Fold related patches together.
authorbenjamin@smedbergs.us
Fri, 21 Dec 2007 13:44:09 -0500
changeset 75 aa1b133fd1616ee46ee56e3d4cbeea19da6c6650
parent 74 346e89a0513f60471481a6b4336d26dc72e184b0
child 76 21e06e84e6d63f6a586aaafd6cca51b0370b9335
push id1
push userbsmedberg@mozilla.com
push dateTue, 15 Apr 2008 21:51:22 +0000
Fold related patches together.
TArray-allocator
TArray-extra2
autolock-request
autolock-request2
debug-unittests
debug-unittests2
layout-suck
layout-suck2
mark-dirservice
mark-dirservice2
necko-deadlocks
necko-deadlocks2
necko-deadlocks3
necko-deadlocks4
necko-deadlocks5
necko-deadlocks6
nsSlots
nsSlots2
remove-cyclec.patch
remove-cyclec.patch2
remove-zeroing-operator-news
remove-zeroing-operator-news2
root-contentutils
root-contentutils2
series
unbraced-if-fixes.patch
unbraced-if-fixes2.patch
xpcomgcbase.patch
xpcomgcbase.patch2
xpconnect-allocations
xpconnect-allocations2
--- a/TArray-allocator
+++ b/TArray-allocator
@@ -1,8 +1,10 @@
+* * *
+
 diff --git a/xpcom/glue/nsTArray.cpp b/xpcom/glue/nsTArray.cpp
 deleted file mode 100644
 --- a/xpcom/glue/nsTArray.cpp
 +++ /dev/null
 @@ -1,278 +0,0 @@
 -/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 -/* vim:set ts=2 sw=2 sts=2 et cindent: */
 -/* ***** BEGIN LICENSE BLOCK *****
@@ -319,16 +321,27 @@ diff --git a/xpcom/glue/nsTArray.h b/xpc
 +    typedef typename nsTArray_base<Allocator>::index_type index_type;
 +    using nsTArray_base<Allocator>::NoIndex;
 +    using nsTArray_base<Allocator>::Length;
 +    using nsTArray_base<Allocator>::mHdr;
 +    using nsTArray_base<Allocator>::ShrinkCapacity;
  
      //
      // Finalization method
+@@ -507,8 +515,8 @@ class nsTArray : public nsTArray_base {
+     }
+ 
+     // A variation on the AppendElements method defined above.
+-    template<class Item>
+-    elem_type *AppendElements(const nsTArray<Item>& array) {
++    template<class Item, class ItemAllocator>
++    elem_type *AppendElements(const nsTArray<Item, ItemAllocator>& array) {
+       return AppendElements(array.Elements(), array.Length());
+     }
+ 
 @@ -626,7 +634,7 @@ class nsTArray : public nsTArray_base {
      //              greater than the current length of the array.
      // @param count the number of elements to insert
      elem_type *InsertElementsAt(index_type index, size_type count) {
 -      if (!nsTArray_base::InsertSlotsAt(index, count, sizeof(elem_type))) {
 +      if (!nsTArray_base<Allocator>::InsertSlotsAt(index, count, sizeof(elem_type))) {
          return nsnull;
        }
deleted file mode 100644
--- a/TArray-extra2
+++ /dev/null
@@ -1,14 +0,0 @@
-diff --git a/xpcom/glue/nsTArray.h b/xpcom/glue/nsTArray.h
---- a/xpcom/glue/nsTArray.h
-+++ b/xpcom/glue/nsTArray.h
-@@ -515,8 +515,8 @@ class nsTArray : public nsTArray_base<Al
-     }
- 
-     // A variation on the AppendElements method defined above.
--    template<class Item>
--    elem_type *AppendElements(const nsTArray<Item>& array) {
-+    template<class Item, class ItemAllocator>
-+    elem_type *AppendElements(const nsTArray<Item, ItemAllocator>& array) {
-       return AppendElements(array.Elements(), array.Length());
-     }
- 
--- a/autolock-request
+++ b/autolock-request
@@ -1,8 +1,9 @@
+* * *
 * * *
 
 diff --git a/xpcom/glue/nsAutoLock.cpp b/xpcom/glue/nsAutoLock.cpp
 --- a/xpcom/glue/nsAutoLock.cpp
 +++ b/xpcom/glue/nsAutoLock.cpp
 @@ -435,7 +435,7 @@ void nsAutoMonitor::Enter()
      mDown = stackTop;
      (void) PR_SetThreadPrivate(LockStackTPI, this);
@@ -114,25 +115,23 @@ diff --git a/xpcom/glue/nsAutoLock.h b/x
  };
  
  class nsAutoUnlock : nsAutoUnlockBase
 @@ -264,13 +301,9 @@ public:
      }
  
      ~nsAutoUnlock() {
 -        PR_Lock(mLock);
--    }
--};
++        RequestSafeLock(mLock);
+     }
+ };
 -
 -#include "prcmon.h"
 -#include "nsError.h"
 -#include "nsDebug.h"
-+        RequestSafeLock(mLock);
-+    }
-+};
  
  class NS_COM_GLUE nsAutoMonitor : public nsAutoLockBase {
  public:
 @@ -300,15 +333,15 @@ public:
            mMonitor(mon), mLockCount(0)
      {
          NS_ASSERTION(mMonitor, "null monitor");
 -        if (mMonitor) {
@@ -147,17 +146,26 @@ diff --git a/xpcom/glue/nsAutoLock.h b/x
      ~nsAutoMonitor() {
          NS_ASSERTION(mMonitor, "null monitor");
 -        if (mMonitor && mLockCount) {
 +
 +        if (mLockCount) {
  #ifdef DEBUG
              PRStatus status = 
  #endif
-@@ -364,27 +397,20 @@ private:
+@@ -336,6 +369,8 @@ public:
+      * @see prmon.h 
+      **/      
+     nsresult Wait(PRIntervalTime interval = PR_INTERVAL_NO_TIMEOUT) {
++        nsAutoSuspendRequest suspended;
++
+         return PR_Wait(mMonitor, interval) == PR_SUCCESS
+             ? NS_OK : NS_ERROR_FAILURE;
+     }
+@@ -364,27 +399,20 @@ private:
  
      // Not meant to be implemented. This makes it a compiler error to
      // construct or assign an nsAutoLock object incorrectly.
 -    nsAutoMonitor(void) {}
 -    nsAutoMonitor(nsAutoMonitor& /*aMon*/) {}
 -    nsAutoMonitor& operator =(nsAutoMonitor& /*aMon*/) {
 -        return *this;
 -    }
@@ -180,34 +188,43 @@ diff --git a/xpcom/glue/nsAutoLock.h b/x
  // (Using this avoids the need to allocate a PRMonitor, which may be useful when
  // a large number of objects of the same class need associated monitors.)
 -
 -#include "prcmon.h"
 -#include "nsError.h"
  
  class NS_COM_GLUE nsAutoCMonitor : public nsAutoLockBase {
  public:
-@@ -393,6 +419,7 @@ public:
+@@ -393,6 +421,7 @@ public:
            mLockObject(lockObject), mLockCount(0)
      {
          NS_ASSERTION(lockObject, "null lock object");
 +        RequestSafeEnterCMonitor(mLockObject);
          PR_CEnterMonitor(mLockObject);
          mLockCount = 1;
      }
-@@ -402,7 +429,7 @@ public:
+@@ -402,7 +431,7 @@ public:
  #ifdef DEBUG
              PRStatus status =
  #endif
 -            PR_CExitMonitor(mLockObject);
 +                PR_CExitMonitor(mLockObject);
              NS_ASSERTION(status == PR_SUCCESS, "PR_CExitMonitor failed");
          }
      }
-@@ -431,18 +458,14 @@ private:
+@@ -411,6 +440,8 @@ public:
+     void Exit();
+ 
+     nsresult Wait(PRIntervalTime interval = PR_INTERVAL_NO_TIMEOUT) {
++        nsAutoSuspendRequest suspended;
++
+         return PR_CWait(mLockObject, interval) == PR_SUCCESS
+             ? NS_OK : NS_ERROR_FAILURE;
+     }
+@@ -431,18 +462,14 @@ private:
  
      // Not meant to be implemented. This makes it a compiler error to
      // construct or assign an nsAutoLock object incorrectly.
 -    nsAutoCMonitor(void) {}
 -    nsAutoCMonitor(nsAutoCMonitor& /*aMon*/) {}
 -    nsAutoCMonitor& operator =(nsAutoCMonitor& /*aMon*/) {
 -        return *this;
 -    }
@@ -224,17 +241,17 @@ diff --git a/xpcom/glue/nsAutoLock.h b/x
 +    static void* operator new(size_t /*size*/) CPP_THROW_NEW;
 +    static void operator delete(void* /*memory*/);
  };
  
  #endif // nsAutoLock_h__
 diff --git a/xpcom/threads/TimerThread.cpp b/xpcom/threads/TimerThread.cpp
 --- a/xpcom/threads/TimerThread.cpp
 +++ b/xpcom/threads/TimerThread.cpp
-@@ -313,7 +313,7 @@ NS_IMETHODIMP TimerThread::Run()
+@@ -314,7 +314,7 @@ NS_IMETHODIMP TimerThread::Run()
      }
  
      mWaiting = PR_TRUE;
 -    PR_WaitCondVar(mCondVar, waitFor);
 +    lock.waitCondVar(mCondVar, waitFor);
      mWaiting = PR_FALSE;
    }
  
deleted file mode 100644
--- a/autolock-request2
+++ /dev/null
@@ -1,21 +0,0 @@
-diff --git a/xpcom/glue/nsAutoLock.h b/xpcom/glue/nsAutoLock.h
---- a/xpcom/glue/nsAutoLock.h
-+++ b/xpcom/glue/nsAutoLock.h
-@@ -369,6 +369,8 @@ public:
-      * @see prmon.h 
-      **/      
-     nsresult Wait(PRIntervalTime interval = PR_INTERVAL_NO_TIMEOUT) {
-+        nsAutoSuspendRequest suspended;
-+
-         return PR_Wait(mMonitor, interval) == PR_SUCCESS
-             ? NS_OK : NS_ERROR_FAILURE;
-     }
-@@ -438,6 +440,8 @@ public:
-     void Exit();
- 
-     nsresult Wait(PRIntervalTime interval = PR_INTERVAL_NO_TIMEOUT) {
-+        nsAutoSuspendRequest suspended;
-+
-         return PR_CWait(mLockObject, interval) == PR_SUCCESS
-             ? NS_OK : NS_ERROR_FAILURE;
-     }
--- a/debug-unittests
+++ b/debug-unittests
@@ -1,51 +1,62 @@
+* * *
+
 diff --git a/config/config.mk b/config/config.mk
 --- a/config/config.mk
 +++ b/config/config.mk
 @@ -872,7 +872,7 @@ endif
  endif
  
  ifeq (,$(filter WINCE WINNT OS2,$(OS_ARCH)))
 -RUN_TEST_PROGRAM = $(DIST)/bin/run-mozilla.sh
 +RUN_TEST_PROGRAM = $(DIST)/bin/run-mozilla.sh $(DEBUG_TEST_PROGRAM)
  endif
  
  #
 diff --git a/config/rules.mk b/config/rules.mk
 --- a/config/rules.mk
 +++ b/config/rules.mk
-@@ -1849,11 +1849,10 @@ endif # CYGWIN_WRAPPER
+@@ -1815,7 +1815,7 @@ libs::
+ 	for testdir in $(XPCSHELL_TESTS); do \
+ 	  $(INSTALL) \
+ 	    $(srcdir)/$$testdir/*.js \
+-	    $(DEPTH)/_tests/xpcshell-simple/$(MODULE)/$$testdir; \
++	    $(DEPTH)/_tests/xpcshell-simple/$(MODULE)/unit; \
+ 	done
+ 
+ # Path formats on Windows are hard.  We require a topsrcdir formatted so that
+@@ -1840,11 +1840,10 @@ endif # CYGWIN_WRAPPER
  
  # Test execution
  check::
 -	@$(EXIT_ON_ERROR) \
 +	$(EXIT_ON_ERROR) \
  	for testdir in $(XPCSHELL_TESTS); do \
 -	  $(RUN_TEST_PROGRAM) \
  	    $(topsrcdir)/tools/test-harness/xpcshell-simple/test_all.sh \
 -	      $(DIST)/bin/xpcshell \
 +	      "$(RUN_TEST_PROGRAM) $(DIST)/bin/xpcshell" \
  	      $(FWDSLASH_TOPSRCDIR) \
  	      $(NATIVE_TOPSRCDIR) \
  	      $(DEPTH)/_tests/xpcshell-simple/$(MODULE)/$$testdir; \
-@@ -1861,10 +1860,9 @@ check::
+@@ -1852,10 +1851,9 @@ check::
  
  # Test execution
  check-interactive::
 -	@$(EXIT_ON_ERROR) \
 -	$(RUN_TEST_PROGRAM) \
 +	$(EXIT_ON_ERROR) \
  	  $(topsrcdir)/tools/test-harness/xpcshell-simple/test_one.sh \
 -	    $(DIST)/bin/xpcshell \
 +	    "$(RUN_TEST_PROGRAM) $(DIST)/bin/xpcshell" \
  	    $(FWDSLASH_TOPSRCDIR) \
  	    $(NATIVE_TOPSRCDIR) \
  	    $(DEPTH)/_tests/xpcshell-simple/$(MODULE)/$$testdir \
-@@ -1873,9 +1871,8 @@ check-interactive::
+@@ -1864,9 +1862,8 @@ check-interactive::
  # Test execution
  check-one::
  	@$(EXIT_ON_ERROR) \
 -	$(RUN_TEST_PROGRAM) \
  	  $(topsrcdir)/tools/test-harness/xpcshell-simple/test_one.sh \
 -	    $(DIST)/bin/xpcshell \
 +	    "$(RUN_TEST_PROGRAM) $(DIST)/bin/xpcshell" \
  	    $(FWDSLASH_TOPSRCDIR) \
deleted file mode 100644
--- a/debug-unittests2
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/config/rules.mk b/config/rules.mk
---- a/config/rules.mk
-+++ b/config/rules.mk
-@@ -1824,7 +1824,7 @@ libs::
- 	for testdir in $(XPCSHELL_TESTS); do \
- 	  $(INSTALL) \
- 	    $(srcdir)/$$testdir/*.js \
--	    $(DEPTH)/_tests/xpcshell-simple/$(MODULE)/$$testdir; \
-+	    $(DEPTH)/_tests/xpcshell-simple/$(MODULE)/unit; \
- 	done
- 
- # Path formats on Windows are hard.  We require a topsrcdir formatted so that
--- a/layout-suck
+++ b/layout-suck
@@ -1,8 +1,9 @@
+* * *
 * * *
 
 diff --git a/layout/mathml/base/src/nsMathMLChar.cpp b/layout/mathml/base/src/nsMathMLChar.cpp
 --- a/layout/mathml/base/src/nsMathMLChar.cpp
 +++ b/layout/mathml/base/src/nsMathMLChar.cpp
 @@ -199,14 +199,14 @@ Clean(nsString& aValue)
  // helper to load a MathFont Property File
  static nsresult
@@ -15,26 +16,36 @@ diff --git a/layout/mathml/base/src/nsMa
    uriStr.Append(aName);
    uriStr.StripWhitespace(); // that may come from aName
    uriStr.AppendLiteral(".properties");
 -  return NS_LoadPersistentPropertiesFromURISpec(getter_AddRefs(aProperties), 
 +  return NS_LoadPersistentPropertiesFromURISpec(aProperties, 
                                                  NS_ConvertUTF16toUTF8(uriStr));
  }
  
-@@ -839,7 +839,7 @@ InitGlobals(nsPresContext* aPresContext)
+@@ -334,7 +334,8 @@ nsGlyphTable::ElementAt(nsPresContext* a
+   if (mState == NS_TABLE_STATE_ERROR) return kNullGlyph;
+   // Load glyph properties if this is the first time we have been here
+   if (mState == NS_TABLE_STATE_EMPTY) {
+-    nsresult rv = LoadProperties(*mFontName[0], mGlyphProperties);
++    nsresult rv = LoadProperties(*mFontName[0],
++                                 getter_AddRefs(mGlyphProperties));
+ #ifdef NS_DEBUG
+     nsCAutoString uriStr;
+     uriStr.AssignLiteral("resource://gre/res/fonts/mathfont");
+@@ -839,7 +840,7 @@ InitGlobals(nsPresContext* aPresContext)
  
    nsCAutoString key;
    nsAutoString value;
 -  nsCOMPtr<nsIPersistentProperties> mathfontProp;
 +  nsIPersistentProperties* mathfontProp = nsnull;
    nsCOMPtr<nsIPrefBranch> prefBranch(do_GetService(NS_PREFSERVICE_CONTRACTID));
  
    // Add the math fonts in the gGlyphTableList in order of preference ...
-@@ -848,7 +848,7 @@ InitGlobals(nsPresContext* aPresContext)
+@@ -848,7 +849,7 @@ InitGlobals(nsPresContext* aPresContext)
  
    // Load the "mathfont.properties" file
    value.Truncate();
 -  rv = LoadProperties(value, mathfontProp);
 +  rv = LoadProperties(value, &mathfontProp);
    if (NS_FAILED(rv)) return rv;
  
    // Get the list of mathfonts having special glyph tables to be used for
deleted file mode 100644
--- a/layout-suck2
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/layout/mathml/base/src/nsMathMLChar.cpp b/layout/mathml/base/src/nsMathMLChar.cpp
---- a/layout/mathml/base/src/nsMathMLChar.cpp
-+++ b/layout/mathml/base/src/nsMathMLChar.cpp
-@@ -334,7 +334,8 @@ nsGlyphTable::ElementAt(nsPresContext* a
-   if (mState == NS_TABLE_STATE_ERROR) return kNullGlyph;
-   // Load glyph properties if this is the first time we have been here
-   if (mState == NS_TABLE_STATE_EMPTY) {
--    nsresult rv = LoadProperties(*mFontName[0], mGlyphProperties);
-+    nsresult rv = LoadProperties(*mFontName[0],
-+                                 getter_AddRefs(mGlyphProperties));
- #ifdef NS_DEBUG
-     nsCAutoString uriStr;
-     uriStr.AssignLiteral("resource://gre/res/fonts/mathfont");
--- a/mark-dirservice
+++ b/mark-dirservice
@@ -1,12 +1,22 @@
+* * *
+
 diff --git a/xpcom/build/nsXPCOM.h b/xpcom/build/nsXPCOM.h
 --- a/xpcom/build/nsXPCOM.h
 +++ b/xpcom/build/nsXPCOM.h
-@@ -479,6 +479,9 @@ NS_GetGC();
+@@ -66,6 +66,7 @@
+ # define NS_CycleCollectorSuspect    NS_CycleCollectorSuspect_P
+ # define NS_CycleCollectorForget     NS_CycleCollectorForget_P
+ # define NS_GetGC                    NS_GetGC_P
++# define NS_RootUntilShutdown        NS_RootUntilShutdown_P
+ #endif
+ 
+ #include "nscore.h"
+@@ -479,6 +480,9 @@ NS_GetGC();
  NS_GetGC();
  #endif
  
 +XPCOM_API(void)
 +NS_RootUntilShutdown(void *obj);
 +
  /**
   * Categories (in the category manager service) used by XPCOM:
@@ -17,26 +27,26 @@ diff --git a/xpcom/components/nsComponen
 @@ -82,6 +82,7 @@
  #include "nsXPIDLString.h"
  #include "prcmon.h"
  #include "xptinfo.h" // this after nsISupports, to pick up IID so that xpt stuff doesn't try to define it itself...
 +#include "nsHashtable.h"
  
  #include "nsInt64.h"
  #include "nsManifestLineReader.h"
-@@ -281,9 +282,6 @@ ArenaStrdup(const char *s, PLArenaPool *
+@@ -280,9 +281,6 @@ ArenaStrdup(const char *s, PLArenaPool *
+ ////////////////////////////////////////////////////////////////////////////////
  // Hashtable Callbacks
  ////////////////////////////////////////////////////////////////////////////////
- 
+-
 -PRBool PR_CALLBACK
 -nsFactoryEntry_Destroy(nsHashKey *aKey, void *aData, void* closure);
--
+ 
  PR_STATIC_CALLBACK(PLDHashNumber)
  factory_HashKey(PLDHashTable *aTable, const void *aKey)
- {
 @@ -358,7 +356,8 @@ typedef NS_CALLBACK(EnumeratorConverter)
                                           void *data,
                                           nsISupports **retval);
  
 -class PLDHashTableEnumeratorImpl : public nsIBidirectionalEnumerator,
 +class PLDHashTableEnumeratorImpl : public XPCOMGCFinalizedObject,
 +                                   public nsIBidirectionalEnumerator,
                                     public nsISimpleEnumerator
@@ -172,20 +182,18 @@ diff --git a/xpcom/glue/nsEnumeratorUtil
  {
  public:
      NS_DECL_ISUPPORTS
 @@ -292,6 +291,5 @@ NS_NewUnionEnumerator(nsISimpleEnumerato
              return NS_ERROR_OUT_OF_MEMORY;
          *result = enumer; 
      }
 -    NS_ADDREF(*result);
--    return NS_OK;
--}
-+    return NS_OK;
-+}
+     return NS_OK;
+ }
 diff --git a/xpcom/io/nsDirectoryService.cpp b/xpcom/io/nsDirectoryService.cpp
 --- a/xpcom/io/nsDirectoryService.cpp
 +++ b/xpcom/io/nsDirectoryService.cpp
 @@ -119,19 +119,18 @@ nsDirectoryService::GetCurrentProcessDir
  
      nsresult rv; 
   
 -    nsCOMPtr<nsIProperties> dirService;
@@ -278,20 +286,19 @@ diff --git a/xpcom/io/nsDirectoryService
        {
 -          nsCOMPtr<nsISimpleEnumerator> newFiles;
 -          rv = prov2->GetFiles(fileData->property, getter_AddRefs(newFiles));
 +          nsISimpleEnumerator* newFiles = nsnull;
 +          rv = prov2->GetFiles(fileData->property, &newFiles);
            if (NS_SUCCEEDED(rv) && newFiles) {
                if (fileData->data) {
 -                  nsCOMPtr<nsISimpleEnumerator> unionFiles;
--
++                  nsISimpleEnumerator* unionFiles = nsnull;
+ 
 -                  NS_NewUnionEnumerator(getter_AddRefs(unionFiles),
-+                  nsISimpleEnumerator* unionFiles = nsnull;
-+
 +                  NS_NewUnionEnumerator(&unionFiles,
                                          (nsISimpleEnumerator*) fileData->data, newFiles);
  
                    if (unionFiles)
 -                      unionFiles.swap(* (nsISimpleEnumerator**) &fileData->data);
 +                      swap(unionFiles, * (nsISimpleEnumerator**) &fileData->data);
                }
                else
@@ -385,20 +392,19 @@ diff --git a/xpcom/io/nsDirectoryService
          (do_GetService(NS_CATEGORYMANAGER_CONTRACTID));
      if (!catman)
          return;
  
 -    nsCOMPtr<nsISimpleEnumerator> entries;
 +    nsISimpleEnumerator* entries = nsnull;
      catman->EnumerateCategory(XPCOM_DIRECTORY_PROVIDER_CATEGORY,
 -                              getter_AddRefs(entries));
--
++                              &entries);
+ 
 -    nsCOMPtr<nsIUTF8StringEnumerator> strings(do_QueryInterface(entries));
-+                              &entries);
-+
 +    nsIUTF8StringEnumerator* strings(do_QueryInterface(entries));
      if (!strings)
          return;
  
 @@ -657,7 +639,7 @@ nsDirectoryService::RegisterCategoryProv
          catman->GetCategoryEntry(XPCOM_DIRECTORY_PROVIDER_CATEGORY, entry.get(), getter_Copies(contractID));
  
          if (contractID) {
@@ -566,8 +572,22 @@ diff --git a/xpcom/reflect/xptinfo/src/x
  {
      {
          nsAutoMonitor lock(xptiInterfaceInfoManager::GetInfoMonitor());
 -        if(mEntry && !mEntry->InterfaceInfoEquals(this))
 +        if(mEntry && mEntry->InterfaceInfoEquals(this))
              mEntry->LockedInterfaceInfoDeathNotification();
      }
  
+diff --git a/xpcom/stub/nsXPComStub.cpp b/xpcom/stub/nsXPComStub.cpp
+--- a/xpcom/stub/nsXPComStub.cpp
++++ b/xpcom/stub/nsXPComStub.cpp
+@@ -553,3 +553,10 @@ NS_GetGC()
+ {
+   return NS_GetGC_P();
+ }
++
++#undef NS_RootUntilShutdown
++EXPORT_XPCOM_API(void)
++NS_RootUntilShutdown(void *obj)
++{
++  NS_RootUntilShutdown_P(obj);
++}
deleted file mode 100644
--- a/mark-dirservice2
+++ /dev/null
@@ -1,25 +0,0 @@
-diff --git a/xpcom/build/nsXPCOM.h b/xpcom/build/nsXPCOM.h
---- a/xpcom/build/nsXPCOM.h
-+++ b/xpcom/build/nsXPCOM.h
-@@ -66,6 +66,7 @@
- # define NS_CycleCollectorSuspect    NS_CycleCollectorSuspect_P
- # define NS_CycleCollectorForget     NS_CycleCollectorForget_P
- # define NS_GetGC                    NS_GetGC_P
-+# define NS_RootUntilShutdown        NS_RootUntilShutdown_P
- #endif
- 
- #include "nscore.h"
-diff --git a/xpcom/stub/nsXPComStub.cpp b/xpcom/stub/nsXPComStub.cpp
---- a/xpcom/stub/nsXPComStub.cpp
-+++ b/xpcom/stub/nsXPComStub.cpp
-@@ -553,3 +553,10 @@ NS_GetGC()
- {
-   return NS_GetGC_P();
- }
-+
-+#undef NS_RootUntilShutdown
-+EXPORT_XPCOM_API(void)
-+NS_RootUntilShutdown(void *obj)
-+{
-+  NS_RootUntilShutdown_P(obj);
-+}
--- a/necko-deadlocks
+++ b/necko-deadlocks
@@ -1,49 +1,1485 @@
+* * *
+* * *
+* * *
+* * *
+* * *
+
+diff --git a/netwerk/base/src/nsIOService.cpp b/netwerk/base/src/nsIOService.cpp
+--- a/netwerk/base/src/nsIOService.cpp
++++ b/netwerk/base/src/nsIOService.cpp
+@@ -170,7 +170,7 @@ nsIOService::nsIOService()
+     if (!gBufferCache)
+     {
+         nsresult rv = NS_OK;
+-        nsCOMPtr<nsIRecyclingAllocator> recyclingAllocator =
++        nsIRecyclingAllocator* recyclingAllocator =
+             do_CreateInstance(NS_RECYCLINGALLOCATOR_CONTRACTID, &rv);
+         if (NS_FAILED(rv))
+             return;
+@@ -179,9 +179,8 @@ nsIOService::nsIOService()
+         if (NS_FAILED(rv))
+             return;
+ 
+-        nsCOMPtr<nsIMemory> eyeMemory = do_QueryInterface(recyclingAllocator);
+-        gBufferCache = eyeMemory.get();
+-        NS_IF_ADDREF(gBufferCache);
++        gBufferCache = recyclingAllocator;
++        NS_RootUntilShutdown(gBufferCache);
+     }
+ }
+ 
+@@ -209,7 +208,7 @@ nsIOService::Init()
+     }
+ 
+     // XXX hack until xpidl supports error info directly (bug 13423)
+-    nsCOMPtr<nsIErrorService> errorService = do_GetService(NS_ERRORSERVICE_CONTRACTID);
++    nsIErrorService* errorService = do_GetService(NS_ERRORSERVICE_CONTRACTID);
+     if (errorService) {
+         errorService->RegisterErrorStringBundle(NS_ERROR_MODULE_NETWORK, NECKO_MSGS_URL);
+     }
+@@ -221,8 +220,8 @@ nsIOService::Init()
+         mRestrictedPortList.AppendElement(reinterpret_cast<void *>(gBadPortList[i]));
+ 
+     // Further modifications to the port list come from prefs
+-    nsCOMPtr<nsIPrefBranch2> prefBranch;
+-    GetPrefBranch(getter_AddRefs(prefBranch));
++    nsIPrefBranch2* prefBranch = nsnull;
++    GetPrefBranch(&prefBranch);
+     if (prefBranch) {
+         prefBranch->AddObserver(PORT_PREF_PREFIX, this, PR_TRUE);
+         prefBranch->AddObserver(AUTODIAL_PREF, this, PR_TRUE);
+@@ -230,7 +229,7 @@ nsIOService::Init()
+     }
+     
+     // Register for profile change notifications
+-    nsCOMPtr<nsIObserverService> observerService =
++    nsIObserverService* observerService =
+         do_GetService("@mozilla.org/observer-service;1");
+     if (observerService) {
+         observerService->AddObserver(this, kProfileChangeNetTeardownTopic, PR_TRUE);
+@@ -265,7 +264,6 @@ nsIOService::GetInstance() {
+         gIOService = new nsIOService();
+         if (!gIOService)
+             return nsnull;
+-        NS_ADDREF(gIOService);
+ 
+         nsresult rv = gIOService->Init();
+         if (NS_FAILED(rv)) {
+@@ -274,7 +272,6 @@ nsIOService::GetInstance() {
+         }
+         return gIOService;
+     }
+-    NS_ADDREF(gIOService);
+     return gIOService;
+ }
+ 
+@@ -291,7 +288,7 @@ nsIOService::OnChannelRedirect(nsIChanne
+ nsIOService::OnChannelRedirect(nsIChannel* oldChan, nsIChannel* newChan,
+                                PRUint32 flags)
+ {
+-    nsCOMPtr<nsIChannelEventSink> sink =
++    nsIChannelEventSink* sink =
+         do_GetService(NS_GLOBAL_CHANNELEVENTSINK_CONTRACTID);
+     if (sink) {
+         nsresult rv = sink->OnChannelRedirect(oldChan, newChan, flags);
+@@ -322,7 +319,7 @@ nsIOService::CacheProtocolHandler(const 
+             nsresult rv;
+             NS_ASSERTION(!mWeakHandler[i], "Protocol handler already cached");
+             // Make sure the handler supports weak references.
+-            nsCOMPtr<nsISupportsWeakReference> factoryPtr = do_QueryInterface(handler, &rv);
++            nsISupportsWeakReference* factoryPtr = do_QueryInterface(handler, &rv);
+             if (!factoryPtr)
+             {
+                 // Don't cache handlers that don't support weak reference as
+@@ -376,8 +373,8 @@ nsIOService::GetProtocolHandler(const ch
+ 
+     PRBool externalProtocol = PR_FALSE;
+     PRBool listedProtocol   = PR_TRUE;
+-    nsCOMPtr<nsIPrefBranch2> prefBranch;
+-    GetPrefBranch(getter_AddRefs(prefBranch));
++    nsIPrefBranch2* prefBranch = nsnull;
++    GetPrefBranch(&prefBranch);
+     if (prefBranch) {
+         nsCAutoString externalProtocolPref("network.protocol-handler.external.");
+         externalProtocolPref += scheme;
+@@ -448,8 +445,8 @@ NS_IMETHODIMP
+ NS_IMETHODIMP 
+ nsIOService::GetProtocolFlags(const char* scheme, PRUint32 *flags)
+ {
+-    nsCOMPtr<nsIProtocolHandler> handler;
+-    nsresult rv = GetProtocolHandler(scheme, getter_AddRefs(handler));
++    nsIProtocolHandler* handler = nsnull;
++    nsresult rv = GetProtocolHandler(scheme, &handler);
+     if (NS_FAILED(rv)) return rv;
+ 
+     rv = handler->GetProtocolFlags(flags);
+@@ -493,8 +490,8 @@ nsIOService::NewURI(const nsACString &aS
+     }
+ 
+     // now get the handler for this scheme
+-    nsCOMPtr<nsIProtocolHandler> handler;
+-    rv = GetProtocolHandler(scheme.get(), getter_AddRefs(handler));
++    nsIProtocolHandler* handler = nsnull;
++    rv = GetProtocolHandler(scheme.get(), &handler);
+     if (NS_FAILED(rv)) return rv;
+ 
+     return handler->NewURI(aSpec, aCharset, aBaseURI, result);
+@@ -507,12 +504,12 @@ nsIOService::NewFileURI(nsIFile *file, n
+     nsresult rv;
+     NS_ENSURE_ARG_POINTER(file);
+ 
+-    nsCOMPtr<nsIProtocolHandler> handler;
++    nsIProtocolHandler* handler = nsnull;
+ 
+-    rv = GetProtocolHandler("file", getter_AddRefs(handler));
++    rv = GetProtocolHandler("file", &handler);
+     if (NS_FAILED(rv)) return rv;
+ 
+-    nsCOMPtr<nsIFileProtocolHandler> fileHandler( do_QueryInterface(handler, &rv) );
++    nsIFileProtocolHandler* fileHandler( do_QueryInterface(handler, &rv) );
+     if (NS_FAILED(rv)) return rv;
+     
+     return fileHandler->NewFileURI(file, result);
+@@ -530,8 +527,8 @@ nsIOService::NewChannelFromURI(nsIURI *a
+     if (NS_FAILED(rv))
+         return rv;
+ 
+-    nsCOMPtr<nsIProtocolHandler> handler;
+-    rv = GetProtocolHandler(scheme.get(), getter_AddRefs(handler));
++    nsIProtocolHandler* handler = nsnull;
++    rv = GetProtocolHandler(scheme.get(), &handler);
+     if (NS_FAILED(rv))
+         return rv;
+ 
+@@ -543,14 +540,14 @@ nsIOService::NewChannelFromURI(nsIURI *a
+     // Talk to the PPS if the protocol handler allows proxying.  Otherwise,
+     // skip this step.  This allows us to lazily load the PPS at startup.
+     if (protoFlags & nsIProtocolHandler::ALLOWS_PROXY) {
+-        nsCOMPtr<nsIProxyInfo> pi;
++        nsIProxyInfo* pi = nsnull;
+         if (!mProxyService) {
+             mProxyService = do_GetService(NS_PROTOCOLPROXYSERVICE_CONTRACTID);
+             if (!mProxyService)
+                 NS_WARNING("failed to get protocol proxy service");
+         }
+         if (mProxyService) {
+-            rv = mProxyService->Resolve(aURI, 0, getter_AddRefs(pi));
++            rv = mProxyService->Resolve(aURI, 0, &pi);
+             if (NS_FAILED(rv))
+                 pi = nsnull;
+         }
+@@ -558,11 +555,11 @@ nsIOService::NewChannelFromURI(nsIURI *a
+             nsCAutoString type;
+             if (NS_SUCCEEDED(pi->GetType(type)) && type.EqualsLiteral("http")) {
+                 // we are going to proxy this channel using an http proxy
+-                rv = GetProtocolHandler("http", getter_AddRefs(handler));
++                rv = GetProtocolHandler("http", &handler);
+                 if (NS_FAILED(rv))
+                     return rv;
+             }
+-            nsCOMPtr<nsIProxiedProtocolHandler> pph = do_QueryInterface(handler);
++            nsIProxiedProtocolHandler* pph = do_QueryInterface(handler);
+             if (pph)
+                 return pph->NewProxiedChannel(aURI, pi, result);
+         }
+@@ -575,8 +572,8 @@ nsIOService::NewChannel(const nsACString
+ nsIOService::NewChannel(const nsACString &aSpec, const char *aCharset, nsIURI *aBaseURI, nsIChannel **result)
+ {
+     nsresult rv;
+-    nsCOMPtr<nsIURI> uri;
+-    rv = NewURI(aSpec, aCharset, aBaseURI, getter_AddRefs(uri));
++    nsIURI* uri = nsnull;
++    rv = NewURI(aSpec, aCharset, aBaseURI, &uri);
+     if (NS_FAILED(rv)) return rv;
+ 
+     return NewChannelFromURI(uri, result);
+@@ -592,7 +589,7 @@ NS_IMETHODIMP
+ NS_IMETHODIMP
+ nsIOService::SetOffline(PRBool offline)
+ {
+-    nsCOMPtr<nsIObserverService> observerService =
++    nsIObserverService* observerService =
+         do_GetService("@mozilla.org/observer-service;1");
+     
+     nsresult rv;
+@@ -672,8 +669,8 @@ nsIOService::AllowPort(PRInt32 inPort, c
+             if (!scheme)
+                 return NS_OK;
+             
+-            nsCOMPtr<nsIProtocolHandler> handler;
+-            nsresult rv = GetProtocolHandler(scheme, getter_AddRefs(handler));
++            nsIProtocolHandler* handler = nsnull;
++            nsresult rv = GetProtocolHandler(scheme, &handler);
+             if (NS_FAILED(rv)) return rv;
+ 
+             // let the protocol handler decide
+@@ -765,7 +762,7 @@ nsIOService::Observe(nsISupports *subjec
+                      const PRUnichar *data)
+ {
+     if (!strcmp(topic, NS_PREFBRANCH_PREFCHANGE_TOPIC_ID)) {
+-        nsCOMPtr<nsIPrefBranch> prefBranch = do_QueryInterface(subject);
++        nsIPrefBranch* prefBranch = do_QueryInterface(subject);
+         if (prefBranch)
+             PrefsChanged(prefBranch, NS_ConvertUTF16toUTF8(data).get());
+     }
+@@ -846,10 +843,10 @@ nsIOService::URIChainHasFlags(nsIURI   *
+ 
+     // Dig deeper into the chain.  Note that this is not a do/while loop to
+     // avoid the extra addref/release on |uri| in the common (non-nested) case.
+-    nsCOMPtr<nsINestedURI> nestedURI = do_QueryInterface(uri);
++    nsINestedURI* nestedURI = do_QueryInterface(uri);
+     while (nestedURI) {
+-        nsCOMPtr<nsIURI> innerURI;
+-        rv = nestedURI->GetInnerURI(getter_AddRefs(innerURI));
++        nsIURI* innerURI = nsnull;
++        rv = nestedURI->GetInnerURI(&innerURI);
+         NS_ENSURE_SUCCESS(rv, rv);
+ 
+         rv = ProtocolHasFlags(innerURI, flags, result);
+diff --git a/netwerk/base/src/nsSocketTransport2.cpp b/netwerk/base/src/nsSocketTransport2.cpp
+--- a/netwerk/base/src/nsSocketTransport2.cpp
++++ b/netwerk/base/src/nsSocketTransport2.cpp
+@@ -221,7 +221,6 @@ nsSocketInputStream::nsSocketInputStream
+ 
+ nsSocketInputStream::~nsSocketInputStream()
+ {
+-    Close();
+ }
+ 
+ // called on the socket transport thread...
+@@ -236,7 +235,7 @@ nsSocketInputStream::OnSocketReady(nsres
+ 
+     NS_ASSERTION(PR_GetCurrentThread() == gSocketThread, "wrong thread");
+ 
+-    nsCOMPtr<nsIInputStreamCallback> callback;
++    nsIInputStreamCallback* callback = nsnull;
+     {
+         nsAutoLock lock(mTransport->mLock);
+ 
+@@ -418,7 +417,7 @@ nsSocketInputStream::AsyncWait(nsIInputS
+     // This variable will be non-null when we want to call the callback
+     // directly from this function, but outside the lock.
+     // (different from callback when target is not null)
+-    nsCOMPtr<nsIInputStreamCallback> directCallback;
++    nsIInputStreamCallback* directCallback = nsnull;
+     {
+         nsAutoLock lock(mTransport->mLock);
+ 
+@@ -429,8 +428,8 @@ nsSocketInputStream::AsyncWait(nsIInputS
+             // failure to create an event proxy (most likely out of memory)
+             // shouldn't alter the state of the transport.
+             //
+-            nsCOMPtr<nsIInputStreamCallback> temp;
+-            nsresult rv = NS_NewInputStreamReadyEvent(getter_AddRefs(temp),
++            nsIInputStreamCallback* temp = nsnull;
++            nsresult rv = NS_NewInputStreamReadyEvent(&temp,
+                                                       callback, target);
+             if (NS_FAILED(rv)) return rv;
+             mCallback = temp;
+@@ -439,7 +438,7 @@ nsSocketInputStream::AsyncWait(nsIInputS
+             mCallback = callback;
+ 
+         if (NS_FAILED(mCondition))
+-            directCallback.swap(mCallback);
++            swap(directCallback, mCallback);
+         else
+             mCallbackFlags = flags;
+     }
+@@ -466,7 +465,6 @@ nsSocketOutputStream::nsSocketOutputStre
+ 
+ nsSocketOutputStream::~nsSocketOutputStream()
+ {
+-  Close();
+ }
+ 
+ // called on the socket transport thread...
+@@ -481,7 +479,7 @@ nsSocketOutputStream::OnSocketReady(nsre
+ 
+     NS_ASSERTION(PR_GetCurrentThread() == gSocketThread, "wrong thread");
+ 
+-    nsCOMPtr<nsIOutputStreamCallback> callback;
++    nsIOutputStreamCallback* callback = nsnull;
+     {
+         nsAutoLock lock(mTransport->mLock);
+ 
+@@ -653,8 +651,8 @@ nsSocketOutputStream::AsyncWait(nsIOutpu
+             // failure to create an event proxy (most likely out of memory)
+             // shouldn't alter the state of the transport.
+             //
+-            nsCOMPtr<nsIOutputStreamCallback> temp;
+-            nsresult rv = NS_NewOutputStreamReadyEvent(getter_AddRefs(temp),
++            nsIOutputStreamCallback* temp = nsnull;
++            nsresult rv = NS_NewOutputStreamReadyEvent(&temp,
+                                                        callback, target);
+             if (NS_FAILED(rv)) return rv;
+             mCallback = temp;
+@@ -693,7 +691,6 @@ nsSocketTransport::nsSocketTransport()
+ {
+     LOG(("creating nsSocketTransport @%x\n", this));
+ 
+-    NS_ADDREF(gSocketTransportService);
+ 
+     mTimeouts[TIMEOUT_CONNECT]    = PR_UINT16_MAX; // no timeout
+     mTimeouts[TIMEOUT_READ_WRITE] = PR_UINT16_MAX; // no timeout
+@@ -726,7 +723,7 @@ nsSocketTransport::Init(const char **typ
+     if (!mLock)
+         return NS_ERROR_OUT_OF_MEMORY;
+ 
+-    nsCOMPtr<nsProxyInfo> proxyInfo;
++    nsProxyInfo* proxyInfo = nsnull;
+     if (givenProxyInfo) {
+         proxyInfo = do_QueryInterface(givenProxyInfo);
+         NS_ENSURE_ARG(proxyInfo);
+@@ -760,7 +757,7 @@ nsSocketTransport::Init(const char **typ
+     // if we have socket types, then the socket provider service had
+     // better exist!
+     nsresult rv;
+-    nsCOMPtr<nsISocketProviderService> spserv =
++    nsISocketProviderService* spserv =
+         do_GetService(kSocketProviderServiceCID, &rv);
+     if (NS_FAILED(rv)) return rv;
+ 
+@@ -780,8 +777,8 @@ nsSocketTransport::Init(const char **typ
+             mTypeCount = i;
+             return NS_ERROR_OUT_OF_MEMORY;
+         }
+-        nsCOMPtr<nsISocketProvider> provider;
+-        rv = spserv->GetSocketProvider(mTypes[i], getter_AddRefs(provider));
++        nsISocketProvider* provider = nsnull;
++        rv = spserv->GetSocketProvider(mTypes[i], &provider);
+         if (NS_FAILED(rv)) {
+             NS_WARNING("no registered socket provider");
+             return rv;
+@@ -852,7 +849,7 @@ nsSocketTransport::PostEvent(PRUint32 ty
+     LOG(("nsSocketTransport::PostEvent [this=%p type=%u status=%x param=%p]\n",
+         this, type, status, param));
+ 
+-    nsCOMPtr<nsIRunnable> event = new nsSocketEvent(this, type, status, param);
++    nsIRunnable* event = new nsSocketEvent(this, type, status, param);
+     if (!event)
+         return NS_ERROR_OUT_OF_MEMORY;
+ 
+@@ -864,7 +861,7 @@ nsSocketTransport::SendStatus(nsresult s
+ {
+     LOG(("nsSocketTransport::SendStatus [this=%x status=%x]\n", this, status));
+ 
+-    nsCOMPtr<nsITransportEventSink> sink;
++    nsITransportEventSink* sink = nsnull;
+     PRUint64 progress;
+     {
+         nsAutoLock lock(mLock);
+@@ -913,7 +910,7 @@ nsSocketTransport::ResolveHost()
+         }
+     }
+ 
+-    nsCOMPtr<nsIDNSService> dns = do_GetService(kDNSServiceCID, &rv);
++    nsIDNSService* dns = do_GetService(kDNSServiceCID, &rv);
+     if (NS_FAILED(rv)) return rv;
+ 
+     mResolving = PR_TRUE;
+@@ -947,7 +944,7 @@ nsSocketTransport::BuildSocket(PRFileDes
+     else {
+         fd = nsnull;
+ 
+-        nsCOMPtr<nsISocketProviderService> spserv =
++        nsISocketProviderService* spserv =
+             do_GetService(kSocketProviderServiceCID, &rv);
+         if (NS_FAILED(rv)) return rv;
+ 
+@@ -959,25 +956,25 @@ nsSocketTransport::BuildSocket(PRFileDes
+ 
+         PRUint32 i;
+         for (i=0; i<mTypeCount; ++i) {
+-            nsCOMPtr<nsISocketProvider> provider;
++            nsISocketProvider* provider = nsnull;
+ 
+             LOG(("  pushing io layer [%u:%s]\n", i, mTypes[i]));
+ 
+-            rv = spserv->GetSocketProvider(mTypes[i], getter_AddRefs(provider));
++            rv = spserv->GetSocketProvider(mTypes[i], &provider);
+             if (NS_FAILED(rv))
+                 break;
+ 
+             if (mProxyTransparentResolvesHost)
+                 proxyFlags |= nsISocketProvider::PROXY_RESOLVES_HOST;
+ 
+-            nsCOMPtr<nsISupports> secinfo;
++            nsISupports* secinfo = nsnull;
+             if (i == 0) {
+                 // if this is the first type, we'll want the 
+                 // service to allocate a new socket
+                 rv = provider->NewSocket(mNetAddr.raw.family,
+                                          host, port, proxyHost, proxyPort,
+                                          proxyFlags, &fd,
+-                                         getter_AddRefs(secinfo));
++                                         &secinfo);
+ 
+                 if (NS_SUCCEEDED(rv) && !fd) {
+                     NS_NOTREACHED("NewSocket succeeded but failed to create a PRFileDesc");
+@@ -991,7 +988,7 @@ nsSocketTransport::BuildSocket(PRFileDes
+                 rv = provider->AddToSocket(mNetAddr.raw.family,
+                                            host, port, proxyHost, proxyPort,
+                                            proxyFlags, fd,
+-                                           getter_AddRefs(secinfo));
++                                           &secinfo);
+             }
+             proxyFlags = 0;
+             if (NS_FAILED(rv))
+@@ -1001,7 +998,7 @@ nsSocketTransport::BuildSocket(PRFileDes
+             PRBool isSSL = (strcmp(mTypes[i], "ssl") == 0);
+             if (isSSL || (strcmp(mTypes[i], "starttls") == 0)) {
+                 // remember security info and give notification callbacks to PSM...
+-                nsCOMPtr<nsIInterfaceRequestor> callbacks;
++                nsIInterfaceRequestor* callbacks = nsnull;
+                 {
+                     nsAutoLock lock(mLock);
+                     mSecInfo = secinfo;
+@@ -1009,7 +1006,7 @@ nsSocketTransport::BuildSocket(PRFileDes
+                     LOG(("  [secinfo=%x callbacks=%x]\n", mSecInfo.get(), mCallbacks.get()));
+                 }
+                 // don't call into PSM while holding mLock!!
+-                nsCOMPtr<nsISSLSocketControl> secCtrl(do_QueryInterface(secinfo));
++                nsISSLSocketControl* secCtrl(do_QueryInterface(secinfo));
+                 if (secCtrl)
+                     secCtrl->SetNotificationCallbacks(callbacks);
+                 // remember if socket type is SSL so we can ProxyStartSSL if need be.
+@@ -1055,7 +1052,7 @@ nsSocketTransport::InitiateSocket()
+     // 194402 for more info.
+     //
+     if (!gSocketTransportService->CanAttachSocket()) {
+-        nsCOMPtr<nsIRunnable> event =
++        nsIRunnable* event =
+                 new nsSocketEvent(this, MSG_RETRY_INIT_SOCKET);
+         if (!event)
+             return NS_ERROR_OUT_OF_MEMORY;
+@@ -1158,7 +1155,7 @@ nsSocketTransport::InitiateSocket()
+                 // been pushed, and we were proxying (transparently; ie. nothing
+                 // has to happen in the protocol layer above us), it's time for
+                 // the ssl to start doing it's thing.
+-                nsCOMPtr<nsISSLSocketControl> secCtrl =
++                nsISSLSocketControl* secCtrl =
+                     do_QueryInterface(mSecInfo);
+                 if (secCtrl) {
+                     LOG(("  calling ProxyStartSSL()\n"));
+@@ -1549,7 +1546,7 @@ nsSocketTransport::OnSocketDetached(PRFi
+     // break any potential reference cycle between the security info object
+     // and ourselves by resetting its notification callbacks object.  see
+     // bug 285991 for details.
+-    nsCOMPtr<nsISSLSocketControl> secCtrl = do_QueryInterface(mSecInfo);
++    nsISSLSocketControl* secCtrl = do_QueryInterface(mSecInfo);
+     if (secCtrl)
+         secCtrl->SetNotificationCallbacks(nsnull);
+ 
+@@ -1591,7 +1588,7 @@ nsSocketTransport::OpenInputStream(PRUin
+     NS_ENSURE_TRUE(!mInput.IsReferenced(), NS_ERROR_UNEXPECTED);
+ 
+     nsresult rv;
+-    nsCOMPtr<nsIAsyncInputStream> pipeIn;
++    nsIAsyncInputStream* pipeIn = nsnull;
+ 
+     if (!(flags & OPEN_UNBUFFERED) || (flags & OPEN_BLOCKING)) {
+         // XXX if the caller wants blocking, then the caller also gets buffered!
+@@ -1602,8 +1599,8 @@ nsSocketTransport::OpenInputStream(PRUin
+         nsIMemory *segalloc = net_GetSegmentAlloc(segsize);
+ 
+         // create a pipe
+-        nsCOMPtr<nsIAsyncOutputStream> pipeOut;
+-        rv = NS_NewPipe2(getter_AddRefs(pipeIn), getter_AddRefs(pipeOut),
++        nsIAsyncOutputStream* pipeOut = nsnull;
++        rv = NS_NewPipe2(&pipeIn, &pipeOut,
+                          !openBlocking, PR_TRUE, segsize, segcount, segalloc);
+         if (NS_FAILED(rv)) return rv;
+ 
+@@ -1623,7 +1620,6 @@ nsSocketTransport::OpenInputStream(PRUin
+     rv = PostEvent(MSG_ENSURE_CONNECT);
+     if (NS_FAILED(rv)) return rv;
+ 
+-    NS_ADDREF(*result);
+     return NS_OK;
+ }
+ 
+@@ -1639,7 +1635,7 @@ nsSocketTransport::OpenOutputStream(PRUi
+     NS_ENSURE_TRUE(!mOutput.IsReferenced(), NS_ERROR_UNEXPECTED);
+ 
+     nsresult rv;
+-    nsCOMPtr<nsIAsyncOutputStream> pipeOut;
++    nsIAsyncOutputStream* pipeOut = nsnull;
+     if (!(flags & OPEN_UNBUFFERED) || (flags & OPEN_BLOCKING)) {
+         // XXX if the caller wants blocking, then the caller also gets buffered!
+         //PRBool openBuffered = !(flags & OPEN_UNBUFFERED);
+@@ -1649,8 +1645,8 @@ nsSocketTransport::OpenOutputStream(PRUi
+         nsIMemory *segalloc = net_GetSegmentAlloc(segsize);
+ 
+         // create a pipe
+-        nsCOMPtr<nsIAsyncInputStream> pipeIn;
+-        rv = NS_NewPipe2(getter_AddRefs(pipeIn), getter_AddRefs(pipeOut),
++        nsIAsyncInputStream* pipeIn = nsnull;
++        rv = NS_NewPipe2(&pipeIn, &pipeOut,
+                          PR_TRUE, !openBlocking, segsize, segcount, segalloc);
+         if (NS_FAILED(rv)) return rv;
+ 
+@@ -1670,7 +1666,6 @@ nsSocketTransport::OpenOutputStream(PRUi
+     rv = PostEvent(MSG_ENSURE_CONNECT);
+     if (NS_FAILED(rv)) return rv;
+ 
+-    NS_ADDREF(*result);
+     return NS_OK;
+ }
+ 
+@@ -1689,7 +1684,7 @@ nsSocketTransport::GetSecurityInfo(nsISu
+ nsSocketTransport::GetSecurityInfo(nsISupports **secinfo)
+ {
+     nsAutoLock lock(mLock);
+-    NS_IF_ADDREF(*secinfo = mSecInfo);
++    *secinfo = mSecInfo;
+     return NS_OK;
+ }
+ 
+@@ -1697,7 +1692,7 @@ nsSocketTransport::GetSecurityCallbacks(
+ nsSocketTransport::GetSecurityCallbacks(nsIInterfaceRequestor **callbacks)
+ {
+     nsAutoLock lock(mLock);
+-    NS_IF_ADDREF(*callbacks = mCallbacks);
++    *callbacks = mCallbacks;
+     return NS_OK;
+ }
+ 
+@@ -1714,13 +1709,13 @@ nsSocketTransport::SetEventSink(nsITrans
+ nsSocketTransport::SetEventSink(nsITransportEventSink *sink,
+                                 nsIEventTarget *target)
+ {
+-    nsCOMPtr<nsITransportEventSink> temp;
++    nsITransportEventSink* temp = nsnull;
+     if (target) {
+-        nsresult rv = net_NewTransportEventSinkProxy(getter_AddRefs(temp),
++        nsresult rv = net_NewTransportEventSinkProxy(&temp,
+                                                      sink, target);
+         if (NS_FAILED(rv))
+             return rv;
+-        sink = temp.get();
++        sink = temp;
+     }
+ 
+     nsAutoLock lock(mLock);
+diff --git a/netwerk/base/src/nsSocketTransportService2.cpp b/netwerk/base/src/nsSocketTransportService2.cpp
+--- a/netwerk/base/src/nsSocketTransportService2.cpp
++++ b/netwerk/base/src/nsSocketTransportService2.cpp
+@@ -83,7 +83,6 @@ nsSocketTransportService::nsSocketTransp
+ 
+ nsSocketTransportService::~nsSocketTransportService()
+ {
+-    NS_ASSERTION(NS_IsMainThread(), "wrong thread");
+     NS_ASSERTION(!mInitialized, "not shutdown properly");
+ 
+     if (mLock)
+@@ -337,6 +336,9 @@ nsSocketTransportService::Poll(PRBool wa
+ 
+     if (!wait)
+         pollTimeout = PR_INTERVAL_NO_WAIT;
++
++    if (pollTimeout > PR_MillisecondsToInterval(25))
++      pollTimeout = PR_MillisecondsToInterval(25);
+ 
+     PRInt32 rv;
+     PRIntervalTime ts;
+diff --git a/netwerk/base/src/nsStreamListenerTee.cpp b/netwerk/base/src/nsStreamListenerTee.cpp
+--- a/netwerk/base/src/nsStreamListenerTee.cpp
++++ b/netwerk/base/src/nsStreamListenerTee.cpp
+@@ -58,6 +58,7 @@ nsStreamListenerTee::OnStopRequest(nsIRe
+     NS_ENSURE_TRUE(mListener, NS_ERROR_NOT_INITIALIZED);
+     // it is critical that we close out the input stream tee
+     if (mInputTee) {
++        mInputTee->Close();
+         mInputTee->SetSink(nsnull);
+         mInputTee = 0;
+     }
+@@ -75,11 +76,11 @@ nsStreamListenerTee::OnDataAvailable(nsI
+     NS_ENSURE_TRUE(mListener, NS_ERROR_NOT_INITIALIZED);
+     NS_ENSURE_TRUE(mSink, NS_ERROR_NOT_INITIALIZED);
+ 
+-    nsCOMPtr<nsIInputStream> tee;
+     nsresult rv;
+ 
+     if (!mInputTee) {
+-        rv = NS_NewInputStreamTee(getter_AddRefs(tee), input, mSink);
++        nsIInputStream *tee = nsnull;
++        rv = NS_NewInputStreamTee(&tee, input, mSink);
+         if (NS_FAILED(rv)) return rv;
+ 
+         mInputTee = do_QueryInterface(tee, &rv);
+@@ -89,12 +90,9 @@ nsStreamListenerTee::OnDataAvailable(nsI
+         // re-initialize the input tee since the input stream may have changed.
+         rv = mInputTee->SetSource(input);
+         if (NS_FAILED(rv)) return rv;
+-
+-        tee = do_QueryInterface(mInputTee, &rv);
+-        if (NS_FAILED(rv)) return rv;
+     }
+ 
+-    return mListener->OnDataAvailable(request, context, tee, offset, count);
++    return mListener->OnDataAvailable(request, context, mInputTee, offset, count);
+ }
+ 
+ NS_IMETHODIMP
+diff --git a/netwerk/cache/src/nsCacheDevice.h b/netwerk/cache/src/nsCacheDevice.h
+--- a/netwerk/cache/src/nsCacheDevice.h
++++ b/netwerk/cache/src/nsCacheDevice.h
+@@ -55,7 +55,7 @@ class nsIOutputStream;
+ /******************************************************************************
+ * nsCacheDevice
+ *******************************************************************************/
+-class nsCacheDevice {
++class nsCacheDevice : public XPCOMGCFinalizedObject, MMgc::GCFinalizable {
+ public:
+     nsCacheDevice() { MOZ_COUNT_CTOR(nsCacheDevice); }
+     virtual ~nsCacheDevice() { MOZ_COUNT_DTOR(nsCacheDevice); }
+diff --git a/netwerk/cache/src/nsCacheEntry.cpp b/netwerk/cache/src/nsCacheEntry.cpp
+--- a/netwerk/cache/src/nsCacheEntry.cpp
++++ b/netwerk/cache/src/nsCacheEntry.cpp
+@@ -80,9 +80,6 @@ nsCacheEntry::~nsCacheEntry()
+ {
+     MOZ_COUNT_DTOR(nsCacheEntry);
+     delete mKey;
+-    
+-    if (mData)
+-        nsCacheService::ReleaseObject_Locked(mData, mThread);
+ }
+ 
+ 
+@@ -128,21 +125,6 @@ nsCacheEntry::TouchData()
+ {
+     mLastModified = SecondsFromPRTime(PR_Now());
+     MarkDataDirty();
+-}
+-
+-
+-void
+-nsCacheEntry::SetData(nsISupports * data)
+-{
+-    if (mData) {
+-        nsCacheService::ReleaseObject_Locked(mData, mThread);
+-        mData = nsnull;
+-    }
+-
+-    if (data) {
+-        NS_ADDREF(mData = data);
+-        mThread = do_GetCurrentThread();
+-    }
+ }
+ 
+ 
+@@ -225,7 +207,7 @@ nsCacheEntry::CreateDescriptor(nsCacheRe
+ 
+     PR_APPEND_LINK(descriptor, &mDescriptorQ);
+ 
+-    NS_ADDREF(*result = descriptor);
++    *result = descriptor;
+     return NS_OK;
+ }
+ 
+@@ -386,8 +368,8 @@ PLDHashTableOps
+ PLDHashTableOps
+ nsCacheEntryHashTable::ops =
+ {
+-    PL_DHashAllocTable,
+-    PL_DHashFreeTable,
++    GCAllocTable,
++    GCFreeTable,
+     HashKey,
+     MatchEntry,
+     MoveEntry,
+diff --git a/netwerk/cache/src/nsCacheEntry.h b/netwerk/cache/src/nsCacheEntry.h
+--- a/netwerk/cache/src/nsCacheEntry.h
++++ b/netwerk/cache/src/nsCacheEntry.h
+@@ -63,7 +63,9 @@ class nsCacheEntryDescriptor;
+ /******************************************************************************
+ * nsCacheEntry
+ *******************************************************************************/
+-class nsCacheEntry : public PRCList
++class nsCacheEntry : public XPCOMGCFinalizedObject
++                   , public MMgc::GCFinalizable
++                   , public PRCList
+ {
+ public:
+ 
+@@ -72,6 +74,11 @@ public:
+                  nsCacheStoragePolicy storagePolicy);
+     ~nsCacheEntry();
+ 
++    // it's ok to explicitly delete this
++    static void operator delete(void* obj)
++    {
++        return XPCOMGCFinalizedObject::operator delete(obj);
++    }
+ 
+     static nsresult  Create( const char *          key,
+                              PRBool                streamBased,
+@@ -104,7 +111,7 @@ public:
+      * Data accessors
+      */
+     nsISupports *Data()                           { return mData; }
+-    void         SetData( nsISupports * data);
++    void         SetData(nsISupports * data)      { mData = data; }
+ 
+     PRUint32 DataSize()                           { return mDataSize; }
+     void     SetDataSize( PRUint32  size)         { mDataSize = size; }
+@@ -244,8 +251,7 @@ private:
+     PRUint32                mDataSize;       // 4
+     nsCacheDevice *         mCacheDevice;    // 4
+     nsCOMPtr<nsISupports>   mSecurityInfo;   // 
+-    nsISupports *           mData;           // strong ref
+-    nsCOMPtr<nsIThread>     mThread;
++    nsCOMPtr<nsISupports>   mData;
+     nsCacheMetaData         mMetaData;       // 4
+     PRCList                 mRequestQ;       // 8
+     PRCList                 mDescriptorQ;    // 8
+@@ -255,7 +261,7 @@ private:
+ /******************************************************************************
+ * nsCacheEntryInfo
+ *******************************************************************************/
+-class nsCacheEntryInfo : public nsICacheEntryInfo {
++class nsCacheEntryInfo : public XPCOMGCFinalizedObject, public nsICacheEntryInfo {
+ public:
+     NS_DECL_ISUPPORTS
+     NS_DECL_NSICACHEENTRYINFO
+diff --git a/netwerk/cache/src/nsCacheEntryDescriptor.cpp b/netwerk/cache/src/nsCacheEntryDescriptor.cpp
+--- a/netwerk/cache/src/nsCacheEntryDescriptor.cpp
++++ b/netwerk/cache/src/nsCacheEntryDescriptor.cpp
+@@ -57,22 +57,11 @@ nsCacheEntryDescriptor::nsCacheEntryDesc
+       mAccessGranted(accessGranted)
+ {
+     PR_INIT_CLIST(this);
+-    NS_ADDREF(nsCacheService::GlobalInstance());  // ensure it lives for the lifetime of the descriptor
+ }
+ 
+ 
+ nsCacheEntryDescriptor::~nsCacheEntryDescriptor()
+ {
+-    // No need to close if the cache entry has already been severed.  This
+-    // helps avoid a shutdown assertion (bug 285519) that is caused when
+-    // consumers end up holding onto these objects past xpcom-shutdown.  It's
+-    // okay for them to do that because the cache service calls our Close
+-    // method during xpcom-shutdown, so we don't need to complain about it.
+-    if (mCacheEntry)
+-        Close();
+-
+-    nsCacheService * service = nsCacheService::GlobalInstance();
+-    NS_RELEASE(service);
+ }
+ 
+ 
+@@ -254,7 +243,7 @@ nsCacheEntryDescriptor::OpenInputStream(
+         new nsInputStreamWrapper(this, offset);
+     if (!cacheInput) return NS_ERROR_OUT_OF_MEMORY;
+ 
+-    NS_ADDREF(*result = cacheInput);
++    *result = cacheInput;
+     return NS_OK;
+ }
+ 
+@@ -277,7 +266,7 @@ nsCacheEntryDescriptor::OpenOutputStream
+         new nsOutputStreamWrapper(this, offset);
+     if (!cacheOutput) return NS_ERROR_OUT_OF_MEMORY;
+ 
+-    NS_ADDREF(*result = cacheOutput);
++    *result = cacheOutput;
+     return NS_OK;
+ }
+ 
+@@ -290,7 +279,7 @@ nsCacheEntryDescriptor::GetCacheElement(
+     if (!mCacheEntry)                 return NS_ERROR_NOT_AVAILABLE;
+     if (mCacheEntry->IsStreamData())  return NS_ERROR_CACHE_DATA_IS_STREAM;
+ 
+-    NS_IF_ADDREF(*result = mCacheEntry->Data());
++    *result = mCacheEntry->Data();
+     return NS_OK;
+ }
+ 
+@@ -507,7 +496,7 @@ nsInputStreamWrapper::LazyInit()
+     nsCacheEntry* cacheEntry = mDescriptor->CacheEntry();
+     if (!cacheEntry) return NS_ERROR_NOT_AVAILABLE;
+ 
+-    nsCOMPtr<nsIInputStream> input;
++    nsIInputStream* input = nsnull;
+     rv = nsCacheService::OpenInputStreamForEntry(cacheEntry, mode,
+                                                  mStartOffset,
+                                                  getter_AddRefs(mInput));
+diff --git a/netwerk/cache/src/nsCacheEntryDescriptor.h b/netwerk/cache/src/nsCacheEntryDescriptor.h
+--- a/netwerk/cache/src/nsCacheEntryDescriptor.h
++++ b/netwerk/cache/src/nsCacheEntryDescriptor.h
+@@ -51,6 +51,7 @@
+ * nsCacheEntryDescriptor
+ *******************************************************************************/
+ class nsCacheEntryDescriptor :
++    public XPCOMGCFinalizedObject,
+     public PRCList,
+     public nsICacheEntryDescriptor
+ {
+@@ -82,7 +83,7 @@ private:
+       * The input stream wrapper references the descriptor, but the descriptor
+       * doesn't need any references to the stream wrapper.
+       *************************************************************************/
+-     class nsInputStreamWrapper : public nsIInputStream {
++     class nsInputStreamWrapper : public XPCOMGCFinalizedObject, public nsIInputStream {
+      private:
+          nsCacheEntryDescriptor    * mDescriptor;
+          nsCOMPtr<nsIInputStream>    mInput;
+@@ -97,7 +98,6 @@ private:
+              , mStartOffset(off)
+              , mInitialized(PR_FALSE)
+          {
+-             NS_ADDREF(mDescriptor);
+          }
+          virtual ~nsInputStreamWrapper()
+          {
+@@ -117,7 +117,7 @@ private:
+       * The output stream wrapper references the descriptor, but the descriptor
+       * doesn't need any references to the stream wrapper.
+       *************************************************************************/
+-     class nsOutputStreamWrapper : public nsIOutputStream {
++     class nsOutputStreamWrapper : public XPCOMGCFinalizedObject, public nsIOutputStream {
+      private:
+          nsCacheEntryDescriptor *    mDescriptor;
+          nsCOMPtr<nsIOutputStream>   mOutput;
+@@ -132,7 +132,6 @@ private:
+              , mStartOffset(off)
+              , mInitialized(PR_FALSE)
+          {
+-             NS_ADDREF(mDescriptor); // owning ref
+          }
+          virtual ~nsOutputStreamWrapper()
+          { 
+diff --git a/netwerk/cache/src/nsCacheRequest.h b/netwerk/cache/src/nsCacheRequest.h
+--- a/netwerk/cache/src/nsCacheRequest.h
++++ b/netwerk/cache/src/nsCacheRequest.h
+@@ -49,7 +49,9 @@
+ #include "nsCacheService.h"
+ 
+ 
+-class nsCacheRequest : public PRCList
++class nsCacheRequest : public XPCOMGCFinalizedObject
++                     , public MMgc::GCFinalizable
++                     , public PRCList
+ {
+ private:
+     friend class nsCacheService;
+@@ -74,7 +76,6 @@ private:
+         if (session->WillDoomEntriesIfExpired())  MarkDoomEntriesIfExpired();
+         if (blockingMode == nsICache::BLOCKING)    MarkBlockingMode();
+         MarkWaitingForValidation();
+-        NS_IF_ADDREF(mListener);
+     }
+     
+     ~nsCacheRequest()
+@@ -83,12 +84,13 @@ private:
+         delete mKey;
+         if (mLock)    PR_DestroyLock(mLock);
+         if (mCondVar) PR_DestroyCondVar(mCondVar);
+-        NS_ASSERTION(PR_CLIST_IS_EMPTY(this), "request still on a list");
++    }
+ 
+-        if (mListener)
+-            nsCacheService::ReleaseObject_Locked(mListener, mThread);
++    static void operator delete(void *obj)
++    {
++        NS_GetGC()->Free(obj);
+     }
+-    
++
+     /**
+      * Simple Accessors
+      */
+diff --git a/netwerk/cache/src/nsCacheService.cpp b/netwerk/cache/src/nsCacheService.cpp
+--- a/netwerk/cache/src/nsCacheService.cpp
++++ b/netwerk/cache/src/nsCacheService.cpp
+@@ -92,7 +92,7 @@
+ #define MEMORY_CACHE_MAX_ENTRY_SIZE_PREF "browser.cache.memory.max_entry_size"
+ 
+ 
+-class nsCacheProfilePrefObserver : public nsIObserver
++class nsCacheProfilePrefObserver : public XPCOMGCFinalizedObject, public nsIObserver
+ {
+ public:
+     NS_DECL_ISUPPORTS
+@@ -150,7 +150,7 @@ nsCacheProfilePrefObserver::Install()
+     nsresult rv, rv2 = NS_OK;
+     
+     // install profile-change observer
+-    nsCOMPtr<nsIObserverService> observerService = do_GetService("@mozilla.org/observer-service;1", &rv);
++    nsIObserverService* observerService = do_GetService("@mozilla.org/observer-service;1", &rv);
+     if (NS_FAILED(rv)) return rv;
+     NS_ENSURE_ARG(observerService);
+     
+@@ -167,7 +167,7 @@ nsCacheProfilePrefObserver::Install()
+     
+     
+     // install preferences observer
+-    nsCOMPtr<nsIPrefBranch2> branch = do_GetService(NS_PREFSERVICE_CONTRACTID);
++    nsIPrefBranch2* branch = do_GetService(NS_PREFSERVICE_CONTRACTID);
+     if (!branch) return NS_ERROR_FAILURE;
+ 
+     char * prefList[] = { 
+@@ -194,9 +194,9 @@ nsCacheProfilePrefObserver::Install()
+     //     In that case, we detect the presence of a profile by the existence
+     //     of the NS_APP_USER_PROFILE_50_DIR directory.
+ 
+-    nsCOMPtr<nsIFile>  directory;
++    nsIFile*  directory = nsnull;
+     rv = NS_GetSpecialDirectory(NS_APP_USER_PROFILE_50_DIR,
+-                                getter_AddRefs(directory));
++                                &directory);
+     if (NS_SUCCEEDED(rv)) {
+         mHaveProfile = PR_TRUE;
+     }
+@@ -211,7 +211,7 @@ nsCacheProfilePrefObserver::Remove()
+ nsCacheProfilePrefObserver::Remove()
+ {
+     // remove Observer Service observers
+-    nsCOMPtr<nsIObserverService> obs =
++    nsIObserverService* obs =
+             do_GetService("@mozilla.org/observer-service;1");
+     if (obs) {
+         obs->RemoveObserver(this, "profile-before-change");
+@@ -220,7 +220,7 @@ nsCacheProfilePrefObserver::Remove()
+     }
+ 
+     // remove Pref Service observers
+-    nsCOMPtr<nsIPrefBranch2> prefs =
++    nsIPrefBranch2* prefs =
+            do_GetService(NS_PREFSERVICE_CONTRACTID);
+     if (prefs) {
+         // remove Disk cache pref observers
+@@ -265,7 +265,7 @@ nsCacheProfilePrefObserver::Observe(nsIS
+     } else if (!strcmp("profile-after-change", topic)) {
+         // profile after change
+         mHaveProfile = PR_TRUE;
+-        nsCOMPtr<nsIPrefBranch> branch = do_GetService(NS_PREFSERVICE_CONTRACTID);
++        nsIPrefBranch* branch = do_GetService(NS_PREFSERVICE_CONTRACTID);
+         ReadPrefs(branch);
+         nsCacheService::OnProfileChanged();
+     
+@@ -274,7 +274,7 @@ nsCacheProfilePrefObserver::Observe(nsIS
+         // ignore pref changes until we're done switch profiles
+         if (!mHaveProfile)  return NS_OK;
+ 
+-        nsCOMPtr<nsIPrefBranch> branch = do_QueryInterface(subject, &rv);
++        nsIPrefBranch* branch = do_QueryInterface(subject, &rv);
+         if (NS_FAILED(rv))  return rv;
+ 
+ #ifdef NECKO_DISK_CACHE
+@@ -366,18 +366,18 @@ nsCacheProfilePrefObserver::ReadPrefs(ns
+                                    getter_AddRefs(mDiskCacheParentDirectory));
+     
+     if (!mDiskCacheParentDirectory) {
+-        nsCOMPtr<nsIFile>  directory;
++        nsIFile*  directory = nsnull;
+ 
+         // try to get the disk cache parent directory
+         rv = NS_GetSpecialDirectory(NS_APP_CACHE_PARENT_DIR,
+-                                    getter_AddRefs(directory));
++                                    &directory);
+         if (NS_FAILED(rv)) {
+             // try to get the profile directory (there may not be a profile yet)
+-            nsCOMPtr<nsIFile> profDir;
++            nsIFile* profDir = nsnull;
+             NS_GetSpecialDirectory(NS_APP_USER_PROFILE_50_DIR,
+-                                   getter_AddRefs(profDir));
++                                   &profDir);
+             NS_GetSpecialDirectory(NS_APP_USER_PROFILE_LOCAL_50_DIR,
+-                                   getter_AddRefs(directory));
++                                   &directory);
+             if (!directory)
+                 directory = profDir;
+             else if (profDir) {
+@@ -398,7 +398,7 @@ nsCacheProfilePrefObserver::ReadPrefs(ns
+         if (!directory) {
+             // use current process directory during development
+             rv = NS_GetSpecialDirectory(NS_XPCOM_CURRENT_PROCESS_DIR,
+-                                        getter_AddRefs(directory));
++                                        &directory);
+         }
+ #endif
+         if (directory)
+@@ -420,18 +420,18 @@ nsCacheProfilePrefObserver::ReadPrefs(ns
+                                    getter_AddRefs(mOfflineCacheParentDirectory));
+ 
+     if (!mOfflineCacheParentDirectory) {
+-        nsCOMPtr<nsIFile>  directory;
++        nsIFile*  directory = nsnull;
+ 
+         // try to get the offline cache parent directory
+         rv = NS_GetSpecialDirectory(NS_APP_CACHE_PARENT_DIR,
+-                                    getter_AddRefs(directory));
++                                    &directory);
+         if (NS_FAILED(rv)) {
+             // try to get the profile directory (there may not be a profile yet)
+-            nsCOMPtr<nsIFile> profDir;
++            nsIFile* profDir = nsnull;
+             NS_GetSpecialDirectory(NS_APP_USER_PROFILE_50_DIR,
+-                                   getter_AddRefs(profDir));
++                                   &profDir);
+             NS_GetSpecialDirectory(NS_APP_USER_PROFILE_LOCAL_50_DIR,
+-                                   getter_AddRefs(directory));
++                                   &directory);
+             if (!directory)
+                 directory = profDir;
+         }
+@@ -439,7 +439,7 @@ nsCacheProfilePrefObserver::ReadPrefs(ns
+         if (!directory) {
+             // use current process directory during development
+             rv = NS_GetSpecialDirectory(NS_XPCOM_CURRENT_PROCESS_DIR,
+-                                        getter_AddRefs(directory));
++                                        &directory);
+         }
+ #endif
+         if (directory)
+@@ -624,7 +624,6 @@ nsCacheService::Init()
+     // create profile/preference observer
+     mObserver = new nsCacheProfilePrefObserver();
+     if (!mObserver)  return NS_ERROR_OUT_OF_MEMORY;
+-    NS_ADDREF(mObserver);
+     
+     mObserver->Install();
+     mEnableDiskDevice    = mObserver->DiskCacheEnabled();
+@@ -654,17 +653,12 @@ nsCacheService::Shutdown()
+         ClearDoomList();
+         ClearActiveEntries();
+ 
+-        // deallocate memory and disk caches
+-        delete mMemoryDevice;
++        // lose the memory and disk caches
+         mMemoryDevice = nsnull;
+-
+ #ifdef NECKO_DISK_CACHE
+-        delete mDiskDevice;
+         mDiskDevice = nsnull;
+ #endif // !NECKO_DISK_CACHE
+-
+ #ifdef NECKO_OFFLINE_CACHE
+-        delete mOfflineDevice;
+         mOfflineDevice = nsnull;
+ #endif // !NECKO_OFFLINE_CACHE
+ 
+@@ -687,7 +681,6 @@ nsCacheService::Create(nsISupports* aOut
+     if (cacheService == nsnull)
+         return NS_ERROR_OUT_OF_MEMORY;
+ 
+-    NS_ADDREF(cacheService);
+     rv = cacheService->Init();
+     if (NS_SUCCEEDED(rv)) {
+         rv = cacheService->QueryInterface(aIID, aResult);
+@@ -710,7 +703,7 @@ nsCacheService::CreateSession(const char
+     nsCacheSession * session = new nsCacheSession(clientID, storagePolicy, streamBased);
+     if (!session)  return NS_ERROR_OUT_OF_MEMORY;
+ 
+-    NS_ADDREF(*result = session);
++    *result = session;
+ 
+     return NS_OK;
+ }
+@@ -731,17 +724,17 @@ nsCacheService::EvictEntriesForClient(co
+ {
+     if (this == nsnull) return NS_ERROR_NOT_AVAILABLE; // XXX eh?
+ 
+-    nsCOMPtr<nsIObserverService> obsSvc =
++    nsIObserverService* obsSvc =
+         do_GetService("@mozilla.org/observer-service;1");
+     if (obsSvc) {
+         // Proxy to the UI thread since the observer service isn't thredsafe.
+         // We use an async proxy, since this it's not important whether this
+         // notification happens before or after the actual eviction.
+ 
+-        nsCOMPtr<nsIObserverService> obsProxy;
++        nsIObserverService* obsProxy = nsnull;
+         NS_GetProxyForObject(NS_PROXY_TO_MAIN_THREAD,
+                              NS_GET_IID(nsIObserverService), obsSvc,
+-                             NS_PROXY_ASYNC, getter_AddRefs(obsProxy));
++                             NS_PROXY_ASYNC, (void**)&obsProxy);
+ 
+         if (obsProxy) {
+             obsProxy->NotifyObservers(this,
+@@ -1241,7 +1234,7 @@ nsCacheService::CreateRequest(nsCacheSes
+ 
+     // get the request's thread
+     (*request)->mThread = do_GetCurrentThread();
+-    
++
+     return NS_OK;
+ }
+ 
+@@ -1292,7 +1285,7 @@ nsCacheService::NotifyListener(nsCacheRe
+     nsICacheListener *listener = request->mListener;
+     request->mListener = nsnull;
+ 
+-    nsCOMPtr<nsIRunnable> ev =
++    nsIRunnable* ev =
+             new nsCacheListenerEvent(listener, descriptor,
+                                      accessGranted, status);
+     if (!ev) {
+diff --git a/netwerk/cache/src/nsDeleteDir.cpp b/netwerk/cache/src/nsDeleteDir.cpp
+--- a/netwerk/cache/src/nsDeleteDir.cpp
++++ b/netwerk/cache/src/nsDeleteDir.cpp
+@@ -40,22 +40,24 @@
+ #include "nsIFile.h"
+ #include "nsString.h"
+ #include "prthread.h"
++#include "nsXPCOMRequests.h"
+ 
+ PR_STATIC_CALLBACK(void) DeleteDirThreadFunc(void *arg)
+ {
+   nsIFile *dir = static_cast<nsIFile *>(arg);
++  NS_BeginRequest();
+   dir->Remove(PR_TRUE);
+-  NS_RELEASE(dir);
++  NS_EndRequest();
+ }
+ 
+ nsresult DeleteDir(nsIFile *dirIn, PRBool moveToTrash, PRBool sync)
+ {
+   nsresult rv;
+-  nsCOMPtr<nsIFile> trash, dir;
++  nsIFile* trash = nsnull, *dir = nsnull;
+ 
+   // Need to make a clone of this since we don't want to modify the input
+   // file object.
+-  rv = dirIn->Clone(getter_AddRefs(dir));
++  rv = dirIn->Clone(&dir);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -65,8 +67,8 @@ nsresult DeleteDir(nsIFile *dirIn, PRBoo
+     if (NS_FAILED(rv))
+       return rv;
+ 
+-    nsCOMPtr<nsIFile> subDir;
+-    rv = trash->Clone(getter_AddRefs(subDir));
++    nsIFile* subDir = nsnull;
++    rv = trash->Clone(&subDir);
+     if (NS_FAILED(rv))
+       return rv;
+ 
+@@ -85,12 +87,12 @@ nsresult DeleteDir(nsIFile *dirIn, PRBoo
+   else
+   {
+     // we want to pass a clone of the original off to the worker thread.
+-    trash.swap(dir);
++    swap(trash, dir);
+   }
+ 
+   // Steal ownership of trash directory; let the thread release it.
+   nsIFile *trashRef = nsnull;
+-  trash.swap(trashRef);
++  swap(trash, trashRef);
+ 
+   if (sync)
+   {
+@@ -113,9 +115,9 @@ nsresult DeleteDir(nsIFile *dirIn, PRBoo
+   return NS_OK;
+ }
+ 
+-nsresult GetTrashDir(nsIFile *target, nsCOMPtr<nsIFile> *result)
++nsresult GetTrashDir(nsIFile *target, nsIFile* *result)
+ {
+-  nsresult rv = target->Clone(getter_AddRefs(*result));
++  nsresult rv = target->Clone(&*result);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+diff --git a/netwerk/cache/src/nsDeleteDir.h b/netwerk/cache/src/nsDeleteDir.h
+--- a/netwerk/cache/src/nsDeleteDir.h
++++ b/netwerk/cache/src/nsDeleteDir.h
+@@ -66,6 +66,6 @@ NS_HIDDEN_(nsresult) DeleteDir(nsIFile *
+  * This routine returns the trash directory corresponding to the given 
+  * directory.
+  */
+-NS_HIDDEN_(nsresult) GetTrashDir(nsIFile *dir, nsCOMPtr<nsIFile> *result);
++NS_HIDDEN_(nsresult) GetTrashDir(nsIFile *dir, nsIFile **result);
+ 
+ #endif  // nsDeleteDir_h__
+diff --git a/netwerk/cache/src/nsDiskCacheDevice.cpp b/netwerk/cache/src/nsDiskCacheDevice.cpp
+--- a/netwerk/cache/src/nsDiskCacheDevice.cpp
++++ b/netwerk/cache/src/nsDiskCacheDevice.cpp
+@@ -158,7 +158,7 @@ nsDiskCacheEvictor::VisitRecord(nsDiskCa
+  *  nsDiskCacheDeviceInfo
+  *****************************************************************************/
+ 
+-class nsDiskCacheDeviceInfo : public nsICacheDeviceInfo {
++class nsDiskCacheDeviceInfo : public XPCOMGCFinalizedObject, public nsICacheDeviceInfo {
+ public:
+     NS_DECL_ISUPPORTS
+     NS_DECL_NSICACHEDEVICEINFO
+@@ -191,9 +191,9 @@ NS_IMETHODIMP nsDiskCacheDeviceInfo::Get
+     nsCString buffer;
+     
+     buffer.AssignLiteral("\n<tr>\n<td><b>Cache Directory:</b></td>\n<td><tt> ");
+-    nsCOMPtr<nsILocalFile> cacheDir;
++    nsILocalFile* cacheDir = nsnull;
+     nsAutoString           path;
+-    mDevice->getCacheDirectory(getter_AddRefs(cacheDir)); 
++    mDevice->getCacheDirectory(&cacheDir); 
+     nsresult rv = cacheDir->GetPath(path);
+     if (NS_SUCCEEDED(rv)) {
+         AppendUTF16toUTF8(path, buffer);
+@@ -345,7 +345,7 @@ nsDiskCacheDevice::Shutdown()
+ 
+     if (mCacheDirectory) {
+         // delete any trash files left-over before shutting down.
+-        nsCOMPtr<nsIFile> trashDir;
++        nsIFile* trashDir = nsnull;
+         GetTrashDir(mCacheDirectory, &trashDir);
+         if (trashDir) {
+             PRBool exists;
+@@ -473,7 +473,6 @@ nsDiskCacheDevice::DeactivateEntry(nsCac
+     }
+ 
+     mBindery.RemoveBinding(binding); // extract binding from collision detection stuff
+-    delete entry;   // which will release binding
+     return rv;
+ }
+ 
+@@ -654,13 +653,13 @@ nsDiskCacheDevice::GetFileForEntry(nsCac
+         }
+     }
+     
+-    nsCOMPtr<nsIFile>  file;
++    nsIFile*  file = nsnull;
+     rv = mCacheMap.GetFileForDiskCacheRecord(&binding->mRecord,
+                                              nsDiskCache::kData,
+-                                             getter_AddRefs(file));
++                                             &file);
+     if (NS_FAILED(rv))  return rv;
+     
+-    NS_IF_ADDREF(*result = file);
++    *result = file;
+     return NS_OK;
+ }
+ 
+@@ -740,7 +739,7 @@ public:
+         if (!entryInfo) {
+             return kStopVisitingRecords;
+         }
+-        nsCOMPtr<nsICacheEntryInfo> ref(entryInfo);
++        nsICacheEntryInfo* ref(entryInfo);
+         
+         PRBool  keepGoing;
+         rv = mVisitor->VisitEntry(DISK_CACHE_DEVICE_ID, entryInfo, &keepGoing);
+@@ -759,7 +758,7 @@ nsDiskCacheDevice::Visit(nsICacheVisitor
+ {
+     if (!Initialized())  return NS_ERROR_NOT_INITIALIZED;
+     nsDiskCacheDeviceInfo* deviceInfo = new nsDiskCacheDeviceInfo(this);
+-    nsCOMPtr<nsICacheDeviceInfo> ref(deviceInfo);
++    nsICacheDeviceInfo* ref(deviceInfo);
+     
+     PRBool keepGoing;
+     nsresult rv = visitor->VisitDevice(DISK_CACHE_DEVICE_ID, deviceInfo, &keepGoing);
+@@ -843,7 +842,7 @@ nsDiskCacheDevice::OpenDiskCache()
+ 
+     if (!trashing) {
+         // delete any trash files leftover from a previous run
+-        nsCOMPtr<nsIFile> trashDir;
++        nsIFile* trashDir = nsnull;
+         GetTrashDir(mCacheDirectory, &trashDir);
+         if (trashDir) {
+             PRBool exists;
+@@ -920,9 +919,9 @@ nsDiskCacheDevice::SetCacheParentDirecto
+     if (NS_FAILED(rv))  return;
+ 
+     // ensure cache directory exists
+-    nsCOMPtr<nsIFile> directory;
++    nsIFile* directory = nsnull;
+     
+-    rv = parentDir->Clone(getter_AddRefs(directory));
++    rv = parentDir->Clone(&directory);
+     if (NS_FAILED(rv))  return;
+     rv = directory->AppendNative(NS_LITERAL_CSTRING("Cache"));
+     if (NS_FAILED(rv))  return;
+@@ -935,7 +934,6 @@ nsDiskCacheDevice::getCacheDirectory(nsI
+ nsDiskCacheDevice::getCacheDirectory(nsILocalFile ** result)
+ {
+     *result = mCacheDirectory;
+-    NS_IF_ADDREF(*result);
+ }
+ 
+ 
+diff --git a/netwerk/cache/src/nsDiskCacheStreams.cpp b/netwerk/cache/src/nsDiskCacheStreams.cpp
+--- a/netwerk/cache/src/nsDiskCacheStreams.cpp
++++ b/netwerk/cache/src/nsDiskCacheStreams.cpp
+@@ -59,7 +59,7 @@
+ #ifdef XP_MAC
+ #pragma mark nsDiskCacheInputStream
+ #endif
+-class nsDiskCacheInputStream : public nsIInputStream {
++class nsDiskCacheInputStream : public XPCOMGCFinalizedObject, public nsIInputStream {
+ 
+ public:
+ 
+@@ -97,7 +97,6 @@ nsDiskCacheInputStream::nsDiskCacheInput
+     , mPos(0)
+     , mClosed(PR_FALSE)
+ {
+-    NS_ADDREF(mStreamIO);
+     mStreamIO->IncrementInputStreamCount();
+ }
+ 
+@@ -195,7 +194,7 @@ nsDiskCacheInputStream::IsNonBlocking(PR
+ #pragma mark -
+ #pragma mark nsDiskCacheOutputStream
+ #endif
+-class nsDiskCacheOutputStream : public nsIOutputStream {
++class nsDiskCacheOutputStream : public XPCOMGCFinalizedObject, public nsIOutputStream {
+ public:
+     nsDiskCacheOutputStream( nsDiskCacheStreamIO * parent);
+     virtual ~nsDiskCacheOutputStream();
+@@ -206,7 +205,7 @@ public:
+     void ReleaseStreamIO() { NS_IF_RELEASE(mStreamIO); }
+ 
+ private:
+-    nsDiskCacheStreamIO *           mStreamIO;  // backpointer to parent
++    nsCOMPtr<nsDiskCacheStreamIO>   mStreamIO;  // backpointer to parent
+     PRBool                          mClosed;
+ };
+ 
+@@ -218,7 +217,6 @@ nsDiskCacheOutputStream::nsDiskCacheOutp
+     : mStreamIO(parent)
+     , mClosed(PR_FALSE)
+ {
+-    NS_ADDREF(mStreamIO);
+ }
+ 
+ 
+@@ -245,8 +243,8 @@ nsDiskCacheOutputStream::Flush()
+ nsDiskCacheOutputStream::Flush()
+ {
+     if (mClosed)  return NS_BASE_STREAM_CLOSED;
+-    // yeah, yeah, well get to it...eventually...
+-    return NS_OK;
++
++    return mStreamIO->Flush();
+ }
+ 
+ 
+@@ -318,17 +316,12 @@ nsDiskCacheStreamIO::nsDiskCacheStreamIO
+ 
+     // acquire "death grip" on cache service
+     nsCacheService *service = nsCacheService::GlobalInstance();
+-    NS_ADDREF(service);
+ }
+ 
+ 
+ nsDiskCacheStreamIO::~nsDiskCacheStreamIO()
+ {
+     Close();
+-
+-    // release "death grip" on cache service
+-    nsCacheService *service = nsCacheService::GlobalInstance();
+-    NS_RELEASE(service);
+ }
+ 
+ 
+@@ -339,7 +332,6 @@ nsDiskCacheStreamIO::Close()
+     // no one is interested in us anymore, so we don't need to grab any locks
+     
+     // assert streams closed
+-    NS_ASSERTION(!mOutStream, "output stream still open");
+     NS_ASSERTION(mInStreamCount == 0, "input stream still open");
+     NS_ASSERTION(!mFD, "file descriptor not closed");
+ 
+@@ -390,7 +382,7 @@ nsDiskCacheStreamIO::GetInputStream(PRUi
+     nsDiskCacheInputStream * inStream = new nsDiskCacheInputStream(this, fd, mBuffer, mStreamEnd);
+     if (!inStream)  return NS_ERROR_OUT_OF_MEMORY;
+     
+-    NS_ADDREF(*inputStream = inStream);
++    *inputStream = inStream;
+     return NS_OK;
+ }
+ 
+@@ -426,7 +418,7 @@ nsDiskCacheStreamIO::GetOutputStream(PRU
+     mOutStream = new nsDiskCacheOutputStream(this);
+     if (!mOutStream)  return NS_ERROR_OUT_OF_MEMORY;
+     
+-    NS_ADDREF(*outputStream = mOutStream);
++    *outputStream = mOutStream;
+     return NS_OK;
+ }
+ 
+diff --git a/netwerk/cache/src/nsDiskCacheStreams.h b/netwerk/cache/src/nsDiskCacheStreams.h
+--- a/netwerk/cache/src/nsDiskCacheStreams.h
++++ b/netwerk/cache/src/nsDiskCacheStreams.h
+@@ -55,7 +55,7 @@ class nsDiskCacheOutputStream;
+ class nsDiskCacheOutputStream;
+ class nsDiskCacheDevice;
+ 
+-class nsDiskCacheStreamIO : public nsISupports {
++class nsDiskCacheStreamIO : public XPCOMGCFinalizedObject, public nsISupports {
+ public:
+              nsDiskCacheStreamIO(nsDiskCacheBinding *   binding);
+     virtual ~nsDiskCacheStreamIO();
+@@ -84,9 +84,7 @@ public:
+                     NS_ASSERTION(mInStreamCount >= 0, "mInStreamCount has gone negative");
+                 }
+ 
+-    // GCC 2.95.2 requires this to be defined, although we never call it.
+-    // and OS/2 requires that it not be private
+-    nsDiskCacheStreamIO() { NS_NOTREACHED("oops"); }
++    nsresult    Flush();
+ private:
+ 
+ 
+@@ -96,7 +94,6 @@ private:
+     nsresult    FlushBufferToFile();
+     void        UpdateFileSize();
+     void        DeleteBuffer();
+-    nsresult    Flush();
+ 
+ 
+     nsDiskCacheBinding *        mBinding;       // not an owning reference
 diff --git a/netwerk/dns/src/nsDNSService2.cpp b/netwerk/dns/src/nsDNSService2.cpp
 --- a/netwerk/dns/src/nsDNSService2.cpp
 +++ b/netwerk/dns/src/nsDNSService2.cpp
 @@ -64,7 +64,7 @@ static const char kPrefDisableIPv6[]    
  
  //-----------------------------------------------------------------------------
  
 -class nsDNSRecord : public nsIDNSRecord
 +class nsDNSRecord : public XPCOMGCFinalizedObject, public nsIDNSRecord
  {
  public:
      NS_DECL_ISUPPORTS
-@@ -178,7 +178,8 @@ nsDNSRecord::Rewind()
+@@ -195,8 +195,9 @@ nsDNSRecord::Rewind()
  
  //-----------------------------------------------------------------------------
  
 -class nsDNSAsyncRequest : public nsResolveHostCallback
 +class nsDNSAsyncRequest : public XPCOMGCFinalizedObject
+                         , public nsICancelable
 +                        , public nsResolveHostCallback
-                         , public nsICancelable
  {
  public:
-@@ -214,7 +215,7 @@ nsDNSAsyncRequest::OnLookupComplete(nsHo
+     NS_DECL_ISUPPORTS
+@@ -231,7 +232,7 @@ nsDNSAsyncRequest::OnLookupComplete(nsHo
      // need to have an owning ref when we issue the callback to enable
      // the caller to be able to addref/release multiple times without
      // destroying the record prematurely.
 -    nsCOMPtr<nsIDNSRecord> rec;
 +    nsIDNSRecord* rec = nsnull;
      if (NS_SUCCEEDED(status)) {
          NS_ASSERTION(hostRecord, "no host record");
          rec = new nsDNSRecord(hostRecord);
-@@ -306,7 +307,7 @@ nsDNSService::Init()
+@@ -323,7 +324,7 @@ nsDNSService::Init()
      nsAdoptingCString ipv4OnlyDomains;
  
      // read prefs
 -    nsCOMPtr<nsIPrefBranch2> prefs = do_GetService(NS_PREFSERVICE_CONTRACTID);
 +    nsIPrefBranch2* prefs = do_GetService(NS_PREFSERVICE_CONTRACTID);
      if (prefs) {
          PRInt32 val;
          if (NS_SUCCEEDED(prefs->GetIntPref(kPrefDnsCacheEntries, &val)))
-@@ -337,14 +338,14 @@ nsDNSService::Init()
+@@ -354,14 +355,14 @@ nsDNSService::Init()
  
      // we have to null out mIDN since we might be getting re-initialized
      // as a result of a pref change.
 -    nsCOMPtr<nsIIDNService> idn;
 +    nsIIDNService* idn = nsnull;
      if (enableIDN)
          idn = do_GetService(NS_IDNSERVICE_CONTRACTID);
  
@@ -51,118 +1487,115 @@ diff --git a/netwerk/dns/src/nsDNSServic
 +    nsHostResolver* res = nsnull;
      nsresult rv = nsHostResolver::Create(maxCacheEntries,
                                           maxCacheLifetime,
 -                                         getter_AddRefs(res));
 +                                         &res);
      if (NS_SUCCEEDED(rv)) {
          // now, set all of our member variables while holding the lock
          nsAutoLock lock(mLock);
-@@ -360,7 +361,7 @@ NS_IMETHODIMP
+@@ -377,7 +378,7 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  nsDNSService::Shutdown()
  {
 -    nsRefPtr<nsHostResolver> res;
 +    nsHostResolver* res = nsnull;
      {
          nsAutoLock lock(mLock);
          res = mResolver;
-@@ -380,8 +381,8 @@ nsDNSService::AsyncResolve(const nsACStr
+@@ -397,8 +398,8 @@ nsDNSService::AsyncResolve(const nsACStr
  {
      // grab reference to global host resolver and IDN service.  beware
      // simultaneous shutdown!!
 -    nsRefPtr<nsHostResolver> res;
 -    nsCOMPtr<nsIIDNService> idn;
 +    nsHostResolver* res = nsnull;
 +    nsIIDNService* idn = nsnull;
      {
          nsAutoLock lock(mLock);
          res = mResolver;
-@@ -398,13 +399,13 @@ nsDNSService::AsyncResolve(const nsACStr
+@@ -415,13 +416,13 @@ nsDNSService::AsyncResolve(const nsACStr
              hostPtr = &hostACE;
      }
  
 -    nsCOMPtr<nsIDNSListener> listenerProxy;
 +    nsIDNSListener* listenerProxy = nsnull;
      if (target) {
          rv = NS_GetProxyForObject(target,
                                    NS_GET_IID(nsIDNSListener),
                                    listener,
                                    NS_PROXY_ASYNC | NS_PROXY_ALWAYS,
 -                                  getter_AddRefs(listenerProxy));
 +                                  (void**)&listenerProxy);
          if (NS_FAILED(rv)) return rv;
          listener = listenerProxy;
      }
-@@ -415,10 +416,9 @@ nsDNSService::AsyncResolve(const nsACStr
+@@ -432,10 +433,9 @@ nsDNSService::AsyncResolve(const nsACStr
              new nsDNSAsyncRequest(res, *hostPtr, listener, flags, af);
      if (!req)
          return NS_ERROR_OUT_OF_MEMORY;
 -    NS_ADDREF(*result = req);
 +    *result = req;
  
      // addref for resolver; will be released when OnLookupComplete is called.
 -    NS_ADDREF(req);
      rv = res->ResolveHost(req->mHost.get(), flags, af, req);
      if (NS_FAILED(rv)) {
          NS_RELEASE(req);
-@@ -434,8 +434,8 @@ nsDNSService::Resolve(const nsACString &
+@@ -451,8 +451,8 @@ nsDNSService::Resolve(const nsACString &
  {
      // grab reference to global host resolver and IDN service.  beware
      // simultaneous shutdown!!
 -    nsRefPtr<nsHostResolver> res;
 -    nsCOMPtr<nsIIDNService> idn;
 +    nsHostResolver* res = nsnull;
 +    nsIIDNService* idn = nsnull;
      {
          nsAutoLock lock(mLock);
          res = mResolver;
-@@ -459,36 +459,36 @@ nsDNSService::Resolve(const nsACString &
+@@ -476,36 +476,36 @@ nsDNSService::Resolve(const nsACString &
      // on the same thread.  so, our mutex needs to be re-entrant.  in other words,
      // we need to use a monitor! ;-)
      //
 -    
 -    PRMonitor *mon = PR_NewMonitor();
 +
 +    PRMonitor *mon = nsAutoMonitor::NewMonitor("nsDNSMonitor");
      if (!mon)
          return NS_ERROR_OUT_OF_MEMORY;
  
 -    PR_EnterMonitor(mon);
 -    nsDNSSyncRequest syncReq(mon);
--
++    {
++        nsAutoMonitor automon(mon);
++        nsDNSSyncRequest syncReq(mon);
+ 
 -    PRUint16 af = GetAFForLookup(*hostPtr);
--
++        PRUint16 af = GetAFForLookup(*hostPtr);
+ 
 -    rv = res->ResolveHost(PromiseFlatCString(*hostPtr).get(), flags, af, &syncReq);
 -    if (NS_SUCCEEDED(rv)) {
 -        // wait for result
 -        while (!syncReq.mDone)
 -            PR_Wait(mon, PR_INTERVAL_NO_TIMEOUT);
--
++        rv = res->ResolveHost(PromiseFlatCString(*hostPtr).get(), flags, af, &syncReq);
++        if (NS_SUCCEEDED(rv)) {
++            // wait for result
++            while (!syncReq.mDone)
++                automon.Wait(PR_INTERVAL_NO_TIMEOUT);
+ 
 -        if (NS_FAILED(syncReq.mStatus))
 -            rv = syncReq.mStatus;
 -        else {
 -            NS_ASSERTION(syncReq.mHostRecord, "no host record");
 -            nsDNSRecord *rec = new nsDNSRecord(syncReq.mHostRecord);
 -            if (!rec)
 -                rv = NS_ERROR_OUT_OF_MEMORY;
 -            else
 -                NS_ADDREF(*result = rec);
-+    {
-+        nsAutoMonitor automon(mon);
-+        nsDNSSyncRequest syncReq(mon);
-+
-+        PRUint16 af = GetAFForLookup(*hostPtr);
-+
-+        rv = res->ResolveHost(PromiseFlatCString(*hostPtr).get(), flags, af, &syncReq);
-+        if (NS_SUCCEEDED(rv)) {
-+            // wait for result
-+            while (!syncReq.mDone)
-+                automon.Wait(PR_INTERVAL_NO_TIMEOUT);
-+
 +            if (NS_FAILED(syncReq.mStatus))
 +                rv = syncReq.mStatus;
 +            else {
 +                NS_ASSERTION(syncReq.mHostRecord, "no host record");
 +                nsDNSRecord *rec = new nsDNSRecord(syncReq.mHostRecord);
 +                if (!rec)
 +                    rv = NS_ERROR_OUT_OF_MEMORY;
 +                else
@@ -172,16 +1605,239 @@ diff --git a/netwerk/dns/src/nsDNSServic
      }
 -
 -    PR_ExitMonitor(mon);
 -    PR_DestroyMonitor(mon);
 +    nsAutoMonitor::DestroyMonitor(mon);
      return rv;
  }
  
+diff --git a/netwerk/dns/src/nsHostResolver.cpp b/netwerk/dns/src/nsHostResolver.cpp
+--- a/netwerk/dns/src/nsHostResolver.cpp
++++ b/netwerk/dns/src/nsHostResolver.cpp
+@@ -419,7 +419,7 @@ nsHostResolver::ResolveHost(const char  
+ 
+     // if result is set inside the lock, then we need to issue the
+     // callback before returning.
+-    nsRefPtr<nsHostRecord> result;
++    nsHostRecord* result = nsnull;
+     nsresult status = NS_OK, rv = NS_OK;
+     {
+         nsAutoLock lock(mLock);
+@@ -494,7 +494,7 @@ nsHostResolver::DetachCallback(const cha
+                                nsResolveHostCallback *callback,
+                                nsresult               status)
+ {
+-    nsRefPtr<nsHostRecord> rec;
++    nsHostRecord* rec = nsnull;
+     {
+         nsAutoLock lock(mLock);
+ 
+@@ -543,7 +543,6 @@ nsHostResolver::IssueLookup(nsHostRecord
+     }
+     else if (mThreadCount < MAX_THREADS) {
+         // dispatch new worker thread
+-        NS_ADDREF_THIS(); // owning reference passed to thread
+         mThreadCount++;
+         PRThread *thr = PR_CreateThread(PR_SYSTEM_THREAD,
+                                         ThreadFunc,
+@@ -634,7 +633,6 @@ nsHostResolver::OnLookupComplete(nsHostR
+         if (rec->addr_info && !mShutdown) {
+             // add to mEvictionQ
+             PR_APPEND_LINK(rec, &mEvictionQ);
+-            NS_ADDREF(rec);
+             if (mEvictionQSize < mMaxCacheEntries)
+                 mEvictionQSize++;
+             else {
+@@ -691,7 +689,10 @@ nsHostResolver::ThreadFunc(void *arg)
+ 
+         // convert error code to nsresult.
+         nsresult status = ai ? NS_OK : NS_ERROR_UNKNOWN_HOST;
++        NS_BeginRequest();
+         resolver->OnLookupComplete(rec, status, ai);
++        NS_EndRequest();
++
+         LOG(("lookup complete for %s ...\n", rec->host));
+     }
+     NS_RELEASE(resolver);
+@@ -714,7 +715,6 @@ nsHostResolver::Create(PRUint32         
+                                              maxCacheLifetime);
+     if (!res)
+         return NS_ERROR_OUT_OF_MEMORY;
+-    NS_ADDREF(res);
+ 
+     nsresult rv = res->Init();
+     if (NS_FAILED(rv))
+diff --git a/netwerk/dns/src/nsHostResolver.h b/netwerk/dns/src/nsHostResolver.h
+--- a/netwerk/dns/src/nsHostResolver.h
++++ b/netwerk/dns/src/nsHostResolver.h
+@@ -63,13 +63,21 @@ struct nsHostKey
+ /**
+  * nsHostRecord - ref counted object type stored in host resolver cache.
+  */
+-class nsHostRecord : public XPCOMGCFinalizedObject, public PRCList, public nsHostKey
++class nsHostRecord : public XPCOMGCFinalizedObject
++                   , public MMgc::GCFinalizable
++                   , public PRCList
++                   , public nsHostKey
+ {
+ public:
+     NS_DECL_REFCOUNTED_THREADSAFE(nsHostRecord)
+ 
+     /* instantiates a new host record */
+     static nsresult Create(const nsHostKey *key, nsHostRecord **record);
++
++    static void* operator new(size_t size, size_t extra)
++    {
++      return MMgc::GCFinalizedObject::operator new(size + extra, NS_GetGC());
++    }
+ 
+     /* a fully resolved host record has either a non-null |addr_info| or |addr|
+      * field.  if |addr_info| is null, it implies that the |host| is an IP
+diff --git a/netwerk/protocol/http/src/nsHttpAuthCache.cpp b/netwerk/protocol/http/src/nsHttpAuthCache.cpp
+--- a/netwerk/protocol/http/src/nsHttpAuthCache.cpp
++++ b/netwerk/protocol/http/src/nsHttpAuthCache.cpp
+@@ -79,8 +79,6 @@ nsHttpAuthCache::nsHttpAuthCache()
+ 
+ nsHttpAuthCache::~nsHttpAuthCache()
+ {
+-    if (mDB)
+-        ClearAll();
+ }
+ 
+ nsresult
+@@ -225,19 +223,20 @@ void *
+ void *
+ nsHttpAuthCache::AllocTable(void *self, PRSize size)
+ {
+-    return malloc(size);
++    return NS_GetGC()->Alloc(size, MMgc::GC::kContainsPointers);
+ }
+ 
+ void
+ nsHttpAuthCache::FreeTable(void *self, void *item)
+ {
+-    free(item);
++    // do nothing!
+ }
+ 
+ PLHashEntry *
+ nsHttpAuthCache::AllocEntry(void *self, const void *key)
+ {
+-    return (PLHashEntry *) malloc(sizeof(PLHashEntry));
++    return static_cast<PLHashEntry*>
++        (NS_GetGC()->Alloc(sizeof(PLHashEntry), MMgc::GC::kContainsPointers));
+ }
+ 
+ void
+@@ -250,14 +249,11 @@ nsHttpAuthCache::FreeEntry(void *self, P
+         NS_NOTREACHED("should never happen");
+     }
+     else if (flag == HT_FREE_ENTRY) {
+-        // three wonderful flavors of freeing memory ;-)
+-        delete (nsHttpAuthNode *) he->value;
+         nsCRT::free((char *) he->key);
+-        free(he);
+     }
+ }
+ 
+-PLHashAllocOps nsHttpAuthCache::gHashAllocOps =
++const PLHashAllocOps nsHttpAuthCache::gHashAllocOps =
+ {
+     nsHttpAuthCache::AllocTable,
+     nsHttpAuthCache::FreeTable,
+@@ -444,21 +440,6 @@ nsHttpAuthEntry::Set(const char *path,
+ // nsHttpAuthNode
+ //-----------------------------------------------------------------------------
+ 
+-nsHttpAuthNode::nsHttpAuthNode()
+-{
+-    LOG(("Creating nsHttpAuthNode @%x\n", this));
+-}
+-
+-nsHttpAuthNode::~nsHttpAuthNode()
+-{
+-    LOG(("Destroying nsHttpAuthNode @%x\n", this));
+-
+-    PRInt32 i;
+-    for (i=0; i<mList.Count(); ++i)
+-        delete (nsHttpAuthEntry *) mList[i];
+-    mList.Clear();
+-}
+-
+ nsHttpAuthEntry *
+ nsHttpAuthNode::LookupEntryByPath(const char *path)
+ {
+@@ -540,6 +521,5 @@ nsHttpAuthNode::ClearAuthEntry(const cha
+     nsHttpAuthEntry *entry = LookupEntryByRealm(realm);
+     if (entry) {
+         mList.RemoveElement(entry); // double search OK
+-        delete entry;
+     }
+ }
+diff --git a/netwerk/protocol/http/src/nsHttpAuthCache.h b/netwerk/protocol/http/src/nsHttpAuthCache.h
+--- a/netwerk/protocol/http/src/nsHttpAuthCache.h
++++ b/netwerk/protocol/http/src/nsHttpAuthCache.h
+@@ -104,7 +104,7 @@ private:
+ // nsHttpAuthEntry
+ //-----------------------------------------------------------------------------
+ 
+-class nsHttpAuthEntry
++class nsHttpAuthEntry : public XPCOMGCFinalizedObject
+ {
+ public:
+     const char *Realm()       const { return mRealm; }
+@@ -161,11 +161,10 @@ private:
+ // nsHttpAuthNode
+ //-----------------------------------------------------------------------------
+ 
+-class nsHttpAuthNode
++class nsHttpAuthNode : public XPCOMGCObject
+ {
+ private:
+-    nsHttpAuthNode();
+-   ~nsHttpAuthNode();
++    nsHttpAuthNode() { }
+ 
+     // path can be null, in which case we'll search for an entry
+     // with a null path.
+@@ -187,7 +186,7 @@ private:
+     PRUint32 EntryCount() { return (PRUint32) mList.Count(); }
+ 
+ private:
+-    nsVoidArray mList; // list of nsHttpAuthEntry objects
++    nsVoidArrayBase<GCAllocator> mList; // list of nsHttpAuthEntry objects
+ 
+     friend class nsHttpAuthCache;
+ };
+@@ -258,7 +257,7 @@ private:
+     static PLHashEntry* PR_CALLBACK AllocEntry(void *, const void *key);
+     static void         PR_CALLBACK FreeEntry(void *, PLHashEntry *he, PRUintn flag);
+ 
+-    static PLHashAllocOps gHashAllocOps;
++    static const PLHashAllocOps gHashAllocOps;
+     
+ private:
+     PLHashTable *mDB; // "host:port" --> nsHttpAuthNode
+diff --git a/netwerk/protocol/http/src/nsHttpConnection.h b/netwerk/protocol/http/src/nsHttpConnection.h
+--- a/netwerk/protocol/http/src/nsHttpConnection.h
++++ b/netwerk/protocol/http/src/nsHttpConnection.h
+@@ -60,9 +60,10 @@
+ // accessed from any other thread.
+ //-----------------------------------------------------------------------------
+ 
+-class nsHttpConnection : public nsAHttpSegmentReader
++class nsHttpConnection : public XPCOMGCFinalizedObject
++                       , public nsIInputStreamCallback
++                       , public nsAHttpSegmentReader
+                        , public nsAHttpSegmentWriter
+-                       , public nsIInputStreamCallback
+                        , public nsIOutputStreamCallback
+                        , public nsITransportEventSink
+                        , public nsIInterfaceRequestor
 diff --git a/netwerk/protocol/http/src/nsHttpConnectionInfo.h b/netwerk/protocol/http/src/nsHttpConnectionInfo.h
 --- a/netwerk/protocol/http/src/nsHttpConnectionInfo.h
 +++ b/netwerk/protocol/http/src/nsHttpConnectionInfo.h
 @@ -51,41 +51,20 @@
  // nsHttpConnectionInfo - holds the properties of a connection
  //-----------------------------------------------------------------------------
  
 -class nsHttpConnectionInfo
@@ -232,8 +1888,167 @@ diff --git a/netwerk/protocol/http/src/n
 +   ~nsHttpConnectionInfo()
 +    {
 +        NS_NOTREACHED("Don't destruct me");
 +    }
 +
      nsCString              mHashKey;
      nsCString              mHost;
      PRInt32                mPort;
+diff --git a/netwerk/protocol/http/src/nsHttpConnectionMgr.h b/netwerk/protocol/http/src/nsHttpConnectionMgr.h
+--- a/netwerk/protocol/http/src/nsHttpConnectionMgr.h
++++ b/netwerk/protocol/http/src/nsHttpConnectionMgr.h
+@@ -86,16 +86,6 @@ public:
+     //-------------------------------------------------------------------------
+     // NOTE: functions below may be called on any thread.
+     //-------------------------------------------------------------------------
+-
+-    void AddRef()
+-    {
+-	NS_WARNING("Don't call me");
+-    }
+-
+-    void Release()
+-    {
+-	NS_WARNING("Don't call me");
+-    }
+ 
+     // adds a transaction to the list of managed transactions.
+     nsresult AddTransaction(nsHttpTransaction *, PRInt32 priority);
+diff --git a/netwerk/protocol/http/src/nsHttpHandler.cpp b/netwerk/protocol/http/src/nsHttpHandler.cpp
+--- a/netwerk/protocol/http/src/nsHttpHandler.cpp
++++ b/netwerk/protocol/http/src/nsHttpHandler.cpp
+@@ -192,12 +192,6 @@ nsHttpHandler::~nsHttpHandler()
+     // it is taken care of in xpcom shutdown event in the Observe method.
+ 
+     LOG(("Deleting nsHttpHandler [this=%x]\n", this));
+-
+-    // make sure the connection manager is shutdown
+-    if (mConnMgr) {
+-        mConnMgr->Shutdown();
+-        NS_RELEASE(mConnMgr);
+-    }
+ 
+     nsHttp::DestroyAtomTable();
+ 
+diff --git a/netwerk/test/httpserver/Makefile.in b/netwerk/test/httpserver/Makefile.in
+--- a/netwerk/test/httpserver/Makefile.in
++++ b/netwerk/test/httpserver/Makefile.in
+@@ -43,7 +43,7 @@ VPATH		= @srcdir@
+ 
+ include $(DEPTH)/config/autoconf.mk
+ 
+-MODULE          = test_necko
++MODULE          = test_necko_httpserver
+ 
+ EXTRA_COMPONENTS = \
+                    httpd.js \
+diff --git a/netwerk/test/unit/test_authentication.js b/netwerk/test/unit/test_authentication.js
+--- a/netwerk/test/unit/test_authentication.js
++++ b/netwerk/test/unit/test_authentication.js
+@@ -276,6 +276,8 @@ function run_test() {
+ }
+ 
+ function test_noauth() {
++  print('test_noauth\n');
++
+   var chan = makeChan("http://localhost:4444/auth");
+ 
+   listener.expectedCode = 401; // Unauthorized
+@@ -285,6 +287,8 @@ function test_noauth() {
+ }
+ 
+ function test_returnfalse1() {
++  print('test_returnfalse1\n');
++
+   var chan = makeChan("http://localhost:4444/auth");
+ 
+   chan.notificationCallbacks = new Requestor(FLAG_RETURN_FALSE, 1);
+@@ -295,6 +299,8 @@ function test_returnfalse1() {
+ }
+ 
+ function test_wrongpw1() {
++  print('test_wrongpw1\n');
++
+   var chan = makeChan("http://localhost:4444/auth");
+ 
+   chan.notificationCallbacks = new Requestor(FLAG_WRONG_PASSWORD, 1);
+@@ -305,6 +311,8 @@ function test_wrongpw1() {
+ }
+ 
+ function test_prompt1() {
++  print('test_prompt1\n');
++
+   var chan = makeChan("http://localhost:4444/auth");
+ 
+   chan.notificationCallbacks = new Requestor(0, 1);
+@@ -315,6 +323,8 @@ function test_prompt1() {
+ }
+ 
+ function test_returnfalse2() {
++  print('test_returnfalse2\n');
++
+   var chan = makeChan("http://localhost:4444/auth");
+ 
+   chan.notificationCallbacks = new Requestor(FLAG_RETURN_FALSE, 2);
+@@ -325,6 +335,8 @@ function test_returnfalse2() {
+ }
+ 
+ function test_wrongpw2() {
++  print('test_wrongpw2\n');
++
+   var chan = makeChan("http://localhost:4444/auth");
+ 
+   chan.notificationCallbacks = new Requestor(FLAG_WRONG_PASSWORD, 2);
+@@ -335,6 +347,8 @@ function test_wrongpw2() {
+ }
+ 
+ function test_prompt2() {
++  print('test_prompt2\n');
++
+   var chan = makeChan("http://localhost:4444/auth");
+ 
+   chan.notificationCallbacks = new Requestor(0, 2);
+@@ -345,6 +359,8 @@ function test_prompt2() {
+ }
+ 
+ function test_ntlm() {
++  print('test_ntlm\n');
++
+   var chan = makeChan("http://localhost:4444/auth/ntlm/simple");
+ 
+   chan.notificationCallbacks = new Requestor(FLAG_RETURN_FALSE, 2);
+@@ -355,6 +371,8 @@ function test_ntlm() {
+ }
+ 
+ function test_auth() {
++  print('test_auth\n');
++
+   var chan = makeChan("http://localhost:4444/auth/realm");
+ 
+   chan.notificationCallbacks = new RealmTestRequestor();
+@@ -365,6 +383,8 @@ function test_auth() {
+ }
+ 
+ function test_digest_noauth() {
++  print('test_digest_noauth\n');
++
+   var chan = makeChan("http://localhost:4444/auth/digest");
+ 
+   //chan.notificationCallbacks = new Requestor(FLAG_RETURN_FALSE, 2);
+@@ -375,6 +395,8 @@ function test_digest_noauth() {
+ }
+ 
+ function test_digest() {
++  print('test_digest\n');
++
+   var chan = makeChan("http://localhost:4444/auth/digest");
+ 
+   chan.notificationCallbacks = new Requestor(0, 2);
+@@ -385,6 +407,8 @@ function test_digest() {
+ }
+ 
+ function test_digest_bogus_user() {
++  print('test_digest_bogus_user\n');
++
+   var chan = makeChan("http://localhost:4444/auth/digest");
+   chan.notificationCallbacks =  new Requestor(0, 2, "foo\nbar");
+   listener.expectedCode = 401; // unauthorized
deleted file mode 100644
--- a/necko-deadlocks2
+++ /dev/null
@@ -1,580 +0,0 @@
-diff --git a/netwerk/cache/src/nsCacheDevice.h b/netwerk/cache/src/nsCacheDevice.h
---- a/netwerk/cache/src/nsCacheDevice.h
-+++ b/netwerk/cache/src/nsCacheDevice.h
-@@ -55,7 +55,7 @@ class nsIOutputStream;
- /******************************************************************************
- * nsCacheDevice
- *******************************************************************************/
--class nsCacheDevice {
-+class nsCacheDevice : public XPCOMGCFinalizedObject, MMgc::GCFinalizable {
- public:
-     nsCacheDevice() { MOZ_COUNT_CTOR(nsCacheDevice); }
-     virtual ~nsCacheDevice() { MOZ_COUNT_DTOR(nsCacheDevice); }
-diff --git a/netwerk/cache/src/nsCacheEntry.cpp b/netwerk/cache/src/nsCacheEntry.cpp
---- a/netwerk/cache/src/nsCacheEntry.cpp
-+++ b/netwerk/cache/src/nsCacheEntry.cpp
-@@ -80,9 +80,6 @@ nsCacheEntry::~nsCacheEntry()
- {
-     MOZ_COUNT_DTOR(nsCacheEntry);
-     delete mKey;
--    
--    if (mData)
--        nsCacheService::ReleaseObject_Locked(mData, mThread);
- }
- 
- 
-@@ -128,21 +125,6 @@ nsCacheEntry::TouchData()
- {
-     mLastModified = SecondsFromPRTime(PR_Now());
-     MarkDataDirty();
--}
--
--
--void
--nsCacheEntry::SetData(nsISupports * data)
--{
--    if (mData) {
--        nsCacheService::ReleaseObject_Locked(mData, mThread);
--        mData = nsnull;
--    }
--
--    if (data) {
--        NS_ADDREF(mData = data);
--        mThread = do_GetCurrentThread();
--    }
- }
- 
- 
-@@ -225,7 +207,7 @@ nsCacheEntry::CreateDescriptor(nsCacheRe
- 
-     PR_APPEND_LINK(descriptor, &mDescriptorQ);
- 
--    NS_ADDREF(*result = descriptor);
-+    *result = descriptor;
-     return NS_OK;
- }
- 
-diff --git a/netwerk/cache/src/nsCacheEntry.h b/netwerk/cache/src/nsCacheEntry.h
---- a/netwerk/cache/src/nsCacheEntry.h
-+++ b/netwerk/cache/src/nsCacheEntry.h
-@@ -63,7 +63,9 @@ class nsCacheEntryDescriptor;
- /******************************************************************************
- * nsCacheEntry
- *******************************************************************************/
--class nsCacheEntry : public PRCList
-+class nsCacheEntry : public XPCOMGCFinalizedObject
-+                   , public MMgc::GCFinalizable
-+                   , public PRCList
- {
- public:
- 
-@@ -72,6 +74,11 @@ public:
-                  nsCacheStoragePolicy storagePolicy);
-     ~nsCacheEntry();
- 
-+    // it's ok to explicitly delete this
-+    static void operator delete(void* obj)
-+    {
-+        return XPCOMGCFinalizedObject::operator delete(obj);
-+    }
- 
-     static nsresult  Create( const char *          key,
-                              PRBool                streamBased,
-@@ -104,7 +111,7 @@ public:
-      * Data accessors
-      */
-     nsISupports *Data()                           { return mData; }
--    void         SetData( nsISupports * data);
-+    void         SetData(nsISupports * data)      { mData = data; }
- 
-     PRUint32 DataSize()                           { return mDataSize; }
-     void     SetDataSize( PRUint32  size)         { mDataSize = size; }
-@@ -244,8 +251,7 @@ private:
-     PRUint32                mDataSize;       // 4
-     nsCacheDevice *         mCacheDevice;    // 4
-     nsCOMPtr<nsISupports>   mSecurityInfo;   // 
--    nsISupports *           mData;           // strong ref
--    nsCOMPtr<nsIThread>     mThread;
-+    nsCOMPtr<nsISupports>   mData;
-     nsCacheMetaData         mMetaData;       // 4
-     PRCList                 mRequestQ;       // 8
-     PRCList                 mDescriptorQ;    // 8
-@@ -255,7 +261,7 @@ private:
- /******************************************************************************
- * nsCacheEntryInfo
- *******************************************************************************/
--class nsCacheEntryInfo : public nsICacheEntryInfo {
-+class nsCacheEntryInfo : public XPCOMGCFinalizedObject, public nsICacheEntryInfo {
- public:
-     NS_DECL_ISUPPORTS
-     NS_DECL_NSICACHEENTRYINFO
-diff --git a/netwerk/cache/src/nsCacheEntryDescriptor.h b/netwerk/cache/src/nsCacheEntryDescriptor.h
---- a/netwerk/cache/src/nsCacheEntryDescriptor.h
-+++ b/netwerk/cache/src/nsCacheEntryDescriptor.h
-@@ -51,6 +51,7 @@
- * nsCacheEntryDescriptor
- *******************************************************************************/
- class nsCacheEntryDescriptor :
-+    public XPCOMGCFinalizedObject,
-     public PRCList,
-     public nsICacheEntryDescriptor
- {
-@@ -82,7 +83,7 @@ private:
-       * The input stream wrapper references the descriptor, but the descriptor
-       * doesn't need any references to the stream wrapper.
-       *************************************************************************/
--     class nsInputStreamWrapper : public nsIInputStream {
-+     class nsInputStreamWrapper : public XPCOMGCFinalizedObject, public nsIInputStream {
-      private:
-          nsCacheEntryDescriptor    * mDescriptor;
-          nsCOMPtr<nsIInputStream>    mInput;
-@@ -97,7 +98,6 @@ private:
-              , mStartOffset(off)
-              , mInitialized(PR_FALSE)
-          {
--             NS_ADDREF(mDescriptor);
-          }
-          virtual ~nsInputStreamWrapper()
-          {
-@@ -117,7 +117,7 @@ private:
-       * The output stream wrapper references the descriptor, but the descriptor
-       * doesn't need any references to the stream wrapper.
-       *************************************************************************/
--     class nsOutputStreamWrapper : public nsIOutputStream {
-+     class nsOutputStreamWrapper : public XPCOMGCFinalizedObject, public nsIOutputStream {
-      private:
-          nsCacheEntryDescriptor *    mDescriptor;
-          nsCOMPtr<nsIOutputStream>   mOutput;
-@@ -132,7 +132,6 @@ private:
-              , mStartOffset(off)
-              , mInitialized(PR_FALSE)
-          {
--             NS_ADDREF(mDescriptor); // owning ref
-          }
-          virtual ~nsOutputStreamWrapper()
-          { 
-diff --git a/netwerk/cache/src/nsCacheRequest.h b/netwerk/cache/src/nsCacheRequest.h
---- a/netwerk/cache/src/nsCacheRequest.h
-+++ b/netwerk/cache/src/nsCacheRequest.h
-@@ -49,7 +49,9 @@
- #include "nsCacheService.h"
- 
- 
--class nsCacheRequest : public PRCList
-+class nsCacheRequest : public XPCOMGCFinalizedObject
-+                     , public MMgc::GCFinalizable
-+                     , public PRCList
- {
- private:
-     friend class nsCacheService;
-@@ -74,7 +76,6 @@ private:
-         if (session->WillDoomEntriesIfExpired())  MarkDoomEntriesIfExpired();
-         if (blockingMode == nsICache::BLOCKING)    MarkBlockingMode();
-         MarkWaitingForValidation();
--        NS_IF_ADDREF(mListener);
-     }
-     
-     ~nsCacheRequest()
-@@ -84,11 +85,13 @@ private:
-         if (mLock)    PR_DestroyLock(mLock);
-         if (mCondVar) PR_DestroyCondVar(mCondVar);
-         NS_ASSERTION(PR_CLIST_IS_EMPTY(this), "request still on a list");
--
--        if (mListener)
--            nsCacheService::ReleaseObject_Locked(mListener, mThread);
--    }
--    
-+    }
-+
-+    static void operator delete(void *obj)
-+    {
-+        NS_GetGC()->Free(obj);
-+    }
-+
-     /**
-      * Simple Accessors
-      */
-diff --git a/netwerk/cache/src/nsCacheService.cpp b/netwerk/cache/src/nsCacheService.cpp
---- a/netwerk/cache/src/nsCacheService.cpp
-+++ b/netwerk/cache/src/nsCacheService.cpp
-@@ -92,7 +92,7 @@
- #define MEMORY_CACHE_MAX_ENTRY_SIZE_PREF "browser.cache.memory.max_entry_size"
- 
- 
--class nsCacheProfilePrefObserver : public nsIObserver
-+class nsCacheProfilePrefObserver : public XPCOMGCFinalizedObject, public nsIObserver
- {
- public:
-     NS_DECL_ISUPPORTS
-@@ -150,7 +150,7 @@ nsCacheProfilePrefObserver::Install()
-     nsresult rv, rv2 = NS_OK;
-     
-     // install profile-change observer
--    nsCOMPtr<nsIObserverService> observerService = do_GetService("@mozilla.org/observer-service;1", &rv);
-+    nsIObserverService* observerService = do_GetService("@mozilla.org/observer-service;1", &rv);
-     if (NS_FAILED(rv)) return rv;
-     NS_ENSURE_ARG(observerService);
-     
-@@ -167,7 +167,7 @@ nsCacheProfilePrefObserver::Install()
-     
-     
-     // install preferences observer
--    nsCOMPtr<nsIPrefBranch2> branch = do_GetService(NS_PREFSERVICE_CONTRACTID);
-+    nsIPrefBranch2* branch = do_GetService(NS_PREFSERVICE_CONTRACTID);
-     if (!branch) return NS_ERROR_FAILURE;
- 
-     char * prefList[] = { 
-@@ -194,9 +194,9 @@ nsCacheProfilePrefObserver::Install()
-     //     In that case, we detect the presence of a profile by the existence
-     //     of the NS_APP_USER_PROFILE_50_DIR directory.
- 
--    nsCOMPtr<nsIFile>  directory;
-+    nsIFile*  directory = nsnull;
-     rv = NS_GetSpecialDirectory(NS_APP_USER_PROFILE_50_DIR,
--                                getter_AddRefs(directory));
-+                                &directory);
-     if (NS_SUCCEEDED(rv)) {
-         mHaveProfile = PR_TRUE;
-     }
-@@ -211,7 +211,7 @@ nsCacheProfilePrefObserver::Remove()
- nsCacheProfilePrefObserver::Remove()
- {
-     // remove Observer Service observers
--    nsCOMPtr<nsIObserverService> obs =
-+    nsIObserverService* obs =
-             do_GetService("@mozilla.org/observer-service;1");
-     if (obs) {
-         obs->RemoveObserver(this, "profile-before-change");
-@@ -220,7 +220,7 @@ nsCacheProfilePrefObserver::Remove()
-     }
- 
-     // remove Pref Service observers
--    nsCOMPtr<nsIPrefBranch2> prefs =
-+    nsIPrefBranch2* prefs =
-            do_GetService(NS_PREFSERVICE_CONTRACTID);
-     if (prefs) {
-         // remove Disk cache pref observers
-@@ -265,7 +265,7 @@ nsCacheProfilePrefObserver::Observe(nsIS
-     } else if (!strcmp("profile-after-change", topic)) {
-         // profile after change
-         mHaveProfile = PR_TRUE;
--        nsCOMPtr<nsIPrefBranch> branch = do_GetService(NS_PREFSERVICE_CONTRACTID);
-+        nsIPrefBranch* branch = do_GetService(NS_PREFSERVICE_CONTRACTID);
-         ReadPrefs(branch);
-         nsCacheService::OnProfileChanged();
-     
-@@ -274,7 +274,7 @@ nsCacheProfilePrefObserver::Observe(nsIS
-         // ignore pref changes until we're done switch profiles
-         if (!mHaveProfile)  return NS_OK;
- 
--        nsCOMPtr<nsIPrefBranch> branch = do_QueryInterface(subject, &rv);
-+        nsIPrefBranch* branch = do_QueryInterface(subject, &rv);
-         if (NS_FAILED(rv))  return rv;
- 
- #ifdef NECKO_DISK_CACHE
-@@ -366,18 +366,18 @@ nsCacheProfilePrefObserver::ReadPrefs(ns
-                                    getter_AddRefs(mDiskCacheParentDirectory));
-     
-     if (!mDiskCacheParentDirectory) {
--        nsCOMPtr<nsIFile>  directory;
-+        nsIFile*  directory = nsnull;
- 
-         // try to get the disk cache parent directory
-         rv = NS_GetSpecialDirectory(NS_APP_CACHE_PARENT_DIR,
--                                    getter_AddRefs(directory));
-+                                    &directory);
-         if (NS_FAILED(rv)) {
-             // try to get the profile directory (there may not be a profile yet)
--            nsCOMPtr<nsIFile> profDir;
-+            nsIFile* profDir = nsnull;
-             NS_GetSpecialDirectory(NS_APP_USER_PROFILE_50_DIR,
--                                   getter_AddRefs(profDir));
-+                                   &profDir);
-             NS_GetSpecialDirectory(NS_APP_USER_PROFILE_LOCAL_50_DIR,
--                                   getter_AddRefs(directory));
-+                                   &directory);
-             if (!directory)
-                 directory = profDir;
-             else if (profDir) {
-@@ -398,7 +398,7 @@ nsCacheProfilePrefObserver::ReadPrefs(ns
-         if (!directory) {
-             // use current process directory during development
-             rv = NS_GetSpecialDirectory(NS_XPCOM_CURRENT_PROCESS_DIR,
--                                        getter_AddRefs(directory));
-+                                        &directory);
-         }
- #endif
-         if (directory)
-@@ -420,18 +420,18 @@ nsCacheProfilePrefObserver::ReadPrefs(ns
-                                    getter_AddRefs(mOfflineCacheParentDirectory));
- 
-     if (!mOfflineCacheParentDirectory) {
--        nsCOMPtr<nsIFile>  directory;
-+        nsIFile*  directory = nsnull;
- 
-         // try to get the offline cache parent directory
-         rv = NS_GetSpecialDirectory(NS_APP_CACHE_PARENT_DIR,
--                                    getter_AddRefs(directory));
-+                                    &directory);
-         if (NS_FAILED(rv)) {
-             // try to get the profile directory (there may not be a profile yet)
--            nsCOMPtr<nsIFile> profDir;
-+            nsIFile* profDir = nsnull;
-             NS_GetSpecialDirectory(NS_APP_USER_PROFILE_50_DIR,
--                                   getter_AddRefs(profDir));
-+                                   &profDir);
-             NS_GetSpecialDirectory(NS_APP_USER_PROFILE_LOCAL_50_DIR,
--                                   getter_AddRefs(directory));
-+                                   &directory);
-             if (!directory)
-                 directory = profDir;
-         }
-@@ -439,7 +439,7 @@ nsCacheProfilePrefObserver::ReadPrefs(ns
-         if (!directory) {
-             // use current process directory during development
-             rv = NS_GetSpecialDirectory(NS_XPCOM_CURRENT_PROCESS_DIR,
--                                        getter_AddRefs(directory));
-+                                        &directory);
-         }
- #endif
-         if (directory)
-@@ -624,7 +624,6 @@ nsCacheService::Init()
-     // create profile/preference observer
-     mObserver = new nsCacheProfilePrefObserver();
-     if (!mObserver)  return NS_ERROR_OUT_OF_MEMORY;
--    NS_ADDREF(mObserver);
-     
-     mObserver->Install();
-     mEnableDiskDevice    = mObserver->DiskCacheEnabled();
-@@ -687,7 +686,6 @@ nsCacheService::Create(nsISupports* aOut
-     if (cacheService == nsnull)
-         return NS_ERROR_OUT_OF_MEMORY;
- 
--    NS_ADDREF(cacheService);
-     rv = cacheService->Init();
-     if (NS_SUCCEEDED(rv)) {
-         rv = cacheService->QueryInterface(aIID, aResult);
-@@ -710,7 +708,7 @@ nsCacheService::CreateSession(const char
-     nsCacheSession * session = new nsCacheSession(clientID, storagePolicy, streamBased);
-     if (!session)  return NS_ERROR_OUT_OF_MEMORY;
- 
--    NS_ADDREF(*result = session);
-+    *result = session;
- 
-     return NS_OK;
- }
-@@ -731,17 +729,17 @@ nsCacheService::EvictEntriesForClient(co
- {
-     if (this == nsnull) return NS_ERROR_NOT_AVAILABLE; // XXX eh?
- 
--    nsCOMPtr<nsIObserverService> obsSvc =
-+    nsIObserverService* obsSvc =
-         do_GetService("@mozilla.org/observer-service;1");
-     if (obsSvc) {
-         // Proxy to the UI thread since the observer service isn't thredsafe.
-         // We use an async proxy, since this it's not important whether this
-         // notification happens before or after the actual eviction.
- 
--        nsCOMPtr<nsIObserverService> obsProxy;
-+        nsIObserverService* obsProxy = nsnull;
-         NS_GetProxyForObject(NS_PROXY_TO_MAIN_THREAD,
-                              NS_GET_IID(nsIObserverService), obsSvc,
--                             NS_PROXY_ASYNC, getter_AddRefs(obsProxy));
-+                             NS_PROXY_ASYNC, (void**)&obsProxy);
- 
-         if (obsProxy) {
-             obsProxy->NotifyObservers(this,
-@@ -1239,9 +1237,6 @@ nsCacheService::CreateRequest(nsCacheSes
- 
-     if (!listener)  return NS_OK;  // we're sync, we're done.
- 
--    // get the request's thread
--    (*request)->mThread = do_GetCurrentThread();
--    
-     return NS_OK;
- }
- 
-@@ -1292,7 +1287,7 @@ nsCacheService::NotifyListener(nsCacheRe
-     nsICacheListener *listener = request->mListener;
-     request->mListener = nsnull;
- 
--    nsCOMPtr<nsIRunnable> ev =
-+    nsIRunnable* ev =
-             new nsCacheListenerEvent(listener, descriptor,
-                                      accessGranted, status);
-     if (!ev) {
-diff --git a/netwerk/cache/src/nsDeleteDir.cpp b/netwerk/cache/src/nsDeleteDir.cpp
---- a/netwerk/cache/src/nsDeleteDir.cpp
-+++ b/netwerk/cache/src/nsDeleteDir.cpp
-@@ -40,22 +40,24 @@
- #include "nsIFile.h"
- #include "nsString.h"
- #include "prthread.h"
-+#include "nsXPCOMRequests.h"
- 
- PR_STATIC_CALLBACK(void) DeleteDirThreadFunc(void *arg)
- {
-   nsIFile *dir = static_cast<nsIFile *>(arg);
-+  NS_BeginRequest();
-   dir->Remove(PR_TRUE);
--  NS_RELEASE(dir);
-+  NS_EndRequest();
- }
- 
- nsresult DeleteDir(nsIFile *dirIn, PRBool moveToTrash, PRBool sync)
- {
-   nsresult rv;
--  nsCOMPtr<nsIFile> trash, dir;
-+  nsIFile* trash = nsnull, *dir = nsnull;
- 
-   // Need to make a clone of this since we don't want to modify the input
-   // file object.
--  rv = dirIn->Clone(getter_AddRefs(dir));
-+  rv = dirIn->Clone(&dir);
-   if (NS_FAILED(rv))
-     return rv;
- 
-@@ -65,8 +67,8 @@ nsresult DeleteDir(nsIFile *dirIn, PRBoo
-     if (NS_FAILED(rv))
-       return rv;
- 
--    nsCOMPtr<nsIFile> subDir;
--    rv = trash->Clone(getter_AddRefs(subDir));
-+    nsIFile* subDir = nsnull;
-+    rv = trash->Clone(&subDir);
-     if (NS_FAILED(rv))
-       return rv;
- 
-@@ -85,12 +87,12 @@ nsresult DeleteDir(nsIFile *dirIn, PRBoo
-   else
-   {
-     // we want to pass a clone of the original off to the worker thread.
--    trash.swap(dir);
-+    swap(trash, dir);
-   }
- 
-   // Steal ownership of trash directory; let the thread release it.
-   nsIFile *trashRef = nsnull;
--  trash.swap(trashRef);
-+  swap(trash, trashRef);
- 
-   if (sync)
-   {
-@@ -113,9 +115,9 @@ nsresult DeleteDir(nsIFile *dirIn, PRBoo
-   return NS_OK;
- }
- 
--nsresult GetTrashDir(nsIFile *target, nsCOMPtr<nsIFile> *result)
-+nsresult GetTrashDir(nsIFile *target, nsIFile* *result)
- {
--  nsresult rv = target->Clone(getter_AddRefs(*result));
-+  nsresult rv = target->Clone(&*result);
-   if (NS_FAILED(rv))
-     return rv;
- 
-diff --git a/netwerk/dns/src/nsHostResolver.cpp b/netwerk/dns/src/nsHostResolver.cpp
---- a/netwerk/dns/src/nsHostResolver.cpp
-+++ b/netwerk/dns/src/nsHostResolver.cpp
-@@ -164,7 +164,6 @@ nsHostRecord::Create(const nsHostKey *ke
-         return NS_ERROR_OUT_OF_MEMORY;
- 
-     size_t hostLen = strlen(key->host) + 1;
--    size_t size = hostLen + sizeof(nsHostRecord);
- 
-     nsHostRecord *rec = (nsHostRecord*) MMgc::GCFinalizedObject::operator new(size, NS_GetGC());
-     if (!rec) {
-@@ -419,7 +418,7 @@ nsHostResolver::ResolveHost(const char  
- 
-     // if result is set inside the lock, then we need to issue the
-     // callback before returning.
--    nsRefPtr<nsHostRecord> result;
-+    nsHostRecord* result = nsnull;
-     nsresult status = NS_OK, rv = NS_OK;
-     {
-         nsAutoLock lock(mLock);
-@@ -494,7 +493,7 @@ nsHostResolver::DetachCallback(const cha
-                                nsResolveHostCallback *callback,
-                                nsresult               status)
- {
--    nsRefPtr<nsHostRecord> rec;
-+    nsHostRecord* rec = nsnull;
-     {
-         nsAutoLock lock(mLock);
- 
-@@ -543,7 +542,6 @@ nsHostResolver::IssueLookup(nsHostRecord
-     }
-     else if (mThreadCount < MAX_THREADS) {
-         // dispatch new worker thread
--        NS_ADDREF_THIS(); // owning reference passed to thread
-         mThreadCount++;
-         PRThread *thr = PR_CreateThread(PR_SYSTEM_THREAD,
-                                         ThreadFunc,
-@@ -634,7 +632,6 @@ nsHostResolver::OnLookupComplete(nsHostR
-         if (rec->addr_info && !mShutdown) {
-             // add to mEvictionQ
-             PR_APPEND_LINK(rec, &mEvictionQ);
--            NS_ADDREF(rec);
-             if (mEvictionQSize < mMaxCacheEntries)
-                 mEvictionQSize++;
-             else {
-@@ -691,7 +688,10 @@ nsHostResolver::ThreadFunc(void *arg)
- 
-         // convert error code to nsresult.
-         nsresult status = ai ? NS_OK : NS_ERROR_UNKNOWN_HOST;
-+        NS_BeginRequest();
-         resolver->OnLookupComplete(rec, status, ai);
-+        NS_EndRequest();
-+
-         LOG(("lookup complete for %s ...\n", rec->host));
-     }
-     NS_RELEASE(resolver);
-@@ -714,7 +714,6 @@ nsHostResolver::Create(PRUint32         
-                                              maxCacheLifetime);
-     if (!res)
-         return NS_ERROR_OUT_OF_MEMORY;
--    NS_ADDREF(res);
- 
-     nsresult rv = res->Init();
-     if (NS_FAILED(rv))
-diff --git a/netwerk/dns/src/nsHostResolver.h b/netwerk/dns/src/nsHostResolver.h
---- a/netwerk/dns/src/nsHostResolver.h
-+++ b/netwerk/dns/src/nsHostResolver.h
-@@ -63,13 +63,21 @@ struct nsHostKey
- /**
-  * nsHostRecord - ref counted object type stored in host resolver cache.
-  */
--class nsHostRecord : public XPCOMGCFinalizedObject, public PRCList, public nsHostKey
-+class nsHostRecord : public XPCOMGCFinalizedObject
-+                   , public MMgc::GCFinalizable
-+                   , public PRCList
-+                   , public nsHostKey
- {
- public:
-     NS_DECL_REFCOUNTED_THREADSAFE(nsHostRecord)
- 
-     /* instantiates a new host record */
-     static nsresult Create(const nsHostKey *key, nsHostRecord **record);
-+
-+    static void* operator new(size_t size, size_t extra)
-+    {
-+      return MMgc::GCFinalizedObject::operator new(size + extra, NS_GetGC());
-+    }
- 
-     /* a fully resolved host record has either a non-null |addr_info| or |addr|
-      * field.  if |addr_info| is null, it implies that the |host| is an IP
-diff --git a/netwerk/protocol/http/src/nsHttpConnection.h b/netwerk/protocol/http/src/nsHttpConnection.h
---- a/netwerk/protocol/http/src/nsHttpConnection.h
-+++ b/netwerk/protocol/http/src/nsHttpConnection.h
-@@ -60,9 +60,10 @@
- // accessed from any other thread.
- //-----------------------------------------------------------------------------
- 
--class nsHttpConnection : public nsAHttpSegmentReader
-+class nsHttpConnection : public XPCOMGCFinalizedObject
-+                       , public nsIInputStreamCallback
-+                       , public nsAHttpSegmentReader
-                        , public nsAHttpSegmentWriter
--                       , public nsIInputStreamCallback
-                        , public nsIOutputStreamCallback
-                        , public nsITransportEventSink
-                        , public nsIInterfaceRequestor
deleted file mode 100644
--- a/necko-deadlocks3
+++ /dev/null
@@ -1,1080 +0,0 @@
-diff --git a/netwerk/base/src/nsIOService.cpp b/netwerk/base/src/nsIOService.cpp
---- a/netwerk/base/src/nsIOService.cpp
-+++ b/netwerk/base/src/nsIOService.cpp
-@@ -170,7 +170,7 @@ nsIOService::nsIOService()
-     if (!gBufferCache)
-     {
-         nsresult rv = NS_OK;
--        nsCOMPtr<nsIRecyclingAllocator> recyclingAllocator =
-+        nsIRecyclingAllocator* recyclingAllocator =
-             do_CreateInstance(NS_RECYCLINGALLOCATOR_CONTRACTID, &rv);
-         if (NS_FAILED(rv))
-             return;
-@@ -179,9 +179,8 @@ nsIOService::nsIOService()
-         if (NS_FAILED(rv))
-             return;
- 
--        nsCOMPtr<nsIMemory> eyeMemory = do_QueryInterface(recyclingAllocator);
--        gBufferCache = eyeMemory.get();
--        NS_IF_ADDREF(gBufferCache);
-+        gBufferCache = recyclingAllocator;
-+        NS_RootUntilShutdown(gBufferCache);
-     }
- }
- 
-@@ -209,7 +208,7 @@ nsIOService::Init()
-     }
- 
-     // XXX hack until xpidl supports error info directly (bug 13423)
--    nsCOMPtr<nsIErrorService> errorService = do_GetService(NS_ERRORSERVICE_CONTRACTID);
-+    nsIErrorService* errorService = do_GetService(NS_ERRORSERVICE_CONTRACTID);
-     if (errorService) {
-         errorService->RegisterErrorStringBundle(NS_ERROR_MODULE_NETWORK, NECKO_MSGS_URL);
-     }
-@@ -221,8 +220,8 @@ nsIOService::Init()
-         mRestrictedPortList.AppendElement(reinterpret_cast<void *>(gBadPortList[i]));
- 
-     // Further modifications to the port list come from prefs
--    nsCOMPtr<nsIPrefBranch2> prefBranch;
--    GetPrefBranch(getter_AddRefs(prefBranch));
-+    nsIPrefBranch2* prefBranch = nsnull;
-+    GetPrefBranch(&prefBranch);
-     if (prefBranch) {
-         prefBranch->AddObserver(PORT_PREF_PREFIX, this, PR_TRUE);
-         prefBranch->AddObserver(AUTODIAL_PREF, this, PR_TRUE);
-@@ -230,7 +229,7 @@ nsIOService::Init()
-     }
-     
-     // Register for profile change notifications
--    nsCOMPtr<nsIObserverService> observerService =
-+    nsIObserverService* observerService =
-         do_GetService("@mozilla.org/observer-service;1");
-     if (observerService) {
-         observerService->AddObserver(this, kProfileChangeNetTeardownTopic, PR_TRUE);
-@@ -265,7 +264,6 @@ nsIOService::GetInstance() {
-         gIOService = new nsIOService();
-         if (!gIOService)
-             return nsnull;
--        NS_ADDREF(gIOService);
- 
-         nsresult rv = gIOService->Init();
-         if (NS_FAILED(rv)) {
-@@ -274,7 +272,6 @@ nsIOService::GetInstance() {
-         }
-         return gIOService;
-     }
--    NS_ADDREF(gIOService);
-     return gIOService;
- }
- 
-@@ -291,7 +288,7 @@ nsIOService::OnChannelRedirect(nsIChanne
- nsIOService::OnChannelRedirect(nsIChannel* oldChan, nsIChannel* newChan,
-                                PRUint32 flags)
- {
--    nsCOMPtr<nsIChannelEventSink> sink =
-+    nsIChannelEventSink* sink =
-         do_GetService(NS_GLOBAL_CHANNELEVENTSINK_CONTRACTID);
-     if (sink) {
-         nsresult rv = sink->OnChannelRedirect(oldChan, newChan, flags);
-@@ -322,7 +319,7 @@ nsIOService::CacheProtocolHandler(const 
-             nsresult rv;
-             NS_ASSERTION(!mWeakHandler[i], "Protocol handler already cached");
-             // Make sure the handler supports weak references.
--            nsCOMPtr<nsISupportsWeakReference> factoryPtr = do_QueryInterface(handler, &rv);
-+            nsISupportsWeakReference* factoryPtr = do_QueryInterface(handler, &rv);
-             if (!factoryPtr)
-             {
-                 // Don't cache handlers that don't support weak reference as
-@@ -376,8 +373,8 @@ nsIOService::GetProtocolHandler(const ch
- 
-     PRBool externalProtocol = PR_FALSE;
-     PRBool listedProtocol   = PR_TRUE;
--    nsCOMPtr<nsIPrefBranch2> prefBranch;
--    GetPrefBranch(getter_AddRefs(prefBranch));
-+    nsIPrefBranch2* prefBranch = nsnull;
-+    GetPrefBranch(&prefBranch);
-     if (prefBranch) {
-         nsCAutoString externalProtocolPref("network.protocol-handler.external.");
-         externalProtocolPref += scheme;
-@@ -448,8 +445,8 @@ NS_IMETHODIMP
- NS_IMETHODIMP 
- nsIOService::GetProtocolFlags(const char* scheme, PRUint32 *flags)
- {
--    nsCOMPtr<nsIProtocolHandler> handler;
--    nsresult rv = GetProtocolHandler(scheme, getter_AddRefs(handler));
-+    nsIProtocolHandler* handler = nsnull;
-+    nsresult rv = GetProtocolHandler(scheme, &handler);
-     if (NS_FAILED(rv)) return rv;
- 
-     rv = handler->GetProtocolFlags(flags);
-@@ -493,8 +490,8 @@ nsIOService::NewURI(const nsACString &aS
-     }
- 
-     // now get the handler for this scheme
--    nsCOMPtr<nsIProtocolHandler> handler;
--    rv = GetProtocolHandler(scheme.get(), getter_AddRefs(handler));
-+    nsIProtocolHandler* handler = nsnull;
-+    rv = GetProtocolHandler(scheme.get(), &handler);
-     if (NS_FAILED(rv)) return rv;
- 
-     return handler->NewURI(aSpec, aCharset, aBaseURI, result);
-@@ -507,12 +504,12 @@ nsIOService::NewFileURI(nsIFile *file, n
-     nsresult rv;
-     NS_ENSURE_ARG_POINTER(file);
- 
--    nsCOMPtr<nsIProtocolHandler> handler;
--
--    rv = GetProtocolHandler("file", getter_AddRefs(handler));
-+    nsIProtocolHandler* handler = nsnull;
-+
-+    rv = GetProtocolHandler("file", &handler);
-     if (NS_FAILED(rv)) return rv;
- 
--    nsCOMPtr<nsIFileProtocolHandler> fileHandler( do_QueryInterface(handler, &rv) );
-+    nsIFileProtocolHandler* fileHandler( do_QueryInterface(handler, &rv) );
-     if (NS_FAILED(rv)) return rv;
-     
-     return fileHandler->NewFileURI(file, result);
-@@ -530,8 +527,8 @@ nsIOService::NewChannelFromURI(nsIURI *a
-     if (NS_FAILED(rv))
-         return rv;
- 
--    nsCOMPtr<nsIProtocolHandler> handler;
--    rv = GetProtocolHandler(scheme.get(), getter_AddRefs(handler));
-+    nsIProtocolHandler* handler = nsnull;
-+    rv = GetProtocolHandler(scheme.get(), &handler);
-     if (NS_FAILED(rv))
-         return rv;
- 
-@@ -543,14 +540,14 @@ nsIOService::NewChannelFromURI(nsIURI *a
-     // Talk to the PPS if the protocol handler allows proxying.  Otherwise,
-     // skip this step.  This allows us to lazily load the PPS at startup.
-     if (protoFlags & nsIProtocolHandler::ALLOWS_PROXY) {
--        nsCOMPtr<nsIProxyInfo> pi;
-+        nsIProxyInfo* pi = nsnull;
-         if (!mProxyService) {
-             mProxyService = do_GetService(NS_PROTOCOLPROXYSERVICE_CONTRACTID);
-             if (!mProxyService)
-                 NS_WARNING("failed to get protocol proxy service");
-         }
-         if (mProxyService) {
--            rv = mProxyService->Resolve(aURI, 0, getter_AddRefs(pi));
-+            rv = mProxyService->Resolve(aURI, 0, &pi);
-             if (NS_FAILED(rv))
-                 pi = nsnull;
-         }
-@@ -558,11 +555,11 @@ nsIOService::NewChannelFromURI(nsIURI *a
-             nsCAutoString type;
-             if (NS_SUCCEEDED(pi->GetType(type)) && type.EqualsLiteral("http")) {
-                 // we are going to proxy this channel using an http proxy
--                rv = GetProtocolHandler("http", getter_AddRefs(handler));
-+                rv = GetProtocolHandler("http", &handler);
-                 if (NS_FAILED(rv))
-                     return rv;
-             }
--            nsCOMPtr<nsIProxiedProtocolHandler> pph = do_QueryInterface(handler);
-+            nsIProxiedProtocolHandler* pph = do_QueryInterface(handler);
-             if (pph)
-                 return pph->NewProxiedChannel(aURI, pi, result);
-         }
-@@ -575,8 +572,8 @@ nsIOService::NewChannel(const nsACString
- nsIOService::NewChannel(const nsACString &aSpec, const char *aCharset, nsIURI *aBaseURI, nsIChannel **result)
- {
-     nsresult rv;
--    nsCOMPtr<nsIURI> uri;
--    rv = NewURI(aSpec, aCharset, aBaseURI, getter_AddRefs(uri));
-+    nsIURI* uri = nsnull;
-+    rv = NewURI(aSpec, aCharset, aBaseURI, &uri);
-     if (NS_FAILED(rv)) return rv;
- 
-     return NewChannelFromURI(uri, result);
-@@ -592,7 +589,7 @@ NS_IMETHODIMP
- NS_IMETHODIMP
- nsIOService::SetOffline(PRBool offline)
- {
--    nsCOMPtr<nsIObserverService> observerService =
-+    nsIObserverService* observerService =
-         do_GetService("@mozilla.org/observer-service;1");
-     
-     nsresult rv;
-@@ -672,8 +669,8 @@ nsIOService::AllowPort(PRInt32 inPort, c
-             if (!scheme)
-                 return NS_OK;
-             
--            nsCOMPtr<nsIProtocolHandler> handler;
--            nsresult rv = GetProtocolHandler(scheme, getter_AddRefs(handler));
-+            nsIProtocolHandler* handler = nsnull;
-+            nsresult rv = GetProtocolHandler(scheme, &handler);
-             if (NS_FAILED(rv)) return rv;
- 
-             // let the protocol handler decide
-@@ -765,7 +762,7 @@ nsIOService::Observe(nsISupports *subjec
-                      const PRUnichar *data)
- {
-     if (!strcmp(topic, NS_PREFBRANCH_PREFCHANGE_TOPIC_ID)) {
--        nsCOMPtr<nsIPrefBranch> prefBranch = do_QueryInterface(subject);
-+        nsIPrefBranch* prefBranch = do_QueryInterface(subject);
-         if (prefBranch)
-             PrefsChanged(prefBranch, NS_ConvertUTF16toUTF8(data).get());
-     }
-@@ -846,10 +843,10 @@ nsIOService::URIChainHasFlags(nsIURI   *
- 
-     // Dig deeper into the chain.  Note that this is not a do/while loop to
-     // avoid the extra addref/release on |uri| in the common (non-nested) case.
--    nsCOMPtr<nsINestedURI> nestedURI = do_QueryInterface(uri);
-+    nsINestedURI* nestedURI = do_QueryInterface(uri);
-     while (nestedURI) {
--        nsCOMPtr<nsIURI> innerURI;
--        rv = nestedURI->GetInnerURI(getter_AddRefs(innerURI));
-+        nsIURI* innerURI = nsnull;
-+        rv = nestedURI->GetInnerURI(&innerURI);
-         NS_ENSURE_SUCCESS(rv, rv);
- 
-         rv = ProtocolHasFlags(innerURI, flags, result);
-diff --git a/netwerk/base/src/nsSocketTransport2.cpp b/netwerk/base/src/nsSocketTransport2.cpp
---- a/netwerk/base/src/nsSocketTransport2.cpp
-+++ b/netwerk/base/src/nsSocketTransport2.cpp
-@@ -221,7 +221,6 @@ nsSocketInputStream::nsSocketInputStream
- 
- nsSocketInputStream::~nsSocketInputStream()
- {
--    Close();
- }
- 
- // called on the socket transport thread...
-@@ -236,7 +235,7 @@ nsSocketInputStream::OnSocketReady(nsres
- 
-     NS_ASSERTION(PR_GetCurrentThread() == gSocketThread, "wrong thread");
- 
--    nsCOMPtr<nsIInputStreamCallback> callback;
-+    nsIInputStreamCallback* callback = nsnull;
-     {
-         nsAutoLock lock(mTransport->mLock);
- 
-@@ -418,7 +417,7 @@ nsSocketInputStream::AsyncWait(nsIInputS
-     // This variable will be non-null when we want to call the callback
-     // directly from this function, but outside the lock.
-     // (different from callback when target is not null)
--    nsCOMPtr<nsIInputStreamCallback> directCallback;
-+    nsIInputStreamCallback* directCallback = nsnull;
-     {
-         nsAutoLock lock(mTransport->mLock);
- 
-@@ -429,8 +428,8 @@ nsSocketInputStream::AsyncWait(nsIInputS
-             // failure to create an event proxy (most likely out of memory)
-             // shouldn't alter the state of the transport.
-             //
--            nsCOMPtr<nsIInputStreamCallback> temp;
--            nsresult rv = NS_NewInputStreamReadyEvent(getter_AddRefs(temp),
-+            nsIInputStreamCallback* temp = nsnull;
-+            nsresult rv = NS_NewInputStreamReadyEvent(&temp,
-                                                       callback, target);
-             if (NS_FAILED(rv)) return rv;
-             mCallback = temp;
-@@ -439,7 +438,7 @@ nsSocketInputStream::AsyncWait(nsIInputS
-             mCallback = callback;
- 
-         if (NS_FAILED(mCondition))
--            directCallback.swap(mCallback);
-+            swap(directCallback, mCallback);
-         else
-             mCallbackFlags = flags;
-     }
-@@ -466,7 +465,6 @@ nsSocketOutputStream::nsSocketOutputStre
- 
- nsSocketOutputStream::~nsSocketOutputStream()
- {
--  Close();
- }
- 
- // called on the socket transport thread...
-@@ -481,7 +479,7 @@ nsSocketOutputStream::OnSocketReady(nsre
- 
-     NS_ASSERTION(PR_GetCurrentThread() == gSocketThread, "wrong thread");
- 
--    nsCOMPtr<nsIOutputStreamCallback> callback;
-+    nsIOutputStreamCallback* callback = nsnull;
-     {
-         nsAutoLock lock(mTransport->mLock);
- 
-@@ -653,8 +651,8 @@ nsSocketOutputStream::AsyncWait(nsIOutpu
-             // failure to create an event proxy (most likely out of memory)
-             // shouldn't alter the state of the transport.
-             //
--            nsCOMPtr<nsIOutputStreamCallback> temp;
--            nsresult rv = NS_NewOutputStreamReadyEvent(getter_AddRefs(temp),
-+            nsIOutputStreamCallback* temp = nsnull;
-+            nsresult rv = NS_NewOutputStreamReadyEvent(&temp,
-                                                        callback, target);
-             if (NS_FAILED(rv)) return rv;
-             mCallback = temp;
-@@ -693,7 +691,6 @@ nsSocketTransport::nsSocketTransport()
- {
-     LOG(("creating nsSocketTransport @%x\n", this));
- 
--    NS_ADDREF(gSocketTransportService);
- 
-     mTimeouts[TIMEOUT_CONNECT]    = PR_UINT16_MAX; // no timeout
-     mTimeouts[TIMEOUT_READ_WRITE] = PR_UINT16_MAX; // no timeout
-@@ -726,7 +723,7 @@ nsSocketTransport::Init(const char **typ
-     if (!mLock)
-         return NS_ERROR_OUT_OF_MEMORY;
- 
--    nsCOMPtr<nsProxyInfo> proxyInfo;
-+    nsProxyInfo* proxyInfo = nsnull;
-     if (givenProxyInfo) {
-         proxyInfo = do_QueryInterface(givenProxyInfo);
-         NS_ENSURE_ARG(proxyInfo);
-@@ -760,7 +757,7 @@ nsSocketTransport::Init(const char **typ
-     // if we have socket types, then the socket provider service had
-     // better exist!
-     nsresult rv;
--    nsCOMPtr<nsISocketProviderService> spserv =
-+    nsISocketProviderService* spserv =
-         do_GetService(kSocketProviderServiceCID, &rv);
-     if (NS_FAILED(rv)) return rv;
- 
-@@ -780,8 +777,8 @@ nsSocketTransport::Init(const char **typ
-             mTypeCount = i;
-             return NS_ERROR_OUT_OF_MEMORY;
-         }
--        nsCOMPtr<nsISocketProvider> provider;
--        rv = spserv->GetSocketProvider(mTypes[i], getter_AddRefs(provider));
-+        nsISocketProvider* provider = nsnull;
-+        rv = spserv->GetSocketProvider(mTypes[i], &provider);
-         if (NS_FAILED(rv)) {
-             NS_WARNING("no registered socket provider");
-             return rv;
-@@ -852,7 +849,7 @@ nsSocketTransport::PostEvent(PRUint32 ty
-     LOG(("nsSocketTransport::PostEvent [this=%p type=%u status=%x param=%p]\n",
-         this, type, status, param));
- 
--    nsCOMPtr<nsIRunnable> event = new nsSocketEvent(this, type, status, param);
-+    nsIRunnable* event = new nsSocketEvent(this, type, status, param);
-     if (!event)
-         return NS_ERROR_OUT_OF_MEMORY;
- 
-@@ -864,7 +861,7 @@ nsSocketTransport::SendStatus(nsresult s
- {
-     LOG(("nsSocketTransport::SendStatus [this=%x status=%x]\n", this, status));
- 
--    nsCOMPtr<nsITransportEventSink> sink;
-+    nsITransportEventSink* sink = nsnull;
-     PRUint64 progress;
-     {
-         nsAutoLock lock(mLock);
-@@ -913,7 +910,7 @@ nsSocketTransport::ResolveHost()
-         }
-     }
- 
--    nsCOMPtr<nsIDNSService> dns = do_GetService(kDNSServiceCID, &rv);
-+    nsIDNSService* dns = do_GetService(kDNSServiceCID, &rv);
-     if (NS_FAILED(rv)) return rv;
- 
-     mResolving = PR_TRUE;
-@@ -947,7 +944,7 @@ nsSocketTransport::BuildSocket(PRFileDes
-     else {
-         fd = nsnull;
- 
--        nsCOMPtr<nsISocketProviderService> spserv =
-+        nsISocketProviderService* spserv =
-             do_GetService(kSocketProviderServiceCID, &rv);
-         if (NS_FAILED(rv)) return rv;
- 
-@@ -959,25 +956,25 @@ nsSocketTransport::BuildSocket(PRFileDes
- 
-         PRUint32 i;
-         for (i=0; i<mTypeCount; ++i) {
--            nsCOMPtr<nsISocketProvider> provider;
-+            nsISocketProvider* provider = nsnull;
- 
-             LOG(("  pushing io layer [%u:%s]\n", i, mTypes[i]));
- 
--            rv = spserv->GetSocketProvider(mTypes[i], getter_AddRefs(provider));
-+            rv = spserv->GetSocketProvider(mTypes[i], &provider);
-             if (NS_FAILED(rv))
-                 break;
- 
-             if (mProxyTransparentResolvesHost)
-                 proxyFlags |= nsISocketProvider::PROXY_RESOLVES_HOST;
- 
--            nsCOMPtr<nsISupports> secinfo;
-+            nsISupports* secinfo = nsnull;
-             if (i == 0) {
-                 // if this is the first type, we'll want the 
-                 // service to allocate a new socket
-                 rv = provider->NewSocket(mNetAddr.raw.family,
-                                          host, port, proxyHost, proxyPort,
-                                          proxyFlags, &fd,
--                                         getter_AddRefs(secinfo));
-+                                         &secinfo);
- 
-                 if (NS_SUCCEEDED(rv) && !fd) {
-                     NS_NOTREACHED("NewSocket succeeded but failed to create a PRFileDesc");
-@@ -991,7 +988,7 @@ nsSocketTransport::BuildSocket(PRFileDes
-                 rv = provider->AddToSocket(mNetAddr.raw.family,
-                                            host, port, proxyHost, proxyPort,
-                                            proxyFlags, fd,
--                                           getter_AddRefs(secinfo));
-+                                           &secinfo);
-             }
-             proxyFlags = 0;
-             if (NS_FAILED(rv))
-@@ -1001,7 +998,7 @@ nsSocketTransport::BuildSocket(PRFileDes
-             PRBool isSSL = (strcmp(mTypes[i], "ssl") == 0);
-             if (isSSL || (strcmp(mTypes[i], "starttls") == 0)) {
-                 // remember security info and give notification callbacks to PSM...
--                nsCOMPtr<nsIInterfaceRequestor> callbacks;
-+                nsIInterfaceRequestor* callbacks = nsnull;
-                 {
-                     nsAutoLock lock(mLock);
-                     mSecInfo = secinfo;
-@@ -1009,7 +1006,7 @@ nsSocketTransport::BuildSocket(PRFileDes
-                     LOG(("  [secinfo=%x callbacks=%x]\n", mSecInfo.get(), mCallbacks.get()));
-                 }
-                 // don't call into PSM while holding mLock!!
--                nsCOMPtr<nsISSLSocketControl> secCtrl(do_QueryInterface(secinfo));
-+                nsISSLSocketControl* secCtrl(do_QueryInterface(secinfo));
-                 if (secCtrl)
-                     secCtrl->SetNotificationCallbacks(callbacks);
-                 // remember if socket type is SSL so we can ProxyStartSSL if need be.
-@@ -1055,7 +1052,7 @@ nsSocketTransport::InitiateSocket()
-     // 194402 for more info.
-     //
-     if (!gSocketTransportService->CanAttachSocket()) {
--        nsCOMPtr<nsIRunnable> event =
-+        nsIRunnable* event =
-                 new nsSocketEvent(this, MSG_RETRY_INIT_SOCKET);
-         if (!event)
-             return NS_ERROR_OUT_OF_MEMORY;
-@@ -1158,7 +1155,7 @@ nsSocketTransport::InitiateSocket()
-                 // been pushed, and we were proxying (transparently; ie. nothing
-                 // has to happen in the protocol layer above us), it's time for
-                 // the ssl to start doing it's thing.
--                nsCOMPtr<nsISSLSocketControl> secCtrl =
-+                nsISSLSocketControl* secCtrl =
-                     do_QueryInterface(mSecInfo);
-                 if (secCtrl) {
-                     LOG(("  calling ProxyStartSSL()\n"));
-@@ -1549,7 +1546,7 @@ nsSocketTransport::OnSocketDetached(PRFi
-     // break any potential reference cycle between the security info object
-     // and ourselves by resetting its notification callbacks object.  see
-     // bug 285991 for details.
--    nsCOMPtr<nsISSLSocketControl> secCtrl = do_QueryInterface(mSecInfo);
-+    nsISSLSocketControl* secCtrl = do_QueryInterface(mSecInfo);
-     if (secCtrl)
-         secCtrl->SetNotificationCallbacks(nsnull);
- 
-@@ -1591,7 +1588,7 @@ nsSocketTransport::OpenInputStream(PRUin
-     NS_ENSURE_TRUE(!mInput.IsReferenced(), NS_ERROR_UNEXPECTED);
- 
-     nsresult rv;
--    nsCOMPtr<nsIAsyncInputStream> pipeIn;
-+    nsIAsyncInputStream* pipeIn = nsnull;
- 
-     if (!(flags & OPEN_UNBUFFERED) || (flags & OPEN_BLOCKING)) {
-         // XXX if the caller wants blocking, then the caller also gets buffered!
-@@ -1602,8 +1599,8 @@ nsSocketTransport::OpenInputStream(PRUin
-         nsIMemory *segalloc = net_GetSegmentAlloc(segsize);
- 
-         // create a pipe
--        nsCOMPtr<nsIAsyncOutputStream> pipeOut;
--        rv = NS_NewPipe2(getter_AddRefs(pipeIn), getter_AddRefs(pipeOut),
-+        nsIAsyncOutputStream* pipeOut = nsnull;
-+        rv = NS_NewPipe2(&pipeIn, &pipeOut,
-                          !openBlocking, PR_TRUE, segsize, segcount, segalloc);
-         if (NS_FAILED(rv)) return rv;
- 
-@@ -1623,7 +1620,6 @@ nsSocketTransport::OpenInputStream(PRUin
-     rv = PostEvent(MSG_ENSURE_CONNECT);
-     if (NS_FAILED(rv)) return rv;
- 
--    NS_ADDREF(*result);
-     return NS_OK;
- }
- 
-@@ -1639,7 +1635,7 @@ nsSocketTransport::OpenOutputStream(PRUi
-     NS_ENSURE_TRUE(!mOutput.IsReferenced(), NS_ERROR_UNEXPECTED);
- 
-     nsresult rv;
--    nsCOMPtr<nsIAsyncOutputStream> pipeOut;
-+    nsIAsyncOutputStream* pipeOut = nsnull;
-     if (!(flags & OPEN_UNBUFFERED) || (flags & OPEN_BLOCKING)) {
-         // XXX if the caller wants blocking, then the caller also gets buffered!
-         //PRBool openBuffered = !(flags & OPEN_UNBUFFERED);
-@@ -1649,8 +1645,8 @@ nsSocketTransport::OpenOutputStream(PRUi
-         nsIMemory *segalloc = net_GetSegmentAlloc(segsize);
- 
-         // create a pipe
--        nsCOMPtr<nsIAsyncInputStream> pipeIn;
--        rv = NS_NewPipe2(getter_AddRefs(pipeIn), getter_AddRefs(pipeOut),
-+        nsIAsyncInputStream* pipeIn = nsnull;
-+        rv = NS_NewPipe2(&pipeIn, &pipeOut,
-                          PR_TRUE, !openBlocking, segsize, segcount, segalloc);
-         if (NS_FAILED(rv)) return rv;
- 
-@@ -1670,7 +1666,6 @@ nsSocketTransport::OpenOutputStream(PRUi
-     rv = PostEvent(MSG_ENSURE_CONNECT);
-     if (NS_FAILED(rv)) return rv;
- 
--    NS_ADDREF(*result);
-     return NS_OK;
- }
- 
-@@ -1689,7 +1684,7 @@ nsSocketTransport::GetSecurityInfo(nsISu
- nsSocketTransport::GetSecurityInfo(nsISupports **secinfo)
- {
-     nsAutoLock lock(mLock);
--    NS_IF_ADDREF(*secinfo = mSecInfo);
-+    *secinfo = mSecInfo;
-     return NS_OK;
- }
- 
-@@ -1697,7 +1692,7 @@ nsSocketTransport::GetSecurityCallbacks(
- nsSocketTransport::GetSecurityCallbacks(nsIInterfaceRequestor **callbacks)
- {
-     nsAutoLock lock(mLock);
--    NS_IF_ADDREF(*callbacks = mCallbacks);
-+    *callbacks = mCallbacks;
-     return NS_OK;
- }
- 
-@@ -1714,13 +1709,13 @@ nsSocketTransport::SetEventSink(nsITrans
- nsSocketTransport::SetEventSink(nsITransportEventSink *sink,
-                                 nsIEventTarget *target)
- {
--    nsCOMPtr<nsITransportEventSink> temp;
-+    nsITransportEventSink* temp = nsnull;
-     if (target) {
--        nsresult rv = net_NewTransportEventSinkProxy(getter_AddRefs(temp),
-+        nsresult rv = net_NewTransportEventSinkProxy(&temp,
-                                                      sink, target);
-         if (NS_FAILED(rv))
-             return rv;
--        sink = temp.get();
-+        sink = temp;
-     }
- 
-     nsAutoLock lock(mLock);
-diff --git a/netwerk/base/src/nsStreamListenerTee.cpp b/netwerk/base/src/nsStreamListenerTee.cpp
---- a/netwerk/base/src/nsStreamListenerTee.cpp
-+++ b/netwerk/base/src/nsStreamListenerTee.cpp
-@@ -58,6 +58,7 @@ nsStreamListenerTee::OnStopRequest(nsIRe
-     NS_ENSURE_TRUE(mListener, NS_ERROR_NOT_INITIALIZED);
-     // it is critical that we close out the input stream tee
-     if (mInputTee) {
-+        mInputTee->Close();
-         mInputTee->SetSink(nsnull);
-         mInputTee = 0;
-     }
-@@ -75,11 +76,11 @@ nsStreamListenerTee::OnDataAvailable(nsI
-     NS_ENSURE_TRUE(mListener, NS_ERROR_NOT_INITIALIZED);
-     NS_ENSURE_TRUE(mSink, NS_ERROR_NOT_INITIALIZED);
- 
--    nsCOMPtr<nsIInputStream> tee;
-     nsresult rv;
- 
-     if (!mInputTee) {
--        rv = NS_NewInputStreamTee(getter_AddRefs(tee), input, mSink);
-+        nsIInputStream *tee = nsnull;
-+        rv = NS_NewInputStreamTee(&tee, input, mSink);
-         if (NS_FAILED(rv)) return rv;
- 
-         mInputTee = do_QueryInterface(tee, &rv);
-@@ -89,12 +90,9 @@ nsStreamListenerTee::OnDataAvailable(nsI
-         // re-initialize the input tee since the input stream may have changed.
-         rv = mInputTee->SetSource(input);
-         if (NS_FAILED(rv)) return rv;
--
--        tee = do_QueryInterface(mInputTee, &rv);
--        if (NS_FAILED(rv)) return rv;
-     }
- 
--    return mListener->OnDataAvailable(request, context, tee, offset, count);
-+    return mListener->OnDataAvailable(request, context, mInputTee, offset, count);
- }
- 
- NS_IMETHODIMP
-diff --git a/netwerk/cache/src/nsCacheEntry.cpp b/netwerk/cache/src/nsCacheEntry.cpp
---- a/netwerk/cache/src/nsCacheEntry.cpp
-+++ b/netwerk/cache/src/nsCacheEntry.cpp
-@@ -368,8 +368,8 @@ PLDHashTableOps
- PLDHashTableOps
- nsCacheEntryHashTable::ops =
- {
--    PL_DHashAllocTable,
--    PL_DHashFreeTable,
-+    GCAllocTable,
-+    GCFreeTable,
-     HashKey,
-     MatchEntry,
-     MoveEntry,
-diff --git a/netwerk/cache/src/nsCacheEntryDescriptor.cpp b/netwerk/cache/src/nsCacheEntryDescriptor.cpp
---- a/netwerk/cache/src/nsCacheEntryDescriptor.cpp
-+++ b/netwerk/cache/src/nsCacheEntryDescriptor.cpp
-@@ -57,22 +57,11 @@ nsCacheEntryDescriptor::nsCacheEntryDesc
-       mAccessGranted(accessGranted)
- {
-     PR_INIT_CLIST(this);
--    NS_ADDREF(nsCacheService::GlobalInstance());  // ensure it lives for the lifetime of the descriptor
- }
- 
- 
- nsCacheEntryDescriptor::~nsCacheEntryDescriptor()
- {
--    // No need to close if the cache entry has already been severed.  This
--    // helps avoid a shutdown assertion (bug 285519) that is caused when
--    // consumers end up holding onto these objects past xpcom-shutdown.  It's
--    // okay for them to do that because the cache service calls our Close
--    // method during xpcom-shutdown, so we don't need to complain about it.
--    if (mCacheEntry)
--        Close();
--
--    nsCacheService * service = nsCacheService::GlobalInstance();
--    NS_RELEASE(service);
- }
- 
- 
-@@ -254,7 +243,7 @@ nsCacheEntryDescriptor::OpenInputStream(
-         new nsInputStreamWrapper(this, offset);
-     if (!cacheInput) return NS_ERROR_OUT_OF_MEMORY;
- 
--    NS_ADDREF(*result = cacheInput);
-+    *result = cacheInput;
-     return NS_OK;
- }
- 
-@@ -277,7 +266,7 @@ nsCacheEntryDescriptor::OpenOutputStream
-         new nsOutputStreamWrapper(this, offset);
-     if (!cacheOutput) return NS_ERROR_OUT_OF_MEMORY;
- 
--    NS_ADDREF(*result = cacheOutput);
-+    *result = cacheOutput;
-     return NS_OK;
- }
- 
-@@ -290,7 +279,7 @@ nsCacheEntryDescriptor::GetCacheElement(
-     if (!mCacheEntry)                 return NS_ERROR_NOT_AVAILABLE;
-     if (mCacheEntry->IsStreamData())  return NS_ERROR_CACHE_DATA_IS_STREAM;
- 
--    NS_IF_ADDREF(*result = mCacheEntry->Data());
-+    *result = mCacheEntry->Data();
-     return NS_OK;
- }
- 
-@@ -507,7 +496,7 @@ nsInputStreamWrapper::LazyInit()
-     nsCacheEntry* cacheEntry = mDescriptor->CacheEntry();
-     if (!cacheEntry) return NS_ERROR_NOT_AVAILABLE;
- 
--    nsCOMPtr<nsIInputStream> input;
-+    nsIInputStream* input = nsnull;
-     rv = nsCacheService::OpenInputStreamForEntry(cacheEntry, mode,
-                                                  mStartOffset,
-                                                  getter_AddRefs(mInput));
-diff --git a/netwerk/cache/src/nsCacheRequest.h b/netwerk/cache/src/nsCacheRequest.h
---- a/netwerk/cache/src/nsCacheRequest.h
-+++ b/netwerk/cache/src/nsCacheRequest.h
-@@ -84,7 +84,6 @@ private:
-         delete mKey;
-         if (mLock)    PR_DestroyLock(mLock);
-         if (mCondVar) PR_DestroyCondVar(mCondVar);
--        NS_ASSERTION(PR_CLIST_IS_EMPTY(this), "request still on a list");
-     }
- 
-     static void operator delete(void *obj)
-diff --git a/netwerk/cache/src/nsCacheService.cpp b/netwerk/cache/src/nsCacheService.cpp
---- a/netwerk/cache/src/nsCacheService.cpp
-+++ b/netwerk/cache/src/nsCacheService.cpp
-@@ -653,17 +653,12 @@ nsCacheService::Shutdown()
-         ClearDoomList();
-         ClearActiveEntries();
- 
--        // deallocate memory and disk caches
--        delete mMemoryDevice;
-+        // lose the memory and disk caches
-         mMemoryDevice = nsnull;
--
- #ifdef NECKO_DISK_CACHE
--        delete mDiskDevice;
-         mDiskDevice = nsnull;
- #endif // !NECKO_DISK_CACHE
--
- #ifdef NECKO_OFFLINE_CACHE
--        delete mOfflineDevice;
-         mOfflineDevice = nsnull;
- #endif // !NECKO_OFFLINE_CACHE
- 
-diff --git a/netwerk/cache/src/nsDiskCacheDevice.cpp b/netwerk/cache/src/nsDiskCacheDevice.cpp
---- a/netwerk/cache/src/nsDiskCacheDevice.cpp
-+++ b/netwerk/cache/src/nsDiskCacheDevice.cpp
-@@ -158,7 +158,7 @@ nsDiskCacheEvictor::VisitRecord(nsDiskCa
-  *  nsDiskCacheDeviceInfo
-  *****************************************************************************/
- 
--class nsDiskCacheDeviceInfo : public nsICacheDeviceInfo {
-+class nsDiskCacheDeviceInfo : public XPCOMGCFinalizedObject, public nsICacheDeviceInfo {
- public:
-     NS_DECL_ISUPPORTS
-     NS_DECL_NSICACHEDEVICEINFO
-@@ -191,9 +191,9 @@ NS_IMETHODIMP nsDiskCacheDeviceInfo::Get
-     nsCString buffer;
-     
-     buffer.AssignLiteral("\n<tr>\n<td><b>Cache Directory:</b></td>\n<td><tt> ");
--    nsCOMPtr<nsILocalFile> cacheDir;
-+    nsILocalFile* cacheDir = nsnull;
-     nsAutoString           path;
--    mDevice->getCacheDirectory(getter_AddRefs(cacheDir)); 
-+    mDevice->getCacheDirectory(&cacheDir); 
-     nsresult rv = cacheDir->GetPath(path);
-     if (NS_SUCCEEDED(rv)) {
-         AppendUTF16toUTF8(path, buffer);
-@@ -345,7 +345,7 @@ nsDiskCacheDevice::Shutdown()
- 
-     if (mCacheDirectory) {
-         // delete any trash files left-over before shutting down.
--        nsCOMPtr<nsIFile> trashDir;
-+        nsIFile* trashDir = nsnull;
-         GetTrashDir(mCacheDirectory, &trashDir);
-         if (trashDir) {
-             PRBool exists;
-@@ -473,7 +473,6 @@ nsDiskCacheDevice::DeactivateEntry(nsCac
-     }
- 
-     mBindery.RemoveBinding(binding); // extract binding from collision detection stuff
--    delete entry;   // which will release binding
-     return rv;
- }
- 
-@@ -654,13 +653,13 @@ nsDiskCacheDevice::GetFileForEntry(nsCac
-         }
-     }
-     
--    nsCOMPtr<nsIFile>  file;
-+    nsIFile*  file = nsnull;
-     rv = mCacheMap.GetFileForDiskCacheRecord(&binding->mRecord,
-                                              nsDiskCache::kData,
--                                             getter_AddRefs(file));
-+                                             &file);
-     if (NS_FAILED(rv))  return rv;
-     
--    NS_IF_ADDREF(*result = file);
-+    *result = file;
-     return NS_OK;
- }
- 
-@@ -740,7 +739,7 @@ public:
-         if (!entryInfo) {
-             return kStopVisitingRecords;
-         }
--        nsCOMPtr<nsICacheEntryInfo> ref(entryInfo);
-+        nsICacheEntryInfo* ref(entryInfo);
-         
-         PRBool  keepGoing;
-         rv = mVisitor->VisitEntry(DISK_CACHE_DEVICE_ID, entryInfo, &keepGoing);
-@@ -759,7 +758,7 @@ nsDiskCacheDevice::Visit(nsICacheVisitor
- {
-     if (!Initialized())  return NS_ERROR_NOT_INITIALIZED;
-     nsDiskCacheDeviceInfo* deviceInfo = new nsDiskCacheDeviceInfo(this);
--    nsCOMPtr<nsICacheDeviceInfo> ref(deviceInfo);
-+    nsICacheDeviceInfo* ref(deviceInfo);
-     
-     PRBool keepGoing;
-     nsresult rv = visitor->VisitDevice(DISK_CACHE_DEVICE_ID, deviceInfo, &keepGoing);
-@@ -843,7 +842,7 @@ nsDiskCacheDevice::OpenDiskCache()
- 
-     if (!trashing) {
-         // delete any trash files leftover from a previous run
--        nsCOMPtr<nsIFile> trashDir;
-+        nsIFile* trashDir = nsnull;
-         GetTrashDir(mCacheDirectory, &trashDir);
-         if (trashDir) {
-             PRBool exists;
-@@ -920,9 +919,9 @@ nsDiskCacheDevice::SetCacheParentDirecto
-     if (NS_FAILED(rv))  return;
- 
-     // ensure cache directory exists
--    nsCOMPtr<nsIFile> directory;
--    
--    rv = parentDir->Clone(getter_AddRefs(directory));
-+    nsIFile* directory = nsnull;
-+    
-+    rv = parentDir->Clone(&directory);
-     if (NS_FAILED(rv))  return;
-     rv = directory->AppendNative(NS_LITERAL_CSTRING("Cache"));
-     if (NS_FAILED(rv))  return;
-@@ -935,7 +934,6 @@ nsDiskCacheDevice::getCacheDirectory(nsI
- nsDiskCacheDevice::getCacheDirectory(nsILocalFile ** result)
- {
-     *result = mCacheDirectory;
--    NS_IF_ADDREF(*result);
- }
- 
- 
-diff --git a/netwerk/cache/src/nsDiskCacheStreams.cpp b/netwerk/cache/src/nsDiskCacheStreams.cpp
---- a/netwerk/cache/src/nsDiskCacheStreams.cpp
-+++ b/netwerk/cache/src/nsDiskCacheStreams.cpp
-@@ -59,7 +59,7 @@
- #ifdef XP_MAC
- #pragma mark nsDiskCacheInputStream
- #endif
--class nsDiskCacheInputStream : public nsIInputStream {
-+class nsDiskCacheInputStream : public XPCOMGCFinalizedObject, public nsIInputStream {
- 
- public:
- 
-@@ -97,7 +97,6 @@ nsDiskCacheInputStream::nsDiskCacheInput
-     , mPos(0)
-     , mClosed(PR_FALSE)
- {
--    NS_ADDREF(mStreamIO);
-     mStreamIO->IncrementInputStreamCount();
- }
- 
-@@ -195,7 +194,7 @@ nsDiskCacheInputStream::IsNonBlocking(PR
- #pragma mark -
- #pragma mark nsDiskCacheOutputStream
- #endif
--class nsDiskCacheOutputStream : public nsIOutputStream {
-+class nsDiskCacheOutputStream : public XPCOMGCFinalizedObject, public nsIOutputStream {
- public:
-     nsDiskCacheOutputStream( nsDiskCacheStreamIO * parent);
-     virtual ~nsDiskCacheOutputStream();
-@@ -206,7 +205,7 @@ public:
-     void ReleaseStreamIO() { NS_IF_RELEASE(mStreamIO); }
- 
- private:
--    nsDiskCacheStreamIO *           mStreamIO;  // backpointer to parent
-+    nsCOMPtr<nsDiskCacheStreamIO>   mStreamIO;  // backpointer to parent
-     PRBool                          mClosed;
- };
- 
-@@ -218,7 +217,6 @@ nsDiskCacheOutputStream::nsDiskCacheOutp
-     : mStreamIO(parent)
-     , mClosed(PR_FALSE)
- {
--    NS_ADDREF(mStreamIO);
- }
- 
- 
-@@ -245,8 +243,8 @@ nsDiskCacheOutputStream::Flush()
- nsDiskCacheOutputStream::Flush()
- {
-     if (mClosed)  return NS_BASE_STREAM_CLOSED;
--    // yeah, yeah, well get to it...eventually...
--    return NS_OK;
-+
-+    return mStreamIO->Flush();
- }
- 
- 
-@@ -318,17 +316,12 @@ nsDiskCacheStreamIO::nsDiskCacheStreamIO
- 
-     // acquire "death grip" on cache service
-     nsCacheService *service = nsCacheService::GlobalInstance();
--    NS_ADDREF(service);
- }
- 
- 
- nsDiskCacheStreamIO::~nsDiskCacheStreamIO()
- {
-     Close();
--
--    // release "death grip" on cache service
--    nsCacheService *service = nsCacheService::GlobalInstance();
--    NS_RELEASE(service);
- }
- 
- 
-@@ -339,7 +332,6 @@ nsDiskCacheStreamIO::Close()
-     // no one is interested in us anymore, so we don't need to grab any locks
-     
-     // assert streams closed
--    NS_ASSERTION(!mOutStream, "output stream still open");
-     NS_ASSERTION(mInStreamCount == 0, "input stream still open");
-     NS_ASSERTION(!mFD, "file descriptor not closed");
- 
-@@ -390,7 +382,7 @@ nsDiskCacheStreamIO::GetInputStream(PRUi
-     nsDiskCacheInputStream * inStream = new nsDiskCacheInputStream(this, fd, mBuffer, mStreamEnd);
-     if (!inStream)  return NS_ERROR_OUT_OF_MEMORY;
-     
--    NS_ADDREF(*inputStream = inStream);
-+    *inputStream = inStream;
-     return NS_OK;
- }
- 
-@@ -426,7 +418,7 @@ nsDiskCacheStreamIO::GetOutputStream(PRU
-     mOutStream = new nsDiskCacheOutputStream(this);
-     if (!mOutStream)  return NS_ERROR_OUT_OF_MEMORY;
-     
--    NS_ADDREF(*outputStream = mOutStream);
-+    *outputStream = mOutStream;
-     return NS_OK;
- }
- 
-diff --git a/netwerk/cache/src/nsDiskCacheStreams.h b/netwerk/cache/src/nsDiskCacheStreams.h
---- a/netwerk/cache/src/nsDiskCacheStreams.h
-+++ b/netwerk/cache/src/nsDiskCacheStreams.h
-@@ -55,7 +55,7 @@ class nsDiskCacheOutputStream;
- class nsDiskCacheOutputStream;
- class nsDiskCacheDevice;
- 
--class nsDiskCacheStreamIO : public nsISupports {
-+class nsDiskCacheStreamIO : public XPCOMGCFinalizedObject, public nsISupports {
- public:
-              nsDiskCacheStreamIO(nsDiskCacheBinding *   binding);
-     virtual ~nsDiskCacheStreamIO();
-@@ -84,9 +84,7 @@ public:
-                     NS_ASSERTION(mInStreamCount >= 0, "mInStreamCount has gone negative");
-                 }
- 
--    // GCC 2.95.2 requires this to be defined, although we never call it.
--    // and OS/2 requires that it not be private
--    nsDiskCacheStreamIO() { NS_NOTREACHED("oops"); }
-+    nsresult    Flush();
- private:
- 
- 
-@@ -96,7 +94,6 @@ private:
-     nsresult    FlushBufferToFile();
-     void        UpdateFileSize();
-     void        DeleteBuffer();
--    nsresult    Flush();
- 
- 
-     nsDiskCacheBinding *        mBinding;       // not an owning reference
-diff --git a/netwerk/dns/src/nsDNSService2.cpp b/netwerk/dns/src/nsDNSService2.cpp
---- a/netwerk/dns/src/nsDNSService2.cpp
-+++ b/netwerk/dns/src/nsDNSService2.cpp
-@@ -196,8 +196,8 @@ nsDNSRecord::Rewind()
- //-----------------------------------------------------------------------------
- 
- class nsDNSAsyncRequest : public XPCOMGCFinalizedObject
-+                        , public nsICancelable
-                         , public nsResolveHostCallback
--                        , public nsICancelable
- {
- public:
-     NS_DECL_ISUPPORTS
-diff --git a/netwerk/test/httpserver/Makefile.in b/netwerk/test/httpserver/Makefile.in
---- a/netwerk/test/httpserver/Makefile.in
-+++ b/netwerk/test/httpserver/Makefile.in
-@@ -43,7 +43,7 @@ VPATH		= @srcdir@
- 
- include $(DEPTH)/config/autoconf.mk
- 
--MODULE          = test_necko
-+MODULE          = test_necko_httpserver
- 
- EXTRA_COMPONENTS = \
-                    httpd.js \
-diff --git a/netwerk/test/unit/test_authentication.js b/netwerk/test/unit/test_authentication.js
---- a/netwerk/test/unit/test_authentication.js
-+++ b/netwerk/test/unit/test_authentication.js
-@@ -276,6 +276,8 @@ function run_test() {
- }
- 
- function test_noauth() {
-+  print('test_noauth\n');
-+
-   var chan = makeChan("http://localhost:4444/auth");
- 
-   listener.expectedCode = 401; // Unauthorized
-@@ -285,6 +287,8 @@ function test_noauth() {
- }
- 
- function test_returnfalse1() {
-+  print('test_returnfalse1\n');
-+
-   var chan = makeChan("http://localhost:4444/auth");
- 
-   chan.notificationCallbacks = new Requestor(FLAG_RETURN_FALSE, 1);
-@@ -295,6 +299,8 @@ function test_returnfalse1() {
- }
- 
- function test_wrongpw1() {
-+  print('test_wrongpw1\n');
-+
-   var chan = makeChan("http://localhost:4444/auth");
- 
-   chan.notificationCallbacks = new Requestor(FLAG_WRONG_PASSWORD, 1);
-@@ -305,6 +311,8 @@ function test_wrongpw1() {
- }
- 
- function test_prompt1() {
-+  print('test_prompt1\n');
-+
-   var chan = makeChan("http://localhost:4444/auth");
- 
-   chan.notificationCallbacks = new Requestor(0, 1);
-@@ -315,6 +323,8 @@ function test_prompt1() {
- }
- 
- function test_returnfalse2() {
-+  print('test_returnfalse2\n');
-+
-   var chan = makeChan("http://localhost:4444/auth");
- 
-   chan.notificationCallbacks = new Requestor(FLAG_RETURN_FALSE, 2);
-@@ -325,6 +335,8 @@ function test_returnfalse2() {
- }
- 
- function test_wrongpw2() {
-+  print('test_wrongpw2\n');
-+
-   var chan = makeChan("http://localhost:4444/auth");
- 
-   chan.notificationCallbacks = new Requestor(FLAG_WRONG_PASSWORD, 2);
-@@ -335,6 +347,8 @@ function test_wrongpw2() {
- }
- 
- function test_prompt2() {
-+  print('test_prompt2\n');
-+
-   var chan = makeChan("http://localhost:4444/auth");
- 
-   chan.notificationCallbacks = new Requestor(0, 2);
-@@ -345,6 +359,8 @@ function test_prompt2() {
- }
- 
- function test_ntlm() {
-+  print('test_ntlm\n');
-+
-   var chan = makeChan("http://localhost:4444/auth/ntlm/simple");
- 
-   chan.notificationCallbacks = new Requestor(FLAG_RETURN_FALSE, 2);
-@@ -355,6 +371,8 @@ function test_ntlm() {
- }
- 
- function test_auth() {
-+  print('test_auth\n');
-+
-   var chan = makeChan("http://localhost:4444/auth/realm");
- 
-   chan.notificationCallbacks = new RealmTestRequestor();
-@@ -365,6 +383,8 @@ function test_auth() {
- }
- 
- function test_digest_noauth() {
-+  print('test_digest_noauth\n');
-+
-   var chan = makeChan("http://localhost:4444/auth/digest");
- 
-   //chan.notificationCallbacks = new Requestor(FLAG_RETURN_FALSE, 2);
-@@ -375,6 +395,8 @@ function test_digest_noauth() {
- }
- 
- function test_digest() {
-+  print('test_digest\n');
-+
-   var chan = makeChan("http://localhost:4444/auth/digest");
- 
-   chan.notificationCallbacks = new Requestor(0, 2);
-@@ -385,6 +407,8 @@ function test_digest() {
- }
- 
- function test_digest_bogus_user() {
-+  print('test_digest_bogus_user\n');
-+
-   var chan = makeChan("http://localhost:4444/auth/digest");
-   chan.notificationCallbacks =  new Requestor(0, 2, "foo\nbar");
-   listener.expectedCode = 401; // unauthorized
deleted file mode 100644
--- a/necko-deadlocks4
+++ /dev/null
@@ -1,47 +0,0 @@
-diff --git a/netwerk/base/src/nsSocketTransportService2.cpp b/netwerk/base/src/nsSocketTransportService2.cpp
---- a/netwerk/base/src/nsSocketTransportService2.cpp
-+++ b/netwerk/base/src/nsSocketTransportService2.cpp
-@@ -83,7 +83,6 @@ nsSocketTransportService::nsSocketTransp
- 
- nsSocketTransportService::~nsSocketTransportService()
- {
--    NS_ASSERTION(NS_IsMainThread(), "wrong thread");
-     NS_ASSERTION(!mInitialized, "not shutdown properly");
- 
-     if (mLock)
-diff --git a/netwerk/protocol/http/src/nsHttpConnectionMgr.h b/netwerk/protocol/http/src/nsHttpConnectionMgr.h
---- a/netwerk/protocol/http/src/nsHttpConnectionMgr.h
-+++ b/netwerk/protocol/http/src/nsHttpConnectionMgr.h
-@@ -87,16 +87,6 @@ public:
-     // NOTE: functions below may be called on any thread.
-     //-------------------------------------------------------------------------
- 
--    void AddRef()
--    {
--	NS_WARNING("Don't call me");
--    }
--
--    void Release()
--    {
--	NS_WARNING("Don't call me");
--    }
--
-     // adds a transaction to the list of managed transactions.
-     nsresult AddTransaction(nsHttpTransaction *, PRInt32 priority);
- 
-diff --git a/netwerk/protocol/http/src/nsHttpHandler.cpp b/netwerk/protocol/http/src/nsHttpHandler.cpp
---- a/netwerk/protocol/http/src/nsHttpHandler.cpp
-+++ b/netwerk/protocol/http/src/nsHttpHandler.cpp
-@@ -192,12 +192,6 @@ nsHttpHandler::~nsHttpHandler()
- 
-     LOG(("Deleting nsHttpHandler [this=%x]\n", this));
- 
--    // make sure the connection manager is shutdown
--    if (mConnMgr) {
--        mConnMgr->Shutdown();
--        NS_RELEASE(mConnMgr);
--    }
--
-     nsHttp::DestroyAtomTable();
- 
-     gHttpHandler = nsnull;
deleted file mode 100644
--- a/necko-deadlocks5
+++ /dev/null
@@ -1,158 +0,0 @@
-diff --git a/netwerk/base/src/nsSocketTransportService2.cpp b/netwerk/base/src/nsSocketTransportService2.cpp
---- a/netwerk/base/src/nsSocketTransportService2.cpp
-+++ b/netwerk/base/src/nsSocketTransportService2.cpp
-@@ -319,6 +319,9 @@ nsSocketTransportService::Poll(PRBool wa
- 
-     if (!wait)
-         pollTimeout = PR_INTERVAL_NO_WAIT;
-+
-+    if (pollTimeout > PR_MillisecondsToInterval(25))
-+      pollTimeout = PR_MillisecondsToInterval(25);
- 
-     PRInt32 rv;
-     PRIntervalTime ts;
-diff --git a/netwerk/cache/src/nsCacheService.cpp b/netwerk/cache/src/nsCacheService.cpp
---- a/netwerk/cache/src/nsCacheService.cpp
-+++ b/netwerk/cache/src/nsCacheService.cpp
-@@ -1232,6 +1232,9 @@ nsCacheService::CreateRequest(nsCacheSes
- 
-     if (!listener)  return NS_OK;  // we're sync, we're done.
- 
-+    // get the request's thread
-+    (*request)->mThread = do_GetCurrentThread();
-+
-     return NS_OK;
- }
- 
-diff --git a/netwerk/protocol/http/src/nsHttpAuthCache.cpp b/netwerk/protocol/http/src/nsHttpAuthCache.cpp
---- a/netwerk/protocol/http/src/nsHttpAuthCache.cpp
-+++ b/netwerk/protocol/http/src/nsHttpAuthCache.cpp
-@@ -79,8 +79,6 @@ nsHttpAuthCache::nsHttpAuthCache()
- 
- nsHttpAuthCache::~nsHttpAuthCache()
- {
--    if (mDB)
--        ClearAll();
- }
- 
- nsresult
-@@ -225,19 +223,20 @@ void *
- void *
- nsHttpAuthCache::AllocTable(void *self, PRSize size)
- {
--    return malloc(size);
-+    return NS_GetGC()->Alloc(size, MMgc::GC::kContainsPointers);
- }
- 
- void
- nsHttpAuthCache::FreeTable(void *self, void *item)
- {
--    free(item);
-+    // do nothing!
- }
- 
- PLHashEntry *
- nsHttpAuthCache::AllocEntry(void *self, const void *key)
- {
--    return (PLHashEntry *) malloc(sizeof(PLHashEntry));
-+    return static_cast<PLHashEntry*>
-+        (NS_GetGC()->Alloc(sizeof(PLHashEntry), MMgc::GC::kContainsPointers));
- }
- 
- void
-@@ -250,14 +249,11 @@ nsHttpAuthCache::FreeEntry(void *self, P
-         NS_NOTREACHED("should never happen");
-     }
-     else if (flag == HT_FREE_ENTRY) {
--        // three wonderful flavors of freeing memory ;-)
--        delete (nsHttpAuthNode *) he->value;
-         nsCRT::free((char *) he->key);
--        free(he);
--    }
--}
--
--PLHashAllocOps nsHttpAuthCache::gHashAllocOps =
-+    }
-+}
-+
-+const PLHashAllocOps nsHttpAuthCache::gHashAllocOps =
- {
-     nsHttpAuthCache::AllocTable,
-     nsHttpAuthCache::FreeTable,
-@@ -443,21 +439,6 @@ nsHttpAuthEntry::Set(const char *path,
- //-----------------------------------------------------------------------------
- // nsHttpAuthNode
- //-----------------------------------------------------------------------------
--
--nsHttpAuthNode::nsHttpAuthNode()
--{
--    LOG(("Creating nsHttpAuthNode @%x\n", this));
--}
--
--nsHttpAuthNode::~nsHttpAuthNode()
--{
--    LOG(("Destroying nsHttpAuthNode @%x\n", this));
--
--    PRInt32 i;
--    for (i=0; i<mList.Count(); ++i)
--        delete (nsHttpAuthEntry *) mList[i];
--    mList.Clear();
--}
- 
- nsHttpAuthEntry *
- nsHttpAuthNode::LookupEntryByPath(const char *path)
-@@ -540,6 +521,5 @@ nsHttpAuthNode::ClearAuthEntry(const cha
-     nsHttpAuthEntry *entry = LookupEntryByRealm(realm);
-     if (entry) {
-         mList.RemoveElement(entry); // double search OK
--        delete entry;
--    }
--}
-+    }
-+}
-diff --git a/netwerk/protocol/http/src/nsHttpAuthCache.h b/netwerk/protocol/http/src/nsHttpAuthCache.h
---- a/netwerk/protocol/http/src/nsHttpAuthCache.h
-+++ b/netwerk/protocol/http/src/nsHttpAuthCache.h
-@@ -104,7 +104,7 @@ private:
- // nsHttpAuthEntry
- //-----------------------------------------------------------------------------
- 
--class nsHttpAuthEntry
-+class nsHttpAuthEntry : public XPCOMGCFinalizedObject
- {
- public:
-     const char *Realm()       const { return mRealm; }
-@@ -161,11 +161,10 @@ private:
- // nsHttpAuthNode
- //-----------------------------------------------------------------------------
- 
--class nsHttpAuthNode
--{
--private:
--    nsHttpAuthNode();
--   ~nsHttpAuthNode();
-+class nsHttpAuthNode : public XPCOMGCObject
-+{
-+private:
-+    nsHttpAuthNode() { }
- 
-     // path can be null, in which case we'll search for an entry
-     // with a null path.
-@@ -187,7 +186,7 @@ private:
-     PRUint32 EntryCount() { return (PRUint32) mList.Count(); }
- 
- private:
--    nsVoidArray mList; // list of nsHttpAuthEntry objects
-+    nsVoidArrayBase<GCAllocator> mList; // list of nsHttpAuthEntry objects
- 
-     friend class nsHttpAuthCache;
- };
-@@ -258,7 +257,7 @@ private:
-     static PLHashEntry* PR_CALLBACK AllocEntry(void *, const void *key);
-     static void         PR_CALLBACK FreeEntry(void *, PLHashEntry *he, PRUintn flag);
- 
--    static PLHashAllocOps gHashAllocOps;
-+    static const PLHashAllocOps gHashAllocOps;
-     
- private:
-     PLHashTable *mDB; // "host:port" --> nsHttpAuthNode
deleted file mode 100644
--- a/necko-deadlocks6
+++ /dev/null
@@ -1,22 +0,0 @@
-diff --git a/netwerk/cache/src/nsDeleteDir.h b/netwerk/cache/src/nsDeleteDir.h
---- a/netwerk/cache/src/nsDeleteDir.h
-+++ b/netwerk/cache/src/nsDeleteDir.h
-@@ -66,6 +66,6 @@ NS_HIDDEN_(nsresult) DeleteDir(nsIFile *
-  * This routine returns the trash directory corresponding to the given 
-  * directory.
-  */
--NS_HIDDEN_(nsresult) GetTrashDir(nsIFile *dir, nsCOMPtr<nsIFile> *result);
-+NS_HIDDEN_(nsresult) GetTrashDir(nsIFile *dir, nsIFile **result);
- 
- #endif  // nsDeleteDir_h__
-diff --git a/netwerk/dns/src/nsHostResolver.cpp b/netwerk/dns/src/nsHostResolver.cpp
---- a/netwerk/dns/src/nsHostResolver.cpp
-+++ b/netwerk/dns/src/nsHostResolver.cpp
-@@ -164,6 +164,7 @@ nsHostRecord::Create(const nsHostKey *ke
-         return NS_ERROR_OUT_OF_MEMORY;
- 
-     size_t hostLen = strlen(key->host) + 1;
-+    size_t size = hostLen + sizeof(nsHostRecord);
- 
-     nsHostRecord *rec = (nsHostRecord*) MMgc::GCFinalizedObject::operator new(size, NS_GetGC());
-     if (!rec) {
--- a/nsSlots
+++ b/nsSlots
@@ -1,8 +1,10 @@
+* * *
+
 diff --git a/content/base/public/nsINode.h b/content/base/public/nsINode.h
 --- a/content/base/public/nsINode.h
 +++ b/content/base/public/nsINode.h
 @@ -538,7 +538,7 @@ public:
  
    // This class can be extended by subclasses that wish to store more
    // information in the slots.
 -  class nsSlots
@@ -234,19 +236,20 @@ diff --git a/content/base/src/nsGenericE
 @@ -926,11 +907,11 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  nsDOMEventRTTearoff::DispatchEvent(nsIDOMEvent *aEvt, PRBool* _retval)
  {
 -  nsCOMPtr<nsIEventListenerManager> listener_manager;
 +  nsIEventListenerManager* listener_manager = nsnull;
    nsresult rv =
 -    mContent->GetListenerManager(PR_TRUE, getter_AddRefs(listener_manager));
+-  NS_ENSURE_SUCCESS(rv, rv);
+-  nsCOMPtr<nsIDOMEventTarget> target = do_QueryInterface(listener_manager);
 +    mContent->GetListenerManager(PR_TRUE, &listener_manager);
-   NS_ENSURE_SUCCESS(rv, rv);
--  nsCOMPtr<nsIDOMEventTarget> target = do_QueryInterface(listener_manager);
++  NS_ENSURE_SUCCESS(rv, rv);
 +  nsIDOMEventTarget* target = do_QueryInterface(listener_manager);
    NS_ENSURE_STATE(target);
    return target->DispatchEvent(aEvt, _retval);
  }
 @@ -942,8 +923,8 @@ nsDOMEventRTTearoff::AddGroupedEventList
                                               PRBool aUseCapture,
                                               nsIDOMEventGroup *aEvtGrp)
  {
@@ -378,39 +381,43 @@ diff --git a/content/base/src/nsGenericE
  
      return SetAttr(kNameSpaceID_None, nameAtom, aValue, PR_TRUE);
 @@ -1440,12 +1416,12 @@ nsGenericElement::GetAttributeNode(const
    NS_ENSURE_ARG_POINTER(aReturn);
    *aReturn = nsnull;
  
 -  nsCOMPtr<nsIDOMNamedNodeMap> map;
 -  nsresult rv = GetAttributes(getter_AddRefs(map));
+-  NS_ENSURE_SUCCESS(rv, rv);
+-
+-  nsCOMPtr<nsIDOMNode> node;
+-  rv = map->GetNamedItem(aName, getter_AddRefs(node));
 +  nsIDOMNamedNodeMap* map = nsnull;
 +  nsresult rv = GetAttributes(&map);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
--  nsCOMPtr<nsIDOMNode> node;
--  rv = map->GetNamedItem(aName, getter_AddRefs(node));
++  NS_ENSURE_SUCCESS(rv, rv);
++
 +  nsIDOMNode* node = nsnull;
 +  rv = map->GetNamedItem(aName, &node);
  
    if (NS_SUCCEEDED(rv) && node) {
      rv = CallQueryInterface(node, aReturn);
 @@ -1463,12 +1439,12 @@ nsGenericElement::SetAttributeNode(nsIDO
  
    *aReturn = nsnull;
  
 -  nsCOMPtr<nsIDOMNamedNodeMap> map;
 -  nsresult rv = GetAttributes(getter_AddRefs(map));
+-  NS_ENSURE_SUCCESS(rv, rv);
+-
+-  nsCOMPtr<nsIDOMNode> returnNode;
+-  rv = map->SetNamedItem(aAttribute, getter_AddRefs(returnNode));
 +  nsIDOMNamedNodeMap* map = nsnull;
 +  nsresult rv = GetAttributes(&map);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
--  nsCOMPtr<nsIDOMNode> returnNode;
--  rv = map->SetNamedItem(aAttribute, getter_AddRefs(returnNode));
++  NS_ENSURE_SUCCESS(rv, rv);
++
 +  nsIDOMNode* returnNode = nsnull;
 +  rv = map->SetNamedItem(aAttribute, &returnNode);
    NS_ENSURE_SUCCESS(rv, rv);
  
    if (returnNode) {
 @@ -1487,16 +1463,16 @@ nsGenericElement::RemoveAttributeNode(ns
  
    *aReturn = nsnull;
@@ -479,39 +486,43 @@ diff --git a/content/base/src/nsGenericE
      nsContentUtils::NameSpaceManager()->GetNameSpaceID(aNamespaceURI);
  
 @@ -1589,12 +1565,12 @@ nsGenericElement::GetAttributeNodeNS(con
  
    *aReturn = nsnull;
  
 -  nsCOMPtr<nsIDOMNamedNodeMap> map;
 -  nsresult rv = GetAttributes(getter_AddRefs(map));
+-  NS_ENSURE_SUCCESS(rv, rv);
+-
+-  nsCOMPtr<nsIDOMNode> node;
+-  rv = map->GetNamedItemNS(aNamespaceURI, aLocalName, getter_AddRefs(node));
 +  nsIDOMNamedNodeMap* map = nsnull;
 +  nsresult rv = GetAttributes(&map);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
--  nsCOMPtr<nsIDOMNode> node;
--  rv = map->GetNamedItemNS(aNamespaceURI, aLocalName, getter_AddRefs(node));
++  NS_ENSURE_SUCCESS(rv, rv);
++
 +  nsIDOMNode* node = nsnull;
 +  rv = map->GetNamedItemNS(aNamespaceURI, aLocalName, &node);
  
    if (NS_SUCCEEDED(rv) && node) {
      rv = CallQueryInterface(node, aReturn);
 @@ -1612,12 +1588,12 @@ nsGenericElement::SetAttributeNodeNS(nsI
  
    *aReturn = nsnull;
  
 -  nsCOMPtr<nsIDOMNamedNodeMap> map;
 -  nsresult rv = GetAttributes(getter_AddRefs(map));
+-  NS_ENSURE_SUCCESS(rv, rv);
+-
+-  nsCOMPtr<nsIDOMNode> returnNode;
+-  rv = map->SetNamedItemNS(aNewAttr, getter_AddRefs(returnNode));
 +  nsIDOMNamedNodeMap* map = nsnull;
 +  nsresult rv = GetAttributes(&map);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
--  nsCOMPtr<nsIDOMNode> returnNode;
--  rv = map->SetNamedItemNS(aNewAttr, getter_AddRefs(returnNode));
++  NS_ENSURE_SUCCESS(rv, rv);
++
 +  nsIDOMNode* returnNode = nsnull;
 +  rv = map->SetNamedItemNS(aNewAttr, &returnNode);
    NS_ENSURE_SUCCESS(rv, rv);
  
    if (returnNode) {
 @@ -1641,10 +1617,10 @@ nsGenericElement::GetElementsByTagNameNS
      NS_ENSURE_SUCCESS(rv, rv);
    }
@@ -534,20 +545,22 @@ diff --git a/content/base/src/nsGenericE
    *aReturn = HasAttr(nsid, name);
  
    return NS_OK;
 @@ -1692,10 +1668,10 @@ nsGenericElement::JoinTextNodes(nsIConte
                                  nsIContent* aSecond)
  {
    nsresult rv = NS_OK;
 -  nsCOMPtr<nsIDOMText> firstText(do_QueryInterface(aFirst, &rv));
+-
+-  if (NS_SUCCEEDED(rv)) {
+-    nsCOMPtr<nsIDOMText> secondText(do_QueryInterface(aSecond, &rv));
 +  nsIDOMText* firstText(do_QueryInterface(aFirst, &rv));
- 
-   if (NS_SUCCEEDED(rv)) {
--    nsCOMPtr<nsIDOMText> secondText(do_QueryInterface(aSecond, &rv));
++
++  if (NS_SUCCEEDED(rv)) {
 +    nsIDOMText* secondText(do_QueryInterface(aSecond, &rv));
  
      if (NS_SUCCEEDED(rv)) {
        nsAutoString str;
 @@ -1722,7 +1698,7 @@ nsGenericElement::Normalize()
    for (index = 0; (index < count) && (NS_OK == result); index++) {
      nsIContent *child = GetChildAt(index);
  
@@ -639,41 +652,25 @@ diff --git a/content/base/src/nsGenericE
  
      aVisitor.mEventTargetAtParent = parent;
    } else if (parent) {
 -    nsCOMPtr<nsIContent> content(do_QueryInterface(aVisitor.mEvent->target));
 +    nsIContent* content(do_QueryInterface(aVisitor.mEvent->target));
      if (content && content->GetBindingParent() == parent) {
        aVisitor.mEventTargetAtParent = parent;
      }
-@@ -2275,7 +2251,7 @@ nsGenericElement::FindAttributeDependenc
-   return PR_FALSE;
- }
- 
--already_AddRefed<nsINodeInfo>
-+nsINodeInfo*
- nsGenericElement::GetExistingAttrNameFromQName(const nsAString& aStr) const
- {
-   const nsAttrName* name = InternalGetExistingAttrNameFromQName(aStr);
-@@ -2289,13 +2265,13 @@ nsGenericElement::GetExistingAttrNameFro
+@@ -2289,7 +2265,7 @@ nsGenericElement::GetExistingAttrNameFro
                                                kNameSpaceID_None, &nodeInfo);
    }
    else {
 -    NS_ADDREF(nodeInfo = name->NodeInfo());
 +    nodeInfo = name->NodeInfo();
    }
  
    return nodeInfo;
- }
- 
--already_AddRefed<nsIURI>
-+nsIURI*
- nsGenericElement::GetBaseURI() const
- {
-   nsIDocument* doc = GetOwnerDoc();
 @@ -2308,7 +2284,7 @@ nsGenericElement::GetBaseURI() const
  
    // Our base URL depends on whether we have an xml:base attribute, as
    // well as on whether any of our ancestors do.
 -  nsCOMPtr<nsIURI> parentBase;
 +  nsIURI* parentBase = nsnull;
  
    nsIContent *parent = GetParent();
@@ -772,133 +769,133 @@ diff --git a/content/base/src/nsGenericE
      return NS_OK;
    }
  
 -  nsCOMPtr<nsIPresShell> shell = aPresContext->GetPresShell();
 +  nsIPresShell* shell = aPresContext->GetPresShell();
    if (!shell) {
      return NS_OK;
    }
-@@ -2815,7 +2790,7 @@ PRBool IsAllowedAsChild(nsIContent* aNew
+@@ -2831,7 +2806,7 @@ PRBool IsAllowedAsChild(nsIContent* aNew
                    "Must have ref content for replace");
  #ifdef DEBUG
    PRUint16 debugNodeType = 0;
 -  nsCOMPtr<nsIDOMNode> debugNode(do_QueryInterface(aNewChild));
 +  nsIDOMNode* debugNode(do_QueryInterface(aNewChild));
    nsresult debugRv = debugNode->GetNodeType(&debugNodeType);
  
    NS_PRECONDITION(NS_SUCCEEDED(debugRv) && debugNodeType == aNewNodeType,
-@@ -2859,11 +2834,11 @@ PRBool IsAllowedAsChild(nsIContent* aNew
+@@ -2875,11 +2850,11 @@ PRBool IsAllowedAsChild(nsIContent* aNew
        }
  
        // Now grovel for a doctype
 -      nsCOMPtr<nsIDOMDocument> doc = do_QueryInterface(aDocument);
 +      nsIDOMDocument* doc = do_QueryInterface(aDocument);
        NS_ASSERTION(doc, "Shouldn't happen");
 -      nsCOMPtr<nsIDOMDocumentType> docType;
 -      doc->GetDoctype(getter_AddRefs(docType));
 -      nsCOMPtr<nsIContent> docTypeContent = do_QueryInterface(docType);
 +      nsIDOMDocumentType* docType = nsnull;
 +      doc->GetDoctype(&docType);
 +      nsIContent* docTypeContent = do_QueryInterface(docType);
        
        if (!docTypeContent) {
          // It's all good.
-@@ -2886,11 +2861,11 @@ PRBool IsAllowedAsChild(nsIContent* aNew
+@@ -2902,11 +2877,11 @@ PRBool IsAllowedAsChild(nsIContent* aNew
          return PR_FALSE;
        }
  
 -      nsCOMPtr<nsIDOMDocument> doc = do_QueryInterface(aDocument);
 +      nsIDOMDocument* doc = do_QueryInterface(aDocument);
        NS_ASSERTION(doc, "Shouldn't happen");
 -      nsCOMPtr<nsIDOMDocumentType> docType;
 -      doc->GetDoctype(getter_AddRefs(docType));
 -      nsCOMPtr<nsIContent> docTypeContent = do_QueryInterface(docType);
 +      nsIDOMDocumentType* docType = nsnull;
 +      doc->GetDoctype(&docType);
 +      nsIContent* docTypeContent = do_QueryInterface(docType);
        if (docTypeContent) {
          // Already have a doctype, so this is only OK if we're replacing it
          return aIsReplace && docTypeContent == aRefContent;
-@@ -2941,7 +2916,7 @@ PRBool IsAllowedAsChild(nsIContent* aNew
+@@ -2957,7 +2932,7 @@ PRBool IsAllowedAsChild(nsIContent* aNew
          }
          // If we can put this content at the the right place, we might be ok;
          // if not, we bail out.
 -        nsCOMPtr<nsIDOMNode> childNode(do_QueryInterface(childContent));
 +        nsIDOMNode* childNode(do_QueryInterface(childContent));
          PRUint16 type;
          childNode->GetNodeType(&type);
          if (!IsAllowedAsChild(childContent, type, aParent, aDocument,
-@@ -2984,9 +2959,9 @@ nsGenericElement::doReplaceOrInsertBefor
+@@ -3000,9 +2975,9 @@ nsGenericElement::doReplaceOrInsertBefor
  
    // Keep a strong reference to the node that we'll return to ensure it
    // doesn't go away.
 -  nsCOMPtr<nsIDOMNode> returnVal = aReplace ? aRefChild : aNewChild;
 -
 -  nsCOMPtr<nsIContent> refContent;
 +  nsIDOMNode* returnVal = aReplace ? aRefChild : aNewChild;
 +
 +  nsIContent* refContent = nsnull;
    nsresult res = NS_OK;
    PRInt32 insPos;
  
-@@ -3001,7 +2976,7 @@ nsGenericElement::doReplaceOrInsertBefor
+@@ -3017,7 +2992,7 @@ nsGenericElement::doReplaceOrInsertBefor
      }
  
      if (aRefChild == aNewChild) {
 -      NS_ADDREF(*aReturn = aNewChild);
 +      *aReturn = aNewChild;
  
        return NS_OK;
      }
-@@ -3009,7 +2984,7 @@ nsGenericElement::doReplaceOrInsertBefor
+@@ -3025,7 +3000,7 @@ nsGenericElement::doReplaceOrInsertBefor
      insPos = container->GetChildCount();
    }
  
 -  nsCOMPtr<nsIContent> newContent = do_QueryInterface(aNewChild);
 +  nsIContent* newContent = do_QueryInterface(aNewChild);
    if (!newContent) {
      return NS_ERROR_DOM_HIERARCHY_REQUEST_ERR;
    }
-@@ -3122,7 +3097,7 @@ nsGenericElement::doReplaceOrInsertBefor
+@@ -3138,7 +3113,7 @@ nsGenericElement::doReplaceOrInsertBefor
            return NS_ERROR_DOM_NOT_FOUND_ERR;
          }
  
 -        nsCOMPtr<nsIDOMNode> tmpNode = do_QueryInterface(childContent);
 +        nsIDOMNode* tmpNode = do_QueryInterface(childContent);
          PRUint16 tmpType = 0;
          tmpNode->GetNodeType(&tmpType);
  
-@@ -3202,7 +3177,7 @@ nsGenericElement::doReplaceOrInsertBefor
+@@ -3218,7 +3193,7 @@ nsGenericElement::doReplaceOrInsertBefor
      NS_ENSURE_SUCCESS(res, res);
    }
  
 -  returnVal.swap(*aReturn);
 +  swap(returnVal, *aReturn);
  
    return res;
  }
-@@ -3221,7 +3196,7 @@ nsGenericElement::doRemoveChild(nsIDOMNo
+@@ -3237,7 +3212,7 @@ nsGenericElement::doRemoveChild(nsIDOMNo
  
    nsINode* container = NODE_FROM(aParent, aDocument);
  
 -  nsCOMPtr<nsIContent> content = do_QueryInterface(aOldChild);
 +  nsIContent* content = do_QueryInterface(aOldChild);
    // fix children to be a passed argument
    PRInt32 index = container->IndexOf(content);
    if (index == -1) {
-@@ -3232,7 +3207,6 @@ nsGenericElement::doRemoveChild(nsIDOMNo
+@@ -3248,7 +3223,6 @@ nsGenericElement::doRemoveChild(nsIDOMNo
    nsresult rv = container->RemoveChildAt(index, PR_TRUE);
  
    *aReturn = aOldChild;
 -  NS_ADDREF(aOldChild);
  
    return rv;
  }
-@@ -3303,12 +3277,12 @@ nsGenericElement::AddScriptEventListener
+@@ -3323,12 +3297,12 @@ nsGenericElement::AddScriptEventListener
    }
  
    NS_PRECONDITION(aEventName, "Must have event name!");
 -  nsCOMPtr<nsISupports> target;
 +  nsISupports* target = nsnull;
    PRBool defer = PR_TRUE;
 -  nsCOMPtr<nsIEventListenerManager> manager;
 -
@@ -906,176 +903,176 @@ diff --git a/content/base/src/nsGenericE
 -                                               getter_AddRefs(target),
 +  nsIEventListenerManager* manager = nsnull;
 +
 +  nsresult rv = GetEventListenerManagerForAttr(&manager,
 +                                               &target,
                                                 &defer);
    NS_ENSURE_SUCCESS(rv, rv);
  
-@@ -3459,10 +3433,10 @@ nsGenericElement::SetAttrAndNotify(PRInt
+@@ -3479,10 +3453,10 @@ nsGenericElement::SetAttrAndNotify(PRInt
      }
    }
    else {
 -    nsCOMPtr<nsINodeInfo> ni;
 +    nsINodeInfo* ni = nsnull;
      rv = mNodeInfo->NodeInfoManager()->GetNodeInfo(aName, aPrefix,
                                                     aNamespaceID,
 -                                                   getter_AddRefs(ni));
 +                                                   &ni);
      NS_ENSURE_SUCCESS(rv, rv);
  
      rv = mAttrsAndChildren.SetAndTakeAttr(ni, aParsedValue);
-@@ -3470,7 +3444,7 @@ nsGenericElement::SetAttrAndNotify(PRInt
+@@ -3490,7 +3464,7 @@ nsGenericElement::SetAttrAndNotify(PRInt
    NS_ENSURE_SUCCESS(rv, rv);
  
    if (document) {
 -    nsRefPtr<nsXBLBinding> binding =
 +    nsXBLBinding* binding =
        document->BindingManager()->GetBinding(this);
      if (binding) {
        binding->AttributeChanged(aName, aNamespaceID, PR_FALSE, aNotify);
-@@ -3492,10 +3466,10 @@ nsGenericElement::SetAttrAndNotify(PRInt
+@@ -3512,10 +3486,10 @@ nsGenericElement::SetAttrAndNotify(PRInt
  
      nsAutoString attrName;
      aName->ToString(attrName);
 -    nsCOMPtr<nsIDOMAttr> attrNode;
 +    nsIDOMAttr* attrNode = nsnull;
      nsAutoString ns;
      nsContentUtils::NameSpaceManager()->GetNameSpaceURI(aNamespaceID, ns);
 -    GetAttributeNodeNS(ns, attrName, getter_AddRefs(attrNode));
 +    GetAttributeNodeNS(ns, attrName, &attrNode);
      mutation.mRelatedNode = attrNode;
  
      mutation.mAttrName = aName;
-@@ -3555,7 +3529,7 @@ nsGenericElement::GetEventListenerManage
+@@ -3575,7 +3549,7 @@ nsGenericElement::GetEventListenerManage
  {
    nsresult rv = GetListenerManager(PR_TRUE, aManager);
    if (NS_SUCCEEDED(rv)) {
 -    NS_ADDREF(*aTarget = static_cast<nsIContent*>(this));
 +    *aTarget = static_cast<nsIContent*>(this);
    }
    *aDefer = PR_TRUE;
    return rv;
-@@ -3697,13 +3671,13 @@ nsGenericElement::UnsetAttr(PRInt32 aNam
+@@ -3720,13 +3694,13 @@ nsGenericElement::UnsetAttr(PRInt32 aNam
                                           this);
  
    // Grab the attr node if needed before we remove it from the attr map
 -  nsCOMPtr<nsIDOMAttr> attrNode;
 +  nsIDOMAttr* attrNode = nsnull;
    if (hasMutationListeners) {
      nsAutoString attrName;
      aName->ToString(attrName);
      nsAutoString ns;
      nsContentUtils::NameSpaceManager()->GetNameSpaceURI(aNameSpaceID, ns);
 -    GetAttributeNodeNS(ns, attrName, getter_AddRefs(attrNode));
 +    GetAttributeNodeNS(ns, attrName, &attrNode);
    }
  
    // Clear binding to nsIDOMNamedNodeMap
-@@ -3717,7 +3691,7 @@ nsGenericElement::UnsetAttr(PRInt32 aNam
+@@ -3740,7 +3714,7 @@ nsGenericElement::UnsetAttr(PRInt32 aNam
    NS_ENSURE_SUCCESS(rv, rv);
  
    if (document) {
 -    nsRefPtr<nsXBLBinding> binding =
 +    nsXBLBinding* binding =
        document->BindingManager()->GetBinding(this);
      if (binding)
        binding->AttributeChanged(aName, aNameSpaceID, PR_TRUE, aNotify);
-@@ -3735,7 +3709,7 @@ nsGenericElement::UnsetAttr(PRInt32 aNam
+@@ -3758,7 +3732,7 @@ nsGenericElement::UnsetAttr(PRInt32 aNam
    }
  
    if (hasMutationListeners) {
 -    nsCOMPtr<nsIDOMEventTarget> node =
 +    nsIDOMEventTarget* node =
        do_QueryInterface(static_cast<nsIContent *>(this));
      nsMutationEvent mutation(PR_TRUE, NS_MUTATION_ATTRMODIFIED);
  
-@@ -3883,9 +3857,9 @@ nsGenericElement::List(FILE* out, PRInt3
+@@ -3906,9 +3880,9 @@ nsGenericElement::List(FILE* out, PRInt3
      // Note: not listing nsIAnonymousContentCreator-created content...
  
      nsBindingManager* bindingManager = document->BindingManager();
 -    nsCOMPtr<nsIDOMNodeList> anonymousChildren;
 +    nsIDOMNodeList* anonymousChildren = nsnull;
      bindingManager->GetAnonymousNodesFor(nonConstThis,
 -                                         getter_AddRefs(anonymousChildren));
 +                                         &anonymousChildren);
  
      if (anonymousChildren) {
        anonymousChildren->GetLength(&length);
-@@ -3894,9 +3868,9 @@ nsGenericElement::List(FILE* out, PRInt3
+@@ -3917,9 +3891,9 @@ nsGenericElement::List(FILE* out, PRInt3
          fputs("anonymous-children<\n", out);
  
          for (i = 0; i < length; ++i) {
 -          nsCOMPtr<nsIDOMNode> node;
 -          anonymousChildren->Item(i, getter_AddRefs(node));
 -          nsCOMPtr<nsIContent> child = do_QueryInterface(node);
 +          nsIDOMNode* node = nsnull;
 +          anonymousChildren->Item(i, &node);
 +          nsIContent* child = do_QueryInterface(node);
            child->List(out, aIndent + 1);
          }
  
-@@ -3906,9 +3880,9 @@ nsGenericElement::List(FILE* out, PRInt3
+@@ -3929,9 +3903,9 @@ nsGenericElement::List(FILE* out, PRInt3
      }
  
      if (bindingManager->HasContentListFor(nonConstThis)) {
 -      nsCOMPtr<nsIDOMNodeList> contentList;
 +      nsIDOMNodeList* contentList = nsnull;
        bindingManager->GetContentListFor(nonConstThis,
 -                                        getter_AddRefs(contentList));
 +                                        &contentList);
  
        NS_ASSERTION(contentList != nsnull, "oops, binding manager lied");
  
-@@ -3918,9 +3892,9 @@ nsGenericElement::List(FILE* out, PRInt3
+@@ -3941,9 +3915,9 @@ nsGenericElement::List(FILE* out, PRInt3
          fputs("content-list<\n", out);
  
          for (i = 0; i < length; ++i) {
 -          nsCOMPtr<nsIDOMNode> node;
 -          contentList->Item(i, getter_AddRefs(node));
 -          nsCOMPtr<nsIContent> child = do_QueryInterface(node);
 +          nsIDOMNode* node = nsnull;
 +          contentList->Item(i, &node);
 +          nsIContent* child = do_QueryInterface(node);
            child->List(out, aIndent + 1);
          }
  
-@@ -4018,8 +3992,8 @@ nsGenericElement::PreHandleEventForLinks
+@@ -4041,8 +4015,8 @@ nsGenericElement::PreHandleEventForLinks
    }
  
    // Make sure we meet the preconditions before continuing
 -  nsCOMPtr<nsIURI> absURI;
 -  if (!CheckHandleEventForLinksPrecondition(aVisitor, getter_AddRefs(absURI))) {
 +  nsIURI* absURI = nsnull;
 +  if (!CheckHandleEventForLinksPrecondition(aVisitor, &absURI)) {
      return NS_OK;
    }
  
-@@ -4073,8 +4047,8 @@ nsGenericElement::PostHandleEventForLink
+@@ -4096,8 +4070,8 @@ nsGenericElement::PostHandleEventForLink
    }
  
    // Make sure we meet the preconditions before continuing
 -  nsCOMPtr<nsIURI> absURI;
 -  if (!CheckHandleEventForLinksPrecondition(aVisitor, getter_AddRefs(absURI))) {
 +  nsIURI* absURI = nsnull;
 +  if (!CheckHandleEventForLinksPrecondition(aVisitor, &absURI)) {
      return NS_OK;
    }
  
-@@ -4101,7 +4075,7 @@ nsGenericElement::PostHandleEventForLink
+@@ -4124,7 +4098,7 @@ nsGenericElement::PostHandleEventForLink
                PRBool isActive = PR_FALSE;
                focusController->GetActive(&isActive);
                if (!isActive) {
 -                nsCOMPtr<nsIDOMElement> domElement = do_QueryInterface(this);
 +                nsIDOMElement* domElement = do_QueryInterface(this);
                  if(domElement)
                    focusController->SetFocusedElement(domElement);
                  break;
-@@ -4125,7 +4099,7 @@ nsGenericElement::PostHandleEventForLink
+@@ -4148,7 +4122,7 @@ nsGenericElement::PostHandleEventForLink
        }
  
        // The default action is simply to dispatch DOMActivate
 -      nsCOMPtr<nsIPresShell> shell = aVisitor.mPresContext->GetPresShell();
 +      nsIPresShell* shell = aVisitor.mPresContext->GetPresShell();
        if (shell) {
          // single-click
          nsEventStatus status = nsEventStatus_eIgnore;
@@ -1105,24 +1102,21 @@ diff --git a/content/base/src/nsGenericE
   */
  
 -class nsNodeWeakReference : public nsIWeakReference
 +class nsNodeWeakReference : public XPCOMGCFinalizedObject, public nsIWeakReference
  {
  public:
    nsNodeWeakReference(nsINode* aNode)
 -    : mNode(aNode)
--  {
--  }
--
++    : mRef(NS_GetGC()->GetWeakRef(aNode))
+   {
+   }
+ 
 -  ~nsNodeWeakReference();
-+    : mRef(NS_GetGC()->GetWeakRef(aNode))
-+  {
-+  }
-+
 +  ~nsNodeWeakReference()
 +  {
 +  }
  
    // nsISupports
    NS_DECL_ISUPPORTS
 @@ -161,19 +163,14 @@ public:
    // nsIWeakReference
@@ -1141,76 +1135,58 @@ diff --git a/content/base/src/nsGenericE
  /**
   * Tearoff to use for nodes to implement nsISupportsWeakReference
   */
 -class nsNodeSupportsWeakRefTearoff : public nsISupportsWeakReference
 +class nsNodeSupportsWeakRefTearoff : public XPCOMGCFinalizedObject, public nsISupportsWeakReference
  {
  public:
    nsNodeSupportsWeakRefTearoff(nsINode* aNode)
-@@ -375,7 +372,7 @@ public:
-                               PRBool aNullParent = PR_TRUE);
-   virtual nsIAtom *GetIDAttributeName() const;
-   virtual nsIAtom *GetClassAttributeName() const;
--  virtual already_AddRefed<nsINodeInfo> GetExistingAttrNameFromQName(const nsAString& aStr) const;
-+  virtual nsINodeInfo* GetExistingAttrNameFromQName(const nsAString& aStr) const;
-   nsresult SetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
-                    const nsAString& aValue, PRBool aNotify)
-   {
-@@ -416,7 +413,7 @@ public:
-   virtual void SetFocus(nsPresContext* aContext);
-   virtual nsIContent *GetBindingParent() const;
-   virtual PRBool IsNodeOfType(PRUint32 aFlags) const;
--  virtual already_AddRefed<nsIURI> GetBaseURI() const;
-+  virtual nsIURI* GetBaseURI() const;
-   virtual PRBool IsLink(nsIURI** aURI) const;
-   virtual void SetMayHaveFrame(PRBool aMayHaveFrame);
-   virtual PRBool MayHaveFrame() const;
-@@ -574,7 +571,7 @@ public:
+@@ -575,7 +572,7 @@ public:
                                       const nsAString& aVersion,
                                       nsISupports** aReturn);
    
 -  static already_AddRefed<nsIDOMNSFeatureFactory>
 +  static nsIDOMNSFeatureFactory*
      GetDOMFeatureFactory(const nsAString& aFeature, const nsAString& aVersion);
  
    static PRBool ShouldFocus(nsIContent *aContent);
-@@ -891,7 +888,6 @@ public:
+@@ -888,7 +885,6 @@ public:
    {
    public:
      nsDOMSlots(PtrBits aFlags);
 -    virtual ~nsDOMSlots();
  
      /**
       * The .style attribute (an interface that forwards to the actual
-@@ -917,11 +913,6 @@ public:
+@@ -914,11 +910,6 @@ public:
        */
        nsIControllers* mControllers; // [OWNER]
      };
 -    
 -    /**
 -     * Weak reference to this node
 -     */
 -    nsNodeWeakReference* mWeakReference;
    };
  
  protected:
-@@ -1042,7 +1033,7 @@ _elementName::Clone(nsINodeInfo *aNodeIn
+@@ -1039,7 +1030,7 @@ _elementName::Clone(nsINodeInfo *aNodeIn
   * Yet another tearoff class for nsGenericElement
   * to implement additional interfaces
   */
 -class nsNSElementTearoff : public nsIDOMNSElement
 +class nsNSElementTearoff : public XPCOMGCFinalizedObject, public nsIDOMNSElement
  {
  public:
    NS_DECL_CYCLE_COLLECTING_ISUPPORTS
 diff --git a/content/base/src/nsNodeUtils.cpp b/content/base/src/nsNodeUtils.cpp
 --- a/content/base/src/nsNodeUtils.cpp
 +++ b/content/base/src/nsNodeUtils.cpp
-@@ -183,60 +183,6 @@ nsNodeUtils::ParentChainChanged(nsIConte
+@@ -184,60 +184,6 @@ nsNodeUtils::ParentChainChanged(nsIConte
    }
  }
  
 -void
 -nsNodeUtils::LastRelease(nsINode* aNode)
 -{
 -  nsINode::nsSlots* slots = aNode->GetExistingSlots();
 -  if (slots) {
@@ -1261,128 +1237,128 @@ diff --git a/content/base/src/nsNodeUtil
 -  }
 -
 -  delete aNode;
 -}
 -
  static nsresult
  SetUserDataProperty(PRUint16 aCategory, nsINode *aNode, nsIAtom *aKey,
                      nsISupports* aValue, void** aOldValue)
-@@ -247,7 +193,6 @@ SetUserDataProperty(PRUint16 aCategory, 
+@@ -248,7 +194,6 @@ SetUserDataProperty(PRUint16 aCategory, 
    NS_ENSURE_SUCCESS(rv, rv);
  
    // Property table owns it now.
 -  NS_ADDREF(aValue);
  
    return NS_OK;
  }
-@@ -260,7 +205,7 @@ nsNodeUtils::SetUserData(nsINode *aNode,
+@@ -261,7 +206,7 @@ nsNodeUtils::SetUserData(nsINode *aNode,
  {
    *aResult = nsnull;
  
 -  nsCOMPtr<nsIAtom> key = do_GetAtom(aKey);
 +  nsIAtom* key = do_GetAtom(aKey);
    if (!key) {
      return NS_ERROR_OUT_OF_MEMORY;
    }
-@@ -276,12 +221,12 @@ nsNodeUtils::SetUserData(nsINode *aNode,
+@@ -277,12 +222,12 @@ nsNodeUtils::SetUserData(nsINode *aNode,
    }
  
    // Take over ownership of the old data from the property table.
 -  nsCOMPtr<nsIVariant> oldData = dont_AddRef(static_cast<nsIVariant*>(data));
 +  nsIVariant* oldData = dont_AddRef(static_cast<nsIVariant*>(data));
  
    if (aData && aHandler) {
 -    nsCOMPtr<nsIDOMUserDataHandler> oldHandler;
 +    nsIDOMUserDataHandler* oldHandler = nsnull;
      rv = SetUserDataProperty(DOM_USER_DATA_HANDLER, aNode, key, aHandler,
 -                             getter_AddRefs(oldHandler));
 +                             (void**)&oldHandler);
      if (NS_FAILED(rv)) {
        // We failed to set the handler, remove the data.
        aNode->DeleteProperty(DOM_USER_DATA, key);
-@@ -293,7 +238,7 @@ nsNodeUtils::SetUserData(nsINode *aNode,
+@@ -294,7 +239,7 @@ nsNodeUtils::SetUserData(nsINode *aNode,
      aNode->DeleteProperty(DOM_USER_DATA_HANDLER, key);
    }
  
 -  oldData.swap(*aResult);
 +  swap(oldData, *aResult);
  
    return NS_OK;
  }
-@@ -303,14 +248,13 @@ nsNodeUtils::GetUserData(nsINode *aNode,
+@@ -304,14 +249,13 @@ nsNodeUtils::GetUserData(nsINode *aNode,
  nsNodeUtils::GetUserData(nsINode *aNode, const nsAString &aKey,
                           nsIVariant **aResult)
  {
 -  nsCOMPtr<nsIAtom> key = do_GetAtom(aKey);
 +  nsIAtom* key = do_GetAtom(aKey);
    if (!key) {
      return NS_ERROR_OUT_OF_MEMORY;
    }
  
    *aResult = static_cast<nsIVariant*>
                          (aNode->GetProperty(DOM_USER_DATA, key));
 -  NS_IF_ADDREF(*aResult);
  
    return NS_OK;
  }
-@@ -325,10 +269,10 @@ CallHandler(void *aObject, nsIAtom *aKey
+@@ -326,10 +270,10 @@ CallHandler(void *aObject, nsIAtom *aKey
  CallHandler(void *aObject, nsIAtom *aKey, void *aHandler, void *aData)
  {
    nsHandlerData *handlerData = static_cast<nsHandlerData*>(aData);
 -  nsCOMPtr<nsIDOMUserDataHandler> handler =
 +  nsIDOMUserDataHandler* handler =
      static_cast<nsIDOMUserDataHandler*>(aHandler);
    nsINode *node = static_cast<nsINode*>(aObject);
 -  nsCOMPtr<nsIVariant> data =
 +  nsIVariant* data =
      static_cast<nsIVariant*>(node->GetProperty(DOM_USER_DATA, aKey));
    NS_ASSERTION(data, "Handler without data?");
  
-@@ -352,7 +296,7 @@ nsNodeUtils::CallUserDataHandlers(nsCOMA
+@@ -353,7 +297,7 @@ nsNodeUtils::CallUserDataHandlers(nsCOMA
  
    // Keep the document alive, just in case one of the handlers causes it to go
    // away.
 -  nsCOMPtr<nsIDocument> ownerDoc = aOwnerDocument;
 +  nsIDocument* ownerDoc = aOwnerDocument;
  
    nsHandlerData handlerData;
    handlerData.mOperation = aOperation;
-@@ -383,10 +327,10 @@ nsNodeUtils::CloneNodeImpl(nsINode *aNod
+@@ -384,10 +328,10 @@ nsNodeUtils::CloneNodeImpl(nsINode *aNod
  {
    *aResult = nsnull;
  
 -  nsCOMPtr<nsIDOMNode> newNode;
 +  nsIDOMNode* newNode = nsnull;
    nsCOMArray<nsINode> nodesWithProperties;
    nsresult rv = Clone(aNode, aDeep, nsnull, nodesWithProperties,
 -                      getter_AddRefs(newNode));
 +                      &newNode);
    NS_ENSURE_SUCCESS(rv, rv);
  
    nsIDocument *ownerDoc = aNode->GetOwnerDoc();
-@@ -396,7 +340,7 @@ nsNodeUtils::CloneNodeImpl(nsINode *aNod
+@@ -397,7 +341,7 @@ nsNodeUtils::CloneNodeImpl(nsINode *aNod
      NS_ENSURE_SUCCESS(rv, rv);
    }
  
 -  newNode.swap(*aResult);
 +  swap(newNode, *aResult);
  
    return NS_OK;
  }
-@@ -426,7 +370,7 @@ PLDHashOperator PR_CALLBACK
+@@ -427,7 +371,7 @@ PLDHashOperator PR_CALLBACK
  PLDHashOperator PR_CALLBACK
  AdoptFunc(nsAttrHashKey::KeyType aKey, nsIDOMNode *aData, void* aUserArg)
  {
 -  nsCOMPtr<nsIAttribute> attr = do_QueryInterface(aData);
 +  nsIAttribute* attr = do_QueryInterface(aData);
    NS_ASSERTION(attr, "non-nsIAttribute somehow made it into the hashmap?!");
  
    AdoptFuncData *data = static_cast<AdoptFuncData*>(aUserArg);
-@@ -434,18 +378,18 @@ AdoptFunc(nsAttrHashKey::KeyType aKey, n
+@@ -435,18 +379,18 @@ AdoptFunc(nsAttrHashKey::KeyType aKey, n
    // If we were passed an element we need to clone the attribute nodes and
    // insert them into the element.
    PRBool clone = data->mElement != nsnull;
 -  nsCOMPtr<nsIDOMNode> node;
 +  nsIDOMNode* node = nsnull;
    nsresult rv = nsNodeUtils::CloneAndAdopt(attr, clone, PR_TRUE,
                                             data->mNewNodeInfoManager,
                                             data->mCx, data->mOldScope,
@@ -1395,32 +1371,32 @@ diff --git a/content/base/src/nsNodeUtil
 -    nsCOMPtr<nsIDOMAttr> dummy, attribute = do_QueryInterface(node, &rv);
 +    nsIDOMAttr* dummy = nsnull, *attribute = do_QueryInterface(node, &rv);
      if (NS_SUCCEEDED(rv)) {
 -      rv = data->mElement->SetAttributeNode(attribute, getter_AddRefs(dummy));
 +      rv = data->mElement->SetAttributeNode(attribute, &dummy);
      }
    }
  
-@@ -479,12 +423,12 @@ nsNodeUtils::CloneAndAdopt(nsINode *aNod
+@@ -480,12 +424,12 @@ nsNodeUtils::CloneAndAdopt(nsINode *aNod
  
    // aNode.
    nsINodeInfo *nodeInfo = aNode->mNodeInfo;
 -  nsCOMPtr<nsINodeInfo> newNodeInfo;
 +  nsINodeInfo* newNodeInfo = nsnull;
    if (nodeInfoManager) {
      rv = nodeInfoManager->GetNodeInfo(nodeInfo->NameAtom(),
                                        nodeInfo->GetPrefixAtom(),
                                        nodeInfo->NamespaceID(),
 -                                      getter_AddRefs(newNodeInfo));
 +                                      &newNodeInfo);
      NS_ENSURE_SUCCESS(rv, rv);
  
      nodeInfo = newNodeInfo;
-@@ -494,15 +438,15 @@ nsNodeUtils::CloneAndAdopt(nsINode *aNod
+@@ -495,15 +439,15 @@ nsNodeUtils::CloneAndAdopt(nsINode *aNod
                             static_cast<nsGenericElement*>(aNode) :
                             nsnull;
  
 -  nsCOMPtr<nsINode> clone;
 +  nsINode* clone = nsnull;
    if (aClone) {
 -    rv = aNode->Clone(nodeInfo, getter_AddRefs(clone));
 +    rv = aNode->Clone(nodeInfo, &clone);
@@ -1429,85 +1405,85 @@ diff --git a/content/base/src/nsNodeUtil
      if (aParent) {
        // If we're cloning we need to insert the cloned children into the cloned
        // parent.
 -      nsCOMPtr<nsIContent> cloneContent = do_QueryInterface(clone, &rv);
 +      nsIContent* cloneContent = do_QueryInterface(clone, &rv);
        NS_ENSURE_SUCCESS(rv, rv);
  
        rv = aParent->AppendChildTo(cloneContent, PR_FALSE);
-@@ -516,7 +460,7 @@ nsNodeUtils::CloneAndAdopt(nsINode *aNod
+@@ -517,7 +461,7 @@ nsNodeUtils::CloneAndAdopt(nsINode *aNod
      }
    }
    else if (nodeInfoManager) {
 -    nsCOMPtr<nsISupports> oldRef;
 +    nsISupports* oldRef = nsnull;
      nsIDocument* oldDoc = aNode->GetOwnerDoc();
      if (oldDoc) {
        oldRef = oldDoc->GetReference(aNode);
-@@ -535,8 +479,8 @@ nsNodeUtils::CloneAndAdopt(nsINode *aNod
+@@ -536,8 +480,8 @@ nsNodeUtils::CloneAndAdopt(nsINode *aNod
  
        nsPIDOMWindow* window = newDoc->GetInnerWindow();
        if (window) {
 -        nsCOMPtr<nsIEventListenerManager> elm;
 -        aNode->GetListenerManager(PR_FALSE, getter_AddRefs(elm));
 +        nsIEventListenerManager* elm = nsnull;
 +        aNode->GetListenerManager(PR_FALSE, &elm);
          if (elm) {
            window->SetMutationListeners(elm->MutationListenerBits());
          }
-@@ -550,9 +494,9 @@ nsNodeUtils::CloneAndAdopt(nsINode *aNod
+@@ -551,9 +495,9 @@ nsNodeUtils::CloneAndAdopt(nsINode *aNod
      if (aCx) {
        nsIXPConnect *xpc = nsContentUtils::XPConnect();
        if (xpc) {
 -        nsCOMPtr<nsIXPConnectJSObjectHolder> oldWrapper;
 +        nsIXPConnectJSObjectHolder* oldWrapper = nsnull;
          rv = xpc->ReparentWrappedNativeIfFound(aCx, aOldScope, aNewScope, aNode,
 -                                               getter_AddRefs(oldWrapper));
 +                                               &oldWrapper);
          if (NS_FAILED(rv)) {
            aNode->mNodeInfo.swap(nodeInfo);
  
-@@ -566,7 +510,7 @@ nsNodeUtils::CloneAndAdopt(nsINode *aNod
+@@ -567,7 +511,7 @@ nsNodeUtils::CloneAndAdopt(nsINode *aNod
      // aNode's attributes.
      const nsDOMAttributeMap *map = elem->GetAttributeMap();
      if (map) {
 -      nsCOMPtr<nsIDOMElement> element;
 +      nsIDOMElement* element = nsnull;
        if (aClone) {
          // If we're cloning we need to insert the cloned attribute nodes into
          // the cloned element.
-@@ -590,11 +534,11 @@ nsNodeUtils::CloneAndAdopt(nsINode *aNod
+@@ -591,11 +535,11 @@ nsNodeUtils::CloneAndAdopt(nsINode *aNod
    //     GetChildAt(0). We can remove this when
    //     https://bugzilla.mozilla.org/show_bug.cgi?id=56758 is fixed.
    if (aClone && aNode->IsNodeOfType(nsINode::eATTRIBUTE)) {
 -    nsCOMPtr<nsINode> attrChildNode = aNode->GetChildAt(0);
 +    nsINode* attrChildNode = aNode->GetChildAt(0);
      // We only need to do this if the child node has properties (because we
      // might need to call a userdata handler).
      if (attrChildNode && attrChildNode->HasProperties()) {
 -      nsCOMPtr<nsINode> clonedAttrChildNode = clone->GetChildAt(0);
 +      nsINode* clonedAttrChildNode = clone->GetChildAt(0);
        if (clonedAttrChildNode) {
          PRBool ok = aNodesWithProperties.AppendObject(attrChildNode) &&
                      aNodesWithProperties.AppendObject(clonedAttrChildNode);
-@@ -607,10 +551,10 @@ nsNodeUtils::CloneAndAdopt(nsINode *aNod
+@@ -608,10 +552,10 @@ nsNodeUtils::CloneAndAdopt(nsINode *aNod
      // aNode's children.
      PRUint32 i, length = aNode->GetChildCount();
      for (i = 0; i < length; ++i) {
 -      nsCOMPtr<nsIDOMNode> child;
 +      nsIDOMNode* child = nsnull;
        rv = CloneAndAdopt(aNode->GetChildAt(i), aClone, PR_TRUE, nodeInfoManager,
                           aCx, aOldScope, aNewScope, aNodesWithProperties,
 -                         clone, getter_AddRefs(child));
 +                         clone, &child);
        NS_ENSURE_SUCCESS(rv, rv);
      }
    }
-@@ -656,7 +600,7 @@ nsNodeUtils::UnlinkUserData(nsINode *aNo
+@@ -657,7 +601,7 @@ nsNodeUtils::UnlinkUserData(nsINode *aNo
  
    // Strong reference to the document so that deleting properties can't
    // delete the document.
 -  nsCOMPtr<nsIDocument> document = aNode->GetOwnerDoc();
 +  nsIDocument* document = aNode->GetOwnerDoc();
    if (document) {
      document->PropertyTable()->DeleteAllPropertiesFor(aNode, DOM_USER_DATA);
      document->PropertyTable()->DeleteAllPropertiesFor(aNode,
@@ -1535,8 +1511,20 @@ diff --git a/content/base/src/nsNodeUtil
 +    nsIDOMNode* dummy = nsnull;
      return CloneAndAdopt(aNode, PR_FALSE, PR_TRUE, aNewNodeInfoManager, aCx,
                           aOldScope, aNewScope, aNodesWithProperties,
 -                         nsnull, getter_AddRefs(dummy));
 +                         nsnull, &dummy);
    }
  
    /**
+diff --git a/content/html/document/src/nsHTMLContentSink.cpp b/content/html/document/src/nsHTMLContentSink.cpp
+--- a/content/html/document/src/nsHTMLContentSink.cpp
++++ b/content/html/document/src/nsHTMLContentSink.cpp
+@@ -591,7 +591,7 @@ NS_NewHTMLElement(nsIContent** aResult, 
+   return *aResult ? NS_OK : NS_ERROR_OUT_OF_MEMORY;
+ }
+ 
+-nsGenericHTMLElement*
++already_AddRefed<nsGenericHTMLElement>
+ CreateHTMLElement(PRUint32 aNodeType, nsINodeInfo *aNodeInfo,
+                   PRBool aFromParser)
+ {
deleted file mode 100644
--- a/nsSlots2
+++ /dev/null
@@ -1,54 +0,0 @@
-diff --git a/content/base/src/nsGenericElement.cpp b/content/base/src/nsGenericElement.cpp
---- a/content/base/src/nsGenericElement.cpp
-+++ b/content/base/src/nsGenericElement.cpp
-@@ -2249,7 +2249,7 @@ nsGenericElement::FindAttributeDependenc
-   return PR_FALSE;
- }
- 
--nsINodeInfo*
-+already_AddRefed<nsINodeInfo>
- nsGenericElement::GetExistingAttrNameFromQName(const nsAString& aStr) const
- {
-   const nsAttrName* name = InternalGetExistingAttrNameFromQName(aStr);
-@@ -2269,7 +2269,7 @@ nsGenericElement::GetExistingAttrNameFro
-   return nodeInfo;
- }
- 
--nsIURI*
-+already_AddRefed<nsIURI>
- nsGenericElement::GetBaseURI() const
- {
-   nsIDocument* doc = GetOwnerDoc();
-diff --git a/content/base/src/nsGenericElement.h b/content/base/src/nsGenericElement.h
---- a/content/base/src/nsGenericElement.h
-+++ b/content/base/src/nsGenericElement.h
-@@ -372,7 +372,7 @@ public:
-                               PRBool aNullParent = PR_TRUE);
-   virtual nsIAtom *GetIDAttributeName() const;
-   virtual nsIAtom *GetClassAttributeName() const;
--  virtual nsINodeInfo* GetExistingAttrNameFromQName(const nsAString& aStr) const;
-+  virtual already_AddRefed<nsINodeInfo> GetExistingAttrNameFromQName(const nsAString& aStr) const;
-   nsresult SetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
-                    const nsAString& aValue, PRBool aNotify)
-   {
-@@ -413,7 +413,7 @@ public:
-   virtual void SetFocus(nsPresContext* aContext);
-   virtual nsIContent *GetBindingParent() const;
-   virtual PRBool IsNodeOfType(PRUint32 aFlags) const;
--  virtual nsIURI* GetBaseURI() const;
-+  virtual already_AddRefed<nsIURI> GetBaseURI() const;
-   virtual PRBool IsLink(nsIURI** aURI) const;
-   virtual void SetMayHaveFrame(PRBool aMayHaveFrame);
-   virtual PRBool MayHaveFrame() const;
-diff --git a/content/html/document/src/nsHTMLContentSink.cpp b/content/html/document/src/nsHTMLContentSink.cpp
---- a/content/html/document/src/nsHTMLContentSink.cpp
-+++ b/content/html/document/src/nsHTMLContentSink.cpp
-@@ -591,7 +591,7 @@ NS_NewHTMLElement(nsIContent** aResult, 
-   return *aResult ? NS_OK : NS_ERROR_OUT_OF_MEMORY;
- }
- 
--nsGenericHTMLElement*
-+already_AddRefed<nsGenericHTMLElement>
- CreateHTMLElement(PRUint32 aNodeType, nsINodeInfo *aNodeInfo,
-                   PRBool aFromParser)
- {
--- a/remove-cyclec.patch
+++ b/remove-cyclec.patch
@@ -1,8 +1,9 @@
+* * *
 * * *
 * * *
 * * *
 * * *
 
 diff --git a/content/base/public/nsContentUtils.h b/content/base/public/nsContentUtils.h
 --- a/content/base/public/nsContentUtils.h
 +++ b/content/base/public/nsContentUtils.h
@@ -612,49 +613,99 @@ diff --git a/content/base/src/nsNodeUtil
 -}
 -
  /* static */
  nsresult
  nsNodeUtils::CloneNodeImpl(nsINode *aNode, PRBool aDeep, nsIDOMNode **aResult)
 diff --git a/content/base/src/nsNodeUtils.h b/content/base/src/nsNodeUtils.h
 --- a/content/base/src/nsNodeUtils.h
 +++ b/content/base/src/nsNodeUtils.h
-@@ -240,16 +240,6 @@ public:
-   static nsresult CallUserDataHandlers(nsCOMArray<nsINode> &aNodesWithProperties,
-                                        nsIDocument *aOwnerDocument,
+@@ -242,16 +242,6 @@ public:
                                         PRUint16 aOperation, PRBool aCloned);
--
--  /**
+ 
+   /**
 -   * Helper for the cycle collector to traverse the DOM UserData and
 -   * UserDataHandlers for aNode.
 -   *
 -   * @param aNode the node to traverse UserData and UserDataHandlers for
 -   * @param aCb the cycle collection callback
 -   */
 -  static void TraverseUserData(nsINode* aNode,
 -                               nsCycleCollectionTraversalCallback &aCb);
- 
-   /**
+-
+-  /**
     * A basic implementation of the DOM cloneNode method. Calls nsINode::Clone to
+    * do the actual cloning of the node.
+    *
 diff --git a/content/base/src/nsObjectLoadingContent.cpp b/content/base/src/nsObjectLoadingContent.cpp
 --- a/content/base/src/nsObjectLoadingContent.cpp
 +++ b/content/base/src/nsObjectLoadingContent.cpp
 @@ -1223,12 +1223,6 @@ nsObjectLoadingContent::RemovedFromDocum
    }
  }
  
 -void
 -nsObjectLoadingContent::Traverse(nsCycleCollectionTraversalCallback &cb)
 -{
 -  cb.NoteXPCOMChild(mFrameLoader);
 -}
 -
  // <private>
  /* static */ PRBool
  nsObjectLoadingContent::IsSuccessfulRequest(nsIRequest* aRequest)
+diff --git a/content/events/src/nsDOMDataContainerEvent.cpp b/content/events/src/nsDOMDataContainerEvent.cpp
+--- a/content/events/src/nsDOMDataContainerEvent.cpp
++++ b/content/events/src/nsDOMDataContainerEvent.cpp
+@@ -49,17 +49,6 @@ nsDOMDataContainerEvent::nsDOMDataContai
+ 
+ NS_IMPL_CYCLE_COLLECTION_CLASS(nsDOMDataContainerEvent)
+ 
+-NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(nsDOMDataContainerEvent,
+-                                                nsDOMEvent)
+-  if (tmp->mData.IsInitialized())
+-    tmp->mData.Clear();
+-NS_IMPL_CYCLE_COLLECTION_UNLINK_END
+-
+-NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(nsDOMDataContainerEvent,
+-                                                  nsDOMEvent)
+-  tmp->mData.EnumerateRead(TraverseEntry, &cb);
+-NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+-
+ NS_IMPL_ADDREF_INHERITED(nsDOMDataContainerEvent, nsDOMEvent)
+ NS_IMPL_RELEASE_INHERITED(nsDOMDataContainerEvent, nsDOMEvent)
+ 
+@@ -104,15 +93,3 @@ NS_NewDOMDataContainerEvent(nsIDOMEvent*
+   return CallQueryInterface(it, aInstancePtrResult);
+ }
+ 
+-PLDHashOperator
+-nsDOMDataContainerEvent::TraverseEntry(const nsAString& aKey,
+-                                       nsIVariant *aDataItem,
+-                                       void* aUserArg)
+-{
+-  nsCycleCollectionTraversalCallback *cb =
+-    static_cast<nsCycleCollectionTraversalCallback*>(aUserArg);
+-  cb->NoteXPCOMChild(aDataItem);
+-
+-  return PL_DHASH_NEXT;
+-}
+-
+diff --git a/content/events/src/nsDOMDataContainerEvent.h b/content/events/src/nsDOMDataContainerEvent.h
+--- a/content/events/src/nsDOMDataContainerEvent.h
++++ b/content/events/src/nsDOMDataContainerEvent.h
+@@ -57,9 +57,6 @@ public:
+   NS_DECL_NSIDOMDATACONTAINEREVENT
+ 
+ private:
+-  static PLDHashOperator PR_CALLBACK
+-    TraverseEntry(const nsAString& aKey, nsIVariant *aDataItem, void* aUserArg);
+-
+   nsInterfaceHashtable<nsStringHashKey, nsIVariant> mData;
+ };
+ 
 diff --git a/content/events/src/nsDOMEvent.cpp b/content/events/src/nsDOMEvent.cpp
 --- a/content/events/src/nsDOMEvent.cpp
 +++ b/content/events/src/nsDOMEvent.cpp
 @@ -155,59 +155,6 @@ NS_INTERFACE_MAP_END
  
  NS_IMPL_CYCLE_COLLECTING_ADDREF(nsDOMEvent)
  NS_IMPL_CYCLE_COLLECTING_RELEASE(nsDOMEvent)
 -
@@ -711,39 +762,39 @@ diff --git a/content/events/src/nsDOMEve
 -  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mExplicitOriginalTarget)
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  // nsIDOMEventInterface
  NS_METHOD nsDOMEvent::GetType(nsAString& aType)
 diff --git a/content/events/src/nsEventListenerManager.cpp b/content/events/src/nsEventListenerManager.cpp
 --- a/content/events/src/nsEventListenerManager.cpp
 +++ b/content/events/src/nsEventListenerManager.cpp
-@@ -400,22 +400,6 @@ NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOU
+@@ -399,22 +399,6 @@ NS_INTERFACE_MAP_END
+ 
  NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOUS(nsEventListenerManager, nsIEventListenerManager)
  NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUOUS(nsEventListenerManager, nsIEventListenerManager)
- 
+-
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsEventListenerManager)
 -  PRInt32 i, count = tmp->mListeners.Count();
 -  nsListenerStruct *ls;
 -  for (i = 0; i < count; i++) {
 -    ls = static_cast<nsListenerStruct*>(tmp->mListeners.ElementAt(i));
 -    if (ls) {
 -      cb.NoteXPCOMChild(ls->mListener.get());
 -    }
 -  }  
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 -
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsEventListenerManager)
 -  tmp->Disconnect();
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 -
--
+ 
  const EventTypeData*
  nsEventListenerManager::GetTypeDataForIID(const nsIID& aIID)
- {
 diff --git a/content/events/src/nsEventStateManager.cpp b/content/events/src/nsEventStateManager.cpp
 --- a/content/events/src/nsEventStateManager.cpp
 +++ b/content/events/src/nsEventStateManager.cpp
 @@ -675,66 +675,6 @@ NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOU
  NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOUS(nsEventStateManager, nsIEventStateManager)
  NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUOUS(nsEventStateManager, nsIEventStateManager)
  
 -PR_STATIC_CALLBACK(PRBool)
@@ -807,20 +858,21 @@ diff --git a/content/events/src/nsEventS
 -
 -
  NS_IMETHODIMP
  nsEventStateManager::PreHandleEvent(nsPresContext* aPresContext,
                                      nsEvent *aEvent,
 diff --git a/content/html/content/src/nsHTMLFormElement.cpp b/content/html/content/src/nsHTMLFormElement.cpp
 --- a/content/html/content/src/nsHTMLFormElement.cpp
 +++ b/content/html/content/src/nsHTMLFormElement.cpp
-@@ -526,25 +526,6 @@ nsHTMLFormElement::Init()
+@@ -525,25 +525,6 @@ nsHTMLFormElement::Init()
+ 
  
  // nsISupports
- 
+-
 -PR_STATIC_CALLBACK(PLDHashOperator)
 -ElementTraverser(const nsAString& key, nsIDOMHTMLInputElement* element,
 -                 void* userArg)
 -{
 -  nsCycleCollectionTraversalCallback *cb = 
 -    static_cast<nsCycleCollectionTraversalCallback*>(userArg);
 - 
 -  cb->NoteXPCOMChild(element);
@@ -829,20 +881,19 @@ diff --git a/content/html/content/src/ns
 -
 -NS_IMPL_CYCLE_COLLECTION_CLASS(nsHTMLFormElement)
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(nsHTMLFormElement,
 -                                                  nsGenericHTMLElement)
 -  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR_AMBIGUOUS(mControls,
 -                                                       nsIDOMHTMLCollection)
 -  tmp->mSelectedRadioButtons.EnumerateRead(ElementTraverser, &cb);
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
--
+ 
  NS_IMPL_ADDREF_INHERITED(nsHTMLFormElement, nsGenericElement) 
  NS_IMPL_RELEASE_INHERITED(nsHTMLFormElement, nsGenericElement) 
- 
 @@ -2076,23 +2057,7 @@ nsFormControlList::FlushPendingNotificat
    }
  }
  
 -PR_STATIC_CALLBACK(PLDHashOperator)
 -ControlTraverser(const nsAString& key, nsISupports* control, void* userArg)
 -{
 -  nsCycleCollectionTraversalCallback *cb = 
@@ -928,16 +979,40 @@ diff --git a/content/html/document/src/n
 -  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mAnchors)
 -  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR_AMBIGUOUS(mForms, nsIDOMNodeList)
 -  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR_AMBIGUOUS(mFormControls,
 -                                                       nsIDOMNodeList)
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  NS_IMPL_ADDREF_INHERITED(nsHTMLDocument, nsDocument)
  NS_IMPL_RELEASE_INHERITED(nsHTMLDocument, nsDocument)
+diff --git a/content/svg/content/src/nsSVGUseElement.cpp b/content/svg/content/src/nsSVGUseElement.cpp
+--- a/content/svg/content/src/nsSVGUseElement.cpp
++++ b/content/svg/content/src/nsSVGUseElement.cpp
+@@ -61,20 +61,6 @@ NS_IMPL_NS_NEW_SVG_ELEMENT(Use)
+ 
+ //----------------------------------------------------------------------
+ // nsISupports methods
+-
+-NS_IMPL_CYCLE_COLLECTION_CLASS(nsSVGUseElement)
+-NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(nsSVGUseElement,
+-                                                nsSVGUseElementBase)
+-  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mOriginal)
+-  tmp->DestroyAnonymousContent();
+-  tmp->RemoveListener();
+-NS_IMPL_CYCLE_COLLECTION_UNLINK_END
+-NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(nsSVGUseElement,
+-                                                  nsSVGUseElementBase)
+-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mOriginal)
+-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mClone)
+-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mSourceContent)
+-NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+ 
+ NS_IMPL_ADDREF_INHERITED(nsSVGUseElement,nsSVGUseElementBase)
+ NS_IMPL_RELEASE_INHERITED(nsSVGUseElement,nsSVGUseElementBase)
 diff --git a/content/xbl/src/nsBindingManager.cpp b/content/xbl/src/nsBindingManager.cpp
 --- a/content/xbl/src/nsBindingManager.cpp
 +++ b/content/xbl/src/nsBindingManager.cpp
 @@ -143,15 +143,6 @@ NS_INTERFACE_MAP_END
  NS_INTERFACE_MAP_END
  
  NS_IMPL_CYCLE_COLLECTION_UNLINK_0(nsAnonymousContentList)
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsAnonymousContentList)
@@ -1020,23 +1095,20 @@ diff --git a/content/xbl/src/nsBindingMa
 -  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSTARRAY_MEMBER(mAttachedStack,
 -                                                    nsXBLBinding)
 -  // No need to traverse mProcessAttachedQueueEvent, since it'll just
 -  // fire at some point.
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  NS_IMPL_CYCLE_COLLECTION_CLASS(nsBindingManager)
  
-@@ -1463,42 +1388,6 @@ nsBindingManager::DropDocumentReference(
-   // Make sure to not run any more XBL constructors
-   mProcessingAttachedStack = PR_TRUE;
-   mDocument = nsnull;
--}
--
--void
+@@ -1466,42 +1391,6 @@ nsBindingManager::DropDocumentReference(
+ }
+ 
+ void
 -nsBindingManager::Traverse(nsIContent *aContent,
 -                           nsCycleCollectionTraversalCallback &cb)
 -{
 -  if (!aContent->HasFlag(NODE_MAY_BE_IN_BINDING_MNGR)) {
 -    return;
 -  }
 -
 -  nsXBLBinding *binding = GetBinding(aContent);
@@ -1060,19 +1132,22 @@ diff --git a/content/xbl/src/nsBindingMa
 -    cb.NoteXPCOMChild(aContent);
 -    cb.NoteXPCOMChild(value);
 -  }
 -  if (mWrapperTable.ops &&
 -      (value = LookupObject(mWrapperTable, aContent))) {
 -    cb.NoteXPCOMChild(aContent);
 -    cb.NoteXPCOMChild(value);
 -  }
- }
- 
- void
+-}
+-
+-void
+ nsBindingManager::BeginOutermostUpdate()
+ {
+   mAttachedStackSizeOnOutermost = mAttachedStack.Length();
 diff --git a/content/xbl/src/nsBindingManager.h b/content/xbl/src/nsBindingManager.h
 --- a/content/xbl/src/nsBindingManager.h
 +++ b/content/xbl/src/nsBindingManager.h
 @@ -189,9 +189,6 @@ public:
                       RuleProcessorData* aData,
                       PRBool* aCutOffInheritance);
  
 -  NS_HIDDEN_(void) Traverse(nsIContent *aContent,
@@ -1410,16 +1485,59 @@ diff --git a/content/xbl/src/nsXBLProtot
  
 -  void Traverse(nsCycleCollectionTraversalCallback &cb) const;
 -  void Unlink();
 -  void Trace(TraceCallback aCallback, void *aClosure) const;
 -
  // Static members
    static PRUint32 gRefCnt;
   
+diff --git a/content/xbl/src/nsXBLPrototypeHandler.cpp b/content/xbl/src/nsXBLPrototypeHandler.cpp
+--- a/content/xbl/src/nsXBLPrototypeHandler.cpp
++++ b/content/xbl/src/nsXBLPrototypeHandler.cpp
+@@ -159,25 +159,6 @@ nsXBLPrototypeHandler::~nsXBLPrototypeHa
+ 
+   // We own the next handler in the chain, so delete it now.
+   delete mNextHandler;
+-}
+-
+-void
+-nsXBLPrototypeHandler::Traverse(nsCycleCollectionTraversalCallback &cb) const
+-{
+-  cb.NoteXPCOMChild(mGlobalForCachedHandler);
+-}
+-
+-void
+-nsXBLPrototypeHandler::Trace(TraceCallback aCallback, void *aClosure) const
+-{
+-  if (mCachedHandler)
+-    aCallback(nsIProgrammingLanguage::JAVASCRIPT, mCachedHandler, aClosure);
+-}
+-
+-void
+-nsXBLPrototypeHandler::Unlink()
+-{
+-  ForgetCachedHandler();
+ }
+ 
+ already_AddRefed<nsIContent>
+diff --git a/content/xbl/src/nsXBLPrototypeHandler.h b/content/xbl/src/nsXBLPrototypeHandler.h
+--- a/content/xbl/src/nsXBLPrototypeHandler.h
++++ b/content/xbl/src/nsXBLPrototypeHandler.h
+@@ -153,10 +153,6 @@ public:
+     return (mType & NS_HANDLER_ALLOW_UNTRUSTED) != 0;
+   }
+ 
+-  void Traverse(nsCycleCollectionTraversalCallback &cb) const;
+-  void Trace(TraceCallback aCallback, void *aClosure) const;
+-  void Unlink();
+-	
+ public:
+   static PRUint32 gRefCnt;
+   
 diff --git a/content/xslt/src/xpath/nsXPathResult.cpp b/content/xslt/src/xpath/nsXPathResult.cpp
 --- a/content/xslt/src/xpath/nsXPathResult.cpp
 +++ b/content/xslt/src/xpath/nsXPathResult.cpp
 @@ -76,18 +76,6 @@ nsXPathResult::~nsXPathResult()
  {
      RemoveObserver();
  }
 -
@@ -1432,16 +1550,43 @@ diff --git a/content/xslt/src/xpath/nsXP
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsXPathResult)
 -    NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mDocument)
 -    NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMARRAY(mResultNodes)
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOUS(nsXPathResult, nsIDOMXPathResult)
  NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUOUS(nsXPathResult, nsIDOMXPathResult)
+diff --git a/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp b/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp
+--- a/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp
++++ b/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp
+@@ -291,23 +291,6 @@ private:
+ /**
+  * txMozillaXSLTProcessor
+  */
+-
+-NS_IMPL_CYCLE_COLLECTION_CLASS(txMozillaXSLTProcessor)
+-NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(txMozillaXSLTProcessor)
+-    NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mEmbeddedStylesheetRoot)
+-    NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mSource)
+-    NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mPrincipal)
+-    tmp->mVariables.clear();
+-NS_IMPL_CYCLE_COLLECTION_UNLINK_END
+-NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(txMozillaXSLTProcessor)
+-    NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mEmbeddedStylesheetRoot)
+-    NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mSource)
+-    NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mPrincipal)
+-    txOwningExpandedNameMap<txIGlobalParameter>::iterator iter(tmp->mVariables);
+-    while (iter.next()) {
+-        cb.NoteXPCOMChild(static_cast<txVariable*>(iter.value())->getValue());
+-    }
+-NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+ 
+ NS_IMPL_CYCLE_COLLECTING_ADDREF(txMozillaXSLTProcessor)
+ NS_IMPL_CYCLE_COLLECTING_RELEASE(txMozillaXSLTProcessor)
 diff --git a/content/xul/content/src/nsXULElement.cpp b/content/xul/content/src/nsXULElement.cpp
 --- a/content/xul/content/src/nsXULElement.cpp
 +++ b/content/xul/content/src/nsXULElement.cpp
 @@ -377,11 +377,6 @@ nsXULElement::QueryInterface(REFNSIID aI
  {
      NS_PRECONDITION(aInstancePtr, "null out param");
  
 -    if (aIID.Equals(NS_GET_IID(nsXPCOMCycleCollectionParticipant))) {
@@ -1597,36 +1742,36 @@ diff --git a/content/xul/content/src/nsX
 -        }
 +        mScriptObject.mObject = aObject;
      }
  
      struct ScriptObjectHolder
 diff --git a/content/xul/document/src/nsXULCommandDispatcher.cpp b/content/xul/document/src/nsXULCommandDispatcher.cpp
 --- a/content/xul/document/src/nsXULCommandDispatcher.cpp
 +++ b/content/xul/document/src/nsXULCommandDispatcher.cpp
-@@ -105,19 +105,6 @@ NS_IMPL_CYCLE_COLLECTING_ADDREF(nsXULCom
+@@ -104,19 +104,6 @@ NS_INTERFACE_MAP_END
+ 
  NS_IMPL_CYCLE_COLLECTING_ADDREF(nsXULCommandDispatcher)
  NS_IMPL_CYCLE_COLLECTING_RELEASE(nsXULCommandDispatcher)
- 
+-
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsXULCommandDispatcher)
 -  tmp->Disconnect();
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 -
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsXULCommandDispatcher)
 -  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mDocument)
 -  Updater* updater = tmp->mUpdaters;
 -  while (updater) {
 -    cb.NoteXPCOMChild(updater->mElement);
 -    updater = updater->mNext;
 -  }
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
--
+ 
  void
  nsXULCommandDispatcher::Disconnect()
- {
 diff --git a/content/xul/document/src/nsXULControllers.cpp b/content/xul/document/src/nsXULControllers.cpp
 --- a/content/xul/document/src/nsXULControllers.cpp
 +++ b/content/xul/document/src/nsXULControllers.cpp
 @@ -98,21 +98,6 @@ NS_NewXULControllers(nsISupports* aOuter
  }
  
  NS_IMPL_CYCLE_COLLECTION_CLASS(nsXULControllers)
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsXULControllers)
@@ -1782,28 +1927,28 @@ diff --git a/content/xul/templates/src/n
 -        mSortState.Traverse(cb);
 -    }
  
      virtual void Uninit(PRBool aIsFinal);
  
 diff --git a/content/xul/templates/src/nsXULSortService.h b/content/xul/templates/src/nsXULSortService.h
 --- a/content/xul/templates/src/nsXULSortService.h
 +++ b/content/xul/templates/src/nsXULSortService.h
-@@ -92,11 +92,6 @@ struct nsSortState
+@@ -91,11 +91,6 @@ struct nsSortState
+   nsSortState()
      : initialized(PR_FALSE)
    {
-   }
+-  }
 -  void Traverse(nsCycleCollectionTraversalCallback &cb) const
 -  {
 -    cb.NoteXPCOMChild(processor);
 -    cb.NoteXPCOMChild(lastContainer);
--  }
+   }
  };
  
- // information about a particular item to be sorted
 diff --git a/content/xul/templates/src/nsXULTemplateBuilder.cpp b/content/xul/templates/src/nsXULTemplateBuilder.cpp
 --- a/content/xul/templates/src/nsXULTemplateBuilder.cpp
 +++ b/content/xul/templates/src/nsXULTemplateBuilder.cpp
 @@ -229,53 +229,12 @@ nsXULTemplateBuilder::Uninit(PRBool aIsF
      mQueriesCompiled = PR_FALSE;
  }
  
 -static PLDHashOperator
@@ -1854,20 +1999,21 @@ diff --git a/content/xul/templates/src/n
 -    tmp->Traverse(cb);
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOUS(nsXULTemplateBuilder,
                                            nsIXULTemplateBuilder)
 diff --git a/content/xul/templates/src/nsXULTemplateQueryProcessorRDF.cpp b/content/xul/templates/src/nsXULTemplateQueryProcessorRDF.cpp
 --- a/content/xul/templates/src/nsXULTemplateQueryProcessorRDF.cpp
 +++ b/content/xul/templates/src/nsXULTemplateQueryProcessorRDF.cpp
-@@ -88,66 +88,6 @@ NS_IMPL_CYCLE_COLLECTION_CLASS(nsXULTemp
+@@ -87,66 +87,6 @@ nsIRDFResource*           nsXULTemplateQ
+ 
  NS_IMPL_CYCLE_COLLECTION_CLASS(nsXULTemplateQueryProcessorRDF)
  NS_IMPL_CYCLE_COLLECTION_UNLINK_0(nsXULTemplateQueryProcessorRDF)
- 
+-
 -PR_STATIC_CALLBACK(PLDHashOperator)
 -BindingDependenciesTraverser(nsISupports* key,
 -                             nsCOMArray<nsXULTemplateResultRDF>* array,
 -                             void* userArg)
 -{
 -    nsCycleCollectionTraversalCallback *cb = 
 -        static_cast<nsCycleCollectionTraversalCallback*>(userArg);
 -
@@ -1917,20 +2063,19 @@ diff --git a/content/xul/templates/src/n
 -        tmp->mMemoryElementToResultMap.EnumerateRead(MemoryElementTraverser,
 -                                                     &cb);
 -    }
 -    if (tmp->mRuleToBindingsMap.IsInitialized()) {
 -        tmp->mRuleToBindingsMap.EnumerateRead(RuleToBindingTraverser, &cb);
 -    }
 -    NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMARRAY(mQueries)
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
--
+ 
  NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOUS(nsXULTemplateQueryProcessorRDF,
                                            nsIXULTemplateQueryProcessor)
- NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUOUS(nsXULTemplateQueryProcessorRDF,
 diff --git a/dom/src/base/nsGlobalWindow.cpp b/dom/src/base/nsGlobalWindow.cpp
 --- a/dom/src/base/nsGlobalWindow.cpp
 +++ b/dom/src/base/nsGlobalWindow.cpp
 @@ -79,7 +79,6 @@
  #endif
  #include "nsContentCID.h"
  #include "nsLayoutStatics.h"
 -#include "nsCycleCollector.h"
@@ -1985,21 +2130,20 @@ diff --git a/dom/src/base/nsGlobalWindow
  #endif
  
 -#ifdef DEBUG
 -  nsCycleCollector_DEBUG_shouldBeFreed(static_cast<nsIScriptGlobalObject*>(this));
 -#endif
  }
  
  //*****************************************************************************
-@@ -911,101 +892,6 @@ NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOU
- NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOUS(nsGlobalWindow, nsIScriptGlobalObject)
+@@ -912,101 +893,6 @@ NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUO
  NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUOUS(nsGlobalWindow,
                                             nsIScriptGlobalObject)
--
+ 
 -
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsGlobalWindow)
 -  if (tmp->mDoc && nsCCUncollectableMarker::InGeneration(
 -                     tmp->mDoc->GetMarkedCCGeneration())) {
 -    return NS_OK;
 -  }
 -
 -  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mContext)
@@ -2084,19 +2228,20 @@ diff --git a/dom/src/base/nsGlobalWindow
 -  if (tmp->mDummyJavaPluginOwner) {
 -    tmp->mDummyJavaPluginOwner->Destroy();
 -    NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mDummyJavaPluginOwner)
 -  }
 -#endif
 -
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 -
- 
+-
  //*****************************************************************************
  // nsGlobalWindow::nsIScriptGlobalObject
+ //*****************************************************************************
 @@ -2005,10 +1891,6 @@ nsGlobalWindow::SetDocShell(nsIDocShell*
          mScriptContexts[st_ndx] = nsnull;
        }
      }
 -#ifdef DEBUG
 -    nsCycleCollector_DEBUG_shouldBeFreed(mContext);
 -    nsCycleCollector_DEBUG_shouldBeFreed(static_cast<nsIScriptGlobalObject*>(this));
 -#endif
@@ -2190,17 +2335,17 @@ diff --git a/dom/src/base/nsJSEnvironmen
 @@ -3544,7 +3529,6 @@ nsJSRuntime::Startup()
    sCCollectCount = 0;
    sUserIsActive = PR_FALSE;
    sPreviousCCTime = 0;
 -  sPreviousCCDidCollect = PR_FALSE;
    sGCTimer = nsnull;
    sReadyForGC = PR_FALSE;
    sLoadInProgressGCTimer = PR_FALSE;
-@@ -3850,24 +3834,6 @@ nsJSArgArray::ReleaseJSObjects()
+@@ -3848,24 +3832,6 @@ nsJSArgArray::ReleaseJSObjects()
  
  // QueryInterface implementation for nsJSArgArray
  NS_IMPL_CYCLE_COLLECTION_CLASS(nsJSArgArray)
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsJSArgArray)
 -  tmp->ReleaseJSObjects();
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsJSArgArray)
 -  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_SCRIPT_OBJECTS
@@ -2252,20 +2397,21 @@ diff --git a/dom/src/base/nsWindowRoot.c
 -  mRefCnt.decr(static_cast<nsIDOMEventTarget*>(this));
 +  --mRefCnt;
  }
  
  nsWindowRoot::~nsWindowRoot()
 diff --git a/dom/src/events/nsJSEventListener.cpp b/dom/src/events/nsJSEventListener.cpp
 --- a/dom/src/events/nsJSEventListener.cpp
 +++ b/dom/src/events/nsJSEventListener.cpp
-@@ -90,26 +90,6 @@ nsJSEventListener::~nsJSEventListener()
+@@ -89,26 +89,6 @@ nsJSEventListener::~nsJSEventListener()
+   if (mContext)
      NS_DROP_JS_OBJECTS(this, nsJSEventListener);
  }
- 
+-
 -NS_IMPL_CYCLE_COLLECTION_CLASS(nsJSEventListener)
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsJSEventListener)
 -  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mTarget)
 -  if (tmp->mContext) {
 -    tmp->mScopeObject = nsnull;
 -    NS_DROP_JS_OBJECTS(tmp, nsJSEventListener);
 -    NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mContext)
 -  }
@@ -2275,27 +2421,27 @@ diff --git a/dom/src/events/nsJSEventLis
 -  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mContext)
 -  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_SCRIPT_OBJECTS
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 -
 -NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN(nsJSEventListener)
 -  NS_IMPL_CYCLE_COLLECTION_TRACE_MEMBER_CALLBACK(tmp->mContext->GetScriptTypeID(),
 -                                                 mScopeObject)
 -NS_IMPL_CYCLE_COLLECTION_TRACE_END
--
+ 
  NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsJSEventListener)
    NS_INTERFACE_MAP_ENTRY(nsIDOMEventListener)
-   NS_INTERFACE_MAP_ENTRY(nsIJSEventListener)
 diff --git a/dom/src/storage/nsDOMStorage.cpp b/dom/src/storage/nsDOMStorage.cpp
 --- a/dom/src/storage/nsDOMStorage.cpp
 +++ b/dom/src/storage/nsDOMStorage.cpp
-@@ -256,29 +256,6 @@ nsDOMStorageEntry::~nsDOMStorageEntry()
+@@ -255,29 +255,6 @@ nsDOMStorageEntry::~nsDOMStorageEntry()
+ nsDOMStorageEntry::~nsDOMStorageEntry()
  {
  }
- 
+-
 -PLDHashOperator PR_CALLBACK
 -SessionStorageTraverser(nsSessionStorageEntry* aEntry, void* userArg) {
 -  nsCycleCollectionTraversalCallback *cb = 
 -    static_cast<nsCycleCollectionTraversalCallback*>(userArg);
 -
 -  cb->NoteXPCOMChild((nsIDOMStorageItem *) aEntry->mItem);
 -
 -  return PL_DHASH_NEXT;
@@ -2308,20 +2454,19 @@ diff --git a/dom/src/storage/nsDOMStorag
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsDOMStorage)
 -  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mURI)
 -  {
 -    if (tmp->mItems.IsInitialized()) {
 -      tmp->mItems.EnumerateEntries(SessionStorageTraverser, &cb);
 -    }
 -  }
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
--
+ 
  NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOUS(nsDOMStorage, nsIDOMStorage)
  NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUOUS(nsDOMStorage, nsIDOMStorage)
- NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsDOMStorage)
 @@ -1089,18 +1066,6 @@ NS_NewDOMStorageList(nsIDOMStorageList**
  // nsDOMStorageItem
  //
  
 -NS_IMPL_CYCLE_COLLECTION_CLASS(nsDOMStorageItem)
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsDOMStorageItem)
 -  {
 -    tmp->mStorage = nsnull;
@@ -2334,20 +2479,21 @@ diff --git a/dom/src/storage/nsDOMStorag
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 -
  NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOUS(nsDOMStorageItem, nsIDOMStorageItem)
  NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUOUS(nsDOMStorageItem, nsIDOMStorageItem)
  NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsDOMStorageItem)
 diff --git a/embedding/components/commandhandler/src/nsCommandManager.cpp b/embedding/components/commandhandler/src/nsCommandManager.cpp
 --- a/embedding/components/commandhandler/src/nsCommandManager.cpp
 +++ b/embedding/components/commandhandler/src/nsCommandManager.cpp
-@@ -69,30 +69,6 @@ nsCommandManager::~nsCommandManager()
+@@ -68,30 +68,6 @@ nsCommandManager::~nsCommandManager()
+ {
    /* destructor code */
  }
- 
+-
 -
 -PR_STATIC_CALLBACK(PLDHashOperator)
 -TraverseCommandObservers(const char* aKey, nsCOMArray<nsIObserver>* aObservers,
 -                         void* aClosure)
 -{
 -  nsCycleCollectionTraversalCallback *cb = 
 -    static_cast<nsCycleCollectionTraversalCallback*>(aClosure);
 -
@@ -2361,24 +2507,23 @@ diff --git a/embedding/components/comman
 -
 -NS_IMPL_CYCLE_COLLECTION_CLASS(nsCommandManager)
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsCommandManager)
 -  tmp->mObserversTable.Clear();
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsCommandManager)
 -  tmp->mObserversTable.EnumerateRead(TraverseCommandObservers, &cb);
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
--
+ 
  NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOUS(nsCommandManager, nsICommandManager)
  NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUOUS(nsCommandManager, nsICommandManager)
- 
 diff --git a/js/src/xpconnect/idl/nsIXPConnect.idl b/js/src/xpconnect/idl/nsIXPConnect.idl
 --- a/js/src/xpconnect/idl/nsIXPConnect.idl
 +++ b/js/src/xpconnect/idl/nsIXPConnect.idl
-@@ -731,29 +731,6 @@ interface nsIXPConnect : nsISupports
+@@ -728,29 +728,6 @@ interface nsIXPConnect : nsISupports
      [noscript] JSVal getCrossOriginWrapperForObject(in JSContextPtr aJSContext,
                                                      in JSObjectPtr aParent,
                                                      in JSObjectPtr aWrappedObj);
 -
 -    /**
 -     * Root JS objects held by aHolder.
 -     * @param aHolder The object that hold the JS objects that should be rooted.
 -     * @param aTrace The tracer for aHolder.
@@ -2434,20 +2579,21 @@ diff --git a/js/src/xpconnect/src/nsXPCo
  {
 -    NS_ASSERTION(!mCycleCollectionContext,
 -                 "Didn't call FinishCycleCollection?");
 -    nsCycleCollector_forgetRuntime(nsIProgrammingLanguage::JAVASCRIPT);
 -
      JSContext *cx = nsnull;
      if (mRuntime) {
          // Create our own JSContext rather than an XPCCallContext, since
-@@ -413,576 +402,6 @@ nsXPConnect::GetInfoForName(const char *
+@@ -412,576 +401,6 @@ nsXPConnect::GetInfoForName(const char *
+ {
      return FindInfo(NameTester, name, mInterfaceInfoManager, info);
  }
- 
+-
 -static JSGCCallback gOldJSGCCallback;
 -// Number of collections that have collected nodes.
 -static PRUint32 gCollections;
 -// Whether to run cycle collection during GC.
 -static PRBool gCollect;
 -
 -JS_STATIC_DLL_CALLBACK(JSBool)
 -XPCCycleCollectGCCallback(JSContext *cx, JSGCStatus status)
@@ -3007,21 +3153,20 @@ diff --git a/js/src/xpconnect/src/nsXPCo
 -
 -NS_IMETHODIMP_(void)
 -nsXPConnect::NoteJSContext(JSContext *aJSContext,
 -                           nsCycleCollectionTraversalCallback &aCb)
 -{
 -    aCb.NoteNativeChild(aJSContext, &JSContext_cycleCollectorGlobal);
 -}
 -
--
+ 
  /***************************************************************************/
  /***************************************************************************/
- // nsIXPConnect interface methods...
-@@ -2232,18 +1651,6 @@ nsXPConnect::OnDispatchedEvent(nsIThread
+@@ -2186,18 +1605,6 @@ nsXPConnect::OnDispatchedEvent(nsIThread
      return NS_ERROR_UNEXPECTED;
  }
  
 -NS_IMETHODIMP
 -nsXPConnect::AddJSHolder(void* aHolder, nsScriptObjectTracer* aTracer)
 -{
 -    return mRuntime->AddJSHolder(aHolder, aTracer);
 -}
@@ -3275,17 +3420,17 @@ diff --git a/js/src/xpconnect/src/xpcjsr
 -        reinterpret_cast<ClearedGlobalObject*>(entry);
 -
 -    return JS_DHASH_ENTRY_IS_BUSY(entry) ?
 -           clearedGlobal->mGlobalObject :
 -           nsnull;
  }
  
  // static
-@@ -1034,17 +822,6 @@ XPCJSRuntime::~XPCJSRuntime()
+@@ -1022,17 +810,6 @@ XPCJSRuntime::~XPCJSRuntime()
  
      gOldJSGCCallback = NULL;
      gOldJSContextCallback = NULL;
 -
 -    if(mJSHolders.ops)
 -    {
 -        JS_DHashTableFinish(&mJSHolders);
 -        mJSHolders.ops = nsnull;
@@ -3293,30 +3438,30 @@ diff --git a/js/src/xpconnect/src/xpcjsr
 -    if(mClearedGlobalObjects.ops)
 -    {
 -        JS_DHashTableFinish(&mClearedGlobalObjects);
 -        mClearedGlobalObjects.ops = nsnull;
 -    }
  }
  
  XPCJSRuntime::XPCJSRuntime(nsXPConnect* aXPConnect,
-@@ -1098,13 +875,6 @@ XPCJSRuntime::XPCJSRuntime(nsXPConnect* 
+@@ -1084,13 +861,6 @@ XPCJSRuntime::XPCJSRuntime(nsXPConnect* 
+         gOldJSGCCallback = JS_SetGCCallbackRT(mJSRuntime, GCCallback);
          JS_SetExtraGCRoots(mJSRuntime, TraceJS, this);
      }
- 
+-
 -    if(!JS_DHashTableInit(&mJSHolders, JS_DHashGetStubOps(), nsnull,
 -                          sizeof(ObjectHolder), 512))
 -        mJSHolders.ops = nsnull;
 -    if(!JS_DHashTableInit(&mClearedGlobalObjects, JS_DHashGetStubOps(), nsnull,
 -                          sizeof(ClearedGlobalObject), JS_DHASH_MIN_SIZE))
 -        mClearedGlobalObjects.ops = nsnull;
--
+ 
      // Install a JavaScript 'debugger' keyword handler in debug builds only
  #ifdef DEBUG
-     if(mJSRuntime && !JS_GetGlobalDebugHooks(mJSRuntime)->debuggerHandler)
 diff --git a/js/src/xpconnect/src/xpcprivate.h b/js/src/xpconnect/src/xpcprivate.h
 --- a/js/src/xpconnect/src/xpcprivate.h
 +++ b/js/src/xpconnect/src/xpcprivate.h
 @@ -54,7 +54,6 @@
  #include "nsXPCOM.h"
  #include "nsAutoPtr.h"
  #include "nsCycleCollectionParticipant.h"
 -#include "nsCycleCollector.h"
@@ -3329,21 +3474,20 @@ diff --git a/js/src/xpconnect/src/xpcpri
                      public nsIThreadObserver,
 -                    public nsSupportsWeakReference,
 -                    public nsCycleCollectionJSRuntime,
 -                    public nsCycleCollectionParticipant
 +                    public nsSupportsWeakReference
  {
  public:
      // all the interface method declarations...
-@@ -493,44 +490,6 @@ public:
- 
+@@ -494,44 +491,6 @@ public:
      nsresult GetInfoForIID(const nsIID * aIID, nsIInterfaceInfo** info);
      nsresult GetInfoForName(const char * name, nsIInterfaceInfo** info);
--
+ 
 -    // nsCycleCollectionParticipant
 -    NS_IMETHOD Root(void *p);
 -    NS_IMETHOD Unlink(void *p);
 -    NS_IMETHOD Unroot(void *p);
 -    NS_IMETHOD Traverse(void *p,
 -                        nsCycleCollectionTraversalCallback &cb);
 -    
 -    // nsCycleCollectionLanguageRuntime
@@ -3371,33 +3515,34 @@ diff --git a/js/src/xpconnect/src/xpcpri
 -    PRInt32 GetRequestDepth(JSContext* cx);
 -
 -    // This returns the singleton nsCycleCollectionParticipant for JSContexts.
 -    static nsCycleCollectionParticipant *JSContextParticipant();
 -
 -#ifndef XPCONNECT_STANDALONE
 -    void RecordTraversal(void *p, nsISupports *s);
 -#endif
- 
+-
  #ifdef XPC_IDISPATCH_SUPPORT
  public:
+     static PRBool IsIDispatchEnabled();
 @@ -556,12 +515,6 @@ private:
      nsIXPCSecurityManager*   mDefaultSecurityManager;
      PRUint16                 mDefaultSecurityManagerFlags;
      JSBool                   mShuttingDown;
 -    XPCCallContext*          mCycleCollectionContext;
 -#ifdef DEBUG_CC
 -    nsAutoPtr<XPCCallContext> mExplainCycleCollectionContext;
 -    PLDHashTable             mJSRoots;
 -#endif
 -    PRBool                   mCycleCollecting;
  
  #ifdef XPC_TOOLS_SUPPORT
      nsCOMPtr<nsIXPCToolsProfiler> mProfiler;
-@@ -715,21 +668,12 @@ public:
+@@ -712,21 +665,12 @@ public:
  
      static void JS_DLL_CALLBACK TraceJS(JSTracer* trc, void* data);
      void TraceXPConnectRoots(JSTracer *trc);
 -    void AddXPConnectRoots(JSContext* cx,
 -                           nsCycleCollectionTraversalCallback& cb);
  
      static JSBool JS_DLL_CALLBACK GCCallback(JSContext *cx, JSGCStatus status);
  
@@ -3409,61 +3554,62 @@ diff --git a/js/src/xpconnect/src/xpcpri
 -    nsresult RemoveJSHolder(void* aHolder);
 -
 -    void UnsetContextGlobals();
 -    void RestoreContextGlobals();
 -    JSObject* GetUnsetContextGlobal(JSContext* cx);
  
      void DebugDump(PRInt16 depth);
  
-@@ -794,8 +738,6 @@ private:
+@@ -790,8 +734,6 @@ private:
      XPCRootSetElem *mVariantRoots;
      XPCRootSetElem *mWrappedJSRoots;
      XPCRootSetElem *mObjectHolderRoots;
 -    JSDHashTable mJSHolders;
 -    JSDHashTable mClearedGlobalObjects;
  };
  
  /***************************************************************************/
-@@ -1200,10 +1142,6 @@ public:
+@@ -1196,10 +1138,6 @@ public:
  
      static void
      TraceJS(JSTracer* trc, XPCJSRuntime* rt);
 -
 -    static void
 -    SuspectAllWrappers(XPCJSRuntime* rt, JSContext* cx,
 -                       nsCycleCollectionTraversalCallback &cb);
  
      static void
      FinishedMarkPhaseOfGC(JSContext* cx, XPCJSRuntime* rt);
-@@ -1983,8 +1921,6 @@ public:
+@@ -1979,8 +1917,6 @@ public:
      NS_DECL_ISUPPORTS
      NS_DECL_NSIXPCONNECTJSOBJECTHOLDER
      NS_DECL_NSIXPCONNECTWRAPPEDNATIVE
 -    NS_DECL_CYCLE_COLLECTION_CLASS(XPCWrappedNative)
 -    NS_DECL_CYCLE_COLLECTION_UNMARK_PURPLE_STUB(XPCWrappedNative)
  
  #ifndef XPCONNECT_STANDALONE
      virtual nsIPrincipal* GetObjectPrincipal() const;
-@@ -2196,8 +2132,6 @@ public:
+@@ -2192,8 +2128,6 @@ public:
  
      JSObject* GetWrapper()              { return mWrapper; }
      void      SetWrapper(JSObject *obj) { mWrapper = obj; }
 -
 -    void NoteTearoffs(nsCycleCollectionTraversalCallback& cb);
  
      // Make ctor and dtor protected (rather than private) to placate nsCOMPtr.
  protected:
 diff --git a/js/src/xpconnect/src/xpcvariant.cpp b/js/src/xpconnect/src/xpcvariant.cpp
 --- a/js/src/xpconnect/src/xpcvariant.cpp
 +++ b/js/src/xpconnect/src/xpcvariant.cpp
-@@ -90,25 +90,6 @@ XPCTraceableVariant::PrintTraceName(JSTr
+@@ -89,25 +89,6 @@ XPCTraceableVariant::PrintTraceName(JSTr
+     JS_snprintf(buf, bufsize, "XPCVariant[0x%p].mJSVal", trc->debugPrintArg);
  }
  #endif
- 
+-
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(XPCVariant)
 -    if(JSVAL_IS_OBJECT(tmp->mJSVal))
 -        cb.NoteScriptChild(nsIProgrammingLanguage::JAVASCRIPT,
 -                           JSVAL_TO_OBJECT(tmp->mJSVal));
 -
 -    nsVariant::Traverse(tmp->mData, cb);
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 -
@@ -3472,20 +3618,19 @@ diff --git a/js/src/xpconnect/src/xpcvar
 -        nsVariant::Cleanup(&tmp->mData);
 -    if(JSVAL_IS_TRACEABLE(tmp->mJSVal))
 -    {
 -        XPCTraceableVariant *v = static_cast<XPCTraceableVariant*>(tmp);
 -        v->RemoveFromRootSet(nsXPConnect::GetRuntime()->GetJSRuntime());
 -    }
 -    tmp->mJSVal = JSVAL_NULL;
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_END
--
+ 
  // static 
  XPCVariant* XPCVariant::newVariant(XPCCallContext& ccx, jsval aJSVal)
- {
 diff --git a/js/src/xpconnect/src/xpcwrappedjs.cpp b/js/src/xpconnect/src/xpcwrappedjs.cpp
 --- a/js/src/xpconnect/src/xpcwrappedjs.cpp
 +++ b/js/src/xpconnect/src/xpcwrappedjs.cpp
 @@ -45,87 +45,6 @@
  
  // NOTE: much of the fancy footwork is done in xpcstubs.cpp
  
 -NS_IMPL_CYCLE_COLLECTION_CLASS(nsXPCWrappedJS)
@@ -3762,20 +3907,21 @@ diff --git a/js/src/xpconnect/src/xpcwra
 -            ccx.GetXPConnect()->RecordTraversal(cur->mGlobalJSObject,
 -                                                cur->mScriptObjectPrincipal);
 -        }
 -}
 -#endif
 diff --git a/layout/base/nsPresContext.cpp b/layout/base/nsPresContext.cpp
 --- a/layout/base/nsPresContext.cpp
 +++ b/layout/base/nsPresContext.cpp
-@@ -292,61 +292,6 @@ NS_IMPL_CYCLE_COLLECTING_ADDREF(nsPresCo
+@@ -291,61 +291,6 @@ NS_INTERFACE_MAP_END
+ 
  NS_IMPL_CYCLE_COLLECTING_ADDREF(nsPresContext)
  NS_IMPL_CYCLE_COLLECTING_RELEASE(nsPresContext)
- 
+-
 -PR_STATIC_CALLBACK(PLDHashOperator)
 -TraverseImageLoader(const void * aKey, nsCOMPtr<nsImageLoader>& aData,
 -                    void* aClosure)
 -{
 -  nsCycleCollectionTraversalCallback *cb =
 -    static_cast<nsCycleCollectionTraversalCallback*>(aClosure);
 -
 -  cb->NoteXPCOMChild(aData);
@@ -3820,45 +3966,44 @@ diff --git a/layout/base/nsPresContext.c
 -  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mPrintSettings);
 -  if (tmp->mPrefChangedTimer)
 -  {
 -    tmp->mPrefChangedTimer->Cancel();
 -    tmp->mPrefChangedTimer = nsnull;
 -  }
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 -
--
+ 
  #define MAKE_FONT_PREF_KEY(_pref, _s0, _s1) \
   _pref.Assign(_s0); \
-  _pref.Append(_s1);
 diff --git a/rdf/base/src/nsCompositeDataSource.cpp b/rdf/base/src/nsCompositeDataSource.cpp
 --- a/rdf/base/src/nsCompositeDataSource.cpp
 +++ b/rdf/base/src/nsCompositeDataSource.cpp
-@@ -649,21 +649,6 @@ CompositeDataSourceImpl::CompositeDataSo
+@@ -648,21 +648,6 @@ CompositeDataSourceImpl::CompositeDataSo
+ //
  // nsISupports interface
  //
- 
+-
 -NS_IMPL_CYCLE_COLLECTION_CLASS(CompositeDataSourceImpl)
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(CompositeDataSourceImpl)
 -    PRUint32 i, count = tmp->mDataSources.Count();
 -    for (i = count; i > 0; --i) {
 -        tmp->mDataSources[i - 1]->RemoveObserver(tmp);
 -        tmp->mDataSources.RemoveObjectAt(i - 1);
 -    }
 -    NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMARRAY(mObservers);
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(CompositeDataSourceImpl)
 -    NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMARRAY(mObservers)
 -    NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMARRAY(mDataSources)
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 -
--
+ 
  NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOUS(CompositeDataSourceImpl,
                                            nsIRDFCompositeDataSource)
- NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUOUS(CompositeDataSourceImpl,
 diff --git a/xpcom/base/Makefile.in b/xpcom/base/Makefile.in
 --- a/xpcom/base/Makefile.in
 +++ b/xpcom/base/Makefile.in
 @@ -108,12 +108,13 @@ SDK_XPIDLSRCS   = \
  		nsITraceRefcnt.idl         \
  		nsIWeakReference.idl	   \
  		nsrootidl.idl		   \
 +		$(NULL)
@@ -3939,21 +4084,20 @@ diff --git a/xpcom/base/nsAgg.h b/xpcom/
 -        return 0;                                                           \
 -    }                                                                       \
 -    return count;                                                           \
 -}
 +  NS_IMPL_AGGREGATED(_class)
  
  #define NS_IMPL_AGGREGATED_HELPER(_class)                                   \
  NS_IMETHODIMP                                                               \
-@@ -216,52 +165,6 @@ _class::Internal::QueryInterface(const n
-     _class* agg = (_class*)((char*)(this) - offsetof(_class, fAggregated)); \
+@@ -217,52 +166,6 @@ _class::Internal::QueryInterface(const n
      return agg->AggregatedQueryInterface(aIID, aInstancePtr);               \
  }                                                                           \
--
+ 
 -/**
 - * To make aggregated objects participate in cycle collection we need to enable
 - * the outer object (aggregator) to traverse/unlink the objects held by the
 - * inner object (the aggregatee). We can't just make the inner object QI'able to
 - * NS_CYCLECOLLECTIONPARTICIPANT_IID, we don't want to return the inner object's
 - * nsCycleCollectionParticipant for the outer object (which will happen if the
 - * outer object doesn't participate in cycle collection itself).
 - * NS_AGGREGATED_CYCLECOLLECTIONPARTICIPANT_IID enables the outer object to get
@@ -3989,19 +4133,20 @@ diff --git a/xpcom/base/nsAgg.h b/xpcom/
 -class nsAggregatedCycleCollectionParticipant
 -{
 -public:
 -    NS_DECLARE_STATIC_IID_ACCESSOR(NS_AGGREGATED_CYCLECOLLECTIONPARTICIPANT_IID)
 -};
 -
 -NS_DEFINE_STATIC_IID_ACCESSOR(nsAggregatedCycleCollectionParticipant, 
 -                              NS_AGGREGATED_CYCLECOLLECTIONPARTICIPANT_IID)
- 
+-
  // for use with QI macros in nsISupportsUtils.h:
  
+ #define NS_INTERFACE_MAP_BEGIN_AGGREGATED(_class)                           \
 @@ -288,25 +191,8 @@ _class::AggregatedQueryInterface(REFNSII
      foundInterface = InnerObject();                                         \
    else
  
 -#define NS_IMPL_AGGREGATED_QUERY_CYCLE_COLLECTION(_class)                   \
 -  if (aIID.Equals(IsPartOfAggregated() ?                                    \
 -                  NS_GET_IID(nsCycleCollectionParticipant) :                \
 -                  NS_GET_IID(nsAggregatedCycleCollectionParticipant)))      \
@@ -6842,22 +6987,20 @@ diff --git a/xpcom/ds/nsVariant.cpp b/xp
 @@ -45,7 +45,6 @@
  #include "prdtoa.h"
  #include <math.h>
  #include "nsCRT.h"
 -#include "nsCycleCollectionParticipant.h"
  
  /***************************************************************************/
  // Helpers for static convert functions...
-@@ -1656,33 +1655,6 @@ nsVariant::Cleanup(nsDiscriminatedUnion*
- 
-     data->mType = nsIDataType::VTYPE_EMPTY;
+@@ -1658,33 +1657,6 @@ nsVariant::Cleanup(nsDiscriminatedUnion*
      return NS_OK;
--}
--
+ }
+ 
 -/* static */ void
 -nsVariant::Traverse(const nsDiscriminatedUnion& data,
 -                    nsCycleCollectionTraversalCallback &cb)
 -{
 -    switch(data.mType)
 -    {
 -        case nsIDataType::VTYPE_INTERFACE:
 -        case nsIDataType::VTYPE_INTERFACE_IS:
@@ -6873,19 +7016,21 @@ diff --git a/xpcom/ds/nsVariant.cpp b/xp
 -                        cb.NoteXPCOMChild(*p);
 -                }
 -                default:
 -                    break;
 -            }
 -        default:
 -            break;
 -    }
- }
- 
+-}
+-
  /***************************************************************************/
+ /***************************************************************************/
+ // members...
 diff --git a/xpcom/ds/nsVariant.h b/xpcom/ds/nsVariant.h
 --- a/xpcom/ds/nsVariant.h
 +++ b/xpcom/ds/nsVariant.h
 @@ -42,8 +42,6 @@
  #include "nsIVariant.h"
  #include "nsStringFwd.h"
  #include "xpt_struct.h"
 -
@@ -7033,17 +7178,18 @@ diff --git a/xpcom/glue/nsCycleCollectio
  #define NS_CYCLECOLLECTIONPARTICIPANT_IID                                      \
  {                                                                              \
      0x9674489b,                                                                \
 @@ -87,142 +75,70 @@ NS_DEFINE_STATIC_IID_ACCESSOR(nsCycleCol
  NS_DEFINE_STATIC_IID_ACCESSOR(nsCycleCollectionISupports, 
                                NS_CYCLECOLLECTIONISUPPORTS_IID)
  
 -class nsCycleCollectionParticipant;
--
++class nsCycleCollectionTraversalCallback;
+ 
 -enum CCNodeType { RefCounted, GCMarked, GCUnmarked };
 -
 -class NS_NO_VTABLE nsCycleCollectionTraversalCallback
 -{
 -public:
 -    // If type is RefCounted you must call DescribeNode() with an accurate
 -    // refcount, otherwise cycle collection will fail, and probably crash.
 -    // If type is not refcounted then the refcount will be ignored.
@@ -7061,34 +7207,31 @@ diff --git a/xpcom/glue/nsCycleCollectio
 -                               nsCycleCollectionParticipant* helper) = 0;
 -    NS_IMETHOD_(void) NoteScriptChild(PRUint32 langID, void *child) = 0;
 -    NS_IMETHOD_(void) NoteXPCOMChild(nsISupports *child) = 0;
 -    NS_IMETHOD_(void) NoteNativeChild(void *child,
 -                                      nsCycleCollectionParticipant *helper) = 0;
 -};
 -
 -class NS_NO_VTABLE nsCycleCollectionParticipant
-+class nsCycleCollectionTraversalCallback;
-+
 +class nsCycleCollectionParticipant
  {
  public:
      NS_DECLARE_STATIC_IID_ACCESSOR(NS_CYCLECOLLECTIONPARTICIPANT_IID)
  
 -    NS_IMETHOD Traverse(void *p, nsCycleCollectionTraversalCallback &cb) = 0;
--
--    NS_IMETHOD Root(void *p) = 0;
--    NS_IMETHOD Unlink(void *p) = 0;
--    NS_IMETHOD Unroot(void *p) = 0;
 +    NS_IMETHOD Traverse(void *p, nsCycleCollectionTraversalCallback &cb)
 +    {
 +        NS_NOTREACHED("No CC");
 +        return NS_ERROR_UNEXPECTED;
 +    }
-+
+ 
+-    NS_IMETHOD Root(void *p) = 0;
+-    NS_IMETHOD Unlink(void *p) = 0;
+-    NS_IMETHOD Unroot(void *p) = 0;
 +    NS_IMETHOD Root(void *p)
 +    {
 +        NS_NOTREACHED("No CC");
 +        return NS_ERROR_UNEXPECTED;
 +    }
 +
 +    NS_IMETHOD Unlink(void *p)
 +    {
@@ -7142,23 +7285,26 @@ diff --git a/xpcom/glue/nsCycleCollectio
 +typedef nsCycleCollectionParticipant nsXPCOMCycleCollectionParticipant;
  
  ///////////////////////////////////////////////////////////////////////////////
  // Helpers for implementing a QI to nsXPCOMCycleCollectionParticipant
  ///////////////////////////////////////////////////////////////////////////////
  
 -#define NS_CYCLE_COLLECTION_INNERCLASS                                         \
 -        cycleCollection
--
++#define NS_IMPL_QUERY_CYCLE_COLLECTION(_class)
+ 
 -#define NS_CYCLE_COLLECTION_CLASSNAME(_class)                                  \
 -        _class::NS_CYCLE_COLLECTION_INNERCLASS
--
++#define NS_INTERFACE_MAP_ENTRY_CYCLE_COLLECTION(_class)
+ 
 -#define NS_CYCLE_COLLECTION_INNERNAME                                          \
 -        _cycleCollectorGlobal
--
++#define NS_INTERFACE_MAP_ENTRY_CYCLE_COLLECTION_ISUPPORTS(_class)
+ 
 -#define NS_CYCLE_COLLECTION_NAME(_class)                                       \
 -        _class::NS_CYCLE_COLLECTION_INNERNAME
 -
 -#define NS_IMPL_QUERY_CYCLE_COLLECTION(_class)                                 \
 -  if ( aIID.Equals(NS_GET_IID(nsXPCOMCycleCollectionParticipant)) ) {          \
 -    *aInstancePtr = & NS_CYCLE_COLLECTION_NAME(_class);                        \
 -    return NS_OK;                                                              \
 -  } else
@@ -7172,22 +7318,16 @@ diff --git a/xpcom/glue/nsCycleCollectio
 -  NS_IMPL_QUERY_CYCLE_COLLECTION(_class)
 -
 -#define NS_INTERFACE_MAP_ENTRY_CYCLE_COLLECTION_ISUPPORTS(_class)              \
 -  NS_IMPL_QUERY_CYCLE_COLLECTION_ISUPPORTS(_class)
 -
 -#define NS_INTERFACE_MAP_ENTRIES_CYCLE_COLLECTION(_class)                      \
 -  NS_INTERFACE_MAP_ENTRY_CYCLE_COLLECTION(_class)                              \
 -  NS_INTERFACE_MAP_ENTRY_CYCLE_COLLECTION_ISUPPORTS(_class)
-+#define NS_IMPL_QUERY_CYCLE_COLLECTION(_class)
-+
-+#define NS_INTERFACE_MAP_ENTRY_CYCLE_COLLECTION(_class)
-+
-+#define NS_INTERFACE_MAP_ENTRY_CYCLE_COLLECTION_ISUPPORTS(_class)
-+
 +#define NS_INTERFACE_MAP_ENTRIES_CYCLE_COLLECTION(_class)
  
  #define NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(_class)                        \
 -  NS_INTERFACE_MAP_BEGIN(_class)                                               \
 -    NS_INTERFACE_MAP_ENTRIES_CYCLE_COLLECTION(_class)
 +  NS_INTERFACE_MAP_BEGIN(_class)
  
  #define NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_INHERITED(_class)              \
@@ -7388,17 +7528,19 @@ diff --git a/xpcom/glue/nsCycleCollectio
 -  NS_CYCLE_COLLECTION_CLASSNAME(_class)::Trace(void *p,                        \
 -                                               TraceCallback aCallback,        \
 -                                               void *aClosure)                 \
 -  {                                                                            \
 -    nsISupports *s = static_cast<nsISupports*>(p);                             \
 -    NS_ASSERTION(CheckForRightISupports(s),                                    \
 -                 "not the nsISupports pointer we expect");                     \
 -    _class *tmp = Downcast(s);
--
++#define NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN(_class)
++#define NS_IMPL_CYCLE_COLLECTION_TRACE_NATIVE_BEGIN(_class)
+ 
 -#define NS_IMPL_CYCLE_COLLECTION_TRACE_NATIVE_BEGIN(_class)                    \
 -  void                                                                         \
 -  NS_CYCLE_COLLECTION_CLASSNAME(_class)::Trace(void *p,                        \
 -                                               TraceCallback aCallback,        \
 -                                               void *aClosure)                 \
 -  {                                                                            \
 -    _class *tmp = static_cast<_class*>(p);
 -
@@ -7413,19 +7555,16 @@ diff --git a/xpcom/glue/nsCycleCollectio
 -  NS_IMPL_CYCLE_COLLECTION_TRACE_CALLBACK(nsIProgrammingLanguage::JAVASCRIPT,  \
 -                                          _object)
 -
 -#define NS_IMPL_CYCLE_COLLECTION_TRACE_JS_MEMBER_CALLBACK(_field)              \
 -  NS_IMPL_CYCLE_COLLECTION_TRACE_JS_CALLBACK(tmp->_field)
 -
 -#define NS_IMPL_CYCLE_COLLECTION_TRACE_END                                     \
 -  }
-+#define NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN(_class)
-+#define NS_IMPL_CYCLE_COLLECTION_TRACE_NATIVE_BEGIN(_class)
-+
 +#define NS_IMPL_CYCLE_COLLECTION_TRACE_CALLBACK(_langID, _object)
 +#define NS_IMPL_CYCLE_COLLECTION_TRACE_MEMBER_CALLBACK(_langID, _field)
 +#define NS_IMPL_CYCLE_COLLECTION_TRACE_JS_CALLBACK(_object)
 +#define NS_IMPL_CYCLE_COLLECTION_TRACE_JS_MEMBER_CALLBACK(_field)
 +#define NS_IMPL_CYCLE_COLLECTION_TRACE_END
  
  ///////////////////////////////////////////////////////////////////////////////
  // Helpers for implementing a concrete nsCycleCollectionParticipant 
@@ -7519,17 +7658,18 @@ diff --git a/xpcom/glue/nsCycleCollectio
 @@ -499,56 +207,15 @@ NS_CYCLE_COLLECTION_PARTICIPANT_INSTANCE
   * the purple buffer. If you're just using NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   * then you don't need this.
   */
 -#define NS_DECL_CYCLE_COLLECTION_UNMARK_PURPLE_STUB(_class)                    \
 -  NS_IMETHODIMP_(void) UnmarkPurple()                                          \
 -  {                                                                            \
 -  }                                                                            \
--
++#define NS_DECL_CYCLE_COLLECTION_UNMARK_PURPLE_STUB(_class)
+ 
 -#define NS_IMPL_CYCLE_COLLECTION_CLASS(_class)                                 \
 -  NS_CYCLE_COLLECTION_CLASSNAME(_class) NS_CYCLE_COLLECTION_NAME(_class);
 -
 -#define NS_DECL_CYCLE_COLLECTION_NATIVE_CLASS_BODY                             \
 -  public:                                                                      \
 -    NS_IMETHOD Root(void *n);                                                  \
 -    NS_IMETHOD Unlink(void *n);                                                \
 -    NS_IMETHOD Unroot(void *n);                                                \
@@ -7565,18 +7705,16 @@ diff --git a/xpcom/glue/nsCycleCollectio
 -#define NS_IMPL_CYCLE_COLLECTION_UNROOT_NATIVE(_class, _unroot_function)       \
 -  NS_IMETHODIMP                                                                \
 -  NS_CYCLE_COLLECTION_CLASSNAME(_class)::Unroot(void *p)                       \
 -  {                                                                            \
 -    _class *tmp = static_cast<_class*>(p);                                     \
 -    tmp->_unroot_function();                                                   \
 -    return NS_OK;                                                              \
 -  }
-+#define NS_DECL_CYCLE_COLLECTION_UNMARK_PURPLE_STUB(_class)
-+
 +#define NS_IMPL_CYCLE_COLLECTION_CLASS(_class)
 +#define NS_CYCLE_COLLECTION_NATIVE_INNERNAME
 +#define NS_CYCLE_COLLECTION_NATIVE_NAME(_class)
 +#define NS_DECL_CYCLE_COLLECTION_NATIVE_CLASS(_class)
 +#define NS_IMPL_CYCLE_COLLECTION_SCRIPT_HOLDER_NATIVE_CLASS(_class)
 +#define NS_IMPL_CYCLE_COLLECTION_ROOT_NATIVE(_class, _root_function)
 +#define NS_IMPL_CYCLE_COLLECTION_UNROOT_NATIVE(_class, _unroot_function)
  
@@ -7588,21 +7726,20 @@ diff --git a/xpcom/glue/nsISupportsImpl.
 @@ -55,7 +55,6 @@
  
  #include "nsDebug.h"
  #include "nsTraceRefcnt.h"
 -#include "nsCycleCollector.h"
  
  ////////////////////////////////////////////////////////////////////////////////
  // Macros to help detect thread-safety:
-@@ -91,102 +90,6 @@ private:
- 
+@@ -92,102 +91,6 @@ private:
  
  // Support for ISupports classes which interact with cycle collector.
--
+ 
 -class nsCycleCollectingAutoRefCnt {
 -
 -public:
 -  nsCycleCollectingAutoRefCnt()
 -    : mValue(0)
 -  {}
 -
 -  nsCycleCollectingAutoRefCnt(nsrefcnt aValue)
@@ -7688,28 +7825,29 @@ diff --git a/xpcom/glue/nsISupportsImpl.
 -  operator nsrefcnt() const
 -  {
 -    return get();
 -  }
 -
 - private:
 -  nsrefcnt mValue;
 -};
- 
+-
  class nsAutoRefCnt {
  
-@@ -207,6 +110,8 @@ class nsAutoRefCnt {
-     nsrefcnt operator--(int);
+  public:
+@@ -208,6 +111,8 @@ class nsAutoRefCnt {
      nsrefcnt mValue;
  };
-+
+ 
 +typedef nsAutoRefCnt nsCycleCollectingAutoRefCnt;
- 
++
  ///////////////////////////////////////////////////////////////////////////////
  
+ /**
 @@ -226,21 +131,7 @@ protected:                              
    NS_DECL_OWNINGTHREAD                                                        \
  public:
  
 -#define NS_DECL_CYCLE_COLLECTING_ISUPPORTS                                    \
 -public:                                                                       \
 -  NS_IMETHOD QueryInterface(REFNSIID aIID,                                    \
 -                            void** aInstancePtr);                             \
@@ -7737,39 +7875,37 @@ diff --git a/xpcom/glue/nsISupportsImpl.
 -{                                                                             \
 -  NS_PRECONDITION(PRInt32(mRefCnt) >= 0, "illegal refcnt");                   \
 -  NS_ASSERT_OWNINGTHREAD(_class);                                             \
 -  nsrefcnt count =                                                            \
 -    mRefCnt.incr(NS_CYCLE_COLLECTION_CLASSNAME(_class)::Upcast(this));        \
 -  NS_LOG_ADDREF(this, count, #_class, sizeof(*this));                         \
 -  return count;                                                               \
 -}
--
++#define NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOUS(_class, _basetype)  NS_IMPL_ADDREF(_class)
+ 
 -#define NS_IMPL_CYCLE_COLLECTING_ADDREF(_class)      \
 -  NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOUS(_class, _class)
--
++#define NS_IMPL_CYCLE_COLLECTING_ADDREF(_class) NS_IMPL_ADDREF(_class)
+ 
 -#define NS_IMPL_CYCLE_COLLECTING_RELEASE_FULL(_class, _basetype, _destroy)    \
 -NS_IMETHODIMP_(nsrefcnt) _class::Release(void)                                \
 -{                                                                             \
 -  NS_PRECONDITION(0 != mRefCnt, "dup release");                               \
 -  NS_ASSERT_OWNINGTHREAD(_class);                                             \
 -  nsISupports *base = NS_CYCLE_COLLECTION_CLASSNAME(_class)::Upcast(this);    \
 -  nsrefcnt count = mRefCnt.decr(base);                                        \
 -  NS_LOG_RELEASE(this, count, #_class);                                       \
 -  if (count == 0) {                                                           \
 -    mRefCnt.stabilizeForDeletion(base);                                       \
 -    _destroy;                                                                 \
 -    return 0;                                                                 \
 -  }                                                                           \
 -  return count;                                                               \
 -}
-+#define NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOUS(_class, _basetype)  NS_IMPL_ADDREF(_class)
-+
-+#define NS_IMPL_CYCLE_COLLECTING_ADDREF(_class) NS_IMPL_ADDREF(_class)
-+
 +#define NS_IMPL_CYCLE_COLLECTING_RELEASE_FULL(_class, _basetype, _destroy) \
 +  NS_IMPL_RELEASE_WITH_DESTROY(_class, _destroy)
  
  #define NS_IMPL_CYCLE_COLLECTING_RELEASE_WITH_DESTROY(_class, _destroy)       \
    NS_IMPL_CYCLE_COLLECTING_RELEASE_FULL(_class, _class, _destroy)
 diff --git a/xpcom/glue/objs.mk b/xpcom/glue/objs.mk
 --- a/xpcom/glue/objs.mk
 +++ b/xpcom/glue/objs.mk
@@ -7779,21 +7915,21 @@ diff --git a/xpcom/glue/objs.mk b/xpcom/
    nsTObserverArray.cpp           \
 -  nsCycleCollectionParticipant.cpp \
    nsDeque.cpp \
    nsTextFormatter.cpp \
    $(NULL)
 diff --git a/xpfe/components/intl/nsCharsetMenu.cpp b/xpfe/components/intl/nsCharsetMenu.cpp
 --- a/xpfe/components/intl/nsCharsetMenu.cpp
 +++ b/xpfe/components/intl/nsCharsetMenu.cpp
-@@ -467,12 +467,6 @@ NS_IMETHODIMP nsCharsetMenuObserver::Obs
+@@ -466,12 +466,6 @@ NS_IMETHODIMP nsCharsetMenuObserver::Obs
+ 
  //----------------------------------------------------------------------------
  // Class nsCharsetMenu [implementation]
- 
+-
 -NS_IMPL_CYCLE_COLLECTION_CLASS(nsCharsetMenu)
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_0(nsCharsetMenu)
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsCharsetMenu)
 -  cb.NoteXPCOMChild(nsCharsetMenu::mInner);
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
--
+ 
  NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOUS(nsCharsetMenu, nsIRDFDataSource)
  NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUOUS(nsCharsetMenu, nsIRDFDataSource)
- NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsCharsetMenu)
deleted file mode 100644
--- a/remove-cyclec.patch2
+++ /dev/null
@@ -1,144 +0,0 @@
-diff --git a/content/events/src/nsDOMDataContainerEvent.cpp b/content/events/src/nsDOMDataContainerEvent.cpp
---- a/content/events/src/nsDOMDataContainerEvent.cpp
-+++ b/content/events/src/nsDOMDataContainerEvent.cpp
-@@ -49,17 +49,6 @@ nsDOMDataContainerEvent::nsDOMDataContai
- 
- NS_IMPL_CYCLE_COLLECTION_CLASS(nsDOMDataContainerEvent)
- 
--NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(nsDOMDataContainerEvent,
--                                                nsDOMEvent)
--  if (tmp->mData.IsInitialized())
--    tmp->mData.Clear();
--NS_IMPL_CYCLE_COLLECTION_UNLINK_END
--
--NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(nsDOMDataContainerEvent,
--                                                  nsDOMEvent)
--  tmp->mData.EnumerateRead(TraverseEntry, &cb);
--NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
--
- NS_IMPL_ADDREF_INHERITED(nsDOMDataContainerEvent, nsDOMEvent)
- NS_IMPL_RELEASE_INHERITED(nsDOMDataContainerEvent, nsDOMEvent)
- 
-@@ -104,15 +93,3 @@ NS_NewDOMDataContainerEvent(nsIDOMEvent*
-   return CallQueryInterface(it, aInstancePtrResult);
- }
- 
--PLDHashOperator
--nsDOMDataContainerEvent::TraverseEntry(const nsAString& aKey,
--                                       nsIVariant *aDataItem,
--                                       void* aUserArg)
--{
--  nsCycleCollectionTraversalCallback *cb =
--    static_cast<nsCycleCollectionTraversalCallback*>(aUserArg);
--  cb->NoteXPCOMChild(aDataItem);
--
--  return PL_DHASH_NEXT;
--}
--
-diff --git a/content/events/src/nsDOMDataContainerEvent.h b/content/events/src/nsDOMDataContainerEvent.h
---- a/content/events/src/nsDOMDataContainerEvent.h
-+++ b/content/events/src/nsDOMDataContainerEvent.h
-@@ -57,9 +57,6 @@ public:
-   NS_DECL_NSIDOMDATACONTAINEREVENT
- 
- private:
--  static PLDHashOperator PR_CALLBACK
--    TraverseEntry(const nsAString& aKey, nsIVariant *aDataItem, void* aUserArg);
--
-   nsInterfaceHashtable<nsStringHashKey, nsIVariant> mData;
- };
- 
-diff --git a/content/svg/content/src/nsSVGUseElement.cpp b/content/svg/content/src/nsSVGUseElement.cpp
---- a/content/svg/content/src/nsSVGUseElement.cpp
-+++ b/content/svg/content/src/nsSVGUseElement.cpp
-@@ -61,20 +61,6 @@ NS_IMPL_NS_NEW_SVG_ELEMENT(Use)
- 
- //----------------------------------------------------------------------
- // nsISupports methods
--
--NS_IMPL_CYCLE_COLLECTION_CLASS(nsSVGUseElement)
--NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(nsSVGUseElement,
--                                                nsSVGUseElementBase)
--  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mOriginal)
--  tmp->DestroyAnonymousContent();
--  tmp->RemoveListener();
--NS_IMPL_CYCLE_COLLECTION_UNLINK_END
--NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(nsSVGUseElement,
--                                                  nsSVGUseElementBase)
--  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mOriginal)
--  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mClone)
--  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mSourceContent)
--NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
- 
- NS_IMPL_ADDREF_INHERITED(nsSVGUseElement,nsSVGUseElementBase)
- NS_IMPL_RELEASE_INHERITED(nsSVGUseElement,nsSVGUseElementBase)
-diff --git a/content/xbl/src/nsXBLPrototypeHandler.cpp b/content/xbl/src/nsXBLPrototypeHandler.cpp
---- a/content/xbl/src/nsXBLPrototypeHandler.cpp
-+++ b/content/xbl/src/nsXBLPrototypeHandler.cpp
-@@ -159,25 +159,6 @@ nsXBLPrototypeHandler::~nsXBLPrototypeHa
- 
-   // We own the next handler in the chain, so delete it now.
-   delete mNextHandler;
--}
--
--void
--nsXBLPrototypeHandler::Traverse(nsCycleCollectionTraversalCallback &cb) const
--{
--  cb.NoteXPCOMChild(mGlobalForCachedHandler);
--}
--
--void
--nsXBLPrototypeHandler::Trace(TraceCallback aCallback, void *aClosure) const
--{
--  if (mCachedHandler)
--    aCallback(nsIProgrammingLanguage::JAVASCRIPT, mCachedHandler, aClosure);
--}
--
--void
--nsXBLPrototypeHandler::Unlink()
--{
--  ForgetCachedHandler();
- }
- 
- already_AddRefed<nsIContent>
-diff --git a/content/xbl/src/nsXBLPrototypeHandler.h b/content/xbl/src/nsXBLPrototypeHandler.h
---- a/content/xbl/src/nsXBLPrototypeHandler.h
-+++ b/content/xbl/src/nsXBLPrototypeHandler.h
-@@ -153,10 +153,6 @@ public:
-     return (mType & NS_HANDLER_ALLOW_UNTRUSTED) != 0;
-   }
- 
--  void Traverse(nsCycleCollectionTraversalCallback &cb) const;
--  void Trace(TraceCallback aCallback, void *aClosure) const;
--  void Unlink();
--	
- public:
-   static PRUint32 gRefCnt;
-   
-diff --git a/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp b/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp
---- a/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp
-+++ b/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp
-@@ -292,23 +292,6 @@ private:
-  * txMozillaXSLTProcessor
-  */
- 
--NS_IMPL_CYCLE_COLLECTION_CLASS(txMozillaXSLTProcessor)
--NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(txMozillaXSLTProcessor)
--    NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mEmbeddedStylesheetRoot)
--    NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mSource)
--    NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mPrincipal)
--    tmp->mVariables.clear();
--NS_IMPL_CYCLE_COLLECTION_UNLINK_END
--NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(txMozillaXSLTProcessor)
--    NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mEmbeddedStylesheetRoot)
--    NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mSource)
--    NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mPrincipal)
--    txOwningExpandedNameMap<txIGlobalParameter>::iterator iter(tmp->mVariables);
--    while (iter.next()) {
--        cb.NoteXPCOMChild(static_cast<txVariable*>(iter.value())->getValue());
--    }
--NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
--
- NS_IMPL_CYCLE_COLLECTING_ADDREF(txMozillaXSLTProcessor)
- NS_IMPL_CYCLE_COLLECTING_RELEASE(txMozillaXSLTProcessor)
- NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(txMozillaXSLTProcessor)
--- a/remove-zeroing-operator-news
+++ b/remove-zeroing-operator-news
@@ -1,33 +1,35 @@
+* * *
+
 diff --git a/content/base/src/nsContentSink.h b/content/base/src/nsContentSink.h
 --- a/content/base/src/nsContentSink.h
 +++ b/content/base/src/nsContentSink.h
 @@ -109,7 +109,8 @@ extern PRLogModuleInfo* gContentSinkLogM
  // sampling the clock too often.
  #define NS_MAX_TOKENS_DEFLECTED_IN_LOW_FREQ_MODE 200
  
 -class nsContentSink : public nsICSSLoaderObserver,
 +class nsContentSink : public XPCOMGCFinalizedObject,
 +                      public nsICSSLoaderObserver,
                        public nsIScriptLoaderObserver,
                        public nsSupportsWeakReference,
                        public nsStubDocumentObserver,
-@@ -213,11 +214,6 @@ protected:
-   // Later on we might want to make this more involved somehow
+@@ -214,11 +215,6 @@ protected:
    // (e.g. stop waiting after some timeout or whatnot).
    PRBool WaitForPendingSheets() { return mPendingSheetCount > 0; }
--
+ 
 -private:
 -  // People shouldn't be allocating this class directly.  All subclasses should
 -  // be allocated using a zeroing operator new.
 -  void* operator new(size_t sz) CPP_THROW_NEW;  // Not to be implemented
- 
+-
  protected:
  
+   void ContinueInterruptedParsingAsync();
 diff --git a/content/html/document/src/nsHTMLContentSink.cpp b/content/html/document/src/nsHTMLContentSink.cpp
 --- a/content/html/document/src/nsHTMLContentSink.cpp
 +++ b/content/html/document/src/nsHTMLContentSink.cpp
 @@ -171,8 +171,6 @@ public:
    HTMLContentSink();
    virtual ~HTMLContentSink();
  
 -  NS_DECL_AND_IMPL_ZEROING_OPERATOR_NEW
@@ -296,22 +298,21 @@ diff --git a/content/html/document/src/n
  
    mTitleString.Truncate();
 @@ -2687,11 +2678,11 @@ HTMLContentSink::AddDocTypeDecl(const ns
    }
  
    if (!publicId.IsEmpty() || !systemId.IsEmpty() || !name.IsEmpty()) {
 -    nsCOMPtr<nsIDOMDocumentType> oldDocType;
 -    nsCOMPtr<nsIDOMDocumentType> docType;
--
++    nsIDOMDocumentType* oldDocType = nsnull;
++    nsIDOMDocumentType* docType = nsnull;
+ 
 -    nsCOMPtr<nsIDOMDocument> doc(do_QueryInterface(mHTMLDocument));
 -    doc->GetDoctype(getter_AddRefs(oldDocType));
-+    nsIDOMDocumentType* oldDocType = nsnull;
-+    nsIDOMDocumentType* docType = nsnull;
-+
 +    nsIDOMDocument* doc(do_QueryInterface(mHTMLDocument));
 +    doc->GetDoctype(&oldDocType);
  
      // Assign "HTML" if we don't have anything, and normalize
      // the name if it is something like "hTmL", per HTML5.
 @@ -2699,12 +2690,12 @@ HTMLContentSink::AddDocTypeDecl(const ns
        name.AssignLiteral("HTML");
      }
@@ -376,20 +377,19 @@ diff --git a/content/html/document/src/n
    if (parent) {
      // Create content object
 -    nsCOMPtr<nsIContent> element;
 -    nsCOMPtr<nsINodeInfo> nodeInfo;
 +    nsIContent* element = nsnull;
 +    nsINodeInfo* nodeInfo = nsnull;
      mNodeInfoManager->GetNodeInfo(nsGkAtoms::link, nsnull, kNameSpaceID_None,
 -                                  getter_AddRefs(nodeInfo));
--
++                                  &nodeInfo);
+ 
 -    result = NS_NewHTMLElement(getter_AddRefs(element), nodeInfo);
-+                                  &nodeInfo);
-+
 +    result = NS_NewHTMLElement(&element, nodeInfo);
      NS_ENSURE_SUCCESS(result, result);
  
 -    nsCOMPtr<nsIStyleSheetLinkingElement> ssle(do_QueryInterface(element));
 +    nsIStyleSheetLinkingElement* ssle(do_QueryInterface(element));
  
      if (ssle) {
        // XXX need prefs. check here.
@@ -430,21 +430,20 @@ diff --git a/content/html/document/src/n
  
 -      nsCOMPtr<nsIDocShellTreeItem> docShellAsItem =
 +      nsIDocShellTreeItem* docShellAsItem =
          do_QueryInterface(mDocShell);
        NS_ENSURE_TRUE(docShellAsItem, NS_ERROR_FAILURE);
  
 -      nsCOMPtr<nsIDocShellTreeItem> parentAsItem;
 -      docShellAsItem->GetSameTypeParent(getter_AddRefs(parentAsItem));
--
--      nsCOMPtr<nsIDocShell> parent(do_QueryInterface(parentAsItem));
 +      nsIDocShellTreeItem* parentAsItem = nsnull;
 +      docShellAsItem->GetSameTypeParent(&parentAsItem);
-+
+ 
+-      nsCOMPtr<nsIDocShell> parent(do_QueryInterface(parentAsItem));
 +      nsIDocShell* parent(do_QueryInterface(parentAsItem));
        if (parent) {
 -        nsCOMPtr<nsIContentViewer> parentContentViewer;
 +        nsIContentViewer* parentContentViewer = nsnull;
          nsresult rv =
 -          parent->GetContentViewer(getter_AddRefs(parentContentViewer));
 +          parent->GetContentViewer(&parentContentViewer);
          if (NS_SUCCEEDED(rv) && parentContentViewer) {
@@ -543,22 +542,20 @@ diff --git a/content/html/document/src/n
        NS_ASSERTION(name, "This should not happen!");
  
        result = mNodeInfoManager->GetNodeInfo(name, nsnull, kNameSpaceID_None,
 -                                             getter_AddRefs(nodeInfo));
 +                                             &nodeInfo);
        NS_ENSURE_SUCCESS(result, result);
  
 -      NS_ADDREF(mNodeInfoCache[nodeType] = nodeInfo);
--    }
--
++      mNodeInfoCache[nodeType] = nodeInfo;
+     }
+ 
 -    content = CreateHTMLElement(nodeType, nodeInfo, PR_FALSE).get();
-+      mNodeInfoCache[nodeType] = nodeInfo;
-+    }
-+
 +    content = CreateHTMLElement(nodeType, nodeInfo, PR_FALSE);
      NS_ENSURE_TRUE(content, NS_ERROR_OUT_OF_MEMORY);
  
      result = AddAttributes(aNode, content);
 @@ -477,23 +474,23 @@ nsHTMLFragmentContentSink::AddLeaf(const
          FlushText();
  
          // Create new leaf content object
@@ -781,25 +778,25 @@ diff --git a/content/xml/document/src/ns
 -
 -  NS_DECL_AND_IMPL_ZEROING_OPERATOR_NEW
  
    nsresult Init(nsIDocument* aDoc,
                  nsIURI* aURL,
 diff --git a/content/xml/document/src/nsXMLFragmentContentSink.cpp b/content/xml/document/src/nsXMLFragmentContentSink.cpp
 --- a/content/xml/document/src/nsXMLFragmentContentSink.cpp
 +++ b/content/xml/document/src/nsXMLFragmentContentSink.cpp
-@@ -68,8 +68,6 @@ public:
+@@ -67,8 +67,6 @@ public:
+ public:
    nsXMLFragmentContentSink(PRBool aAllContent = PR_FALSE);
    virtual ~nsXMLFragmentContentSink();
- 
+-
 -  NS_DECL_AND_IMPL_ZEROING_OPERATOR_NEW
--
+ 
    // nsISupports
    NS_DECL_ISUPPORTS_INHERITED
- 
 @@ -143,7 +141,7 @@ NewXMLFragmentContentSinkHelper(PRBool a
      return NS_ERROR_OUT_OF_MEMORY;
    }
    
 -  NS_ADDREF(*aResult = it);
 +  *aResult = it;
    
    return NS_OK;
@@ -824,20 +821,19 @@ diff --git a/content/xml/document/src/ns
  
    // Drop our reference to the parser to get rid of a circular
    // reference.
 @@ -294,9 +292,9 @@ nsXMLFragmentContentSink::HandleProcessi
    const nsDependentString target(aTarget);
    const nsDependentString data(aData);
  
 -  nsCOMPtr<nsIContent> node;
--
++  nsIContent* node = nsnull;
+ 
 -  result = NS_NewXMLProcessingInstruction(getter_AddRefs(node),
-+  nsIContent* node = nsnull;
-+
 +  result = NS_NewXMLProcessingInstruction(&node,
                                            mNodeInfoManager, target, data);
    if (NS_SUCCEEDED(result)) {
      // no special processing here.  that should happen when the fragment moves into the document
 @@ -339,14 +337,14 @@ nsXMLFragmentContentSink::ReportError(co
    mState = eXMLContentSinkState_InProlog;
  
    // Clear the current content
@@ -951,17 +947,17 @@ diff --git a/content/xml/document/src/ns
 +    nsContentUtils::SplitExpatName(aAtts[i], &prefix,
 +                                   &localName, &nameSpaceID);
      rv = mNodeInfoManager->GetNodeInfo(localName, prefix, nameSpaceID,
 -                                       getter_AddRefs(nodeInfo));
 +                                       &nodeInfo);
      NS_ENSURE_SUCCESS(rv, rv);
      
      name = nodeInfo->NameAtom();
-@@ -702,21 +700,21 @@ nsXHTMLParanoidFragmentSink::HandleEndEl
+@@ -699,21 +697,21 @@ nsXHTMLParanoidFragmentSink::HandleEndEl
  {
    nsresult rv;
    PRInt32 nameSpaceID;
 -  nsCOMPtr<nsIAtom> prefix, localName;
 -  nsContentUtils::SplitExpatName(aName, getter_AddRefs(prefix),
 -                                 getter_AddRefs(localName), &nameSpaceID);
 +  nsIAtom* prefix = nsnull, *localName = nsnull;
 +  nsContentUtils::SplitExpatName(aName, &prefix,
@@ -999,99 +995,80 @@ diff --git a/layout/base/nsPresShell.cpp
  {
  public:
    PresShell();
 -
 -  NS_DECL_AND_IMPL_ZEROING_OPERATOR_NEW
  
    // nsISupports
    NS_DECL_ISUPPORTS
-@@ -881,12 +879,12 @@ public:
-                             nscolor aBackgroundColor,
-                             gfxContext* aThebesContext);
- 
--  virtual already_AddRefed<gfxASurface> RenderNode(nsIDOMNode* aNode,
-+  virtual gfxASurface* RenderNode(nsIDOMNode* aNode,
-                                                    nsIRegion* aRegion,
-                                                    nsPoint& aPoint,
-                                                    nsRect* aScreenRect);
- 
--  virtual already_AddRefed<gfxASurface> RenderSelection(nsISelection* aSelection,
-+  virtual gfxASurface* RenderSelection(nsISelection* aSelection,
-                                                         nsPoint& aPoint,
-                                                         nsRect* aScreenRect);
- 
-@@ -1080,7 +1078,7 @@ protected:
+@@ -1081,7 +1079,7 @@ protected:
     * aScreenRect - [out] set to the area of the screen the painted area should
     *               be displayed at
     */
 -  already_AddRefed<gfxASurface>
 +  gfxASurface*
    PaintRangePaintInfo(nsTArray<nsAutoPtr<RangePaintInfo> >* aItems,
                        nsISelection* aSelection,
                        nsIRegion* aRegion,
-@@ -1352,10 +1350,9 @@ nsIPresShell::RemoveWeakFrame(nsWeakFram
-   }
- }
- 
--already_AddRefed<nsFrameSelection>
-+nsFrameSelection*
+@@ -1356,7 +1354,6 @@ already_AddRefed<nsFrameSelection>
+ already_AddRefed<nsFrameSelection>
  nsIPresShell::FrameSelection()
  {
 -  NS_IF_ADDREF(mSelection);
    return mSelection;
  }
  
-@@ -1453,7 +1450,6 @@ PresShell::Init(nsIDocument* aDocument,
+@@ -1454,7 +1451,6 @@ PresShell::Init(nsIDocument* aDocument,
    NS_ENSURE_SUCCESS(result, result);
  
    mDocument = aDocument;
 -  NS_ADDREF(mDocument);
    mViewManager = aViewManager;
  
    // Create our frame constructor.
-@@ -1465,7 +1461,6 @@ PresShell::Init(nsIDocument* aDocument,
+@@ -1466,7 +1462,6 @@ PresShell::Init(nsIDocument* aDocument,
  
    // Bind the context to the presentation shell.
    mPresContext = aPresContext;
 -  NS_ADDREF(mPresContext);
    aPresContext->SetShell(this);
  
    // Now we can initialize the style set.
-@@ -1529,7 +1524,7 @@ PresShell::Init(nsIDocument* aDocument,
+@@ -1530,7 +1525,7 @@ PresShell::Init(nsIDocument* aDocument,
    }
  
    {
 -    nsCOMPtr<nsIObserverService> os =
 +    nsIObserverService* os =
        do_GetService("@mozilla.org/observer-service;1", &result);
      if (os) {
        os->AddObserver(this, NS_LINK_VISITED_EVENT_TOPIC, PR_FALSE);
-@@ -1590,7 +1585,7 @@ PresShell::Destroy()
+@@ -1591,7 +1586,7 @@ PresShell::Destroy()
    }
  
    {
 -    nsCOMPtr<nsIObserverService> os =
 +    nsIObserverService* os =
        do_GetService("@mozilla.org/observer-service;1");
      if (os) {
        os->RemoveObserver(this, NS_LINK_VISITED_EVENT_TOPIC);
-@@ -1769,9 +1764,9 @@ PresShell::SetPreferenceStyleRules(PRBoo
+@@ -1771,9 +1766,9 @@ PresShell::SetPreferenceStyleRules(PRBoo
      nsresult result = NS_OK;
  
      // first, make sure this is not a chrome shell 
 -    nsCOMPtr<nsISupports> container = mPresContext->GetContainer();
 +    nsISupports* container = mPresContext->GetContainer();
      if (container) {
 -      nsCOMPtr<nsIDocShellTreeItem> docShell(do_QueryInterface(container, &result));
 +      nsIDocShellTreeItem* docShell(do_QueryInterface(container, &result));
        if (NS_SUCCEEDED(result) && docShell){
          PRInt32 docShellType;
          result = docShell->GetItemType(&docShellType);
-@@ -1855,14 +1850,14 @@ nsresult PresShell::CreatePreferenceStyl
+@@ -1857,14 +1852,14 @@ nsresult PresShell::CreatePreferenceStyl
    nsresult result = CallCreateInstance(kCSSStyleSheetCID, &mPrefStyleSheet);
    if (NS_SUCCEEDED(result)) {
      NS_ASSERTION(mPrefStyleSheet, "null but no error");
 -    nsCOMPtr<nsIURI> uri;
 -    result = NS_NewURI(getter_AddRefs(uri), "about:PreferenceStyleSheet", nsnull);
 +    nsIURI* uri = nsnull;
 +    result = NS_NewURI(&uri, "about:PreferenceStyleSheet", nsnull);
      if (NS_SUCCEEDED(result)) {
@@ -1099,174 +1076,174 @@ diff --git a/layout/base/nsPresShell.cpp
        result = mPrefStyleSheet->SetURIs(uri, nsnull, uri);
        if (NS_SUCCEEDED(result)) {
          mPrefStyleSheet->SetComplete();
 -        nsCOMPtr<nsIDOMCSSStyleSheet> sheet(do_QueryInterface(mPrefStyleSheet));
 +        nsIDOMCSSStyleSheet* sheet(do_QueryInterface(mPrefStyleSheet));
          if (sheet) {
            PRUint32 index;
            result = sheet->InsertRule(NS_LITERAL_STRING("@namespace url(http://www.w3.org/1999/xhtml);"),
-@@ -1907,7 +1902,7 @@ PresShell::SetPrefNoScriptRule()
+@@ -1909,7 +1904,7 @@ PresShell::SetPrefNoScriptRule()
        NS_ENSURE_SUCCESS(rv, rv);
      }
      // get the DOM interface to the stylesheet
 -    nsCOMPtr<nsIDOMCSSStyleSheet> sheet(do_QueryInterface(mPrefStyleSheet, &rv));
 +    nsIDOMCSSStyleSheet* sheet(do_QueryInterface(mPrefStyleSheet, &rv));
      NS_ENSURE_SUCCESS(rv, rv);
      PRUint32 index = 0;
      rv = sheet->InsertRule(NS_LITERAL_STRING("noscript{display:none!important}"),
-@@ -1934,12 +1929,12 @@ nsresult PresShell::SetPrefNoFramesRule(
+@@ -1936,12 +1931,12 @@ nsresult PresShell::SetPrefNoFramesRule(
    NS_ASSERTION(mPrefStyleSheet, "prefstylesheet should not be null");
    
    // get the DOM interface to the stylesheet
 -  nsCOMPtr<nsIDOMCSSStyleSheet> sheet(do_QueryInterface(mPrefStyleSheet, &rv));
 +  nsIDOMCSSStyleSheet* sheet(do_QueryInterface(mPrefStyleSheet, &rv));
    NS_ENSURE_SUCCESS(rv, rv);
  
    PRBool allowSubframes = PR_TRUE;
 -  nsCOMPtr<nsISupports> container = mPresContext->GetContainer();     
 -  nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(container));
 +  nsISupports* container = mPresContext->GetContainer();     
 +  nsIDocShell* docShell(do_QueryInterface(container));
    if (docShell) {
      docShell->GetAllowSubframes(&allowSubframes);
    }
-@@ -1971,7 +1966,7 @@ nsresult PresShell::SetPrefLinkRules(voi
+@@ -1973,7 +1968,7 @@ nsresult PresShell::SetPrefLinkRules(voi
    NS_ASSERTION(mPrefStyleSheet, "prefstylesheet should not be null");
    
    // get the DOM interface to the stylesheet
 -  nsCOMPtr<nsIDOMCSSStyleSheet> sheet(do_QueryInterface(mPrefStyleSheet, &rv));
 +  nsIDOMCSSStyleSheet* sheet(do_QueryInterface(mPrefStyleSheet, &rv));
    NS_ENSURE_SUCCESS(rv, rv);
    
    // support default link colors: 
-@@ -2043,7 +2038,7 @@ nsresult PresShell::SetPrefFocusRules(vo
+@@ -2045,7 +2040,7 @@ nsresult PresShell::SetPrefFocusRules(vo
      NS_ASSERTION(mPrefStyleSheet, "prefstylesheet should not be null");
  
      // get the DOM interface to the stylesheet
 -    nsCOMPtr<nsIDOMCSSStyleSheet> sheet(do_QueryInterface(mPrefStyleSheet,&result));
 +    nsIDOMCSSStyleSheet* sheet(do_QueryInterface(mPrefStyleSheet,&result));
      if (NS_SUCCEEDED(result)) {
        if (mPresContext->GetUseFocusColors()) {
          nscolor focusBackground(mPresContext->FocusBackgroundColor());
-@@ -2108,7 +2103,7 @@ PresShell::AddUserSheet(nsISupports* aSh
+@@ -2110,7 +2105,7 @@ PresShell::AddUserSheet(nsISupports* aSh
    // service sheets, but before other user sheets; see nsIStyleSheetService.idl
    // for the ordering.  Just remove and readd all the nsStyleSheetService
    // sheets.
 -  nsCOMPtr<nsIStyleSheetService> dummy =
 +  nsIStyleSheetService* dummy =
      do_GetService(NS_STYLESHEETSERVICE_CONTRACTID);
  
    mStyleSet->BeginUpdate();
-@@ -2138,7 +2133,7 @@ PresShell::AddAgentSheet(nsISupports* aS
+@@ -2140,7 +2135,7 @@ PresShell::AddAgentSheet(nsISupports* aS
  {
    // Make sure this does what DocumentViewerImpl::CreateStyleSet does
    // wrt ordering.
 -  nsCOMPtr<nsIStyleSheet> sheet = do_QueryInterface(aSheet);
 +  nsIStyleSheet* sheet = do_QueryInterface(aSheet);
    if (!sheet) {
      return;
    }
-@@ -2150,7 +2145,7 @@ void
+@@ -2152,7 +2147,7 @@ void
  void
  PresShell::RemoveSheet(nsStyleSet::sheetType aType, nsISupports* aSheet)
  {
 -  nsCOMPtr<nsIStyleSheet> sheet = do_QueryInterface(aSheet);
 +  nsIStyleSheet* sheet = do_QueryInterface(aSheet);
    if (!sheet) {
      return;
    }
-@@ -2184,7 +2179,6 @@ PresShell::GetSelection(SelectionType aT
+@@ -2186,7 +2181,6 @@ PresShell::GetSelection(SelectionType aT
    if (!(*aSelection))
      return NS_ERROR_INVALID_ARG;
  
 -  NS_ADDREF(*aSelection);
  
    return NS_OK;
  }
-@@ -2262,10 +2256,10 @@ static void CheckForFocus(nsPIDOMWindow*
+@@ -2264,10 +2258,10 @@ static void CheckForFocus(nsPIDOMWindow*
    if (!aFocusController)
      return;
  
 -  nsCOMPtr<nsIDOMWindowInternal> ourWin = do_QueryInterface(aOurWindow);
 -
 -  nsCOMPtr<nsIDOMWindowInternal> focusedWindow;
 -  aFocusController->GetFocusedWindow(getter_AddRefs(focusedWindow));
 +  nsIDOMWindowInternal* ourWin = do_QueryInterface(aOurWindow);
 +
 +  nsIDOMWindowInternal* focusedWindow = nsnull;
 +  aFocusController->GetFocusedWindow(&focusedWindow);
    if (!focusedWindow) {
      // This should never really happen, but if it does, assume
      // we can focus ourself to keep the window from being keydead.
-@@ -2279,10 +2273,10 @@ static void CheckForFocus(nsPIDOMWindow*
+@@ -2281,10 +2275,10 @@ static void CheckForFocus(nsPIDOMWindow*
    // that means there is a child document which loaded before us that's
    // already been given focus.
  
 -  nsCOMPtr<nsIDOMDocument> focusedDOMDoc;
 -  focusedWindow->GetDocument(getter_AddRefs(focusedDOMDoc));
 -
 -  nsCOMPtr<nsIDocument> curDoc = do_QueryInterface(focusedDOMDoc);
 +  nsIDOMDocument* focusedDOMDoc = nsnull;
 +  focusedWindow->GetDocument(&focusedDOMDoc);
 +
 +  nsIDocument* curDoc = do_QueryInterface(focusedDOMDoc);
    if (!curDoc) {
      // This can happen if the previously focused DOM window has been
      // unhooked from its document during document teardown.  We don't
-@@ -2340,7 +2334,7 @@ PresShell::InitialReflow(nscoord aWidth,
+@@ -2342,7 +2336,7 @@ PresShell::InitialReflow(nscoord aWidth,
      return NS_OK;
    }
  
 -  nsCOMPtr<nsIPresShell> kungFuDeathGrip(this);
 +  nsIPresShell* kungFuDeathGrip(this);
    mDidInitialReflow = PR_TRUE;
  
  #ifdef NS_DEBUG
-@@ -2499,11 +2493,11 @@ PresShell::ResizeReflow(nscoord aWidth, 
+@@ -2501,11 +2495,11 @@ PresShell::ResizeReflow(nscoord aWidth, 
      return NS_OK;
  
    NS_ASSERTION(mViewManager, "Must have view manager");
 -  nsCOMPtr<nsIViewManager> viewManager = mViewManager;
 +  nsIViewManager* viewManager = mViewManager;
    viewManager->BeginUpdateViewBatch();
  
    // Take this ref after viewManager so it'll make sure to go away first
 -  nsCOMPtr<nsIPresShell> kungFuDeathGrip(this);
 +  nsIPresShell* kungFuDeathGrip(this);
  
    // Make sure style is up to date
    mFrameConstructor->ProcessPendingRestyles();
-@@ -2624,7 +2618,6 @@ NS_IMETHODIMP PresShell::GetCaret(nsICar
+@@ -2626,7 +2620,6 @@ NS_IMETHODIMP PresShell::GetCaret(nsICar
    NS_ENSURE_ARG_POINTER(outCaret);
    
    *outCaret = mCaret;
 -  NS_IF_ADDREF(*outCaret);
    return NS_OK;
  }
  
-@@ -2932,7 +2925,7 @@ PresShell::CheckVisibility(nsIDOMNode *n
+@@ -2934,7 +2927,7 @@ PresShell::CheckVisibility(nsIDOMNode *n
    if (!node || startOffset>EndOffset || !_retval || startOffset<0 || EndOffset<0)
      return NS_ERROR_INVALID_ARG;
    *_retval = PR_FALSE; //initialize return parameter
 -  nsCOMPtr<nsIContent> content(do_QueryInterface(node));
 +  nsIContent* content(do_QueryInterface(node));
    if (!content)
      return NS_ERROR_FAILURE;
    nsIFrame *frame = GetPrimaryFrameFor(content);
-@@ -3047,7 +3040,7 @@ PresShell::RestoreRootScrollPosition()
+@@ -3049,7 +3042,7 @@ PresShell::RestoreRootScrollPosition()
  PresShell::RestoreRootScrollPosition()
  {
    // Restore frame state for the root scroll frame
 -  nsCOMPtr<nsILayoutHistoryState> historyState =
 +  nsILayoutHistoryState* historyState =
      mDocument->GetLayoutHistoryState();
    // Make sure we don't reenter reflow via the sync paint that happens while
    // we're scrolling to our restored position.  Entering reflow for the
-@@ -3263,16 +3256,16 @@ nsIScrollableView*
+@@ -3265,16 +3258,16 @@ nsIScrollableView*
  nsIScrollableView*
  PresShell::GetViewToScroll(nsLayoutUtils::Direction aDirection)
  {
 -  nsCOMPtr<nsIEventStateManager> esm = mPresContext->EventStateManager();
 +  nsIEventStateManager* esm = mPresContext->EventStateManager();
    nsIScrollableView* scrollView = nsnull;
 -  nsCOMPtr<nsIContent> focusedContent;
 -  esm->GetFocusedContent(getter_AddRefs(focusedContent));
@@ -1278,56 +1255,57 @@ diff --git a/layout/base/nsPresShell.cpp
      if (domSelection) {
 -      nsCOMPtr<nsIDOMNode> focusedNode;
 -      domSelection->GetFocusNode(getter_AddRefs(focusedNode));
 +      nsIDOMNode* focusedNode = nsnull;
 +      domSelection->GetFocusNode(&focusedNode);
        focusedContent = do_QueryInterface(focusedNode);
      }
    }
-@@ -3313,7 +3306,7 @@ void nsIPresShell::InvalidateAccessibleS
+@@ -3315,7 +3308,7 @@ void nsIPresShell::InvalidateAccessibleS
  void nsIPresShell::InvalidateAccessibleSubtree(nsIContent *aContent)
  {
    if (gIsAccessibilityActive) {
 -    nsCOMPtr<nsIAccessibilityService> accService = 
 +    nsIAccessibilityService* accService = 
        do_GetService("@mozilla.org/accessibilityService;1");
      if (accService) {
        accService->InvalidateSubtreeFor(this, aContent,
-@@ -3451,7 +3444,7 @@ PresShell::GoToAnchor(const nsAString& a
+@@ -3453,7 +3446,7 @@ PresShell::GoToAnchor(const nsAString& a
    }
    
    // Hold a reference to the ESM in case event dispatch tears us down.
 -  nsCOMPtr<nsIEventStateManager> esm = mPresContext->EventStateManager();
 +  nsIEventStateManager* esm = mPresContext->EventStateManager();
  
    if (aAnchorName.IsEmpty()) {
      NS_ASSERTION(!aScroll, "can't scroll to empty anchor name");
-@@ -3459,15 +3452,15 @@ PresShell::GoToAnchor(const nsAString& a
+@@ -3461,15 +3454,15 @@ PresShell::GoToAnchor(const nsAString& a
      return NS_OK;
    }
  
 -  nsCOMPtr<nsIDOMDocument> doc = do_QueryInterface(mDocument);
 -  nsCOMPtr<nsIDOMHTMLDocument> htmlDoc = do_QueryInterface(mDocument);
+-  nsresult rv = NS_OK;
+-  nsCOMPtr<nsIContent> content;
 +  nsIDOMDocument* doc = do_QueryInterface(mDocument);
 +  nsIDOMHTMLDocument* htmlDoc = do_QueryInterface(mDocument);
-   nsresult rv = NS_OK;
--  nsCOMPtr<nsIContent> content;
++  nsresult rv = NS_OK;
 +  nsIContent* content = nsnull;
  
    // Search for an element with a matching "id" attribute
    if (doc) {    
 -    nsCOMPtr<nsIDOMElement> element;
 -    rv = doc->GetElementById(aAnchorName, getter_AddRefs(element));
 +    nsIDOMElement* element = nsnull;
 +    rv = doc->GetElementById(aAnchorName, &element);
      if (NS_SUCCEEDED(rv) && element) {
        // Get the nsIContent interface, because that's what we need to
        // get the primary frame
-@@ -3477,15 +3470,15 @@ PresShell::GoToAnchor(const nsAString& a
+@@ -3479,15 +3472,15 @@ PresShell::GoToAnchor(const nsAString& a
  
    // Search for an anchor element with a matching "name" attribute
    if (!content && htmlDoc) {
 -    nsCOMPtr<nsIDOMNodeList> list;
 +    nsIDOMNodeList* list = nsnull;
      // Find a matching list of named nodes
 -    rv = htmlDoc->GetElementsByName(aAnchorName, getter_AddRefs(list));
 +    rv = htmlDoc->GetElementsByName(aAnchorName, &list);
@@ -1337,17 +1315,17 @@ diff --git a/layout/base/nsPresShell.cpp
        for (i = 0; PR_TRUE; i++) {
 -        nsCOMPtr<nsIDOMNode> node;
 -        rv = list->Item(i, getter_AddRefs(node));
 +        nsIDOMNode* node = nsnull;
 +        rv = list->Item(i, &node);
          if (!node) {  // End of list
            break;
          }
-@@ -3505,21 +3498,21 @@ PresShell::GoToAnchor(const nsAString& a
+@@ -3507,21 +3500,21 @@ PresShell::GoToAnchor(const nsAString& a
    // Search for anchor in the HTML namespace with a matching name
    if (!content && !htmlDoc)
    {
 -    nsCOMPtr<nsIDOMNodeList> list;
 +    nsIDOMNodeList* list = nsnull;
      NS_NAMED_LITERAL_STRING(nameSpace, "http://www.w3.org/1999/xhtml");
      // Get the list of anchor elements
 -    rv = doc->GetElementsByTagNameNS(nameSpace, NS_LITERAL_STRING("a"), getter_AddRefs(list));
@@ -1364,17 +1342,17 @@ diff --git a/layout/base/nsPresShell.cpp
            break;
          }
          // Compare the name attribute
 -        nsCOMPtr<nsIDOMElement> element = do_QueryInterface(node);
 +        nsIDOMElement* element = do_QueryInterface(node);
          nsAutoString value;
          if (element && NS_SUCCEEDED(element->GetAttribute(NS_LITERAL_STRING("name"), value))) {
            if (value.Equals(aAnchorName)) {
-@@ -3531,15 +3524,15 @@ PresShell::GoToAnchor(const nsAString& a
+@@ -3533,15 +3526,15 @@ PresShell::GoToAnchor(const nsAString& a
      }
    }
  
 -  nsCOMPtr<nsIDOMRange> jumpToRange;
 -  nsCOMPtr<nsIXPointerResult> xpointerResult;
 +  nsIDOMRange* jumpToRange = nsnull;
 +  nsIXPointerResult* xpointerResult = nsnull;
    if (!content) {
@@ -1385,136 +1363,136 @@ diff --git a/layout/base/nsPresShell.cpp
 -      xmldoc->EvaluateXPointer(aAnchorName, getter_AddRefs(xpointerResult));
 +      xmldoc->EvaluateXPointer(aAnchorName, &xpointerResult);
        if (xpointerResult) {
 -        xpointerResult->Item(0, getter_AddRefs(jumpToRange));
 +        xpointerResult->Item(0, &jumpToRange);
          if (!jumpToRange) {
            // We know it was an XPointer, so there is no point in
            // trying any other pointer types, let's just return
-@@ -3550,12 +3543,12 @@ PresShell::GoToAnchor(const nsAString& a
+@@ -3552,12 +3545,12 @@ PresShell::GoToAnchor(const nsAString& a
  
        // Finally try FIXptr
        if (!jumpToRange) {
 -        xmldoc->EvaluateFIXptr(aAnchorName,getter_AddRefs(jumpToRange));
 +        xmldoc->EvaluateFIXptr(aAnchorName,&jumpToRange);
        }
  
        if (jumpToRange) {
 -        nsCOMPtr<nsIDOMNode> node;
 -        jumpToRange->GetStartContainer(getter_AddRefs(node));
 +        nsIDOMNode* node = nsnull;
 +        jumpToRange->GetStartContainer(&node);
          if (node) {
            PRUint16 nodeType;
            node->GetNodeType(&nodeType);
-@@ -3565,14 +3558,14 @@ PresShell::GoToAnchor(const nsAString& a
+@@ -3567,14 +3560,14 @@ PresShell::GoToAnchor(const nsAString& a
              case nsIDOMNode::ATTRIBUTE_NODE:
              {
                // XXX Assuming jumping to the ownerElement is the sanest action.
 -              nsCOMPtr<nsIAttribute> attr = do_QueryInterface(node);
 +              nsIAttribute* attr = do_QueryInterface(node);
                content = attr->GetContent();
                break;
              }
              case nsIDOMNode::DOCUMENT_NODE:
              {
                if (offset >= 0) {
 -                nsCOMPtr<nsIDocument> document = do_QueryInterface(node);
 +                nsIDocument* document = do_QueryInterface(node);
                  content = document->GetChildAt(offset);
                }
                break;
-@@ -3582,7 +3575,7 @@ PresShell::GoToAnchor(const nsAString& a
+@@ -3584,7 +3577,7 @@ PresShell::GoToAnchor(const nsAString& a
              case nsIDOMNode::ENTITY_REFERENCE_NODE:
              {
                if (offset >= 0) {
 -                nsCOMPtr<nsIContent> parent = do_QueryInterface(node);
 +                nsIContent* parent = do_QueryInterface(node);
                  content = parent->GetChildAt(offset);
                }
                break;
-@@ -3625,7 +3618,7 @@ PresShell::GoToAnchor(const nsAString& a
+@@ -3627,7 +3620,7 @@ PresShell::GoToAnchor(const nsAString& a
          while (content && content->GetChildCount() > 0) {
            content = content->GetChildAt(0);
          }
 -        nsCOMPtr<nsIDOMNode> node(do_QueryInterface(content));
 +        nsIDOMNode* node(do_QueryInterface(content));
          NS_ASSERTION(node, "No nsIDOMNode for descendant of anchor");
          jumpToRange->SelectNodeContents(node);
        }
-@@ -3648,8 +3641,8 @@ PresShell::GoToAnchor(const nsAString& a
+@@ -3650,8 +3643,8 @@ PresShell::GoToAnchor(const nsAString& a
          PRUint32 count, i;
          xpointerResult->GetLength(&count);
          for (i = 1; i < count; i++) { // jumpToRange is i = 0
 -          nsCOMPtr<nsIDOMRange> range;
 -          xpointerResult->Item(i, getter_AddRefs(range));
 +          nsIDOMRange* range = nsnull;
 +          xpointerResult->Item(i, &range);
            sel->AddRange(range);
          }
        }
-@@ -3658,10 +3651,10 @@ PresShell::GoToAnchor(const nsAString& a
+@@ -3660,10 +3653,10 @@ PresShell::GoToAnchor(const nsAString& a
        nsPIDOMWindow *win = mDocument->GetWindow();
  
        if (win) {
 -        nsCOMPtr<nsIFocusController> focusController = win->GetRootFocusController();
 +        nsIFocusController* focusController = win->GetRootFocusController();
          if (focusController) {
 -          nsCOMPtr<nsIDOMWindowInternal> focusedWin;
 -          focusController->GetFocusedWindow(getter_AddRefs(focusedWin));
 +          nsIDOMWindowInternal* focusedWin = nsnull;
 +          focusController->GetFocusedWindow(&focusedWin);
            if (SameCOMIdentity(win, focusedWin)) {
              esm->ChangeFocusWith(nsnull, nsIEventStateManager::eEventFocusedByApplication);
            }
-@@ -3735,7 +3728,7 @@ UnionRectForClosestScrolledView(nsIFrame
+@@ -3737,7 +3730,7 @@ UnionRectForClosestScrolledView(nsIFrame
          f &&
          frameType == nsGkAtoms::blockFrame) {
        // find the line containing aFrame and increase the top of |offset|.
 -      nsCOMPtr<nsILineIterator> lines(do_QueryInterface(f));
 +      nsILineIterator* lines(do_QueryInterface(f));
  
        if (lines) {
          PRInt32 index = -1;
-@@ -3909,9 +3902,9 @@ PresShell::ScrollContentIntoView(nsICont
+@@ -3911,9 +3904,9 @@ PresShell::ScrollContentIntoView(nsICont
                                   PRIntn      aVPercent,
                                   PRIntn      aHPercent) const
  {
 -  nsCOMPtr<nsIContent> content = aContent; // Keep content alive while flushing.
 +  nsIContent* content = aContent; // Keep content alive while flushing.
    NS_ENSURE_TRUE(content, NS_ERROR_NULL_POINTER);
 -  nsCOMPtr<nsIDocument> currentDoc = content->GetCurrentDoc();
 +  nsIDocument* currentDoc = content->GetCurrentDoc();
    NS_ENSURE_STATE(currentDoc);
    currentDoc->FlushPendingNotifications(Flush_Layout);
    nsIFrame* frame = GetPrimaryFrameFor(content);
-@@ -3986,9 +3979,9 @@ NS_IMETHODIMP PresShell::GetLinkLocation
+@@ -3988,9 +3981,9 @@ NS_IMETHODIMP PresShell::GetLinkLocation
    static char strippedChars[] = {'\t','\r','\n'};
  
    // are we an anchor?
 -  nsCOMPtr<nsIDOMHTMLAnchorElement> anchor(do_QueryInterface(aNode));
 -  nsCOMPtr<nsIDOMHTMLAreaElement> area;
 -  nsCOMPtr<nsIDOMHTMLLinkElement> link;
 +  nsIDOMHTMLAnchorElement* anchor(do_QueryInterface(aNode));
 +  nsIDOMHTMLAreaElement* area = nsnull;
 +  nsIDOMHTMLLinkElement* link = nsnull;
    nsAutoString xlinkType;
    if (anchor) {
      rv = anchor->GetHref(anchorText);
-@@ -4007,7 +4000,7 @@ NS_IMETHODIMP PresShell::GetLinkLocation
+@@ -4009,7 +4002,7 @@ NS_IMETHODIMP PresShell::GetLinkLocation
          NS_ENSURE_SUCCESS(rv, rv);
        } else {
          // Xlink?
 -        nsCOMPtr<nsIDOMElement> element(do_QueryInterface(aNode));
 +        nsIDOMElement* element(do_QueryInterface(aNode));
          if (element) {
            NS_NAMED_LITERAL_STRING(xlinkNS,"http://www.w3.org/1999/xlink");
            element->GetAttributeNS(xlinkNS,NS_LITERAL_STRING("type"),xlinkType);
-@@ -4017,16 +4010,16 @@ NS_IMETHODIMP PresShell::GetLinkLocation
+@@ -4019,16 +4012,16 @@ NS_IMETHODIMP PresShell::GetLinkLocation
                // Resolve the full URI using baseURI property
  
                nsAutoString base;
 -              nsCOMPtr<nsIDOM3Node> node(do_QueryInterface(aNode,&rv));
 +              nsIDOM3Node* node(do_QueryInterface(aNode,&rv));
                NS_ENSURE_SUCCESS(rv, rv);
                node->GetBaseURI(base);
  
@@ -1525,17 +1503,17 @@ diff --git a/layout/base/nsPresShell.cpp
  
 -              nsCOMPtr<nsIURI> baseURI;
 -              rv = ios->NewURI(NS_ConvertUTF16toUTF8(base),nsnull,nsnull,getter_AddRefs(baseURI));
 +              nsIURI* baseURI = nsnull;
 +              rv = ios->NewURI(NS_ConvertUTF16toUTF8(base),nsnull,nsnull,&baseURI);
                NS_ENSURE_SUCCESS(rv, rv);
  
                nsCAutoString spec;
-@@ -4063,37 +4056,37 @@ PresShell::GetSelectionForCopy(nsISelect
+@@ -4065,37 +4058,37 @@ PresShell::GetSelectionForCopy(nsISelect
  
    if (!mDocument) return NS_ERROR_FAILURE;
  
 -  nsCOMPtr<nsIContent> content;
 +  nsIContent* content = nsnull;
    nsPIDOMWindow *ourWindow = mDocument->GetWindow();
    if (ourWindow) {
      nsIFocusController *focusController = ourWindow->GetRootFocusController();
@@ -1572,51 +1550,51 @@ diff --git a/layout/base/nsPresShell.cpp
        if (!selCon) return NS_ERROR_FAILURE;
  
        rv = selCon->GetSelection(nsISelectionController::SELECTION_NORMAL,
 -                                getter_AddRefs(sel));
 +                                &sel);
      }
    }
    if (!sel) {
-@@ -4102,7 +4095,6 @@ PresShell::GetSelectionForCopy(nsISelect
+@@ -4104,7 +4097,6 @@ PresShell::GetSelectionForCopy(nsISelect
    }
  
    *outSelection = sel;
 -  NS_IF_ADDREF(*outSelection);
    return rv;
  }
  
-@@ -4115,12 +4107,12 @@ PresShell::DoGetContents(const nsACStrin
+@@ -4117,12 +4109,12 @@ PresShell::DoGetContents(const nsACStrin
    if (!mDocument) return NS_ERROR_FAILURE;
  
    nsresult rv;
 -  nsCOMPtr<nsISelection> sel;
 +  nsISelection* sel = nsnull;
  
    // Now we have the selection.  Make sure it's nonzero:
    if (aSelectionOnly)
    {
 -    rv = GetSelectionForCopy(getter_AddRefs(sel));
 +    rv = GetSelectionForCopy(&sel);
      if (NS_FAILED(rv)) return rv;
      if (!sel) return NS_ERROR_FAILURE;
    
-@@ -4140,8 +4132,8 @@ PresShell::DoCopy()
+@@ -4142,8 +4134,8 @@ PresShell::DoCopy()
  {
    if (!mDocument) return NS_ERROR_FAILURE;
  
 -  nsCOMPtr<nsISelection> sel;
 -  nsresult rv = GetSelectionForCopy(getter_AddRefs(sel));
 +  nsISelection* sel = nsnull;
 +  nsresult rv = GetSelectionForCopy(&sel);
    if (NS_FAILED(rv)) 
      return rv;
    if (!sel) 
-@@ -4181,19 +4173,19 @@ PresShell::CaptureHistoryState(nsILayout
+@@ -4183,19 +4175,19 @@ PresShell::CaptureHistoryState(nsILayout
    // content viewer's Hide() method...  by that point the docshell's
    // state could be wrong.  We should sort out a better ownership
    // model for the layout history state.
 -  nsCOMPtr<nsISupports> container = mPresContext->GetContainer();
 +  nsISupports* container = mPresContext->GetContainer();
    if (!container)
      return NS_ERROR_FAILURE;
  
@@ -1631,158 +1609,144 @@ diff --git a/layout/base/nsPresShell.cpp
 +  docShell->GetLayoutHistoryState(&historyState);
    if (!historyState) {
      // Create the document state object
 -    rv = NS_NewLayoutHistoryState(getter_AddRefs(historyState));
 +    rv = NS_NewLayoutHistoryState(&historyState);
    
      if (NS_FAILED(rv)) { 
        *aState = nsnull;
-@@ -4204,7 +4196,6 @@ PresShell::CaptureHistoryState(nsILayout
+@@ -4206,7 +4198,6 @@ PresShell::CaptureHistoryState(nsILayout
    }
  
    *aState = historyState;
 -  NS_IF_ADDREF(*aState);
    
    // Capture frame state for the entire frame hierarchy
    nsIFrame* rootFrame = FrameManager()->GetRootFrame();
-@@ -4251,9 +4242,9 @@ PresShell::UnsuppressAndInvalidate()
+@@ -4253,9 +4244,9 @@ PresShell::UnsuppressAndInvalidate()
  
    // This makes sure to get the same thing that nsPresContext::EnsureVisible()
    // got.
 -  nsCOMPtr<nsISupports> container = mPresContext->GetContainer();
 -  nsCOMPtr<nsPIDOMWindow> ourWindow = do_GetInterface(container);
 -  nsCOMPtr<nsIFocusController> focusController =
 +  nsISupports* container = mPresContext->GetContainer();
 +  nsPIDOMWindow* ourWindow = do_GetInterface(container);
 +  nsIFocusController* focusController =
      ourWindow ? ourWindow->GetRootFocusController() : nsnull;
  
    if (ourWindow)
-@@ -4438,11 +4429,11 @@ PresShell::DoFlushPendingNotifications(m
+@@ -4457,11 +4448,11 @@ PresShell::DoFlushPendingNotifications(m
    // Make sure the view manager stays alive while batching view updates.
    // XXX FIXME: If viewmanager hierarchy is modified while we're in update
    //            batch... We need to address that somehow.  See bug 369165.
 -  nsCOMPtr<nsIViewManager> viewManager = mViewManager;
 +  nsIViewManager* viewManager = mViewManager;
    if (isSafeToFlush && viewManager) {
      // Processing pending notifications can kill us, and some callers only
      // hold weak refs when calling FlushPendingNotifications().  :(
 -    nsCOMPtr<nsIPresShell> kungFuDeathGrip(this);
 +    nsIPresShell* kungFuDeathGrip(this);
  
      // Style reresolves not in conjunction with reflows can't cause
      // painting or geometry changes, so don't bother with view update
-@@ -4866,8 +4857,8 @@ PresShell::RenderDocument(const nsRect& 
+@@ -4885,8 +4876,8 @@ PresShell::RenderDocument(const nsRect& 
        gfxFloat scale = gfxFloat(devCtx->AppUnitsPerDevPixel())/nsPresContext::AppUnitsPerCSSPixel();
        aThebesContext->Scale(scale, scale);
        
 -      nsCOMPtr<nsIRenderingContext> rc;
 -      devCtx->CreateRenderingContextInstance(*getter_AddRefs(rc));
 +      nsIRenderingContext* rc = nsnull;
 +      devCtx->CreateRenderingContextInstance(*&rc);
        rc->Init(devCtx, aThebesContext);
  
        nsRegion region(rect);
-@@ -4991,7 +4982,7 @@ PresShell::CreateRangePaintInfo(nsIDOMRa
+@@ -5010,7 +5001,7 @@ PresShell::CreateRangePaintInfo(nsIDOMRa
  {
    RangePaintInfo* info = nsnull;
  
 -  nsCOMPtr<nsIRange> range = do_QueryInterface(aRange);
 +  nsIRange* range = do_QueryInterface(aRange);
    if (!range)
      return nsnull;
  
-@@ -5052,7 +5043,7 @@ PresShell::CreateRangePaintInfo(nsIDOMRa
+@@ -5071,7 +5062,7 @@ PresShell::CreateRangePaintInfo(nsIDOMRa
    return info;
  }
  
 -already_AddRefed<gfxASurface>
 +gfxASurface*
  PresShell::PaintRangePaintInfo(nsTArray<nsAutoPtr<RangePaintInfo> >* aItems,
                                 nsISelection* aSelection,
                                 nsIRegion* aRegion,
-@@ -5121,8 +5112,8 @@ PresShell::PaintRangePaintInfo(nsTArray<
+@@ -5140,8 +5131,8 @@ PresShell::PaintRangePaintInfo(nsTArray<
    context.Rectangle(gfxRect(0, 0, pixelArea.width, pixelArea.height));
    context.Fill();
  
 -  nsCOMPtr<nsIRenderingContext> rc;
 -  deviceContext->CreateRenderingContextInstance(*getter_AddRefs(rc));
 +  nsIRenderingContext* rc = nsnull;
 +  deviceContext->CreateRenderingContextInstance(*&rc);
    rc->Init(deviceContext, surface);
  
    if (aRegion)
-@@ -5137,10 +5128,10 @@ PresShell::PaintRangePaintInfo(nsTArray<
+@@ -5156,10 +5147,10 @@ PresShell::PaintRangePaintInfo(nsTArray<
    // temporarily hide the selection so that text is drawn normally. If a
    // selection is being rendered, use that, otherwise use the presshell's
    // selection.
 -  nsCOMPtr<nsFrameSelection> frameSelection;
 +  nsFrameSelection* frameSelection = nsnull;
    if (aSelection) {
 -    nsCOMPtr<nsISelectionPrivate> selpriv = do_QueryInterface(aSelection);
 -    selpriv->GetFrameSelection(getter_AddRefs(frameSelection));
 +    nsISelectionPrivate* selpriv = do_QueryInterface(aSelection);
 +    selpriv->GetFrameSelection(&frameSelection);
    }
    else {
      frameSelection = FrameSelection();
-@@ -5165,11 +5156,10 @@ PresShell::PaintRangePaintInfo(nsTArray<
+@@ -5184,7 +5175,6 @@ PresShell::PaintRangePaintInfo(nsTArray<
    // restore the old selection display state
    frameSelection->SetDisplaySelection(oldDisplaySelection);
  
 -  NS_ADDREF(surface);
    return surface;
  }
  
--already_AddRefed<gfxASurface>
-+gfxASurface*
- PresShell::RenderNode(nsIDOMNode* aNode,
-                       nsIRegion* aRegion,
-                       nsPoint& aPoint,
-@@ -5180,8 +5170,8 @@ PresShell::RenderNode(nsIDOMNode* aNode,
+@@ -5199,8 +5189,8 @@ PresShell::RenderNode(nsIDOMNode* aNode,
    nsRect area;
    nsTArray<nsAutoPtr<RangePaintInfo> > rangeItems;
  
 -  nsCOMPtr<nsIDOMRange> range;
 -  NS_NewRange(getter_AddRefs(range));
 +  nsIDOMRange* range = nsnull;
 +  NS_NewRange(&range);
    range->SelectNode(aNode);
  
    RangePaintInfo* info = CreateRangePaintInfo(range, area);
-@@ -5213,7 +5203,7 @@ PresShell::RenderNode(nsIDOMNode* aNode,
-                              aScreenRect);
- }
- 
--already_AddRefed<gfxASurface>
-+gfxASurface*
- PresShell::RenderSelection(nsISelection* aSelection,
-                            nsPoint& aPoint,
-                            nsRect* aScreenRect)
-@@ -5232,8 +5222,8 @@ PresShell::RenderSelection(nsISelection*
+@@ -5251,8 +5241,8 @@ PresShell::RenderSelection(nsISelection*
  
    for (PRInt32 r = 0; r < numRanges; r++)
    {
 -    nsCOMPtr<nsIDOMRange> range;
 -    aSelection->GetRangeAt(r, getter_AddRefs(range));
 +    nsIDOMRange* range = nsnull;
 +    aSelection->GetRangeAt(r, &range);
  
      RangePaintInfo* info = CreateRangePaintInfo(range, area);
      if (info && !rangeItems.AppendElement(info)) {
-@@ -5318,7 +5308,6 @@ PresShell::GetEventTargetContent(nsEvent
+@@ -5337,7 +5327,6 @@ PresShell::GetEventTargetContent(nsEvent
  {
    if (mCurrentEventContent) {
      *aContent = mCurrentEventContent;
 -    NS_IF_ADDREF(*aContent);
    } else {
      nsIFrame* currentEventFrame = GetCurrentEventFrame();
      if (currentEventFrame) {
-@@ -5375,26 +5364,26 @@ nsresult PresShell::RetargetEventToParen
+@@ -5394,26 +5383,26 @@ nsresult PresShell::RetargetEventToParen
    // or a root content is not present.
    // That way at least the UI key bindings can work.
  
 -  nsCOMPtr<nsIPresShell> kungFuDeathGrip(this);
 -  nsCOMPtr<nsISupports> container = mPresContext->GetContainer();
 +  nsIPresShell* kungFuDeathGrip(this);
 +  nsISupports* container = mPresContext->GetContainer();
    if (!container)
@@ -1808,49 +1772,49 @@ diff --git a/layout/base/nsPresShell.cpp
 -  parentDocShell->GetPresShell(getter_AddRefs(parentPresShell));
 -  nsCOMPtr<nsIViewObserver> parentViewObserver = 
 +  nsIPresShell* parentPresShell = nsnull;
 +  parentDocShell->GetPresShell(&parentPresShell);
 +  nsIViewObserver* parentViewObserver = 
      do_QueryInterface(parentPresShell);
    if (!parentViewObserver) {
      return NS_ERROR_FAILURE;
-@@ -5516,7 +5505,7 @@ PresShell::HandleEvent(nsIView         *
+@@ -5535,7 +5524,7 @@ PresShell::HandleEvent(nsIView         *
        if (shell != this) {
          // Handle the event in the correct shell.
          // Prevent deletion until we're done with event handling (bug 336582).
 -        nsCOMPtr<nsIPresShell> kungFuDeathGrip(shell);
 +        nsIPresShell* kungFuDeathGrip(shell);
          nsIView* subshellRootView;
          shell->GetViewManager()->GetRootView(subshellRootView);
          // We pass the subshell's root view as the view to start from. This is
-@@ -5575,8 +5564,8 @@ PresShell::HandleEvent(nsIView         *
+@@ -5594,8 +5583,8 @@ PresShell::HandleEvent(nsIView         *
                focusController->GetActive(&active);
                if (!active) {
                  // if not, search for pre-focused element
 -                nsCOMPtr<nsIDOMElement> focusedElement;
 -                focusController->GetFocusedElement(getter_AddRefs(focusedElement));
 +                nsIDOMElement* focusedElement = nsnull;
 +                focusController->GetFocusedElement(&focusedElement);
                  if (focusedElement) {
                    // get mCurrentEventContent from focusedElement
                    mCurrentEventContent = do_QueryInterface(focusedElement);
-@@ -5656,9 +5645,9 @@ PresShell::HandlePositionedEvent(nsIView
+@@ -5675,9 +5664,9 @@ PresShell::HandlePositionedEvent(nsIView
    mCurrentEventFrame = aTargetFrame;
  
    if (mCurrentEventFrame) {
 -    nsCOMPtr<nsIContent> targetElement;
 +    nsIContent* targetElement = nsnull;
      mCurrentEventFrame->GetContentForEvent(mPresContext, aEvent,
 -                                           getter_AddRefs(targetElement));
 +                                           &targetElement);
  
      // If there is no content for this frame, target it anyway.  Some
      // frames can be targeted but do not have content, particularly
-@@ -5725,17 +5714,17 @@ PresShell::HandleEventInternal(nsEvent* 
+@@ -5744,17 +5733,17 @@ PresShell::HandleEventInternal(nsEvent* 
    if (aEvent->eventStructType == NS_ACCESSIBLE_EVENT)
    {
      static_cast<nsAccessibleEvent*>(aEvent)->accessible = nsnull;
 -    nsCOMPtr<nsIAccessibilityService> accService = 
 +    nsIAccessibilityService* accService = 
        do_GetService("@mozilla.org/accessibilityService;1");
      if (accService) {
 -      nsCOMPtr<nsISupports> container = mPresContext->GetContainer();
@@ -1861,220 +1825,220 @@ diff --git a/layout/base/nsPresShell.cpp
          return NS_OK;
        }
        nsIAccessible* acc;
 -      nsCOMPtr<nsIDOMNode> domNode(do_QueryInterface(mDocument));
 +      nsIDOMNode* domNode(do_QueryInterface(mDocument));
        NS_ASSERTION(domNode, "No dom node for doc");
        accService->GetAccessibleInShell(domNode, this, &acc);
        // Addref this - it's not a COM Ptr
-@@ -5750,7 +5739,7 @@ PresShell::HandleEventInternal(nsEvent* 
+@@ -5769,7 +5758,7 @@ PresShell::HandleEventInternal(nsEvent* 
    }
  #endif
  
 -  nsCOMPtr<nsIEventStateManager> manager = mPresContext->EventStateManager();
 +  nsIEventStateManager* manager = mPresContext->EventStateManager();
    nsresult rv = NS_OK;
  
    if (!NS_EVENT_NEEDS_FRAME(aEvent) || GetCurrentEventFrame()) {
-@@ -5803,9 +5792,9 @@ PresShell::HandleEventInternal(nsEvent* 
+@@ -5822,9 +5811,9 @@ PresShell::HandleEventInternal(nsEvent* 
                                        aEvent, nsnull, aStatus, &eventCB);
          }
          else {
 -          nsCOMPtr<nsIContent> targetContent;
 +          nsIContent* targetContent = nsnull;
            rv = mCurrentEventFrame->GetContentForEvent(mPresContext, aEvent,
 -                                                      getter_AddRefs(targetContent));
 +                                                      &targetContent);
            if (NS_SUCCEEDED(rv) && targetContent) {
              nsEventDispatcher::Dispatch(targetContent, mPresContext, aEvent,
                                          nsnull, aStatus, &eventCB);
-@@ -5841,7 +5830,7 @@ PresShell::HandleDOMEventWithTarget(nsIC
+@@ -5860,7 +5849,7 @@ PresShell::HandleDOMEventWithTarget(nsIC
    // and the js context is out of date. This check detects the case
    // that caused a crash in bug 41013, but there may be a better way
    // to handle this situation!
 -  nsCOMPtr<nsISupports> container = mPresContext->GetContainer();
 +  nsISupports* container = mPresContext->GetContainer();
    if (container) {
  
      // Dispatch event to content
-@@ -5862,8 +5851,8 @@ NS_IMETHODIMP_(PRBool)
+@@ -5881,8 +5870,8 @@ NS_IMETHODIMP_(PRBool)
  NS_IMETHODIMP_(PRBool)
  PresShell::IsVisible()
  {
 -  nsCOMPtr<nsISupports> container = mPresContext->GetContainer();
 -  nsCOMPtr<nsIBaseWindow> bw = do_QueryInterface(container);
 +  nsISupports* container = mPresContext->GetContainer();
 +  nsIBaseWindow* bw = do_QueryInterface(container);
    if (!bw)
      return PR_FALSE;
    PRBool res = PR_TRUE;
-@@ -5948,7 +5937,7 @@ void
+@@ -5967,7 +5956,7 @@ void
  void
  PresShell::Freeze()
  {
 -  nsCOMPtr<nsIDOMDocument> domDoc = do_QueryInterface(mDocument);
 +  nsIDOMDocument* domDoc = do_QueryInterface(mDocument);
    if (domDoc) {
      EnumeratePlugins(domDoc, NS_LITERAL_STRING("object"), StopPluginInstance);
      EnumeratePlugins(domDoc, NS_LITERAL_STRING("applet"), StopPluginInstance);
-@@ -5967,12 +5956,12 @@ static void
+@@ -5986,12 +5975,12 @@ static void
  static void
  StartPluginInstance(PresShell *aShell, nsIContent *aContent)
  {
 -  nsCOMPtr<nsIObjectLoadingContent> objlc(do_QueryInterface(aContent));
 +  nsIObjectLoadingContent* objlc(do_QueryInterface(aContent));
    if (!objlc)
      return;
  
 -  nsCOMPtr<nsIPluginInstance> inst;
 -  objlc->EnsureInstantiation(getter_AddRefs(inst));
 +  nsIPluginInstance* inst = nsnull;
 +  objlc->EnsureInstantiation(&inst);
  }
  
  PR_STATIC_CALLBACK(PRBool)
-@@ -5988,7 +5977,7 @@ void
+@@ -6007,7 +5996,7 @@ void
  void
  PresShell::Thaw()
  {
 -  nsCOMPtr<nsIDOMDocument> domDoc = do_QueryInterface(mDocument);
 +  nsIDOMDocument* domDoc = do_QueryInterface(mDocument);
    if (domDoc) {
      EnumeratePlugins(domDoc, NS_LITERAL_STRING("object"), StartPluginInstance);
      EnumeratePlugins(domDoc, NS_LITERAL_STRING("applet"), StartPluginInstance);
-@@ -6011,7 +6000,7 @@ PresShell::ReflowEvent::Run() {
+@@ -6030,7 +6019,7 @@ PresShell::ReflowEvent::Run() {
  PresShell::ReflowEvent::Run() {    
    // Take an owning reference to the PresShell during this call to ensure
    // that it doesn't get killed off prematurely.
 -  nsRefPtr<PresShell> ps = mPresShell;
 +  PresShell* ps = mPresShell;
    if (ps) {
  #ifdef DEBUG
      if (VERIFY_REFLOW_NOISY_RC & gVerifyReflowFlags) {
-@@ -6022,7 +6011,7 @@ PresShell::ReflowEvent::Run() {
+@@ -6041,7 +6030,7 @@ PresShell::ReflowEvent::Run() {
      ps->ClearReflowEventStatus();
      // Set a kung fu death grip on the view manager associated with the pres shell
      // before processing that pres shell's reflow commands.  Fixes bug 54868.
 -    nsCOMPtr<nsIViewManager> viewManager = ps->GetViewManager();
 +    nsIViewManager* viewManager = ps->GetViewManager();
  
      ps->DoFlushPendingNotifications(Flush_Layout, PR_TRUE);
  
-@@ -6042,7 +6031,7 @@ PresShell::PostReflowEvent()
+@@ -6061,7 +6050,7 @@ PresShell::PostReflowEvent()
        mDirtyRoots.Count() == 0)
      return;
  
 -  nsRefPtr<ReflowEvent> ev = new ReflowEvent(this);
 +  ReflowEvent* ev = new ReflowEvent(this);
    if (NS_FAILED(NS_DispatchToCurrentThread(ev))) {
      NS_WARNING("failed to dispatch reflow event");
    } else {
-@@ -6108,10 +6097,10 @@ PresShell::DoReflow(nsIFrame* target)
+@@ -6127,10 +6116,10 @@ PresShell::DoReflow(nsIFrame* target)
  {
    nsIFrame* rootFrame = FrameManager()->GetRootFrame();
  
 -  nsCOMPtr<nsIRenderingContext> rcx;
 +  nsIRenderingContext* rcx = nsnull;
    // Always create the rendering context relative to the root frame during
    // reflow; otherwise, it crashes on the mac (I'm not quite sure why)
 -  nsresult rv = CreateRenderingContext(rootFrame, getter_AddRefs(rcx));
 +  nsresult rv = CreateRenderingContext(rootFrame, &rcx);
    if (NS_FAILED(rv)) {
     NS_NOTREACHED("CreateRenderingContext failure");
     return;
-@@ -6334,7 +6323,7 @@ ReResolveMenusAndTrees(nsIFrame *aFrame,
+@@ -6353,7 +6342,7 @@ ReResolveMenusAndTrees(nsIFrame *aFrame,
  {
    // Trees have a special style cache that needs to be flushed when
    // the theme changes.
 -  nsCOMPtr<nsITreeBoxObject> treeBox(do_QueryInterface(aFrame));
 +  nsITreeBoxObject* treeBox(do_QueryInterface(aFrame));
    if (treeBox)
      treeBox->ClearStyleAndImageCaches();
  
-@@ -6426,7 +6415,7 @@ PresShell::Observe(nsISupports* aSubject
+@@ -6445,7 +6434,7 @@ PresShell::Observe(nsISupports* aSubject
  #endif
  
    if (!nsCRT::strcmp(aTopic, NS_LINK_VISITED_EVENT_TOPIC)) {
 -    nsCOMPtr<nsIURI> uri = do_QueryInterface(aSubject);
 +    nsIURI* uri = do_QueryInterface(aSubject);
      if (uri && mDocument) {
        mDocument->NotifyURIVisitednessChanged(uri);
      }
-@@ -6467,8 +6456,8 @@ PresShell::EnumeratePlugins(nsIDOMDocume
+@@ -6486,8 +6475,8 @@ PresShell::EnumeratePlugins(nsIDOMDocume
                              const nsString &aPluginTag,
                              nsPluginEnumCallback aCallback)
  {
 -  nsCOMPtr<nsIDOMNodeList> nodes;
 -  aDocument->GetElementsByTagName(aPluginTag, getter_AddRefs(nodes));
 +  nsIDOMNodeList* nodes = nsnull;
 +  aDocument->GetElementsByTagName(aPluginTag, &nodes);
    if (!nodes)
      return;
  
-@@ -6476,10 +6465,10 @@ PresShell::EnumeratePlugins(nsIDOMDocume
+@@ -6495,10 +6484,10 @@ PresShell::EnumeratePlugins(nsIDOMDocume
    nodes->GetLength(&length);
  
    for (PRUint32 i = 0; i < length; ++i) {
 -    nsCOMPtr<nsIDOMNode> node;
 -    nodes->Item(i, getter_AddRefs(node));
 -
 -    nsCOMPtr<nsIContent> content = do_QueryInterface(node);
 +    nsIDOMNode* node = nsnull;
 +    nodes->Item(i, &node);
 +
 +    nsIContent* content = do_QueryInterface(node);
      if (content)
        aCallback(this, content);
    }
-@@ -6943,7 +6932,7 @@ PresShell::VerifyIncrementalReflow()
+@@ -6962,7 +6951,7 @@ PresShell::VerifyIncrementalReflow()
     }
  
    // Create a presentation context to view the new frame tree
 -  nsCOMPtr<nsPresContext> cx =
 +  nsPresContext* cx =
         new nsPresContext(mDocument, mPresContext->IsPaginated() ?
                                          nsPresContext::eContext_PrintPreview :
                                          nsPresContext::eContext_Galley);
-@@ -6959,7 +6948,7 @@ PresShell::VerifyIncrementalReflow()
+@@ -6978,7 +6967,7 @@ PresShell::VerifyIncrementalReflow()
    void* nativeParentWidget = rootView->GetWidget()->GetNativeData(NS_NATIVE_WIDGET);
  
    // Create a new view manager.
 -  nsCOMPtr<nsIViewManager> vm = do_CreateInstance(kViewManagerCID);
 +  nsIViewManager* vm = do_CreateInstance(kViewManagerCID);
    NS_ENSURE_TRUE(vm, PR_FALSE);
    rv = vm->Init(dc);
    NS_ENSURE_SUCCESS(rv, PR_FALSE);
-@@ -6987,13 +6976,13 @@ PresShell::VerifyIncrementalReflow()
+@@ -7006,13 +6995,13 @@ PresShell::VerifyIncrementalReflow()
    nsAutoPtr<nsStyleSet> newSet;
    rv = CloneStyleSet(mStyleSet, getter_Transfers(newSet));
    NS_ENSURE_SUCCESS(rv, PR_FALSE);
 -  nsCOMPtr<nsIPresShell> sh;
 -  rv = mDocument->CreateShell(cx, vm, newSet, getter_AddRefs(sh));
 +  nsIPresShell* sh = nsnull;
 +  rv = mDocument->CreateShell(cx, vm, newSet, &sh);
    NS_ENSURE_SUCCESS(rv, PR_FALSE);
    newSet.forget();
    // Note that after we create the shell, we must make sure to destroy it
    sh->SetVerifyReflowEnable(PR_FALSE); // turn off verify reflow while we're reflowing the test frame tree
 -  vm->SetViewObserver((nsIViewObserver *)((PresShell*)sh.get()));
 +  vm->SetViewObserver((nsIViewObserver *)((PresShell*)sh));
    WillCauseReflow();
    sh->InitialReflow(r.width, r.height);
    DidCauseReflow();
-@@ -7002,7 +6991,7 @@ PresShell::VerifyIncrementalReflow()
+@@ -7021,7 +7010,7 @@ PresShell::VerifyIncrementalReflow()
    sh->SetVerifyReflowEnable(PR_TRUE);  // turn on verify reflow again now that we're done reflowing the test frame tree
    // Force the non-primary presshell to unsuppress; it doesn't want to normally
    // because it thinks it's hidden
 -  ((PresShell*)sh.get())->mPaintingSuppressed = PR_FALSE;
 +  ((PresShell*)sh)->mPaintingSuppressed = PR_FALSE;
    if (VERIFY_REFLOW_NOISY & gVerifyReflowFlags) {
       printf("Verification Tree built, comparing...\n");
    }
-@@ -7315,7 +7304,7 @@ void ReflowCountMgr::PaintCount(const ch
+@@ -7334,7 +7323,7 @@ void ReflowCountMgr::PaintCount(const ch
                    NS_FONT_WEIGHT_NORMAL, 0,
                    nsPresContext::CSSPixelsToAppUnits(11));
  
 -      nsCOMPtr<nsIFontMetrics> fm = aPresContext->GetMetricsFor(font);
 +      nsIFontMetrics* fm = aPresContext->GetMetricsFor(font);
        aRenderingContext->SetFont(fm);
        char buf[16];
        sprintf(buf, "%d", counter->mCount);
deleted file mode 100644
--- a/remove-zeroing-operator-news2
+++ /dev/null
@@ -1,45 +0,0 @@
-diff --git a/layout/base/nsPresShell.cpp b/layout/base/nsPresShell.cpp
---- a/layout/base/nsPresShell.cpp
-+++ b/layout/base/nsPresShell.cpp
-@@ -879,12 +879,12 @@ public:
-                             nscolor aBackgroundColor,
-                             gfxContext* aThebesContext);
- 
--  virtual gfxASurface* RenderNode(nsIDOMNode* aNode,
-+  virtual already_AddRefed<gfxASurface> RenderNode(nsIDOMNode* aNode,
-                                                    nsIRegion* aRegion,
-                                                    nsPoint& aPoint,
-                                                    nsRect* aScreenRect);
- 
--  virtual gfxASurface* RenderSelection(nsISelection* aSelection,
-+  virtual already_AddRefed<gfxASurface> RenderSelection(nsISelection* aSelection,
-                                                         nsPoint& aPoint,
-                                                         nsRect* aScreenRect);
- 
-@@ -1351,7 +1351,7 @@ nsIPresShell::RemoveWeakFrame(nsWeakFram
-   }
- }
- 
--nsFrameSelection*
-+already_AddRefed<nsFrameSelection>
- nsIPresShell::FrameSelection()
- {
-   return mSelection;
-@@ -5178,7 +5178,7 @@ PresShell::PaintRangePaintInfo(nsTArray<
-   return surface;
- }
- 
--gfxASurface*
-+already_AddRefed<gfxASurface>
- PresShell::RenderNode(nsIDOMNode* aNode,
-                       nsIRegion* aRegion,
-                       nsPoint& aPoint,
-@@ -5222,7 +5222,7 @@ PresShell::RenderNode(nsIDOMNode* aNode,
-                              aScreenRect);
- }
- 
--gfxASurface*
-+already_AddRefed<gfxASurface>
- PresShell::RenderSelection(nsISelection* aSelection,
-                            nsPoint& aPoint,
-                            nsRect* aScreenRect)
--- a/root-contentutils
+++ b/root-contentutils
@@ -1,8 +1,10 @@
+* * *
+
 diff --git a/content/base/public/nsContentUtils.h b/content/base/public/nsContentUtils.h
 --- a/content/base/public/nsContentUtils.h
 +++ b/content/base/public/nsContentUtils.h
 @@ -119,6 +119,8 @@ struct EventNameMapping {
  
  class nsContentUtils
  {
 +  struct LayoutRoots;
@@ -124,53 +126,73 @@ diff --git a/content/base/public/nsConte
  
    static nsresult doReparentContentWrapper(nsIContent *aChild,
                                             JSContext *cx,
 @@ -1062,56 +1065,55 @@ private:
    PR_STATIC_CALLBACK(void) DropScriptObject(PRUint32 aLangID, void *aObject,
                                              void *aClosure);
  
 -  static nsIDOMScriptObjectFactory *sDOMScriptObjectFactory;
--
--  static nsIXPConnect *sXPConnect;
--
--  static nsIScriptSecurityManager *sSecurityManager;
--
--  static nsIThreadJSContextStack *sThreadJSContextStack;
--
--  static nsIParserService *sParserService;
--
--  static nsINameSpaceManager *sNameSpaceManager;
--
--  static nsIIOService *sIOService;
--
 +  struct LayoutRoots : public MMgc::GCRoot
 +  {
 +    LayoutRoots() :
 +      MMgc::GCRoot(NS_GetGC()) { }
 +    nsresult Init();
-+
+ 
+-  static nsIXPConnect *sXPConnect;
 +    PRBool InitializeEventTable();
-+
+ 
+-  static nsIScriptSecurityManager *sSecurityManager;
 +    nsIDOMScriptObjectFactory *sDOMScriptObjectFactory;
 +    nsIXPConnect *sXPConnect;
 +    nsIScriptSecurityManager *sSecurityManager;
 +    nsIThreadJSContextStack *sThreadJSContextStack;
 +    nsIParserService *sParserService;
 +    nsINameSpaceManager *sNameSpaceManager;
 +    nsIIOService *sIOService;
- #ifdef MOZ_XTF
--  static nsIXTFService *sXTFService;
++#ifdef MOZ_XTF
 +    nsIXTFService *sXTFService;
- #endif
++#endif
++    nsIPrefBranch *sPrefBranch;
++    nsIPref *sPref;
++    imgILoader* sImgLoader;
++    nsIConsoleService* sConsoleService;
++    nsDataHashtable<nsISupportsHashKey, EventNameMapping, GCAllocator> sEventTable;
++    nsIStringBundleService* sStringBundleService;
++    nsIStringBundle* sStringBundles[PropertiesFile_COUNT];
++    nsIContentPolicy* sContentPolicyService;
+ 
+-  static nsIThreadJSContextStack *sThreadJSContextStack;
++    nsILineBreaker* sLineBreaker;
++    nsIWordBreaker* sWordBreaker;
++    nsICaseConversion* sCaseConv;
+ 
+-  static nsIParserService *sParserService;
++    // Holds pointers to nsISupports* that should be released at shutdown
++    nsVoidArrayBase<GCAllocator> sExtraLayoutRoots;
+ 
+-  static nsINameSpaceManager *sNameSpaceManager;
++    nsIScriptRuntime* sScriptRuntimes[NS_STID_ARRAY_UBOUND];
+ 
+-  static nsIIOService *sIOService;
 -
+-#ifdef MOZ_XTF
+-  static nsIXTFService *sXTFService;
++#ifdef IBMBIDI
++    nsIBidiKeyboard* sBidiKeyboard;
+ #endif
+ 
 -  static nsIPrefBranch *sPrefBranch;
--
++    nsIJSRuntimeService* sJSRuntimeService;
++    JSRuntime* sJSScriptRuntime;
++  };
+ 
 -  static nsIPref *sPref;
--
++  static LayoutRoots *sLayoutRoots;
+ 
 -  static imgILoader* sImgLoader;
 -
 -  static nsIConsoleService* sConsoleService;
 -
 -  static nsDataHashtable<nsISupportsHashKey, EventNameMapping, GCAllocator>* sEventTable;
 -
 -  static nsIStringBundleService* sStringBundleService;
 -  static nsIStringBundle* sStringBundles[PropertiesFile_COUNT];
@@ -181,44 +203,16 @@ diff --git a/content/base/public/nsConte
 -  static nsILineBreaker* sLineBreaker;
 -  static nsIWordBreaker* sWordBreaker;
 -  static nsICaseConversion* sCaseConv;
 -
 -  // Holds pointers to nsISupports* that should be released at shutdown
 -  static nsVoidArray* sPtrsToPtrsToRelease;
 -
 -  static nsIScriptRuntime* sScriptRuntimes[NS_STID_ARRAY_UBOUND];
-+    nsIPrefBranch *sPrefBranch;
-+    nsIPref *sPref;
-+    imgILoader* sImgLoader;
-+    nsIConsoleService* sConsoleService;
-+    nsDataHashtable<nsISupportsHashKey, EventNameMapping, GCAllocator> sEventTable;
-+    nsIStringBundleService* sStringBundleService;
-+    nsIStringBundle* sStringBundles[PropertiesFile_COUNT];
-+    nsIContentPolicy* sContentPolicyService;
-+
-+    nsILineBreaker* sLineBreaker;
-+    nsIWordBreaker* sWordBreaker;
-+    nsICaseConversion* sCaseConv;
-+
-+    // Holds pointers to nsISupports* that should be released at shutdown
-+    nsVoidArrayBase<GCAllocator> sExtraLayoutRoots;
-+
-+    nsIScriptRuntime* sScriptRuntimes[NS_STID_ARRAY_UBOUND];
-+
-+#ifdef IBMBIDI
-+    nsIBidiKeyboard* sBidiKeyboard;
-+#endif
-+
-+    nsIJSRuntimeService* sJSRuntimeService;
-+    JSRuntime* sJSScriptRuntime;
-+  };
-+
-+  static LayoutRoots *sLayoutRoots;
-+
    static PRInt32 sScriptRootCount[NS_STID_ARRAY_UBOUND];
    static PRUint32 sJSGCThingRootCount;
 -
 -#ifdef IBMBIDI
 -  static nsIBidiKeyboard* sBidiKeyboard;
 -#endif
 -
 -  static PRBool sInitialized;
@@ -316,32 +310,29 @@ diff --git a/content/base/src/nsContentU
  static PLDHashTable sEventListenerManagersHash;
  
 @@ -238,20 +207,31 @@ nsresult
  nsresult
  nsContentUtils::Init()
  {
 -  if (sInitialized) {
 -    NS_WARNING("Init() called twice");
--
++  NS_ASSERTION(!sLayoutRoots, "nsContentUtils::Init called twice");
+ 
 -    return NS_OK;
--  }
--
-+  NS_ASSERTION(!sLayoutRoots, "nsContentUtils::Init called twice");
-+
 +  LayoutRoots *roots = new LayoutRoots();
 +  nsresult rv = roots->Init();
 +  if (NS_FAILED(rv)) {
 +    delete roots;
 +    return rv;
-+  }
+   }
 +  sLayoutRoots = roots;
 +  return NS_OK;
 +}
-+
+ 
 +nsresult
 +nsContentUtils::LayoutRoots::Init()
 +{
    nsresult rv = CallGetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID,
                                 &sSecurityManager);
    NS_ENSURE_SUCCESS(rv, rv);
  
    // It's ok to not have a pref service.
@@ -409,22 +400,21 @@ diff --git a/content/base/src/nsContentU
 -  sEventTable = new nsDataHashtable<nsISupportsHashKey, EventNameMapping, GCAllocator>;
 -  if (!sEventTable ||
 -      !sEventTable->Init(int(NS_ARRAY_LENGTH(eventArray) / 0.75) + 1)) {
 -    delete sEventTable;
 -    sEventTable = nsnull;
 +  if (!sEventTable.Init(int(NS_ARRAY_LENGTH(eventArray) / 0.75) + 1))
      return PR_FALSE;
 -  }
--
+ 
 -  for (PRUint32 i = 0; i < NS_ARRAY_LENGTH(eventArray); ++i) {
 -    if (!sEventTable->Put(*(eventArray[i].mAtom), eventArray[i].mValue)) {
 -      delete sEventTable;
 -      sEventTable = nsnull;
-+
 +  for (PRUint32 i = 0; i < NS_ARRAY_LENGTH(eventArray); ++i)
 +    if (!sEventTable.Put(*(eventArray[i].mAtom), eventArray[i].mValue))
        return PR_FALSE;
 -    }
 -  }
  
    return PR_TRUE;
  }
@@ -435,65 +425,57 @@ diff --git a/content/base/src/nsContentU
 -  if (!sParserService) {
 +  if (!sLayoutRoots->sParserService) {
      // Lock, recheck sCachedParserService and aquire if this should be
      // safe for multiple threads.
 -    nsresult rv = CallGetService(kParserServiceCID, &sParserService);
 +    nsresult rv = CallGetService(kParserServiceCID, &sLayoutRoots->sParserService);
      if (NS_FAILED(rv)) {
 -      sParserService = nsnull;
--    }
--  }
--
++      sLayoutRoots->sParserService = nsnull;
+     }
+   }
+ 
 -  return sParserService;
-+      sLayoutRoots->sParserService = nsnull;
-+    }
-+  }
-+
 +  return sLayoutRoots->sParserService;
  }
  
  #ifdef MOZ_XTF
  nsIXTFService*
  nsContentUtils::GetXTFService()
  {
 -  if (!sXTFService) {
 -    nsresult rv = CallGetService(kXTFServiceCID, &sXTFService);
 +  if (!sLayoutRoots->sXTFService) {
 +    nsresult rv = CallGetService(kXTFServiceCID, &sLayoutRoots->sXTFService);
      if (NS_FAILED(rv)) {
 -      sXTFService = nsnull;
--    }
--  }
--
++      sLayoutRoots->sXTFService = nsnull;
+     }
+   }
+ 
 -  return sXTFService;
-+      sLayoutRoots->sXTFService = nsnull;
-+    }
-+  }
-+
 +  return sLayoutRoots->sXTFService;
  }
  #endif
  
 @@ -477,13 +432,13 @@ nsIBidiKeyboard*
  nsIBidiKeyboard*
  nsContentUtils::GetBidiKeyboard()
  {
 -  if (!sBidiKeyboard) {
 -    nsresult rv = CallGetService("@mozilla.org/widget/bidikeyboard;1", &sBidiKeyboard);
 +  if (!sLayoutRoots->sBidiKeyboard) {
 +    nsresult rv = CallGetService("@mozilla.org/widget/bidikeyboard;1", &sLayoutRoots->sBidiKeyboard);
      if (NS_FAILED(rv)) {
 -      sBidiKeyboard = nsnull;
--    }
--  }
++      sLayoutRoots->sBidiKeyboard = nsnull;
+     }
+   }
 -  return sBidiKeyboard;
-+      sLayoutRoots->sBidiKeyboard = nsnull;
-+    }
-+  }
 +  return sLayoutRoots->sBidiKeyboard;
  }
  #endif
  
 @@ -676,51 +631,13 @@ void
  void
  nsContentUtils::Shutdown()
  {
@@ -928,21 +910,20 @@ diff --git a/content/base/src/nsContentU
 -    nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem =
 +    nsISupports* container = aLoadingDocument->GetContainer();
 +    nsIDocShellTreeItem* docShellTreeItem =
        do_QueryInterface(container);
  
      if (docShellTreeItem) {
 -      nsCOMPtr<nsIDocShellTreeItem> root;
 -      docShellTreeItem->GetRootTreeItem(getter_AddRefs(root));
--
--      nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(root));
 +      nsIDocShellTreeItem* root = nsnull;
 +      docShellTreeItem->GetRootTreeItem(&root);
-+
+ 
+-      nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(root));
 +      nsIDocShell* docShell(do_QueryInterface(root));
  
        if (!docShell || NS_FAILED(docShell->GetAppType(&appType))) {
          appType = nsIDocShell::APP_TYPE_UNKNOWN;
 @@ -2126,7 +2043,7 @@ nsContentUtils::CanLoadImage(nsIURI* aUR
      // Editor apps get special treatment here, editors can load images
      // from anywhere.  This allows editor to insert images from file://
      // into documents that are being edited.
@@ -1302,58 +1283,55 @@ diff --git a/content/base/src/nsContentU
 +    }
 +  }  
 +  return sLayoutRoots->sJSScriptRuntime;
  }
  
  // static
  nsresult
 -nsAutoGCRoot::AddJSGCRoot(void* aPtr, const char* aName)
--{
++nsContentUtils::AddJSGCRoot(void* aPtr, const char* aName)
+ {
 -  if (!sJSScriptRuntime) {
 -    nsresult rv = CallGetService("@mozilla.org/js/xpc/RuntimeService;1",
 -                                 &sJSRuntimeService);
 -    NS_ENSURE_TRUE(sJSRuntimeService, rv);
 -
 -    sJSRuntimeService->GetRuntime(&sJSScriptRuntime);
 -    if (!sJSScriptRuntime) {
 -      NS_RELEASE(sJSRuntimeService);
 -      NS_WARNING("Unable to get JS runtime from JS runtime service");
 -      return NS_ERROR_FAILURE;
 -    }
 -  }
-+nsContentUtils::AddJSGCRoot(void* aPtr, const char* aName)
-+{
 +  JSRuntime *rt = GetJSScriptRuntime();
 +  if (!rt)
 +    return NS_ERROR_FAILURE;
  
    PRBool ok;
 -  ok = ::JS_AddNamedRootRT(sJSScriptRuntime, aPtr, aName);
 +  ok = ::JS_AddNamedRootRT(rt, aPtr, aName);
    if (!ok) {
      NS_WARNING("JS_AddNamedRootRT failed");
      return NS_ERROR_OUT_OF_MEMORY;
 @@ -2722,14 +2650,12 @@ nsAutoGCRoot::AddJSGCRoot(void* aPtr, co
  
  /* static */
  nsresult
 -nsAutoGCRoot::RemoveJSGCRoot(void* aPtr)
--{
++nsContentUtils::RemoveJSGCRoot(void* aPtr)
+ {
 -  if (!sJSScriptRuntime) {
 -    NS_NOTREACHED("Trying to remove a JS GC root when none were added");
 -    return NS_ERROR_UNEXPECTED;
 -  }
--
--  ::JS_RemoveRootRT(sJSScriptRuntime, aPtr);
-+nsContentUtils::RemoveJSGCRoot(void* aPtr)
-+{
 +  JSRuntime *rt = GetJSScriptRuntime();
 +  NS_ASSERTION(rt, "Removing a JSGC root when none were added?");
-+
+ 
+-  ::JS_RemoveRootRT(sJSScriptRuntime, aPtr);
 +  ::JS_RemoveRootRT(rt, aPtr);
  
    return NS_OK;
  }
 @@ -2744,7 +2670,7 @@ nsContentUtils::IsEventAttributeName(nsI
      return PR_FALSE;
  
    EventNameMapping mapping;
@@ -1421,21 +1399,20 @@ diff --git a/content/base/src/nsContentU
      return rv;
  
 @@ -2872,18 +2798,18 @@ nsContentUtils::ConvertStringFromCharset
  
  static PRBool EqualExceptRef(nsIURL* aURL1, nsIURL* aURL2)
  {
 -  nsCOMPtr<nsIURI> u1;
 -  nsCOMPtr<nsIURI> u2;
--
--  nsresult rv = aURL1->Clone(getter_AddRefs(u1));
 +  nsIURI* u1 = nsnull;
 +  nsIURI* u2 = nsnull;
-+
+ 
+-  nsresult rv = aURL1->Clone(getter_AddRefs(u1));
 +  nsresult rv = aURL1->Clone(&u1);
    if (NS_SUCCEEDED(rv)) {
 -    rv = aURL2->Clone(getter_AddRefs(u2));
 +    rv = aURL2->Clone(&u2);
    }
    if (NS_FAILED(rv))
      return PR_FALSE;
  
@@ -1633,22 +1610,20 @@ diff --git a/content/base/src/nsContentU
  nsContentUtils::GetDOMScriptObjectFactory()
  {
 -  if (!sDOMScriptObjectFactory) {
 +  if (!sLayoutRoots->sDOMScriptObjectFactory) {
      static NS_DEFINE_CID(kDOMScriptObjectFactoryCID,
                           NS_DOM_SCRIPT_OBJECT_FACTORY_CID);
  
 -    CallGetService(kDOMScriptObjectFactoryCID, &sDOMScriptObjectFactory);
--  }
--
++    CallGetService(kDOMScriptObjectFactoryCID, &sLayoutRoots->sDOMScriptObjectFactory);
+   }
+ 
 -  return sDOMScriptObjectFactory;
-+    CallGetService(kDOMScriptObjectFactoryCID, &sLayoutRoots->sDOMScriptObjectFactory);
-+  }
-+
 +  return sLayoutRoots->sDOMScriptObjectFactory;
  }
  
  /* static */
 @@ -3481,7 +3406,7 @@ nsContentUtils::HoldScriptObject(PRUint3
    nsresult rv;
  
    PRUint32 langIndex = NS_STID_INDEX(aLangID);
@@ -1767,25 +1742,16 @@ diff --git a/content/html/content/src/ns
  static const char kWhitespace[] = "\n\r\t\b";
  
 -class nsHTMLInputElement : public nsGenericHTMLFormElement,
 +class nsHTMLInputElement : public XPCOMGCFinalizedObject,
 +                           public nsGenericHTMLFormElement,
                             public nsImageLoadingContent,
                             public nsIDOMHTMLInputElement,
                             public nsIDOMNSHTMLInputElement,
-@@ -239,7 +240,7 @@ public:
-    * Get the radio group container for this button (form or document)
-    * @return the radio group container (or null if no form or document)
-    */
--  virtual already_AddRefed<nsIRadioGroupContainer> GetRadioGroupContainer();
-+  virtual nsIRadioGroupContainer* GetRadioGroupContainer();
- 
-   virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
- 
 @@ -435,7 +436,7 @@ nsHTMLInputElement::Clone(nsINodeInfo *a
      return NS_ERROR_OUT_OF_MEMORY;
    }
  
 -  nsCOMPtr<nsINode> kungFuDeathGrip = it;
 +  nsINode* kungFuDeathGrip = it;
    nsresult rv = CopyInnerTo(it);
    NS_ENSURE_SUCCESS(rv, rv);
@@ -1873,25 +1839,16 @@ diff --git a/content/html/content/src/ns
    if (container) {
      nameExists = GetNameIfExists(name);
      if (nameExists) {
 -      container->GetCurrentRadioButton(name, getter_AddRefs(currentlySelected));
 +      container->GetCurrentRadioButton(name, &currentlySelected);
      }
    }
  
-@@ -1130,7 +1131,7 @@ nsHTMLInputElement::RadioSetChecked(PRBo
-   return rv;
- }
- 
--/* virtual */ already_AddRefed<nsIRadioGroupContainer>
-+/* virtual */ nsIRadioGroupContainer*
- nsHTMLInputElement::GetRadioGroupContainer()
- {
-   nsIRadioGroupContainer* retval = nsnull;
 @@ -1153,7 +1154,7 @@ nsHTMLInputElement::MaybeSubmitForm(nsPr
      return NS_OK;
    }
    
 -  nsCOMPtr<nsIPresShell> shell = aPresContext->GetPresShell();
 +  nsIPresShell* shell = aPresContext->GetPresShell();
    if (!shell) {
      return NS_OK;
@@ -2060,17 +2017,17 @@ diff --git a/content/html/content/src/ns
 @@ -2157,7 +2158,6 @@ nsHTMLInputElement::GetControllers(nsICo
    }
  
    *aResult = mControllers;
 -  NS_IF_ADDREF(*aResult);
  
    return NS_OK;
  }
-@@ -2261,7 +2261,7 @@ nsHTMLInputElement::GetFileList(nsIDOMFi
+@@ -2261,7 +2261,7 @@ nsHTMLInputElement::GetFiles(nsIDOMFileL
      UpdateFileList();
    }
  
 -  NS_ADDREF(*aFileList = mFileList);
 +  *aFileList = mFileList;
  
    return NS_OK;
  }
deleted file mode 100644
--- a/root-contentutils2
+++ /dev/null
@@ -1,21 +0,0 @@
-diff --git a/content/html/content/src/nsHTMLInputElement.cpp b/content/html/content/src/nsHTMLInputElement.cpp
---- a/content/html/content/src/nsHTMLInputElement.cpp
-+++ b/content/html/content/src/nsHTMLInputElement.cpp
-@@ -240,7 +240,7 @@ public:
-    * Get the radio group container for this button (form or document)
-    * @return the radio group container (or null if no form or document)
-    */
--  virtual nsIRadioGroupContainer* GetRadioGroupContainer();
-+  virtual already_AddRefed<nsIRadioGroupContainer> GetRadioGroupContainer();
- 
-   virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
- 
-@@ -1131,7 +1131,7 @@ nsHTMLInputElement::RadioSetChecked(PRBo
-   return rv;
- }
- 
--/* virtual */ nsIRadioGroupContainer*
-+/* virtual */ already_AddRefed<nsIRadioGroupContainer>
- nsHTMLInputElement::GetRadioGroupContainer()
- {
-   nsIRadioGroupContainer* retval = nsnull;
--- a/series
+++ b/series
@@ -17,42 +17,36 @@ nscore-class-annotation-types
 psm-remove-init-isupports
 success-macros.patch
 consoleservice.patch # bug 397929
 no-standaloneglue.patch
 comptr-rewrite.patch
 prerewrite_fixes.patch
 maybeweak-crap.patch
 remove-cyclec.patch
-remove-cyclec.patch2
 xpcomgcbase.patch
-xpcomgcbase.patch2
 dirservice-atomroots.patch
 proxy-fixup.patch
 windows-warning.patch
 comarray.patch
 gc-hashtables.patch
 xpti-workingset.patch
 unbraced-if-fixes.patch
-unbraced-if-fixes2.patch
 more-gcobjects.patch
 fix-garburator.patch
 xpcomproxy-gcalloc.patch
 hashentry-fixups.patch
 uconverter-suck
 xpinstall-suck
 layout-suck
-layout-suck2
 widget-suck
 TArray-allocator
-TArray-extra2
 TArray-extra
 compmgr-loadertype
 xpconnect-allocations
-xpconnect-allocations2
 observerlist-gc
 jscomponentloader-gc
 necko-gc
 imgcache
 more-xptcall
 shell-loginit
 console-heapallocate
 compmgr-more
@@ -69,63 +63,52 @@ revert-xpcomgc-cookie-madness
 system-metrics-comarray
 revert-xpccallcontext
 xpcom-request-contexts
 set-default-jscontext
 no-socketts-deadlock
 root-jscomponentloader-script
 nativescriptableshared-gcobject
 root-contentutils
-root-contentutils2
 mark-observerservice
 mark-dirservice
-mark-dirservice2
 more-hashtables
 root-layout-stuff
 mark-events
 xpconnect-finalizers
 observe-before-thread-shutdown
 compmgr-shutdown-asserts
 debug-unittests
-debug-unittests2
 xpconnect-scope-finalizer-assertions
 xpcom-thread-fixup
 nsPipeEvents-stackobject
 xptimanager-shutdown-reentry
 root-timers
 autolock-request
-autolock-request2
 xslt-maps-gcobjects
 necko-deadlocks
-necko-deadlocks2
-necko-deadlocks3
-necko-deadlocks4
-necko-deadlocks5
-necko-deadlocks6
 variant-comptr
 xptinfo-finalizer-locking
 dir-removal-thread
 root-nsIMemory
 input-stream-tee-closesink
 bad-plugin-finalization
 nsWeakRef
 nsListenerStruct
 remove-zeroing-operator-news
-remove-zeroing-operator-news2
 parser-gcobjects
 NS_OBSERVER_ARRAY_NOTIFY_OBSERVERS
 nsXMLContentSink-mContentStack
 mozAutoDocUpdate
 nsPresShellIterator
 nsEvent
 nsEventTargetChainItem
 nsEventChainVisitor
 nsContentListKey
 nsSlots
-nsSlots2
 nsAttrAndChildArray
 root-running-threads
 xpcshell-shutdown-necko
 temp-debug-necko-unittests
 CallGetService-nullcheck
 nsSingletonFactory
 gfx-refcounting
 nsWebShell-operator-new
--- a/unbraced-if-fixes.patch
+++ b/unbraced-if-fixes.patch
@@ -1,24 +1,26 @@
+* * *
+
 diff --git a/accessible/src/base/nsDocAccessible.cpp b/accessible/src/base/nsDocAccessible.cpp
 --- a/accessible/src/base/nsDocAccessible.cpp
 +++ b/accessible/src/base/nsDocAccessible.cpp
-@@ -409,8 +409,6 @@ NS_IMETHODIMP nsDocAccessible::GetWindow
+@@ -393,8 +393,6 @@ NS_IMETHODIMP nsDocAccessible::GetWindow
+ 
    if (!*aDOMWin)
      return NS_ERROR_FAILURE;  // No DOM Window
- 
+-
 -  NS_ADDREF(*aDOMWin);
--
+ 
    return NS_OK;
  }
- 
 diff --git a/caps/src/nsScriptSecurityManager.cpp b/caps/src/nsScriptSecurityManager.cpp
 --- a/caps/src/nsScriptSecurityManager.cpp
 +++ b/caps/src/nsScriptSecurityManager.cpp
-@@ -1806,8 +1806,6 @@ nsScriptSecurityManager::GetSubjectPrinc
+@@ -1816,8 +1816,6 @@ nsScriptSecurityManager::GetSubjectPrinc
  {
      nsresult rv;
      *aSubjectPrincipal = doGetSubjectPrincipal(&rv);
 -    if (NS_SUCCEEDED(rv))
 -        NS_IF_ADDREF(*aSubjectPrincipal);
      return rv;
  }
  
@@ -182,39 +184,51 @@ diff --git a/js/src/xpconnect/tests/comp
 -    if(mReceiver)
 -        NS_ADDREF(mReceiver);
  
      /* don't release the reference, that is the caller's problem */
      *aReceiver = oldReceiver;
 diff --git a/netwerk/base/src/nsSocketTransportService2.cpp b/netwerk/base/src/nsSocketTransportService2.cpp
 --- a/netwerk/base/src/nsSocketTransportService2.cpp
 +++ b/netwerk/base/src/nsSocketTransportService2.cpp
-@@ -145,8 +145,6 @@ nsSocketTransportService::AttachSocket(P
+@@ -162,8 +162,6 @@ nsSocketTransportService::AttachSocket(P
      sock.mElapsedTime = 0;
  
      nsresult rv = AddToIdleList(&sock);
 -    if (NS_SUCCEEDED(rv))
 -        NS_ADDREF(handler);
      return rv;
  }
  
 diff --git a/netwerk/dns/src/nsHostResolver.cpp b/netwerk/dns/src/nsHostResolver.cpp
 --- a/netwerk/dns/src/nsHostResolver.cpp
 +++ b/netwerk/dns/src/nsHostResolver.cpp
-@@ -520,9 +520,7 @@ nsHostResolver::IssueLookup(nsHostRecord
+@@ -530,9 +530,7 @@ nsHostResolver::IssueLookup(nsHostRecord
      // add rec to mPendingQ, possibly removing it from mEvictionQ.
      // if rec is on mEvictionQ, then we can just move the owning
      // reference over to mPendingQ.
 -    if (rec->next == rec)
 -        NS_ADDREF(rec);
 -    else {
 +    if (rec->next != rec) {
          PR_REMOVE_LINK(rec);
          mEvictionQSize--;
      }
+diff --git a/uriloader/exthandler/win/nsOSHelperAppService.cpp b/uriloader/exthandler/win/nsOSHelperAppService.cpp
+--- a/uriloader/exthandler/win/nsOSHelperAppService.cpp
++++ b/uriloader/exthandler/win/nsOSHelperAppService.cpp
+@@ -469,8 +469,6 @@ already_AddRefed<nsMIMEInfoWin> nsOSHelp
+   if (!mimeInfo)
+     return nsnull; // out of memory
+ 
+-  NS_ADDREF(mimeInfo);
+-
+   // don't append the '.'
+   mimeInfo->AppendExtension(NS_ConvertUTF16toUTF8(Substring(fileExtToUse, 1)));
+ 
 diff --git a/widget/src/xpwidgets/nsBaseClipboard.cpp b/widget/src/xpwidgets/nsBaseClipboard.cpp
 --- a/widget/src/xpwidgets/nsBaseClipboard.cpp
 +++ b/widget/src/xpwidgets/nsBaseClipboard.cpp
 @@ -77,8 +77,6 @@ NS_IMETHODIMP nsBaseClipboard::SetData(n
    EmptyClipboard(aWhichClipboard);
  
    mClipboardOwner = anOwner;
 -  if ( anOwner )
@@ -265,8 +279,22 @@ diff --git a/xpcom/reflect/xptinfo/src/x
          }
  
          gInterfaceInfoManager = new xptiInterfaceInfoManager(searchPath);
 -        if(gInterfaceInfoManager)
 -            NS_ADDREF(gInterfaceInfoManager);
          if(!gInterfaceInfoManager->IsValid())
          {
              NS_RELEASE(gInterfaceInfoManager);
+diff --git a/xpcom/threads/nsTimerImpl.cpp b/xpcom/threads/nsTimerImpl.cpp
+--- a/xpcom/threads/nsTimerImpl.cpp
++++ b/xpcom/threads/nsTimerImpl.cpp
+@@ -392,10 +392,6 @@ void nsTimerImpl::Fire()
+   // See bug 330128.
+   CallbackUnion callback = mCallback;
+   PRUintn callbackType = mCallbackType;
+-  if (callbackType == CALLBACK_TYPE_INTERFACE)
+-    NS_ADDREF(callback.i);
+-  else if (callbackType == CALLBACK_TYPE_OBSERVER)
+-    NS_ADDREF(callback.o);
+   ReleaseCallback();
+ 
+   switch (callbackType) {
deleted file mode 100644
--- a/unbraced-if-fixes2.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-diff --git a/uriloader/exthandler/win/nsOSHelperAppService.cpp b/uriloader/exthandler/win/nsOSHelperAppService.cpp
---- a/uriloader/exthandler/win/nsOSHelperAppService.cpp
-+++ b/uriloader/exthandler/win/nsOSHelperAppService.cpp
-@@ -469,8 +469,6 @@ already_AddRefed<nsMIMEInfoWin> nsOSHelp
-   if (!mimeInfo)
-     return nsnull; // out of memory
- 
--  NS_ADDREF(mimeInfo);
--
-   // don't append the '.'
-   mimeInfo->AppendExtension(NS_ConvertUTF16toUTF8(Substring(fileExtToUse, 1)));
- 
-diff --git a/xpcom/threads/nsTimerImpl.cpp b/xpcom/threads/nsTimerImpl.cpp
---- a/xpcom/threads/nsTimerImpl.cpp
-+++ b/xpcom/threads/nsTimerImpl.cpp
-@@ -394,10 +394,6 @@ void nsTimerImpl::Fire()
-   // See bug 330128.
-   CallbackUnion callback = mCallback;
-   PRUintn callbackType = mCallbackType;
--  if (callbackType == CALLBACK_TYPE_INTERFACE)
--    NS_ADDREF(callback.i);
--  else if (callbackType == CALLBACK_TYPE_OBSERVER)
--    NS_ADDREF(callback.o);
-   ReleaseCallback();
- 
-   switch (callbackType) {
--- a/xpcomgcbase.patch
+++ b/xpcomgcbase.patch
@@ -1,8 +1,9 @@
+* * *
 * * *
 * * *
 * * *
 * * *
 * * *
 * * *
 * * *
 * * *
@@ -59,20 +60,21 @@ diff --git a/caps/include/nsPrincipal.h 
 -class nsPrincipal : public nsIPrincipal
 +class nsPrincipal : public XPCOMGCFinalizedObject, public nsIPrincipal
  {
  public:
    nsPrincipal();
 diff --git a/caps/src/nsNullPrincipal.cpp b/caps/src/nsNullPrincipal.cpp
 --- a/caps/src/nsNullPrincipal.cpp
 +++ b/caps/src/nsNullPrincipal.cpp
-@@ -60,28 +60,6 @@ NS_IMPL_CI_INTERFACE_GETTER2(nsNullPrinc
+@@ -59,28 +59,6 @@ NS_IMPL_CI_INTERFACE_GETTER2(nsNullPrinc
+ NS_IMPL_CI_INTERFACE_GETTER2(nsNullPrincipal,
                               nsIPrincipal,
                               nsISerializable)
- 
+-
 -NS_IMETHODIMP_(nsrefcnt) 
 -nsNullPrincipal::AddRef()
 -{
 -  NS_PRECONDITION(PRInt32(mJSPrincipals.refcount) >= 0, "illegal refcnt");
 -  nsrefcnt count = PR_AtomicIncrement((PRInt32 *)&mJSPrincipals.refcount);
 -  NS_LOG_ADDREF(this, count, "nsNullPrincipal", sizeof(*this));
 -  return count;
 -}
@@ -84,27 +86,27 @@ diff --git a/caps/src/nsNullPrincipal.cp
 -  nsrefcnt count = PR_AtomicDecrement((PRInt32 *)&mJSPrincipals.refcount);
 -  NS_LOG_RELEASE(this, count, "nsNullPrincipal");
 -  if (count == 0) {
 -    NS_DELETEXPCOM(this);
 -  }
 -
 -  return count;
 -}
--
+ 
  nsNullPrincipal::nsNullPrincipal()
  {
- }
 diff --git a/caps/src/nsPrincipal.cpp b/caps/src/nsPrincipal.cpp
 --- a/caps/src/nsPrincipal.cpp
 +++ b/caps/src/nsPrincipal.cpp
-@@ -79,29 +79,6 @@ NS_IMPL_CI_INTERFACE_GETTER2(nsPrincipal
+@@ -78,29 +78,6 @@ NS_IMPL_CI_INTERFACE_GETTER2(nsPrincipal
+ NS_IMPL_CI_INTERFACE_GETTER2(nsPrincipal,
                               nsIPrincipal,
                               nsISerializable)
- 
+-
 -NS_IMETHODIMP_(nsrefcnt)
 -nsPrincipal::AddRef()
 -{
 -  NS_PRECONDITION(PRInt32(mJSPrincipals.refcount) >= 0, "illegal refcnt");
 -  // XXXcaa does this need to be threadsafe?  See bug 143559.
 -  nsrefcnt count = PR_AtomicIncrement((PRInt32 *)&mJSPrincipals.refcount);
 -  NS_LOG_ADDREF(this, count, "nsPrincipal", sizeof(*this));
 -  return count;
@@ -117,27 +119,27 @@ diff --git a/caps/src/nsPrincipal.cpp b/
 -  nsrefcnt count = PR_AtomicDecrement((PRInt32 *)&mJSPrincipals.refcount);
 -  NS_LOG_RELEASE(this, count, "nsPrincipal");
 -  if (count == 0) {
 -    NS_DELETEXPCOM(this);
 -  }
 -
 -  return count;
 -}
--
+ 
  nsPrincipal::nsPrincipal()
    : mCapabilities(nsnull),
-     mSecurityPolicy(nsnull),
 diff --git a/caps/src/nsSystemPrincipal.cpp b/caps/src/nsSystemPrincipal.cpp
 --- a/caps/src/nsSystemPrincipal.cpp
 +++ b/caps/src/nsSystemPrincipal.cpp
-@@ -57,29 +57,6 @@ NS_IMPL_CI_INTERFACE_GETTER2(nsSystemPri
+@@ -56,29 +56,6 @@ NS_IMPL_CI_INTERFACE_GETTER2(nsSystemPri
+ NS_IMPL_CI_INTERFACE_GETTER2(nsSystemPrincipal,
                               nsIPrincipal,
                               nsISerializable)
- 
+-
 -NS_IMETHODIMP_(nsrefcnt) 
 -nsSystemPrincipal::AddRef()
 -{
 -  NS_PRECONDITION(PRInt32(mJSPrincipals.refcount) >= 0, "illegal refcnt");
 -  nsrefcnt count = PR_AtomicIncrement((PRInt32 *)&mJSPrincipals.refcount);
 -  NS_LOG_ADDREF(this, count, "nsSystemPrincipal", sizeof(*this));
 -  return count;
 -}
@@ -150,20 +152,19 @@ diff --git a/caps/src/nsSystemPrincipal.
 -  NS_LOG_RELEASE(this, count, "nsSystemPrincipal");
 -  if (count == 0) {
 -    NS_DELETEXPCOM(this);
 -  }
 -
 -  return count;
 -}
 -
--
+ 
  ///////////////////////////////////////
  // Methods implementing nsIPrincipal //
- ///////////////////////////////////////
 diff --git a/content/base/public/nsContentUtils.h b/content/base/public/nsContentUtils.h
 --- a/content/base/public/nsContentUtils.h
 +++ b/content/base/public/nsContentUtils.h
 @@ -966,14 +966,6 @@ public:
    static void DestroyAnonymousContent(nsCOMPtr<nsIContent>* aContent);
  
    /**
 -   * Drop the JS objects held by aScriptObjectHolder.
@@ -539,33 +540,34 @@ diff --git a/content/base/src/nsNodeInfo
 -
 -  return count;
  }
  
  nsresult
 diff --git a/content/base/src/nsNodeInfoManager.h b/content/base/src/nsNodeInfoManager.h
 --- a/content/base/src/nsNodeInfoManager.h
 +++ b/content/base/src/nsNodeInfoManager.h
-@@ -58,14 +58,11 @@ class nsIDOMNamedNodeMap;
+@@ -58,14 +58,12 @@ class nsIDOMNamedNodeMap;
  class nsIDOMNamedNodeMap;
  class nsXULPrototypeDocument;
  
 -class nsNodeInfoManager
 +class nsNodeInfoManager : public XPCOMGCFinalizedObject
++                        , public MMgc::GCFinalizable
  {
  public:
    nsNodeInfoManager();
    ~nsNodeInfoManager();
 -
 -  nsrefcnt AddRef(void);
 -  nsrefcnt Release(void);
  
    /**
     * Initialize the nodeinfo manager with a document.
-@@ -146,7 +143,6 @@ private:
+@@ -146,7 +144,6 @@ private:
                                                      const void *key2);
    static PLHashNumber PR_CALLBACK GetNodeInfoInnerHashValue(const void *key);
  
 -  nsAutoRefCnt mRefCnt;
    NS_DECL_OWNINGTHREAD
  
    PLHashTable *mNodeInfoHash;
 diff --git a/content/base/src/nsTextNode.cpp b/content/base/src/nsTextNode.cpp
@@ -1714,71 +1716,71 @@ diff --git a/content/xslt/src/xslt/txMoz
 -    }
 -    return mRefCnt;
  }
  
  nsresult
 diff --git a/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp b/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp
 --- a/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp
 +++ b/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp
-@@ -520,7 +520,7 @@ txMozillaXSLTProcessor::AddXSLTParam(con
+@@ -503,7 +503,7 @@ txMozillaXSLTProcessor::AddXSLTParam(con
          NS_ENSURE_SUCCESS(rv, rv);
      }
      else {
 -        value = new StringResult(aValue, nsnull);
 +        value = new StringResult(aValue);
          NS_ENSURE_TRUE(value, NS_ERROR_OUT_OF_MEMORY);
      }
  
-@@ -1336,7 +1336,7 @@ txVariable::Convert(nsIVariant *aValue, 
+@@ -1319,7 +1319,7 @@ txVariable::Convert(nsIVariant *aValue, 
              nsresult rv = aValue->GetAsDouble(&value);
              NS_ENSURE_SUCCESS(rv, rv);
  
 -            *aResult = new NumberResult(value, nsnull);
 +            *aResult = new NumberResult(value);
              NS_ENSURE_TRUE(*aResult, NS_ERROR_OUT_OF_MEMORY);
  
              NS_ADDREF(*aResult);
-@@ -1375,7 +1375,7 @@ txVariable::Convert(nsIVariant *aValue, 
+@@ -1358,7 +1358,7 @@ txVariable::Convert(nsIVariant *aValue, 
              nsresult rv = aValue->GetAsAString(value);
              NS_ENSURE_SUCCESS(rv, rv);
  
 -            *aResult = new StringResult(value, nsnull);
 +            *aResult = new StringResult(value);
              NS_ENSURE_TRUE(*aResult, NS_ERROR_OUT_OF_MEMORY);
  
              NS_ADDREF(*aResult);
-@@ -1398,7 +1398,7 @@ txVariable::Convert(nsIVariant *aValue, 
+@@ -1381,7 +1381,7 @@ txVariable::Convert(nsIVariant *aValue, 
                      return NS_ERROR_FAILURE;
                  }
  
 -                *aResult = new txNodeSet(*xpathNode, nsnull);
 +                *aResult = new txNodeSet(*xpathNode);
                  if (!*aResult) {
                      return NS_ERROR_OUT_OF_MEMORY;
                  }
-@@ -1415,7 +1415,7 @@ txVariable::Convert(nsIVariant *aValue, 
+@@ -1398,7 +1398,7 @@ txVariable::Convert(nsIVariant *aValue, 
  
              nsCOMPtr<nsIDOMNodeList> nodeList = do_QueryInterface(supports);
              if (nodeList) {
 -                nsRefPtr<txNodeSet> nodeSet = new txNodeSet(nsnull);
 +                nsRefPtr<txNodeSet> nodeSet = new txNodeSet();
                  if (!nodeSet) {
                      return NS_ERROR_OUT_OF_MEMORY;
                  }
-@@ -1470,7 +1470,7 @@ txVariable::Convert(nsIVariant *aValue, 
+@@ -1453,7 +1453,7 @@ txVariable::Convert(nsIVariant *aValue, 
                                      (::JS_GetStringChars(str));
                  nsDependentString value(strChars, ::JS_GetStringLength(str));
  
 -                *aResult = new StringResult(value, nsnull);
 +                *aResult = new StringResult(value);
                  if (!*aResult) {
                      return NS_ERROR_OUT_OF_MEMORY;
                  }
-@@ -1498,7 +1498,7 @@ txVariable::Convert(nsIVariant *aValue, 
+@@ -1481,7 +1481,7 @@ txVariable::Convert(nsIVariant *aValue, 
  
              nsISupports** values = static_cast<nsISupports**>(array);
  
 -            nsRefPtr<txNodeSet> nodeSet = new txNodeSet(nsnull);
 +            nsRefPtr<txNodeSet> nodeSet = new txNodeSet();
              if (!nodeSet) {
                  NS_FREE_XPCOM_ISUPPORTS_POINTER_ARRAY(count, values);
  
@@ -1836,20 +1838,22 @@ diff --git a/content/xslt/src/xslt/txSty
 -    nsAutoRefCnt mRefCnt;
 -
      // List of ImportFrames
      txList mImportFrames;
      
 diff --git a/content/xslt/src/xslt/txStylesheetCompiler.cpp b/content/xslt/src/xslt/txStylesheetCompiler.cpp
 --- a/content/xslt/src/xslt/txStylesheetCompiler.cpp
 +++ b/content/xslt/src/xslt/txStylesheetCompiler.cpp
-@@ -69,27 +69,6 @@ txStylesheetCompiler::txStylesheetCompil
+@@ -67,27 +67,6 @@ txStylesheetCompiler::txStylesheetCompil
+     : txStylesheetCompilerState(aObserver)
+ {
      mStatus = init(aStylesheetURI, aStylesheet, aInsertPosition);
- }
- 
+-}
+-
 -nsrefcnt
 -txStylesheetCompiler::AddRef()
 -{
 -    ++mRefCnt;
 -    NS_LOG_ADDREF(this, mRefCnt, "txStylesheetCompiler", sizeof(*this));
 -    return mRefCnt;
 -}
 -
@@ -1859,21 +1863,19 @@ diff --git a/content/xslt/src/xslt/txSty
 -    --mRefCnt;
 -    NS_LOG_RELEASE(this, mRefCnt, "txStylesheetCompiler");
 -    if (mRefCnt == 0) {
 -        mRefCnt = 1; //stabilize
 -        delete this;
 -        return 0;
 -    }
 -    return mRefCnt;
--}
--
+ }
+ 
  void
- txStylesheetCompiler::setBaseURI(const nsString& aBaseURI)
- {
 diff --git a/content/xslt/src/xslt/txStylesheetCompiler.h b/content/xslt/src/xslt/txStylesheetCompiler.h
 --- a/content/xslt/src/xslt/txStylesheetCompiler.h
 +++ b/content/xslt/src/xslt/txStylesheetCompiler.h
 @@ -75,9 +75,6 @@ class txACompileObserver
  class txACompileObserver
  {
  public:
 -    virtual nsrefcnt AddRef() = 0;
@@ -1992,29 +1994,29 @@ diff --git a/content/xul/document/src/ns
      if (NS_FAILED(rv)) {
 -        element->Release();
          return rv;
      }
  
 diff --git a/content/xul/document/src/nsXULPrototypeDocument.cpp b/content/xul/document/src/nsXULPrototypeDocument.cpp
 --- a/content/xul/document/src/nsXULPrototypeDocument.cpp
 +++ b/content/xul/document/src/nsXULPrototypeDocument.cpp
-@@ -179,12 +179,6 @@ nsXULPrototypeDocument::~nsXULPrototypeD
+@@ -177,12 +177,6 @@ nsXULPrototypeDocument::~nsXULPrototypeD
+     if (mGlobalObject) {
+         // cleaup cycles etc.
          mGlobalObject->ClearGlobalObjectOwner();
-     }
- 
+-    }
+-
 -    PRUint32 count = mProcessingInstructions.Length();
 -    for (PRUint32 i = 0; i < count; i++)
 -    {
 -        mProcessingInstructions[i]->Release();
--    }
--
+     }
+ 
      if (mRoot)
-         mRoot->ReleaseSubtree();
- 
 diff --git a/content/xul/templates/src/nsXMLBinding.h b/content/xul/templates/src/nsXMLBinding.h
 --- a/content/xul/templates/src/nsXMLBinding.h
 +++ b/content/xul/templates/src/nsXMLBinding.h
 @@ -72,22 +72,14 @@ struct nsXMLBinding {
   * a collection of <binding> descriptors. This object is refcounted by
   * nsXMLBindingValues objects and the query processor.
   */
 -class nsXMLBindingSet
@@ -2035,26 +2037,26 @@ diff --git a/content/xul/templates/src/n
 -  NS_IMETHOD_(nsrefcnt) Release();
 -  NS_DECL_OWNINGTHREAD
  
    /**
     * Add a binding to the set
 diff --git a/docshell/base/nsWebShell.cpp b/docshell/base/nsWebShell.cpp
 --- a/docshell/base/nsWebShell.cpp
 +++ b/docshell/base/nsWebShell.cpp
-@@ -561,9 +561,6 @@ nsWebShell::~nsWebShell()
+@@ -560,9 +560,6 @@ nsWebShell::~nsWebShell()
+ nsWebShell::~nsWebShell()
  {
     Destroy();
- 
+-
 -  ++mRefCnt; // following releases can cause this destructor to be called
 -             // recursively if the refcount is allowed to remain 0
--
+ 
    mContentViewer=nsnull;
    mDeviceContext=nsnull;
- 
 diff --git a/dom/src/base/nsWindowRoot.cpp b/dom/src/base/nsWindowRoot.cpp
 --- a/dom/src/base/nsWindowRoot.cpp
 +++ b/dom/src/base/nsWindowRoot.cpp
 @@ -67,10 +67,8 @@ nsWindowRoot::nsWindowRoot(nsIDOMWindow*
    nsFocusController::Create(getter_AddRefs(mFocusController));
  
    nsCOMPtr<nsIDOMFocusListener> focusListener(do_QueryInterface(mFocusController));
 -  ++mRefCnt;
@@ -2281,33 +2283,33 @@ diff --git a/gfx/thebes/public/gfxTypes.
 -    nsAutoRefCnt mRefCnt;                                                     \
 +    gfxAutoRefCnt mRefCnt;                                                    \
  public:
  
  #endif /* GFX_TYPES_H */
 diff --git a/intl/unicharutil/src/nsCaseConversionImp2.cpp b/intl/unicharutil/src/nsCaseConversionImp2.cpp
 --- a/intl/unicharutil/src/nsCaseConversionImp2.cpp
 +++ b/intl/unicharutil/src/nsCaseConversionImp2.cpp
-@@ -166,16 +166,6 @@ nsCaseConversionImp2* nsCaseConversionIm
-   if (!gCaseConv)
-     NS_NEWXPCOM(gCaseConv, nsCaseConversionImp2);
+@@ -168,16 +168,6 @@ nsCaseConversionImp2* nsCaseConversionIm
    return gCaseConv;
--}
--
+ }
+ 
 -NS_IMETHODIMP_(nsrefcnt) nsCaseConversionImp2::AddRef(void)
 -{
 -  return (nsrefcnt)1;
 -}
 -
 -NS_IMETHODIMP_(nsrefcnt) nsCaseConversionImp2::Release(void)
 -{
 -  return (nsrefcnt)1;
- }
- 
+-}
+-
  NS_IMPL_THREADSAFE_QUERY_INTERFACE1(nsCaseConversionImp2, nsICaseConversion)
+ 
+ nsresult nsCaseConversionImp2::ToUpper(
 diff --git a/intl/unicharutil/src/nsCategoryImp.cpp b/intl/unicharutil/src/nsCategoryImp.cpp
 --- a/intl/unicharutil/src/nsCategoryImp.cpp
 +++ b/intl/unicharutil/src/nsCategoryImp.cpp
 @@ -42,19 +42,10 @@
  #include "nsCategoryImp.h"
  #include "cattable.h"
  
 +// XXXbsmedberg this is bad, must go
@@ -2343,32 +2345,32 @@ diff --git a/js/src/xpconnect/shell/xpcs
 -  : public nsIXPCSecurityManager
 +                      , public nsIXPCSecurityManager
  #endif
  {
  public:
 diff --git a/js/src/xpconnect/src/nsXPConnect.cpp b/js/src/xpconnect/src/nsXPConnect.cpp
 --- a/js/src/xpconnect/src/nsXPConnect.cpp
 +++ b/js/src/xpconnect/src/nsXPConnect.cpp
-@@ -242,14 +242,6 @@ nsXPConnect::ReleaseXPConnectSingleton()
+@@ -241,14 +241,6 @@ nsXPConnect::ReleaseXPConnectSingleton()
+         // NOTE: to see really interesting stuff turn on the prlog stuff.
          // See the comment at the top of xpclog.h to see how to do that.
          xpc->DebugDump(7);
- #endif
+-#endif
 -        nsrefcnt cnt;
 -        NS_RELEASE2(xpc, cnt);
 -#ifdef XPC_DUMP_AT_SHUTDOWN
 -        if(0 != cnt)
 -            printf("*** dangling reference to nsXPConnect: refcnt=%d\n", cnt);
 -        else
 -            printf("+++ XPConnect had no dangling references.\n");
--#endif
+ #endif
      }
  }
- 
-@@ -1443,7 +1435,7 @@ nsXPConnect::DebugDump(PRInt16 depth)
+@@ -1397,7 +1389,7 @@ nsXPConnect::DebugDump(PRInt16 depth)
  {
  #ifdef DEBUG
      depth-- ;
 -    XPC_LOG_ALWAYS(("nsXPConnect @ %x with mRefCnt = %d", this, mRefCnt.get()));
 +    XPC_LOG_ALWAYS(("nsXPConnect @ %x", this));
      XPC_LOG_INDENT();
          XPC_LOG_ALWAYS(("gSelf @ %x", gSelf));
          XPC_LOG_ALWAYS(("gOnceAliveNowDead is %d", (int)gOnceAliveNowDead));
@@ -2379,34 +2381,34 @@ diff --git a/js/src/xpconnect/src/xpccal
  
  XPCCallContext::~XPCCallContext()
  {
 -    NS_ASSERTION(mRefCnt == 0, "Someone is holding a bad reference to a XPCCallContext");
 -
      // do cleanup...
  
      if(mXPCContext)
-@@ -358,17 +356,6 @@ NS_IMPL_QUERY_INTERFACE1(XPCCallContext,
+@@ -357,17 +355,6 @@ XPCCallContext::~XPCCallContext()
+ 
  NS_IMPL_QUERY_INTERFACE1(XPCCallContext, nsIXPCNativeCallContext)
  NS_IMPL_ADDREF(XPCCallContext)
- 
+-
 -NS_IMETHODIMP_(nsrefcnt)
 -XPCCallContext::Release(void)
 -{
 -  NS_PRECONDITION(0 != mRefCnt, "dup release");
 -  NS_ASSERT_OWNINGTHREAD(XPCCallContext);
 -  --mRefCnt;
 -  NS_LOG_RELEASE(this, mRefCnt, "XPCCallContext");
 -  // no delete this!
 -  return mRefCnt;
 -}
--
+ 
  /* readonly attribute nsISupports Callee; */
  NS_IMETHODIMP
- XPCCallContext::GetCallee(nsISupports * *aCallee)
 diff --git a/js/src/xpconnect/src/xpcjsruntime.cpp b/js/src/xpconnect/src/xpcjsruntime.cpp
 --- a/js/src/xpconnect/src/xpcjsruntime.cpp
 +++ b/js/src/xpconnect/src/xpcjsruntime.cpp
 @@ -83,6 +83,8 @@ struct JSDyingJSObjectData
      nsVoidArray* array;
  };
  
 +#if 0
@@ -2417,23 +2419,20 @@ diff --git a/js/src/xpconnect/src/xpcjsr
 @@ -103,6 +105,7 @@ WrappedJSDyingJSObjectFinder(JSDHashTabl
      }
      return JS_DHASH_NEXT;
  }
 +#endif
  
  struct CX_AND_XPCRT_Data
  {
-@@ -249,57 +252,6 @@ ContextCallback(JSContext *cx, uintN ope
-     return gOldJSContextCallback
-            ? gOldJSContextCallback(cx, operation)
-            : JS_TRUE;
--}
--
--// static
+@@ -252,57 +255,6 @@ ContextCallback(JSContext *cx, uintN ope
+ }
+ 
+ // static
 -void XPCJSRuntime::TraceJS(JSTracer* trc, void* data)
 -{
 -    XPCJSRuntime* self = (XPCJSRuntime*)data;
 -
 -    // Skip this part if XPConnect is shutting down. We get into
 -    // bad locking problems with the thread iteration otherwise.
 -    if(!self->GetXPConnect()->IsShuttingDown())
 -    {
@@ -2472,58 +2471,61 @@ diff --git a/js/src/xpconnect/src/xpcjsr
 -{
 -    XPCWrappedNativeScope::TraceJS(trc, this);
 -
 -    for(XPCRootSetElem *e = mVariantRoots; e ; e = e->GetNextRoot())
 -        static_cast<XPCTraceableVariant*>(e)->TraceJS(trc);
 -
 -    for(XPCRootSetElem *e = mWrappedJSRoots; e ; e = e->GetNextRoot())
 -        static_cast<nsXPCWrappedJS*>(e)->TraceJS(trc);
- }
- 
- // static
-@@ -345,8 +297,11 @@ JSBool XPCJSRuntime::GCCallback(JSContex
+-}
+-
+-// static
+ JSBool XPCJSRuntime::GCCallback(JSContext *cx, JSGCStatus status)
+ {
+     nsVoidArray* dyingWrappedJSArray;
+@@ -342,8 +294,11 @@ JSBool XPCJSRuntime::GCCallback(JSContex
                      // We add them to the array now and Release the array members
                      // later to avoid the posibility of doing any JS GCThing
                      // allocations during the gc cycle.
 +#if 0
 +                    // let's pretend this is unnecessary (it probably is)
                      self->mWrappedJSMap->
                          Enumerate(WrappedJSDyingJSObjectFinder, &data);
 +#endif
                  }
  
                  // Do cleanup in NativeInterfaces. This part just finds 
-@@ -683,7 +638,7 @@ XPCJSRuntime::~XPCJSRuntime()
+@@ -671,7 +626,7 @@ XPCJSRuntime::~XPCJSRuntime()
      // count the total JSContexts in use
      JSContext* iter = nsnull;
      int count = 0;
 -    while(JS_ContextIterator(mJSRuntime, &iter))
 +    while(JS_ContextIterator(gJSRuntime, &iter))
          count ++;
      if(count)
          printf("deleting XPCJSRuntime with %d live JSContexts\n", count);
-@@ -705,7 +660,7 @@ XPCJSRuntime::~XPCJSRuntime()
+@@ -693,7 +648,7 @@ XPCJSRuntime::~XPCJSRuntime()
          if(count)
              printf("deleting XPCJSRuntime with %d live wrapped JSObject\n", (int)count);
  #endif
 -        mWrappedJSMap->Enumerate(WrappedJSShutdownMarker, mJSRuntime);
 +        mWrappedJSMap->Enumerate(WrappedJSShutdownMarker, gJSRuntime);
          delete mWrappedJSMap;
      }
  
-@@ -827,7 +782,6 @@ XPCJSRuntime::XPCJSRuntime(nsXPConnect* 
+@@ -815,7 +770,6 @@ XPCJSRuntime::XPCJSRuntime(nsXPConnect* 
  XPCJSRuntime::XPCJSRuntime(nsXPConnect* aXPConnect,
                             nsIJSRuntimeService* aJSRuntimeService)
   : mXPConnect(aXPConnect),
 -   mJSRuntime(nsnull),
     mJSRuntimeService(aJSRuntimeService),
     mContextMap(JSContext2XPCContextMap::newMap(XPC_CONTEXT_MAP_SIZE)),
     mWrappedJSMap(JSObject2WrappedJSMap::newMap(XPC_JS_MAP_SIZE)),
-@@ -863,22 +817,17 @@ XPCJSRuntime::XPCJSRuntime(nsXPConnect* 
+@@ -850,22 +804,17 @@ XPCJSRuntime::XPCJSRuntime(nsXPConnect* 
      if(mJSRuntimeService)
      {
          NS_ADDREF(mJSRuntimeService);
 -        mJSRuntimeService->GetRuntime(&mJSRuntime);
      }
  
      NS_ASSERTION(!gOldJSGCCallback, "XPCJSRuntime created more than once");
 -    if(mJSRuntime)
@@ -2541,26 +2543,26 @@ diff --git a/js/src/xpconnect/src/xpcjsr
  #ifdef DEBUG
 -    if(mJSRuntime && !JS_GetGlobalDebugHooks(mJSRuntime)->debuggerHandler)
 -        xpc_InstallJSDebuggerKeywordHandler(mJSRuntime);
 +    if(!JS_GetGlobalDebugHooks(gJSRuntime)->debuggerHandler)
 +        xpc_InstallJSDebuggerKeywordHandler(gJSRuntime);
  #endif
  }
  
-@@ -960,7 +909,7 @@ XPCJSRuntime::SyncXPCContextList(JSConte
+@@ -947,7 +896,7 @@ XPCJSRuntime::SyncXPCContextList(JSConte
  
      // add XPCContexts that represent any JSContexts we have not seen before
      JSContext *cur, *iter = nsnull;
 -    while(nsnull != (cur = JS_ContextIterator(mJSRuntime, &iter)))
 +    while(nsnull != (cur = JS_ContextIterator(gJSRuntime, &iter)))
      {
          XPCContext* xpcc = mContextMap->Find(cur);
  
-@@ -1098,7 +1047,7 @@ XPCJSRuntime::DebugDump(PRInt16 depth)
+@@ -1081,7 +1030,7 @@ XPCJSRuntime::DebugDump(PRInt16 depth)
      XPC_LOG_ALWAYS(("XPCJSRuntime @ %x", this));
          XPC_LOG_INDENT();
          XPC_LOG_ALWAYS(("mXPConnect @ %x", mXPConnect));
 -        XPC_LOG_ALWAYS(("mJSRuntime @ %x", mJSRuntime));
 +        XPC_LOG_ALWAYS(("gJSRuntime @ %x", gJSRuntime));
          XPC_LOG_ALWAYS(("mMapLock @ %x", mMapLock));
          XPC_LOG_ALWAYS(("mJSRuntimeService @ %x", mJSRuntimeService));
  
@@ -2590,54 +2592,54 @@ diff --git a/js/src/xpconnect/src/xpcpri
      static XPCJSRuntime* newXPCJSRuntime(nsXPConnect* aXPConnect,
                                           nsIJSRuntimeService* aJSRuntimeService);
  
 -    JSRuntime*     GetJSRuntime() const {return mJSRuntime;}
 +    static JSRuntime* GetJSRuntime() {return gJSRuntime;}
      nsXPConnect*   GetXPConnect() const {return mXPConnect;}
  
      nsIJSRuntimeService* GetJSRuntimeService() const {return mJSRuntimeService;}
-@@ -666,9 +667,6 @@ public:
+@@ -663,9 +664,6 @@ public:
          return mStrings[index];
      }
  
 -    static void JS_DLL_CALLBACK TraceJS(JSTracer* trc, void* data);
 -    void TraceXPConnectRoots(JSTracer *trc);
 -
      static JSBool JS_DLL_CALLBACK GCCallback(JSContext *cx, JSGCStatus status);
  
      inline void AddVariantRoot(XPCTraceableVariant* variant);
-@@ -715,7 +713,6 @@ private:
+@@ -712,7 +710,6 @@ private:
      jsval mStrJSVals[IDX_TOTAL_COUNT];
  
      nsXPConnect* mXPConnect;
 -    JSRuntime*  mJSRuntime;
      nsIJSRuntimeService* mJSRuntimeService; // hold this to hold the JSRuntime
      JSContext2XPCContextMap* mContextMap;
      JSObject2WrappedJSMap*   mWrappedJSMap;
-@@ -1139,9 +1136,6 @@ public:
+@@ -1135,9 +1132,6 @@ public:
  
      static void
      SystemIsBeingShutDown(JSContext* cx);
 -
 -    static void
 -    TraceJS(JSTracer* trc, XPCJSRuntime* rt);
  
      static void
      FinishedMarkPhaseOfGC(JSContext* cx, XPCJSRuntime* rt);
-@@ -2128,8 +2122,6 @@ public:
+@@ -2124,8 +2118,6 @@ public:
                          nsIClassInfo* classInfo,
                          XPCNativeScriptableCreateInfo* sciProto);
  
 -    JSBool HasExternalReference() const {return mRefCnt > 1;}
 -
      JSObject* GetWrapper()              { return mWrapper; }
      void      SetWrapper(JSObject *obj) { mWrapper = obj; }
  
-@@ -2359,21 +2351,8 @@ public:
+@@ -2355,21 +2347,8 @@ public:
      JSBool IsValid() const {return mJSObj != nsnull;}
      void SystemIsBeingShutDown(JSRuntime* rt);
  
 -    // This is used by XPCJSRuntime::GCCallback to find wrappers that no
 -    // longer root their JSObject and are only still alive because they
 -    // were being used via nsSupportsWeakReference at the time when their
 -    // last (outside) reference was released. Wrappers that fit into that
 -    // category are only deleted when we see that their corresponding JSObject
@@ -2649,25 +2651,25 @@ diff --git a/js/src/xpconnect/src/xpcpri
 -
 -    void TraceJS(JSTracer* trc);
 -#ifdef DEBUG
 -    static void PrintTraceName(JSTracer* trc, char *buf, size_t bufsize);
 -#endif
  
      virtual ~nsXPCWrappedJS();
  protected:
-@@ -3044,7 +3023,6 @@ public:
+@@ -3040,7 +3019,6 @@ public:
      static nsXPCThreadJSContextStackImpl* GetSingleton();
  
      static void InitStatics() { gXPCThreadJSContextStack = nsnull; }
 -    static void FreeSingleton();
  
      nsXPCThreadJSContextStackImpl();
      virtual ~nsXPCThreadJSContextStackImpl();
-@@ -3122,12 +3100,11 @@ class nsJSRuntimeServiceImpl : public ns
+@@ -3118,12 +3096,11 @@ class nsJSRuntimeServiceImpl : public ns
  
      static void FreeSingleton();
  
 -    nsJSRuntimeServiceImpl();
 -    virtual ~nsJSRuntimeServiceImpl();
 +    nsJSRuntimeServiceImpl() {}
 +    ~nsJSRuntimeServiceImpl() {}
  
@@ -2758,20 +2760,21 @@ diff --git a/js/src/xpconnect/src/xpcthr
 -}
 -
  /* readonly attribute PRInt32 Count; */
  NS_IMETHODIMP
  nsXPCThreadJSContextStackImpl::GetCount(PRInt32 *aCount)
 diff --git a/js/src/xpconnect/src/xpcwrappedjs.cpp b/js/src/xpconnect/src/xpcwrappedjs.cpp
 --- a/js/src/xpconnect/src/xpcwrappedjs.cpp
 +++ b/js/src/xpconnect/src/xpcwrappedjs.cpp
-@@ -97,91 +97,6 @@ nsXPCWrappedJS::QueryInterface(REFNSIID 
+@@ -96,91 +96,6 @@ nsXPCWrappedJS::QueryInterface(REFNSIID 
+ 
      return mClass->DelegatedQueryInterface(this, aIID, aInstancePtr);
  }
- 
+-
 -
 -// Refcounting is now similar to that used in the chained (pre-flattening)
 -// wrappednative system.
 -//
 -// We are now holding an extra refcount for nsISupportsWeakReference support.
 -//
 -// Non-root wrappers remove themselves from the chain in their destructors.
 -// We root the JSObject as the refcount transitions from 1->2. And we unroot
@@ -2846,40 +2849,39 @@ diff --git a/js/src/xpconnect/src/xpcwra
 -nsXPCWrappedJS::PrintTraceName(JSTracer* trc, char *buf, size_t bufsize)
 -{
 -    const nsXPCWrappedJS* self = static_cast<const nsXPCWrappedJS*>
 -                                            (trc->debugPrintArg);
 -    JS_snprintf(buf, bufsize, "nsXPCWrappedJS[%s,0x%p].mJSObj",
 -                self->GetClass()->GetInterfaceName(), self);
 -}
 -#endif
--
+ 
  NS_IMETHODIMP
  nsXPCWrappedJS::GetWeakReference(nsIWeakReference** aInstancePtr)
- {
-@@ -353,19 +268,6 @@ nsXPCWrappedJS::nsXPCWrappedJS(XPCCallCo
+@@ -352,19 +267,6 @@ nsXPCWrappedJS::nsXPCWrappedJS(XPCCallCo
+ }
  
  nsXPCWrappedJS::~nsXPCWrappedJS()
- {
+-{
 -    NS_PRECONDITION(0 == mRefCnt, "refcounting error");
 -
 -    if(mRoot == this)
 -    {
 -        // Let the nsWeakReference object (if present) know of our demise.
 -        ClearWeakReferences();
 -    }
 -    Unlink();
 -}
 -
 -void
 -nsXPCWrappedJS::Unlink()
--{
+ {
      XPCJSRuntime* rt = nsXPConnect::GetRuntime();
      if(mRoot == this)
-     {
 @@ -537,7 +439,7 @@ nsXPCWrappedJS::DebugDump(PRInt16 depth)
  nsXPCWrappedJS::DebugDump(PRInt16 depth)
  {
  #ifdef DEBUG
 -    XPC_LOG_ALWAYS(("nsXPCWrappedJS @ %x with mRefCnt = %d", this, mRefCnt.get()));
 +    XPC_LOG_ALWAYS(("nsXPCWrappedJS @ %x", this));
          XPC_LOG_INDENT();
  
@@ -3022,52 +3024,52 @@ diff --git a/layout/generic/nsGfxScrollF
 -nsHTMLScrollFrame::Release(void)
 -{
 -    return NS_OK;
 -}
 -
  #ifdef NS_DEBUG
  NS_IMETHODIMP
  nsHTMLScrollFrame::GetFrameName(nsAString& aResult) const
-@@ -1170,18 +1158,6 @@ nsXULScrollFrame::GetMinWidth(nsIRenderi
-   return 0;
+@@ -1171,18 +1159,6 @@ nsXULScrollFrame::GetMinWidth(nsIRenderi
  }
  #endif
--
+ 
 -NS_IMETHODIMP_(nsrefcnt) 
 -nsXULScrollFrame::AddRef(void)
 -{
 -  return NS_OK;
 -}
 -
 -NS_IMETHODIMP_(nsrefcnt)
 -nsXULScrollFrame::Release(void)
 -{
 -    return NS_OK;
 -}
- 
+-
  #ifdef NS_DEBUG
  NS_IMETHODIMP
-@@ -1256,16 +1232,6 @@ nsGfxScrollFrameInner::~nsGfxScrollFrame
- {
- }
- 
+ nsXULScrollFrame::GetFrameName(nsAString& aResult) const
+@@ -1254,16 +1230,6 @@ nsGfxScrollFrameInner::nsGfxScrollFrameI
+ 
+ nsGfxScrollFrameInner::~nsGfxScrollFrameInner()
+ {
+-}
+-
 -NS_IMETHODIMP_(nsrefcnt) nsGfxScrollFrameInner::AddRef(void)
 -{
 -  return 2;
 -}
 -
 -NS_IMETHODIMP_(nsrefcnt) nsGfxScrollFrameInner::Release(void)
 -{
 -  return 1;
--}
--
+ }
+ 
  NS_IMPL_QUERY_INTERFACE1(nsGfxScrollFrameInner, nsIScrollPositionListener)
- 
- nsresult
 diff --git a/layout/generic/nsGfxScrollFrame.h b/layout/generic/nsGfxScrollFrame.h
 --- a/layout/generic/nsGfxScrollFrame.h
 +++ b/layout/generic/nsGfxScrollFrame.h
 @@ -65,8 +65,6 @@ class nsGfxScrollFrameInner : public nsI
                                public nsIReflowCallback {
  public:
    NS_IMETHOD QueryInterface(REFNSIID aIID, void** aInstancePtr);
 -  NS_IMETHOD_(nsrefcnt) AddRef(void);
@@ -3253,31 +3255,30 @@ diff --git a/layout/style/nsComputedDOMS
  nsresult
  NS_NewComputedDOMStyle(nsIComputedDOMStyle** aComputedStyle)
  {
    NS_ENSURE_ARG_POINTER(aComputedStyle);
  
 -  if (sCachedComputedDOMStyle) {
 -    // There's an unused nsComputedDOMStyle cached, use it.
 -    // But before we use it, re-initialize the object.
--
++  // No nsComputedDOMStyle cached, create a new one.
+ 
 -    // Oh yeah baby, placement new!
 -    *aComputedStyle = new (sCachedComputedDOMStyle) nsComputedDOMStyle();
 -
 -    sCachedComputedDOMStyle = nsnull;
 -  } else {
 -    // No nsComputedDOMStyle cached, create a new one.
 -
 -    *aComputedStyle = new nsComputedDOMStyle();
 -    NS_ENSURE_TRUE(*aComputedStyle, NS_ERROR_OUT_OF_MEMORY);
 -  }
 -
 -  NS_ADDREF(*aComputedStyle);
-+  // No nsComputedDOMStyle cached, create a new one.
-+
 +  *aComputedStyle = new nsComputedDOMStyle();
 +  NS_ENSURE_TRUE(*aComputedStyle, NS_ERROR_OUT_OF_MEMORY);
  
    return NS_OK;
  }
 @@ -129,12 +115,6 @@ void
  void
  nsComputedDOMStyle::Shutdown()
@@ -3352,35 +3353,35 @@ diff --git a/layout/style/nsDOMCSSAttrDe
 -  NS_DECL_OWNINGTHREAD
 -
    nsIContent *mContent;
  };
  
 diff --git a/layout/style/nsDOMCSSDeclaration.cpp b/layout/style/nsDOMCSSDeclaration.cpp
 --- a/layout/style/nsDOMCSSDeclaration.cpp
 +++ b/layout/style/nsDOMCSSDeclaration.cpp
-@@ -356,18 +356,6 @@ CSS2PropertiesTearoff::CSS2PropertiesTea
- 
- CSS2PropertiesTearoff::~CSS2PropertiesTearoff()
- {
--}
--
+@@ -358,18 +358,6 @@ CSS2PropertiesTearoff::~CSS2PropertiesTe
+ {
+ }
+ 
 -NS_IMETHODIMP_(nsrefcnt)
 -CSS2PropertiesTearoff::AddRef(void)
 -{
 -  return mOuter->AddRef();
 -}
 -
 -NS_IMETHODIMP_(nsrefcnt)
 -CSS2PropertiesTearoff::Release(void)
 -{
 -  return mOuter->Release();
- }
- 
+-}
+-
  NS_IMETHODIMP
+ CSS2PropertiesTearoff::QueryInterface(REFNSIID aIID, void** aInstancePtr)
+ {
 diff --git a/layout/style/nsDOMCSSDeclaration.h b/layout/style/nsDOMCSSDeclaration.h
 --- a/layout/style/nsDOMCSSDeclaration.h
 +++ b/layout/style/nsDOMCSSDeclaration.h
 @@ -64,7 +64,7 @@ private:
    nsICSSDeclaration* mOuter;
  };
  
 -class nsDOMCSSDeclaration : public nsICSSDeclaration
@@ -3451,36 +3452,36 @@ diff --git a/layout/xul/base/src/nsDocEl
 -}
 -
  NS_INTERFACE_MAP_BEGIN(nsDocElementBoxFrame)
    NS_INTERFACE_MAP_ENTRY(nsIAnonymousContentCreator)
  NS_INTERFACE_MAP_END_INHERITING(nsBoxFrame)
 diff --git a/layout/xul/base/src/nsListBoxBodyFrame.cpp b/layout/xul/base/src/nsListBoxBodyFrame.cpp
 --- a/layout/xul/base/src/nsListBoxBodyFrame.cpp
 +++ b/layout/xul/base/src/nsListBoxBodyFrame.cpp
-@@ -206,20 +206,6 @@ nsListBoxBodyFrame::~nsListBoxBodyFrame(
- 
- }
- 
+@@ -204,20 +204,6 @@ nsListBoxBodyFrame::~nsListBoxBodyFrame(
+   mAutoScrollTimer = nsnull;
+ #endif
+ 
+-}
+-
 -////////// nsISupports /////////////////
 -
 -NS_IMETHODIMP_(nsrefcnt) 
 -nsListBoxBodyFrame::AddRef(void)
 -{
 -  return 2;
 -}
 -
 -NS_IMETHODIMP_(nsrefcnt)
 -nsListBoxBodyFrame::Release(void)
 -{
 -  return 1;
--}
--
- //
- // QueryInterface
+ }
+ 
  //
 diff --git a/layout/xul/base/src/nsListItemFrame.cpp b/layout/xul/base/src/nsListItemFrame.cpp
 --- a/layout/xul/base/src/nsListItemFrame.cpp
 +++ b/layout/xul/base/src/nsListItemFrame.cpp
 @@ -43,18 +43,6 @@
  #include "nsINameSpaceManager.h" 
  #include "nsGkAtoms.h"
  #include "nsDisplayList.h"
@@ -3497,34 +3498,34 @@ diff --git a/layout/xul/base/src/nsListI
 -  return NS_OK;
 -}
  
  NS_INTERFACE_MAP_BEGIN(nsListItemFrame)
  NS_INTERFACE_MAP_END_INHERITING(nsGridRowLeafFrame)
 diff --git a/layout/xul/base/src/nsMenuFrame.cpp b/layout/xul/base/src/nsMenuFrame.cpp
 --- a/layout/xul/base/src/nsMenuFrame.cpp
 +++ b/layout/xul/base/src/nsMenuFrame.cpp
-@@ -167,18 +167,6 @@ NS_NewMenuFrame(nsIPresShell* aPresShell
+@@ -165,18 +165,6 @@ NS_NewMenuFrame(nsIPresShell* aPresShell
+     it->SetIsMenu(PR_TRUE);
+ 
    return it;
- }
- 
+-}
+-
 -NS_IMETHODIMP_(nsrefcnt) 
 -nsMenuFrame::AddRef(void)
 -{
 -  return NS_OK;
 -}
 -