection();
  
 @@ -457,8 +457,8 @@ NS_IMETHODIMP nsXULTreeAccessible::RefSe
  
    NS_ENSURE_TRUE(mTree && mTreeView, NS_ERROR_FAILURE);
  
 -  nsCOMPtr<nsITreeSelection> selection;
 -  mTreeView->GetSelection(getter_AddRefs(selection));
-+  nsITreeSelection* selection;
++  nsITreeSelection* selection = nsnull;
 +  mTreeView->GetSelection(&selection);
    if (!selection)
      return NS_ERROR_FAILURE;
  
 @@ -486,14 +486,14 @@ NS_IMETHODIMP nsXULTreeAccessible::Selec
    NS_ENSURE_TRUE(mTree && mTreeView, NS_ERROR_FAILURE);
  
    // see if we are multiple select if so set ourselves as such
@@ -10966,50 +10966,50 @@ diff --git a/accessible/src/xul/nsXULTre
 +  nsIDOMElement* element (do_QueryInterface(mDOMNode));
    if (element) {
      nsAutoString selType;
      element->GetAttribute(NS_LITERAL_STRING("seltype"), selType);
      if (selType.IsEmpty() || !selType.EqualsLiteral("single")) {
        *_retval = PR_TRUE;
 -      nsCOMPtr<nsITreeSelection> selection;
 -      mTreeView->GetSelection(getter_AddRefs(selection));
-+      nsITreeSelection* selection;
++      nsITreeSelection* selection = nsnull;
 +      mTreeView->GetSelection(&selection);
        if (selection)
          selection->SelectAll();
      }
 @@ -513,17 +513,17 @@ nsXULTreeAccessible::GetCachedTreeitemAc
    NS_ASSERTION(mAccessNodeCache, "No accessibility cache for tree");
    NS_ASSERTION(mTree && mTreeView, "Can't get mTree or mTreeView!\n");
  
 -  nsCOMPtr<nsITreeColumn> col;
-+  nsITreeColumn* col;
++  nsITreeColumn* col = nsnull;
  #ifdef MOZ_ACCESSIBILITY_ATK
    col = aColumn;
  #endif
    PRInt32 columnIndex = -1;
  
    if (!col && mTree) {
 -    nsCOMPtr<nsITreeColumns> cols;
 -    mTree->GetColumns(getter_AddRefs(cols));
-+    nsITreeColumns* cols;
++    nsITreeColumns* cols = nsnull;
 +    mTree->GetColumns(&cols);
      if (cols)
 -      cols->GetKeyColumn(getter_AddRefs(col));
 +      cols->GetKeyColumn(&col);
    }
  
    // Do not create accessible for treeitem if there is no column in the tree
 @@ -533,19 +533,19 @@ nsXULTreeAccessible::GetCachedTreeitemAc
  
    col->GetIndex(&columnIndex);
  
 -  nsCOMPtr<nsIAccessNode> accessNode;
 -  GetCacheEntry(*mAccessNodeCache, (void*)(aRow * kMaxTreeColumns + columnIndex), getter_AddRefs(accessNode));
-+  nsIAccessNode* accessNode;
++  nsIAccessNode* accessNode = nsnull;
 +  GetCacheEntry(*mAccessNodeCache, (void*)(aRow * kMaxTreeColumns + columnIndex), &accessNode);
    if (!accessNode)
    {
      accessNode = new nsXULTreeitemAccessibleWrap(this, mDOMNode, mWeakShell, aRow, col);
 -    nsCOMPtr<nsPIAccessNode> privateAccessNode(do_QueryInterface(accessNode));
 +    nsPIAccessNode* privateAccessNode(do_QueryInterface(accessNode));
      if (!privateAccessNode)
        return NS_ERROR_OUT_OF_MEMORY;
@@ -11023,39 +11023,39 @@ diff --git a/accessible/src/xul/nsXULTre
    return NS_OK;
  }
 @@ -553,8 +553,8 @@ nsresult nsXULTreeAccessible::GetColumnC
  nsresult nsXULTreeAccessible::GetColumnCount(nsITreeBoxObject* aBoxObject, PRInt32* aCount)
  {
    NS_ENSURE_TRUE(aBoxObject, NS_ERROR_FAILURE);
 -  nsCOMPtr<nsITreeColumns> treeColumns;
 -  aBoxObject->GetColumns(getter_AddRefs(treeColumns));
-+  nsITreeColumns* treeColumns;
++  nsITreeColumns* treeColumns = nsnull;
 +  aBoxObject->GetColumns(&treeColumns);
    NS_ENSURE_TRUE(treeColumns, NS_ERROR_FAILURE);
    return treeColumns->GetCount(aCount);
  }
 @@ -576,8 +576,8 @@ nsXULTreeitemAccessible::nsXULTreeitemAc
    mColumn = aColumn;
  
    if (!mColumn && mTree) {
 -    nsCOMPtr<nsITreeColumns> cols;
 -    mTree->GetColumns(getter_AddRefs(cols));
-+    nsITreeColumns* cols;
++    nsITreeColumns* cols = nsnull;
 +    mTree->GetColumns(&cols);
      if (cols)
        cols->GetKeyColumn(getter_AddRefs(mColumn));
    }
 @@ -648,8 +648,8 @@ nsXULTreeitemAccessible::GetState(PRUint
    }
  
    // get selected state
 -  nsCOMPtr<nsITreeSelection> selection;
 -  mTreeView->GetSelection(getter_AddRefs(selection));
-+  nsITreeSelection* selection;
++  nsITreeSelection* selection = nsnull;
 +  mTreeView->GetSelection(&selection);
    if (selection) {
      PRBool isSelected;
      selection->IsSelected(mRow, &isSelected);
 @@ -657,7 +657,7 @@ nsXULTreeitemAccessible::GetState(PRUint
        *aState |= nsIAccessibleStates::STATE_SELECTED;
    }
  
@@ -11069,17 +11069,17 @@ diff --git a/accessible/src/xul/nsXULTre
    NS_ENSURE_SUCCESS(rv, rv);
  
 -  nsCOMPtr<nsIDOMXULTreeElement> tree(do_QueryInterface(mDOMNode));
 +  nsIDOMXULTreeElement* tree(do_QueryInterface(mDOMNode));
    NS_ENSURE_TRUE(tree, NS_OK);
  
 -  nsCOMPtr<nsITreeView> view;
 -  tree->GetView(getter_AddRefs(view));
-+  nsITreeView* view;
++  nsITreeView* view = nsnull;
 +  tree->GetView(&view);
    NS_ENSURE_TRUE(view, NS_OK);
  
    PRInt32 level;
 @@ -830,7 +830,7 @@ NS_IMETHODIMP nsXULTreeitemAccessible::G
  
    NS_ENSURE_TRUE(mTree && mTreeView, NS_ERROR_FAILURE);
  
@@ -11088,17 +11088,17 @@ diff --git a/accessible/src/xul/nsXULTre
    NS_ENSURE_TRUE(treeCache, NS_ERROR_FAILURE);
  
    PRInt32 rowCount;
 @@ -845,7 +845,7 @@ NS_IMETHODIMP nsXULTreeitemAccessible::G
  
    nsresult rv = NS_OK;
    PRInt32 row = mRow;
 -  nsCOMPtr<nsITreeColumn> column;
-+  nsITreeColumn* column;
++  nsITreeColumn* column = nsnull;
  #ifdef MOZ_ACCESSIBILITY_ATK
    column = nsXULTreeAccessible::GetNextVisibleColumn(mColumn);
  
 @@ -877,7 +877,7 @@ NS_IMETHODIMP nsXULTreeitemAccessible::G
  
    NS_ENSURE_TRUE(mTree && mTreeView, NS_ERROR_FAILURE);
  
 -  nsCOMPtr<nsIAccessibleTreeCache> treeCache(do_QueryInterface(mParent));
@@ -11106,92 +11106,92 @@ diff --git a/accessible/src/xul/nsXULTre
    NS_ENSURE_TRUE(treeCache, NS_ERROR_FAILURE);
  
    if (!mColumn && mRow > 0)
 @@ -887,9 +887,9 @@ NS_IMETHODIMP nsXULTreeitemAccessible::G
  
  
    PRInt32 row = mRow;
 -  nsCOMPtr<nsITreeColumn> column;
-+  nsITreeColumn* column;
++  nsITreeColumn* column = nsnull;
  #ifdef MOZ_ACCESSIBILITY_ATK
 -  rv = mColumn->GetPrevious(getter_AddRefs(column));
 +  rv = mColumn->GetPrevious(&column);
    NS_ENSURE_SUCCESS(rv, rv);
    
    if (!column && mRow > 0) {
 @@ -919,8 +919,8 @@ NS_IMETHODIMP nsXULTreeitemAccessible::D
        rv = mTreeView->CycleCell(mRow, mColumn);
      } 
      else {
 -      nsCOMPtr<nsITreeSelection> selection;
 -      mTreeView->GetSelection(getter_AddRefs(selection));
-+      nsITreeSelection* selection;
++      nsITreeSelection* selection = nsnull;
 +      mTreeView->GetSelection(&selection);
        if (selection) {
          rv = selection->Select(mRow);
          mTree->EnsureRowIsVisible(mRow);
 @@ -946,28 +946,28 @@ NS_IMETHODIMP nsXULTreeitemAccessible::G
  
    // Get treechildren's BoxObject to adjust the Bounds' upper left corner
    // XXXvarga consider using mTree->GetTreeBody()
 -  nsCOMPtr<nsIBoxObject> boxObject(do_QueryInterface(mTree));
 +  nsIBoxObject* boxObject(do_QueryInterface(mTree));
    if (boxObject) {
 -    nsCOMPtr<nsIDOMElement> boxElement;
 -    boxObject->GetElement(getter_AddRefs(boxElement));
 -    nsCOMPtr<nsIDOMNode> boxNode(do_QueryInterface(boxElement));
-+    nsIDOMElement* boxElement;
++    nsIDOMElement* boxElement = nsnull;
 +    boxObject->GetElement(&boxElement);
 +    nsIDOMNode* boxNode(do_QueryInterface(boxElement));
      if (boxNode) {
 -      nsCOMPtr<nsIDOMNodeList> childNodes;
 -      boxNode->GetChildNodes(getter_AddRefs(childNodes));
-+      nsIDOMNodeList* childNodes;
++      nsIDOMNodeList* childNodes = nsnull;
 +      boxNode->GetChildNodes(&childNodes);
        if (childNodes) {
          nsAutoString name;
 -        nsCOMPtr<nsIDOMNode> childNode;
-+        nsIDOMNode* childNode;
++        nsIDOMNode* childNode = nsnull;
          PRUint32 childCount, childIndex;
  
          childNodes->GetLength(&childCount);
          for (childIndex = 0; childIndex < childCount; childIndex++) {
 -          childNodes->Item(childIndex, getter_AddRefs(childNode));
 +          childNodes->Item(childIndex, &childNode);
            childNode->GetLocalName(name);
            if (name.EqualsLiteral("treechildren")) {
 -            nsCOMPtr<nsIDOMXULElement> xulElement(do_QueryInterface(childNode));
 +            nsIDOMXULElement* xulElement(do_QueryInterface(childNode));
              if (xulElement) {
 -              nsCOMPtr<nsIBoxObject> box;
 -              xulElement->GetBoxObject(getter_AddRefs(box));
-+              nsIBoxObject* box;
++              nsIBoxObject* box = nsnull;
 +              xulElement->GetBoxObject(&box);
                if (box) {
                  PRInt32 myX, myY;
                  box->GetScreenX(&myX);
 @@ -990,8 +990,8 @@ NS_IMETHODIMP nsXULTreeitemAccessible::S
  {
    NS_ENSURE_TRUE(mTree && mTreeView, NS_ERROR_FAILURE);
  
 -  nsCOMPtr<nsITreeSelection> selection;
 -  mTreeView->GetSelection(getter_AddRefs(selection));
-+  nsITreeSelection* selection;
++  nsITreeSelection* selection = nsnull;
 +  mTreeView->GetSelection(&selection);
    if (selection) {
      PRBool isSelected;
      selection->IsSelected(mRow, &isSelected);
 @@ -1006,8 +1006,8 @@ NS_IMETHODIMP nsXULTreeitemAccessible::T
  { 
    NS_ENSURE_TRUE(mTree && mTreeView, NS_ERROR_FAILURE);
  
 -  nsCOMPtr<nsITreeSelection> selection;
 -  mTreeView->GetSelection(getter_AddRefs(selection));
-+  nsITreeSelection* selection;
++  nsITreeSelection* selection = nsnull;
 +  mTreeView->GetSelection(&selection);
    if (selection)
      selection->SetCurrentIndex(mRow);
  
 @@ -1031,7 +1031,7 @@ NS_IMETHODIMP nsXULTreeitemAccessible::G
            *aRelated = mParent;
            return NS_OK;
          } else {
@@ -11203,18 +11203,18 @@ diff --git a/accessible/src/xul/nsXULTre
 @@ -1060,18 +1060,18 @@ nsXULTreeColumnsAccessible::GetNextSibli
    nsresult ret = nsXULColumnsAccessible::GetNextSibling(aNextSibling);
  
    if (*aNextSibling == nsnull) { // if there is not other sibling, use the first row as its sibling
 -    nsCOMPtr<nsITreeBoxObject> tree;
 -    nsCOMPtr<nsITreeView> treeView;
 -
 -    nsXULTreeAccessible::GetTreeBoxObject(mDOMNode, getter_AddRefs(tree));
-+    nsITreeBoxObject* tree;
-+    nsITreeView* treeView;
++    nsITreeBoxObject* tree = nsnull;
++    nsITreeView* treeView = nsnull;
 +
 +    nsXULTreeAccessible::GetTreeBoxObject(mDOMNode, &tree);
      if (tree) {
 -      tree->GetView(getter_AddRefs(treeView));
 +      tree->GetView(&treeView);
        if (treeView) {
          PRInt32 rowCount;
          treeView->GetRowCount(&rowCount);
@@ -11246,17 +11246,17 @@ diff --git a/browser/app/nsBrowserApp.cp
 --- a/browser/app/nsBrowserApp.cpp
 +++ b/browser/app/nsBrowserApp.cpp
 @@ -105,8 +105,8 @@ int main(int argc, char* argv[])
  {
    ScopedLogging log;
  
 -  nsCOMPtr<nsILocalFile> appini;
 -  nsresult rv = XRE_GetBinaryPath(argv[0], getter_AddRefs(appini));
-+  nsILocalFile* appini;
++  nsILocalFile* appini = nsnull;
 +  nsresult rv = XRE_GetBinaryPath(argv[0], &appini);
    if (NS_FAILED(rv)) {
      Output("Couldn't calculate the application directory.");
      return 255;
 @@ -118,7 +118,7 @@ int main(int argc, char* argv[])
    char *appEnv = nsnull;
    const char *appDataFile = PR_GetEnv("XUL_APP_FILE");
    if (appDataFile && *appDataFile) {
@@ -11277,17 +11277,17 @@ diff --git a/browser/app/nsBrowserApp.cp
 diff --git a/browser/components/dirprovider/nsBrowserDirectoryProvider.cpp b/browser/components/dirprovider/nsBrowserDirectoryProvider.cpp
 --- a/browser/components/dirprovider/nsBrowserDirectoryProvider.cpp
 +++ b/browser/components/dirprovider/nsBrowserDirectoryProvider.cpp
 @@ -110,47 +110,47 @@ nsBrowserDirectoryProvider::GetFile(cons
    // NOTE: This function can be reentrant through the NS_GetSpecialDirectory
    // call, so be careful not to cause infinite recursion.
  
 -  nsCOMPtr<nsIFile> file;
-+  nsIFile* file;
++  nsIFile* file = nsnull;
  
    char const* leafName = nsnull;
  
    if (!strcmp(aKey, NS_APP_BOOKMARKS_50_FILE)) {
      leafName = "bookmarks.html";
  
 -    nsCOMPtr<nsIPrefBranch> prefs(do_GetService(NS_PREFSERVICE_CONTRACTID));
 +    nsIPrefBranch* prefs(do_GetService(NS_PREFSERVICE_CONTRACTID));
@@ -11334,17 +11334,17 @@ diff --git a/browser/components/dirprovi
      return NS_OK;
    }
    else {
 @@ -159,18 +159,18 @@ nsBrowserDirectoryProvider::GetFile(cons
  
    nsDependentCString leafstr(leafName);
  
 -  nsCOMPtr<nsIFile> parentDir;
-+  nsIFile* parentDir;
++  nsIFile* parentDir = nsnull;
    if (file) {
 -    rv = file->GetParent(getter_AddRefs(parentDir));
 +    rv = file->GetParent(&parentDir);
      if (NS_FAILED(rv))
        return rv;
    }
    else {
 -    rv = NS_GetSpecialDirectory(NS_APP_USER_PROFILE_50_DIR, getter_AddRefs(parentDir));
@@ -11361,78 +11361,78 @@ diff --git a/browser/components/dirprovi
        return rv;
  
 @@ -187,8 +187,8 @@ AppendFileKey(const char *key, nsIProper
  AppendFileKey(const char *key, nsIProperties* aDirSvc,
                nsCOMArray<nsIFile> &array)
  {
 -  nsCOMPtr<nsIFile> file;
 -  nsresult rv = aDirSvc->Get(key, NS_GET_IID(nsIFile), getter_AddRefs(file));
-+  nsIFile* file;
++  nsIFile* file = nsnull;
 +  nsresult rv = aDirSvc->Get(key, NS_GET_IID(nsIFile), (void**)&file);
    if (NS_FAILED(rv))
      return;
  
 @@ -220,10 +220,10 @@ static void
  static void
  AppendDistroSearchDirs(nsIProperties* aDirSvc, nsCOMArray<nsIFile> &array)
  {
 -  nsCOMPtr<nsIFile> searchPlugins;
-+  nsIFile* searchPlugins;
++  nsIFile* searchPlugins = nsnull;
    nsresult rv = aDirSvc->Get(NS_XPCOM_CURRENT_PROCESS_DIR,
                               NS_GET_IID(nsIFile),
 -                             getter_AddRefs(searchPlugins));
 +                             (void**)&searchPlugins);
    if (NS_FAILED(rv))
      return;
    searchPlugins->AppendNative(NS_LITERAL_CSTRING("distribution"));
 @@ -234,8 +234,8 @@ AppendDistroSearchDirs(nsIProperties* aD
    if (NS_FAILED(rv) || !exists)
      return;
  
 -  nsCOMPtr<nsIFile> commonPlugins;
 -  rv = searchPlugins->Clone(getter_AddRefs(commonPlugins));
-+  nsIFile* commonPlugins;
++  nsIFile* commonPlugins = nsnull;
 +  rv = searchPlugins->Clone(&commonPlugins);
    if (NS_SUCCEEDED(rv)) {
      commonPlugins->AppendNative(NS_LITERAL_CSTRING("common"));
      rv = commonPlugins->Exists(&exists);
 @@ -243,11 +243,11 @@ AppendDistroSearchDirs(nsIProperties* aD
          array.AppendObject(commonPlugins);
    }
  
 -  nsCOMPtr<nsIPrefBranch> prefs(do_GetService(NS_PREFSERVICE_CONTRACTID));
 +  nsIPrefBranch* prefs(do_GetService(NS_PREFSERVICE_CONTRACTID));
    if (prefs) {
  
 -    nsCOMPtr<nsIFile> localePlugins;
 -    rv = searchPlugins->Clone(getter_AddRefs(localePlugins));
-+    nsIFile* localePlugins;
++    nsIFile* localePlugins = nsnull;
 +    rv = searchPlugins->Clone(&localePlugins);
      if (NS_FAILED(rv))
        return;
  
 @@ -257,8 +257,8 @@ AppendDistroSearchDirs(nsIProperties* aD
      rv = prefs->GetCharPref("general.useragent.locale", getter_Copies(locale));
      if (NS_SUCCEEDED(rv)) {
  
 -      nsCOMPtr<nsIFile> curLocalePlugins;
 -      rv = localePlugins->Clone(getter_AddRefs(curLocalePlugins));
-+      nsIFile* curLocalePlugins;
++      nsIFile* curLocalePlugins = nsnull;
 +      rv = localePlugins->Clone(&curLocalePlugins);
        if (NS_SUCCEEDED(rv)) {
  
          curLocalePlugins->AppendNative(locale);
 @@ -276,8 +276,8 @@ AppendDistroSearchDirs(nsIProperties* aD
                              getter_Copies(defLocale));
      if (NS_SUCCEEDED(rv)) {
  
 -      nsCOMPtr<nsIFile> defLocalePlugins;
 -      rv = localePlugins->Clone(getter_AddRefs(defLocalePlugins));
-+      nsIFile* defLocalePlugins;
++      nsIFile* defLocalePlugins = nsnull;
 +      rv = localePlugins->Clone(&defLocalePlugins);
        if (NS_SUCCEEDED(rv)) {
  
          defLocalePlugins->AppendNative(defLocale);
 @@ -296,7 +296,7 @@ nsBrowserDirectoryProvider::GetFiles(con
    nsresult rv;
  
    if (!strcmp(aKey, NS_APP_SEARCH_DIR_LIST)) {
@@ -11446,22 +11446,22 @@ diff --git a/browser/components/dirprovi
      AppendFileKey(NS_APP_USER_SEARCH_DIR, dirSvc, baseFiles);
  
 -    nsCOMPtr<nsISimpleEnumerator> baseEnum;
 -    rv = NS_NewArrayEnumerator(getter_AddRefs(baseEnum), baseFiles);
 -    if (NS_FAILED(rv))
 -      return rv;
 -
 -    nsCOMPtr<nsISimpleEnumerator> list;
-+    nsISimpleEnumerator* baseEnum;
++    nsISimpleEnumerator* baseEnum = nsnull;
 +    rv = NS_NewArrayEnumerator(&baseEnum, baseFiles);
 +    if (NS_FAILED(rv))
 +      return rv;
 +
-+    nsISimpleEnumerator* list;
++    nsISimpleEnumerator* list = nsnull;
      rv = dirSvc->Get(XRE_EXTENSIONS_DIR_LIST,
 -                     NS_GET_IID(nsISimpleEnumerator), getter_AddRefs(list));
 +                     NS_GET_IID(nsISimpleEnumerator), (void**)&list);
      if (NS_FAILED(rv))
        return rv;
  
      static char const *const kAppendSPlugins[] = {"searchplugins", nsnull};
  
@@ -11491,17 +11491,17 @@ diff --git a/browser/components/dirprovi
 @@ -412,10 +412,10 @@ nsBrowserDirectoryProvider::AppendingEnu
  
    PRBool more;
    while (NS_SUCCEEDED(mBase->HasMoreElements(&more)) && more) {
 -    nsCOMPtr<nsISupports> nextbasesupp;
 -    mBase->GetNext(getter_AddRefs(nextbasesupp));
 -
 -    nsCOMPtr<nsIFile> nextbase(do_QueryInterface(nextbasesupp));
-+    nsISupports* nextbasesupp;
++    nsISupports* nextbasesupp = nsnull;
 +    mBase->GetNext(&nextbasesupp);
 +
 +    nsIFile* nextbase(do_QueryInterface(nextbasesupp));
      if (!nextbase)
        continue;
  
 diff --git a/browser/components/feeds/src/nsAboutFeeds.cpp b/browser/components/feeds/src/nsAboutFeeds.cpp
 --- a/browser/components/feeds/src/nsAboutFeeds.cpp
@@ -11511,34 +11511,34 @@ diff --git a/browser/components/feeds/sr
  
    nsresult rv;
 -  nsCOMPtr<nsIIOService> ios(do_GetIOService(&rv));
 +  nsIIOService* ios(do_GetIOService(&rv));
    if (NS_FAILED(rv))
      return rv;
  
 -  nsCOMPtr<nsIChannel> channel;
-+  nsIChannel* channel;
++  nsIChannel* channel = nsnull;
    rv = ios->NewChannel(NS_LITERAL_CSTRING(FEEDS_PAGE_URI),
 -                       nsnull, nsnull, getter_AddRefs(channel));
 +                       nsnull, nsnull, &channel);
    if (NS_FAILED(rv))
      return rv;
  
    channel->SetOriginalURI(uri);
  
 -  nsCOMPtr<nsIScriptSecurityManager> ssm =
 +  nsIScriptSecurityManager* ssm =
      do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID, &rv);
    if (NS_FAILED(rv))
      return rv;
  
 -  nsCOMPtr<nsIPrincipal> principal;
 -  rv = ssm->GetCodebasePrincipal(uri, getter_AddRefs(principal));
-+  nsIPrincipal* principal;
++  nsIPrincipal* principal = nsnull;
 +  rv = ssm->GetCodebasePrincipal(uri, &principal);
    if (NS_FAILED(rv))
      return rv;
  
 diff --git a/browser/components/feeds/src/nsFeedSniffer.cpp b/browser/components/feeds/src/nsFeedSniffer.cpp
 --- a/browser/components/feeds/src/nsFeedSniffer.cpp
 +++ b/browser/components/feeds/src/nsFeedSniffer.cpp
 @@ -79,7 +79,7 @@ nsFeedSniffer::ConvertEncodedData(nsIReq
@@ -11555,17 +11555,17 @@ diff --git a/browser/components/feeds/sr
                                   contentEncoding);
    if (!contentEncoding.IsEmpty()) {
 -    nsCOMPtr<nsIStreamConverterService> converterService(do_GetService(NS_STREAMCONVERTERSERVICE_CONTRACTID));
 +    nsIStreamConverterService* converterService(do_GetService(NS_STREAMCONVERTERSERVICE_CONTRACTID));
      if (converterService) {
        ToLowerCase(contentEncoding);
  
 -      nsCOMPtr<nsIStreamListener> converter;
-+      nsIStreamListener* converter;
++      nsIStreamListener* converter = nsnull;
        rv = converterService->AsyncConvertData(contentEncoding.get(), 
                                                "uncompressed", this, nsnull, 
 -                                              getter_AddRefs(converter));
 +                                              &converter);
        NS_ENSURE_SUCCESS(rv, rv);
  
        converter->OnStartRequest(request, nsnull);
  
@@ -11576,17 +11576,17 @@ diff --git a/browser/components/feeds/sr
          return NS_ERROR_FAILURE;
 @@ -138,9 +138,9 @@ HasAttachmentDisposition(nsIHttpChannel*
                                     contentDisposition);
    
    if (NS_SUCCEEDED(rv) && !contentDisposition.IsEmpty()) {
 -    nsCOMPtr<nsIURI> uri;
 -    httpChannel->GetURI(getter_AddRefs(uri));
 -    nsCOMPtr<nsIMIMEHeaderParam> mimehdrpar =
-+    nsIURI* uri;
++    nsIURI* uri = nsnull;
 +    httpChannel->GetURI(&uri);
 +    nsIMIMEHeaderParam* mimehdrpar =
        do_GetService(NS_MIMEHEADERPARAM_CONTRACTID, &rv);
      if (NS_SUCCEEDED(rv))
      {
 @@ -264,7 +264,7 @@ nsFeedSniffer::GetMIMETypeFromContent(ns
                                        PRUint32 length, 
                                        nsACString& sniffedType)
@@ -11597,17 +11597,17 @@ diff --git a/browser/components/feeds/sr
      return NS_ERROR_NO_INTERFACE;
  
 @@ -283,8 +283,8 @@ nsFeedSniffer::GetMIMETypeFromContent(ns
    // nsContentDLF::CreateInstance knows about (e.g. application/xml, text/html 
    // etc) to something that only the application fe knows about (maybe.feed) 
    // thus deactivating syntax highlighting.
 -  nsCOMPtr<nsIURI> originalURI;
 -  channel->GetOriginalURI(getter_AddRefs(originalURI));
-+  nsIURI* originalURI;
++  nsIURI* originalURI = nsnull;
 +  channel->GetOriginalURI(&originalURI);
  
    nsCAutoString scheme;
    originalURI->GetScheme(scheme);
 @@ -418,7 +418,7 @@ nsFeedSniffer::Register(nsIComponentMana
                          const nsModuleComponentInfo *info)
  {
    nsresult rv;
@@ -11628,32 +11628,32 @@ diff --git a/browser/components/migratio
      do_CreateInstance(NS_SUPPORTS_STRING_CONTRACTID);    
    if (supportsString) {
       supportsString->SetData(aValue); 
 @@ -76,12 +76,12 @@ void SetProxyPref(const nsAString& aHost
  void SetProxyPref(const nsAString& aHostPort, const char* aPref, 
                    const char* aPortPref, nsIPrefBranch* aPrefs) 
  {
 -  nsCOMPtr<nsIURI> uri;
-+  nsIURI* uri;
++  nsIURI* uri = nsnull;
    nsCAutoString host;
    PRInt32 portValue;
  
    // try parsing it as a URI first
 -  if (NS_SUCCEEDED(NS_NewURI(getter_AddRefs(uri), aHostPort))
 +  if (NS_SUCCEEDED(NS_NewURI(&uri, aHostPort))
        && NS_SUCCEEDED(uri->GetHost(host))
        && !host.IsEmpty()
        && NS_SUCCEEDED(uri->GetPort(&portValue))) {
 @@ -130,7 +130,7 @@ void GetMigrateDataFromArray(MigrationDa
                               PRBool aReplace, nsIFile* aSourceProfile, 
                               PRUint16* aResult)
  {
 -  nsCOMPtr<nsIFile> sourceFile; 
-+  nsIFile* sourceFile; 
++  nsIFile* sourceFile = nsnull; 
    PRBool exists;
    MigrationData* cursor;
    MigrationData* end = aDataArray + aDataArrayLength;
 @@ -139,7 +139,7 @@ void GetMigrateDataFromArray(MigrationDa
      // When in non-replace mode, only items that do not require file replacement
      // can be imported.
      if (aReplace || !cursor->replaceOnly) {
 -      aSourceProfile->Clone(getter_AddRefs(sourceFile));
@@ -11684,24 +11684,24 @@ diff --git a/browser/components/migratio
    }
  }
 @@ -171,17 +171,17 @@ AnnotatePersonalToolbarFolder(nsIFile* a
                                nsIFile* aTargetBookmarksFile,
                                const char* aToolbarFolderName)
  {
 -  nsCOMPtr<nsIInputStream> fileInputStream;
 -  nsresult rv = NS_NewLocalFileInputStream(getter_AddRefs(fileInputStream),
-+  nsIInputStream* fileInputStream;
++  nsIInputStream* fileInputStream = nsnull;
 +  nsresult rv = NS_NewLocalFileInputStream(&fileInputStream,
                                             aSourceBookmarksFile);
    NS_ENSURE_SUCCESS(rv, rv);
  
 -  nsCOMPtr<nsIOutputStream> outputStream;
 -  rv = NS_NewLocalFileOutputStream(getter_AddRefs(outputStream),
-+  nsIOutputStream* outputStream;
++  nsIOutputStream* outputStream = nsnull;
 +  rv = NS_NewLocalFileOutputStream(&outputStream,
                                     aTargetBookmarksFile);
    NS_ENSURE_SUCCESS(rv, rv);
  
 -  nsCOMPtr<nsILineInputStream> lineInputStream =
 +  nsILineInputStream* lineInputStream =
      do_QueryInterface(fileInputStream, &rv);
    NS_ENSURE_SUCCESS(rv, rv);
@@ -11724,17 +11724,17 @@ diff --git a/browser/components/migratio
    // Get the source application name.
 -  nsCOMPtr<nsIStringBundleService> bundleService =
 +  nsIStringBundleService* bundleService =
      do_GetService(NS_STRINGBUNDLE_CONTRACTID, &rv);
    NS_ENSURE_SUCCESS(rv, rv);
  
 -  nsCOMPtr<nsIStringBundle> bundle;
 -  rv = bundleService->CreateBundle(MIGRATION_BUNDLE, getter_AddRefs(bundle));
-+  nsIStringBundle* bundle;
++  nsIStringBundle* bundle = nsnull;
 +  rv = bundleService->CreateBundle(MIGRATION_BUNDLE, &bundle);
    NS_ENSURE_SUCCESS(rv, rv);
  
    nsString sourceName;
 @@ -256,7 +256,7 @@ ImportBookmarksHTML(nsIFile* aBookmarksF
                                 getter_Copies(importedBookmarksTitle));
  
    // Get the bookmarks service.
@@ -11744,17 +11744,17 @@ diff --git a/browser/components/migratio
    NS_ENSURE_SUCCESS(rv, rv);
  
 @@ -276,8 +276,8 @@ nsresult
  nsresult
  InitializeBookmarks(nsIFile* aTargetProfile)
  {
 -  nsCOMPtr<nsIFile> bookmarksFile;
 -  aTargetProfile->Clone(getter_AddRefs(bookmarksFile));
-+  nsIFile* bookmarksFile;
++  nsIFile* bookmarksFile = nsnull;
 +  aTargetProfile->Clone(&bookmarksFile);
    bookmarksFile->Append(BOOKMARKS_FILE_NAME);
    
    nsresult rv = ImportBookmarksHTML(bookmarksFile, PR_TRUE, PR_TRUE, EmptyString().get());
 diff --git a/browser/components/migration/src/nsBrowserProfileMigratorUtils.h b/browser/components/migration/src/nsBrowserProfileMigratorUtils.h
 --- a/browser/components/migration/src/nsBrowserProfileMigratorUtils.h
 +++ b/browser/components/migration/src/nsBrowserProfileMigratorUtils.h
 @@ -90,7 +90,7 @@ void GetMigrateDataFromArray(MigrationDa
@@ -11779,45 +11779,45 @@ diff --git a/browser/components/migratio
    }
  
 @@ -250,8 +250,8 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  nsDogbertProfileMigrator::GetSourceExists(PRBool* aResult)
  {
 -  nsCOMPtr<nsISupportsArray> profiles;
 -  GetSourceProfiles(getter_AddRefs(profiles));
-+  nsISupportsArray* profiles;
++  nsISupportsArray* profiles = nsnull;
 +  GetSourceProfiles(&profiles);
  
    if (profiles) { 
      PRUint32 count;
 @@ -267,8 +267,8 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  nsDogbertProfileMigrator::GetSourceHasMultipleProfiles(PRBool* aResult)
  {
 -  nsCOMPtr<nsISupportsArray> profiles;
 -  GetSourceProfiles(getter_AddRefs(profiles));
-+  nsISupportsArray* profiles;
++  nsISupportsArray* profiles = nsnull;
 +  GetSourceProfiles(&profiles);
  
    if (profiles) {
      PRUint32 count;
 @@ -342,12 +342,12 @@ nsDogbertProfileMigrator::GetSourceProfi
    nsCAutoString profilePath(profileDir);
    profilePath += "/.netscape";
  
 -  nsCOMPtr<nsILocalFile> profileFile;
 -  rv = NS_NewNativeLocalFile(profilePath, PR_TRUE, getter_AddRefs(profileFile));
-+  nsILocalFile* profileFile;
++  nsILocalFile* profileFile = nsnull;
 +  rv = NS_NewNativeLocalFile(profilePath, PR_TRUE, &profileFile);
    NS_ENSURE_SUCCESS(rv, rv);
  
 -  nsCOMPtr<nsIFile> prefFile;
 -  rv = profileFile->Clone(getter_AddRefs(prefFile));
-+  nsIFile* prefFile;
++  nsIFile* prefFile = nsnull;
 +  rv = profileFile->Clone(&prefFile);
    NS_ENSURE_SUCCESS(rv, rv);
  
    prefFile->AppendNative(NS_LITERAL_CSTRING("preferences.js"));
 @@ -363,7 +363,7 @@ nsDogbertProfileMigrator::GetSourceProfi
    mProfiles = do_CreateInstance(NS_SUPPORTSARRAY_CONTRACTID, &rv);
    NS_ENSURE_SUCCESS(rv, rv);
  
@@ -11831,100 +11831,100 @@ diff --git a/browser/components/migratio
  
    // Load the source pref file
 -  nsCOMPtr<nsIPrefService> psvc(do_GetService(NS_PREFSERVICE_CONTRACTID));
 +  nsIPrefService* psvc(do_GetService(NS_PREFSERVICE_CONTRACTID));
    psvc->ResetPrefs();
  
 -  nsCOMPtr<nsIFile> sourcePrefsFile;
 -  mSourceProfile->Clone(getter_AddRefs(sourcePrefsFile));
-+  nsIFile* sourcePrefsFile;
++  nsIFile* sourcePrefsFile = nsnull;
 +  mSourceProfile->Clone(&sourcePrefsFile);
    sourcePrefsFile->Append(aSourcePrefFileName);
    psvc->ReadUserPrefs(sourcePrefsFile);
  
 -  nsCOMPtr<nsIPrefBranch> branch(do_QueryInterface(psvc));
 +  nsIPrefBranch* branch(do_QueryInterface(psvc));
    for (transform = gTransforms; transform < end; ++transform)
      transform->prefGetterFunc(transform, branch);
  
 @@ -451,8 +451,8 @@ nsDogbertProfileMigrator::TransformPrefe
    for (transform = gTransforms; transform < end; ++transform)
      transform->prefSetterFunc(transform, branch);
  
 -  nsCOMPtr<nsIFile> targetPrefsFile;
 -  mTargetProfile->Clone(getter_AddRefs(targetPrefsFile));
-+  nsIFile* targetPrefsFile;
++  nsIFile* targetPrefsFile = nsnull;
 +  mTargetProfile->Clone(&targetPrefsFile);
    targetPrefsFile->Append(aTargetPrefFileName);
    psvc->SavePrefFile(targetPrefsFile);
  
 @@ -519,12 +519,12 @@ nsDogbertProfileMigrator::CopyCookies(PR
  #endif
    }
    else {
 -    nsCOMPtr<nsICookieManager2> cookieManager(do_GetService(NS_COOKIEMANAGER_CONTRACTID));
 +    nsICookieManager2* cookieManager(do_GetService(NS_COOKIEMANAGER_CONTRACTID));
      if (!cookieManager)
        return NS_ERROR_OUT_OF_MEMORY;
  
 -    nsCOMPtr<nsIFile> dogbertCookiesFile;
 -    mSourceProfile->Clone(getter_AddRefs(dogbertCookiesFile));
-+    nsIFile* dogbertCookiesFile;
++    nsIFile* dogbertCookiesFile = nsnull;
 +    mSourceProfile->Clone(&dogbertCookiesFile);
      dogbertCookiesFile->Append(COOKIES_FILE_NAME_IN_4x);
  
      rv = ImportNetscapeCookies(dogbertCookiesFile);
 @@ -639,16 +639,16 @@ nsDogbertProfileMigrator::MigrateDogbert
  
    // Find out what the personal toolbar folder was called, this is stored in a pref
    // in 4.x
 -  nsCOMPtr<nsIPrefService> psvc(do_GetService(NS_PREFSERVICE_CONTRACTID));
 +  nsIPrefService* psvc(do_GetService(NS_PREFSERVICE_CONTRACTID));
    psvc->ResetPrefs();
  
 -  nsCOMPtr<nsIFile> dogbertPrefsFile;
 -  mSourceProfile->Clone(getter_AddRefs(dogbertPrefsFile));
-+  nsIFile* dogbertPrefsFile;
++  nsIFile* dogbertPrefsFile = nsnull;
 +  mSourceProfile->Clone(&dogbertPrefsFile);
    dogbertPrefsFile->Append(PREF_FILE_NAME_IN_4x);
    psvc->ReadUserPrefs(dogbertPrefsFile);
  
    nsCString toolbarName;
 -  nsCOMPtr<nsIPrefBranch> branch(do_QueryInterface(psvc));
 +  nsIPrefBranch* branch(do_QueryInterface(psvc));
    rv = branch->GetCharPref("custtoolbar.personal_toolbar_folder", getter_Copies(toolbarName));
    // If the pref wasn't set in the user's 4.x preferences, there's no way we can "Fix" the
    // file when importing it to set the personal toolbar folder correctly, so don't bother
 @@ -658,12 +658,12 @@ nsDogbertProfileMigrator::MigrateDogbert
  
    // Now read the 4.x bookmarks file, correcting the Personal Toolbar Folder line
    // and writing to the new location.
 -  nsCOMPtr<nsIFile> sourceBookmarksFile;
 -  mSourceProfile->Clone(getter_AddRefs(sourceBookmarksFile));
-+  nsIFile* sourceBookmarksFile;
++  nsIFile* sourceBookmarksFile = nsnull;
 +  mSourceProfile->Clone(&sourceBookmarksFile);
    sourceBookmarksFile->Append(BOOKMARKS_FILE_NAME_IN_4x);
  
 -  nsCOMPtr<nsIFile> targetBookmarksFile;
 -  mTargetProfile->Clone(getter_AddRefs(targetBookmarksFile));
-+  nsIFile* targetBookmarksFile;
++  nsIFile* targetBookmarksFile = nsnull;
 +  mTargetProfile->Clone(&targetBookmarksFile);
    targetBookmarksFile->Append(BOOKMARKS_FILE_NAME_IN_5x);
  
    return AnnotatePersonalToolbarFolder(sourceBookmarksFile,
 diff --git a/browser/components/migration/src/nsNetscapeProfileMigratorBase.cpp b/browser/components/migration/src/nsNetscapeProfileMigratorBase.cpp
 --- a/browser/components/migration/src/nsNetscapeProfileMigratorBase.cpp
 +++ b/browser/components/migration/src/nsNetscapeProfileMigratorBase.cpp
 @@ -153,14 +153,14 @@ nsNetscapeProfileMigratorBase::GetProfil
      // Remove trailing \0
      dirStr.SetLength(regInfo.entryLength-1);
  
 -    nsCOMPtr<nsILocalFile> dir;
-+    nsILocalFile* dir;
++    nsILocalFile* dir = nsnull;
  #ifdef XP_MACOSX
      rv = NS_NewNativeLocalFile(EmptyCString(), PR_TRUE, getter_AddRefs(dir));
      if (NS_FAILED(rv)) break;
      dir->SetPersistentDescriptor(dirStr);
  #else
      rv = NS_NewLocalFile(NS_ConvertUTF8toUTF16(dirStr), PR_TRUE,
 -                         getter_AddRefs(dir));
 +                         &dir);
@@ -11940,17 +11940,17 @@ diff --git a/browser/components/migratio
          do_CreateInstance("@mozilla.org/supports-string;1"));
  
        profileNameString->SetData(profileName);
 @@ -217,10 +217,10 @@ nsNetscapeProfileMigratorBase::GetWStrin
  nsNetscapeProfileMigratorBase::GetWString(void* aTransform, nsIPrefBranch* aBranch)
  {
    PrefTransform* xform = (PrefTransform*)aTransform;
 -  nsCOMPtr<nsIPrefLocalizedString> prefValue;
-+  nsIPrefLocalizedString* prefValue;
++  nsIPrefLocalizedString* prefValue = nsnull;
    nsresult rv = aBranch->GetComplexValue(xform->sourcePrefName, 
                                           NS_GET_IID(nsIPrefLocalizedString),
 -                                         getter_AddRefs(prefValue));
 +                                         (void**)&prefValue);
  
    if (NS_SUCCEEDED(rv) && prefValue) {
      nsString data;
 @@ -237,7 +237,7 @@ nsNetscapeProfileMigratorBase::SetWStrin
@@ -11972,50 +11972,50 @@ diff --git a/browser/components/migratio
      pls->SetData(data.get());
      return aBranch->SetComplexValue(xform->targetPrefName ? xform->targetPrefName : xform->sourcePrefName, NS_GET_IID(nsIPrefLocalizedString), pls);
 @@ -290,8 +290,8 @@ nsresult
  nsresult
  nsNetscapeProfileMigratorBase::CopyFile(const nsAString& aSourceFileName, const nsAString& aTargetFileName)
  {
 -  nsCOMPtr<nsIFile> sourceFile;
 -  mSourceProfile->Clone(getter_AddRefs(sourceFile));
-+  nsIFile* sourceFile;
++  nsIFile* sourceFile = nsnull;
 +  mSourceProfile->Clone(&sourceFile);
  
    sourceFile->Append(aSourceFileName);
    PRBool exists = PR_FALSE;
 @@ -299,8 +299,8 @@ nsNetscapeProfileMigratorBase::CopyFile(
    if (!exists)
      return NS_OK;
  
 -  nsCOMPtr<nsIFile> targetFile;
 -  mTargetProfile->Clone(getter_AddRefs(targetFile));
-+  nsIFile* targetFile;
++  nsIFile* targetFile = nsnull;
 +  mTargetProfile->Clone(&targetFile);
    
    targetFile->Append(aTargetFileName);
    targetFile->Exists(&exists);
 @@ -314,8 +314,8 @@ nsNetscapeProfileMigratorBase::ImportNet
  nsNetscapeProfileMigratorBase::ImportNetscapeBookmarks(const nsAString& aBookmarksFileName,
                                                         const PRUnichar* aImportSourceNameKey)
  {
 -  nsCOMPtr<nsIFile> bookmarksFile;
 -  mSourceProfile->Clone(getter_AddRefs(bookmarksFile));
-+  nsIFile* bookmarksFile;
++  nsIFile* bookmarksFile = nsnull;
 +  mSourceProfile->Clone(&bookmarksFile);
    bookmarksFile->Append(aBookmarksFileName);
    
    return ImportBookmarksHTML(bookmarksFile, PR_FALSE, PR_FALSE, aImportSourceNameKey);
 @@ -325,11 +325,11 @@ nsNetscapeProfileMigratorBase::ImportNet
  nsNetscapeProfileMigratorBase::ImportNetscapeCookies(nsIFile* aCookiesFile)
  {
    nsresult rv;
 -  nsCOMPtr<nsIInputStream> cookiesStream;
 -  rv = NS_NewLocalFileInputStream(getter_AddRefs(cookiesStream), aCookiesFile);
-+  nsIInputStream* cookiesStream;
++  nsIInputStream* cookiesStream = nsnull;
 +  rv = NS_NewLocalFileInputStream(&cookiesStream, aCookiesFile);
    if (NS_FAILED(rv)) return rv;
  
 -  nsCOMPtr<nsILineInputStream> lineInputStream(do_QueryInterface(cookiesStream));
 +  nsILineInputStream* lineInputStream(do_QueryInterface(cookiesStream));
  
    // This code is copied from mozilla/netwerk/cookie/src/nsCookieManager.cpp
    static NS_NAMED_LITERAL_CSTRING(kTrue, "TRUE");
@@ -12033,94 +12033,94 @@ diff --git a/browser/components/migratio
      // Find out what the signons file was called, this is stored in a pref
      // in Seamonkey.
 -    nsCOMPtr<nsIPrefService> psvc(do_GetService(NS_PREFSERVICE_CONTRACTID));
 +    nsIPrefService* psvc(do_GetService(NS_PREFSERVICE_CONTRACTID));
      psvc->ResetPrefs();
  
 -    nsCOMPtr<nsIFile> sourcePrefsName;
 -    mSourceProfile->Clone(getter_AddRefs(sourcePrefsName));
-+    nsIFile* sourcePrefsName;
++    nsIFile* sourcePrefsName = nsnull;
 +    mSourceProfile->Clone(&sourcePrefsName);
      sourcePrefsName->Append(FILE_NAME_PREFS_5X);
      psvc->ReadUserPrefs(sourcePrefsName);
  
 -    nsCOMPtr<nsIPrefBranch> branch(do_QueryInterface(psvc));
 +    nsIPrefBranch* branch(do_QueryInterface(psvc));
      rv = branch->GetCharPref("signon.SignonFileName", aFileName);
    }
    else 
 @@ -431,8 +431,8 @@ nsresult
  nsresult
  nsNetscapeProfileMigratorBase::LocateSignonsFile(char** aResult)
  {
 -  nsCOMPtr<nsISimpleEnumerator> entries;
 -  nsresult rv = mSourceProfile->GetDirectoryEntries(getter_AddRefs(entries));
-+  nsISimpleEnumerator* entries;
++  nsISimpleEnumerator* entries = nsnull;
 +  nsresult rv = mSourceProfile->GetDirectoryEntries(&entries);
    if (NS_FAILED(rv)) return rv;
  
    nsCAutoString fileName;
 @@ -441,16 +441,16 @@ nsNetscapeProfileMigratorBase::LocateSig
      rv = entries->HasMoreElements(&hasMore);
      if (NS_FAILED(rv) || !hasMore) break;
  
 -    nsCOMPtr<nsISupports> supp;
 -    rv = entries->GetNext(getter_AddRefs(supp));
-+    nsISupports* supp;
++    nsISupports* supp = nsnull;
 +    rv = entries->GetNext(&supp);
      if (NS_FAILED(rv)) break;
  
 -    nsCOMPtr<nsIFile> currFile(do_QueryInterface(supp));
 -
 -    nsCOMPtr<nsIURI> uri;
 -    rv = NS_NewFileURI(getter_AddRefs(uri), currFile);
 +    nsIFile* currFile(do_QueryInterface(supp));
 +
-+    nsIURI* uri;
++    nsIURI* uri = nsnull;
 +    rv = NS_NewFileURI(&uri, currFile);
      if (NS_FAILED(rv)) break;
 -    nsCOMPtr<nsIURL> url(do_QueryInterface(uri));
 +    nsIURL* url(do_QueryInterface(uri));
  
      nsCAutoString extn;
      url->GetFileExtension(extn);
 diff --git a/browser/components/migration/src/nsOperaProfileMigrator.cpp b/browser/components/migration/src/nsOperaProfileMigrator.cpp
 --- a/browser/components/migration/src/nsOperaProfileMigrator.cpp
 +++ b/browser/components/migration/src/nsOperaProfileMigrator.cpp
 @@ -174,8 +174,8 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  nsOperaProfileMigrator::GetSourceExists(PRBool* aResult)
  {
 -  nsCOMPtr<nsISupportsArray> profiles;
 -  GetSourceProfiles(getter_AddRefs(profiles));
-+  nsISupportsArray* profiles;
++  nsISupportsArray* profiles = nsnull;
 +  GetSourceProfiles(&profiles);
  
    if (profiles) { 
      PRUint32 count;
 @@ -191,8 +191,8 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  nsOperaProfileMigrator::GetSourceHasMultipleProfiles(PRBool* aResult)
  {
 -  nsCOMPtr<nsISupportsArray> profiles;
 -  GetSourceProfiles(getter_AddRefs(profiles));
-+  nsISupportsArray* profiles;
++  nsISupportsArray* profiles = nsnull;
 +  GetSourceProfiles(&profiles);
  
  #ifdef XP_WIN
    if (profiles) {
 @@ -216,8 +216,8 @@ nsOperaProfileMigrator::GetSourceProfile
      mProfiles = do_CreateInstance(NS_SUPPORTSARRAY_CONTRACTID, &rv);
      if (NS_FAILED(rv)) return rv;
  
 -    nsCOMPtr<nsIProperties> fileLocator(do_GetService("@mozilla.org/file/directory_service;1"));
 -    nsCOMPtr<nsILocalFile> file;
 +    nsIProperties* fileLocator(do_GetService("@mozilla.org/file/directory_service;1"));
-+    nsILocalFile* file;
++    nsILocalFile* file = nsnull;
  #ifdef XP_WIN
      fileLocator->Get(NS_WIN_APPDATA_DIR, NS_GET_IID(nsILocalFile), getter_AddRefs(file));
  
 @@ -262,7 +262,7 @@ nsOperaProfileMigrator::GetSourceProfile
        mProfiles->AppendElement(string);
      }
  #elif defined (XP_UNIX)
 -    fileLocator->Get(NS_UNIX_HOME_DIR, NS_GET_IID(nsILocalFile), getter_AddRefs(file));
@@ -12138,17 +12138,17 @@ diff --git a/browser/components/migratio
        mProfiles->AppendElement(string);
      }
 @@ -287,11 +287,11 @@ nsOperaProfileMigrator::GetSourceHomePag
    nsresult rv;
    nsCAutoString val;
  
 -  nsCOMPtr<nsIFile> operaPrefs;
 -  mOperaProfile->Clone(getter_AddRefs(operaPrefs));
-+  nsIFile* operaPrefs;
++  nsIFile* operaPrefs = nsnull;
 +  mOperaProfile->Clone(&operaPrefs);
    operaPrefs->Append(OPERA_PREFERENCES_FILE_NAME);
  
 -  nsCOMPtr<nsILocalFile> lf(do_QueryInterface(operaPrefs));
 +  nsILocalFile* lf(do_QueryInterface(operaPrefs));
    NS_ENSURE_TRUE(lf, NS_ERROR_UNEXPECTED);
  
    nsINIParser parser;
@@ -12171,17 +12171,17 @@ diff --git a/browser/components/migratio
    pls->SetData(data.get());
    return aBranch->SetComplexValue(xform->targetPrefName, NS_GET_IID(nsIPrefLocalizedString), pls);
 @@ -395,18 +395,18 @@ nsOperaProfileMigrator::CopyPreferences(
  {
    nsresult rv;
  
 -  nsCOMPtr<nsIFile> operaPrefs;
 -  mOperaProfile->Clone(getter_AddRefs(operaPrefs));
-+  nsIFile* operaPrefs;
++  nsIFile* operaPrefs = nsnull;
 +  mOperaProfile->Clone(&operaPrefs);
    operaPrefs->Append(OPERA_PREFERENCES_FILE_NAME);
  
 -  nsCOMPtr<nsILocalFile> lf(do_QueryInterface(operaPrefs));
 +  nsILocalFile* lf(do_QueryInterface(operaPrefs));
    NS_ENSURE_TRUE(lf, NS_ERROR_UNEXPECTED);
  
    nsINIParser parser;
@@ -12193,51 +12193,51 @@ diff --git a/browser/components/migratio
  
    // Traverse the standard transforms
    PrefTransform* transform;
 @@ -581,9 +581,9 @@ nsOperaProfileMigrator::CopyUserContentS
      return NS_OK;
  
    // Copy the file
 -  nsCOMPtr<nsILocalFile> userContentCSSFile;
-+  nsILocalFile* userContentCSSFile;
++  nsILocalFile* userContentCSSFile = nsnull;
    rv = NS_NewNativeLocalFile(userContentCSS, PR_TRUE,
 -                             getter_AddRefs(userContentCSSFile));
 +                             &userContentCSSFile);
    if (NS_FAILED(rv))
      return NS_OK;
  
 @@ -592,9 +592,9 @@ nsOperaProfileMigrator::CopyUserContentS
    if (NS_FAILED(rv) || !exists)
      return NS_OK;
  
 -  nsCOMPtr<nsIFile> profileChromeDir;
-+  nsIFile* profileChromeDir;
++  nsIFile* profileChromeDir = nsnull;
    NS_GetSpecialDirectory(NS_APP_USER_CHROME_DIR,
 -                         getter_AddRefs(profileChromeDir));
 +                         &profileChromeDir);
    if (!profileChromeDir)
      return NS_OK;
  
 @@ -609,14 +609,14 @@ nsOperaProfileMigrator::CopyCookies(PRBo
  {
    nsresult rv = NS_OK;
  
 -  nsCOMPtr<nsIFile> temp;
 -  mOperaProfile->Clone(getter_AddRefs(temp));
 -  nsCOMPtr<nsILocalFile> historyFile(do_QueryInterface(temp));
-+  nsIFile* temp;
++  nsIFile* temp = nsnull;
 +  mOperaProfile->Clone(&temp);
 +  nsILocalFile* historyFile(do_QueryInterface(temp));
  
    historyFile->Append(OPERA_COOKIES_FILE_NAME);
  
 -  nsCOMPtr<nsIInputStream> fileStream;
 -  NS_NewLocalFileInputStream(getter_AddRefs(fileStream), historyFile);
-+  nsIInputStream* fileStream;
++  nsIInputStream* fileStream = nsnull;
 +  NS_NewLocalFileInputStream(&fileStream, historyFile);
    if (!fileStream) 
      return NS_ERROR_OUT_OF_MEMORY;
  
 @@ -665,8 +665,8 @@ nsOperaCookieMigrator::Migrate()
    if (NS_FAILED(rv)) 
      return NS_OK;
  
@@ -12272,56 +12272,56 @@ diff --git a/browser/components/migratio
  {
 -  nsCOMPtr<nsIBrowserHistory> hist(do_GetService(NS_GLOBALHISTORY2_CONTRACTID));
 -
 -  nsCOMPtr<nsIFile> temp;
 -  mOperaProfile->Clone(getter_AddRefs(temp));
 -  nsCOMPtr<nsILocalFile> historyFile(do_QueryInterface(temp));
 +  nsIBrowserHistory* hist(do_GetService(NS_GLOBALHISTORY2_CONTRACTID));
 +
-+  nsIFile* temp;
++  nsIFile* temp = nsnull;
 +  mOperaProfile->Clone(&temp);
 +  nsILocalFile* historyFile(do_QueryInterface(temp));
    historyFile->Append(OPERA_HISTORY_FILE_NAME);
  
 -  nsCOMPtr<nsIInputStream> fileStream;
 -  NS_NewLocalFileInputStream(getter_AddRefs(fileStream), historyFile);
-+  nsIInputStream* fileStream;
++  nsIInputStream* fileStream = nsnull;
 +  NS_NewLocalFileInputStream(&fileStream, historyFile);
    if (!fileStream) return NS_ERROR_OUT_OF_MEMORY;
  
 -  nsCOMPtr<nsILineInputStream> lineStream = do_QueryInterface(fileStream);
 +  nsILineInputStream* lineStream = do_QueryInterface(fileStream);
  
    nsCAutoString buffer, url;
    nsAutoString title;
 @@ -1017,8 +1017,8 @@ nsOperaProfileMigrator::RunBatched(nsISu
        LL_I2L(million, PR_USEC_PER_SEC);
        LL_MUL(lastVisitDate, temp, million);
  
 -      nsCOMPtr<nsIURI> uri;
 -      NS_NewURI(getter_AddRefs(uri), url);
-+      nsIURI* uri;
++      nsIURI* uri = nsnull;
 +      NS_NewURI(&uri, url);
        if (uri)
          hist->AddPageWithDetails(uri, title.get(), lastVisitDate);
        
 @@ -1035,27 +1035,27 @@ nsOperaProfileMigrator::CopyBookmarks(PR
  nsOperaProfileMigrator::CopyBookmarks(PRBool aReplace)
  {
    // Find Opera Bookmarks
 -  nsCOMPtr<nsIFile> operaBookmarks;
 -  mOperaProfile->Clone(getter_AddRefs(operaBookmarks));
-+  nsIFile* operaBookmarks;
++  nsIFile* operaBookmarks = nsnull;
 +  mOperaProfile->Clone(&operaBookmarks);
    operaBookmarks->Append(OPERA_BOOKMARKS_FILE_NAME);
  
 -  nsCOMPtr<nsIInputStream> fileInputStream;
 -  NS_NewLocalFileInputStream(getter_AddRefs(fileInputStream), operaBookmarks);
-+  nsIInputStream* fileInputStream;
++  nsIInputStream* fileInputStream = nsnull;
 +  NS_NewLocalFileInputStream(&fileInputStream, operaBookmarks);
    if (!fileInputStream) return NS_ERROR_OUT_OF_MEMORY;
  
 -  nsCOMPtr<nsILineInputStream> lineInputStream(do_QueryInterface(fileInputStream));
 +  nsILineInputStream* lineInputStream(do_QueryInterface(fileInputStream));
  
    nsresult rv;
 -  nsCOMPtr<nsINavBookmarksService> bms(do_GetService(NS_NAVBOOKMARKSSERVICE_CONTRACTID, &rv));
@@ -12331,27 +12331,27 @@ diff --git a/browser/components/migratio
    rv = bms->GetBookmarksRoot(&root);
    NS_ENSURE_SUCCESS(rv, rv);
    PRInt64 parentFolder = root;
  
 -  nsCOMPtr<nsIStringBundleService> bundleService(do_GetService(NS_STRINGBUNDLE_CONTRACTID));
 -  nsCOMPtr<nsIStringBundle> bundle;
 -  bundleService->CreateBundle(MIGRATION_BUNDLE, getter_AddRefs(bundle));
 +  nsIStringBundleService* bundleService(do_GetService(NS_STRINGBUNDLE_CONTRACTID));
-+  nsIStringBundle* bundle;
++  nsIStringBundle* bundle = nsnull;
 +  bundleService->CreateBundle(MIGRATION_BUNDLE, &bundle);
    if (!aReplace) {
      nsString sourceNameOpera;
      bundle->GetStringFromName(NS_LITERAL_STRING("sourceNameOpera").get(), 
 @@ -1071,7 +1071,7 @@ nsOperaProfileMigrator::CopyBookmarks(PR
                        nsINavBookmarksService::DEFAULT_INDEX, &parentFolder);
    }
    else {
 -    nsCOMPtr<nsIFile> profile;
-+    nsIFile* profile;
++    nsIFile* profile = nsnull;
      GetProfilePath(nsnull, profile);
      rv = InitializeBookmarks(profile);
      NS_ENSURE_SUCCESS(rv, rv);
 @@ -1093,7 +1093,7 @@ nsOperaProfileMigrator::CopyBookmarks(PR
    // after importing the favorites, 
    // we need to set this pref so that on startup
    // we don't blow away what we just imported
 -  nsCOMPtr<nsIPrefBranch> pref(do_GetService(NS_PREFSERVICE_CONTRACTID));
@@ -12360,55 +12360,55 @@ diff --git a/browser/components/migratio
    rv = pref->SetBoolPref("browser.places.importBookmarksHTML", PR_FALSE);
    NS_ENSURE_SUCCESS(rv, rv);
 @@ -1108,11 +1108,11 @@ nsOperaProfileMigrator::CopySmartKeyword
  {
    nsresult rv;
  
 -  nsCOMPtr<nsIFile> smartKeywords;
 -  mOperaProfile->Clone(getter_AddRefs(smartKeywords));
-+  nsIFile* smartKeywords;
++  nsIFile* smartKeywords = nsnull;
 +  mOperaProfile->Clone(&smartKeywords);
    smartKeywords->Append(NS_LITERAL_STRING("search.ini"));
  
 -  nsCOMPtr<nsILocalFile> lf(do_QueryInterface(smartKeywords));
 +  nsILocalFile* lf(do_QueryInterface(smartKeywords));
    if (!lf)
      return NS_OK;
  
 @@ -1181,8 +1181,8 @@ nsOperaProfileMigrator::CopySmartKeyword
      }
      while (index < length);
  
 -    nsCOMPtr<nsIURI> uri;
 -    NS_NewURI(getter_AddRefs(uri), url.get());
-+    nsIURI* uri;
++    nsIURI* uri = nsnull;
 +    NS_NewURI(&uri, url.get());
      if (!uri)
        return NS_ERROR_OUT_OF_MEMORY;
  
 @@ -1317,8 +1317,8 @@ nsOperaProfileMigrator::ParseBookmarksFo
        // XXX Todo: |description| is not saved.
        if (entryType == EntryType_BOOKMARK) {
          if (!name.IsEmpty() && !url.IsEmpty()) {
 -          nsCOMPtr<nsIURI> uri;
 -          rv = NS_NewURI(getter_AddRefs(uri), url);
-+          nsIURI* uri;
++          nsIURI* uri = nsnull;
 +          rv = NS_NewURI(&uri, url);
            if (NS_FAILED(rv))
              continue;
            PRInt64 id;
 @@ -1360,8 +1360,8 @@ void
  void
  nsOperaProfileMigrator::GetOperaProfile(const PRUnichar* aProfile, nsILocalFile** aFile)
  {
 -  nsCOMPtr<nsIProperties> fileLocator(do_GetService("@mozilla.org/file/directory_service;1"));
 -  nsCOMPtr<nsILocalFile> file;
 +  nsIProperties* fileLocator(do_GetService("@mozilla.org/file/directory_service;1"));
-+  nsILocalFile* file;
++  nsILocalFile* file = nsnull;
  #ifdef XP_WIN
    fileLocator->Get(NS_WIN_APPDATA_DIR, NS_GET_IID(nsILocalFile), getter_AddRefs(file));
  
 @@ -1375,7 +1375,7 @@ nsOperaProfileMigrator::GetOperaProfile(
    file->Append(NS_LITERAL_STRING("Preferences"));
    file->Append(OPERA_PREFERENCES_FOLDER_NAME);
  #elif defined (XP_UNIX)
 -  fileLocator->Get(NS_UNIX_HOME_DIR, NS_GET_IID(nsILocalFile), getter_AddRefs(file));
@@ -12429,63 +12429,63 @@ diff --git a/browser/components/migratio
    }
    if (!mSourceProfile)
 @@ -176,8 +176,8 @@ nsPhoenixProfileMigrator::GetMigrateData
  
    if (!signonsFileName.IsEmpty()) {
      NS_ConvertASCIItoUTF16 fileName(signonsFileName);
 -    nsCOMPtr<nsIFile> sourcePasswordsFile;
 -    mSourceProfile->Clone(getter_AddRefs(sourcePasswordsFile));
-+    nsIFile* sourcePasswordsFile;
++    nsIFile* sourcePasswordsFile = nsnull;
 +    mSourceProfile->Clone(&sourcePasswordsFile);
      sourcePasswordsFile->Append(fileName);
  
      PRBool exists;
 @@ -192,8 +192,8 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  nsPhoenixProfileMigrator::GetSourceExists(PRBool* aResult)
  {
 -  nsCOMPtr<nsISupportsArray> profiles;
 -  GetSourceProfiles(getter_AddRefs(profiles));
-+  nsISupportsArray* profiles;
++  nsISupportsArray* profiles = nsnull;
 +  GetSourceProfiles(&profiles);
  
    if (profiles) { 
      PRUint32 count;
 @@ -209,8 +209,8 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  nsPhoenixProfileMigrator::GetSourceHasMultipleProfiles(PRBool* aResult)
  {
 -  nsCOMPtr<nsISupportsArray> profiles;
 -  GetSourceProfiles(getter_AddRefs(profiles));
-+  nsISupportsArray* profiles;
++  nsISupportsArray* profiles = nsnull;
 +  GetSourceProfiles(&profiles);
  
    if (profiles) {
      PRUint32 count;
 @@ -253,9 +253,9 @@ nsPhoenixProfileMigrator::GetSourceProfi
    PRUint32 count;
    mProfileNames->Count(&count);
    for (PRUint32 i = 0; i < count; ++i) {
 -    nsCOMPtr<nsISupportsString> str;
-+    nsISupportsString* str;
++    nsISupportsString* str = nsnull;
      mProfileNames->QueryElementAt(i, NS_GET_IID(nsISupportsString),
 -                                  getter_AddRefs(str));
 +                                  (void**)&str);
      nsString profileName;
      str->GetData(profileName);
      if (profileName.Equals(aProfile)) {
 @@ -272,8 +272,8 @@ nsPhoenixProfileMigrator::FillProfileDat
  nsPhoenixProfileMigrator::FillProfileDataFromPhoenixRegistry()
  {
    // Find the Phoenix Registry
 -  nsCOMPtr<nsIProperties> fileLocator(do_GetService("@mozilla.org/file/directory_service;1"));
 -  nsCOMPtr<nsILocalFile> phoenixRegistry;
 +  nsIProperties* fileLocator(do_GetService("@mozilla.org/file/directory_service;1"));
-+  nsILocalFile* phoenixRegistry;
++  nsILocalFile* phoenixRegistry = nsnull;
  #ifdef XP_WIN
    fileLocator->Get(NS_WIN_APPDATA_DIR, NS_GET_IID(nsILocalFile), getter_AddRefs(phoenixRegistry));
  
 @@ -285,7 +285,7 @@ nsPhoenixProfileMigrator::FillProfileDat
    phoenixRegistry->Append(NS_LITERAL_STRING("Phoenix"));
    phoenixRegistry->Append(NS_LITERAL_STRING("Application Registry"));
  #elif defined(XP_UNIX)
 -  fileLocator->Get(NS_UNIX_HOME_DIR, NS_GET_IID(nsILocalFile), getter_AddRefs(phoenixRegistry));
@@ -12494,72 +12494,72 @@ diff --git a/browser/components/migratio
    phoenixRegistry->Append(NS_LITERAL_STRING(".phoenix"));
    phoenixRegistry->Append(NS_LITERAL_STRING("appreg"));
 @@ -333,19 +333,19 @@ nsPhoenixProfileMigrator::CopyUserStyleS
  {
    nsresult rv = NS_OK;
  
 -  nsCOMPtr<nsIFile> sourceUserContent;
 -  mSourceProfile->Clone(getter_AddRefs(sourceUserContent));
-+  nsIFile* sourceUserContent;
++  nsIFile* sourceUserContent = nsnull;
 +  mSourceProfile->Clone(&sourceUserContent);
    sourceUserContent->Append(DIR_NAME_CHROME);
    sourceUserContent->Append(FILE_NAME_USERCONTENT);
  
    PRBool exists = PR_FALSE;
    sourceUserContent->Exists(&exists);
    if (exists) {
 -    nsCOMPtr<nsIFile> targetUserContent;
 -    mTargetProfile->Clone(getter_AddRefs(targetUserContent));
-+    nsIFile* targetUserContent;
++    nsIFile* targetUserContent = nsnull;
 +    mTargetProfile->Clone(&targetUserContent);
      targetUserContent->Append(DIR_NAME_CHROME);
 -    nsCOMPtr<nsIFile> targetChromeDir;
 -    targetUserContent->Clone(getter_AddRefs(targetChromeDir));
-+    nsIFile* targetChromeDir;
++    nsIFile* targetChromeDir = nsnull;
 +    targetUserContent->Clone(&targetChromeDir);
      targetUserContent->Append(FILE_NAME_USERCONTENT);
  
      targetUserContent->Exists(&exists);
 @@ -355,18 +355,18 @@ nsPhoenixProfileMigrator::CopyUserStyleS
      rv |= sourceUserContent->CopyTo(targetChromeDir, FILE_NAME_USERCONTENT);
    }
  
 -  nsCOMPtr<nsIFile> sourceUserChrome;
 -  mSourceProfile->Clone(getter_AddRefs(sourceUserChrome));
-+  nsIFile* sourceUserChrome;
++  nsIFile* sourceUserChrome = nsnull;
 +  mSourceProfile->Clone(&sourceUserChrome);
    sourceUserChrome->Append(DIR_NAME_CHROME);
    sourceUserChrome->Append(FILE_NAME_USERCHROME);
  
    sourceUserChrome->Exists(&exists);
    if (exists) {
 -    nsCOMPtr<nsIFile> targetUserChrome;
 -    mTargetProfile->Clone(getter_AddRefs(targetUserChrome));
-+    nsIFile* targetUserChrome;
++    nsIFile* targetUserChrome = nsnull;
 +    mTargetProfile->Clone(&targetUserChrome);
      targetUserChrome->Append(DIR_NAME_CHROME);
 -    nsCOMPtr<nsIFile> targetChromeDir;
 -    targetUserChrome->Clone(getter_AddRefs(targetChromeDir));
-+    nsIFile* targetChromeDir;
++    nsIFile* targetChromeDir = nsnull;
 +    targetUserChrome->Clone(&targetChromeDir);
      targetUserChrome->Append(FILE_NAME_USERCHROME);
  
      targetUserChrome->Exists(&exists);
 @@ -402,15 +402,15 @@ nsPhoenixProfileMigrator::CopyPasswords(
  
    // Find out what the signons file was called, this is stored in a pref
    // in Seamonkey.
 -  nsCOMPtr<nsIPrefService> psvc(do_GetService(NS_PREFSERVICE_CONTRACTID));
 +  nsIPrefService* psvc(do_GetService(NS_PREFSERVICE_CONTRACTID));
    psvc->ResetPrefs();
  
 -  nsCOMPtr<nsIFile> seamonkeyPrefsFile;
 -  mSourceProfile->Clone(getter_AddRefs(seamonkeyPrefsFile));
-+  nsIFile* seamonkeyPrefsFile;
++  nsIFile* seamonkeyPrefsFile = nsnull;
 +  mSourceProfile->Clone(&seamonkeyPrefsFile);
    seamonkeyPrefsFile->Append(FILE_NAME_PREFS);
    psvc->ReadUserPrefs(seamonkeyPrefsFile);
  
 -  nsCOMPtr<nsIPrefBranch> branch(do_QueryInterface(psvc));
 +  nsIPrefBranch* branch(do_QueryInterface(psvc));
    rv = branch->GetCharPref("signon.SignonFileName", getter_Copies(signonsFileName));
  
@@ -12567,17 +12567,17 @@ diff --git a/browser/components/migratio
 diff --git a/browser/components/migration/src/nsProfileMigrator.cpp b/browser/components/migration/src/nsProfileMigrator.cpp
 --- a/browser/components/migration/src/nsProfileMigrator.cpp
 +++ b/browser/components/migration/src/nsProfileMigrator.cpp
 @@ -89,7 +89,7 @@ nsProfileMigrator::Migrate(nsIProfileSta
    nsresult rv;
  
    nsCAutoString key;
 -  nsCOMPtr<nsIBrowserProfileMigrator> bpm;
-+  nsIBrowserProfileMigrator* bpm;
++  nsIBrowserProfileMigrator* bpm = nsnull;
  
    rv = GetDefaultBrowserMigratorKey(key, bpm);
    if (NS_FAILED(rv)) return rv;
 @@ -115,15 +115,15 @@ nsProfileMigrator::Migrate(nsIProfileSta
  #endif
    }
  
 -  nsCOMPtr<nsISupportsCString> cstr
@@ -12595,17 +12595,17 @@ diff --git a/browser/components/migratio
      do_CreateInstance(NS_SUPPORTSARRAY_CONTRACTID);
    if (!ww || !params) return NS_ERROR_FAILURE;
  
 @@ -131,13 +131,13 @@ nsProfileMigrator::Migrate(nsIProfileSta
    params->AppendElement(bpm);
    params->AppendElement(aStartup);
  
 -  nsCOMPtr<nsIDOMWindow> migrateWizard;
-+  nsIDOMWindow* migrateWizard;
++  nsIDOMWindow* migrateWizard = nsnull;
    return ww->OpenWindow(nsnull, 
                          MIGRATION_WIZARD_FE_URL,
                          "_blank",
                          MIGRATION_WIZARD_FE_FEATURES,
                          params,
 -                        getter_AddRefs(migrateWizard));
 +                        &migrateWizard);
  }
@@ -12630,17 +12630,17 @@ diff --git a/browser/components/migratio
    NS_ENSURE_TRUE(profileSvc, NS_ERROR_FAILURE);
  
 -  nsCOMPtr<nsIProperties> dirService
 +  nsIProperties* dirService
      (do_GetService("@mozilla.org/file/directory_service;1"));
    NS_ENSURE_TRUE(dirService, NS_ERROR_FAILURE);
  
 -  nsCOMPtr<nsILocalFile> regFile;
-+  nsILocalFile* regFile;
++  nsILocalFile* regFile = nsnull;
  #ifdef XP_WIN
    rv = dirService->Get(NS_WIN_APPDATA_DIR, NS_GET_IID(nsILocalFile),
                         getter_AddRefs(regFile));
 @@ -328,7 +328,7 @@ nsProfileMigrator::ImportRegistryProfile
    regFile->AppendNative(NS_LITERAL_CSTRING("appreg"));
  #else
    rv = dirService->Get(NS_UNIX_HOME_DIR, NS_GET_IID(nsILocalFile),
 -                       getter_AddRefs(regFile));
@@ -12657,17 +12657,17 @@ diff --git a/browser/components/migratio
        (do_CreateInstance("@mozilla.org/file/local;1"));
      if (!profileFile)
        continue;
 @@ -387,10 +387,10 @@ nsProfileMigrator::ImportRegistryProfile
  #endif
      if (NS_FAILED(rv)) continue;
  
 -    nsCOMPtr<nsIToolkitProfile> tprofile;
-+    nsIToolkitProfile* tprofile;
++    nsIToolkitProfile* tprofile = nsnull;
      profileSvc->CreateProfile(profileFile, nsnull,
                                nsDependentCString(profileName),
 -                              getter_AddRefs(tprofile));
 +                              &tprofile);
      migrated = PR_TRUE;
    }
  
 diff --git a/browser/components/migration/src/nsProfileMigrator.h b/browser/components/migration/src/nsProfileMigrator.h
@@ -12695,95 +12695,95 @@ diff --git a/browser/components/migratio
    }
    if (!mSourceProfile)
 @@ -165,8 +165,8 @@ nsSeamonkeyProfileMigrator::GetMigrateDa
  
    if (!signonsFileName.IsEmpty()) {
      NS_ConvertASCIItoUTF16 fileName(signonsFileName);
 -    nsCOMPtr<nsIFile> sourcePasswordsFile;
 -    mSourceProfile->Clone(getter_AddRefs(sourcePasswordsFile));
-+    nsIFile* sourcePasswordsFile;
++    nsIFile* sourcePasswordsFile = nsnull;
 +    mSourceProfile->Clone(&sourcePasswordsFile);
      sourcePasswordsFile->Append(fileName);
      
      PRBool exists;
 @@ -181,8 +181,8 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  nsSeamonkeyProfileMigrator::GetSourceExists(PRBool* aResult)
  {
 -  nsCOMPtr<nsISupportsArray> profiles;
 -  GetSourceProfiles(getter_AddRefs(profiles));
-+  nsISupportsArray* profiles;
++  nsISupportsArray* profiles = nsnull;
 +  GetSourceProfiles(&profiles);
  
    if (profiles) { 
      PRUint32 count;
 @@ -198,8 +198,8 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  nsSeamonkeyProfileMigrator::GetSourceHasMultipleProfiles(PRBool* aResult)
  {
 -  nsCOMPtr<nsISupportsArray> profiles;
 -  GetSourceProfiles(getter_AddRefs(profiles));
-+  nsISupportsArray* profiles;
++  nsISupportsArray* profiles = nsnull;
 +  GetSourceProfiles(&profiles);
  
    if (profiles) {
      PRUint32 count;
 @@ -232,25 +232,25 @@ nsSeamonkeyProfileMigrator::GetSourceHom
  nsSeamonkeyProfileMigrator::GetSourceHomePageURL(nsACString& aResult)
  {
    // Load the source pref file
 -  nsCOMPtr<nsIPrefService> psvc(do_GetService(NS_PREFSERVICE_CONTRACTID));
 +  nsIPrefService* psvc(do_GetService(NS_PREFSERVICE_CONTRACTID));
    psvc->ResetPrefs();
  
 -  nsCOMPtr<nsIFile> sourcePrefsFile;
-+  nsIFile* sourcePrefsFile;
++  nsIFile* sourcePrefsFile = nsnull;
    
 -  mSourceProfile->Clone(getter_AddRefs(sourcePrefsFile));
 +  mSourceProfile->Clone(&sourcePrefsFile);
    sourcePrefsFile->Append(FILE_NAME_PREFS);
  
    psvc->ReadUserPrefs(sourcePrefsFile);
  
 -  nsCOMPtr<nsIPrefBranch> branch(do_QueryInterface(psvc));
 +  nsIPrefBranch* branch(do_QueryInterface(psvc));
  
    PRBool hasUserValue;
 -  nsCOMPtr<nsIPrefLocalizedString> prefValue;
-+  nsIPrefLocalizedString* prefValue;
++  nsIPrefLocalizedString* prefValue = nsnull;
    nsresult rv = branch->PrefHasUserValue("browser.startup.homepage", &hasUserValue);
    if (NS_SUCCEEDED(rv) && hasUserValue) {
      rv = branch->GetComplexValue("browser.startup.homepage", 
                                   NS_GET_IID(nsIPrefLocalizedString),
 -                                 getter_AddRefs(prefValue));
 +                                 (void**)&prefValue);
      if (NS_SUCCEEDED(rv) && prefValue) {
        nsString data;
        prefValue->ToString(getter_Copies(data));
 @@ -277,9 +277,9 @@ nsSeamonkeyProfileMigrator::GetSourcePro
    PRUint32 count;
    mProfileNames->Count(&count);
    for (PRUint32 i = 0; i < count; ++i) {
 -    nsCOMPtr<nsISupportsString> str;
-+    nsISupportsString* str;
++    nsISupportsString* str = nsnull;
      mProfileNames->QueryElementAt(i, NS_GET_IID(nsISupportsString),
 -                                  getter_AddRefs(str));
 +                                  (void**)&str);
      nsString profileName;
      str->GetData(profileName);
      if (profileName.Equals(aProfile)) {
 @@ -296,8 +296,8 @@ nsSeamonkeyProfileMigrator::FillProfileD
  nsSeamonkeyProfileMigrator::FillProfileDataFromSeamonkeyRegistry()
  {
    // Find the Seamonkey Registry
 -  nsCOMPtr<nsIProperties> fileLocator(do_GetService("@mozilla.org/file/directory_service;1"));
 -  nsCOMPtr<nsILocalFile> seamonkeyRegistry;
 +  nsIProperties* fileLocator(do_GetService("@mozilla.org/file/directory_service;1"));
-+  nsILocalFile* seamonkeyRegistry;
++  nsILocalFile* seamonkeyRegistry = nsnull;
  #ifdef XP_WIN
    fileLocator->Get(NS_WIN_APPDATA_DIR, NS_GET_IID(nsILocalFile), getter_AddRefs(seamonkeyRegistry));
  
 @@ -309,7 +309,7 @@ nsSeamonkeyProfileMigrator::FillProfileD
    seamonkeyRegistry->Append(NS_LITERAL_STRING("Mozilla"));
    seamonkeyRegistry->Append(NS_LITERAL_STRING("Application Registry"));
  #elif defined(XP_UNIX)
 -  fileLocator->Get(NS_UNIX_HOME_DIR, NS_GET_IID(nsILocalFile), getter_AddRefs(seamonkeyRegistry));
@@ -12796,68 +12796,68 @@ diff --git a/browser/components/migratio
  
    // Load the source pref file
 -  nsCOMPtr<nsIPrefService> psvc(do_GetService(NS_PREFSERVICE_CONTRACTID));
 +  nsIPrefService* psvc(do_GetService(NS_PREFSERVICE_CONTRACTID));
    psvc->ResetPrefs();
  
 -  nsCOMPtr<nsIFile> sourcePrefsFile;
 -  mSourceProfile->Clone(getter_AddRefs(sourcePrefsFile));
-+  nsIFile* sourcePrefsFile;
++  nsIFile* sourcePrefsFile = nsnull;
 +  mSourceProfile->Clone(&sourcePrefsFile);
    sourcePrefsFile->Append(aSourcePrefFileName);
    psvc->ReadUserPrefs(sourcePrefsFile);
  
 -  nsCOMPtr<nsIPrefBranch> branch(do_QueryInterface(psvc));
 +  nsIPrefBranch* branch(do_QueryInterface(psvc));
    for (transform = gTransforms; transform < end; ++transform)
      transform->prefGetterFunc(transform, branch);
  
 @@ -484,8 +484,8 @@ nsSeamonkeyProfileMigrator::TransformPre
    delete fontPrefs;
    fontPrefs = nsnull;
  
 -  nsCOMPtr<nsIFile> targetPrefsFile;
 -  mTargetProfile->Clone(getter_AddRefs(targetPrefsFile));
-+  nsIFile* targetPrefsFile;
++  nsIFile* targetPrefsFile = nsnull;
 +  mTargetProfile->Clone(&targetPrefsFile);
    targetPrefsFile->Append(aTargetPrefFileName);
    psvc->SavePrefFile(targetPrefsFile);
  
 @@ -511,8 +511,8 @@ nsSeamonkeyProfileMigrator::ReadFontsBra
                                              nsVoidArray* aPrefs)
  {
    // Enumerate the branch
 -  nsCOMPtr<nsIPrefBranch> branch;
 -  aPrefService->GetBranch("font.", getter_AddRefs(branch));
-+  nsIPrefBranch* branch;
++  nsIPrefBranch* branch = nsnull;
 +  aPrefService->GetBranch("font.", &branch);
  
    PRUint32 count;
    char** prefs = nsnull;
 @@ -539,10 +539,10 @@ nsSeamonkeyProfileMigrator::ReadFontsBra
        break;
      case nsIPrefBranch::PREF_INVALID:
        {
 -        nsCOMPtr<nsIPrefLocalizedString> str;
-+        nsIPrefLocalizedString* str;
++        nsIPrefLocalizedString* str = nsnull;
          rv = branch->GetComplexValue(currPref, 
                                      NS_GET_IID(nsIPrefLocalizedString), 
 -                                    getter_AddRefs(str));
 +                                    (void**)&str);
          if (NS_SUCCEEDED(rv) && str)
            str->ToString(&pref->wstringValue);
        }
 @@ -561,8 +561,8 @@ nsSeamonkeyProfileMigrator::WriteFontsBr
    nsresult rv;
  
    // Enumerate the branch
 -  nsCOMPtr<nsIPrefBranch> branch;
 -  aPrefService->GetBranch("font.", getter_AddRefs(branch));
-+  nsIPrefBranch* branch;
++  nsIPrefBranch* branch = nsnull;
 +  aPrefService->GetBranch("font.", &branch);
  
    PRUint32 count = aPrefs->Count();
    for (PRUint32 i = 0; i < count; ++i) {
 @@ -580,7 +580,7 @@ nsSeamonkeyProfileMigrator::WriteFontsBr
        rv = branch->SetIntPref(pref->prefName, pref->intValue);
        break;
      case nsIPrefBranch::PREF_INVALID:
@@ -12867,44 +12867,44 @@ diff --git a/browser/components/migratio
        rv = branch->SetComplexValue(pref->prefName, 
                                     NS_GET_IID(nsIPrefLocalizedString),
 @@ -622,8 +622,8 @@ nsresult
  nsresult 
  nsSeamonkeyProfileMigrator::CopyUserContentSheet()
  {
 -  nsCOMPtr<nsIFile> sourceUserContent;
 -  mSourceProfile->Clone(getter_AddRefs(sourceUserContent));
-+  nsIFile* sourceUserContent;
++  nsIFile* sourceUserContent = nsnull;
 +  mSourceProfile->Clone(&sourceUserContent);
    sourceUserContent->Append(DIR_NAME_CHROME);
    sourceUserContent->Append(FILE_NAME_USERCONTENT);
  
 @@ -632,11 +632,11 @@ nsSeamonkeyProfileMigrator::CopyUserCont
    if (!exists)
      return NS_OK;
  
 -  nsCOMPtr<nsIFile> targetUserContent;
 -  mTargetProfile->Clone(getter_AddRefs(targetUserContent));
-+  nsIFile* targetUserContent;
++  nsIFile* targetUserContent = nsnull;
 +  mTargetProfile->Clone(&targetUserContent);
    targetUserContent->Append(DIR_NAME_CHROME);
 -  nsCOMPtr<nsIFile> targetChromeDir;
 -  targetUserContent->Clone(getter_AddRefs(targetChromeDir));
-+  nsIFile* targetChromeDir;
++  nsIFile* targetChromeDir = nsnull;
 +  targetUserContent->Clone(&targetChromeDir);
    targetUserContent->Append(FILE_NAME_USERCONTENT);
  
    targetUserContent->Exists(&exists);
 @@ -653,8 +653,8 @@ nsSeamonkeyProfileMigrator::CopyCookies(
    if (aReplace)
      rv = CopyFile(FILE_NAME_COOKIES, FILE_NAME_COOKIES);
    else {
 -    nsCOMPtr<nsIFile> seamonkeyCookiesFile;
 -    mSourceProfile->Clone(getter_AddRefs(seamonkeyCookiesFile));
-+    nsIFile* seamonkeyCookiesFile;
++    nsIFile* seamonkeyCookiesFile = nsnull;
 +    mSourceProfile->Clone(&seamonkeyCookiesFile);
      seamonkeyCookiesFile->Append(FILE_NAME_COOKIES);
  
      rv = ImportNetscapeCookies(seamonkeyCookiesFile);
 @@ -687,12 +687,12 @@ nsSeamonkeyProfileMigrator::CopyPassword
      // being migrated. Also create a new instance of the legacy password
      // storage component, which we'll use to slurp in the signons from
      // Seamonkey's signons.txt.
@@ -12924,31 +12924,31 @@ diff --git a/browser/components/places/s
 --- a/browser/components/places/src/nsPlacesImportExportService.cpp
 +++ b/browser/components/places/src/nsPlacesImportExportService.cpp
 @@ -918,8 +918,8 @@ BookmarkContentSink::HandleLinkBegin(con
  
    // save the favicon, ignore errors
    if (!icon.IsEmpty() || !iconUri.IsEmpty()) {
 -    nsCOMPtr<nsIURI> iconUriObject;
 -    NS_NewURI(getter_AddRefs(iconUriObject), iconUri);
-+    nsIURI* iconUriObject;
++    nsIURI* iconUriObject = nsnull;
 +    NS_NewURI(&iconUriObject, iconUri);
      if (!icon.IsEmpty() || iconUriObject) {
        rv = SetFaviconForURI(frame.mPreviousLink, iconUriObject,
                              NS_ConvertUTF16toUTF8(icon));
 @@ -949,11 +949,11 @@ BookmarkContentSink::HandleLinkBegin(con
    // Note: expiration and generated title are ignored, and will be recalculated
    // by the microsummary service
    if (!micsumGenURI.IsEmpty()) {
 -    nsCOMPtr<nsIURI> micsumGenURIObject;
 -    if (NS_SUCCEEDED(NS_NewURI(getter_AddRefs(micsumGenURIObject), micsumGenURI))) {
 -      nsCOMPtr<nsIMicrosummary> microsummary;
-+    nsIURI* micsumGenURIObject;
++    nsIURI* micsumGenURIObject = nsnull;
 +    if (NS_SUCCEEDED(NS_NewURI(&micsumGenURIObject, micsumGenURI))) {
-+      nsIMicrosummary* microsummary;
++      nsIMicrosummary* microsummary = nsnull;
        mMicrosummaryService->CreateMicrosummary(frame.mPreviousLink, micsumGenURIObject,
 -                                               getter_AddRefs(microsummary));
 +                                               &microsummary);
        mMicrosummaryService->SetMicrosummary(frame.mPreviousId, microsummary);
      }
    }
 @@ -1241,7 +1241,7 @@ BookmarkContentSink::SetFaviconForURI(ns
    nsresult rv;
@@ -12959,174 +12959,174 @@ diff --git a/browser/components/places/s
    NS_ENSURE_SUCCESS(rv, rv);
  
    // if the input favicon URI is a chrome: URI, then we just save it and don't
 @@ -1259,7 +1259,7 @@ BookmarkContentSink::SetFaviconForURI(ns
    if (aData.Length() <= 5)
      return NS_OK;
  
 -  nsCOMPtr<nsIURI> faviconURI;
-+  nsIURI* faviconURI;
++  nsIURI* faviconURI = nsnull;
    if (aIconURI) {
      faviconURI = aIconURI;
    } else {
 @@ -1271,29 +1271,29 @@ BookmarkContentSink::SetFaviconForURI(ns
      char buf[32];
      PR_snprintf(buf, sizeof(buf), "%lld", PR_Now());
      faviconSpec.Append(buf);
 -    rv = NS_NewURI(getter_AddRefs(faviconURI), faviconSpec);
 +    rv = NS_NewURI(&faviconURI, faviconSpec);
      NS_ENSURE_SUCCESS(rv, rv);
      serialNumber++;
    }
  
 -  nsCOMPtr<nsIURI> dataURI;
 -  rv = NS_NewURI(getter_AddRefs(dataURI), aData);
-+  nsIURI* dataURI;
++  nsIURI* dataURI = nsnull;
 +  rv = NS_NewURI(&dataURI, aData);
    NS_ENSURE_SUCCESS(rv, rv);
  
    // use the data: protocol handler to convert the data
 -  nsCOMPtr<nsIIOService> ioService = do_GetIOService(&rv);
 -  NS_ENSURE_SUCCESS(rv, rv);
 -  nsCOMPtr<nsIProtocolHandler> protocolHandler;
 -  rv = ioService->GetProtocolHandler("data", getter_AddRefs(protocolHandler));
 -  NS_ENSURE_SUCCESS(rv, rv);
 -
 -  nsCOMPtr<nsIChannel> channel;
 -  rv = protocolHandler->NewChannel(dataURI, getter_AddRefs(channel));
 +  nsIIOService* ioService = do_GetIOService(&rv);
 +  NS_ENSURE_SUCCESS(rv, rv);
-+  nsIProtocolHandler* protocolHandler;
++  nsIProtocolHandler* protocolHandler = nsnull;
 +  rv = ioService->GetProtocolHandler("data", &protocolHandler);
 +  NS_ENSURE_SUCCESS(rv, rv);
 +
-+  nsIChannel* channel;
++  nsIChannel* channel = nsnull;
 +  rv = protocolHandler->NewChannel(dataURI, &channel);
    NS_ENSURE_SUCCESS(rv, rv);
  
    // blocking stream is OK for data URIs
 -  nsCOMPtr<nsIInputStream> stream;
 -  rv = channel->Open(getter_AddRefs(stream));
-+  nsIInputStream* stream;
++  nsIInputStream* stream = nsnull;
 +  rv = channel->Open(&stream);
    NS_ENSURE_SUCCESS(rv, rv);
  
    PRUint32 available;
 @@ -1339,16 +1339,16 @@ BookmarkContentSink::SetFaviconForFolder
                                           const nsACString& aFavicon)
  {
    nsresult rv;
 -  nsCOMPtr<nsIFaviconService> faviconService(do_GetService(NS_FAVICONSERVICE_CONTRACTID, &rv));
 -  NS_ENSURE_SUCCESS(rv, rv);
 -
 -  nsCOMPtr<nsIURI> folderURI;
 +  nsIFaviconService* faviconService(do_GetService(NS_FAVICONSERVICE_CONTRACTID, &rv));
 +  NS_ENSURE_SUCCESS(rv, rv);
 +
-+  nsIURI* folderURI;
++  nsIURI* folderURI = nsnull;
    rv = mBookmarksService->GetFolderURI(aFolder,
 -                                                getter_AddRefs(folderURI));
 -  NS_ENSURE_SUCCESS(rv, rv);
 -
 -  nsCOMPtr<nsIURI> faviconURI;
 -  rv = NS_NewURI(getter_AddRefs(faviconURI), aFavicon);
 +                                                &folderURI);
 +  NS_ENSURE_SUCCESS(rv, rv);
 +
-+  nsIURI* faviconURI;
++  nsIURI* faviconURI = nsnull;
 +  rv = NS_NewURI(&faviconURI, aFavicon);
    NS_ENSURE_SUCCESS(rv, rv);
  
    return faviconService->SetFaviconUrlForPage(folderURI, faviconURI);
 @@ -1517,15 +1517,15 @@ WriteFaviconAttribute(const nsACString& 
    nsresult rv;
    PRUint32 dummy;
  
 -  nsCOMPtr<nsIURI> uri;
 -  rv = NS_NewURI(getter_AddRefs(uri), aURI);
-+  nsIURI* uri;
++  nsIURI* uri = nsnull;
 +  rv = NS_NewURI(&uri, aURI);
    NS_ENSURE_SUCCESS(rv, rv);
  
    // get favicon
 -  nsCOMPtr<nsIFaviconService> faviconService = do_GetService(NS_FAVICONSERVICE_CONTRACTID, &rv);
 -  NS_ENSURE_SUCCESS(rv, rv);
 -  nsCOMPtr<nsIURI> faviconURI;
 -  rv = faviconService->GetFaviconForPage(uri, getter_AddRefs(faviconURI));
 +  nsIFaviconService* faviconService = do_GetService(NS_FAVICONSERVICE_CONTRACTID, &rv);
 +  NS_ENSURE_SUCCESS(rv, rv);
-+  nsIURI* faviconURI;
++  nsIURI* faviconURI = nsnull;
 +  rv = faviconService->GetFaviconForPage(uri, &faviconURI);
    if (rv == NS_ERROR_NOT_AVAILABLE)
      return NS_OK; // no favicon
    NS_ENSURE_SUCCESS(rv, rv); // anything else is error
 @@ -1690,8 +1690,8 @@ nsPlacesImportExportService::WriteContai
    }
   
    // favicon (most folders won't have one)
 -  nsCOMPtr<nsIURI> folderURI;
 -  rv = mBookmarksService->GetFolderURI(folderId, getter_AddRefs(folderURI));
-+  nsIURI* folderURI;
++  nsIURI* folderURI = nsnull;
 +  rv = mBookmarksService->GetFolderURI(folderId, &folderURI);
    NS_ENSURE_SUCCESS(rv, rv);
    nsCAutoString folderSpec;
    rv = folderURI->GetSpec(folderSpec);
 @@ -1863,8 +1863,8 @@ nsPlacesImportExportService::WriteItem(n
    }
  
    // post data
 -  nsCOMPtr<nsIURI> pageURI;
 -  rv = NS_NewURI(getter_AddRefs(pageURI), uri, nsnull);
-+  nsIURI* pageURI;
++  nsIURI* pageURI = nsnull;
 +  rv = NS_NewURI(&pageURI, uri, nsnull);
    NS_ENSURE_SUCCESS(rv, rv);
    
    PRBool hasPostData;
 @@ -1896,15 +1896,15 @@ nsPlacesImportExportService::WriteItem(n
      aOutput->Write(kWebPanelAttribute, sizeof(kWebPanelAttribute)-1, &dummy);
  
    // microsummary
 -  nsCOMPtr<nsIMicrosummary> microsummary;
 -  rv = mMicrosummaryService->GetMicrosummary(itemId, getter_AddRefs(microsummary));
-+  nsIMicrosummary* microsummary;
++  nsIMicrosummary* microsummary = nsnull;
 +  rv = mMicrosummaryService->GetMicrosummary(itemId, &microsummary);
    NS_ENSURE_SUCCESS(rv, rv);
    if (microsummary) {
 -    nsCOMPtr<nsIMicrosummaryGenerator> generator;
 -    rv = microsummary->GetGenerator(getter_AddRefs(generator));
 -    NS_ENSURE_SUCCESS(rv, rv);
 -    nsCOMPtr<nsIURI> genURI;
 -    rv = generator->GetUri(getter_AddRefs(genURI));
-+    nsIMicrosummaryGenerator* generator;
++    nsIMicrosummaryGenerator* generator = nsnull;
 +    rv = microsummary->GetGenerator(&generator);
 +    NS_ENSURE_SUCCESS(rv, rv);
-+    nsIURI* genURI;
++    nsIURI* genURI = nsnull;
 +    rv = generator->GetUri(&genURI);
      NS_ENSURE_SUCCESS(rv, rv);
      nsCAutoString spec;
      rv = genURI->GetSpec(spec);
 @@ -1994,8 +1994,8 @@ nsPlacesImportExportService::WriteLivema
    NS_ENSURE_SUCCESS(rv, rv);
  
    // get feed URI
 -  nsCOMPtr<nsIURI> feedURI;
 -  rv = mLivemarkService->GetFeedURI(folderId, getter_AddRefs(feedURI));
-+  nsIURI* feedURI;
++  nsIURI* feedURI = nsnull;
 +  rv = mLivemarkService->GetFeedURI(folderId, &feedURI);
    NS_ENSURE_SUCCESS(rv, rv);
    if (feedURI) {
      nsCString feedSpec;
 @@ -2012,8 +2012,8 @@ nsPlacesImportExportService::WriteLivema
    }
  
    // get the optional site URI
 -  nsCOMPtr<nsIURI> siteURI;
 -  rv = mLivemarkService->GetSiteURI(folderId, getter_AddRefs(siteURI));
-+  nsIURI* siteURI;
++  nsIURI* siteURI = nsnull;
 +  rv = mLivemarkService->GetSiteURI(folderId, &siteURI);
    NS_ENSURE_SUCCESS(rv, rv);
    if (siteURI) {
      nsCString siteSpec;
 @@ -2145,7 +2145,7 @@ nsPlacesImportExportService::WriteContai
    nsresult rv = aFolder->GetItemId(&folderId);
    NS_ENSURE_SUCCESS(rv, rv);
  
@@ -13136,17 +13136,17 @@ diff --git a/browser/components/places/s
  
    rv = folderNode->SetContainerOpen(PR_TRUE);
 @@ -2166,8 +2166,8 @@ nsPlacesImportExportService::WriteContai
    PRUint32 childCount = 0;
    folderNode->GetChildCount(&childCount);
    for (PRUint32 i = 0; i < childCount; ++i) {
 -    nsCOMPtr<nsINavHistoryResultNode> child;
 -    rv = folderNode->GetChild(i, getter_AddRefs(child));
-+    nsINavHistoryResultNode* child;
++    nsINavHistoryResultNode* child = nsnull;
 +    rv = folderNode->GetChild(i, &child);
      NS_ENSURE_SUCCESS(rv, rv);
      PRUint32 type = 0;
      rv = child->GetType(&type);
 @@ -2233,7 +2233,7 @@ nsPlacesImportExportService::ImportHTMLF
    nsresult rv = EnsureServiceState();
    NS_ENSURE_SUCCESS(rv, rv);
  
@@ -13175,34 +13175,34 @@ diff --git a/browser/components/places/s
    // channel: note we have to set the content type or the default "unknown" type
    // will confuse the parser
 -  nsCOMPtr<nsIIOService> ioservice = do_GetIOService(&rv);
 -  NS_ENSURE_SUCCESS(rv, rv);
 -  nsCOMPtr<nsIURI> fileURI;
 -  rv = ioservice->NewFileURI(file, getter_AddRefs(fileURI));
 +  nsIIOService* ioservice = do_GetIOService(&rv);
 +  NS_ENSURE_SUCCESS(rv, rv);
-+  nsIURI* fileURI;
++  nsIURI* fileURI = nsnull;
 +  rv = ioservice->NewFileURI(file, &fileURI);
    NS_ENSURE_SUCCESS(rv, rv);
    rv = ioservice->NewChannelFromURI(fileURI, getter_AddRefs(mImportChannel));
    NS_ENSURE_SUCCESS(rv, rv);
 @@ -2294,17 +2294,17 @@ nsPlacesImportExportService::RunBatched(
    }
  
    // streams
 -  nsCOMPtr<nsIInputStream> stream;
 -  rv = mImportChannel->Open(getter_AddRefs(stream));
 -  NS_ENSURE_SUCCESS(rv, rv);
 -  nsCOMPtr<nsIInputStream> bufferedstream;
 -  rv = NS_NewBufferedInputStream(getter_AddRefs(bufferedstream), stream, 4096);
-+  nsIInputStream* stream;
++  nsIInputStream* stream = nsnull;
 +  rv = mImportChannel->Open(&stream);
 +  NS_ENSURE_SUCCESS(rv, rv);
-+  nsIInputStream* bufferedstream;
++  nsIInputStream* bufferedstream = nsnull;
 +  rv = NS_NewBufferedInputStream(&bufferedstream, stream, 4096);
    NS_ENSURE_SUCCESS(rv, rv);
  
    // feed the parser the data
    // Note: on error, we always need to set the channel's status to be the
    // same, and to always call OnStopRequest with the channel error.
 -  nsCOMPtr<nsIStreamListener> listener = do_QueryInterface(aUserData, &rv);
 +  nsIStreamListener* listener = do_QueryInterface(aUserData, &rv);
@@ -13210,75 +13210,75 @@ diff --git a/browser/components/places/s
    rv = listener->OnStartRequest(mImportChannel, nsnull);
    rv = SyncChannelStatus(mImportChannel, rv);
 @@ -2355,8 +2355,8 @@ nsPlacesImportExportService::ExportHTMLT
  
    // get a safe output stream, so we don't clobber the bookmarks file unless
    // all the writes succeeded.
 -  nsCOMPtr<nsIOutputStream> out;
 -  rv = NS_NewSafeLocalFileOutputStream(getter_AddRefs(out),
-+  nsIOutputStream* out;
++  nsIOutputStream* out = nsnull;
 +  rv = NS_NewSafeLocalFileOutputStream(&out,
                                         aBookmarksFile,
                                         PR_WRONLY | PR_CREATE_FILE,
                                         /*octal*/ 0600,
 @@ -2365,8 +2365,8 @@ nsPlacesImportExportService::ExportHTMLT
  
    // We need a buffered output stream for performance.
    // See bug 202477.
 -  nsCOMPtr<nsIOutputStream> strm;
 -  rv = NS_NewBufferedOutputStream(getter_AddRefs(strm), out, 4096);
-+  nsIOutputStream* strm;
++  nsIOutputStream* strm = nsnull;
 +  rv = NS_NewBufferedOutputStream(&strm, out, 4096);
    NS_ENSURE_SUCCESS(rv, rv);
  
    // get bookmarks root id
 @@ -2380,13 +2380,13 @@ nsPlacesImportExportService::ExportHTMLT
    NS_ENSURE_SUCCESS(rv, rv);
  
    // get empty options
 -  nsCOMPtr<nsINavHistoryQueryOptions> options;
 -  rv = mHistoryService->GetNewQueryOptions(getter_AddRefs(options));
-+  nsINavHistoryQueryOptions* options;
++  nsINavHistoryQueryOptions* options = nsnull;
 +  rv = mHistoryService->GetNewQueryOptions(&options);
    NS_ENSURE_SUCCESS(rv, rv);
  
    // get a new query object
 -  nsCOMPtr<nsINavHistoryQuery> query;
 -  rv = mHistoryService->GetNewQuery(getter_AddRefs(query));
-+  nsINavHistoryQuery* query;
++  nsINavHistoryQuery* query = nsnull;
 +  rv = mHistoryService->GetNewQuery(&query);
    NS_ENSURE_SUCCESS(rv, rv);
  
    // query for just this folder
 @@ -2394,13 +2394,13 @@ nsPlacesImportExportService::ExportHTMLT
    NS_ENSURE_SUCCESS(rv, rv);
  
    // execute query
 -  nsCOMPtr<nsINavHistoryResult> result;
 -  rv = mHistoryService->ExecuteQuery(query, options, getter_AddRefs(result));
-+  nsINavHistoryResult* result;
++  nsINavHistoryResult* result = nsnull;
 +  rv = mHistoryService->ExecuteQuery(query, options, &result);
    NS_ENSURE_SUCCESS(rv, rv);
  
    // get root (folder) node
 -  nsCOMPtr<nsINavHistoryContainerResultNode> rootNode;
 -  rv = result->GetRoot(getter_AddRefs(rootNode));
-+  nsINavHistoryContainerResultNode* rootNode;
++  nsINavHistoryContainerResultNode* rootNode = nsnull;
 +  rv = result->GetRoot(&rootNode);
    NS_ENSURE_SUCCESS(rv, rv);
  
    // '<H1'
 @@ -2408,8 +2408,8 @@ nsPlacesImportExportService::ExportHTMLT
    NS_ENSURE_SUCCESS(rv, rv);
  
    // bookmarks menu favicon
 -  nsCOMPtr<nsIURI> folderURI;
 -  rv = mBookmarksService->GetFolderURI(bookmarksRoot, getter_AddRefs(folderURI));
-+  nsIURI* folderURI;
++  nsIURI* folderURI = nsnull;
 +  rv = mBookmarksService->GetFolderURI(bookmarksRoot, &folderURI);
    NS_ENSURE_SUCCESS(rv, rv);
    nsCAutoString folderSpec;
    rv = folderURI->GetSpec(folderSpec);
 @@ -2442,7 +2442,7 @@ nsPlacesImportExportService::ExportHTMLT
    NS_ENSURE_SUCCESS(rv, rv);
  
    // commit the write
@@ -13287,17 +13287,17 @@ diff --git a/browser/components/places/s
    NS_ENSURE_SUCCESS(rv, rv);
    rv = safeStream->Finish();
  #ifdef DEBUG_EXPORT
 @@ -2458,12 +2458,12 @@ nsPlacesImportExportService::BackupBookm
    NS_ENSURE_SUCCESS(rv, rv);
  
    // get bookmarks file
 -  nsCOMPtr<nsIFile> bookmarksFileDir;
-+  nsIFile* bookmarksFileDir;
++  nsIFile* bookmarksFileDir = nsnull;
    rv = NS_GetSpecialDirectory(NS_APP_BOOKMARKS_50_FILE,
 -                              getter_AddRefs(bookmarksFileDir));
 -
 -  NS_ENSURE_SUCCESS(rv, rv);
 -  nsCOMPtr<nsILocalFile> bookmarksFile(do_QueryInterface(bookmarksFileDir));
 +                              &bookmarksFileDir);
 +
 +  NS_ENSURE_SUCCESS(rv, rv);
@@ -13310,55 +13310,55 @@ diff --git a/browser/components/places/s
  
    // archive if needed
 -  nsCOMPtr<nsIPrefService> prefServ(do_GetService(NS_PREFSERVICE_CONTRACTID, &rv));
 -  NS_ENSURE_SUCCESS(rv, rv);
 -  nsCOMPtr<nsIPrefBranch> bookmarksPrefs;
 -  rv = prefServ->GetBranch("browser.bookmarks.", getter_AddRefs(bookmarksPrefs));
 +  nsIPrefService* prefServ(do_GetService(NS_PREFSERVICE_CONTRACTID, &rv));
 +  NS_ENSURE_SUCCESS(rv, rv);
-+  nsIPrefBranch* bookmarksPrefs;
++  nsIPrefBranch* bookmarksPrefs = nsnull;
 +  rv = prefServ->GetBranch("browser.bookmarks.", &bookmarksPrefs);
    NS_ENSURE_SUCCESS(rv, rv);
  
    PRInt32 numberOfBackups;
 @@ -2512,9 +2512,9 @@ nsPlacesImportExportService::ArchiveBook
  nsPlacesImportExportService::ArchiveBookmarksFile(PRInt32 numberOfBackups,
                                           PRBool forceArchive)
  {
 -  nsCOMPtr<nsIFile> bookmarksBackupDir;
-+  nsIFile* bookmarksBackupDir;
++  nsIFile* bookmarksBackupDir = nsnull;
    nsresult rv = NS_GetSpecialDirectory(NS_APP_USER_PROFILE_50_DIR,
 -                                       getter_AddRefs(bookmarksBackupDir));
 +                                       &bookmarksBackupDir);
    NS_ENSURE_SUCCESS(rv, rv);
    
    nsDependentCString dirName("bookmarkbackups");
 @@ -2546,11 +2546,11 @@ nsPlacesImportExportService::ArchiveBook
    //nsAutoString backupFilenameString = NS_ConvertUTF8toUTF16(backupFilenameCString);
    nsAutoString backupFilenameString = NS_ConvertUTF8toUTF16((timeString));
  
 -  nsCOMPtr<nsIFile> backupFile;
-+  nsIFile* backupFile;
++  nsIFile* backupFile = nsnull;
    if (forceArchive) {
      // if we have a backup from today, nuke it
 -    nsCOMPtr<nsIFile> currentBackup;
 -    rv = bookmarksBackupDir->Clone(getter_AddRefs(currentBackup));
-+    nsIFile* currentBackup;
++    nsIFile* currentBackup = nsnull;
 +    rv = bookmarksBackupDir->Clone(&currentBackup);
      NS_ENSURE_SUCCESS(rv, rv);
      rv = currentBackup->Append(backupFilenameString);
      NS_ENSURE_SUCCESS(rv, rv);
 @@ -2560,8 +2560,8 @@ nsPlacesImportExportService::ArchiveBook
        NS_ENSURE_SUCCESS(rv, rv);
      }
    } else {
 -    nsCOMPtr<nsISimpleEnumerator> existingBackups;
 -    rv = bookmarksBackupDir->GetDirectoryEntries(getter_AddRefs(existingBackups));
-+    nsISimpleEnumerator* existingBackups;
++    nsISimpleEnumerator* existingBackups = nsnull;
 +    rv = bookmarksBackupDir->GetDirectoryEntries(&existingBackups);
      NS_ENSURE_SUCCESS(rv, rv);
  
      nsStringArray backupFileNames;
 @@ -2572,7 +2572,7 @@ nsPlacesImportExportService::ArchiveBook
      while (NS_SUCCEEDED(existingBackups->HasMoreElements(&hasMoreElements)) &&
             hasMoreElements)
      {
@@ -13376,17 +13376,17 @@ diff --git a/browser/components/places/s
          (void)backupFile->Append(*backupFileNames[0]);
          (void)backupFile->Remove(PR_FALSE);
          backupFileNames.RemoveStringAt(0);
 @@ -2605,9 +2605,9 @@ nsPlacesImportExportService::ArchiveBook
        return NS_OK;
    }
  
 -  nsCOMPtr<nsIFile> bookmarksFile;
-+  nsIFile* bookmarksFile;
++  nsIFile* bookmarksFile = nsnull;
    rv = NS_GetSpecialDirectory(NS_APP_BOOKMARKS_50_FILE,
 -                              getter_AddRefs(bookmarksFile));
 +                              &bookmarksFile);
    NS_ENSURE_SUCCESS(rv, rv);
    
    rv = bookmarksFile->CopyTo(bookmarksBackupDir, backupFilenameString);
 diff --git a/browser/components/safebrowsing/src/nsDocNavStartProgressListener.cpp b/browser/components/safebrowsing/src/nsDocNavStartProgressListener.cpp
 --- a/browser/components/safebrowsing/src/nsDocNavStartProgressListener.cpp
@@ -13409,17 +13409,17 @@ diff --git a/browser/components/safebrow
        NS_DOCUMENTLOADER_SERVICE_CONTRACTID, &rv);
    NS_ENSURE_SUCCESS(rv, rv);
  
 @@ -122,7 +122,7 @@ nsresult
  nsresult
  nsDocNavStartProgressListener::GetRequestUri(nsIRequest* aReq, nsIURI** uri)
  {
 -  nsCOMPtr<nsIChannel> channel;
-+  nsIChannel* channel;
++  nsIChannel* channel = nsnull;
    nsresult rv;
    channel = do_QueryInterface(aReq, &rv);
    if (NS_FAILED(rv))
 @@ -221,8 +221,8 @@ nsDocNavStartProgressListener::IsSpuriou
  
    // If there's a nested URI, we want to check the inner URI's scheme.
    // If we find a spurious scheme then we can break the checking loop at that point.
 -  nsCOMPtr<nsIURI> inner = aURI;
@@ -13438,17 +13438,17 @@ diff --git a/browser/components/safebrow
      NS_ENSURE_SUCCESS(rv, rv);
      nestedURI = do_QueryInterface(inner);
    }
 @@ -279,10 +279,10 @@ nsDocNavStartProgressListener::OnLocatio
  {
    nsresult rv;
    nsCAutoString uriString;
 -  nsCOMPtr<nsIURI> uri;
-+  nsIURI* uri;
++  nsIURI* uri = nsnull;
  
    // ignore requests with no URI
 -  rv = GetRequestUri(aRequest, getter_AddRefs(uri));
 +  rv = GetRequestUri(aRequest, &uri);
    if (NS_FAILED(rv))
      return NS_OK;
    rv = uri->GetAsciiSpec(uriString);
 @@ -293,7 +293,7 @@ nsDocNavStartProgressListener::OnLocatio
@@ -13461,17 +13461,17 @@ diff --git a/browser/components/safebrow
  
    rv = timer->Init(this, mDelay, nsITimer::TYPE_ONE_SHOT);
 @@ -348,8 +348,8 @@ nsDocNavStartProgressListener::Observe(n
      if (mCallback) {
        PRBool isSpurious;
  
 -      nsCOMPtr<nsIURI> uri;
 -      nsresult rv = GetRequestUri(request, getter_AddRefs(uri));
-+      nsIURI* uri;
++      nsIURI* uri = nsnull;
 +      nsresult rv = GetRequestUri(request, &uri);
        NS_ENSURE_SUCCESS(rv, rv);
        
        rv = IsSpurious(uri, &isSpurious);
 diff --git a/browser/components/shell/src/nsGNOMEShellService.cpp b/browser/components/shell/src/nsGNOMEShellService.cpp
 --- a/browser/components/shell/src/nsGNOMEShellService.cpp
 +++ b/browser/components/shell/src/nsGNOMEShellService.cpp
 @@ -109,8 +109,8 @@ nsGNOMEShellService::Init()
@@ -13490,17 +13490,17 @@ diff --git a/browser/components/shell/sr
    mUseLocaleFilenames = PR_GetEnv("G_BROKEN_FILENAMES") != nsnull;
  
 -  nsCOMPtr<nsIProperties> dirSvc
 +  nsIProperties* dirSvc
      (do_GetService("@mozilla.org/file/directory_service;1"));
    NS_ENSURE_TRUE(dirSvc, NS_ERROR_NOT_AVAILABLE);
  
 -  nsCOMPtr<nsILocalFile> appPath;
-+  nsILocalFile* appPath;
++  nsILocalFile* appPath = nsnull;
    rv = dirSvc->Get(NS_XPCOM_CURRENT_PROCESS_DIR, NS_GET_IID(nsILocalFile),
 -                   getter_AddRefs(appPath));
 +                   (void**)&appPath);
    NS_ENSURE_SUCCESS(rv, rv);
  
    rv = appPath->AppendNative(NS_LITERAL_CSTRING(MOZ_APP_NAME));
 @@ -171,7 +171,7 @@ nsGNOMEShellService::IsDefaultBrowser(PR
    if (aStartupCheck)
@@ -13530,61 +13530,61 @@ diff --git a/browser/components/shell/sr
  
 -    nsCOMPtr<nsIStringBundleService> bundleService =
 +    nsIStringBundleService* bundleService =
        do_GetService(NS_STRINGBUNDLE_CONTRACTID);
      NS_ENSURE_TRUE(bundleService, NS_ERROR_OUT_OF_MEMORY);
  
 -    nsCOMPtr<nsIStringBundle> brandBundle;
 -    bundleService->CreateBundle(BRAND_PROPERTIES, getter_AddRefs(brandBundle));
-+    nsIStringBundle* brandBundle;
++    nsIStringBundle* brandBundle = nsnull;
 +    bundleService->CreateBundle(BRAND_PROPERTIES, &brandBundle);
      NS_ENSURE_TRUE(brandBundle, NS_ERROR_FAILURE);
  
      nsString brandShortName, brandFullName;
 @@ -280,14 +280,14 @@ nsGNOMEShellService::SetDefaultBrowser(P
        NS_ERROR("no slash in executable path?");
      } else {
        iconFilePath.SetLength(lastSlash);
 -      nsCOMPtr<nsILocalFile> iconFile;
 -      NS_NewNativeLocalFile(iconFilePath, PR_FALSE, getter_AddRefs(iconFile));
-+      nsILocalFile* iconFile;
++      nsILocalFile* iconFile = nsnull;
 +      NS_NewNativeLocalFile(iconFilePath, PR_FALSE, &iconFile);
        if (iconFile) {
          iconFile->AppendRelativeNativePath(NS_LITERAL_CSTRING("icons/document.png"));
  
 -        nsCOMPtr<nsILocalFile> userIconPath;
-+        nsILocalFile* userIconPath;
++        nsILocalFile* userIconPath = nsnull;
          NS_NewNativeLocalFile(nsDependentCString(PR_GetEnv("HOME")), PR_FALSE,
 -                              getter_AddRefs(userIconPath));
 +                              &userIconPath);
          if (userIconPath) {
            userIconPath->AppendNative(NS_LITERAL_CSTRING(".icons"));
            iconFile->CopyToNative(userIconPath,
 @@ -321,10 +321,10 @@ nsGNOMEShellService::GetShouldCheckDefau
      return NS_OK;
    }
  
 -  nsCOMPtr<nsIPrefBranch> prefs;
 -  nsCOMPtr<nsIPrefService> pserve(do_GetService(NS_PREFSERVICE_CONTRACTID));
-+  nsIPrefBranch* prefs;
++  nsIPrefBranch* prefs = nsnull;
 +  nsIPrefService* pserve(do_GetService(NS_PREFSERVICE_CONTRACTID));
    if (pserve)
 -    pserve->GetBranch("", getter_AddRefs(prefs));
 +    pserve->GetBranch("", &prefs);
  
    prefs->GetBoolPref(PREF_CHECKDEFAULTBROWSER, aResult);
  
 @@ -334,10 +334,10 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  nsGNOMEShellService::SetShouldCheckDefaultBrowser(PRBool aShouldCheck)
  {
 -  nsCOMPtr<nsIPrefBranch> prefs;
 -  nsCOMPtr<nsIPrefService> pserve(do_GetService(NS_PREFSERVICE_CONTRACTID));
-+  nsIPrefBranch* prefs;
++  nsIPrefBranch* prefs = nsnull;
 +  nsIPrefService* pserve(do_GetService(NS_PREFSERVICE_CONTRACTID));
    if (pserve)
 -    pserve->GetBranch("", getter_AddRefs(prefs));
 +    pserve->GetBranch("", &prefs);
  
    prefs->SetBoolPref(PREF_CHECKDEFAULTBROWSER, aShouldCheck);
  
 @@ -347,14 +347,14 @@ static nsresult
@@ -13606,31 +13606,31 @@ diff --git a/browser/components/shell/sr
        return NS_ERROR_NOT_AVAILABLE;
 @@ -376,22 +376,22 @@ nsGNOMEShellService::SetDesktopBackgroun
                                            PRInt32 aPosition)
  {
    nsresult rv;
 -  nsCOMPtr<gfxIImageFrame> gfxFrame;
 -
 -  nsCOMPtr<nsIImageLoadingContent> imageContent = do_QueryInterface(aElement, &rv);
-+  gfxIImageFrame* gfxFrame;
++  gfxIImageFrame* gfxFrame = nsnull;
 +
 +  nsIImageLoadingContent* imageContent = do_QueryInterface(aElement, &rv);
    if (!imageContent) return rv;
  
    // get the image container
 -  nsCOMPtr<imgIRequest> request;
-+  imgIRequest* request;
++  imgIRequest* request = nsnull;
    rv = imageContent->GetRequest(nsIImageLoadingContent::CURRENT_REQUEST,
 -                                getter_AddRefs(request));
 +                                &request);
    if (!request) return rv;
 -  nsCOMPtr<imgIContainer> container;
 -  rv = request->GetImage(getter_AddRefs(container));
-+  imgIContainer* container;
++  imgIContainer* container = nsnull;
 +  rv = request->GetImage(&container);
    if (!container) return rv;
  
    // get the current frame, which holds the image data
 -  container->GetCurrentFrame(getter_AddRefs(gfxFrame));
 +  container->GetCurrentFrame(&gfxFrame);
  
    if (!gfxFrame)
@@ -13638,17 +13638,17 @@ diff --git a/browser/components/shell/sr
 @@ -402,11 +402,11 @@ nsGNOMEShellService::SetDesktopBackgroun
    // get the product brand name from localized strings
    nsString brandName;
    nsCID bundleCID = NS_STRINGBUNDLESERVICE_CID;
 -  nsCOMPtr<nsIStringBundleService> bundleService(do_GetService(bundleCID));
 +  nsIStringBundleService* bundleService(do_GetService(bundleCID));
    if (bundleService) {
 -    nsCOMPtr<nsIStringBundle> brandBundle;
-+    nsIStringBundle* brandBundle;
++    nsIStringBundle* brandBundle = nsnull;
      rv = bundleService->CreateBundle(BRAND_PROPERTIES,
 -                                     getter_AddRefs(brandBundle));
 +                                     &brandBundle);
      if (NS_SUCCEEDED(rv) && brandBundle) {
        rv = brandBundle->GetStringFromName(NS_LITERAL_STRING("brandShortName").get(),
                                            getter_Copies(brandName));
 @@ -423,7 +423,7 @@ nsGNOMEShellService::SetDesktopBackgroun
    rv = WriteImage(filePath, gfxFrame);
@@ -13699,17 +13699,17 @@ diff --git a/caps/src/nsJSPrincipals.cpp
 --- a/caps/src/nsJSPrincipals.cpp
 +++ b/caps/src/nsJSPrincipals.cpp
 @@ -132,8 +132,8 @@ nsTranscodeJSPrincipals(JSXDRState *xdr,
          nsIObjectInputStream *stream =
              reinterpret_cast<nsIObjectInputStream*>(xdr->userdata);
  
 -        nsCOMPtr<nsIPrincipal> prin;
 -        rv = stream->ReadObject(PR_TRUE, getter_AddRefs(prin));
-+        nsIPrincipal* prin;
++        nsIPrincipal* prin = nsnull;
 +        rv = stream->ReadObject(PR_TRUE, (class nsISupports**)&prin);
          if (NS_SUCCEEDED(rv)) {
              PRUint32 size;
              rv = stream->Read32(&size);
 @@ -172,7 +172,7 @@ nsJSPrincipals::Startup()
  nsJSPrincipals::Startup()
  {
      static const char rtsvc_id[] = "@mozilla.org/js/xpc/RuntimeService;1";
@@ -13743,17 +13743,17 @@ diff --git a/caps/src/nsPrincipal.cpp b/
    return
      mutableObj &&
 @@ -252,8 +252,8 @@ nsPrincipal::Equals(nsIPrincipal *aOther
        // If either principal has no URI, it's the saved principal from
        // preferences; in that case, test true.  Do NOT test true if the two
        // principals have URIs with different codebases.
 -      nsCOMPtr<nsIURI> otherURI;
 -      nsresult rv = aOther->GetURI(getter_AddRefs(otherURI));
-+      nsIURI* otherURI;
++      nsIURI* otherURI = nsnull;
 +      nsresult rv = aOther->GetURI(&otherURI);
        if (NS_FAILED(rv)) {
          *aResult = PR_FALSE;
          return rv;
 @@ -307,7 +307,7 @@ nsPrincipal::CanEnableCapability(const c
      // even with the pref disabled.
  
      static const char pref[] = "signed.applets.codebase_principal_support";
@@ -13762,45 +13762,45 @@ diff --git a/caps/src/nsPrincipal.cpp b/
        do_GetService(NS_PREFSERVICE_CONTRACTID);
      if (prefBranch) {
        PRBool mightEnable;
 @@ -928,7 +928,7 @@ nsPrincipal::Read(nsIObjectInputStream* 
    nsCString fingerprint;
    nsCString subjectName;
    nsCString prettyName;
 -  nsCOMPtr<nsISupports> cert;
-+  nsISupports* cert;
++  nsISupports* cert = nsnull;
    if (haveCert) {
      rv = NS_ReadOptionalCString(aStream, fingerprint);
      if (NS_FAILED(rv)) {
 @@ -945,14 +945,14 @@ nsPrincipal::Read(nsIObjectInputStream* 
        return rv;
      }
  
 -    rv = aStream->ReadObject(PR_TRUE, getter_AddRefs(cert));
 +    rv = aStream->ReadObject(PR_TRUE, &cert);
      if (NS_FAILED(rv)) {
        return rv;
      }
    }
  
 -  nsCOMPtr<nsIURI> codebase;
 -  rv = NS_ReadOptionalObject(aStream, PR_TRUE, getter_AddRefs(codebase));
-+  nsIURI* codebase;
++  nsIURI* codebase = nsnull;
 +  rv = NS_ReadOptionalObject(aStream, PR_TRUE, (class nsISupports**)&codebase);
    if (NS_FAILED(rv)) {
      return rv;
    }
 @@ -960,8 +960,8 @@ nsPrincipal::Read(nsIObjectInputStream* 
    rv = Init(fingerprint, subjectName, prettyName, cert, codebase);
    NS_ENSURE_SUCCESS(rv, rv);
  
 -  nsCOMPtr<nsIURI> domain;
 -  rv = NS_ReadOptionalObject(aStream, PR_TRUE, getter_AddRefs(domain));
-+  nsIURI* domain;
++  nsIURI* domain = nsnull;
 +  rv = NS_ReadOptionalObject(aStream, PR_TRUE, (class nsISupports**)&domain);
    if (NS_FAILED(rv)) {
      return rv;
    }
 diff --git a/caps/src/nsScriptSecurityManager.cpp b/caps/src/nsScriptSecurityManager.cpp
 --- a/caps/src/nsScriptSecurityManager.cpp
 +++ b/caps/src/nsScriptSecurityManager.cpp
 @@ -268,8 +268,8 @@ nsScriptSecurityManager::SecurityCompare
@@ -13814,85 +13814,85 @@ diff --git a/caps/src/nsScriptSecurityMa
  
      if (!sourceBaseURI || !targetBaseURI)
          return PR_FALSE;
 @@ -330,9 +330,9 @@ nsScriptSecurityManager::SecurityCompare
          NS_ENSURE_STATE(sIOService);
  
          PRInt32 defaultPort;
 -        nsCOMPtr<nsIProtocolHandler> protocolHandler;
-+        nsIProtocolHandler* protocolHandler;
++        nsIProtocolHandler* protocolHandler = nsnull;
          rv = sIOService->GetProtocolHandler(targetScheme.get(),
 -                                            getter_AddRefs(protocolHandler));
 +                                            &protocolHandler);
          if (NS_FAILED(rv))
          {
              return PR_FALSE;
 @@ -373,11 +373,11 @@ nsScriptSecurityManager::SecurityCompare
  
      // disallow access to directory listings (bug 209234)
      PRBool targetIsDir = PR_TRUE;
 -    nsCOMPtr<nsIFile> targetFile;
 -    nsCOMPtr<nsIFileURL> targetFileURL( do_QueryInterface(aTargetURI) );
-+    nsIFile* targetFile;
++    nsIFile* targetFile = nsnull;
 +    nsIFileURL* targetFileURL( do_QueryInterface(aTargetURI) );
  
      if (!targetFileURL ||
 -        NS_FAILED( targetFileURL->GetFile(getter_AddRefs(targetFile)) ) ||
 +        NS_FAILED( targetFileURL->GetFile(&targetFile) ) ||
          NS_FAILED( targetFile->IsDirectory(&targetIsDir) ) ||
          targetIsDir)
      {
 @@ -391,13 +391,13 @@ nsScriptSecurityManager::SecurityCompare
  
  
      // source parent directory is needed for remaining policies
 -    nsCOMPtr<nsIFile> sourceFile;
 -    nsCOMPtr<nsIFile> sourceParent;
 -    nsCOMPtr<nsIFileURL> sourceFileURL( do_QueryInterface(aSourceURI) );
-+    nsIFile* sourceFile;
-+    nsIFile* sourceParent;
++    nsIFile* sourceFile = nsnull;
++    nsIFile* sourceParent = nsnull;
 +    nsIFileURL* sourceFileURL( do_QueryInterface(aSourceURI) );
  
      if (!sourceFileURL ||
 -        NS_FAILED( sourceFileURL->GetFile(getter_AddRefs(sourceFile)) ) ||
 -        NS_FAILED( sourceFile->GetParent(getter_AddRefs(sourceParent)) ) ||
 +        NS_FAILED( sourceFileURL->GetFile(&sourceFile) ) ||
 +        NS_FAILED( sourceFile->GetParent(&sourceParent) ) ||
          !sourceParent)
      {
          // unexpected error
 @@ -409,8 +409,8 @@ nsScriptSecurityManager::SecurityCompare
      {
          // file: URIs in the same directory have the same origin
          PRBool sameParent = PR_FALSE;
 -        nsCOMPtr<nsIFile> targetParent;
 -        if (NS_FAILED( targetFile->GetParent(getter_AddRefs(targetParent)) ) ||
-+        nsIFile* targetParent;
++        nsIFile* targetParent = nsnull;
 +        if (NS_FAILED( targetFile->GetParent(&targetParent) ) ||
              NS_FAILED( sourceParent->Equals(targetParent, &sameParent) ))
              return PR_FALSE;
          return sameParent;
 @@ -434,8 +434,8 @@ nsScriptSecurityManager::GetChannelPrinc
                                               nsIPrincipal** aPrincipal)
  {
      NS_PRECONDITION(aChannel, "Must have channel!");
 -    nsCOMPtr<nsISupports> owner;
 -    aChannel->GetOwner(getter_AddRefs(owner));
-+    nsISupports* owner;
++    nsISupports* owner = nsnull;
 +    aChannel->GetOwner(&owner);
      if (owner) {
          CallQueryInterface(owner, aPrincipal);
          if (*aPrincipal) {
 @@ -445,13 +445,13 @@ nsScriptSecurityManager::GetChannelPrinc
  
      // OK, get the principal from the URI.  Make sure this does the same thing
      // as nsDocument::Reset and nsXULDocument::StartDocumentLoad.
 -    nsCOMPtr<nsIURI> uri;
-+    nsIURI* uri;
++    nsIURI* uri = nsnull;
      nsLoadFlags loadFlags = 0;
      nsresult rv = aChannel->GetLoadFlags(&loadFlags);
      if (NS_SUCCEEDED(rv) && (loadFlags & nsIChannel::LOAD_REPLACE)) {
 -      aChannel->GetURI(getter_AddRefs(uri));
 +      aChannel->GetURI(&uri);
      } else {
 -      aChannel->GetOriginalURI(getter_AddRefs(uri));
 +      aChannel->GetOriginalURI(&uri);
@@ -13900,30 +13900,30 @@ diff --git a/caps/src/nsScriptSecurityMa
  
      return GetCodebasePrincipal(uri, aPrincipal);
 @@ -663,10 +663,10 @@ nsScriptSecurityManager::CheckSameOrigin
      // Get the original URI from the source principal.
      // This has the effect of ignoring any change to document.domain
      // which must be done to avoid DNS spoofing (bug 154930)
 -    nsCOMPtr<nsIURI> sourceURI;
 -    sourcePrincipal->GetDomain(getter_AddRefs(sourceURI));
-+    nsIURI* sourceURI;
++    nsIURI* sourceURI = nsnull;
 +    sourcePrincipal->GetDomain(&sourceURI);
      if (!sourceURI) {
 -      sourcePrincipal->GetURI(getter_AddRefs(sourceURI));
 +      sourcePrincipal->GetURI(&sourceURI);
        NS_ENSURE_TRUE(sourceURI, NS_ERROR_FAILURE);
      }
  
 @@ -773,7 +773,7 @@ nsScriptSecurityManager::CheckPropertyAc
  #ifdef DEBUG_CAPS_CheckPropertyAccessImpl
                  printf("sameOrigin ");
  #endif
 -                nsCOMPtr<nsIPrincipal> objectPrincipal;
-+                nsIPrincipal* objectPrincipal;
++                nsIPrincipal* objectPrincipal = nsnull;
                  if(aJSObject)
                  {
                      objectPrincipal = doGetObjectPrincipal(cx, aJSObject);
 @@ -783,7 +783,7 @@ nsScriptSecurityManager::CheckPropertyAc
                  else if(aTargetURI)
                  {
                      if (NS_FAILED(GetCodebasePrincipal(
 -                          aTargetURI, getter_AddRefs(objectPrincipal))))
@@ -13948,46 +13948,46 @@ diff --git a/caps/src/nsScriptSecurityMa
 +    nsISecurityCheckedComponent* checkedComponent =
          do_QueryInterface(aObj);
  
      nsXPIDLCString objectSecurityLevel;
      if (checkedComponent)
      {
 -        nsCOMPtr<nsIXPConnectWrappedNative> wrapper;
 -        nsCOMPtr<nsIInterfaceInfo> interfaceInfo;
-+        nsIXPConnectWrappedNative* wrapper;
-+        nsIInterfaceInfo* interfaceInfo;
++        nsIXPConnectWrappedNative* wrapper = nsnull;
++        nsIInterfaceInfo* interfaceInfo = nsnull;
          const nsIID* objIID;
 -        rv = aCallContext->GetCalleeWrapper(getter_AddRefs(wrapper));
 +        rv = aCallContext->GetCalleeWrapper(&wrapper);
          if (NS_SUCCEEDED(rv))
 -            rv = wrapper->FindInterfaceWithMember(aProperty, getter_AddRefs(interfaceInfo));
 +            rv = wrapper->FindInterfaceWithMember(aProperty, &interfaceInfo);
          if (NS_SUCCEEDED(rv))
              rv = interfaceInfo->GetIIDShared(&objIID);
          if (NS_SUCCEEDED(rv))
 @@ -916,8 +916,8 @@ nsScriptSecurityManager::CheckPropertyAc
  
          if (sXPConnect)
          {
 -            nsCOMPtr<nsIXPCNativeCallContext> xpcCallContext;
 -            sXPConnect->GetCurrentNativeCallContext(getter_AddRefs(xpcCallContext));
-+            nsIXPCNativeCallContext* xpcCallContext;
++            nsIXPCNativeCallContext* xpcCallContext = nsnull;
 +            sXPConnect->GetCurrentNativeCallContext(&xpcCallContext);
              if (xpcCallContext)
                  xpcCallContext->SetExceptionWasThrown(PR_TRUE);
          }
 @@ -942,28 +942,28 @@ nsScriptSecurityManager::CheckSameOrigin
      PRBool subjectSetDomain = PR_FALSE;
      PRBool objectSetDomain = PR_FALSE;
      
 -    nsCOMPtr<nsIURI> subjectURI;
 -    nsCOMPtr<nsIURI> objectURI;
-+    nsIURI* subjectURI;
-+    nsIURI* objectURI;
++    nsIURI* subjectURI = nsnull;
++    nsIURI* objectURI = nsnull;
  
      if (aIsCheckConnect)
      {
          // Don't use domain for CheckConnect calls, since that's called for
          // data-only load checks like XMLHTTPRequest (bug 290100).
 -        aSubject->GetURI(getter_AddRefs(subjectURI));
 -        aObject->GetURI(getter_AddRefs(objectURI));
 +        aSubject->GetURI(&subjectURI);
@@ -14012,30 +14012,30 @@ diff --git a/caps/src/nsScriptSecurityMa
          } else {
              objectSetDomain = PR_TRUE;
          }
 @@ -1266,9 +1266,9 @@ nsScriptSecurityManager::CheckLoadURI(ns
      // NS_NULLPRINCIPAL_SCHEME, but we'll just extract the scheme in
      // CheckLoadURIWithPrincipal anyway, so this is good enough.  This method
      // really needs to go away....
 -    nsCOMPtr<nsIPrincipal> sourcePrincipal;
-+    nsIPrincipal* sourcePrincipal;
++    nsIPrincipal* sourcePrincipal = nsnull;
      nsresult rv = CreateCodebasePrincipal(aSourceURI,
 -                                          getter_AddRefs(sourcePrincipal));
 +                                          &sourcePrincipal);
      NS_ENSURE_SUCCESS(rv, rv);
      return CheckLoadURIWithPrincipal(sourcePrincipal, aTargetURI, aFlags);
  }
 @@ -1317,8 +1317,8 @@ nsScriptSecurityManager::CheckLoadURIWit
          return NS_OK;
      }
      
 -    nsCOMPtr<nsIURI> sourceURI;
 -    aPrincipal->GetURI(getter_AddRefs(sourceURI));
-+    nsIURI* sourceURI;
++    nsIURI* sourceURI = nsnull;
 +    aPrincipal->GetURI(&sourceURI);
      if (!sourceURI) {
          NS_ERROR("Non-system principals passed to CheckLoadURIWithPrincipal "
                   "must have a URI!");
 @@ -1344,8 +1344,8 @@ nsScriptSecurityManager::CheckLoadURIWit
      }
  
      // If either URI is a nested URI, get the base URI
@@ -14056,17 +14056,17 @@ diff --git a/caps/src/nsScriptSecurityMa
              NS_ENSURE_TRUE(console, NS_ERROR_FAILURE);
  
 @@ -1522,15 +1522,15 @@ nsScriptSecurityManager::ReportError(JSC
          // Tell XPConnect that an exception was thrown, if appropriate
          if (sXPConnect)
          {
 -            nsCOMPtr<nsIXPCNativeCallContext> xpcCallContext;
 -            sXPConnect->GetCurrentNativeCallContext(getter_AddRefs(xpcCallContext));
-+            nsIXPCNativeCallContext* xpcCallContext;
++            nsIXPCNativeCallContext* xpcCallContext = nsnull;
 +            sXPConnect->GetCurrentNativeCallContext(&xpcCallContext);
               if (xpcCallContext)
                  xpcCallContext->SetExceptionWasThrown(PR_TRUE);
          }
      }
      else // Print directly to the console
      {
 -        nsCOMPtr<nsIConsoleService> console(
@@ -14075,40 +14075,40 @@ diff --git a/caps/src/nsScriptSecurityMa
          NS_ENSURE_TRUE(console, NS_ERROR_FAILURE);
  
 @@ -1548,8 +1548,8 @@ nsScriptSecurityManager::CheckLoadURIStr
                                           PRUint32 aFlags)
  {
      // FIXME: bug 327244 -- this function should really die...  Really truly.
 -    nsCOMPtr<nsIURI> source;
 -    nsresult rv = NS_NewURI(getter_AddRefs(source), aSourceURIStr,
-+    nsIURI* source;
++    nsIURI* source = nsnull;
 +    nsresult rv = NS_NewURI(&source, aSourceURIStr,
                              nsnull, nsnull, sIOService);
      NS_ENSURE_SUCCESS(rv, rv);
  
 @@ -1557,9 +1557,9 @@ nsScriptSecurityManager::CheckLoadURIStr
      // NS_NULLPRINCIPAL_SCHEME, but we'll just extract the scheme in
      // CheckLoadURIWithPrincipal anyway, so this is good enough.  This method
      // really needs to go away....
 -    nsCOMPtr<nsIPrincipal> sourcePrincipal;
-+    nsIPrincipal* sourcePrincipal;
++    nsIPrincipal* sourcePrincipal = nsnull;
      rv = CreateCodebasePrincipal(source,
 -                                 getter_AddRefs(sourcePrincipal));
 +                                 &sourcePrincipal);
      NS_ENSURE_SUCCESS(rv, rv);
  
      return CheckLoadURIStrWithPrincipal(sourcePrincipal, aTargetURIStr,
 @@ -1572,8 +1572,8 @@ nsScriptSecurityManager::CheckLoadURIStr
                                                        PRUint32 aFlags)
  {
      nsresult rv;
 -    nsCOMPtr<nsIURI> target;
 -    rv = NS_NewURI(getter_AddRefs(target), aTargetURIStr,
-+    nsIURI* target;
++    nsIURI* target = nsnull;
 +    rv = NS_NewURI(&target, aTargetURIStr,
                     nsnull, nsnull, sIOService);
      NS_ENSURE_SUCCESS(rv, rv);
  
 @@ -1583,7 +1583,7 @@ nsScriptSecurityManager::CheckLoadURIStr
      // Now start testing fixup -- since aTargetURIStr is a string, not
      // an nsIURI, we may well end up fixing it up before loading.
      // Note: This needs to stay in sync with the nsIURIFixup api.
@@ -14128,33 +14128,33 @@ diff --git a/caps/src/nsScriptSecurityMa
          rv = CheckLoadURIWithPrincipal(aPrincipal, target, aFlags);
 @@ -1697,21 +1697,21 @@ nsScriptSecurityManager::CanExecuteScrip
  
      // window can be null here if we're running with a non-DOM window
      // as the script global (i.e. a XUL prototype document).
 -    nsCOMPtr<nsPIDOMWindow> window = do_QueryInterface(sgo);
 -    nsCOMPtr<nsIDocShell> docshell;
 +    nsPIDOMWindow* window = do_QueryInterface(sgo);
-+    nsIDocShell* docshell;
++    nsIDocShell* docshell = nsnull;
      nsresult rv;
  
      if (window) {
          docshell = window->GetDocShell();
      }
  
 -    nsCOMPtr<nsIDocShellTreeItem> globalObjTreeItem =
 +    nsIDocShellTreeItem* globalObjTreeItem =
          do_QueryInterface(docshell);
  
      if (globalObjTreeItem) 
      {
 -        nsCOMPtr<nsIDocShellTreeItem> treeItem(globalObjTreeItem);
 -        nsCOMPtr<nsIDocShellTreeItem> parentItem;
 +        nsIDocShellTreeItem* treeItem(globalObjTreeItem);
-+        nsIDocShellTreeItem* parentItem;
++        nsIDocShellTreeItem* parentItem = nsnull;
  
          // Walk up the docshell tree to see if any containing docshell disallows scripts
          do
 @@ -1720,8 +1720,8 @@ nsScriptSecurityManager::CanExecuteScrip
              if (NS_FAILED(rv)) return rv;
              if (!*result)
                  return NS_OK; // Do not run scripts
 -            treeItem->GetParent(getter_AddRefs(parentItem));
@@ -14165,50 +14165,50 @@ diff --git a/caps/src/nsScriptSecurityMa
  #ifdef DEBUG
              if (treeItem && !docshell) {
 @@ -1736,8 +1736,8 @@ nsScriptSecurityManager::CanExecuteScrip
      // we need to allow JS to run.  In this case, don't apply the JS enabled
      // pref or policies.  On failures, just press on and don't do this special
      // case.
 -    nsCOMPtr<nsIURI> principalURI;
 -    aPrincipal->GetURI(getter_AddRefs(principalURI));
-+    nsIURI* principalURI;
++    nsIURI* principalURI = nsnull;
 +    aPrincipal->GetURI(&principalURI);
      if (!principalURI) {
          // Broken principal of some sort.  Disallow.
          *result = PR_FALSE;
 @@ -1747,8 +1747,8 @@ nsScriptSecurityManager::CanExecuteScrip
      PRBool isAbout;
      rv = principalURI->SchemeIs("about", &isAbout);
      if (NS_SUCCEEDED(rv) && isAbout) {
 -        nsCOMPtr<nsIAboutModule> module;
 -        rv = NS_GetAboutModule(principalURI, getter_AddRefs(module));
-+        nsIAboutModule* module;
++        nsIAboutModule* module = nsnull;
 +        rv = NS_GetAboutModule(principalURI, &module);
          if (NS_SUCCEEDED(rv)) {
              PRUint32 flags;
              rv = module->GetURIFlags(principalURI, &flags);
 @@ -1764,8 +1764,8 @@ nsScriptSecurityManager::CanExecuteScrip
      *result = mIsJavaScriptEnabled;
      if (mIsJavaScriptEnabled != mIsMailJavaScriptEnabled && globalObjTreeItem) 
      {
 -        nsCOMPtr<nsIDocShellTreeItem> rootItem;
 -        globalObjTreeItem->GetRootTreeItem(getter_AddRefs(rootItem));
-+        nsIDocShellTreeItem* rootItem;
++        nsIDocShellTreeItem* rootItem = nsnull;
 +        globalObjTreeItem->GetRootTreeItem(&rootItem);
          docshell = do_QueryInterface(rootItem);
          if (docshell) 
          {
 @@ -1841,8 +1841,8 @@ nsScriptSecurityManager::SubjectPrincipa
      if (!mSystemPrincipal)
          return NS_OK;
  
 -    nsCOMPtr<nsIPrincipal> subject;
 -    nsresult rv = GetSubjectPrincipal(getter_AddRefs(subject));
-+    nsIPrincipal* subject;
++    nsIPrincipal* subject = nsnull;
 +    nsresult rv = GetSubjectPrincipal(&subject);
      if (NS_FAILED(rv))
          return rv;
  
 @@ -1890,7 +1890,7 @@ nsScriptSecurityManager::DoGetCertificat
      // Create a certificate principal out of the certificate ID
      // and URI given to us.  We will use this principal to test
      // equality when doing our hashtable lookups below.
@@ -14218,17 +14218,17 @@ diff --git a/caps/src/nsScriptSecurityMa
          return NS_ERROR_OUT_OF_MEMORY;
  
 @@ -1899,8 +1899,8 @@ nsScriptSecurityManager::DoGetCertificat
      NS_ENSURE_SUCCESS(rv, rv);
  
      // Check to see if we already have this principal.
 -    nsCOMPtr<nsIPrincipal> fromTable;
 -    mPrincipals.Get(certificate, getter_AddRefs(fromTable));
-+    nsIPrincipal* fromTable;
++    nsIPrincipal* fromTable = nsnull;
 +    mPrincipals.Get(certificate, &fromTable);
      if (fromTable) {
          // Bingo.  We found the certificate in the table, which means
          // that it has escalated privileges.
 @@ -1976,7 +1976,7 @@ nsScriptSecurityManager::CreateCodebaseP
      // I _think_ it's safe to not create null principals here based on aURI.
      // At least all the callers would do the right thing in those cases, as far
      // as I can tell.  --bz
@@ -14238,42 +14238,42 @@ diff --git a/caps/src/nsScriptSecurityMa
          return NS_ERROR_OUT_OF_MEMORY;
  
 @@ -2005,15 +2005,15 @@ nsScriptSecurityManager::GetCodebasePrin
          return CallCreateInstance(NS_NULLPRINCIPAL_CONTRACTID, result);
      }
      
 -    nsCOMPtr<nsIPrincipal> principal;
 -    rv = CreateCodebasePrincipal(aURI, getter_AddRefs(principal));
-+    nsIPrincipal* principal;
++    nsIPrincipal* principal = nsnull;
 +    rv = CreateCodebasePrincipal(aURI, &principal);
      if (NS_FAILED(rv)) return rv;
  
      if (mPrincipals.Count() > 0)
      {
          //-- Check to see if we already have this principal.
 -        nsCOMPtr<nsIPrincipal> fromTable;
 -        mPrincipals.Get(principal, getter_AddRefs(fromTable));
-+        nsIPrincipal* fromTable;
++        nsIPrincipal* fromTable = nsnull;
 +        mPrincipals.Get(principal, &fromTable);
          if (!fromTable)
          {
              //-- Check to see if we have a more general principal
 @@ -2026,13 +2026,13 @@ nsScriptSecurityManager::GetCodebasePrin
              nsXPIDLCString originUrl;
              rv = principal->GetOrigin(getter_Copies(originUrl));
              if (NS_FAILED(rv)) return rv;
 -            nsCOMPtr<nsIURI> newURI;
 -            rv = NS_NewURI(getter_AddRefs(newURI), originUrl, nsnull, sIOService);
-+            nsIURI* newURI;
++            nsIURI* newURI = nsnull;
 +            rv = NS_NewURI(&newURI, originUrl, nsnull, sIOService);
              if (NS_FAILED(rv)) return rv;
 -            nsCOMPtr<nsIPrincipal> principal2;
 -            rv = CreateCodebasePrincipal(newURI, getter_AddRefs(principal2));
-+            nsIPrincipal* principal2;
++            nsIPrincipal* principal2 = nsnull;
 +            rv = CreateCodebasePrincipal(newURI, &principal2);
              if (NS_FAILED(rv)) return rv;
 -            mPrincipals.Get(principal2, getter_AddRefs(fromTable));
 +            mPrincipals.Get(principal2, &fromTable);
          }
  
          if (fromTable) {
 @@ -2055,7 +2055,7 @@ nsScriptSecurityManager::GetCodebasePrin
@@ -14312,26 +14312,26 @@ diff --git a/caps/src/nsScriptSecurityMa
                  do_QueryInterface(priv);
  
              if (NS_LIKELY(xpcWrapper != nsnull))
 @@ -2321,7 +2321,7 @@ nsScriptSecurityManager::doGetObjectPrin
                  }
                  else
                  {
 -                    nsCOMPtr<nsIScriptObjectPrincipal> objPrin;
-+                    nsIScriptObjectPrincipal* objPrin;
++                    nsIScriptObjectPrincipal* objPrin = nsnull;
                      objPrin = do_QueryWrappedNative(xpcWrapper);
                      if (objPrin)
                      {
 @@ -2331,7 +2331,7 @@ nsScriptSecurityManager::doGetObjectPrin
              }
              else
              {
 -                nsCOMPtr<nsIScriptObjectPrincipal> objPrin;
-+                nsIScriptObjectPrincipal* objPrin;
++                nsIScriptObjectPrincipal* objPrin = nsnull;
                  objPrin = do_QueryInterface(priv);
                  if (objPrin)
                  {
 @@ -2408,7 +2408,7 @@ nsScriptSecurityManager::SavePrincipal(n
  
      mIsWritingPrefs = PR_FALSE;
  
 -    nsCOMPtr<nsIPrefService> prefService(do_GetService(NS_PREFSERVICE_CONTRACTID, &rv));
@@ -14339,17 +14339,17 @@ diff --git a/caps/src/nsScriptSecurityMa
      NS_ENSURE_SUCCESS(rv, rv);
      return prefService->SavePrefFile(nsnull);
  }
 @@ -2528,25 +2528,25 @@ nsScriptSecurityManager::CheckConfirmDia
      *checkValue = PR_FALSE;
  
      //-- Get a prompter for the current window.
 -    nsCOMPtr<nsIPrompt> prompter;
-+    nsIPrompt* prompter;
++    nsIPrompt* prompter = nsnull;
      if (cx)
      {
          nsIScriptContext *scriptContext = GetScriptContext(cx);
          if (scriptContext)
          {
 -            nsCOMPtr<nsIDOMWindowInternal> domWin =
 +            nsIDOMWindowInternal* domWin =
                  do_QueryInterface(scriptContext->GetGlobalObject());
@@ -14371,17 +14371,17 @@ diff --git a/caps/src/nsScriptSecurityMa
              return PR_FALSE;
      }
 @@ -2781,12 +2781,12 @@ nsScriptSecurityManager::SetCanEnableCap
      //-- Get the system certificate
      if (!mSystemCertificate)
      {
 -        nsCOMPtr<nsIFile> systemCertFile;
 -        nsCOMPtr<nsIProperties> directoryService =
-+        nsIFile* systemCertFile;
++        nsIFile* systemCertFile = nsnull;
 +        nsIProperties* directoryService =
                   do_GetService(NS_DIRECTORY_SERVICE_CONTRACTID, &rv);
          if (!directoryService) return NS_ERROR_FAILURE;
          rv = directoryService->Get(NS_XPCOM_CURRENT_PROCESS_DIR, NS_GET_IID(nsIFile),
 -                              getter_AddRefs(systemCertFile));
 +                              (void**)&systemCertFile);
          if (NS_FAILED(rv)) return NS_ERROR_FAILURE;
  #ifdef XP_MAC
@@ -14401,17 +14401,17 @@ diff --git a/caps/src/nsScriptSecurityMa
              if (NS_FAILED(rv)) return NS_ERROR_FAILURE;
              rv = systemCertJar->GetCertificatePrincipal(nsnull,
                                                          getter_AddRefs(mSystemCertificate));
 @@ -2826,11 +2826,11 @@ nsScriptSecurityManager::SetCanEnableCap
      }
  
      //-- Get the target principal
 -    nsCOMPtr<nsIPrincipal> objectPrincipal;
-+    nsIPrincipal* objectPrincipal;
++    nsIPrincipal* objectPrincipal = nsnull;
      rv = DoGetCertificatePrincipal(certFingerprint, EmptyCString(),
                                     EmptyCString(), nsnull,
                                     nsnull, PR_FALSE,
 -                                   getter_AddRefs(objectPrincipal));
 +                                   &objectPrincipal);
      if (NS_FAILED(rv)) return NS_ERROR_FAILURE;
      rv = objectPrincipal->SetCanEnableCapability(capability, canEnable);
      if (NS_FAILED(rv)) return NS_ERROR_FAILURE;
@@ -14437,20 +14437,20 @@ diff --git a/caps/src/nsScriptSecurityMa
                                             nsIChannel* newChannel,
                                             PRUint32 redirFlags)
  {
 -    nsCOMPtr<nsIPrincipal> oldPrincipal;
 -    GetChannelPrincipal(oldChannel, getter_AddRefs(oldPrincipal));
 -
 -    nsCOMPtr<nsIURI> newURI;
 -    newChannel->GetURI(getter_AddRefs(newURI));
-+    nsIPrincipal* ol