This is the state where nuker is dying. Saving it for Taras' sanity and love.
authorBenjamin Smedberg <benjamin@smedbergs.us>
Sat, 26 Jul 2008 04:04:02 -0400
changeset 165 aef82785a230
parent 164 fa6388d0a0da
child 166 b62b37ca56a0
push id38
push userbsmedberg@mozilla.com
push dateSat, 26 Jul 2008 08:06:05 +0000
This is the state where nuker is dying. Saving it for Taras' sanity and love.
automatic-garburator
automatic-nuker
generate-automatic-patches.py
series
new file mode 100644
--- /dev/null
+++ b/automatic-garburator
@@ -0,0 +1,160170 @@
+Automatically generated patch: convert stack nsCOMPtrs to raw pointers
+
+diff --git a/accessible/src/atk/nsAccessibleWrap.cpp b/accessible/src/atk/nsAccessibleWrap.cpp
+--- a/accessible/src/atk/nsAccessibleWrap.cpp
++++ b/accessible/src/atk/nsAccessibleWrap.cpp
+@@ -430,74 +430,74 @@ nsAccessibleWrap::CreateMaiInterfaces(vo
+     }
+ 
+     //nsIAccessibleText
+-    nsCOMPtr<nsIAccessibleText> accessInterfaceText;
++    nsIAccessibleText* accessInterfaceText = nsnull;
+     QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                   getter_AddRefs(accessInterfaceText));
++                   (void**)&accessInterfaceText);
+     if (accessInterfaceText) {
+         interfacesBits |= 1 << MAI_INTERFACE_TEXT;
+     }
+ 
+     //nsIAccessibleEditableText
+-    nsCOMPtr<nsIAccessibleEditableText> accessInterfaceEditableText;
++    nsIAccessibleEditableText* accessInterfaceEditableText = nsnull;
+     QueryInterface(NS_GET_IID(nsIAccessibleEditableText),
+-                   getter_AddRefs(accessInterfaceEditableText));
++                   (void**)&accessInterfaceEditableText);
+     if (accessInterfaceEditableText) {
+         interfacesBits |= 1 << MAI_INTERFACE_EDITABLE_TEXT;
+     }
+ 
+     //nsIAccessibleValue
+-    nsCOMPtr<nsIAccessibleValue> accessInterfaceValue;
++    nsIAccessibleValue* accessInterfaceValue = nsnull;
+     QueryInterface(NS_GET_IID(nsIAccessibleValue),
+-                   getter_AddRefs(accessInterfaceValue));
++                   (void**)&accessInterfaceValue);
+     if (accessInterfaceValue) {
+        interfacesBits |= 1 << MAI_INTERFACE_VALUE; 
+     }
+ 
+     //nsIAccessibleDocument
+-    nsCOMPtr<nsIAccessibleDocument> accessInterfaceDocument;
++    nsIAccessibleDocument* accessInterfaceDocument = nsnull;
+     QueryInterface(NS_GET_IID(nsIAccessibleDocument),
+-                              getter_AddRefs(accessInterfaceDocument));
++                              (void**)&accessInterfaceDocument);
+     if (accessInterfaceDocument) {
+         interfacesBits |= 1 << MAI_INTERFACE_DOCUMENT;
+     }
+ 
+     //nsIAccessibleImage
+-    nsCOMPtr<nsIAccessibleImage> accessInterfaceImage;
++    nsIAccessibleImage* accessInterfaceImage = nsnull;
+     QueryInterface(NS_GET_IID(nsIAccessibleImage),
+-                              getter_AddRefs(accessInterfaceImage));
++                              (void**)&accessInterfaceImage);
+     if (accessInterfaceImage) {
+         interfacesBits |= 1 << MAI_INTERFACE_IMAGE;
+     }
+ 
+     //nsIAccessibleHyperLink
+-    nsCOMPtr<nsIAccessibleHyperLink> accessInterfaceHyperlink;
++    nsIAccessibleHyperLink* accessInterfaceHyperlink = nsnull;
+     QueryInterface(NS_GET_IID(nsIAccessibleHyperLink),
+-                   getter_AddRefs(accessInterfaceHyperlink));
++                   (void**)&accessInterfaceHyperlink);
+     if (accessInterfaceHyperlink) {
+        interfacesBits |= 1 << MAI_INTERFACE_HYPERLINK_IMPL;
+     }
+ 
+     if (!MustPrune(this)) {  // These interfaces require children
+       //nsIAccessibleHypertext
+-      nsCOMPtr<nsIAccessibleHyperText> accessInterfaceHypertext;
++      nsIAccessibleHyperText* accessInterfaceHypertext = nsnull;
+       QueryInterface(NS_GET_IID(nsIAccessibleHyperText),
+-                     getter_AddRefs(accessInterfaceHypertext));
++                     (void**)&accessInterfaceHypertext);
+       if (accessInterfaceHypertext) {
+           interfacesBits |= 1 << MAI_INTERFACE_HYPERTEXT;
+       }
+ 
+       //nsIAccessibleTable
+-      nsCOMPtr<nsIAccessibleTable> accessInterfaceTable;
++      nsIAccessibleTable* accessInterfaceTable = nsnull;
+       QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                     getter_AddRefs(accessInterfaceTable));
++                     (void**)&accessInterfaceTable);
+       if (accessInterfaceTable) {
+           interfacesBits |= 1 << MAI_INTERFACE_TABLE;
+       }
+       
+       //nsIAccessibleSelection
+-      nsCOMPtr<nsIAccessibleSelectable> accessInterfaceSelection;
++      nsIAccessibleSelectable* accessInterfaceSelection = nsnull;
+       QueryInterface(NS_GET_IID(nsIAccessibleSelectable),
+-                     getter_AddRefs(accessInterfaceSelection));
++                     (void**)&accessInterfaceSelection);
+       if (accessInterfaceSelection) {
+           interfacesBits |= 1 << MAI_INTERFACE_SELECTION;
+       }
+@@ -790,8 +790,8 @@ GetAttributeSet(nsIAccessible* aAccessib
+ GetAttributeSet(nsIAccessible* aAccessible)
+ {
+     AtkAttributeSet *objAttributeSet = nsnull;
+-    nsCOMPtr<nsIPersistentProperties> attributes;
+-    aAccessible->GetAttributes(getter_AddRefs(attributes));
++    nsIPersistentProperties* attributes = nsnull;
++    aAccessible->GetAttributes(&attributes);
+     
+     if (attributes) {
+         // Deal with attributes that we only need to expose in ATK
+@@ -804,15 +804,15 @@ GetAttributeSet(nsIAccessible* aAccessib
+                                         oldValueUnused);
+         }
+ 
+-        nsCOMPtr<nsISimpleEnumerator> propEnum;
+-        nsresult rv = attributes->Enumerate(getter_AddRefs(propEnum));
++        nsISimpleEnumerator* propEnum = nsnull;
++        nsresult rv = attributes->Enumerate(&propEnum);
+         NS_ENSURE_SUCCESS(rv, nsnull);
+ 
+         PRBool hasMore;
+         while (NS_SUCCEEDED(propEnum->HasMoreElements(&hasMore)) && hasMore) {
+-            nsCOMPtr<nsISupports> sup;
+-            rv = propEnum->GetNext(getter_AddRefs(sup));
+-            nsCOMPtr<nsIPropertyElement> propElem(do_QueryInterface(sup));
++            nsISupports* sup = nsnull;
++            rv = propEnum->GetNext(&sup);
++            nsIPropertyElement* propElem(do_QueryInterface(sup));
+             NS_ENSURE_TRUE(propElem, nsnull);
+ 
+             nsCAutoString name;
+@@ -850,8 +850,8 @@ getParentCB(AtkObject *aAtkObj)
+             return nsnull;
+         }
+ 
+-        nsCOMPtr<nsIAccessible> accParent;
+-        nsresult rv = accWrap->GetParent(getter_AddRefs(accParent));
++        nsIAccessible* accParent = nsnull;
++        nsresult rv = accWrap->GetParent(&accParent);
+         if (NS_FAILED(rv) || !accParent)
+             return nsnull;
+ 
+@@ -870,15 +870,15 @@ getChildCountCB(AtkObject *aAtkObj)
+     }
+ 
+     PRInt32 count = 0;
+-    nsCOMPtr<nsIAccessibleHyperText> hyperText;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleHyperText), getter_AddRefs(hyperText));
++    nsIAccessibleHyperText* hyperText = nsnull;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleHyperText), (void**)&hyperText);
+     if (hyperText) {
+         // If HyperText, then number of links matches number of children
+         hyperText->GetLinkCount(&count);
+     }
+     else {
+-        nsCOMPtr<nsIAccessibleText> accText;
+-        accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText), getter_AddRefs(accText));
++        nsIAccessibleText* accText = nsnull;
++        accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText), (void**)&accText);
+         if (!accText) {    // Accessible text that is not a HyperText has no children
+             accWrap->GetChildCount(&count);
+         }
+@@ -903,20 +903,20 @@ refChildCB(AtkObject *aAtkObj, gint aChi
+         return nsnull;
+     }
+ 
+-    nsCOMPtr<nsIAccessible> accChild;
+-    nsCOMPtr<nsIAccessibleHyperText> hyperText;
+-    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleHyperText), getter_AddRefs(hyperText));
++    nsIAccessible* accChild = nsnull;
++    nsIAccessibleHyperText* hyperText = nsnull;
++    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleHyperText), (void**)&hyperText);
+     if (hyperText) {
+         // If HyperText, then number of links matches number of children
+-        nsCOMPtr<nsIAccessibleHyperLink> hyperLink;
+-        hyperText->GetLink(aChildIndex, getter_AddRefs(hyperLink));
++        nsIAccessibleHyperLink* hyperLink = nsnull;
++        hyperText->GetLink(aChildIndex, &hyperLink);
+         accChild = do_QueryInterface(hyperLink);
+     }
+     else {
+-        nsCOMPtr<nsIAccessibleText> accText;
+-        accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText), getter_AddRefs(accText));
++        nsIAccessibleText* accText = nsnull;
++        accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText), (void**)&accText);
+         if (!accText) {  // Accessible Text that is not HyperText has no children
+-            accWrap->GetChildAt(aChildIndex, getter_AddRefs(accChild));
++            accWrap->GetChildAt(aChildIndex, &accChild);
+         }
+     }
+ 
+@@ -945,14 +945,14 @@ getIndexInParentCB(AtkObject *aAtkObj)
+         return -1;
+     }
+ 
+-    nsCOMPtr<nsIAccessible> parent;
+-    accWrap->GetParent(getter_AddRefs(parent));
++    nsIAccessible* parent = nsnull;
++    accWrap->GetParent(&parent);
+     if (!parent) {
+         return -1; // No parent
+     }
+ 
+-    nsCOMPtr<nsIAccessible> sibling;
+-    parent->GetFirstChild(getter_AddRefs(sibling));
++    nsIAccessible* sibling = nsnull;
++    parent->GetFirstChild(&sibling);
+     if (!sibling) {
+         return -1;  // Error, parent has no children
+     }
+@@ -969,9 +969,9 @@ getIndexInParentCB(AtkObject *aAtkObj)
+         ++ currentIndex;
+       }
+ 
+-      nsCOMPtr<nsIAccessible> tempAccessible;
+-      sibling->GetNextSibling(getter_AddRefs(tempAccessible));
+-      sibling.swap(tempAccessible);
++      nsIAccessible* tempAccessible = nsnull;
++      sibling->GetNextSibling(&tempAccessible);
++      swap(sibling, tempAccessible);
+     }
+ 
+     return currentIndex;
+@@ -1085,10 +1085,10 @@ nsAccessibleWrap *GetAccessibleWrap(AtkO
+ 
+     NS_ENSURE_TRUE(tmpAccWrap->GetAtkObject() == aAtkObj, nsnull);
+ 
+-    nsRefPtr<nsApplicationAccessibleWrap> appAccWrap =
++    nsApplicationAccessibleWrap* appAccWrap =
+         nsAccessNode::GetApplicationAccessible();
+     nsAccessibleWrap* tmpAppAccWrap =
+-        static_cast<nsAccessibleWrap*>(appAccWrap.get());
++        static_cast<nsAccessibleWrap*>(appAccWrap);
+ 
+     if (tmpAppAccWrap != tmpAccWrap && !tmpAccWrap->IsValidObject())
+         return nsnull;
+@@ -1108,8 +1108,8 @@ nsresult
+ nsresult
+ nsAccessibleWrap::FirePlatformEvent(nsIAccessibleEvent *aEvent)
+ {
+-    nsCOMPtr<nsIAccessible> accessible;
+-    aEvent->GetAccessible(getter_AddRefs(accessible));
++    nsIAccessible* accessible = nsnull;
++    aEvent->GetAccessible(&accessible);
+     NS_ENSURE_TRUE(accessible, NS_ERROR_FAILURE);
+ 
+     PRUint32 type = 0;
+@@ -1145,11 +1145,11 @@ nsAccessibleWrap::FirePlatformEvent(nsIA
+     case nsIAccessibleEvent::EVENT_FOCUS:
+       {
+         MAI_LOG_DEBUG(("\n\nReceived: EVENT_FOCUS\n"));
+-        nsRefPtr<nsRootAccessible> rootAccWrap = accWrap->GetRootAccessible();
++        nsRootAccessible* rootAccWrap = accWrap->GetRootAccessible();
+         if (rootAccWrap && rootAccWrap->mActivated) {
+             atk_focus_tracker_notify(atkObj);
+             // Fire state change event for focus
+-            nsCOMPtr<nsIAccessibleStateChangeEvent> stateChangeEvent =
++            nsIAccessibleStateChangeEvent* stateChangeEvent =
+               new nsAccStateChangeEvent(accessible,
+                                         nsIAccessibleStates::STATE_FOCUSED,
+                                         PR_FALSE, PR_TRUE);
+@@ -1160,7 +1160,7 @@ nsAccessibleWrap::FirePlatformEvent(nsIA
+     case nsIAccessibleEvent::EVENT_VALUE_CHANGE:
+       {
+         MAI_LOG_DEBUG(("\n\nReceived: EVENT_VALUE_CHANGE\n"));
+-        nsCOMPtr<nsIAccessibleValue> value(do_QueryInterface(accessible));
++        nsIAccessibleValue* value(do_QueryInterface(accessible));
+         if (value) {    // Make sure this is a numeric value
+             // Don't fire for MSAA string value changes (e.g. text editing)
+             // ATK values are always numeric
+@@ -1182,7 +1182,7 @@ nsAccessibleWrap::FirePlatformEvent(nsIA
+       {
+         MAI_LOG_DEBUG(("\n\nReceived: EVENT_TEXT_CARET_MOVED\n"));
+ 
+-        nsCOMPtr<nsIAccessibleCaretMoveEvent> caretMoveEvent(do_QueryInterface(aEvent));
++        nsIAccessibleCaretMoveEvent* caretMoveEvent(do_QueryInterface(aEvent));
+         NS_ASSERTION(caretMoveEvent, "Event needs event data");
+         if (!caretMoveEvent)
+             break;
+@@ -1205,7 +1205,7 @@ nsAccessibleWrap::FirePlatformEvent(nsIA
+     case nsIAccessibleEvent::EVENT_TABLE_ROW_INSERT:
+       {
+         MAI_LOG_DEBUG(("\n\nReceived: EVENT_TABLE_ROW_INSERT\n"));
+-        nsCOMPtr<nsIAccessibleTableChangeEvent> tableEvent = do_QueryInterface(aEvent);
++        nsIAccessibleTableChangeEvent* tableEvent = do_QueryInterface(aEvent);
+         NS_ENSURE_TRUE(tableEvent, NS_ERROR_FAILURE);
+ 
+         PRInt32 rowIndex, numRows;
+@@ -1223,7 +1223,7 @@ nsAccessibleWrap::FirePlatformEvent(nsIA
+    case nsIAccessibleEvent::EVENT_TABLE_ROW_DELETE:
+      {
+         MAI_LOG_DEBUG(("\n\nReceived: EVENT_TABLE_ROW_DELETE\n"));
+-        nsCOMPtr<nsIAccessibleTableChangeEvent> tableEvent = do_QueryInterface(aEvent);
++        nsIAccessibleTableChangeEvent* tableEvent = do_QueryInterface(aEvent);
+         NS_ENSURE_TRUE(tableEvent, NS_ERROR_FAILURE);
+ 
+         PRInt32 rowIndex, numRows;
+@@ -1248,7 +1248,7 @@ nsAccessibleWrap::FirePlatformEvent(nsIA
+     case nsIAccessibleEvent::EVENT_TABLE_COLUMN_INSERT:
+       {
+         MAI_LOG_DEBUG(("\n\nReceived: EVENT_TABLE_COLUMN_INSERT\n"));
+-        nsCOMPtr<nsIAccessibleTableChangeEvent> tableEvent = do_QueryInterface(aEvent);
++        nsIAccessibleTableChangeEvent* tableEvent = do_QueryInterface(aEvent);
+         NS_ENSURE_TRUE(tableEvent, NS_ERROR_FAILURE);
+ 
+         PRInt32 colIndex, numCols;
+@@ -1266,7 +1266,7 @@ nsAccessibleWrap::FirePlatformEvent(nsIA
+     case nsIAccessibleEvent::EVENT_TABLE_COLUMN_DELETE:
+       {
+         MAI_LOG_DEBUG(("\n\nReceived: EVENT_TABLE_COLUMN_DELETE\n"));
+-        nsCOMPtr<nsIAccessibleTableChangeEvent> tableEvent = do_QueryInterface(aEvent);
++        nsIAccessibleTableChangeEvent* tableEvent = do_QueryInterface(aEvent);
+         NS_ENSURE_TRUE(tableEvent, NS_ERROR_FAILURE);
+ 
+         PRInt32 colIndex, numCols;
+@@ -1317,7 +1317,7 @@ nsAccessibleWrap::FirePlatformEvent(nsIA
+       {
+         MAI_LOG_DEBUG(("\n\nReceived: EVENT_WINDOW_ACTIVATED\n"));
+         nsRootAccessible *rootAcc =
+-          static_cast<nsRootAccessible *>(accessible.get());
++          static_cast<nsRootAccessible *>(accessible);
+         rootAcc->mActivated = PR_TRUE;
+         guint id = g_signal_lookup ("activate", MAI_TYPE_ATK_OBJECT);
+         g_signal_emit(atkObj, id, 0);
+@@ -1330,7 +1330,7 @@ nsAccessibleWrap::FirePlatformEvent(nsIA
+       {
+         MAI_LOG_DEBUG(("\n\nReceived: EVENT_WINDOW_DEACTIVATED\n"));
+         nsRootAccessible *rootAcc =
+-          static_cast<nsRootAccessible *>(accessible.get());
++          static_cast<nsRootAccessible *>(accessible);
+         rootAcc->mActivated = PR_FALSE;
+         guint id = g_signal_lookup ("deactivate", MAI_TYPE_ATK_OBJECT);
+         g_signal_emit(atkObj, id, 0);
+@@ -1377,7 +1377,7 @@ nsAccessibleWrap::FireAtkStateChangeEven
+ {
+     MAI_LOG_DEBUG(("\n\nReceived: EVENT_STATE_CHANGE\n"));
+ 
+-    nsCOMPtr<nsIAccessibleStateChangeEvent> event =
++    nsIAccessibleStateChangeEvent* event =
+         do_QueryInterface(aEvent);
+     NS_ENSURE_TRUE(event, NS_ERROR_FAILURE);
+ 
+@@ -1419,7 +1419,7 @@ nsAccessibleWrap::FireAtkTextChangedEven
+ {
+     MAI_LOG_DEBUG(("\n\nReceived: EVENT_TEXT_REMOVED/INSERTED\n"));
+ 
+-    nsCOMPtr<nsIAccessibleTextChangeEvent> event =
++    nsIAccessibleTextChangeEvent* event =
+         do_QueryInterface(aEvent);
+     NS_ENSURE_TRUE(event, NS_ERROR_FAILURE);
+ 
+diff --git a/accessible/src/atk/nsAppRootAccessible.cpp b/accessible/src/atk/nsAppRootAccessible.cpp
+--- a/accessible/src/atk/nsAppRootAccessible.cpp
++++ b/accessible/src/atk/nsAppRootAccessible.cpp
+@@ -435,7 +435,7 @@ AtkObject *
+ AtkObject *
+ mai_util_get_root(void)
+ {
+-    nsRefPtr<nsApplicationAccessibleWrap> root =
++    nsApplicationAccessibleWrap* root =
+         nsAccessNode::GetApplicationAccessible();
+ 
+     if (root)
+@@ -541,7 +541,7 @@ nsApplicationAccessibleWrap::Init()
+     } else {
+         //check gconf-2 setting
+         nsresult rv;
+-        nsCOMPtr<nsIPrefBranch> sysPrefService =
++        nsIPrefBranch* sysPrefService =
+             do_GetService(sSysPrefService, &rv);
+         if (NS_SUCCEEDED(rv) && sysPrefService) {
+             sysPrefService->GetBoolPref(sAccessibilityKey, &isGnomeATEnabled);
+@@ -665,7 +665,7 @@ nsApplicationAccessibleWrap::RemoveRootA
+     nsresult rv = NS_ERROR_FAILURE;
+ 
+     // we must use weak ref to get the index
+-    nsCOMPtr<nsIWeakReference> weakPtr = do_GetWeakReference(aRootAccWrap);
++    nsIWeakReference* weakPtr = do_GetWeakReference(aRootAccWrap);
+     rv = mChildren->IndexOf(0, weakPtr, &index);
+ 
+     AtkObject *atkAccessible = nsAccessibleWrap::GetAtkObject(aRootAccWrap);
+diff --git a/accessible/src/atk/nsMaiHyperlink.cpp b/accessible/src/atk/nsMaiHyperlink.cpp
+--- a/accessible/src/atk/nsMaiHyperlink.cpp
++++ b/accessible/src/atk/nsMaiHyperlink.cpp
+@@ -144,7 +144,7 @@ MaiHyperlink::GetAtkHyperlink(void)
+     if (mMaiAtkHyperlink)
+         return mMaiAtkHyperlink;
+ 
+-    nsCOMPtr<nsIAccessibleHyperLink> accessIf(do_QueryInterface(mHyperlink));
++    nsIAccessibleHyperLink* accessIf(do_QueryInterface(mHyperlink));
+     if (!accessIf)
+         return nsnull;
+ 
+@@ -219,8 +219,8 @@ getUriCB(AtkHyperlink *aLink, gint aLink
+ 
+     MaiAtkHyperlink *maiAtkHyperlink = MAI_ATK_HYPERLINK(aLink);
+ 
+-    nsCOMPtr<nsIURI> uri;
+-    nsresult rv = accHyperlink->GetURI(aLinkIndex,getter_AddRefs(uri));
++    nsIURI* uri = nsnull;
++    nsresult rv = accHyperlink->GetURI(aLinkIndex,&uri);
+     if (NS_FAILED(rv) || !uri)
+         return nsnull;
+     nsCAutoString cautoStr;
+@@ -235,8 +235,8 @@ getObjectCB(AtkHyperlink *aLink, gint aL
+     nsIAccessibleHyperLink *accHyperlink = get_accessible_hyperlink(aLink);
+     NS_ENSURE_TRUE(accHyperlink, nsnull);
+ 
+-    nsCOMPtr<nsIAccessible> accObj;
+-    accHyperlink->GetAnchor(aLinkIndex, getter_AddRefs(accObj));
++    nsIAccessible* accObj = nsnull;
++    accHyperlink->GetAnchor(aLinkIndex, &accObj);
+     NS_ENSURE_TRUE(accObj, nsnull);
+ 
+     AtkObject *atkObj = nsAccessibleWrap::GetAtkObject(accObj);
+diff --git a/accessible/src/atk/nsMaiInterfaceAction.cpp b/accessible/src/atk/nsMaiInterfaceAction.cpp
+--- a/accessible/src/atk/nsMaiInterfaceAction.cpp
++++ b/accessible/src/atk/nsMaiInterfaceAction.cpp
+@@ -119,8 +119,8 @@ getKeyBindingCB(AtkAction *aAction, gint
+     nsresult rv = accWrap->GetKeyboardShortcut(accessKey);
+ 
+     if (NS_SUCCEEDED(rv) && !accessKey.IsEmpty()) {
+-        nsCOMPtr<nsIAccessible> parentAccessible;
+-        accWrap->GetParent(getter_AddRefs(parentAccessible));
++        nsIAccessible* parentAccessible = nsnull;
++        accWrap->GetParent(&parentAccessible);
+         if (parentAccessible) {
+             PRUint32 role;
+             parentAccessible->GetRole(&role);
+@@ -135,7 +135,7 @@ getKeyBindingCB(AtkAction *aAction, gint
+             else if ((role == ATK_ROLE_MENU) || (role == ATK_ROLE_MENU_ITEM)) {
+                 //it is submenu, change from "s" to "s;<Alt>f:s"
+                 nsAutoString allKey = accessKey;
+-                nsCOMPtr<nsIAccessible> grandParentAcc = parentAccessible;
++                nsIAccessible* grandParentAcc = parentAccessible;
+ 
+                 while ((grandParentAcc) && (role != ATK_ROLE_MENU_BAR)) {
+                     nsAutoString grandParentKey;
+@@ -147,8 +147,8 @@ getKeyBindingCB(AtkAction *aAction, gint
+                         allKey = rightChar + NS_LITERAL_STRING(":") + allKey;
+                     }
+ 
+-                    nsCOMPtr<nsIAccessible> tempAcc = grandParentAcc;
+-                    tempAcc->GetParent(getter_AddRefs(grandParentAcc));
++                    nsIAccessible* tempAcc = grandParentAcc;
++                    tempAcc->GetParent(&grandParentAcc);
+                     if (grandParentAcc)
+                         grandParentAcc->GetRole(&role);
+                 }
+@@ -168,8 +168,8 @@ getKeyBindingCB(AtkAction *aAction, gint
+ 
+     //get shortcut
+     nsAutoString subShortcut;
+-    nsCOMPtr<nsIDOMDOMStringList> keyBindings;
+-    rv = accWrap->GetKeyBindings(aActionIndex, getter_AddRefs(keyBindings));
++    nsIDOMDOMStringList* keyBindings = nsnull;
++    rv = accWrap->GetKeyBindings(aActionIndex, &keyBindings);
+ 
+     if (NS_SUCCEEDED(rv) && keyBindings) {
+         PRUint32 length = 0;
+diff --git a/accessible/src/atk/nsMaiInterfaceComponent.cpp b/accessible/src/atk/nsMaiInterfaceComponent.cpp
+--- a/accessible/src/atk/nsMaiInterfaceComponent.cpp
++++ b/accessible/src/atk/nsMaiInterfaceComponent.cpp
+@@ -74,15 +74,15 @@ refAccessibleAtPointCB(AtkComponent *aCo
+ 
+     // nsIAccessible getChildAtPoint (x,y) is in screen pixels.
+     if (aCoordType == ATK_XY_WINDOW) {
+-        nsCOMPtr<nsIDOMNode> domNode;
+-        accWrap->GetDOMNode(getter_AddRefs(domNode));
++        nsIDOMNode* domNode = nsnull;
++        accWrap->GetDOMNode(&domNode);
+         nsIntPoint winCoords = nsAccUtils::GetScreenCoordsForWindow(domNode);
+         aAccX += winCoords.x;
+         aAccY += winCoords.y;
+     }
+ 
+-    nsCOMPtr<nsIAccessible> pointAcc;
+-    accWrap->GetChildAtPoint(aAccX, aAccY, getter_AddRefs(pointAcc));
++    nsIAccessible* pointAcc = nsnull;
++    accWrap->GetChildAtPoint(aAccX, aAccY, &pointAcc);
+     if (!pointAcc) {
+         return nsnull;
+     }
+@@ -115,8 +115,8 @@ getExtentsCB(AtkComponent *aComponent,
+     if (NS_FAILED(rv))
+         return;
+     if (aCoordType == ATK_XY_WINDOW) {
+-        nsCOMPtr<nsIDOMNode> domNode;
+-        accWrap->GetDOMNode(getter_AddRefs(domNode));
++        nsIDOMNode* domNode = nsnull;
++        accWrap->GetDOMNode(&domNode);
+         nsIntPoint winCoords = nsAccUtils::GetScreenCoordsForWindow(domNode);
+         nsAccX -= winCoords.x;
+         nsAccY -= winCoords.y;
+diff --git a/accessible/src/atk/nsMaiInterfaceDocument.cpp b/accessible/src/atk/nsMaiInterfaceDocument.cpp
+--- a/accessible/src/atk/nsMaiInterfaceDocument.cpp
++++ b/accessible/src/atk/nsMaiInterfaceDocument.cpp
+@@ -70,9 +70,9 @@ getDocumentLocaleCB(AtkDocument *aDocume
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessNode> docAccessNode;
++    nsIAccessNode* docAccessNode = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessNode),
+-                            getter_AddRefs(docAccessNode));
++                            (void**)&docAccessNode);
+     NS_ENSURE_TRUE(docAccessNode, nsnull);
+ 
+     nsAutoString locale;
+@@ -90,9 +90,9 @@ getDocumentTypeCB(AtkDocument *aDocument
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleDocument> accDocument;
++    nsIAccessibleDocument* accDocument = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleDocument),
+-                            getter_AddRefs(accDocument));
++                            (void**)&accDocument);
+     NS_ENSURE_TRUE(accDocument, nsnull);
+ 
+     nsAutoString mimeType;
+@@ -118,9 +118,9 @@ getDocumentAttributesCB(AtkDocument *aDo
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleDocument> accDocument;
++    nsIAccessibleDocument* accDocument = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleDocument),
+-                            getter_AddRefs(accDocument));
++                            (void**)&accDocument);
+     NS_ENSURE_TRUE(accDocument, nsnull);
+ 
+     // according to atkobject.h, AtkAttributeSet is a GSList
+@@ -153,9 +153,9 @@ getDocumentAttributeValueCB(AtkDocument 
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleDocument> accDocument;
++    nsIAccessibleDocument* accDocument = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleDocument),
+-                            getter_AddRefs(accDocument));
++                            (void**)&accDocument);
+     NS_ENSURE_TRUE(accDocument, nsnull);
+ 
+     nsresult rv;
+diff --git a/accessible/src/atk/nsMaiInterfaceEditableText.cpp b/accessible/src/atk/nsMaiInterfaceEditableText.cpp
+--- a/accessible/src/atk/nsMaiInterfaceEditableText.cpp
++++ b/accessible/src/atk/nsMaiInterfaceEditableText.cpp
+@@ -68,12 +68,12 @@ setRunAttributesCB(AtkEditableText *aTex
+     if (!accWrap)
+         return FALSE;
+ 
+-    nsCOMPtr<nsIAccessibleEditableText> accText;
++    nsIAccessibleEditableText* accText = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleEditableText),
+-                            getter_AddRefs(accText));
++                            (void**)&accText);
+     NS_ENSURE_TRUE(accText, FALSE);
+ 
+-    nsCOMPtr<nsISupports> attrSet;
++    nsISupports* attrSet = nsnull;
+     /* how to insert attributes into nsISupports ??? */
+ 
+     nsresult rv = accText->SetAttributes(aStartOffset, aEndOffset,
+@@ -88,9 +88,9 @@ setTextContentsCB(AtkEditableText *aText
+     if (!accWrap)
+         return;
+ 
+-    nsCOMPtr<nsIAccessibleEditableText> accText;
++    nsIAccessibleEditableText* accText = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleEditableText),
+-                            getter_AddRefs(accText));
++                            (void**)&accText);
+     if (!accText)
+         return;
+ 
+@@ -108,9 +108,9 @@ insertTextCB(AtkEditableText *aText,
+     if (!accWrap)
+         return;
+ 
+-    nsCOMPtr<nsIAccessibleEditableText> accText;
++    nsIAccessibleEditableText* accText = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleEditableText),
+-                            getter_AddRefs(accText));
++                            (void**)&accText);
+     if (!accText)
+         return;
+ 
+@@ -135,9 +135,9 @@ copyTextCB(AtkEditableText *aText, gint 
+     if (!accWrap)
+         return;
+ 
+-    nsCOMPtr<nsIAccessibleEditableText> accText;
++    nsIAccessibleEditableText* accText = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleEditableText),
+-                            getter_AddRefs(accText));
++                            (void**)&accText);
+     if (!accText)
+         return;
+ 
+@@ -153,9 +153,9 @@ cutTextCB(AtkEditableText *aText, gint a
+     if (!accWrap)
+         return;
+ 
+-    nsCOMPtr<nsIAccessibleEditableText> accText;
++    nsIAccessibleEditableText* accText = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleEditableText),
+-                            getter_AddRefs(accText));
++                            (void**)&accText);
+     if (!accText)
+         return;
+     MAI_LOG_DEBUG(("EditableText: cutTextCB, aStartPos=%d, aEndPos=%d",
+@@ -170,9 +170,9 @@ deleteTextCB(AtkEditableText *aText, gin
+     if (!accWrap)
+         return;
+ 
+-    nsCOMPtr<nsIAccessibleEditableText> accText;
++    nsIAccessibleEditableText* accText = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleEditableText),
+-                            getter_AddRefs(accText));
++                            (void**)&accText);
+     if (!accText)
+         return;
+ 
+@@ -188,9 +188,9 @@ pasteTextCB(AtkEditableText *aText, gint
+     if (!accWrap)
+         return;
+ 
+-    nsCOMPtr<nsIAccessibleEditableText> accText;
++    nsIAccessibleEditableText* accText = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleEditableText),
+-                            getter_AddRefs(accText));
++                            (void**)&accText);
+     if (!accText)
+         return;
+ 
+diff --git a/accessible/src/atk/nsMaiInterfaceHyperlinkImpl.cpp b/accessible/src/atk/nsMaiInterfaceHyperlinkImpl.cpp
+--- a/accessible/src/atk/nsMaiInterfaceHyperlinkImpl.cpp
++++ b/accessible/src/atk/nsMaiInterfaceHyperlinkImpl.cpp
+@@ -56,9 +56,9 @@ getHyperlinkCB(AtkHyperlinkImpl *aImpl)
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleHyperLink> accHyperlink;
++    nsIAccessibleHyperLink* accHyperlink = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleHyperLink),
+-                            getter_AddRefs(accHyperlink));
++                            (void**)&accHyperlink);
+     NS_ENSURE_TRUE(accHyperlink, nsnull);
+     
+     MaiHyperlink *maiHyperlink = accWrap->GetMaiHyperlink();
+diff --git a/accessible/src/atk/nsMaiInterfaceHypertext.cpp b/accessible/src/atk/nsMaiInterfaceHypertext.cpp
+--- a/accessible/src/atk/nsMaiInterfaceHypertext.cpp
++++ b/accessible/src/atk/nsMaiInterfaceHypertext.cpp
+@@ -59,17 +59,17 @@ getLinkCB(AtkHypertext *aText, gint aLin
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleHyperText> hyperText;
++    nsIAccessibleHyperText* hyperText = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleHyperText),
+-                            getter_AddRefs(hyperText));
++                            (void**)&hyperText);
+     NS_ENSURE_TRUE(hyperText, nsnull);
+ 
+-    nsCOMPtr<nsIAccessibleHyperLink> hyperLink;
+-    nsresult rv = hyperText->GetLink(aLinkIndex, getter_AddRefs(hyperLink));
++    nsIAccessibleHyperLink* hyperLink = nsnull;
++    nsresult rv = hyperText->GetLink(aLinkIndex, &hyperLink);
+     if (NS_FAILED(rv) || !hyperLink)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessible> hyperLinkAcc(do_QueryInterface(hyperLink));
++    nsIAccessible* hyperLinkAcc(do_QueryInterface(hyperLink));
+     AtkObject *hyperLinkAtkObj = nsAccessibleWrap::GetAtkObject(hyperLinkAcc);
+     nsAccessibleWrap *accChild = GetAccessibleWrap(hyperLinkAtkObj);
+     NS_ENSURE_TRUE(accChild, nsnull);
+@@ -86,9 +86,9 @@ getLinkCountCB(AtkHypertext *aText)
+     if (!accWrap)
+         return -1;
+ 
+-    nsCOMPtr<nsIAccessibleHyperText> hyperText;
++    nsIAccessibleHyperText* hyperText = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleHyperText),
+-                            getter_AddRefs(hyperText));
++                            (void**)&hyperText);
+     NS_ENSURE_TRUE(hyperText, -1);
+ 
+     PRInt32 count = -1;
+@@ -105,9 +105,9 @@ getLinkIndexCB(AtkHypertext *aText, gint
+     if (!accWrap)
+         return -1;
+ 
+-    nsCOMPtr<nsIAccessibleHyperText> hyperText;
++    nsIAccessibleHyperText* hyperText = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleHyperText),
+-                            getter_AddRefs(hyperText));
++                            (void**)&hyperText);
+     NS_ENSURE_TRUE(hyperText, -1);
+ 
+     PRInt32 index = -1;
+diff --git a/accessible/src/atk/nsMaiInterfaceImage.cpp b/accessible/src/atk/nsMaiInterfaceImage.cpp
+--- a/accessible/src/atk/nsMaiInterfaceImage.cpp
++++ b/accessible/src/atk/nsMaiInterfaceImage.cpp
+@@ -62,9 +62,9 @@ getImagePositionCB(AtkImage *aImage, gin
+     if (!accWrap) 
+       return;
+ 
+-    nsCOMPtr<nsIAccessibleImage> image;
++    nsIAccessibleImage* image = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleImage),
+-                            getter_AddRefs(image));
++                            (void**)&image);
+     if (!image)
+       return;
+ 
+@@ -89,9 +89,9 @@ getImageSizeCB(AtkImage *aImage, gint *a
+     if (!accWrap) 
+       return;
+ 
+-    nsCOMPtr<nsIAccessibleImage> image;
++    nsIAccessibleImage* image = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleImage),
+-                            getter_AddRefs(image));
++                            (void**)&image);
+     if (!image)
+       return;
+ 
+diff --git a/accessible/src/atk/nsMaiInterfaceSelection.cpp b/accessible/src/atk/nsMaiInterfaceSelection.cpp
+--- a/accessible/src/atk/nsMaiInterfaceSelection.cpp
++++ b/accessible/src/atk/nsMaiInterfaceSelection.cpp
+@@ -63,9 +63,9 @@ addSelectionCB(AtkSelection *aSelection,
+     if (!accWrap)
+         return FALSE;
+ 
+-    nsCOMPtr<nsIAccessibleSelectable> accSelection;
++    nsIAccessibleSelectable* accSelection = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleSelectable),
+-                            getter_AddRefs(accSelection));
++                            (void**)&accSelection);
+     NS_ENSURE_TRUE(accSelection, FALSE);
+ 
+     return NS_SUCCEEDED(accSelection->AddChildToSelection(i));
+@@ -78,9 +78,9 @@ clearSelectionCB(AtkSelection *aSelectio
+     if (!accWrap)
+         return FALSE;
+ 
+-    nsCOMPtr<nsIAccessibleSelectable> accSelection;
++    nsIAccessibleSelectable* accSelection = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleSelectable),
+-                            getter_AddRefs(accSelection));
++                            (void**)&accSelection);
+     NS_ENSURE_TRUE(accSelection, FALSE);
+ 
+     return NS_SUCCEEDED(accSelection->ClearSelection());
+@@ -93,13 +93,13 @@ refSelectionCB(AtkSelection *aSelection,
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleSelectable> accSelection;
++    nsIAccessibleSelectable* accSelection = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleSelectable),
+-                            getter_AddRefs(accSelection));
++                            (void**)&accSelection);
+     NS_ENSURE_TRUE(accSelection, nsnull);
+ 
+-    nsCOMPtr<nsIAccessible> accSelect;
+-    accSelection->RefSelection(i, getter_AddRefs(accSelect));
++    nsIAccessible* accSelect = nsnull;
++    accSelection->RefSelection(i, &accSelect);
+     if (!accSelect) {
+         return nsnull;
+     }
+@@ -118,9 +118,9 @@ getSelectionCountCB(AtkSelection *aSelec
+     if (!accWrap)
+         return -1;
+ 
+-    nsCOMPtr<nsIAccessibleSelectable> accSelection;
++    nsIAccessibleSelectable* accSelection = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleSelectable),
+-                            getter_AddRefs(accSelection));
++                            (void**)&accSelection);
+     NS_ENSURE_TRUE(accSelection, -1);
+ 
+     PRInt32 num = 0;
+@@ -135,9 +135,9 @@ isChildSelectedCB(AtkSelection *aSelecti
+     if (!accWrap)
+         return FALSE;
+ 
+-    nsCOMPtr<nsIAccessibleSelectable> accSelection;
++    nsIAccessibleSelectable* accSelection = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleSelectable),
+-                            getter_AddRefs(accSelection));
++                            (void**)&accSelection);
+     NS_ENSURE_TRUE(accSelection, FALSE);
+ 
+     PRBool result = FALSE;
+@@ -152,9 +152,9 @@ removeSelectionCB(AtkSelection *aSelecti
+     if (!accWrap)
+         return FALSE;
+ 
+-    nsCOMPtr<nsIAccessibleSelectable> accSelection;
++    nsIAccessibleSelectable* accSelection = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleSelectable),
+-                            getter_AddRefs(accSelection));
++                            (void**)&accSelection);
+     NS_ENSURE_TRUE(accSelection, FALSE);
+ 
+     nsresult rv = accSelection->RemoveChildFromSelection(i);
+@@ -168,9 +168,9 @@ selectAllSelectionCB(AtkSelection *aSele
+     if (!accWrap)
+         return FALSE;
+ 
+-    nsCOMPtr<nsIAccessibleSelectable> accSelection;
++    nsIAccessibleSelectable* accSelection = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleSelectable),
+-                            getter_AddRefs(accSelection));
++                            (void**)&accSelection);
+     NS_ENSURE_TRUE(accSelection, FALSE);
+ 
+     PRBool result = FALSE;
+diff --git a/accessible/src/atk/nsMaiInterfaceTable.cpp b/accessible/src/atk/nsMaiInterfaceTable.cpp
+--- a/accessible/src/atk/nsMaiInterfaceTable.cpp
++++ b/accessible/src/atk/nsMaiInterfaceTable.cpp
+@@ -75,13 +75,13 @@ refAtCB(AtkTable *aTable, gint aRow, gin
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
++    nsIAccessibleTable* accTable = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
++                            (void**)&accTable);
+     NS_ENSURE_TRUE(accTable, nsnull);
+ 
+-    nsCOMPtr<nsIAccessible> cell;
+-    nsresult rv = accTable->CellRefAt(aRow, aColumn,getter_AddRefs(cell));
++    nsIAccessible* cell = nsnull;
++    nsresult rv = accTable->CellRefAt(aRow, aColumn,&cell);
+     if (NS_FAILED(rv) || !cell)
+         return nsnull;
+ 
+@@ -99,9 +99,9 @@ getIndexAtCB(AtkTable *aTable, gint aRow
+     if (!accWrap)
+         return -1;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
++    nsIAccessibleTable* accTable = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
++                            (void**)&accTable);
+     NS_ENSURE_TRUE(accTable, -1);
+ 
+     PRInt32 index;
+@@ -118,9 +118,9 @@ getColumnAtIndexCB(AtkTable *aTable, gin
+     if (!accWrap)
+         return -1;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
++    nsIAccessibleTable* accTable = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
++                            (void**)&accTable);
+     NS_ENSURE_TRUE(accTable, -1);
+ 
+     PRInt32 col;
+@@ -137,9 +137,9 @@ getRowAtIndexCB(AtkTable *aTable, gint a
+     if (!accWrap)
+         return -1;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
++    nsIAccessibleTable* accTable = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
++                            (void**)&accTable);
+     NS_ENSURE_TRUE(accTable, -1);
+ 
+     PRInt32 row;
+@@ -156,9 +156,9 @@ getColumnCountCB(AtkTable *aTable)
+     if (!accWrap)
+         return -1;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
++    nsIAccessibleTable* accTable = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
++                            (void**)&accTable);
+     NS_ENSURE_TRUE(accTable, -1);
+ 
+     PRInt32 count;
+@@ -175,9 +175,9 @@ getRowCountCB(AtkTable *aTable)
+     if (!accWrap)
+         return -1;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
++    nsIAccessibleTable* accTable = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
++                            (void**)&accTable);
+     NS_ENSURE_TRUE(accTable, -1);
+ 
+     PRInt32 count;
+@@ -195,9 +195,9 @@ getColumnExtentAtCB(AtkTable *aTable,
+     if (!accWrap)
+         return -1;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
++    nsIAccessibleTable* accTable = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
++                            (void**)&accTable);
+     NS_ENSURE_TRUE(accTable, -1);
+ 
+     PRInt32 extent;
+@@ -215,9 +215,9 @@ getRowExtentAtCB(AtkTable *aTable,
+     if (!accWrap)
+         return -1;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
++    nsIAccessibleTable* accTable = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
++                            (void**)&accTable);
+     NS_ENSURE_TRUE(accTable, -1);
+ 
+     PRInt32 extent;
+@@ -234,13 +234,13 @@ getCaptionCB(AtkTable *aTable)
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
++    nsIAccessibleTable* accTable = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
++                            (void**)&accTable);
+     NS_ENSURE_TRUE(accTable, nsnull);
+ 
+-    nsCOMPtr<nsIAccessible> caption;
+-    nsresult rv = accTable->GetCaption(getter_AddRefs(caption));
++    nsIAccessible* caption = nsnull;
++    nsresult rv = accTable->GetCaption(&caption);
+     if (NS_FAILED(rv) || !caption)
+         return nsnull;
+ 
+@@ -254,9 +254,9 @@ getColumnDescriptionCB(AtkTable *aTable,
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
++    nsIAccessibleTable* accTable = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
++                            (void**)&accTable);
+     NS_ENSURE_TRUE(accTable, nsnull);
+ 
+     nsAutoString autoStr;
+@@ -273,13 +273,13 @@ getColumnHeaderCB(AtkTable *aTable, gint
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
++    nsIAccessibleTable* accTable = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
++                            (void**)&accTable);
+     NS_ENSURE_TRUE(accTable, nsnull);
+ 
+-    nsCOMPtr<nsIAccessibleTable> header;
+-    nsresult rv = accTable->GetColumnHeader(getter_AddRefs(header));
++    nsIAccessibleTable* header = nsnull;
++    nsresult rv = accTable->GetColumnHeader(&header);
+     NS_ENSURE_SUCCESS(rv, nsnull);
+     NS_ENSURE_TRUE(header, nsnull);
+ 
+@@ -292,8 +292,8 @@ getColumnHeaderCB(AtkTable *aTable, gint
+     // 2. "GetColumnHeader" defined in nsIAccessibleTable returns
+     // nsXULTreeColumnsAccessibleWrap, which exports nsIAccessibleTable and is
+     // "ROLE_LIST".
+-    nsCOMPtr<nsIAccessible> accHeader;
+-    header->CellRefAt(0, aColumn, getter_AddRefs(accHeader));
++    nsIAccessible* accHeader = nsnull;
++    header->CellRefAt(0, aColumn, &accHeader);
+     NS_ENSURE_TRUE(accHeader, nsnull);
+ 
+     return nsAccessibleWrap::GetAtkObject(accHeader);
+@@ -306,9 +306,9 @@ getRowDescriptionCB(AtkTable *aTable, gi
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
++    nsIAccessibleTable* accTable = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
++                            (void**)&accTable);
+     NS_ENSURE_TRUE(accTable, nsnull);
+ 
+     nsAutoString autoStr;
+@@ -325,16 +325,16 @@ getRowHeaderCB(AtkTable *aTable, gint aR
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
++    nsIAccessibleTable* accTable = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
++                            (void**)&accTable);
+     NS_ENSURE_TRUE(accTable, nsnull);
+ 
+-    nsCOMPtr<nsIAccessibleTable> header;
+-    nsresult rv = accTable->GetRowHeader(getter_AddRefs(header));
++    nsIAccessibleTable* header = nsnull;
++    nsresult rv = accTable->GetRowHeader(&header);
+     NS_ENSURE_SUCCESS(rv, nsnull);
+ 
+-    nsCOMPtr<nsIAccessible> accHeader(do_QueryInterface(header));
++    nsIAccessible* accHeader(do_QueryInterface(header));
+     NS_ENSURE_TRUE(accHeader, nsnull);
+ 
+     return nsAccessibleWrap::GetAtkObject(accHeader);
+@@ -357,9 +357,9 @@ getSelectedColumnsCB(AtkTable *aTable, g
+     if (!accWrap)
+         return 0;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
++    nsIAccessibleTable* accTable = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
++                            (void**)&accTable);
+     NS_ENSURE_TRUE(accTable, 0);
+ 
+     PRUint32 size = 0;
+@@ -392,9 +392,9 @@ getSelectedRowsCB(AtkTable *aTable, gint
+     if (!accWrap)
+         return 0;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
++    nsIAccessibleTable* accTable = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
++                            (void**)&accTable);
+     NS_ENSURE_TRUE(accTable, 0);
+ 
+     PRUint32 size = 0;
+@@ -427,9 +427,9 @@ isColumnSelectedCB(AtkTable *aTable, gin
+     if (!accWrap)
+         return FALSE;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
++    nsIAccessibleTable* accTable = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
++                            (void**)&accTable);
+     NS_ENSURE_TRUE(accTable, FALSE);
+ 
+     PRBool outValue;
+@@ -444,9 +444,9 @@ isRowSelectedCB(AtkTable *aTable, gint a
+     if (!accWrap)
+         return FALSE;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
++    nsIAccessibleTable* accTable = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
++                            (void**)&accTable);
+     NS_ENSURE_TRUE(accTable, FALSE);
+ 
+     PRBool outValue;
+@@ -461,9 +461,9 @@ isCellSelectedCB(AtkTable *aTable, gint 
+     if (!accWrap)
+         return FALSE;
+ 
+-    nsCOMPtr<nsIAccessibleTable> accTable;
++    nsIAccessibleTable* accTable = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
+-                            getter_AddRefs(accTable));
++                            (void**)&accTable);
+     NS_ENSURE_TRUE(accTable, FALSE);
+ 
+     PRBool outValue;
+diff --git a/accessible/src/atk/nsMaiInterfaceText.cpp b/accessible/src/atk/nsMaiInterfaceText.cpp
+--- a/accessible/src/atk/nsMaiInterfaceText.cpp
++++ b/accessible/src/atk/nsMaiInterfaceText.cpp
+@@ -92,9 +92,9 @@ getTextCB(AtkText *aText, gint aStartOff
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleText> accText;
++    nsIAccessibleText* accText = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                            getter_AddRefs(accText));
++                            (void**)&accText);
+     NS_ENSURE_TRUE(accText, nsnull);
+ 
+     nsAutoString autoStr;
+@@ -117,9 +117,9 @@ getTextAfterOffsetCB(AtkText *aText, gin
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleText> accText;
++    nsIAccessibleText* accText = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                            getter_AddRefs(accText));
++                            (void**)&accText);
+     NS_ENSURE_TRUE(accText, nsnull);
+ 
+     nsAutoString autoStr;
+@@ -146,9 +146,9 @@ getTextAtOffsetCB(AtkText *aText, gint a
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleText> accText;
++    nsIAccessibleText* accText = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                            getter_AddRefs(accText));
++                            (void**)&accText);
+     NS_ENSURE_TRUE(accText, nsnull);
+ 
+     nsAutoString autoStr;
+@@ -173,9 +173,9 @@ getCharacterAtOffsetCB(AtkText *aText, g
+     if (!accWrap)
+         return 0;
+ 
+-    nsCOMPtr<nsIAccessibleText> accText;
++    nsIAccessibleText* accText = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                            getter_AddRefs(accText));
++                            (void**)&accText);
+     NS_ENSURE_TRUE(accText, 0);
+ 
+     /* PRUnichar is unsigned short in Mozilla */
+@@ -203,9 +203,9 @@ getTextBeforeOffsetCB(AtkText *aText, gi
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleText> accText;
++    nsIAccessibleText* accText = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                            getter_AddRefs(accText));
++                            (void**)&accText);
+     NS_ENSURE_TRUE(accText, nsnull);
+ 
+     nsAutoString autoStr;
+@@ -230,9 +230,9 @@ getCaretOffsetCB(AtkText *aText)
+     if (!accWrap)
+         return 0;
+ 
+-    nsCOMPtr<nsIAccessibleText> accText;
++    nsIAccessibleText* accText = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                            getter_AddRefs(accText));
++                            (void**)&accText);
+     NS_ENSURE_TRUE(accText, 0);
+ 
+     PRInt32 offset;
+@@ -249,16 +249,16 @@ getRunAttributesCB(AtkText *aText, gint 
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleText> accText;
++    nsIAccessibleText* accText = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                            getter_AddRefs(accText));
++                            (void**)&accText);
+     NS_ENSURE_TRUE(accText, nsnull);
+ 
+-    nsCOMPtr<nsIAccessible> accessibleWithAttrs;
++    nsIAccessible* accessibleWithAttrs = nsnull;
+     PRInt32 startOffset = 0, endOffset = 0;
+     nsresult rv =
+         accText->GetAttributeRange(aOffset, &startOffset, &endOffset,
+-                                   getter_AddRefs(accessibleWithAttrs));
++                                   &accessibleWithAttrs);
+     *aStartOffset = startOffset;
+     *aEndOffset = endOffset;
+     if (NS_FAILED(rv))
+@@ -284,9 +284,9 @@ getCharacterExtentsCB(AtkText *aText, gi
+     if(!accWrap || !aX || !aY || !aWidth || !aHeight)
+         return;
+ 
+-    nsCOMPtr<nsIAccessibleText> accText;
++    nsIAccessibleText* accText = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                            getter_AddRefs(accText));
++                            (void**)&accText);
+     if (!accText)
+         return;
+ 
+@@ -318,9 +318,9 @@ getRangeExtentsCB(AtkText *aText, gint a
+     if(!accWrap || !aRect)
+         return;
+ 
+-    nsCOMPtr<nsIAccessibleText> accText;
++    nsIAccessibleText* accText = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                            getter_AddRefs(accText));
++                            (void**)&accText);
+     if (!accText)
+         return;
+ 
+@@ -352,9 +352,9 @@ getCharacterCountCB(AtkText *aText)
+     if (!accWrap)
+         return 0;
+ 
+-    nsCOMPtr<nsIAccessibleText> accText;
++    nsIAccessibleText* accText = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                            getter_AddRefs(accText));
++                            (void**)&accText);
+     NS_ENSURE_TRUE(accText, 0);
+ 
+     PRInt32 count = 0;
+@@ -371,9 +371,9 @@ getOffsetAtPointCB(AtkText *aText,
+     if (!accWrap)
+         return -1;
+ 
+-    nsCOMPtr<nsIAccessibleText> accText;
++    nsIAccessibleText* accText = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                            getter_AddRefs(accText));
++                            (void**)&accText);
+     NS_ENSURE_TRUE(accText, -1);
+ 
+     PRInt32 offset = 0;
+@@ -394,9 +394,9 @@ getTextSelectionCountCB(AtkText *aText)
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleText> accText;
++    nsIAccessibleText* accText = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                            getter_AddRefs(accText));
++                            (void**)&accText);
+     NS_ENSURE_TRUE(accText, nsnull);
+ 
+     PRInt32 selectionCount;
+@@ -413,9 +413,9 @@ getTextSelectionCB(AtkText *aText, gint 
+     if (!accWrap)
+         return nsnull;
+ 
+-    nsCOMPtr<nsIAccessibleText> accText;
++    nsIAccessibleText* accText = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                            getter_AddRefs(accText));
++                            (void**)&accText);
+     NS_ENSURE_TRUE(accText, nsnull);
+ 
+     PRInt32 startOffset = 0, endOffset = 0;
+@@ -440,9 +440,9 @@ addTextSelectionCB(AtkText *aText,
+     if (!accWrap)
+         return FALSE;
+ 
+-    nsCOMPtr<nsIAccessibleText> accText;
++    nsIAccessibleText* accText = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                            getter_AddRefs(accText));
++                            (void**)&accText);
+     NS_ENSURE_TRUE(accText, FALSE);
+ 
+     nsresult rv = accText->AddSelection(aStartOffset, aEndOffset);
+@@ -458,9 +458,9 @@ removeTextSelectionCB(AtkText *aText,
+     if (!accWrap)
+         return FALSE;
+ 
+-    nsCOMPtr<nsIAccessibleText> accText;
++    nsIAccessibleText* accText = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                            getter_AddRefs(accText));
++                            (void**)&accText);
+     NS_ENSURE_TRUE(accText, FALSE);
+ 
+     nsresult rv = accText->RemoveSelection(aSelectionNum);
+@@ -476,9 +476,9 @@ setTextSelectionCB(AtkText *aText, gint 
+     if (!accWrap)
+         return FALSE;
+ 
+-    nsCOMPtr<nsIAccessibleText> accText;
++    nsIAccessibleText* accText = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                            getter_AddRefs(accText));
++                            (void**)&accText);
+     NS_ENSURE_TRUE(accText, FALSE);
+ 
+     nsresult rv = accText->SetSelectionBounds(aSelectionNum,
+@@ -493,9 +493,9 @@ setCaretOffsetCB(AtkText *aText, gint aO
+     if (!accWrap)
+         return FALSE;
+ 
+-    nsCOMPtr<nsIAccessibleText> accText;
++    nsIAccessibleText* accText = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
+-                            getter_AddRefs(accText));
++                            (void**)&accText);
+     NS_ENSURE_TRUE(accText, FALSE);
+ 
+     nsresult rv = accText->SetCaretOffset(aOffset);
+diff --git a/accessible/src/atk/nsMaiInterfaceValue.cpp b/accessible/src/atk/nsMaiInterfaceValue.cpp
+--- a/accessible/src/atk/nsMaiInterfaceValue.cpp
++++ b/accessible/src/atk/nsMaiInterfaceValue.cpp
+@@ -61,9 +61,9 @@ getCurrentValueCB(AtkValue *obj, GValue 
+     if (!accWrap)
+         return;
+ 
+-    nsCOMPtr<nsIAccessibleValue> accValue;
++    nsIAccessibleValue* accValue = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleValue),
+-                            getter_AddRefs(accValue));
++                            (void**)&accValue);
+     if (!accValue)
+         return;
+ 
+@@ -82,9 +82,9 @@ getMaximumValueCB(AtkValue *obj, GValue 
+     if (!accWrap)
+         return;
+ 
+-    nsCOMPtr<nsIAccessibleValue> accValue;
++    nsIAccessibleValue* accValue = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleValue),
+-                            getter_AddRefs(accValue));
++                            (void**)&accValue);
+     if (!accValue)
+         return;
+ 
+@@ -103,9 +103,9 @@ getMinimumValueCB(AtkValue *obj, GValue 
+     if (!accWrap)
+         return;
+ 
+-    nsCOMPtr<nsIAccessibleValue> accValue;
++    nsIAccessibleValue* accValue = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleValue),
+-                            getter_AddRefs(accValue));
++                            (void**)&accValue);
+     if (!accValue)
+         return;
+ 
+@@ -124,9 +124,9 @@ getMinimumIncrementCB(AtkValue *obj, GVa
+     if (!accWrap)
+         return;
+ 
+-    nsCOMPtr<nsIAccessibleValue> accValue;
++    nsIAccessibleValue* accValue = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleValue),
+-                            getter_AddRefs(accValue));
++                            (void**)&accValue);
+     if (!accValue)
+         return;
+ 
+@@ -145,9 +145,9 @@ setCurrentValueCB(AtkValue *obj, const G
+     if (!accWrap)
+         return FALSE;
+ 
+-    nsCOMPtr<nsIAccessibleValue> accValue;
++    nsIAccessibleValue* accValue = nsnull;
+     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleValue),
+-                            getter_AddRefs(accValue));
++                            (void**)&accValue);
+     NS_ENSURE_TRUE(accValue, FALSE);
+ 
+     double accDouble =g_value_get_double (value);
+diff --git a/accessible/src/atk/nsXULTreeAccessibleWrap.cpp b/accessible/src/atk/nsXULTreeAccessibleWrap.cpp
+--- a/accessible/src/atk/nsXULTreeAccessibleWrap.cpp
++++ b/accessible/src/atk/nsXULTreeAccessibleWrap.cpp
+@@ -92,7 +92,7 @@ NS_IMETHODIMP nsXULTreeAccessibleWrap::G
+   NS_ENSURE_ARG_POINTER(aColumnCount);
+   *aColumnCount = 0;
+ 
+-  nsCOMPtr<nsITreeColumn> column;
++  nsITreeColumn* column = nsnull;
+   column = GetFirstVisibleColumn(mTree);
+   if (!column)
+     return NS_ERROR_FAILURE;
+@@ -108,11 +108,11 @@ NS_IMETHODIMP nsXULTreeAccessibleWrap::G
+ {
+   nsresult rv = NS_OK;
+ 
+-  nsCOMPtr<nsIAccessible> acc;
+-  nsAccessible::GetFirstChild(getter_AddRefs(acc));
++  nsIAccessible* acc = nsnull;
++  nsAccessible::GetFirstChild(&acc);
+   NS_ENSURE_TRUE(acc, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIAccessibleTable> accTable(do_QueryInterface(acc, &rv));
++  nsIAccessibleTable* accTable(do_QueryInterface(acc, &rv));
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+   *aColumnHeader = accTable;
+@@ -211,12 +211,12 @@ NS_IMETHODIMP nsXULTreeAccessibleWrap::G
+   PRInt32 *outArray = (PRInt32 *)nsMemory::Alloc((*aNumRows) * sizeof(PRInt32));
+   NS_ENSURE_TRUE(outArray, NS_ERROR_OUT_OF_MEMORY);
+ 
+-  nsCOMPtr<nsITreeView> view;
+-  rv = mTree->GetView(getter_AddRefs(view));
++  nsITreeView* view = nsnull;
++  rv = mTree->GetView(&view);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+-  nsCOMPtr<nsITreeSelection> selection;
+-  rv = view->GetSelection(getter_AddRefs(selection));
++  nsITreeSelection* selection = nsnull;
++  rv = view->GetSelection(&selection);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+   PRInt32 rowCount;
+@@ -326,8 +326,8 @@ NS_IMETHODIMP nsXULTreeAccessibleWrap::G
+ 
+ NS_IMETHODIMP nsXULTreeAccessibleWrap::GetColumnDescription(PRInt32 aColumn, nsAString & _retval)
+ {
+-  nsCOMPtr<nsIAccessibleTable> columnHeader;
+-  nsresult rv = GetColumnHeader(getter_AddRefs(columnHeader));
++  nsIAccessibleTable* columnHeader = nsnull;
++  nsresult rv = GetColumnHeader(&columnHeader);
+   if (NS_SUCCEEDED(rv) && columnHeader) {
+     return columnHeader->GetColumnDescription(aColumn, _retval);
+   }
+@@ -366,12 +366,12 @@ NS_IMETHODIMP nsXULTreeAccessibleWrap::I
+ 
+   nsresult rv = NS_OK;
+ 
+-  nsCOMPtr<nsITreeView> view;
+-  rv = mTree->GetView(getter_AddRefs(view));
++  nsITreeView* view = nsnull;
++  rv = mTree->GetView(&view);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+-  nsCOMPtr<nsITreeSelection> selection;
+-  rv = view->GetSelection(getter_AddRefs(selection));
++  nsITreeSelection* selection = nsnull;
++  rv = view->GetSelection(&selection);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+   return selection->IsSelected(aRow, _retval);
+@@ -413,8 +413,8 @@ NS_IMETHODIMP nsXULTreeAccessibleWrap::C
+   PRInt32 rowIndex;
+   nsresult rv = GetRowAtIndex(aIndex, &rowIndex);
+ 
+-  nsCOMPtr<nsITreeSelection> selection;
+-  rv = mTreeView->GetSelection(getter_AddRefs(selection));
++  nsITreeSelection* selection = nsnull;
++  rv = mTreeView->GetSelection(&selection);
+   NS_ASSERTION(selection, "Can't get selection from mTreeView");
+ 
+   if (selection) {
+@@ -527,12 +527,12 @@ NS_IMETHODIMP nsXULTreeColumnsAccessible
+ 
+ NS_IMETHODIMP nsXULTreeColumnsAccessibleWrap::CellRefAt(PRInt32 aRow, PRInt32 aColumn, nsIAccessible **_retval)
+ {
+-  nsCOMPtr<nsIAccessible> next, temp;
+-  GetFirstChild(getter_AddRefs(next));
++  nsIAccessible* next = nsnull, *temp = nsnull;
++  GetFirstChild(&next);
+   NS_ENSURE_TRUE(next, NS_ERROR_FAILURE);
+ 
+   for (PRInt32 col = 0; col < aColumn; col++) {
+-    next->GetNextSibling(getter_AddRefs(temp));
++    next->GetNextSibling(&temp);
+     NS_ENSURE_TRUE(temp, NS_ERROR_FAILURE);
+ 
+     next = temp;
+@@ -586,8 +586,8 @@ NS_IMETHODIMP nsXULTreeColumnsAccessible
+ 
+ NS_IMETHODIMP nsXULTreeColumnsAccessibleWrap::GetColumnDescription(PRInt32 aColumn, nsAString & _retval)
+ {
+-  nsCOMPtr<nsIAccessible> column;  
+-  nsresult rv = CellRefAt(0, aColumn, getter_AddRefs(column));
++  nsIAccessible* column = nsnull;  
++  nsresult rv = CellRefAt(0, aColumn, &column);
+   if (NS_SUCCEEDED(rv) && column) {
+     return column->GetName(_retval);
+   }
+diff --git a/accessible/src/base/nsAccessNode.cpp b/accessible/src/base/nsAccessNode.cpp
+--- a/accessible/src/base/nsAccessNode.cpp
++++ b/accessible/src/base/nsAccessNode.cpp
+@@ -146,21 +146,21 @@ NS_IMETHODIMP nsAccessNode::Init()
+ #ifdef DEBUG_A11Y
+   NS_ASSERTION(!mIsInitialized, "Initialized twice!");
+ #endif
+-  nsCOMPtr<nsIAccessibleDocument> docAccessible(GetDocAccessible());
++  nsIAccessibleDocument* docAccessible(GetDocAccessible());
+   if (!docAccessible) {
+     // No doc accessible yet for this node's document. 
+     // There was probably an accessible event fired before the 
+     // current document was ever asked for by the assistive technology.
+     // Create a doc accessible so we can cache this node
+-    nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
++    nsIPresShell* presShell(do_QueryReferent(mWeakShell));
+     if (presShell) {
+-      nsCOMPtr<nsIDOMNode> docNode(do_QueryInterface(presShell->GetDocument()));
++      nsIDOMNode* docNode(do_QueryInterface(presShell->GetDocument()));
+       if (docNode) {
+         nsIAccessibilityService *accService = GetAccService();
+         if (accService) {
+-          nsCOMPtr<nsIAccessible> accessible;
++          nsIAccessible* accessible = nsnull;
+           accService->GetAccessibleInShell(docNode, presShell,
+-                                           getter_AddRefs(accessible));
++                                           &accessible);
+           docAccessible = do_QueryInterface(accessible);
+         }
+       }
+@@ -173,7 +173,7 @@ NS_IMETHODIMP nsAccessNode::Init()
+ 
+   void* uniqueID;
+   GetUniqueID(&uniqueID);
+-  nsCOMPtr<nsPIAccessibleDocument> privateDocAccessible =
++  nsPIAccessibleDocument* privateDocAccessible =
+     do_QueryInterface(docAccessible);
+   NS_ASSERTION(privateDocAccessible, "No private docaccessible for docaccessible");
+   privateDocAccessible->CacheAccessNode(uniqueID, this);
+@@ -181,12 +181,12 @@ NS_IMETHODIMP nsAccessNode::Init()
+   // Make sure an ancestor in real content is cached
+   // so that nsDocAccessible::RefreshNodes() can find the anonymous subtree to release when
+   // the root node goes away
+-  nsCOMPtr<nsIContent> content = do_QueryInterface(mDOMNode);
++  nsIContent* content = do_QueryInterface(mDOMNode);
+   if (content && (content->IsNativeAnonymous() ||
+                   content->GetBindingParent())) {
+     // Specific examples of where this is used: <input type="file"> and <xul:findbar>
+-    nsCOMPtr<nsIAccessible> parentAccessible;
+-    docAccessible->GetAccessibleInParentChain(mDOMNode, PR_TRUE, getter_AddRefs(parentAccessible));
++    nsIAccessible* parentAccessible = nsnull;
++    docAccessible->GetAccessibleInParentChain(mDOMNode, PR_TRUE, &parentAccessible);
+     if (parentAccessible) {
+       PRInt32 childCountUnused;
+       parentAccessible->GetChildCount(&childCountUnused);
+@@ -218,13 +218,13 @@ NS_IMETHODIMP nsAccessNode::GetOwnerWind
+ NS_IMETHODIMP nsAccessNode::GetOwnerWindow(void **aWindow)
+ {
+   *aWindow = nsnull;
+-  nsCOMPtr<nsIAccessibleDocument> docAccessible(GetDocAccessible());
++  nsIAccessibleDocument* docAccessible(GetDocAccessible());
+   if (!docAccessible)
+     return NS_ERROR_FAILURE; // This node or doc accessible is shut down
+   return docAccessible->GetWindowHandle(aWindow);
+ }
+ 
+-already_AddRefed<nsApplicationAccessibleWrap>
++nsApplicationAccessibleWrap*
+ nsAccessNode::GetApplicationAccessible()
+ {
+   if (!gIsAccessibilityActive) {
+@@ -259,7 +259,7 @@ void nsAccessNode::InitXPAccessibility()
+     return;
+   }
+ 
+-  nsCOMPtr<nsIStringBundleService> stringBundleService =
++  nsIStringBundleService* stringBundleService =
+     do_GetService(NS_STRINGBUNDLE_CONTRACTID);
+   if (stringBundleService) {
+     // Static variables are released in ShutdownAllXPAccessibility();
+@@ -273,7 +273,7 @@ void nsAccessNode::InitXPAccessibility()
+ 
+   gGlobalDocAccessibleCache.Init(4);
+ 
+-  nsCOMPtr<nsIPrefBranch> prefBranch(do_GetService(NS_PREFSERVICE_CONTRACTID));
++  nsIPrefBranch* prefBranch(do_GetService(NS_PREFSERVICE_CONTRACTID));
+   if (prefBranch) {
+     prefBranch->GetBoolPref("accessibility.disablecache", &gIsCacheDisabled);
+     prefBranch->GetBoolPref("browser.formfill.enable", &gIsFormFillEnabled);
+@@ -285,7 +285,7 @@ void nsAccessNode::InitXPAccessibility()
+ 
+ void nsAccessNode::NotifyA11yInitOrShutdown()
+ {
+-  nsCOMPtr<nsIObserverService> obsService =
++  nsIObserverService* obsService =
+     do_GetService("@mozilla.org/observer-service;1");
+   NS_ASSERTION(obsService, "No observer service to notify of a11y init/shutdown");
+   if (obsService) {
+@@ -325,7 +325,7 @@ void nsAccessNode::ShutdownXPAccessibili
+   NotifyA11yInitOrShutdown();
+ }
+ 
+-already_AddRefed<nsIPresShell> nsAccessNode::GetPresShell()
++nsIPresShell* nsAccessNode::GetPresShell()
+ {
+   nsIPresShell *presShell = nsnull;
+   if (mWeakShell)
+@@ -344,34 +344,34 @@ already_AddRefed<nsIPresShell> nsAccessN
+ 
+ nsPresContext* nsAccessNode::GetPresContext()
+ {
+-  nsCOMPtr<nsIPresShell> presShell(GetPresShell());
++  nsIPresShell* presShell(GetPresShell());
+   if (!presShell) {
+     return nsnull;
+   }
+   return presShell->GetPresContext();
+ }
+ 
+-already_AddRefed<nsIAccessibleDocument> nsAccessNode::GetDocAccessible()
++nsIAccessibleDocument* nsAccessNode::GetDocAccessible()
+ {
+   return GetDocAccessibleFor(mWeakShell); // Addref'd
+ }
+ 
+-already_AddRefed<nsRootAccessible> nsAccessNode::GetRootAccessible()
++nsRootAccessible* nsAccessNode::GetRootAccessible()
+ {
+-  nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem =
++  nsIDocShellTreeItem* docShellTreeItem =
+     nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
+   NS_ASSERTION(docShellTreeItem, "No docshell tree item for mDOMNode");
+   if (!docShellTreeItem) {
+     return nsnull;
+   }
+-  nsCOMPtr<nsIDocShellTreeItem> root;
+-  docShellTreeItem->GetRootTreeItem(getter_AddRefs(root));
++  nsIDocShellTreeItem* root = nsnull;
++  docShellTreeItem->GetRootTreeItem(&root);
+   NS_ASSERTION(root, "No root content tree item");
+   if (!root) {
+     return nsnull;
+   }
+ 
+-  nsCOMPtr<nsIAccessibleDocument> accDoc = GetDocAccessibleFor(root);
++  nsIAccessibleDocument* accDoc = GetDocAccessibleFor(root);
+   if (!accDoc) {
+     return nsnull;
+   }
+@@ -385,11 +385,11 @@ already_AddRefed<nsRootAccessible> nsAcc
+ 
+ nsIFrame* nsAccessNode::GetFrame()
+ {
+-  nsCOMPtr<nsIPresShell> shell(do_QueryReferent(mWeakShell));
++  nsIPresShell* shell(do_QueryReferent(mWeakShell));
+   if (!shell) 
+     return nsnull;  
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   return content ? shell->GetPrimaryFrameFor(content) : nsnull;
+ }
+ 
+@@ -403,7 +403,7 @@ NS_IMETHODIMP
+ NS_IMETHODIMP
+ nsAccessNode::GetNumChildren(PRInt32 *aNumChildren)
+ {
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+ 
+   if (!content) {
+     *aNumChildren = 0;
+@@ -419,7 +419,7 @@ NS_IMETHODIMP
+ NS_IMETHODIMP
+ nsAccessNode::GetAccessibleDocument(nsIAccessibleDocument **aDocAccessible)
+ {
+-  *aDocAccessible = GetDocAccessibleFor(mWeakShell).get();
++  *aDocAccessible = GetDocAccessibleFor(mWeakShell);
+   return NS_OK;
+ }
+ 
+@@ -428,7 +428,7 @@ nsAccessNode::GetInnerHTML(nsAString& aI
+ {
+   aInnerHTML.Truncate();
+ 
+-  nsCOMPtr<nsIDOMNSHTMLElement> domNSElement(do_QueryInterface(mDOMNode));
++  nsIDOMNSHTMLElement* domNSElement(do_QueryInterface(mDOMNode));
+   NS_ENSURE_TRUE(domNSElement, NS_ERROR_NULL_POINTER);
+ 
+   return domNSElement->GetInnerHTML(aInnerHTML);
+@@ -440,13 +440,13 @@ nsAccessNode::ScrollTo(PRUint32 aScrollT
+   if (IsDefunct())
+     return NS_ERROR_FAILURE;
+ 
+-  nsCOMPtr<nsIPresShell> shell(GetPresShell());
++  nsIPresShell* shell(GetPresShell());
+   NS_ENSURE_TRUE(shell, NS_ERROR_FAILURE);
+ 
+   nsIFrame *frame = GetFrame();
+   NS_ENSURE_TRUE(frame, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIContent> content = frame->GetContent();
++  nsIContent* content = frame->GetContent();
+   NS_ENSURE_TRUE(content, NS_ERROR_FAILURE);
+ 
+   PRInt16 vPercent, hPercent;
+@@ -481,13 +481,13 @@ nsAccessNode::MakeAccessNode(nsIDOMNode 
+   nsIAccessibilityService *accService = GetAccService();
+   NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIAccessNode> accessNode;
+-  accService->GetCachedAccessNode(aNode, mWeakShell, getter_AddRefs(accessNode));
++  nsIAccessNode* accessNode = nsnull;
++  accService->GetCachedAccessNode(aNode, mWeakShell, &accessNode);
+ 
+   if (!accessNode) {
+-    nsCOMPtr<nsIAccessible> accessible;
++    nsIAccessible* accessible = nsnull;
+     accService->GetAccessibleInWeakShell(aNode, mWeakShell,
+-                                         getter_AddRefs(accessible));
++                                         &accessible);
+ 
+     accessNode = do_QueryInterface(accessible);
+   }
+@@ -515,8 +515,8 @@ nsAccessNode::GetFirstChildNode(nsIAcces
+   *aAccessNode = nsnull;
+   NS_ENSURE_TRUE(mDOMNode, NS_ERROR_NULL_POINTER);
+ 
+-  nsCOMPtr<nsIDOMNode> domNode;
+-  mDOMNode->GetFirstChild(getter_AddRefs(domNode));
++  nsIDOMNode* domNode = nsnull;
++  mDOMNode->GetFirstChild(&domNode);
+ 
+   return domNode ? MakeAccessNode(domNode, aAccessNode) : NS_OK;
+ }
+@@ -528,8 +528,8 @@ nsAccessNode::GetLastChildNode(nsIAccess
+   *aAccessNode = nsnull;
+   NS_ENSURE_TRUE(mDOMNode, NS_ERROR_NULL_POINTER);
+ 
+-  nsCOMPtr<nsIDOMNode> domNode;
+-  mDOMNode->GetLastChild(getter_AddRefs(domNode));
++  nsIDOMNode* domNode = nsnull;
++  mDOMNode->GetLastChild(&domNode);
+ 
+   return domNode ? MakeAccessNode(domNode, aAccessNode) : NS_OK;
+ }
+@@ -541,8 +541,8 @@ nsAccessNode::GetParentNode(nsIAccessNod
+   *aAccessNode = nsnull;
+   NS_ENSURE_TRUE(mDOMNode, NS_ERROR_NULL_POINTER);
+ 
+-  nsCOMPtr<nsIDOMNode> domNode;
+-  mDOMNode->GetParentNode(getter_AddRefs(domNode));
++  nsIDOMNode* domNode = nsnull;
++  mDOMNode->GetParentNode(&domNode);
+ 
+   return domNode ? MakeAccessNode(domNode, aAccessNode) : NS_OK;
+ }
+@@ -554,8 +554,8 @@ nsAccessNode::GetPreviousSiblingNode(nsI
+   *aAccessNode = nsnull;
+   NS_ENSURE_TRUE(mDOMNode, NS_ERROR_NULL_POINTER);
+ 
+-  nsCOMPtr<nsIDOMNode> domNode;
+-  mDOMNode->GetPreviousSibling(getter_AddRefs(domNode));
++  nsIDOMNode* domNode = nsnull;
++  mDOMNode->GetPreviousSibling(&domNode);
+ 
+   return domNode ? MakeAccessNode(domNode, aAccessNode) : NS_OK;
+ }
+@@ -567,8 +567,8 @@ nsAccessNode::GetNextSiblingNode(nsIAcce
+   *aAccessNode = nsnull;
+   NS_ENSURE_TRUE(mDOMNode, NS_ERROR_NULL_POINTER);
+ 
+-  nsCOMPtr<nsIDOMNode> domNode;
+-  mDOMNode->GetNextSibling(getter_AddRefs(domNode));
++  nsIDOMNode* domNode = nsnull;
++  mDOMNode->GetNextSibling(&domNode);
+ 
+   return domNode ? MakeAccessNode(domNode, aAccessNode) : NS_OK;
+ }
+@@ -579,10 +579,10 @@ nsAccessNode::GetChildNodeAt(PRInt32 aCh
+   NS_ENSURE_ARG_POINTER(aAccessNode);
+   *aAccessNode = nsnull;
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   NS_ENSURE_TRUE(content, NS_ERROR_NULL_POINTER);
+ 
+-  nsCOMPtr<nsIDOMNode> domNode =
++  nsIDOMNode* domNode =
+     do_QueryInterface(content->GetChildAt(aChildNum));
+ 
+   return domNode ? MakeAccessNode(domNode, aAccessNode) : NS_OK;
+@@ -591,12 +591,12 @@ NS_IMETHODIMP
+ NS_IMETHODIMP
+ nsAccessNode::GetComputedStyleValue(const nsAString& aPseudoElt, const nsAString& aPropertyName, nsAString& aValue)
+ {
+-  nsCOMPtr<nsIDOMElement> domElement(do_QueryInterface(mDOMNode));
++  nsIDOMElement* domElement(do_QueryInterface(mDOMNode));
+   if (!domElement) {
+     return NS_ERROR_FAILURE;
+   }
+-  nsCOMPtr<nsIDOMCSSStyleDeclaration> styleDecl;
+-  GetComputedStyleDeclaration(aPseudoElt, domElement, getter_AddRefs(styleDecl));
++  nsIDOMCSSStyleDeclaration* styleDecl = nsnull;
++  GetComputedStyleDeclaration(aPseudoElt, domElement, &styleDecl);
+   NS_ENSURE_TRUE(styleDecl, NS_ERROR_FAILURE);
+   
+   return styleDecl->GetPropertyValue(aPropertyName, aValue);
+@@ -611,17 +611,17 @@ nsAccessNode::GetComputedStyleCSSValue(c
+ 
+   *aCSSValue = nsnull;
+ 
+-  nsCOMPtr<nsIDOMElement> domElement(do_QueryInterface(mDOMNode));
++  nsIDOMElement* domElement(do_QueryInterface(mDOMNode));
+   if (!domElement)
+     return NS_ERROR_FAILURE;
+ 
+-  nsCOMPtr<nsIDOMCSSStyleDeclaration> styleDecl;
++  nsIDOMCSSStyleDeclaration* styleDecl = nsnull;
+   GetComputedStyleDeclaration(aPseudoElt, domElement,
+-                              getter_AddRefs(styleDecl));
++                              &styleDecl);
+   NS_ENSURE_STATE(styleDecl);
+ 
+-  nsCOMPtr<nsIDOMCSSValue> cssValue;
+-  styleDecl->GetPropertyCSSValue(aPropertyName, getter_AddRefs(cssValue));
++  nsIDOMCSSValue* cssValue = nsnull;
++  styleDecl->GetPropertyCSSValue(aPropertyName, &cssValue);
+   NS_ENSURE_TRUE(cssValue, NS_ERROR_FAILURE);
+ 
+   return CallQueryInterface(cssValue, aCSSValue);
+@@ -633,28 +633,28 @@ void nsAccessNode::GetComputedStyleDecla
+ {
+   *aCssDecl = nsnull;
+   // Returns number of items in style declaration
+-  nsCOMPtr<nsIContent> content = do_QueryInterface(aElement);
++  nsIContent* content = do_QueryInterface(aElement);
+   if (!content) {
+     return;
+   }
+-  nsCOMPtr<nsIDocument> doc = content->GetDocument();
++  nsIDocument* doc = content->GetDocument();
+   if (!doc) {
+     return;
+   }
+ 
+-  nsCOMPtr<nsIDOMViewCSS> viewCSS(do_QueryInterface(doc->GetWindow()));
++  nsIDOMViewCSS* viewCSS(do_QueryInterface(doc->GetWindow()));
+   if (!viewCSS) {
+     return;
+   }
+ 
+-  nsCOMPtr<nsIDOMCSSStyleDeclaration> cssDecl;
+-  viewCSS->GetComputedStyle(aElement, aPseudoElt, getter_AddRefs(cssDecl));
++  nsIDOMCSSStyleDeclaration* cssDecl = nsnull;
++  viewCSS->GetComputedStyle(aElement, aPseudoElt, &cssDecl);
+   NS_IF_ADDREF(*aCssDecl = cssDecl);
+ }
+ 
+ /***************** Hashtable of nsIAccessNode's *****************/
+ 
+-already_AddRefed<nsIAccessibleDocument>
++nsIAccessibleDocument*
+ nsAccessNode::GetDocAccessibleFor(nsIDocument *aDocument)
+ {
+   if (!aDocument) {
+@@ -662,19 +662,19 @@ nsAccessNode::GetDocAccessibleFor(nsIDoc
+   }
+ 
+   nsIAccessibleDocument *docAccessible = nsnull;
+-  nsCOMPtr<nsIAccessNode> accessNode;
++  nsIAccessNode* accessNode = nsnull;
+   gGlobalDocAccessibleCache.Get(static_cast<void*>(aDocument),
+-                                getter_AddRefs(accessNode));
++                                &accessNode);
+   if (accessNode) {
+     CallQueryInterface(accessNode, &docAccessible);
+   }
+   return docAccessible;
+ }
+  
+-already_AddRefed<nsIAccessibleDocument>
++nsIAccessibleDocument*
+ nsAccessNode::GetDocAccessibleFor(nsIWeakReference *aWeakShell)
+ {
+-  nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(aWeakShell));
++  nsIPresShell* presShell(do_QueryReferent(aWeakShell));
+   if (!presShell) {
+     return nsnull;
+   }
+@@ -682,25 +682,25 @@ nsAccessNode::GetDocAccessibleFor(nsIWea
+   return nsAccessNode::GetDocAccessibleFor(presShell->GetDocument());
+ }
+ 
+-already_AddRefed<nsIAccessibleDocument>
++nsIAccessibleDocument*
+ nsAccessNode::GetDocAccessibleFor(nsIDocShellTreeItem *aContainer,
+                                   PRBool aCanCreate)
+ {
+   if (!aCanCreate) {
+-    nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(aContainer));
++    nsIDocShell* docShell(do_QueryInterface(aContainer));
+     NS_ASSERTION(docShell, "This method currently only supports docshells");
+-    nsCOMPtr<nsIPresShell> presShell;
+-    docShell->GetPresShell(getter_AddRefs(presShell));
++    nsIPresShell* presShell = nsnull;
++    docShell->GetPresShell(&presShell);
+     return presShell ? GetDocAccessibleFor(presShell->GetDocument()) : nsnull;
+   }
+ 
+-  nsCOMPtr<nsIDOMNode> node = GetDOMNodeForContainer(aContainer);
++  nsIDOMNode* node = GetDOMNodeForContainer(aContainer);
+   if (!node) {
+     return nsnull;
+   }
+ 
+-  nsCOMPtr<nsIAccessible> accessible;
+-  GetAccService()->GetAccessibleFor(node, getter_AddRefs(accessible));
++  nsIAccessible* accessible = nsnull;
++  GetAccService()->GetAccessibleFor(node, &accessible);
+   nsIAccessibleDocument *docAccessible = nsnull;
+   if (accessible) {
+     CallQueryInterface(accessible, &docAccessible);
+@@ -708,15 +708,15 @@ nsAccessNode::GetDocAccessibleFor(nsIDoc
+   return docAccessible;
+ }
+  
+-already_AddRefed<nsIAccessibleDocument>
++nsIAccessibleDocument*
+ nsAccessNode::GetDocAccessibleFor(nsIDOMNode *aNode)
+ {
+-  nsCOMPtr<nsIPresShell> eventShell = GetPresShellFor(aNode);
++  nsIPresShell* eventShell = GetPresShellFor(aNode);
+   if (eventShell) {
+     return GetDocAccessibleFor(eventShell->GetDocument());
+   }
+ 
+-  nsCOMPtr<nsIDocument> doc(do_QueryInterface(aNode));
++  nsIDocument* doc(do_QueryInterface(aNode));
+   if (doc) {
+     return GetDocAccessibleFor(doc);
+   }
+@@ -724,12 +724,12 @@ nsAccessNode::GetDocAccessibleFor(nsIDOM
+   return nsnull;
+ }
+ 
+-already_AddRefed<nsIPresShell>
++nsIPresShell*
+ nsAccessNode::GetPresShellFor(nsIDOMNode *aNode)
+ {
+-  nsCOMPtr<nsIDOMDocument> domDocument;
+-  aNode->GetOwnerDocument(getter_AddRefs(domDocument));
+-  nsCOMPtr<nsIDocument> doc(do_QueryInterface(domDocument));
++  nsIDOMDocument* domDocument = nsnull;
++  aNode->GetOwnerDocument(&domDocument);
++  nsIDocument* doc(do_QueryInterface(domDocument));
+   if (!doc) {   // This is necessary when the node is the document node
+     doc = do_QueryInterface(aNode);
+   }
+@@ -741,20 +741,20 @@ nsAccessNode::GetPresShellFor(nsIDOMNode
+   return presShell;
+ }
+ 
+-already_AddRefed<nsIDOMNode>
++nsIDOMNode*
+ nsAccessNode::GetDOMNodeForContainer(nsISupports *aContainer)
+ {
+   nsIDOMNode* node = nsnull;
+-  nsCOMPtr<nsIDocShell> shell = do_QueryInterface(aContainer);
+-  nsCOMPtr<nsIContentViewer> cv;
+-  shell->GetContentViewer(getter_AddRefs(cv));
++  nsIDocShell* shell = do_QueryInterface(aContainer);
++  nsIContentViewer* cv = nsnull;
++  shell->GetContentViewer(&cv);
+   if (cv) {
+-    nsCOMPtr<nsIDocumentViewer> docv(do_QueryInterface(cv));
++    nsIDocumentViewer* docv(do_QueryInterface(cv));
+     if (docv) {
+-      nsCOMPtr<nsIDocument> doc;
+-      docv->GetDocument(getter_AddRefs(doc));
++      nsIDocument* doc = nsnull;
++      docv->GetDocument(&doc);
+       if (doc) {
+-        CallQueryInterface(doc.get(), &node);
++        CallQueryInterface(doc, &node);
+       }
+     }
+   }
+@@ -787,7 +787,7 @@ PLDHashOperator nsAccessNode::ClearCache
+ {
+   NS_ASSERTION(aAccessNode, "Calling ClearCacheEntry with a NULL pointer!");
+   if (aAccessNode) {
+-    nsCOMPtr<nsPIAccessNode> privateAccessNode(do_QueryInterface(aAccessNode));
++    nsPIAccessNode* privateAccessNode(do_QueryInterface(aAccessNode));
+     privateAccessNode->Shutdown();
+   }
+ 
+@@ -800,14 +800,14 @@ nsAccessNode::ClearCache(nsAccessNodeHas
+   aCache.Enumerate(ClearCacheEntry, nsnull);
+ }
+ 
+-already_AddRefed<nsIDOMNode> nsAccessNode::GetCurrentFocus()
++nsIDOMNode* nsAccessNode::GetCurrentFocus()
+ {
+-  nsCOMPtr<nsIPresShell> shell = GetPresShellFor(mDOMNode);
++  nsIPresShell* shell = GetPresShellFor(mDOMNode);
+   NS_ENSURE_TRUE(shell, nsnull);
+-  nsCOMPtr<nsIDocument> doc = shell->GetDocument();
++  nsIDocument* doc = shell->GetDocument();
+   NS_ENSURE_TRUE(doc, nsnull);
+ 
+-  nsCOMPtr<nsPIDOMWindow> privateDOMWindow(do_QueryInterface(doc->GetWindow()));
++  nsPIDOMWindow* privateDOMWindow(do_QueryInterface(doc->GetWindow()));
+   if (!privateDOMWindow) {
+     return nsnull;
+   }
+@@ -815,18 +815,18 @@ already_AddRefed<nsIDOMNode> nsAccessNod
+   if (!focusController) {
+     return nsnull;
+   }
+-  nsCOMPtr<nsIDOMElement> focusedElement;
+-  focusController->GetFocusedElement(getter_AddRefs(focusedElement));
++  nsIDOMElement* focusedElement = nsnull;
++  focusController->GetFocusedElement(&focusedElement);
+   nsIDOMNode *focusedNode = nsnull;
+   if (!focusedElement) {
+     // Document itself has focus
+-    nsCOMPtr<nsIDOMWindowInternal> focusedWinInternal;
+-    focusController->GetFocusedWindow(getter_AddRefs(focusedWinInternal));
++    nsIDOMWindowInternal* focusedWinInternal = nsnull;
++    focusController->GetFocusedWindow(&focusedWinInternal);
+     if (!focusedWinInternal) {
+       return nsnull;
+     }
+-    nsCOMPtr<nsIDOMDocument> focusedDOMDocument;
+-    focusedWinInternal->GetDocument(getter_AddRefs(focusedDOMDocument));
++    nsIDOMDocument* focusedDOMDocument = nsnull;
++    focusedWinInternal->GetDocument(&focusedDOMDocument);
+     if (!focusedDOMDocument) {
+       return nsnull;
+     }
+@@ -843,22 +843,22 @@ nsAccessNode::GetLanguage(nsAString& aLa
+ nsAccessNode::GetLanguage(nsAString& aLanguage)
+ {
+   aLanguage.Truncate();
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   if (!content) {
+     // For documents make sure we look for lang attribute on
+     // document element
+-    nsCOMPtr<nsIDOMDocument> domDoc(do_QueryInterface(mDOMNode));
++    nsIDOMDocument* domDoc(do_QueryInterface(mDOMNode));
+     if (domDoc) {
+-      nsCOMPtr<nsIDOMHTMLDocument> htmlDoc(do_QueryInterface(mDOMNode));
++      nsIDOMHTMLDocument* htmlDoc(do_QueryInterface(mDOMNode));
+       if (htmlDoc) {
+         // Make sure we look for lang attribute on HTML <body>
+-        nsCOMPtr<nsIDOMHTMLElement> bodyElement;
+-        htmlDoc->GetBody(getter_AddRefs(bodyElement));
++        nsIDOMHTMLElement* bodyElement = nsnull;
++        htmlDoc->GetBody(&bodyElement);
+         content = do_QueryInterface(bodyElement);
+       }
+       if (!content) {
+-        nsCOMPtr<nsIDOMElement> docElement;
+-        domDoc->GetDocumentElement(getter_AddRefs(docElement));
++        nsIDOMElement* docElement = nsnull;
++        domDoc->GetDocumentElement(&docElement);
+         content = do_QueryInterface(docElement);
+       }
+     }
+diff --git a/accessible/src/base/nsAccessNode.h b/accessible/src/base/nsAccessNode.h
+--- a/accessible/src/base/nsAccessNode.h
++++ b/accessible/src/base/nsAccessNode.h
+@@ -88,7 +88,7 @@ class nsAccessNode: public nsIAccessNode
+     /**
+      * Return an application accessible.
+      */
+-    static already_AddRefed<nsApplicationAccessibleWrap> GetApplicationAccessible();
++    static nsApplicationAccessibleWrap* GetApplicationAccessible();
+ 
+     // Static methods for handling per-document cache
+     static void PutCacheEntry(nsAccessNodeHashtable& aCache,
+@@ -101,23 +101,23 @@ class nsAccessNode: public nsIAccessNode
+     HIDE_FROM_GARBURATOR(static PLDHashOperator PR_CALLBACK ClearCacheEntry(const void* aKey, nsCOMPtr<nsIAccessNode>& aAccessNode, void* aUserArg))
+ 
+     // Static cache methods for global document cache
+-    static already_AddRefed<nsIAccessibleDocument> GetDocAccessibleFor(nsIDocument *aDocument);
+-    static already_AddRefed<nsIAccessibleDocument> GetDocAccessibleFor(nsIWeakReference *aWeakShell);
+-    static already_AddRefed<nsIAccessibleDocument> GetDocAccessibleFor(nsIDocShellTreeItem *aContainer, PRBool aCanCreate = PR_FALSE);
+-    static already_AddRefed<nsIAccessibleDocument> GetDocAccessibleFor(nsIDOMNode *aNode);
++    static nsIAccessibleDocument* GetDocAccessibleFor(nsIDocument *aDocument);
++    static nsIAccessibleDocument* GetDocAccessibleFor(nsIWeakReference *aWeakShell);
++    static nsIAccessibleDocument* GetDocAccessibleFor(nsIDocShellTreeItem *aContainer, PRBool aCanCreate = PR_FALSE);
++    static nsIAccessibleDocument* GetDocAccessibleFor(nsIDOMNode *aNode);
+ 
+-    static already_AddRefed<nsIDOMNode> GetDOMNodeForContainer(nsISupports *aContainer);
+-    static already_AddRefed<nsIPresShell> GetPresShellFor(nsIDOMNode *aStartNode);
++    static nsIDOMNode* GetDOMNodeForContainer(nsISupports *aContainer);
++    static nsIPresShell* GetPresShellFor(nsIDOMNode *aStartNode);
+     
+     static void GetComputedStyleDeclaration(const nsAString& aPseudoElt,
+                                             nsIDOMElement *aElement,
+                                             nsIDOMCSSStyleDeclaration **aCssDecl);
+ 
+-    already_AddRefed<nsRootAccessible> GetRootAccessible();
++    nsRootAccessible* GetRootAccessible();
+ 
+     static nsIDOMNode *gLastFocusedNode;
+     static nsIAccessibilityService* GetAccService();
+-    already_AddRefed<nsIDOMNode> GetCurrentFocus();
++    nsIDOMNode* GetCurrentFocus();
+ 
+     /**
+      * Returns true when the accessible is defunct.
+@@ -126,9 +126,9 @@ class nsAccessNode: public nsIAccessNode
+ 
+ protected:
+     nsresult MakeAccessNode(nsIDOMNode *aNode, nsIAccessNode **aAccessNode);
+-    already_AddRefed<nsIPresShell> GetPresShell();
++    nsIPresShell* GetPresShell();
+     nsPresContext* GetPresContext();
+-    already_AddRefed<nsIAccessibleDocument> GetDocAccessible();
++    nsIAccessibleDocument* GetDocAccessible();
+     void LastRelease();
+ 
+     nsCOMPtr<nsIDOMNode> mDOMNode;
+diff --git a/accessible/src/base/nsAccessibilityService.cpp b/accessible/src/base/nsAccessibilityService.cpp
+--- a/accessible/src/base/nsAccessibilityService.cpp
++++ b/accessible/src/base/nsAccessibilityService.cpp
+@@ -119,13 +119,13 @@ nsAccessibilityService *nsAccessibilityS
+ 
+ nsAccessibilityService::nsAccessibilityService()
+ {
+-  nsCOMPtr<nsIObserverService> observerService = 
++  nsIObserverService* observerService = 
+     do_GetService("@mozilla.org/observer-service;1");
+   if (!observerService)
+     return;
+ 
+   observerService->AddObserver(this, NS_XPCOM_SHUTDOWN_OBSERVER_ID, PR_FALSE);
+-  nsCOMPtr<nsIWebProgress> progress(do_GetService(NS_DOCUMENTLOADER_SERVICE_CONTRACTID));
++  nsIWebProgress* progress(do_GetService(NS_DOCUMENTLOADER_SERVICE_CONTRACTID));
+   if (progress) {
+     progress->AddProgressListener(static_cast<nsIWebProgressListener*>(this),
+                                   nsIWebProgress::NOTIFY_STATE_DOCUMENT |
+@@ -150,18 +150,18 @@ nsAccessibilityService::Observe(nsISuppo
+                          const PRUnichar *aData)
+ {
+   if (!nsCRT::strcmp(aTopic, NS_XPCOM_SHUTDOWN_OBSERVER_ID)) {
+-    nsCOMPtr<nsIObserverService> observerService = 
++    nsIObserverService* observerService = 
+       do_GetService("@mozilla.org/observer-service;1");
+     if (observerService) {
+       observerService->RemoveObserver(this, NS_XPCOM_SHUTDOWN_OBSERVER_ID);
+     }
+-    nsCOMPtr<nsIWebProgress> progress(do_GetService(NS_DOCUMENTLOADER_SERVICE_CONTRACTID));
++    nsIWebProgress* progress(do_GetService(NS_DOCUMENTLOADER_SERVICE_CONTRACTID));
+     if (progress)
+       progress->RemoveProgressListener(static_cast<nsIWebProgressListener*>(this));
+     nsAccessNodeWrap::ShutdownAccessibility();
+     // Cancel and release load timers
+     while (mLoadTimers.Count() > 0 ) {
+-      nsCOMPtr<nsITimer> timer = mLoadTimers.ObjectAt(0);
++      nsITimer* timer = mLoadTimers.ObjectAt(0);
+       void *closure = nsnull;
+       timer->GetClosure(&closure);
+       if (closure) {
+@@ -193,7 +193,7 @@ NS_IMETHODIMP nsAccessibilityService::On
+   if (NS_FAILED(aStatus) && (aStateFlags & STATE_START))
+     return NS_OK;
+  
+-  nsCOMPtr<nsITimer> timer = do_CreateInstance("@mozilla.org/timer;1");
++  nsITimer* timer = do_CreateInstance("@mozilla.org/timer;1");
+   if (!timer)
+     return NS_OK;
+   mLoadTimers.AppendObject(timer);
+@@ -213,16 +213,16 @@ NS_IMETHODIMP nsAccessibilityService::On
+ 
+ NS_IMETHODIMP nsAccessibilityService::ProcessDocLoadEvent(nsITimer *aTimer, void *aClosure, PRUint32 aEventType)
+ {
+-  nsCOMPtr<nsIDOMWindow> domWindow;
++  nsIDOMWindow* domWindow = nsnull;
+   nsIWebProgress *webProgress = static_cast<nsIWebProgress*>(aClosure);
+-  webProgress->GetDOMWindow(getter_AddRefs(domWindow));
++  webProgress->GetDOMWindow(&domWindow);
+   NS_RELEASE(webProgress);
+   mLoadTimers.RemoveObject(aTimer);
+   NS_ENSURE_STATE(domWindow);
+ 
+   if (aEventType == nsIAccessibleEvent::EVENT_DOCUMENT_LOAD_START) {
+-    nsCOMPtr<nsIWebNavigation> webNav(do_GetInterface(domWindow));
+-    nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(webNav));
++    nsIWebNavigation* webNav(do_GetInterface(domWindow));
++    nsIDocShell* docShell(do_QueryInterface(webNav));
+     NS_ENSURE_STATE(docShell);
+     PRUint32 loadType;
+     docShell->GetLoadType(&loadType);
+@@ -234,14 +234,14 @@ NS_IMETHODIMP nsAccessibilityService::Pr
+     }
+   }
+       
+-  nsCOMPtr<nsIDOMDocument> domDoc;
+-  domWindow->GetDocument(getter_AddRefs(domDoc));
+-  nsCOMPtr<nsIDOMNode> docNode = do_QueryInterface(domDoc);
++  nsIDOMDocument* domDoc = nsnull;
++  domWindow->GetDocument(&domDoc);
++  nsIDOMNode* docNode = do_QueryInterface(domDoc);
+   NS_ENSURE_STATE(docNode);
+ 
+-  nsCOMPtr<nsIAccessible> accessible;
+-  GetAccessibleFor(docNode, getter_AddRefs(accessible));
+-  nsCOMPtr<nsPIAccessibleDocument> privDocAccessible = do_QueryInterface(accessible);
++  nsIAccessible* accessible = nsnull;
++  GetAccessibleFor(docNode, &accessible);
++  nsPIAccessibleDocument* privDocAccessible = do_QueryInterface(accessible);
+   NS_ENSURE_STATE(privDocAccessible);
+   privDocAccessible->FireDocLoadEvents(aEventType);
+ 
+@@ -287,19 +287,19 @@ NS_IMETHODIMP nsAccessibilityService::On
+   // If there is no accessible for the document, we will ignore
+   // this and the anchor jump event will be fired via OnStateChange
+   // and nsIAccessibleStates::STATE_STOP
+-  nsCOMPtr<nsIDOMWindow> domWindow;
+-  aWebProgress->GetDOMWindow(getter_AddRefs(domWindow));
++  nsIDOMWindow* domWindow = nsnull;
++  aWebProgress->GetDOMWindow(&domWindow);
+   NS_ASSERTION(domWindow, "DOM Window for state change is null");
+   NS_ENSURE_TRUE(domWindow, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIDOMDocument> domDoc;
+-  domWindow->GetDocument(getter_AddRefs(domDoc));
+-  nsCOMPtr<nsIDOMNode> domDocRootNode(do_QueryInterface(domDoc));
++  nsIDOMDocument* domDoc = nsnull;
++  domWindow->GetDocument(&domDoc);
++  nsIDOMNode* domDocRootNode(do_QueryInterface(domDoc));
+   NS_ENSURE_TRUE(domDocRootNode, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIAccessibleDocument> accessibleDoc =
++  nsIAccessibleDocument* accessibleDoc =
+     nsAccessNode::GetDocAccessibleFor(domDocRootNode);
+-  nsCOMPtr<nsPIAccessibleDocument> privateAccessibleDoc =
++  nsPIAccessibleDocument* privateAccessibleDoc =
+     do_QueryInterface(accessibleDoc);
+   if (!privateAccessibleDoc) {
+     return NS_OK;
+@@ -329,21 +329,21 @@ nsAccessibilityService::GetInfo(nsISuppo
+ {
+   NS_ASSERTION(aFrame,"Error -- 1st argument (aFrame) is null!!");
+   *aRealFrame = static_cast<nsIFrame*>(aFrame);
+-  nsCOMPtr<nsIContent> content = (*aRealFrame)->GetContent();
+-  nsCOMPtr<nsIDOMNode> node(do_QueryInterface(content));
++  nsIContent* content = (*aRealFrame)->GetContent();
++  nsIDOMNode* node(do_QueryInterface(content));
+   if (!content || !node)
+     return NS_ERROR_FAILURE;
+   *aNode = node;
+   NS_IF_ADDREF(*aNode);
+ 
+-  nsCOMPtr<nsIDocument> document = content->GetDocument();
++  nsIDocument* document = content->GetDocument();
+   if (!document)
+     return NS_ERROR_FAILURE;
+ 
+   NS_ASSERTION(document->GetPrimaryShell(),"Error no shells!");
+ 
+   // do_GetWR only works into a |nsCOMPtr| :-(
+-  nsCOMPtr<nsIWeakReference> weakShell =
++  nsIWeakReference* weakShell =
+     do_GetWeakReference(document->GetPrimaryShell());
+   NS_IF_ADDREF(*aShell = weakShell);
+ 
+@@ -353,9 +353,9 @@ nsresult
+ nsresult
+ nsAccessibilityService::GetShellFromNode(nsIDOMNode *aNode, nsIWeakReference **aWeakShell)
+ {
+-  nsCOMPtr<nsIDOMDocument> domDoc;
+-  aNode->GetOwnerDocument(getter_AddRefs(domDoc));
+-  nsCOMPtr<nsIDocument> doc(do_QueryInterface(domDoc));
++  nsIDOMDocument* domDoc = nsnull;
++  aNode->GetOwnerDocument(&domDoc);
++  nsIDocument* doc(do_QueryInterface(domDoc));
+   if (!doc)
+     return NS_ERROR_INVALID_ARG;
+ 
+@@ -364,7 +364,7 @@ nsAccessibilityService::GetShellFromNode
+   if (!shell)
+     return NS_ERROR_FAILURE;
+ 
+-  nsCOMPtr<nsIWeakReference> weakRef(do_GetWeakReference(shell));
++  nsIWeakReference* weakRef(do_GetWeakReference(shell));
+   
+   *aWeakShell = weakRef;
+   NS_IF_ADDREF(*aWeakShell);
+@@ -384,8 +384,8 @@ nsAccessibilityService::CreateOuterDocAc
+   
+   *aOuterDocAccessible = nsnull;
+ 
+-  nsCOMPtr<nsIWeakReference> outerWeakShell;
+-  GetShellFromNode(aDOMNode, getter_AddRefs(outerWeakShell));
++  nsIWeakReference* outerWeakShell = nsnull;
++  GetShellFromNode(aDOMNode, &outerWeakShell);
+   NS_ENSURE_TRUE(outerWeakShell, NS_ERROR_FAILURE);
+ 
+   nsOuterDocAccessible *outerDocAccessible =
+@@ -404,27 +404,27 @@ nsAccessibilityService::CreateRootAccess
+ {
+   *aRootAcc = nsnull;
+ 
+-  nsCOMPtr<nsIDOMNode> rootNode(do_QueryInterface(aDocument));
++  nsIDOMNode* rootNode(do_QueryInterface(aDocument));
+   NS_ENSURE_TRUE(rootNode, NS_ERROR_FAILURE);
+ 
+   nsIPresShell *presShell = aShell;
+   if (!presShell) {
+     presShell = aDocument->GetPrimaryShell();
+   }
+-  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(presShell));
++  nsIWeakReference* weakShell(do_GetWeakReference(presShell));
+ 
+-  nsCOMPtr<nsISupports> container = aDocument->GetContainer();
+-  nsCOMPtr<nsIDocShell> docShell = do_QueryInterface(container);
++  nsISupports* container = aDocument->GetContainer();
++  nsIDocShell* docShell = do_QueryInterface(container);
+   NS_ENSURE_TRUE(docShell, NS_ERROR_FAILURE);
+-  nsCOMPtr<nsIContentViewer> contentViewer;
+-  docShell->GetContentViewer(getter_AddRefs(contentViewer));
++  nsIContentViewer* contentViewer = nsnull;
++  docShell->GetContentViewer(&contentViewer);
+   NS_ENSURE_TRUE(contentViewer, NS_ERROR_FAILURE); // Doc was already shut down
+   PRUint32 busyFlags;
+   docShell->GetBusyFlags(&busyFlags);
+   if (busyFlags != nsIDocShell::BUSY_FLAGS_NONE) {
+-    nsCOMPtr<nsIWebNavigation> webNav(do_GetInterface(docShell));
+-    nsCOMPtr<nsIURI> uri;
+-    webNav->GetCurrentURI(getter_AddRefs(uri));
++    nsIWebNavigation* webNav(do_GetInterface(docShell));
++    nsIURI* uri = nsnull;
++    webNav->GetCurrentURI(&uri);
+     NS_ENSURE_STATE(uri);
+     nsCAutoString url;
+     uri->GetSpec(url);
+@@ -433,12 +433,12 @@ nsAccessibilityService::CreateRootAccess
+     }
+   }
+ 
+-  nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem =
++  nsIDocShellTreeItem* docShellTreeItem =
+     do_QueryInterface(container);
+   NS_ENSURE_TRUE(docShellTreeItem, NS_ERROR_FAILURE);
+   
+-  nsCOMPtr<nsIDocShellTreeItem> parentTreeItem;
+-  docShellTreeItem->GetParent(getter_AddRefs(parentTreeItem));
++  nsIDocShellTreeItem* parentTreeItem = nsnull;
++  docShellTreeItem->GetParent(&parentTreeItem);
+ 
+   if (parentTreeItem) {
+     // We only create root accessibles for the true root, othewise create a
+@@ -451,10 +451,10 @@ nsAccessibilityService::CreateRootAccess
+   if (!*aRootAcc)
+     return NS_ERROR_OUT_OF_MEMORY;
+ 
+-  nsCOMPtr<nsPIAccessNode> privateAccessNode(do_QueryInterface(*aRootAcc));
++  nsPIAccessNode* privateAccessNode(do_QueryInterface(*aRootAcc));
+   privateAccessNode->Init();
+   nsRoleMapEntry *roleMapEntry = nsAccUtils::GetRoleMapEntry(rootNode);
+-  nsCOMPtr<nsPIAccessible> privateAccessible =
++  nsPIAccessible* privateAccessible =
+     do_QueryInterface(privateAccessNode);
+   privateAccessible->SetRoleMapEntry(roleMapEntry);
+ 
+@@ -470,9 +470,9 @@ nsAccessibilityService::CreateHTML4Butto
+ nsAccessibilityService::CreateHTML4ButtonAccessible(nsISupports *aFrame, nsIAccessible **_retval)
+ {
+   nsIFrame* frame;
+-  nsCOMPtr<nsIDOMNode> node;
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
++  nsIDOMNode* node = nsnull;
++  nsIWeakReference* weakShell = nsnull;
++  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -488,9 +488,9 @@ nsAccessibilityService::CreateHTMLButton
+ nsAccessibilityService::CreateHTMLButtonAccessible(nsISupports *aFrame, nsIAccessible **_retval)
+ {
+   nsIFrame* frame;
+-  nsCOMPtr<nsIDOMNode> node;
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
++  nsIDOMNode* node = nsnull;
++  nsIWeakReference* weakShell = nsnull;
++  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -510,7 +510,7 @@ nsAccessibilityService::CreateHTMLAccess
+ {
+   // This method assumes we're in an HTML namespace.
+   *aAccessible = nsnull;
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(aNode));
++  nsIContent* content(do_QueryInterface(aNode));
+   nsIAtom *tag = content->Tag();
+   if (tag == nsAccessibilityAtoms::legend) {
+     *aAccessible = new nsHTMLLegendAccessible(aNode, aWeakShell);
+@@ -564,9 +564,9 @@ nsAccessibilityService::CreateHTMLLIAcce
+                                                nsIAccessible **_retval)
+ {
+   nsIFrame* frame;
+-  nsCOMPtr<nsIDOMNode> node;
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
++  nsIDOMNode* node = nsnull;
++  nsIWeakReference* weakShell = nsnull;
++  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -582,13 +582,13 @@ nsAccessibilityService::CreateHyperTextA
+ nsAccessibilityService::CreateHyperTextAccessible(nsISupports *aFrame, nsIAccessible **aAccessible)
+ {
+   nsIFrame* frame;
+-  nsCOMPtr<nsIDOMNode> node;
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
++  nsIDOMNode* node = nsnull;
++  nsIWeakReference* weakShell = nsnull;
++  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(node));
++  nsIContent* content(do_QueryInterface(node));
+   NS_ENSURE_TRUE(content, NS_ERROR_FAILURE);
+   
+   if (nsAccUtils::HasListener(content, NS_LITERAL_STRING("click"))) {
+@@ -610,9 +610,9 @@ nsAccessibilityService::CreateHTMLCheckb
+ nsAccessibilityService::CreateHTMLCheckboxAccessible(nsISupports *aFrame, nsIAccessible **_retval)
+ {
+   nsIFrame* frame;
+-  nsCOMPtr<nsIDOMNode> node;
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
++  nsIDOMNode* node = nsnull;
++  nsIWeakReference* weakShell = nsnull;
++  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -639,14 +639,14 @@ nsAccessibilityService::CreateHTMLImageA
+ nsAccessibilityService::CreateHTMLImageAccessible(nsISupports *aFrame, nsIAccessible **_retval)
+ {
+   nsIFrame* frame;
+-  nsCOMPtr<nsIDOMNode> node;
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
++  nsIDOMNode* node = nsnull;
++  nsIWeakReference* weakShell = nsnull;
++  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+   *_retval = nsnull;
+-  nsCOMPtr<nsIDOMElement> domElement(do_QueryInterface(node));
++  nsIDOMElement* domElement(do_QueryInterface(node));
+   if (domElement) {
+       *_retval = new nsHTMLImageAccessibleWrap(node, weakShell);
+   }
+@@ -668,9 +668,9 @@ nsAccessibilityService::CreateHTMLGroupb
+ nsAccessibilityService::CreateHTMLGroupboxAccessible(nsISupports *aFrame, nsIAccessible **_retval)
+ {
+   nsIFrame* frame;
+-  nsCOMPtr<nsIDOMNode> node;
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
++  nsIDOMNode* node = nsnull;
++  nsIWeakReference* weakShell = nsnull;
++  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -706,20 +706,20 @@ nsAccessibilityService::CreateHTMLObject
+ nsAccessibilityService::CreateHTMLObjectFrameAccessible(nsObjectFrame *aFrame,
+                                                         nsIAccessible **aAccessible)
+ {
+-  nsCOMPtr<nsIDOMNode> node;
+-  nsCOMPtr<nsIWeakReference> weakShell;
++  nsIDOMNode* node = nsnull;
++  nsIWeakReference* weakShell = nsnull;
+   nsIFrame *frame;
+-  GetInfo(static_cast<nsIFrame*>(aFrame), &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
++  GetInfo(static_cast<nsIFrame*>(aFrame), &frame, &weakShell, &node);
+ 
+   *aAccessible = nsnull;
+   if (!frame || frame->GetRect().IsEmpty()) {
+     return NS_ERROR_FAILURE;
+   }
+   // 1) for object elements containing either HTML or TXT documents
+-  nsCOMPtr<nsIDOMDocument> domDoc;
+-  nsCOMPtr<nsIDOMHTMLObjectElement> obj(do_QueryInterface(node));
++  nsIDOMDocument* domDoc = nsnull;
++  nsIDOMHTMLObjectElement* obj(do_QueryInterface(node));
+   if (obj)
+-    obj->GetContentDocument(getter_AddRefs(domDoc));
++    obj->GetContentDocument(&domDoc);
+   else
+     domDoc = do_QueryInterface(node);
+   if (domDoc)
+@@ -755,9 +755,9 @@ nsAccessibilityService::CreateHTMLRadioB
+ nsAccessibilityService::CreateHTMLRadioButtonAccessible(nsISupports *aFrame, nsIAccessible **_retval)
+ {
+   nsIFrame* frame;
+-  nsCOMPtr<nsIDOMNode> node;
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
++  nsIDOMNode* node = nsnull;
++  nsIWeakReference* weakShell = nsnull;
++  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -787,9 +787,9 @@ nsAccessibilityService::CreateHTMLTableA
+ nsAccessibilityService::CreateHTMLTableAccessible(nsISupports *aFrame, nsIAccessible **_retval)
+ {
+   nsIFrame* frame;
+-  nsCOMPtr<nsIDOMNode> node;
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
++  nsIDOMNode* node = nsnull;
++  nsIWeakReference* weakShell = nsnull;
++  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -812,8 +812,8 @@ nsAccessibilityService::CreateHTMLTableH
+ 
+   nsresult rv = NS_OK;
+ 
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  rv = GetShellFromNode(aDOMNode, getter_AddRefs(weakShell));
++  nsIWeakReference* weakShell = nsnull;
++  rv = GetShellFromNode(aDOMNode, &weakShell);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+   nsHTMLTableHeadAccessibleWrap* accTableHead =
+@@ -832,9 +832,9 @@ nsAccessibilityService::CreateHTMLTableC
+ nsAccessibilityService::CreateHTMLTableCellAccessible(nsISupports *aFrame, nsIAccessible **_retval)
+ {
+   nsIFrame* frame;
+-  nsCOMPtr<nsIDOMNode> node;
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
++  nsIDOMNode* node = nsnull;
++  nsIWeakReference* weakShell = nsnull;
++  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -852,9 +852,9 @@ nsAccessibilityService::CreateHTMLTextAc
+   *_retval = nsnull;
+ 
+   nsIFrame* frame;
+-  nsCOMPtr<nsIDOMNode> node;
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
++  nsIDOMNode* node = nsnull;
++  nsIWeakReference* weakShell = nsnull;
++  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -871,9 +871,9 @@ nsAccessibilityService::CreateHTMLTextFi
+ nsAccessibilityService::CreateHTMLTextFieldAccessible(nsISupports *aFrame, nsIAccessible **_retval)
+ {
+   nsIFrame* frame;
+-  nsCOMPtr<nsIDOMNode> node;
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
++  nsIDOMNode* node = nsnull;
++  nsIWeakReference* weakShell = nsnull;
++  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -889,9 +889,9 @@ nsAccessibilityService::CreateHTMLLabelA
+ nsAccessibilityService::CreateHTMLLabelAccessible(nsISupports *aFrame, nsIAccessible **_retval)
+ {
+   nsIFrame* frame;
+-  nsCOMPtr<nsIDOMNode> node;
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
++  nsIDOMNode* node = nsnull;
++  nsIWeakReference* weakShell = nsnull;
++  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -907,9 +907,9 @@ nsAccessibilityService::CreateHTMLHRAcce
+ nsAccessibilityService::CreateHTMLHRAccessible(nsISupports *aFrame, nsIAccessible **_retval)
+ {
+   nsIFrame* frame;
+-  nsCOMPtr<nsIDOMNode> node;
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
++  nsIDOMNode* node = nsnull;
++  nsIWeakReference* weakShell = nsnull;
++  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -925,9 +925,9 @@ nsAccessibilityService::CreateHTMLBRAcce
+ nsAccessibilityService::CreateHTMLBRAccessible(nsISupports *aFrame, nsIAccessible **_retval)
+ {
+   nsIFrame* frame;
+-  nsCOMPtr<nsIDOMNode> node;
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
++  nsIDOMNode* node = nsnull;
++  nsIWeakReference* weakShell = nsnull;
++  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -943,9 +943,9 @@ nsAccessibilityService::CreateHTMLCaptio
+ nsAccessibilityService::CreateHTMLCaptionAccessible(nsISupports *aFrame, nsIAccessible **_retval)
+ {
+   nsIFrame* frame;
+-  nsCOMPtr<nsIDOMNode> node;
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
++  nsIDOMNode* node = nsnull;
++  nsIWeakReference* weakShell = nsnull;
++  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -961,9 +961,9 @@ NS_IMETHODIMP nsAccessibilityService::Ge
+                                                           nsIWeakReference *aWeakShell,
+                                                           nsIAccessible **aAccessible)
+ {
+-  nsCOMPtr<nsIAccessNode> accessNode;
+-  nsresult rv = GetCachedAccessNode(aNode, aWeakShell, getter_AddRefs(accessNode));
+-  nsCOMPtr<nsIAccessible> accessible(do_QueryInterface(accessNode));
++  nsIAccessNode* accessNode = nsnull;
++  nsresult rv = GetCachedAccessNode(aNode, aWeakShell, &accessNode);
++  nsIAccessible* accessible(do_QueryInterface(accessNode));
+   NS_IF_ADDREF(*aAccessible = accessible);
+   return rv;
+ }
+@@ -972,7 +972,7 @@ NS_IMETHODIMP nsAccessibilityService::Ge
+                                                           nsIWeakReference *aWeakShell,
+                                                           nsIAccessNode **aAccessNode)
+ {
+-  nsCOMPtr<nsIAccessibleDocument> accessibleDoc =
++  nsIAccessibleDocument* accessibleDoc =
+     nsAccessNode::GetDocAccessibleFor(aWeakShell);
+ 
+   if (!accessibleDoc) {
+@@ -1158,8 +1158,8 @@ nsAccessibilityService::GetAccessibleFor
+ 
+   // We use presentation shell #0 because we assume that is presentation of
+   // given node window.
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(aNode));
+-  nsCOMPtr<nsIDocument> doc;
++  nsIContent* content(do_QueryInterface(aNode));
++  nsIDocument* doc = nsnull;
+   if (content) {
+     doc = content->GetDocument();
+   }
+@@ -1182,8 +1182,8 @@ nsAccessibilityService::GetAttachedAcces
+ 
+   *aAccessible = nsnull;
+ 
+-  nsCOMPtr<nsIDOMNode> relevantNode;
+-  nsresult rv = GetRelevantContentNodeFor(aNode, getter_AddRefs(relevantNode));
++  nsIDOMNode* relevantNode = nsnull;
++  nsresult rv = GetRelevantContentNodeFor(aNode, &relevantNode);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+   if (relevantNode != aNode)
+@@ -1202,13 +1202,13 @@ NS_IMETHODIMP nsAccessibilityService::Ge
+   NS_ENSURE_ARG(aNode);
+   NS_ENSURE_ARG(aWin);
+ 
+-  nsCOMPtr<nsIWebNavigation> webNav(do_GetInterface(aWin));
+-  nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(webNav));
++  nsIWebNavigation* webNav(do_GetInterface(aWin));
++  nsIDocShell* docShell(do_QueryInterface(webNav));
+   if (!docShell)
+     return NS_ERROR_FAILURE;
+ 
+-  nsCOMPtr<nsIPresShell> presShell;
+-  docShell->GetPresShell(getter_AddRefs(presShell));
++  nsIPresShell* presShell = nsnull;
++  docShell->GetPresShell(&presShell);
+   return GetAccessibleInShell(aNode, presShell, aAccessible);
+ }
+ 
+@@ -1222,7 +1222,7 @@ NS_IMETHODIMP nsAccessibilityService::Ge
+   NS_ENSURE_ARG(aNode);
+   NS_ENSURE_ARG(aPresShell);
+ 
+-  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
++  nsIWeakReference* weakShell(do_GetWeakReference(aPresShell));
+   nsIFrame *outFrameUnused = NULL;
+   PRBool isHiddenUnused = false;
+   return GetAccessible(aNode, aPresShell, weakShell, 
+@@ -1239,7 +1239,7 @@ NS_IMETHODIMP nsAccessibilityService::Ge
+   NS_ENSURE_ARG(aNode);
+   NS_ENSURE_ARG(aWeakShell);
+ 
+-  nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(aWeakShell));
++  nsIPresShell* presShell(do_QueryReferent(aWeakShell));
+   nsIFrame *outFrameUnused = NULL;
+   PRBool isHiddenUnused = false;
+   return GetAccessible(aNode, presShell, aWeakShell, 
+@@ -1255,11 +1255,11 @@ nsresult nsAccessibilityService::InitAcc
+   }
+   NS_ASSERTION(aAccessibleOut && !*aAccessibleOut, "Out param should already be cleared out");
+ 
+-  nsCOMPtr<nsPIAccessNode> privateAccessNode = do_QueryInterface(aAccessibleIn);
++  nsPIAccessNode* privateAccessNode = do_QueryInterface(aAccessibleIn);
+   NS_ASSERTION(privateAccessNode, "All accessibles must support nsPIAccessNode");
+   nsresult rv = privateAccessNode->Init(); // Add to cache, etc.
+   if (NS_SUCCEEDED(rv)) {
+-    nsCOMPtr<nsPIAccessible> privateAccessible =
++    nsPIAccessible* privateAccessible =
+       do_QueryInterface(privateAccessNode);
+     privateAccessible->SetRoleMapEntry(aRoleMapEntry);
+     NS_ADDREF(*aAccessibleOut = aAccessibleIn);
+@@ -1330,10 +1330,10 @@ NS_IMETHODIMP nsAccessibilityService::Ge
+ 
+   // Check to see if we already have an accessible for this
+   // node in the cache
+-  nsCOMPtr<nsIAccessNode> accessNode;
+-  GetCachedAccessNode(aNode, aWeakShell, getter_AddRefs(accessNode));
++  nsIAccessNode* accessNode = nsnull;
++  GetCachedAccessNode(aNode, aWeakShell, &accessNode);
+ 
+-  nsCOMPtr<nsIAccessible> newAcc;
++  nsIAccessible* newAcc = nsnull;
+   if (accessNode) {
+     // Retrieved from cache. QI might not succeed if it's a node that's not
+     // accessible. In this case try to create new accessible because one and
+@@ -1346,25 +1346,25 @@ NS_IMETHODIMP nsAccessibilityService::Ge
+     }
+   }
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(aNode));
++  nsIContent* content(do_QueryInterface(aNode));
+ 
+   // No cache entry, so we must create the accessible
+   // Check to see if hidden first
+-  nsCOMPtr<nsIDocument> nodeIsDoc;
++  nsIDocument* nodeIsDoc = nsnull;
+   if (!content) {
+     // This happens when we're on the document node, which will not QI to an
+     // nsIContent.
+     nodeIsDoc = do_QueryInterface(aNode);
+     NS_ENSURE_TRUE(nodeIsDoc, NS_ERROR_FAILURE); // No content, and not doc node
+ 
+-    nsCOMPtr<nsIAccessibleDocument> accessibleDoc =
++    nsIAccessibleDocument* accessibleDoc =
+       nsAccessNode::GetDocAccessibleFor(aWeakShell);
+     if (accessibleDoc) {
+       newAcc = do_QueryInterface(accessibleDoc);
+       NS_ASSERTION(newAcc, "nsIAccessibleDocument is not an nsIAccessible");
+     }
+     else {
+-      CreateRootAccessible(aPresShell, nodeIsDoc, getter_AddRefs(newAcc)); // Does Init() for us
++      CreateRootAccessible(aPresShell, nodeIsDoc, &newAcc); // Does Init() for us
+       NS_WARN_IF_FALSE(newAcc, "No root/doc accessible created");
+     }
+ 
+@@ -1413,10 +1413,10 @@ NS_IMETHODIMP nsAccessibilityService::Ge
+         // Check if frame is an image frame, and content is <area>
+         nsIImageFrame *imageFrame;
+         CallQueryInterface(frame, &imageFrame);
+-        nsCOMPtr<nsIDOMHTMLAreaElement> areaElmt = do_QueryInterface(content);
++        nsIDOMHTMLAreaElement* areaElmt = do_QueryInterface(content);
+         if (imageFrame && areaElmt) {
+-          nsCOMPtr<nsIAccessible> imageAcc;
+-          CreateHTMLImageAccessible(frame, getter_AddRefs(imageAcc));
++          nsIAccessible* imageAcc = nsnull;
++          CreateHTMLImageAccessible(frame, &imageAcc);
+           if (imageAcc) {
+             // cache children
+             PRInt32 childCount;
+@@ -1454,7 +1454,7 @@ NS_IMETHODIMP nsAccessibilityService::Ge
+         return NS_OK;
+       }
+     }
+-    frame->GetAccessible(getter_AddRefs(newAcc));
++    frame->GetAccessible(&newAcc);
+     return InitAccessible(newAcc, aAccessible, nsnull);
+   }
+ 
+@@ -1475,7 +1475,7 @@ NS_IMETHODIMP nsAccessibilityService::Ge
+       return NS_OK;
+     }
+     
+-    nsresult rv = CreateHyperTextAccessible(frame, getter_AddRefs(newAcc));
++    nsresult rv = CreateHyperTextAccessible(frame, &newAcc);
+     NS_ENSURE_SUCCESS(rv, rv);
+   }
+ 
+@@ -1490,7 +1490,7 @@ NS_IMETHODIMP nsAccessibilityService::Ge
+ 
+   // Elements may implement nsIAccessibleProvider via XBL. This allows them to
+   // say what kind of accessible to create.
+-  nsresult rv = GetAccessibleByType(aNode, getter_AddRefs(newAcc));
++  nsresult rv = GetAccessibleByType(aNode, &newAcc);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+   if (!newAcc && !isHTML) {
+@@ -1522,9 +1522,9 @@ NS_IMETHODIMP nsAccessibilityService::Ge
+         if (!tableFrame)
+           continue;
+         if (tableFrame->GetType() == nsAccessibilityAtoms::tableOuterFrame) {
+-          nsCOMPtr<nsIDOMNode> tableNode(do_QueryInterface(tableContent));
+-          nsCOMPtr<nsIAccessible> tableAccessible;
+-          GetAccessibleInShell(tableNode, aPresShell, getter_AddRefs(tableAccessible));
++          nsIDOMNode* tableNode(do_QueryInterface(tableContent));
++          nsIAccessible* tableAccessible = nsnull;
++          GetAccessibleInShell(tableNode, aPresShell, &tableAccessible);
+           if (!tableAccessible && !content->IsFocusable()) {
+ #ifdef DEBUG
+             nsRoleMapEntry *tableRoleMapEntry = nsAccUtils::GetRoleMapEntry(tableNode);
+@@ -1562,7 +1562,7 @@ NS_IMETHODIMP nsAccessibilityService::Ge
+       // we do not call it if accessibles for table related content are
+       // prevented above.
+       rv = CreateHTMLAccessibleByMarkup(frame, aWeakShell, aNode,
+-                                        getter_AddRefs(newAcc));
++                                        &newAcc);
+       NS_ENSURE_SUCCESS(rv, rv);
+ 
+       if (!newAcc) {
+@@ -1579,13 +1579,13 @@ NS_IMETHODIMP nsAccessibilityService::Ge
+           *aIsHidden = PR_TRUE;
+           return NS_OK;
+         }
+-        frame->GetAccessible(getter_AddRefs(newAcc)); // Try using frame to do it
++        frame->GetAccessible(&newAcc); // Try using frame to do it
+       }
+     }
+   }
+ 
+   if (!newAcc) {
+-    GetAccessibleForDeckChildren(aNode, getter_AddRefs(newAcc));
++    GetAccessibleForDeckChildren(aNode, &newAcc);
+   }
+ 
+   // If no accessible, see if we need to create a generic accessible because
+@@ -1602,7 +1602,7 @@ NS_IMETHODIMP nsAccessibilityService::Ge
+     // other accessibles can point to it, or so that it can hold a state, etc.
+     if (isHTML) {
+       // Interesting HTML container which may have selectable text and/or embedded objects
+-      CreateHyperTextAccessible(frame, getter_AddRefs(newAcc));
++      CreateHyperTextAccessible(frame, &newAcc);
+     }
+     else {  // XUL, SVG, MathML etc.
+       // Interesting generic non-HTML container
+@@ -1663,7 +1663,7 @@ nsAccessibilityService::GetRelevantConte
+   NS_ENSURE_ARG_POINTER(aRelevantNode);
+ 
+   nsresult rv;
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(aNode));
++  nsIContent* content(do_QueryInterface(aNode));
+   if (content) {
+     // Build stack of binding parents so we can walk it in reverse.
+     nsIContent *bindingParent;
+@@ -1678,15 +1678,15 @@ nsAccessibilityService::GetRelevantConte
+     PRInt32 bindingsCount = bindingsStack.Count();
+     for (PRInt32 index = bindingsCount - 1; index >= 0 ; index--) {
+       bindingParent = bindingsStack[index];
+-      nsCOMPtr<nsIDOMNode> bindingNode(do_QueryInterface(bindingParent));
++      nsIDOMNode* bindingNode(do_QueryInterface(bindingParent));
+       if (bindingNode) {
+         // Try to get an accessible by type since XBL widget can be accessible
+         // only if it implements nsIAccessibleProvider interface.
+-        nsCOMPtr<nsIAccessible> accessible;
+-        rv = GetAccessibleByType(bindingNode, getter_AddRefs(accessible));
++        nsIAccessible* accessible = nsnull;
++        rv = GetAccessibleByType(bindingNode, &accessible);
+ 
+         if (NS_SUCCEEDED(rv)) {
+-          nsCOMPtr<nsPIAccessible> paccessible(do_QueryInterface(accessible));
++          nsPIAccessible* paccessible(do_QueryInterface(accessible));
+           if (paccessible) {
+             PRBool allowsAnonChildren = PR_FALSE;
+             paccessible->GetAllowsAnonChildAccessibles(&allowsAnonChildren);
+@@ -1712,7 +1712,7 @@ nsresult nsAccessibilityService::GetAcce
+ 
+   *aAccessible = nsnull;
+ 
+-  nsCOMPtr<nsIAccessibleProvider> accessibleProvider(do_QueryInterface(aNode));
++  nsIAccessibleProvider* accessibleProvider(do_QueryInterface(aNode));
+   if (!accessibleProvider)
+     return NS_OK;
+ 
+@@ -1723,8 +1723,8 @@ nsresult nsAccessibilityService::GetAcce
+   if (type == nsIAccessibleProvider::OuterDoc)
+     return CreateOuterDocAccessible(aNode, aAccessible);
+ 
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  GetShellFromNode(aNode, getter_AddRefs(weakShell));
++  nsIWeakReference* weakShell = nsnull;
++  GetShellFromNode(aNode, &weakShell);
+ 
+   switch (type)
+   {
+@@ -1759,7 +1759,7 @@ nsresult nsAccessibilityService::GetAcce
+     case nsIAccessibleProvider::XULImage:
+     {
+       // Don't include nameless images in accessible tree
+-      nsCOMPtr<nsIDOMElement> elt(do_QueryInterface(aNode));
++      nsIDOMElement* elt(do_QueryInterface(aNode));
+       if (!elt)
+         return NS_ERROR_FAILURE;
+ 
+@@ -1804,7 +1804,7 @@ nsresult nsAccessibilityService::GetAcce
+       // XXX In the future we will should this for consistency across the nsIAccessible
+       // implementations on each platform for a consistent scripting environment, but
+       // then strip out redundant accessibles in the nsAccessibleWrap class for each platform.
+-      nsCOMPtr<nsIContent> content = do_QueryInterface(aNode);
++      nsIContent* content = do_QueryInterface(aNode);
+       if (content) {
+         nsIContent *parent = content->GetParent();
+         if (parent && parent->NodeInfo()->Equals(nsAccessibilityAtoms::menu, kNameSpaceID_XUL)) {
+@@ -1960,7 +1960,7 @@ NS_IMETHODIMP nsAccessibilityService::Ad
+   *aRootAccessible = static_cast<nsIAccessible*>(rootAccWrap);
+   NS_ADDREF(*aRootAccessible);
+ 
+-  nsRefPtr<nsApplicationAccessibleWrap> appRoot =
++  nsApplicationAccessibleWrap* appRoot =
+     nsAccessNode::GetApplicationAccessible();
+   NS_ENSURE_STATE(appRoot);
+ 
+@@ -1978,7 +1978,7 @@ NS_IMETHODIMP nsAccessibilityService::Re
+   void* atkAccessible;
+   aRootAccessible->GetNativeInterface(&atkAccessible);
+ 
+-  nsRefPtr<nsApplicationAccessibleWrap> appRoot =
++  nsApplicationAccessibleWrap* appRoot =
+     nsAccessNode::GetApplicationAccessible();
+   NS_ENSURE_STATE(appRoot);
+ 
+@@ -2004,9 +2004,9 @@ NS_IMETHODIMP nsAccessibilityService::In
+                "Incorrect aEvent passed in");
+ 
+   NS_ENSURE_ARG_POINTER(aShell);
+-  nsCOMPtr<nsIAccessibleDocument> accessibleDoc =
++  nsIAccessibleDocument* accessibleDoc =
+     nsAccessNode::GetDocAccessibleFor(aShell->GetDocument());
+-  nsCOMPtr<nsPIAccessibleDocument> privateAccessibleDoc =
++  nsPIAccessibleDocument* privateAccessibleDoc =
+     do_QueryInterface(accessibleDoc);
+   if (!privateAccessibleDoc) {
+     return NS_OK;
+@@ -2045,15 +2045,15 @@ nsresult
+ nsresult
+ nsAccessibilityService::GetAccessibleForDeckChildren(nsIDOMNode *aNode, nsIAccessible** aAccessible)
+ {
+-  nsCOMPtr<nsIWeakReference> weakShell;
+-  GetShellFromNode(aNode, getter_AddRefs(weakShell));
++  nsIWeakReference* weakShell = nsnull;
++  GetShellFromNode(aNode, &weakShell);
+   NS_ENSURE_TRUE(weakShell, NS_ERROR_FAILURE);
+-  nsCOMPtr<nsIPresShell> shell(do_QueryReferent(weakShell));
++  nsIPresShell* shell(do_QueryReferent(weakShell));
+   NS_ENSURE_TRUE(shell, NS_ERROR_FAILURE);
+   
+   nsIFrame* frame = nsnull;
+   nsIFrame* parentFrame = nsnull;
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(aNode));
++  nsIContent* content(do_QueryInterface(aNode));
+ 
+   if (content) {
+     frame = shell->GetPrimaryFrameFor(content);
+@@ -2065,7 +2065,7 @@ nsAccessibilityService::GetAccessibleFor
+     if (parentFrame && parentFrame->GetType() == nsAccessibilityAtoms::deckFrame) {
+       // If deck frame is for xul:tabpanels element then the given node has
+       // tabpanel accessible.
+-      nsCOMPtr<nsIContent> parentContent = parentFrame->GetContent();
++      nsIContent* parentContent = parentFrame->GetContent();
+       if (parentContent->NodeInfo()->Equals(nsAccessibilityAtoms::tabpanels,
+                                             kNameSpaceID_XUL)) {
+         *aAccessible = new nsXULTabpanelAccessible(aNode, weakShell);
+diff --git a/accessible/src/base/nsAccessibilityUtils.cpp b/accessible/src/base/nsAccessibilityUtils.cpp
+--- a/accessible/src/base/nsAccessibilityUtils.cpp
++++ b/accessible/src/base/nsAccessibilityUtils.cpp
+@@ -170,12 +170,12 @@ nsAccUtils::SetAccAttrsForXULSelectContr
+ nsAccUtils::SetAccAttrsForXULSelectControlItem(nsIDOMNode *aNode,
+                                                nsIPersistentProperties *aAttributes)
+ {
+-  nsCOMPtr<nsIDOMXULSelectControlItemElement> item(do_QueryInterface(aNode));
++  nsIDOMXULSelectControlItemElement* item(do_QueryInterface(aNode));
+   if (!item)
+     return;
+ 
+-  nsCOMPtr<nsIDOMXULSelectControlElement> control;
+-  item->GetControl(getter_AddRefs(control));
++  nsIDOMXULSelectControlElement* control = nsnull;
++  item->GetControl(&control);
+   if (!control)
+     return;
+ 
+@@ -187,13 +187,13 @@ nsAccUtils::SetAccAttrsForXULSelectContr
+ 
+   PRUint32 setSize = itemsCount, posInSet = indexOf;
+   for (PRUint32 index = 0; index < itemsCount; index++) {
+-    nsCOMPtr<nsIDOMXULSelectControlItemElement> currItem;
+-    control->GetItemAtIndex(index, getter_AddRefs(currItem));
+-    nsCOMPtr<nsIDOMNode> currNode(do_QueryInterface(currItem));
++    nsIDOMXULSelectControlItemElement* currItem = nsnull;
++    control->GetItemAtIndex(index, &currItem);
++    nsIDOMNode* currNode(do_QueryInterface(currItem));
+ 
+-    nsCOMPtr<nsIAccessible> itemAcc;
++    nsIAccessible* itemAcc = nsnull;
+     nsAccessNode::GetAccService()->GetAccessibleFor(currNode,
+-                                                    getter_AddRefs(itemAcc));
++                                                    &itemAcc);
+     if (!itemAcc ||
+         nsAccessible::State(itemAcc) & nsIAccessibleStates::STATE_INVISIBLE) {
+       setSize--;
+@@ -209,12 +209,12 @@ nsAccUtils::SetAccAttrsForXULContainerIt
+ nsAccUtils::SetAccAttrsForXULContainerItem(nsIDOMNode *aNode,
+                                            nsIPersistentProperties *aAttributes)
+ {
+-  nsCOMPtr<nsIDOMXULContainerItemElement> item(do_QueryInterface(aNode));
++  nsIDOMXULContainerItemElement* item(do_QueryInterface(aNode));
+   if (!item)
+     return;
+ 
+-  nsCOMPtr<nsIDOMXULContainerElement> container;
+-  item->GetParentContainer(getter_AddRefs(container));
++  nsIDOMXULContainerElement* container = nsnull;
++  item->GetParentContainer(&container);
+   if (!container)
+     return;
+ 
+@@ -229,12 +229,12 @@ nsAccUtils::SetAccAttrsForXULContainerIt
+   // Calculate set size and position in the set.
+   PRUint32 setSize = 0, posInSet = 0;
+   for (PRInt32 index = indexOf; index >= 0; index--) {
+-    nsCOMPtr<nsIDOMXULElement> item;
+-    container->GetItemAtIndex(index, getter_AddRefs(item));
++    nsIDOMXULElement* item = nsnull;
++    container->GetItemAtIndex(index, &item);
+ 
+-    nsCOMPtr<nsIAccessible> itemAcc;
++    nsIAccessible* itemAcc = nsnull;
+     nsAccessNode::GetAccService()->GetAccessibleFor(item,
+-                                                    getter_AddRefs(itemAcc));
++                                                    &itemAcc);
+ 
+     if (itemAcc) {
+       PRUint32 itemRole = nsAccessible::Role(itemAcc);
+@@ -250,12 +250,12 @@ nsAccUtils::SetAccAttrsForXULContainerIt
+   }
+ 
+   for (PRInt32 index = indexOf + 1; index < itemsCount; index++) {
+-    nsCOMPtr<nsIDOMXULElement> item;
+-    container->GetItemAtIndex(index, getter_AddRefs(item));
++    nsIDOMXULElement* item = nsnull;
++    container->GetItemAtIndex(index, &item);
+     
+-    nsCOMPtr<nsIAccessible> itemAcc;
++    nsIAccessible* itemAcc = nsnull;
+     nsAccessNode::GetAccService()->GetAccessibleFor(item,
+-                                                    getter_AddRefs(itemAcc));
++                                                    &itemAcc);
+ 
+     if (itemAcc) {
+       PRUint32 itemRole = nsAccessible::Role(itemAcc);
+@@ -273,9 +273,9 @@ nsAccUtils::SetAccAttrsForXULContainerIt
+   while (container) {
+     level++;
+ 
+-    nsCOMPtr<nsIDOMXULContainerElement> parentContainer;
+-    container->GetParentContainer(getter_AddRefs(parentContainer));
+-    parentContainer.swap(container);
++    nsIDOMXULContainerElement* parentContainer = nsnull;
++    container->GetParentContainer(&parentContainer);
++    swap(parentContainer, container);
+   }
+   
+   SetAccGroupAttrs(aAttributes, level, posInSet, setSize);
+@@ -285,8 +285,8 @@ nsAccUtils::HasListener(nsIContent *aCon
+ nsAccUtils::HasListener(nsIContent *aContent, const nsAString& aEventType)
+ {
+   NS_ENSURE_TRUE(aContent, PR_FALSE);
+-  nsCOMPtr<nsIEventListenerManager> listenerManager;
+-  aContent->GetListenerManager(PR_FALSE, getter_AddRefs(listenerManager));
++  nsIEventListenerManager* listenerManager = nsnull;
++  aContent->GetListenerManager(PR_FALSE, &listenerManager);
+ 
+   return listenerManager && listenerManager->HasListenersFor(aEventType);  
+ }
+@@ -303,11 +303,11 @@ nsAccUtils::GetAccessKeyFor(nsIContent *
+   if (!aContent->HasAttr(kNameSpaceID_None, nsAccessibilityAtoms::accesskey))
+     return 0;
+ 
+-  nsCOMPtr<nsIDocument> doc = aContent->GetOwnerDoc();
++  nsIDocument* doc = aContent->GetOwnerDoc();
+   if (!doc)
+     return 0;
+ 
+-  nsCOMPtr<nsIPresShell> presShell = doc->GetPrimaryShell();
++  nsIPresShell* presShell = doc->GetPrimaryShell();
+   if (!presShell)
+     return 0;
+ 
+@@ -330,10 +330,10 @@ nsAccUtils::FireAccEvent(PRUint32 aEvent
+ {
+   NS_ENSURE_ARG(aAccessible);
+ 
+-  nsCOMPtr<nsPIAccessible> pAccessible(do_QueryInterface(aAccessible));
++  nsPIAccessible* pAccessible(do_QueryInterface(aAccessible));
+   NS_ASSERTION(pAccessible, "Accessible doesn't implement nsPIAccessible");
+ 
+-  nsCOMPtr<nsIAccessibleEvent> event =
++  nsIAccessibleEvent* event =
+     new nsAccEvent(aEventType, aAccessible, aIsAsynch);
+   NS_ENSURE_TRUE(event, NS_ERROR_OUT_OF_MEMORY);
+ 
+@@ -346,14 +346,14 @@ nsAccUtils::IsAncestorOf(nsIDOMNode *aPo
+ {
+   NS_ENSURE_TRUE(aPossibleAncestorNode && aPossibleDescendantNode, PR_FALSE);
+ 
+-  nsCOMPtr<nsIDOMNode> loopNode = aPossibleDescendantNode;
+-  nsCOMPtr<nsIDOMNode> parentNode;
+-  while (NS_SUCCEEDED(loopNode->GetParentNode(getter_AddRefs(parentNode))) &&
++  nsIDOMNode* loopNode = aPossibleDescendantNode;
++  nsIDOMNode* parentNode = nsnull;
++  while (NS_SUCCEEDED(loopNode->GetParentNode(&parentNode)) &&
+          parentNode) {
+     if (parentNode == aPossibleAncestorNode) {
+       return PR_TRUE;
+     }
+-    loopNode.swap(parentNode);
++    swap(loopNode, parentNode);
+   }
+   return PR_FALSE;
+ }
+@@ -364,20 +364,20 @@ nsAccUtils::AreSiblings(nsIDOMNode *aDOM
+ {
+   NS_ENSURE_TRUE(aDOMNode1 && aDOMNode2, PR_FALSE);
+ 
+-  nsCOMPtr<nsIDOMNode> parentNode1, parentNode2;
+-  if (NS_SUCCEEDED(aDOMNode1->GetParentNode(getter_AddRefs(parentNode1))) &&
+-      NS_SUCCEEDED(aDOMNode2->GetParentNode(getter_AddRefs(parentNode2))) &&
++  nsIDOMNode* parentNode1 = nsnull, *parentNode2 = nsnull;
++  if (NS_SUCCEEDED(aDOMNode1->GetParentNode(&parentNode1)) &&
++      NS_SUCCEEDED(aDOMNode2->GetParentNode(&parentNode2)) &&
+       parentNode1 == parentNode2) {
+     return PR_TRUE;
+   }
+   return PR_FALSE;
+ }
+ 
+-already_AddRefed<nsIAccessible>
++nsIAccessible*
+ nsAccUtils::GetAncestorWithRole(nsIAccessible *aDescendant, PRUint32 aRole)
+ {
+-  nsCOMPtr<nsIAccessible> parentAccessible = aDescendant, testRoleAccessible;
+-  while (NS_SUCCEEDED(parentAccessible->GetParent(getter_AddRefs(testRoleAccessible))) &&
++  nsIAccessible* parentAccessible = aDescendant, *testRoleAccessible = nsnull;
++  while (NS_SUCCEEDED(parentAccessible->GetParent(&testRoleAccessible)) &&
+          testRoleAccessible) {
+     PRUint32 testRole;
+     testRoleAccessible->GetFinalRole(&testRole);
+@@ -386,11 +386,11 @@ nsAccUtils::GetAncestorWithRole(nsIAcces
+       NS_ADDREF(returnAccessible);
+       return returnAccessible;
+     }
+-    nsCOMPtr<nsIAccessibleDocument> docAccessible = do_QueryInterface(testRoleAccessible);
++    nsIAccessibleDocument* docAccessible = do_QueryInterface(testRoleAccessible);
+     if (docAccessible) {
+       break;
+     }
+-    parentAccessible.swap(testRoleAccessible);
++    swap(parentAccessible, testRoleAccessible);
+   }
+   return nsnull;
+ }
+@@ -408,11 +408,11 @@ nsAccUtils::GetARIATreeItemParent(nsIAcc
+     PRInt32 success;
+     level = levelStr.ToInteger(&success);
+     if (level > 1 && NS_SUCCEEDED(success)) {
+-      nsCOMPtr<nsIAccessible> currentAccessible = aStartTreeItem, prevAccessible;
++      nsIAccessible* currentAccessible = aStartTreeItem, *prevAccessible = nsnull;
+       while (PR_TRUE) {
+-        currentAccessible->GetPreviousSibling(getter_AddRefs(prevAccessible));
+-        currentAccessible.swap(prevAccessible);
+-        nsCOMPtr<nsIAccessNode> accessNode = do_QueryInterface(currentAccessible);
++        currentAccessible->GetPreviousSibling(&prevAccessible);
++        swap(currentAccessible, prevAccessible);
++        nsIAccessNode* accessNode = do_QueryInterface(currentAccessible);
+         if (!accessNode) {
+           break; // Reached top of tree, no higher level found
+         }
+@@ -420,9 +420,9 @@ nsAccUtils::GetARIATreeItemParent(nsIAcc
+         currentAccessible->GetFinalRole(&role);
+         if (role != nsIAccessibleRole::ROLE_OUTLINEITEM)
+           continue;
+-        nsCOMPtr<nsIDOMNode> treeItemNode;
+-        accessNode->GetDOMNode(getter_AddRefs(treeItemNode));
+-        nsCOMPtr<nsIContent> treeItemContent = do_QueryInterface(treeItemNode);
++        nsIDOMNode* treeItemNode = nsnull;
++        accessNode->GetDOMNode(&treeItemNode);
++        nsIContent* treeItemContent = do_QueryInterface(treeItemNode);
+         if (treeItemContent &&
+             treeItemContent->GetAttr(kNameSpaceID_None,
+                                      nsAccessibilityAtoms::aria_level, levelStr)) {
+@@ -439,8 +439,8 @@ nsAccUtils::GetARIATreeItemParent(nsIAcc
+   // In this case the parent of the tree item will be a group and the
+   // previous sibling of that should be the tree item parent.
+   // Or, if the parent is something other than a tree we will return that.
+-  nsCOMPtr<nsIAccessible> parentAccessible;
+-  aStartTreeItem->GetParent(getter_AddRefs(parentAccessible));
++  nsIAccessible* parentAccessible = nsnull;
++  aStartTreeItem->GetParent(&parentAccessible);
+   if (!parentAccessible)
+     return;
+   PRUint32 role;
+@@ -449,8 +449,8 @@ nsAccUtils::GetARIATreeItemParent(nsIAcc
+     NS_ADDREF(*aTreeItemParentResult = parentAccessible);
+     return; // The container for the tree items
+   }
+-  nsCOMPtr<nsIAccessible> prevAccessible;
+-  parentAccessible->GetPreviousSibling(getter_AddRefs(prevAccessible));
++  nsIAccessible* prevAccessible = nsnull;
++  parentAccessible->GetPreviousSibling(&prevAccessible);
+   if (!prevAccessible)
+     return;
+   prevAccessible->GetFinalRole(&role);
+@@ -458,8 +458,8 @@ nsAccUtils::GetARIATreeItemParent(nsIAcc
+     // XXX Sometimes an empty text accessible is in the hierarchy here,
+     // although the text does not appear to be rendered, GetRenderedText() says that it is
+     // so we need to skip past it to find the true previous sibling
+-    nsCOMPtr<nsIAccessible> tempAccessible = prevAccessible;
+-    tempAccessible->GetPreviousSibling(getter_AddRefs(prevAccessible));
++    nsIAccessible* tempAccessible = prevAccessible;
++    tempAccessible->GetPreviousSibling(&prevAccessible);
+     if (!prevAccessible)
+       return;
+     prevAccessible->GetFinalRole(&role);
+@@ -494,21 +494,21 @@ nsAccUtils::ScrollSubstringTo(nsIFrame *
+ 
+   nsPresContext *presContext = aFrame->PresContext();
+ 
+-  nsCOMPtr<nsIDOMRange> scrollToRange = do_CreateInstance(kRangeCID);
++  nsIDOMRange* scrollToRange = do_CreateInstance(kRangeCID);
+   NS_ENSURE_TRUE(scrollToRange, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsISelectionController> selCon;
+-  aFrame->GetSelectionController(presContext, getter_AddRefs(selCon));
++  nsISelectionController* selCon = nsnull;
++  aFrame->GetSelectionController(presContext, &selCon);
+   NS_ENSURE_TRUE(selCon, NS_ERROR_FAILURE);
+ 
+   scrollToRange->SetStart(aStartNode, aStartIndex);
+   scrollToRange->SetEnd(aEndNode, aEndIndex);
+ 
+-  nsCOMPtr<nsISelection> selection1;
++  nsISelection* selection1 = nsnull;
+   selCon->GetSelection(nsISelectionController::SELECTION_ACCESSIBILITY,
+-                       getter_AddRefs(selection1));
++                       &selection1);
+ 
+-  nsCOMPtr<nsISelection2> selection(do_QueryInterface(selection1));
++  nsISelection2* selection(do_QueryInterface(selection1));
+   if (selection) {
+     selection->RemoveAllRanges();
+     selection->AddRange(scrollToRange);
+@@ -658,20 +658,20 @@ nsAccUtils::GetScreenCoordsForWindow(nsI
+ nsAccUtils::GetScreenCoordsForWindow(nsIDOMNode *aNode)
+ {
+   nsIntPoint coords(0, 0);
+-  nsCOMPtr<nsIDocShellTreeItem> treeItem(GetDocShellTreeItemFor(aNode));
++  nsIDocShellTreeItem* treeItem(GetDocShellTreeItemFor(aNode));
+   if (!treeItem)
+     return coords;
+ 
+-  nsCOMPtr<nsIDocShellTreeItem> rootTreeItem;
+-  treeItem->GetRootTreeItem(getter_AddRefs(rootTreeItem));
+-  nsCOMPtr<nsIDOMDocument> domDoc = do_GetInterface(rootTreeItem);
+-  nsCOMPtr<nsIDOMDocumentView> docView(do_QueryInterface(domDoc));
++  nsIDocShellTreeItem* rootTreeItem = nsnull;
++  treeItem->GetRootTreeItem(&rootTreeItem);
++  nsIDOMDocument* domDoc = do_GetInterface(rootTreeItem);
++  nsIDOMDocumentView* docView(do_QueryInterface(domDoc));
+   if (!docView)
+     return coords;
+ 
+-  nsCOMPtr<nsIDOMAbstractView> abstractView;
+-  docView->GetDefaultView(getter_AddRefs(abstractView));
+-  nsCOMPtr<nsIDOMWindowInternal> windowInter(do_QueryInterface(abstractView));
++  nsIDOMAbstractView* abstractView = nsnull;
++  docView->GetDefaultView(&abstractView);
++  nsIDOMWindowInternal* windowInter(do_QueryInterface(abstractView));
+   if (!windowInter)
+     return coords;
+ 
+@@ -683,8 +683,8 @@ nsIntPoint
+ nsIntPoint
+ nsAccUtils::GetScreenCoordsForWindow(nsIAccessNode *aAccessNode)
+ {
+-  nsCOMPtr<nsIDOMNode> DOMNode;
+-  aAccessNode->GetDOMNode(getter_AddRefs(DOMNode));
++  nsIDOMNode* DOMNode = nsnull;
++  aAccessNode->GetDOMNode(&DOMNode);
+   if (DOMNode)
+     return GetScreenCoordsForWindow(DOMNode);
+ 
+@@ -694,15 +694,15 @@ nsIntPoint
+ nsIntPoint
+ nsAccUtils::GetScreenCoordsForParent(nsIAccessNode *aAccessNode)
+ {
+-  nsCOMPtr<nsPIAccessNode> parent;
+-  nsCOMPtr<nsIAccessible> accessible(do_QueryInterface(aAccessNode));
++  nsPIAccessNode* parent = nsnull;
++  nsIAccessible* accessible(do_QueryInterface(aAccessNode));
+   if (accessible) {
+-    nsCOMPtr<nsIAccessible> parentAccessible;
+-    accessible->GetParent(getter_AddRefs(parentAccessible));
++    nsIAccessible* parentAccessible = nsnull;
++    accessible->GetParent(&parentAccessible);
+     parent = do_QueryInterface(parentAccessible);
+   } else {
+-    nsCOMPtr<nsIAccessNode> parentAccessNode;
+-    aAccessNode->GetParentNode(getter_AddRefs(parentAccessNode));
++    nsIAccessNode* parentAccessNode = nsnull;
++    aAccessNode->GetParentNode(&parentAccessNode);
+     parent = do_QueryInterface(parentAccessNode);
+   }
+ 
+@@ -717,22 +717,22 @@ nsAccUtils::GetScreenCoordsForParent(nsI
+   return nsIntPoint(parentRect.x, parentRect.y);
+ }
+ 
+-already_AddRefed<nsIDocShellTreeItem>
++nsIDocShellTreeItem*
+ nsAccUtils::GetDocShellTreeItemFor(nsIDOMNode *aNode)
+ {
+   if (!aNode)
+     return nsnull;
+ 
+-  nsCOMPtr<nsIDOMDocument> domDoc;
+-  aNode->GetOwnerDocument(getter_AddRefs(domDoc));
+-  nsCOMPtr<nsIDocument> doc(do_QueryInterface(domDoc));
++  nsIDOMDocument* domDoc = nsnull;
++  aNode->GetOwnerDocument(&domDoc);
++  nsIDocument* doc(do_QueryInterface(domDoc));
+   if (!doc)
+     doc = do_QueryInterface(aNode);
+ 
+   NS_ASSERTION(doc, "No document for node passed in");
+   NS_ENSURE_TRUE(doc, nsnull);
+ 
+-  nsCOMPtr<nsISupports> container = doc->GetContainer();
++  nsISupports* container = doc->GetContainer();
+   nsIDocShellTreeItem *docShellTreeItem = nsnull;
+   if (container)
+     CallQueryInterface(container, &docShellTreeItem);
+@@ -774,7 +774,7 @@ nsAccUtils::FindNeighbourPointingToNode(
+                                         nsIAtom *aTagName,
+                                         PRUint32 aAncestorLevelsToSearch)
+ {
+-  nsCOMPtr<nsIContent> binding;
++  nsIContent* binding = nsnull;
+   nsAutoString controlID;
+   if (!nsAccUtils::GetID(aForNode, controlID)) {
+     binding = aForNode->GetBindingParent();
+@@ -797,14 +797,14 @@ nsAccUtils::FindNeighbourPointingToNode(
+     if (aForNode == binding) {
+       // When we reach the binding parent, make sure to check
+       // all of its anonymous child subtrees
+-      nsCOMPtr<nsIDocument> doc = aForNode->GetCurrentDoc();
+-      nsCOMPtr<nsIDOMDocumentXBL> xblDoc(do_QueryInterface(doc));
++      nsIDocument* doc = aForNode->GetCurrentDoc();
++      nsIDOMDocumentXBL* xblDoc(do_QueryInterface(doc));
+       if (!xblDoc)
+         return nsnull;
+ 
+-      nsCOMPtr<nsIDOMNodeList> nodes;
+-      nsCOMPtr<nsIDOMElement> forElm(do_QueryInterface(aForNode));
+-      xblDoc->GetAnonymousNodes(forElm, getter_AddRefs(nodes));
++      nsIDOMNodeList* nodes = nsnull;
++      nsIDOMElement* forElm(do_QueryInterface(aForNode));
++      xblDoc->GetAnonymousNodes(forElm, &nodes);
+       if (!nodes)
+         return nsnull;
+ 
+@@ -814,12 +814,12 @@ nsAccUtils::FindNeighbourPointingToNode(
+         return nsnull;
+ 
+       for (PRUint32 index = 0; index < length && !labelContent; index++) {
+-        nsCOMPtr<nsIDOMNode> node;
+-        rv = nodes->Item(index, getter_AddRefs(node));
++        nsIDOMNode* node = nsnull;
++        rv = nodes->Item(index, &node);
+         if (NS_FAILED(rv))
+           return nsnull;
+ 
+-        nsCOMPtr<nsIContent> content = do_QueryInterface(node);
++        nsIContent* content = do_QueryInterface(node);
+         if (!content)
+           return nsnull;
+ 
+diff --git a/accessible/src/base/nsAccessibilityUtils.h b/accessible/src/base/nsAccessibilityUtils.h
+--- a/accessible/src/base/nsAccessibilityUtils.h
++++ b/accessible/src/base/nsAccessibilityUtils.h
+@@ -161,7 +161,7 @@ public:
+     * @param aRole Role to find matching ancestor for
+     * @return The ancestor accessible with the given role, or nsnull if no match is found
+     */
+-   static already_AddRefed<nsIAccessible>
++   static nsIAccessible*
+      GetAncestorWithRole(nsIAccessible *aDescendant, PRUint32 aRole);
+ 
+    /**
+@@ -283,7 +283,7 @@ public:
+   /**
+    * Return document shell tree item for the given DOM node.
+    */
+-  static already_AddRefed<nsIDocShellTreeItem>
++  static nsIDocShellTreeItem*
+     GetDocShellTreeItemFor(nsIDOMNode *aNode);
+ 
+   /**
+diff --git a/accessible/src/base/nsAccessible.cpp b/accessible/src/base/nsAccessible.cpp
+--- a/accessible/src/base/nsAccessible.cpp
++++ b/accessible/src/base/nsAccessible.cpp
+@@ -202,7 +202,7 @@ nsresult nsAccessible::QueryInterface(RE
+   }
+ 
+   if (aIID.Equals(NS_GET_IID(nsIAccessibleSelectable))) {
+-    nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++    nsIContent* content(do_QueryInterface(mDOMNode));
+     if (!content) {
+       return NS_ERROR_FAILURE; // This accessible has been shut down
+     }
+@@ -231,8 +231,8 @@ nsresult nsAccessible::QueryInterface(RE
+   }                       
+ 
+   if (aIID.Equals(NS_GET_IID(nsIAccessibleHyperLink))) {
+-    nsCOMPtr<nsIAccessible> parent(GetParent());
+-    nsCOMPtr<nsIAccessibleHyperText> hyperTextParent(do_QueryInterface(parent));
++    nsIAccessible* parent(GetParent());
++    nsIAccessibleHyperText* hyperTextParent(do_QueryInterface(parent));
+     if (hyperTextParent) {
+       *aInstancePtr = static_cast<nsIAccessibleHyperLink*>(this);
+       NS_ADDREF_THIS();
+@@ -285,7 +285,7 @@ NS_IMETHODIMP nsAccessible::GetName(nsAS
+ NS_IMETHODIMP nsAccessible::GetName(nsAString& aName)
+ {
+   aName.Truncate();
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   if (!content) {
+     return NS_ERROR_FAILURE;  // Node shut down
+   }
+@@ -311,7 +311,7 @@ NS_IMETHODIMP nsAccessible::GetDescripti
+   // 2. It has no DHTML describedby property
+   // 3. it doesn't have an accName; or
+   // 4. its title attribute already equals to its accName nsAutoString name; 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   if (!content) {
+     return NS_ERROR_FAILURE;  // Node shut down
+   }
+@@ -363,7 +363,7 @@ static PRInt32
+ static PRInt32
+ GetAccessModifierMask(nsIContent* aContent)
+ {
+-  nsCOMPtr<nsIPrefBranch> prefBranch =
++  nsIPrefBranch* prefBranch =
+     do_GetService(NS_PREFSERVICE_CONTRACTID);
+   if (!prefBranch)
+     return 0;
+@@ -382,13 +382,13 @@ GetAccessModifierMask(nsIContent* aConte
+   }
+ 
+   // get the docShell to this DOMNode, return 0 on failure
+-  nsCOMPtr<nsIDocument> document = aContent->GetCurrentDoc();
++  nsIDocument* document = aContent->GetCurrentDoc();
+   if (!document)
+     return 0;
+-  nsCOMPtr<nsISupports> container = document->GetContainer();
++  nsISupports* container = document->GetContainer();
+   if (!container)
+     return 0;
+-  nsCOMPtr<nsIDocShellTreeItem> treeItem(do_QueryInterface(container));
++  nsIDocShellTreeItem* treeItem(do_QueryInterface(container));
+   if (!treeItem)
+     return 0;
+ 
+@@ -414,7 +414,7 @@ nsAccessible::GetKeyboardShortcut(nsAStr
+ {
+   aAccessKey.Truncate();
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   if (!content)
+     return NS_ERROR_FAILURE;
+ 
+@@ -422,8 +422,8 @@ nsAccessible::GetKeyboardShortcut(nsAStr
+   if (!key && content->IsNodeOfType(nsIContent::eELEMENT)) {
+     // Copy access key from label node unless it is labeled
+     // via an ancestor <label>, in which case that would be redundant
+-    nsCOMPtr<nsIContent> labelContent(GetLabelContent(content));
+-    nsCOMPtr<nsIDOMNode> labelNode = do_QueryInterface(labelContent);
++    nsIContent* labelContent(GetLabelContent(content));
++    nsIDOMNode* labelNode = do_QueryInterface(labelContent);
+     if (labelNode && !nsAccUtils::IsAncestorOf(labelNode, mDOMNode))
+       key = nsAccUtils::GetAccessKeyFor(labelContent);
+   }
+@@ -464,7 +464,7 @@ NS_IMETHODIMP nsAccessible::SetParent(ns
+     // may be a dom node which wasn't previously accessible but now is.
+     // The old parent's children now need to be invalidated, since 
+     // it no longer owns the child, the new parent does
+-    nsCOMPtr<nsPIAccessible> privOldParent = do_QueryInterface(mParent);
++    nsPIAccessible* privOldParent = do_QueryInterface(mParent);
+     if (privOldParent) {
+       privOldParent->InvalidateChildren();
+     }
+@@ -494,19 +494,19 @@ nsIContent *nsAccessible::GetRoleContent
+   // For non-document accessibles, this is the associated content node.
+   // For doc accessibles, use the <body>/<frameset> if it's HTML.
+   // For any other doc accessible , this is the document element.
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(aDOMNode));
++  nsIContent* content(do_QueryInterface(aDOMNode));
+   if (!content) {
+-    nsCOMPtr<nsIDOMDocument> domDoc(do_QueryInterface(aDOMNode));
++    nsIDOMDocument* domDoc(do_QueryInterface(aDOMNode));
+     if (domDoc) {
+-      nsCOMPtr<nsIDOMHTMLDocument> htmlDoc(do_QueryInterface(aDOMNode));
++      nsIDOMHTMLDocument* htmlDoc(do_QueryInterface(aDOMNode));
+       if (htmlDoc) {
+-        nsCOMPtr<nsIDOMHTMLElement> bodyElement;
+-        htmlDoc->GetBody(getter_AddRefs(bodyElement));
++        nsIDOMHTMLElement* bodyElement = nsnull;
++        htmlDoc->GetBody(&bodyElement);
+         content = do_QueryInterface(bodyElement);
+       }
+       else {
+-        nsCOMPtr<nsIDOMElement> docElement;
+-        domDoc->GetDocumentElement(getter_AddRefs(docElement));
++        nsIDOMElement* docElement = nsnull;
++        domDoc->GetDocumentElement(&docElement);
+         content = do_QueryInterface(docElement);
+       }
+     }
+@@ -522,7 +522,7 @@ NS_IMETHODIMP nsAccessible::Shutdown()
+   // sure none of it's children point to this parent
+   InvalidateChildren();
+   if (mParent) {
+-    nsCOMPtr<nsPIAccessible> privateParent(do_QueryInterface(mParent));
++    nsPIAccessible* privateParent(do_QueryInterface(mParent));
+     privateParent->InvalidateChildren();
+     mParent = nsnull;
+   }
+@@ -561,7 +561,7 @@ NS_IMETHODIMP nsAccessible::GetParent(ns
+     return rv;
+   }
+ 
+-  nsCOMPtr<nsIAccessibleDocument> docAccessible(GetDocAccessible());
++  nsIAccessibleDocument* docAccessible(GetDocAccessible());
+   NS_ENSURE_TRUE(docAccessible, NS_ERROR_FAILURE);
+ 
+   return docAccessible->GetAccessibleInParentChain(mDOMNode, PR_TRUE, aParent);
+@@ -598,7 +598,7 @@ NS_IMETHODIMP nsAccessible::GetNextSibli
+     return NS_ERROR_FAILURE;
+   }
+   if (!mParent) {
+-    nsCOMPtr<nsIAccessible> parent(GetParent());
++    nsIAccessible* parent(GetParent());
+     if (parent) {
+       PRInt32 numChildren;
+       parent->GetChildCount(&numChildren);  // Make sure we cache all of the children
+@@ -627,16 +627,16 @@ NS_IMETHODIMP nsAccessible::GetPreviousS
+     return NS_ERROR_FAILURE;
+   }
+ 
+-  nsCOMPtr<nsIAccessible> parent;
+-  if (NS_FAILED(GetParent(getter_AddRefs(parent))) || !parent) {
++  nsIAccessible* parent = nsnull;
++  if (NS_FAILED(GetParent(&parent)) || !parent) {
+     return NS_ERROR_FAILURE;
+   }
+ 
+-  nsCOMPtr<nsIAccessible> testAccessible, prevSibling;
+-  parent->GetFirstChild(getter_AddRefs(testAccessible));
++  nsIAccessible* testAccessible = nsnull, *prevSibling = nsnull;
++  parent->GetFirstChild(&testAccessible);
+   while (testAccessible && this != testAccessible) {
+     prevSibling = testAccessible;
+-    prevSibling->GetNextSibling(getter_AddRefs(testAccessible));
++    prevSibling->GetNextSibling(&testAccessible);
+   }
+ 
+   if (!prevSibling) {
+@@ -657,10 +657,10 @@ NS_IMETHODIMP nsAccessible::GetFirstChil
+   GetChildCount(&numChildren);  // Make sure we cache all of the children
+ 
+ #ifdef DEBUG
+-  nsCOMPtr<nsPIAccessible> firstChild(do_QueryInterface(mFirstChild));
++  nsPIAccessible* firstChild(do_QueryInterface(mFirstChild));
+   if (firstChild) {
+-    nsCOMPtr<nsIAccessible> realParent;
+-    firstChild->GetCachedParent(getter_AddRefs(realParent));
++    nsIAccessible* realParent = nsnull;
++    firstChild->GetCachedParent(&realParent);
+     NS_ASSERTION(!realParent || realParent == this,
+                  "Two accessibles have the same first child accessible.");
+   }
+@@ -694,7 +694,7 @@ NS_IMETHODIMP nsAccessible::GetChildAt(P
+     aChildNum = numChildren - 1;
+   }
+ 
+-  nsCOMPtr<nsIAccessible> current(mFirstChild), nextSibling;
++  nsIAccessible* current(mFirstChild), *nextSibling = nsnull;
+   PRInt32 index = 0;
+ 
+   while (current) {
+@@ -702,7 +702,7 @@ NS_IMETHODIMP nsAccessible::GetChildAt(P
+     if (++index > aChildNum) {
+       break;
+     }
+-    nextSibling->GetNextSibling(getter_AddRefs(current));
++    nextSibling->GetNextSibling(&current);
+   }
+ 
+   NS_IF_ADDREF(*aChild = nextSibling);
+@@ -714,11 +714,11 @@ NS_IMETHODIMP nsAccessible::GetChildren(
+ NS_IMETHODIMP nsAccessible::GetChildren(nsIArray **aOutChildren)
+ {
+   *aOutChildren = nsnull;
+-  nsCOMPtr<nsIMutableArray> children = do_CreateInstance(NS_ARRAY_CONTRACTID);
++  nsIMutableArray* children = do_CreateInstance(NS_ARRAY_CONTRACTID);
+   if (!children)
+     return NS_ERROR_FAILURE;
+ 
+-  nsCOMPtr<nsIAccessible> curChild;
++  nsIAccessible* curChild = nsnull;
+   while (NextChild(curChild)) {
+     children->AppendElement(curChild, PR_FALSE);
+   }
+@@ -727,14 +727,14 @@ NS_IMETHODIMP nsAccessible::GetChildren(
+   return NS_OK;
+ }
+ 
+-nsIAccessible *nsAccessible::NextChild(nsCOMPtr<nsIAccessible>& aAccessible)
++nsIAccessible *nsAccessible::NextChild(nsIAccessible*& aAccessible)
+ {
+-  nsCOMPtr<nsIAccessible> nextChild;
++  nsIAccessible* nextChild = nsnull;
+   if (!aAccessible) {
+-    GetFirstChild(getter_AddRefs(nextChild));
++    GetFirstChild(&nextChild);
+   }
+   else {
+-    aAccessible->GetNextSibling(getter_AddRefs(nextChild));
++    aAccessible->GetNextSibling(&nextChild);
+   }
+   return (aAccessible = nextChild);
+ }
+@@ -757,7 +757,7 @@ void nsAccessible::CacheChildren()
+     // a text node, because text nodes aren't in the frame map.
+     walker.mState.frame = GetFrame();
+ 
+-    nsCOMPtr<nsPIAccessible> privatePrevAccessible;
++    nsPIAccessible* privatePrevAccessible = nsnull;
+     PRInt32 childCount = 0;
+     walker.GetFirstChild();
+     SetFirstChild(walker.mState.accessible);
+@@ -795,14 +795,14 @@ NS_IMETHODIMP nsAccessible::GetIndexInPa
+     return NS_ERROR_FAILURE;
+   }
+ 
+-  nsCOMPtr<nsIAccessible> parent;
+-  GetParent(getter_AddRefs(parent));
++  nsIAccessible* parent = nsnull;
++  GetParent(&parent);
+   if (!parent) {
+     return NS_ERROR_FAILURE;
+   }
+ 
+-  nsCOMPtr<nsIAccessible> sibling;
+-  parent->GetFirstChild(getter_AddRefs(sibling));
++  nsIAccessible* sibling = nsnull;
++  parent->GetFirstChild(&sibling);
+   if (!sibling) {
+     return NS_ERROR_FAILURE;
+   }
+@@ -815,8 +815,8 @@ NS_IMETHODIMP nsAccessible::GetIndexInPa
+       return NS_ERROR_FAILURE;
+ 
+     ++*aIndexInParent;
+-    nsCOMPtr<nsIAccessible> tempAccessible;
+-    sibling->GetNextSibling(getter_AddRefs(tempAccessible));
++    nsIAccessible* tempAccessible = nsnull;
++    sibling->GetNextSibling(&tempAccessible);
+     sibling = tempAccessible;
+   }
+ 
+@@ -891,7 +891,7 @@ PRBool nsAccessible::IsVisible(PRBool *a
+ 
+   const PRUint16 kMinPixels  = 12;
+    // Set up the variables we need, return false if we can't get at them all
+-  nsCOMPtr<nsIPresShell> shell(GetPresShell());
++  nsIPresShell* shell(GetPresShell());
+   if (!shell) 
+     return PR_FALSE;
+ 
+@@ -976,9 +976,9 @@ PRBool nsAccessible::IsVisible(PRBool *a
+   // nsRectVisibility_kLeftOfViewport, 
+   // nsRectVisibility_kRightOfViewport
+   // This view says it is visible, but we need to check the parent view chain :(
+-  nsCOMPtr<nsIDOMDocument> domDoc;
+-  mDOMNode->GetOwnerDocument(getter_AddRefs(domDoc));
+-  nsCOMPtr<nsIDocument> doc(do_QueryInterface(domDoc));
++  nsIDOMDocument* domDoc = nsnull;
++  mDOMNode->GetOwnerDocument(&domDoc);
++  nsIDocument* doc(do_QueryInterface(domDoc));
+   if (!doc)  {
+     return PR_FALSE;
+   }
+@@ -1005,7 +1005,7 @@ nsAccessible::GetState(PRUint32 *aState,
+   if (aExtraState)
+     *aExtraState = 0;
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   if (!content) {
+     return NS_OK;  // On document, this is not an error
+   }
+@@ -1064,20 +1064,20 @@ nsAccessible::GetState(PRUint32 *aState,
+   /* readonly attribute boolean focusedChild; */
+ NS_IMETHODIMP nsAccessible::GetFocusedChild(nsIAccessible **aFocusedChild) 
+ { 
+-  nsCOMPtr<nsIAccessible> focusedChild;
++  nsIAccessible* focusedChild = nsnull;
+   if (gLastFocusedNode == mDOMNode) {
+     focusedChild = this;
+   }
+   else if (gLastFocusedNode) {
+-    nsCOMPtr<nsIAccessibilityService> accService =
++    nsIAccessibilityService* accService =
+       do_GetService("@mozilla.org/accessibilityService;1");
+     NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
+ 
+     accService->GetAccessibleFor(gLastFocusedNode,
+-                                 getter_AddRefs(focusedChild));
++                                 &focusedChild);
+     if (focusedChild) {
+-      nsCOMPtr<nsIAccessible> focusedParentAccessible;
+-      focusedChild->GetParent(getter_AddRefs(focusedParentAccessible));
++      nsIAccessible* focusedParentAccessible = nsnull;
++      focusedChild->GetParent(&focusedParentAccessible);
+       if (focusedParentAccessible != this) {
+         focusedChild = nsnull;
+       }
+@@ -1102,7 +1102,7 @@ nsAccessible::GetChildAtPoint(PRInt32 aX
+ 
+   // If we can't find the point in a child, we will return the fallback answer:
+   // we return |this| if the point is within it, otherwise nsnull
+-  nsCOMPtr<nsIAccessible> fallbackAnswer;
++  nsIAccessible* fallbackAnswer = nsnull;
+   PRInt32 x, y, width, height;
+   GetBounds(&x, &y, &width, &height);
+   if (aX >= x && aX < x + width &&
+@@ -1120,12 +1120,12 @@ nsAccessible::GetChildAtPoint(PRInt32 aX
+   // therefore accessible for containing block may be different from accessible
+   // for DOM parent but GetFrameForPoint() should be called for containing block
+   // to get an out of flow element.
+-  nsCOMPtr<nsIAccessibleDocument> accDocument;
+-  nsresult rv = GetAccessibleDocument(getter_AddRefs(accDocument));
++  nsIAccessibleDocument* accDocument = nsnull;
++  nsresult rv = GetAccessibleDocument(&accDocument);
+   NS_ENSURE_SUCCESS(rv, rv);
+   NS_ENSURE_TRUE(accDocument, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsPIAccessNode> accessNodeDocument(do_QueryInterface(accDocument));
++  nsPIAccessNode* accessNodeDocument(do_QueryInterface(accDocument));
+   NS_ASSERTION(accessNodeDocument,
+                "nsIAccessibleDocument doesn't implement nsPIAccessNode");
+ 
+@@ -1138,31 +1138,31 @@ nsAccessible::GetChildAtPoint(PRInt32 aX
+   nsPoint offset(presContext->DevPixelsToAppUnits(aX - screenRect.x),
+                  presContext->DevPixelsToAppUnits(aY - screenRect.y));
+ 
+-  nsCOMPtr<nsIPresShell> presShell = presContext->PresShell();
++  nsIPresShell* presShell = presContext->PresShell();
+   nsIFrame *foundFrame = presShell->GetFrameForPoint(frame, offset);
+-  nsCOMPtr<nsIContent> content;
++  nsIContent* content = nsnull;
+   if (!foundFrame || !(content = foundFrame->GetContent())) {
+     NS_IF_ADDREF(*aAccessible = fallbackAnswer);
+     return NS_OK;
+   }
+ 
+-  nsCOMPtr<nsIDOMNode> node(do_QueryInterface(content));
+-  nsCOMPtr<nsIAccessibilityService> accService = GetAccService();
++  nsIDOMNode* node(do_QueryInterface(content));
++  nsIAccessibilityService* accService = GetAccService();
+ 
+-  nsCOMPtr<nsIDOMNode> relevantNode;
+-  accService->GetRelevantContentNodeFor(node, getter_AddRefs(relevantNode));
++  nsIDOMNode* relevantNode = nsnull;
++  accService->GetRelevantContentNodeFor(node, &relevantNode);
+   if (!relevantNode) {
+     NS_IF_ADDREF(*aAccessible = fallbackAnswer);
+     return NS_OK;
+   }
+ 
+-  nsCOMPtr<nsIAccessible> accessible;
+-  accService->GetAccessibleFor(relevantNode, getter_AddRefs(accessible));
++  nsIAccessible* accessible = nsnull;
++  accService->GetAccessibleFor(relevantNode, &accessible);
+   if (!accessible) {
+     // No accessible for the node with the point, so find the first
+     // accessible in the DOM parent chain
+     accDocument->GetAccessibleInParentChain(relevantNode, PR_TRUE,
+-                                            getter_AddRefs(accessible));
++                                            &accessible);
+     if (!accessible) {
+       NS_IF_ADDREF(*aAccessible = fallbackAnswer);
+       return NS_OK;
+@@ -1174,7 +1174,7 @@ nsAccessible::GetChildAtPoint(PRInt32 aX
+     // the are within this point.
+     // This takes care of cases where layout won't walk into
+     // things for us, such as image map areas and sub documents
+-    nsCOMPtr<nsIAccessible> child;
++    nsIAccessible* child = nsnull;
+     while (NextChild(child)) {
+       PRInt32 childX, childY, childWidth, childHeight;
+       child->GetBounds(&childX, &childY, &childWidth, &childHeight);
+@@ -1190,9 +1190,9 @@ nsAccessible::GetChildAtPoint(PRInt32 aX
+     // We are allowed to return |this| as the answer
+   }
+   else {
+-    nsCOMPtr<nsIAccessible> parent;
++    nsIAccessible* parent = nsnull;
+     while (PR_TRUE) {
+-      accessible->GetParent(getter_AddRefs(parent));
++      accessible->GetParent(&parent);
+       if (!parent) {
+         // Reached the top of the hierarchy
+         // these bounds were inside an accessible that is not a descendant of this one
+@@ -1204,7 +1204,7 @@ nsAccessible::GetChildAtPoint(PRInt32 aX
+         // child we want to return
+         break;
+       }
+-      accessible.swap(parent);
++      swap(accessible, parent);
+     }
+   }
+ 
+@@ -1247,7 +1247,7 @@ void nsAccessible::GetBoundsRect(nsRect&
+   }
+ 
+   nsIFrame *iterFrame = firstFrame;
+-  nsCOMPtr<nsIContent> firstContent(do_QueryInterface(mDOMNode));
++  nsIContent* firstContent(do_QueryInterface(mDOMNode));
+   nsIContent* iterContent = firstContent;
+   PRInt32 depth = 0;
+ 
+@@ -1356,15 +1356,15 @@ nsIFrame* nsAccessible::GetBoundsFrame()
+   return GetFrame();
+ }
+ 
+-already_AddRefed<nsIAccessible>
++nsIAccessible*
+ nsAccessible::GetMultiSelectFor(nsIDOMNode *aNode)
+ {
+   NS_ENSURE_TRUE(aNode, nsnull);
+-  nsCOMPtr<nsIAccessibilityService> accService =
++  nsIAccessibilityService* accService =
+     do_GetService("@mozilla.org/accessibilityService;1");
+   NS_ENSURE_TRUE(accService, nsnull);
+-  nsCOMPtr<nsIAccessible> accessible;
+-  accService->GetAccessibleFor(aNode, getter_AddRefs(accessible));
++  nsIAccessible* accessible = nsnull;
++  accService->GetAccessibleFor(aNode, &accessible);
+   if (!accessible) {
+     return nsnull;
+   }
+@@ -1377,7 +1377,7 @@ nsAccessible::GetMultiSelectFor(nsIDOMNo
+   PRUint32 containerRole;
+   while (0 == (state & nsIAccessibleStates::STATE_MULTISELECTABLE)) {
+     nsIAccessible *current = accessible;
+-    current->GetParent(getter_AddRefs(accessible));
++    current->GetParent(&accessible);
+     if (!accessible || (NS_SUCCEEDED(accessible->GetFinalRole(&containerRole)) &&
+                         containerRole == nsIAccessibleRole::ROLE_PANE)) {
+       return nsnull;
+@@ -1385,7 +1385,7 @@ nsAccessible::GetMultiSelectFor(nsIDOMNo
+     state = State(accessible);
+   }
+   nsIAccessible *returnAccessible = nsnull;
+-  accessible.swap(returnAccessible);
++  swap(accessible, returnAccessible);
+   return returnAccessible;
+ }
+ 
+@@ -1399,11 +1399,11 @@ NS_IMETHODIMP nsAccessible::SetSelected(
+ 
+   PRUint32 state = State(this);
+   if (state & nsIAccessibleStates::STATE_SELECTABLE) {
+-    nsCOMPtr<nsIAccessible> multiSelect = GetMultiSelectFor(mDOMNode);
++    nsIAccessible* multiSelect = GetMultiSelectFor(mDOMNode);
+     if (!multiSelect) {
+       return aSelect ? TakeFocus() : NS_ERROR_FAILURE;
+     }
+-    nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++    nsIContent* content(do_QueryInterface(mDOMNode));
+     NS_ASSERTION(content, "Called for dead accessible");
+ 
+     if (mRoleMapEntry) {
+@@ -1428,9 +1428,9 @@ NS_IMETHODIMP nsAccessible::TakeSelectio
+ 
+   PRUint32 state = State(this);
+   if (state & nsIAccessibleStates::STATE_SELECTABLE) {
+-    nsCOMPtr<nsIAccessible> multiSelect = GetMultiSelectFor(mDOMNode);
++    nsIAccessible* multiSelect = GetMultiSelectFor(mDOMNode);
+     if (multiSelect) {
+-      nsCOMPtr<nsIAccessibleSelectable> selectable = do_QueryInterface(multiSelect);
++      nsIAccessibleSelectable* selectable = do_QueryInterface(multiSelect);
+       selectable->ClearSelection();
+     }
+     return SetSelected(PR_TRUE);
+@@ -1446,7 +1446,7 @@ nsAccessible::TakeFocus()
+   if (IsDefunct())
+     return NS_ERROR_FAILURE;
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+ 
+   nsIFrame *frame = GetFrame();
+   NS_ENSURE_STATE(frame);
+@@ -1459,13 +1459,13 @@ nsAccessible::TakeFocus()
+     nsAutoString id;
+     if (content && nsAccUtils::GetID(content, id)) {
+ 
+-      nsCOMPtr<nsIContent> ancestorContent = content;
++      nsIContent* ancestorContent = content;
+       while ((ancestorContent = ancestorContent->GetParent()) &&
+              !ancestorContent->HasAttr(kNameSpaceID_None,
+                                        nsAccessibilityAtoms::aria_activedescendant));
+ 
+       if (ancestorContent) {
+-        nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
++        nsIPresShell* presShell(do_QueryReferent(mWeakShell));
+         if (presShell) {
+           nsIFrame *frame = presShell->GetPrimaryFrameFor(ancestorContent);
+           if (frame && frame->IsFocusable()) {
+@@ -1480,7 +1480,7 @@ nsAccessible::TakeFocus()
+     }
+   }
+ 
+-  nsCOMPtr<nsIDOMNSHTMLElement> htmlElement(do_QueryInterface(content));
++  nsIDOMNSHTMLElement* htmlElement(do_QueryInterface(content));
+   if (htmlElement) {
+     // HTML Elements also set the caret position
+     // in order to affect tabbing order
+@@ -1509,8 +1509,8 @@ nsresult nsAccessible::AppendNameFromAcc
+ {
+   nsAutoString textEquivalent, value;
+ 
+-  nsCOMPtr<nsIDOMNode> domNode(do_QueryInterface(aContent));
+-  nsCOMPtr<nsIAccessible> accessible;
++  nsIDOMNode* domNode(do_QueryInterface(aContent));
++  nsIAccessible* accessible = nsnull;
+   if (domNode == mDOMNode) {
+     accessible = this;
+     if (!aFromValue) {
+@@ -1519,10 +1519,10 @@ nsresult nsAccessible::AppendNameFromAcc
+     }
+   }
+   else {
+-    nsCOMPtr<nsIAccessibilityService> accService =
++    nsIAccessibilityService* accService =
+       do_GetService("@mozilla.org/accessibilityService;1");
+     NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
+-    accService->GetAccessibleInWeakShell(domNode, mWeakShell, getter_AddRefs(accessible));
++    accService->GetAccessibleInWeakShell(domNode, mWeakShell, &accessible);
+   }
+   if (accessible) {
+     if (aFromValue) {
+@@ -1551,13 +1551,13 @@ nsresult nsAccessible::AppendFlatStringF
+   if (aContent->IsNodeOfType(nsINode::eTEXT)) {
+     // If it's a text node, append the text
+     PRBool isHTMLBlock = PR_FALSE;
+-    nsCOMPtr<nsIPresShell> shell = GetPresShell();
++    nsIPresShell* shell = GetPresShell();
+     if (!shell) {
+       return NS_ERROR_FAILURE;  
+     }
+ 
+     nsIContent *parentContent = aContent->GetParent();
+-    nsCOMPtr<nsIContent> appendedSubtreeStart(do_QueryInterface(mDOMNode));
++    nsIContent* appendedSubtreeStart(do_QueryInterface(mDOMNode));
+     if (parentContent && parentContent != appendedSubtreeStart) {
+       nsIFrame *frame = shell->GetPrimaryFrameFor(parentContent);
+       if (frame) {
+@@ -1593,7 +1593,7 @@ nsresult nsAccessible::AppendFlatStringF
+   nsAutoString textEquivalent;
+   if (!aContent->IsNodeOfType(nsINode::eHTML)) {
+     if (aContent->IsNodeOfType(nsINode::eXUL)) {
+-      nsCOMPtr<nsIPresShell> shell = GetPresShell();
++      nsIPresShell* shell = GetPresShell();
+       if (!shell) {
+         return NS_ERROR_FAILURE;  
+       }
+@@ -1602,7 +1602,7 @@ nsresult nsAccessible::AppendFlatStringF
+         return NS_OK;
+       }
+ 
+-      nsCOMPtr<nsIDOMXULLabeledControlElement> labeledEl(do_QueryInterface(aContent));
++      nsIDOMXULLabeledControlElement* labeledEl(do_QueryInterface(aContent));
+       if (labeledEl) {
+         labeledEl->GetLabel(textEquivalent);
+       }
+@@ -1622,7 +1622,7 @@ nsresult nsAccessible::AppendFlatStringF
+     return NS_OK; // Not HTML and not XUL -- we don't handle it yet
+   }
+ 
+-  nsCOMPtr<nsIAtom> tag = aContent->Tag();
++  nsIAtom* tag = aContent->Tag();
+   if (tag == nsAccessibilityAtoms::img) {
+     return AppendNameFromAccessibleFor(aContent, aFlatString);
+   }
+@@ -1686,7 +1686,7 @@ nsresult nsAccessible::AppendFlatStringF
+   // Depth first search for all text nodes that are decendants of content node.
+   // Append all the text into one flat string
+   PRUint32 numChildren = 0;
+-  nsCOMPtr<nsIDOMXULSelectControlElement> selectControlEl(do_QueryInterface(aContent));
++  nsIDOMXULSelectControlElement* selectControlEl(do_QueryInterface(aContent));
+   if (!selectControlEl) {  // Don't walk children of elements with options, just get label directly
+     numChildren = aContent->GetChildCount();
+   }
+@@ -1750,7 +1750,7 @@ nsresult nsAccessible::GetTextFromRelati
+   // Get DHTML name from content subtree pointed to by ID attribute
+   aName.Truncate();
+   NS_ASSERTION(mDOMNode, "Called from shutdown accessible");
+-  nsCOMPtr<nsIContent> content = GetRoleContent(mDOMNode);
++  nsIContent* content = GetRoleContent(mDOMNode);
+   if (!content)
+     return NS_OK;
+ 
+@@ -1760,7 +1760,7 @@ nsresult nsAccessible::GetTextFromRelati
+   }
+   ids.CompressWhitespace(PR_TRUE, PR_TRUE);
+ 
+-  nsCOMPtr<nsIDOMDocument> domDoc = do_QueryInterface(content->GetOwnerDoc());
++  nsIDOMDocument* domDoc = do_QueryInterface(content->GetOwnerDoc());
+   NS_ENSURE_TRUE(domDoc, NS_ERROR_FAILURE);
+   
+   nsresult rv = NS_ERROR_FAILURE;
+@@ -1781,8 +1781,8 @@ nsresult nsAccessible::GetTextFromRelati
+     if (!aName.IsEmpty()) {
+       aName += ' '; // Need whitespace between multiple labels or descriptions
+     }
+-    nsCOMPtr<nsIDOMElement> labelElement;
+-    domDoc->GetElementById(id, getter_AddRefs(labelElement));
++    nsIDOMElement* labelElement = nsnull;
++    domDoc->GetElementById(id, &labelElement);
+     content = do_QueryInterface(labelElement);
+     if (!content) {
+       return NS_OK;
+@@ -1804,7 +1804,7 @@ nsresult nsAccessible::GetTextFromRelati
+   */
+ nsresult nsAccessible::GetHTMLName(nsAString& aLabel, PRBool aCanAggregateSubtree)
+ {
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   if (!content) {
+     return NS_ERROR_FAILURE;   // Node shut down
+   }
+@@ -1857,7 +1857,7 @@ nsresult nsAccessible::GetHTMLName(nsASt
+   */
+ nsresult nsAccessible::GetXULName(nsAString& aLabel, PRBool aCanAggregateSubtree)
+ {
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   NS_ASSERTION(content, "No nsIContent for DOM node");
+ 
+   // First check for label override via accessibility labelledby relationship
+@@ -1869,21 +1869,21 @@ nsresult nsAccessible::GetXULName(nsAStr
+   }
+ 
+   // CASE #1 (via label attribute) -- great majority of the cases
+-  nsCOMPtr<nsIDOMXULLabeledControlElement> labeledEl(do_QueryInterface(mDOMNode));
++  nsIDOMXULLabeledControlElement* labeledEl(do_QueryInterface(mDOMNode));
+   if (labeledEl) {
+     rv = labeledEl->GetLabel(label);
+   }
+   else {
+-    nsCOMPtr<nsIDOMXULSelectControlItemElement> itemEl(do_QueryInterface(mDOMNode));
++    nsIDOMXULSelectControlItemElement* itemEl(do_QueryInterface(mDOMNode));
+     if (itemEl) {
+       rv = itemEl->GetLabel(label);
+     }
+     else {
+-      nsCOMPtr<nsIDOMXULSelectControlElement> select(do_QueryInterface(mDOMNode));
++      nsIDOMXULSelectControlElement* select(do_QueryInterface(mDOMNode));
+       // Use label if this is not a select control element which 
+       // uses label attribute to indicate which option is selected
+       if (!select) {
+-        nsCOMPtr<nsIDOMXULElement> xulEl(do_QueryInterface(mDOMNode));
++        nsIDOMXULElement* xulEl(do_QueryInterface(mDOMNode));
+         if (xulEl) {
+           rv = xulEl->GetAttribute(NS_LITERAL_STRING("label"), label);
+         }
+@@ -1898,7 +1898,7 @@ nsresult nsAccessible::GetXULName(nsAStr
+       nsAccUtils::FindNeighbourPointingToNode(content, nsAccessibilityAtoms::control,
+                                               nsAccessibilityAtoms::label);
+ 
+-    nsCOMPtr<nsIDOMXULLabelElement> xulLabel(do_QueryInterface(labelContent));
++    nsIDOMXULLabelElement* xulLabel(do_QueryInterface(labelContent));
+     // Check if label's value attribute is used
+     if (xulLabel && NS_SUCCEEDED(xulLabel->GetValue(label)) && label.IsEmpty()) {
+       // If no value attribute, a non-empty label must contain
+@@ -1943,11 +1943,11 @@ PRBool nsAccessible::IsNodeRelevant(nsID
+ {
+   // Can this node be accessible and attached to
+   // the document's accessible tree?
+-  nsCOMPtr<nsIAccessibilityService> accService =
++  nsIAccessibilityService* accService =
+     do_GetService("@mozilla.org/accessibilityService;1");
+   NS_ENSURE_TRUE(accService, PR_FALSE);
+-  nsCOMPtr<nsIDOMNode> relevantNode;
+-  accService->GetRelevantContentNodeFor(aNode, getter_AddRefs(relevantNode));
++  nsIDOMNode* relevantNode = nsnull;
++  accService->GetRelevantContentNodeFor(aNode, &relevantNode);
+   return aNode == relevantNode;
+ }
+ 
+@@ -1958,7 +1958,7 @@ nsAccessible::FireToolkitEvent(PRUint32 
+   if (!mWeakShell)
+     return NS_ERROR_FAILURE;
+ 
+-  nsCOMPtr<nsIAccessibleEvent> accEvent =
++  nsIAccessibleEvent* accEvent =
+     new nsAccEvent(aEvent, aTarget);
+   NS_ENSURE_TRUE(accEvent, NS_ERROR_OUT_OF_MEMORY);
+ 
+@@ -1969,11 +1969,11 @@ nsAccessible::FireAccessibleEvent(nsIAcc
+ nsAccessible::FireAccessibleEvent(nsIAccessibleEvent *aEvent)
+ {
+   NS_ENSURE_ARG_POINTER(aEvent);
+-  nsCOMPtr<nsIDOMNode> eventNode;
+-  aEvent->GetDOMNode(getter_AddRefs(eventNode));
++  nsIDOMNode* eventNode = nsnull;
++  aEvent->GetDOMNode(&eventNode);
+   NS_ENSURE_TRUE(IsNodeRelevant(eventNode), NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIObserverService> obsService =
++  nsIObserverService* obsService =
+     do_GetService("@mozilla.org/observer-service;1");
+   NS_ENSURE_TRUE(obsService, NS_ERROR_FAILURE);
+ 
+@@ -1991,7 +1991,7 @@ NS_IMETHODIMP nsAccessible::GetFinalRole
+     // These unfortunate exceptions don't fit into the ARIA table
+     // This is where the nsIAccessible role depends on both the role and ARIA state
+     if (*aRole == nsIAccessibleRole::ROLE_PUSHBUTTON) {
+-      nsCOMPtr<nsIContent> content = do_QueryInterface(mDOMNode);
++      nsIContent* content = do_QueryInterface(mDOMNode);
+       if (content) {
+         if (content->HasAttr(kNameSpaceID_None, nsAccessibilityAtoms::aria_pressed)) {
+           // For aria-pressed="false" or aria-pressed="true"
+@@ -2007,21 +2007,21 @@ NS_IMETHODIMP nsAccessible::GetFinalRole
+     }
+     else if (*aRole == nsIAccessibleRole::ROLE_LISTBOX) {
+       // A listbox inside of a combo box needs a special role because of ATK mapping to menu
+-      nsCOMPtr<nsIAccessible> possibleCombo;
+-      GetParent(getter_AddRefs(possibleCombo));
++      nsIAccessible* possibleCombo = nsnull;
++      GetParent(&possibleCombo);
+       if (possibleCombo && Role(possibleCombo) == nsIAccessibleRole::ROLE_COMBOBOX) {
+         *aRole = nsIAccessibleRole::ROLE_COMBOBOX_LIST;
+       }
+       else {   // Check to see if combo owns the listbox instead
+-        GetAccessibleRelated(nsIAccessibleRelation::RELATION_NODE_CHILD_OF, getter_AddRefs(possibleCombo));
++        GetAccessibleRelated(nsIAccessibleRelation::RELATION_NODE_CHILD_OF, &possibleCombo);
+         if (possibleCombo && Role(possibleCombo) == nsIAccessibleRole::ROLE_COMBOBOX) {
+           *aRole = nsIAccessibleRole::ROLE_COMBOBOX_LIST;
+         }
+       }
+     }
+     else if (*aRole == nsIAccessibleRole::ROLE_OPTION) {
+-      nsCOMPtr<nsIAccessible> parent;
+-      GetParent(getter_AddRefs(parent));
++      nsIAccessible* parent = nsnull;
++      GetParent(&parent);
+       if (parent && Role(parent) == nsIAccessibleRole::ROLE_COMBOBOX_LIST) {
+         *aRole = nsIAccessibleRole::ROLE_COMBOBOX_OPTION;
+       }
+@@ -2048,12 +2048,12 @@ nsAccessible::GetAttributes(nsIPersisten
+   if (IsDefunct())
+     return NS_ERROR_FAILURE;
+ 
+-  nsCOMPtr<nsIContent> content = GetRoleContent(mDOMNode);
++  nsIContent* content = GetRoleContent(mDOMNode);
+   if (!content) {
+     return NS_ERROR_FAILURE;
+   }
+ 
+-  nsCOMPtr<nsIPersistentProperties> attributes = *aAttributes;
++  nsIPersistentProperties* attributes = *aAttributes;
+   if (!attributes) {
+     // Create only if an array wasn't already passed in
+     attributes = do_CreateInstance(NS_PERSISTENTPROPERTIES_CONTRACTID);
+@@ -2077,7 +2077,7 @@ nsAccessible::GetAttributes(nsIPersisten
+     attributes->SetStringProperty(NS_LITERAL_CSTRING("xml-roles"),  xmlRoles, oldValueUnused);          
+   }
+ 
+-  nsCOMPtr<nsIAccessibleValue> supportsValue = do_QueryInterface(static_cast<nsIAccessible*>(this));
++  nsIAccessibleValue* supportsValue = do_QueryInterface(static_cast<nsIAccessible*>(this));
+   if (supportsValue) {
+     // We support values, so expose the string value as well, via the valuetext object attribute
+     // We test for the value interface because we don't want to expose traditional get_accValue()
+@@ -2132,14 +2132,14 @@ nsAccessible::GetAttributes(nsIPersisten
+           role == nsIAccessibleRole::ROLE_RADIO_MENU_ITEM)
+         baseRole = nsIAccessibleRole::ROLE_MENUITEM;
+ 
+-      nsCOMPtr<nsIAccessible> parent = GetParent();
++      nsIAccessible* parent = GetParent();
+       NS_ENSURE_TRUE(parent, NS_ERROR_FAILURE);
+ 
+       PRInt32 positionInGroup = 0;
+       PRInt32 setSize = 0;
+ 
+-      nsCOMPtr<nsIAccessible> sibling, nextSibling;
+-      parent->GetFirstChild(getter_AddRefs(sibling));
++      nsIAccessible* sibling = nsnull, *nextSibling = nsnull;
++      parent->GetFirstChild(&sibling);
+       NS_ENSURE_TRUE(sibling, NS_ERROR_FAILURE);
+ 
+       PRBool foundCurrent = PR_FALSE;
+@@ -2173,14 +2173,14 @@ nsAccessible::GetAttributes(nsIPersisten
+           setSize = 0;
+         }
+ 
+-        sibling->GetNextSibling(getter_AddRefs(nextSibling));
++        sibling->GetNextSibling(&nextSibling);
+         sibling = nextSibling;
+       }
+ 
+       PRInt32 groupLevel = 0;
+       if (role == nsIAccessibleRole::ROLE_OUTLINEITEM) {
+         groupLevel = 1;
+-        nsCOMPtr<nsIAccessible> nextParent;
++        nsIAccessible* nextParent = nsnull;
+         while (parent) {
+           parent->GetFinalRole(&role);
+ 
+@@ -2189,8 +2189,8 @@ nsAccessible::GetAttributes(nsIPersisten
+           if (role == nsIAccessibleRole::ROLE_GROUPING)
+             ++ groupLevel;
+ 
+-          parent->GetParent(getter_AddRefs(nextParent));
+-          parent.swap(nextParent);
++          parent->GetParent(&nextParent);
++          swap(parent, nextParent);
+         }
+       }
+ 
+@@ -2227,7 +2227,7 @@ nsAccessible::GetAttributesInternal(nsIP
+   // Attributes set by this method will not be used to override attributes on a sub-document accessible
+   // when there is a <frame>/<iframe> element that spawned the sub-document
+   nsIContent *content = GetRoleContent(mDOMNode);
+-  nsCOMPtr<nsIDOMElement> element(do_QueryInterface(content));
++  nsIDOMElement* element(do_QueryInterface(content));
+   NS_ENSURE_TRUE(element, NS_ERROR_UNEXPECTED);
+ 
+   nsAutoString tagName;
+@@ -2252,18 +2252,18 @@ nsAccessible::GetAttributesInternal(nsIP
+   //   The inner nodes can be used to override live region behavior on more general outer nodes
+   // However, nodes in outer documents override nodes in inner documents:
+   //   Outer doc author may want to override properties on a widget they used in an iframe
+-  nsCOMPtr<nsIDOMNode> startNode = mDOMNode;
++  nsIDOMNode* startNode = mDOMNode;
+   nsIContent *startContent = content;
+   while (PR_TRUE) {
+     NS_ENSURE_STATE(startContent);
+     nsIDocument *doc = startContent->GetDocument();
+-    nsCOMPtr<nsIDOMNode> docNode = do_QueryInterface(doc);
++    nsIDOMNode* docNode = do_QueryInterface(doc);
+     NS_ENSURE_STATE(docNode);
+     nsIContent *topContent = GetRoleContent(docNode);
+     NS_ENSURE_STATE(topContent);
+     nsAccUtils::GetLiveContainerAttributes(aAttributes, startContent, topContent);
+     // Allow ARIA live region markup from outer documents to override
+-    nsCOMPtr<nsISupports> container = doc->GetContainer();
++    nsISupports* container = doc->GetContainer();
+     nsIDocShellTreeItem *docShellTreeItem = nsnull;
+     if (container)
+       CallQueryInterface(container, &docShellTreeItem);
+@@ -2310,8 +2310,8 @@ nsAccessible::GroupPosition(PRInt32 *aGr
+   *aSimilarItemsInGroup = 0;
+   *aPositionInGroup = 0;
+ 
+-  nsCOMPtr<nsIPersistentProperties> attributes;
+-  nsresult rv = GetAttributes(getter_AddRefs(attributes));
++  nsIPersistentProperties* attributes = nsnull;
++  nsresult rv = GetAttributes(&attributes);
+   NS_ENSURE_SUCCESS(rv, rv);
+   if (!attributes) {
+     return NS_ERROR_FAILURE;
+@@ -2374,15 +2374,15 @@ nsAccessible::GetFinalState(PRUint32 *aS
+     } else {
+       // Expose 'selected' state on ARIA tab if the focus is on internal element
+       // of related tabpanel.
+-      nsCOMPtr<nsIAccessible> tabPanel;
++      nsIAccessible* tabPanel = nsnull;
+       rv = GetAccessibleRelated(nsIAccessibleRelation::RELATION_LABEL_FOR,
+-                                getter_AddRefs(tabPanel));
++                                &tabPanel);
+       NS_ENSURE_SUCCESS(rv, rv);
+ 
+       if (tabPanel && Role(tabPanel) == nsIAccessibleRole::ROLE_PROPERTYPAGE) {
+-        nsCOMPtr<nsIAccessNode> tabPanelAccessNode(do_QueryInterface(tabPanel));
+-        nsCOMPtr<nsIDOMNode> tabPanelNode;
+-        tabPanelAccessNode->GetDOMNode(getter_AddRefs(tabPanelNode));
++        nsIAccessNode* tabPanelAccessNode(do_QueryInterface(tabPanel));
++        nsIDOMNode* tabPanelNode = nsnull;
++        tabPanelAccessNode->GetDOMNode(&tabPanelNode);
+         NS_ENSURE_STATE(tabPanelNode);
+ 
+         if (nsAccUtils::IsAncestorOf(tabPanelNode, gLastFocusedNode))
+@@ -2419,7 +2419,7 @@ nsAccessible::GetFinalState(PRUint32 *aS
+     // pointing at it, we mark it as ACTIVE even if it's not currently focused.
+     // This allows screen reader virtual buffer modes to know which descendant
+     // is the current one that would get focus if the user navigates to the container widget.
+-    nsCOMPtr<nsIContent> content = do_QueryInterface(mDOMNode);
++    nsIContent* content = do_QueryInterface(mDOMNode);
+     nsAutoString id;
+     if (content && nsAccUtils::GetID(content, id)) {
+       nsIContent *ancestorContent = content;
+@@ -2442,7 +2442,7 @@ nsAccessible::GetFinalState(PRUint32 *aS
+   if (role == nsIAccessibleRole::ROLE_ENTRY ||
+       role == nsIAccessibleRole::ROLE_COMBOBOX) {
+ 
+-    nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++    nsIContent* content(do_QueryInterface(mDOMNode));
+     NS_ENSURE_STATE(content);
+ 
+     nsAutoString autocomplete;
+@@ -2561,7 +2561,7 @@ nsAccessible::GetValue(nsAString& aValue
+   if (IsDefunct())
+     return NS_ERROR_FAILURE;
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   if (!content)
+     return NS_OK;
+ 
+@@ -2582,7 +2582,7 @@ nsAccessible::GetValue(nsAString& aValue
+ 
+   // Check if it's an simple xlink.
+   if (nsAccUtils::IsXLink(content)) {
+-    nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
++    nsIPresShell* presShell(do_QueryReferent(mWeakShell));
+     if (presShell)
+       return presShell->GetLinkLocation(mDOMNode, aValue);
+   }
+@@ -2642,7 +2642,7 @@ nsAccessible::SetCurrentValue(double aVa
+   if (NS_SUCCEEDED(GetMaximumValue(&maxValue)) && aValue > maxValue)
+     return NS_ERROR_INVALID_ARG;
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   NS_ENSURE_STATE(content);
+ 
+   nsAutoString newValue;
+@@ -2694,7 +2694,7 @@ NS_IMETHODIMP nsAccessible::GetRole(PRUi
+   if (IsDefunct())
+     return NS_ERROR_FAILURE;
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   if (nsAccUtils::IsXLink(content))
+     *aRole = nsIAccessibleRole::ROLE_LINK;
+ 
+@@ -2711,7 +2711,7 @@ nsAccessible::GetNumActions(PRUint8 *aNu
+   if (IsDefunct())
+     return NS_ERROR_FAILURE;
+ 
+-  nsCOMPtr<nsIContent> content = GetRoleContent(mDOMNode);
++  nsIContent* content = GetRoleContent(mDOMNode);
+   if (!content)
+     return NS_OK;
+ 
+@@ -2744,7 +2744,7 @@ nsAccessible::GetActionName(PRUint8 aInd
+     return NS_ERROR_FAILURE;
+ 
+   // Check if it's simple xlink.
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   if (nsAccUtils::IsXLink(content)) {
+     aName.AssignLiteral("jump");
+     return NS_OK;
+@@ -2787,7 +2787,7 @@ nsAccessible::DoAction(PRUint8 aIndex)
+   PRBool doAction = PR_FALSE;
+ 
+   // Check if it's simple xlink.
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   if (nsAccUtils::IsXLink(content))
+     doAction = PR_TRUE;
+ 
+@@ -2833,14 +2833,14 @@ NS_IMETHODIMP nsAccessible::GetAccessibl
+ 
+ nsIDOMNode* nsAccessible::GetAtomicRegion()
+ {
+-  nsCOMPtr<nsIContent> content = GetRoleContent(mDOMNode);
++  nsIContent* content = GetRoleContent(mDOMNode);
+   nsIContent *loopContent = content;
+   nsAutoString atomic;
+   while (loopContent && !loopContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::aria_atomic, atomic)) {
+     loopContent = loopContent->GetParent();
+   }
+ 
+-  nsCOMPtr<nsIDOMNode> atomicRegion;
++  nsIDOMNode* atomicRegion = nsnull;
+   if (atomic.EqualsLiteral("true")) {
+     atomicRegion = do_QueryInterface(loopContent);
+   }
+@@ -2861,7 +2861,7 @@ NS_IMETHODIMP nsAccessible::GetAccessibl
+     return NS_ERROR_FAILURE;  // Node already shut down
+   }
+ 
+-  nsCOMPtr<nsIDOMNode> relatedNode;
++  nsIDOMNode* relatedNode = nsnull;
+   nsAutoString relatedID;
+ 
+   // Search for the related DOM node according to the specified "relation type"
+@@ -2962,47 +2962,47 @@ NS_IMETHODIMP nsAccessible::GetAccessibl
+     {
+       if (content->IsNodeOfType(nsINode::eHTML)) {
+         // HTML form controls implements nsIFormControl interface.
+-        nsCOMPtr<nsIFormControl> control(do_QueryInterface(content));
++        nsIFormControl* control(do_QueryInterface(content));
+         if (control) {
+-          nsCOMPtr<nsIDOMHTMLFormElement> htmlform;
+-          control->GetForm(getter_AddRefs(htmlform));
+-          nsCOMPtr<nsIForm> form(do_QueryInterface(htmlform));
++          nsIDOMHTMLFormElement* htmlform = nsnull;
++          control->GetForm(&htmlform);
++          nsIForm* form(do_QueryInterface(htmlform));
+           if (form)
+             relatedNode = do_QueryInterface(form->GetDefaultSubmitElement());
+         }
+       }
+       else {
+         // In XUL, use first <button default="true" .../> in the document
+-        nsCOMPtr<nsIDOMXULDocument> xulDoc = do_QueryInterface(content->GetDocument());
+-        nsCOMPtr<nsIDOMXULButtonElement> buttonEl;
++        nsIDOMXULDocument* xulDoc = do_QueryInterface(content->GetDocument());
++        nsIDOMXULButtonElement* buttonEl = nsnull;
+         if (xulDoc) {
+-          nsCOMPtr<nsIDOMNodeList> possibleDefaultButtons;
++          nsIDOMNodeList* possibleDefaultButtons = nsnull;
+           xulDoc->GetElementsByAttribute(NS_LITERAL_STRING("default"),
+                                          NS_LITERAL_STRING("true"),
+-                                         getter_AddRefs(possibleDefaultButtons));
++                                         &possibleDefaultButtons);
+           if (possibleDefaultButtons) {
+             PRUint32 length;
+             possibleDefaultButtons->GetLength(&length);
+-            nsCOMPtr<nsIDOMNode> possibleButton;
++            nsIDOMNode* possibleButton = nsnull;
+             // Check for button in list of default="true" elements
+             for (PRUint32 count = 0; count < length && !buttonEl; count ++) {
+-              possibleDefaultButtons->Item(count, getter_AddRefs(possibleButton));
++              possibleDefaultButtons->Item(count, &possibleButton);
+               buttonEl = do_QueryInterface(possibleButton);
+             }
+           }
+           if (!buttonEl) { // Check for anonymous accept button in <dialog>
+-            nsCOMPtr<nsIDOMDocumentXBL> xblDoc(do_QueryInterface(xulDoc));
++            nsIDOMDocumentXBL* xblDoc(do_QueryInterface(xulDoc));
+             if (xblDoc) {
+-              nsCOMPtr<nsIDOMDocument> domDoc = do_QueryInterface(xulDoc);
++              nsIDOMDocument* domDoc = do_QueryInterface(xulDoc);
+               NS_ASSERTION(domDoc, "No DOM document");
+-              nsCOMPtr<nsIDOMElement> rootEl;
+-              domDoc->GetDocumentElement(getter_AddRefs(rootEl));
++              nsIDOMElement* rootEl = nsnull;
++              domDoc->GetDocumentElement(&rootEl);
+               if (rootEl) {
+-                nsCOMPtr<nsIDOMElement> possibleButtonEl;
++                nsIDOMElement* possibleButtonEl = nsnull;
+                 xblDoc->GetAnonymousElementByAttribute(rootEl,
+                                                       NS_LITERAL_STRING("default"),
+                                                       NS_LITERAL_STRING("true"),
+-                                                      getter_AddRefs(possibleButtonEl));
++                                                      &possibleButtonEl);
+                 buttonEl = do_QueryInterface(possibleButtonEl);
+               }
+             }
+@@ -3023,17 +3023,17 @@ NS_IMETHODIMP nsAccessible::GetAccessibl
+ 
+   if (!relatedID.IsEmpty()) {
+     // In some cases we need to get the relatedNode from an ID-style attribute
+-    nsCOMPtr<nsIDOMDocument> domDoc;
+-    mDOMNode->GetOwnerDocument(getter_AddRefs(domDoc));
++    nsIDOMDocument* domDoc = nsnull;
++    mDOMNode->GetOwnerDocument(&domDoc);
+     NS_ENSURE_TRUE(domDoc, NS_ERROR_FAILURE);
+-    nsCOMPtr<nsIDOMElement> relatedEl;
+-    domDoc->GetElementById(relatedID, getter_AddRefs(relatedEl));
++    nsIDOMElement* relatedEl = nsnull;
++    domDoc->GetElementById(relatedID, &relatedEl);
+     relatedNode = do_QueryInterface(relatedEl);
+   }
+ 
+   // Return the corresponding accessible if the related DOM node is found
+   if (relatedNode) {
+-    nsCOMPtr<nsIAccessibilityService> accService = GetAccService();
++    nsIAccessibilityService* accService = GetAccService();
+     NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
+     accService->GetAccessibleInWeakShell(relatedNode, mWeakShell, aRelated);
+   }
+@@ -3046,8 +3046,8 @@ nsAccessible::GetRelationsCount(PRUint32
+   NS_ENSURE_ARG_POINTER(aCount);
+   *aCount = 0;
+ 
+-  nsCOMPtr<nsIArray> relations;
+-  nsresult rv = GetRelations(getter_AddRefs(relations));
++  nsIArray* relations = nsnull;
++  nsresult rv = GetRelations(&relations);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+   return relations->GetLength(aCount);
+@@ -3059,13 +3059,13 @@ nsAccessible::GetRelation(PRUint32 aInde
+   NS_ENSURE_ARG_POINTER(aRelation);
+   *aRelation = nsnull;
+ 
+-  nsCOMPtr<nsIArray> relations;
+-  nsresult rv = GetRelations(getter_AddRefs(relations));
++  nsIArray* relations = nsnull;
++  nsresult rv = GetRelations(&relations);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+-  nsCOMPtr<nsIAccessibleRelation> relation;
++  nsIAccessibleRelation* relation = nsnull;
+   rv = relations->QueryElementAt(aIndex, NS_GET_IID(nsIAccessibleRelation),
+-                                 getter_AddRefs(relation));
++                                 (void**)&relation);
+ 
+   // nsIArray::QueryElementAt() returns NS_ERROR_ILLEGAL_VALUE on invalid index.
+   if (rv == NS_ERROR_ILLEGAL_VALUE)
+@@ -3082,17 +3082,17 @@ nsAccessible::GetRelations(nsIArray **aR
+ {
+   NS_ENSURE_ARG_POINTER(aRelations);
+ 
+-  nsCOMPtr<nsIMutableArray> relations = do_CreateInstance(NS_ARRAY_CONTRACTID);
++  nsIMutableArray* relations = do_CreateInstance(NS_ARRAY_CONTRACTID);
+   NS_ENSURE_TRUE(relations, NS_ERROR_OUT_OF_MEMORY);
+ 
+   for (PRUint32 relType = nsIAccessibleRelation::RELATION_FIRST;
+        relType < nsIAccessibleRelation::RELATION_LAST;
+        ++relType) {
+-    nsCOMPtr<nsIAccessible> accessible;
+-    GetAccessibleRelated(relType, getter_AddRefs(accessible));
++    nsIAccessible* accessible = nsnull;
++    GetAccessibleRelated(relType, &accessible);
+ 
+     if (accessible) {
+-      nsCOMPtr<nsIAccessibleRelation> relation =
++      nsIAccessibleRelation* relation =
+         new nsAccessibleRelationWrap(relType, accessible);
+       NS_ENSURE_TRUE(relation, NS_ERROR_OUT_OF_MEMORY);
+ 
+@@ -3123,7 +3123,7 @@ void nsAccessible::DoCommandCallback(nsI
+   NS_RELEASE(gDoCommandTimer);
+ 
+   nsIContent *content = reinterpret_cast<nsIContent*>(aClosure);
+-  nsCOMPtr<nsIDOMXULElement> xulElement(do_QueryInterface(content));
++  nsIDOMXULElement* xulElement(do_QueryInterface(content));
+   if (xulElement) {
+     xulElement->Click();
+   }
+@@ -3132,7 +3132,7 @@ void nsAccessible::DoCommandCallback(nsI
+     if (!doc) {
+       return;
+     }
+-    nsCOMPtr<nsIPresShell> presShell = doc->GetPrimaryShell();
++    nsIPresShell* presShell = doc->GetPrimaryShell();
+     nsPIDOMWindow *outerWindow = doc->GetWindow();
+     if (presShell && outerWindow) {
+       nsAutoPopupStatePusher popupStatePusher(outerWindow, openAllowed);
+@@ -3165,7 +3165,7 @@ void nsAccessible::DoCommandCallback(nsI
+  */
+ nsresult nsAccessible::DoCommand(nsIContent *aContent)
+ {
+-  nsCOMPtr<nsIContent> content = aContent;
++  nsIContent* content = aContent;
+   if (!content) {
+     content = do_QueryInterface(mDOMNode);
+   }
+@@ -3175,7 +3175,7 @@ nsresult nsAccessible::DoCommand(nsICont
+     return NS_ERROR_FAILURE;
+   }
+ 
+-  nsCOMPtr<nsITimer> timer = do_CreateInstance("@mozilla.org/timer;1");
++  nsITimer* timer = do_CreateInstance("@mozilla.org/timer;1");
+   if (!timer) {
+     return NS_ERROR_OUT_OF_MEMORY;
+   } 
+@@ -3186,35 +3186,35 @@ nsresult nsAccessible::DoCommand(nsICont
+                                                nsITimer::TYPE_ONE_SHOT);
+ }
+ 
+-already_AddRefed<nsIAccessible>
++nsIAccessible*
+ nsAccessible::GetNextWithState(nsIAccessible *aStart, PRUint32 matchState)
+ {
+   // Return the next descendant that matches one of the states in matchState
+   // Uses depth first search
+   NS_ASSERTION(matchState, "GetNextWithState() not called with a state to match");
+   NS_ASSERTION(aStart, "GetNextWithState() not called with an accessible to start with");
+-  nsCOMPtr<nsIAccessible> look, current = aStart;
++  nsIAccessible* look = nsnull, *current = aStart;
+   PRUint32 state = 0;
+   while (0 == (state & matchState)) {
+-    current->GetFirstChild(getter_AddRefs(look));
++    current->GetFirstChild(&look);
+     while (!look) {
+       if (current == this) {
+         return nsnull; // At top of subtree
+       }
+-      current->GetNextSibling(getter_AddRefs(look));
++      current->GetNextSibling(&look);
+       if (!look) {
+-        current->GetParent(getter_AddRefs(look));
++        current->GetParent(&look);
+         current = look;
+         look = nsnull;
+         continue;
+       }
+     }
+-    current.swap(look);
++    swap(current, look);
+     state = State(current);
+   }
+ 
+   nsIAccessible *returnAccessible = nsnull;
+-  current.swap(returnAccessible);
++  swap(current, returnAccessible);
+ 
+   return returnAccessible;
+ }
+@@ -3224,11 +3224,11 @@ NS_IMETHODIMP nsAccessible::GetSelectedC
+ {
+   *aSelectedAccessibles = nsnull;
+ 
+-  nsCOMPtr<nsIMutableArray> selectedAccessibles =
++  nsIMutableArray* selectedAccessibles =
+     do_CreateInstance(NS_ARRAY_CONTRACTID);
+   NS_ENSURE_STATE(selectedAccessibles);
+ 
+-  nsCOMPtr<nsIAccessible> selected = this;
++  nsIAccessible* selected = this;
+   while ((selected = GetNextWithState(selected, nsIAccessibleStates::STATE_SELECTED)) != nsnull) {
+     selectedAccessibles->AppendElement(selected, PR_FALSE);
+   }
+@@ -3250,7 +3250,7 @@ NS_IMETHODIMP nsAccessible::RefSelection
+   if (aIndex < 0) {
+     return NS_ERROR_FAILURE;
+   }
+-  nsCOMPtr<nsIAccessible> selected = this;
++  nsIAccessible* selected = this;
+   PRInt32 count = 0;
+   while (count ++ <= aIndex) {
+     selected = GetNextWithState(selected, nsIAccessibleStates::STATE_SELECTED);
+@@ -3265,7 +3265,7 @@ NS_IMETHODIMP nsAccessible::GetSelection
+ NS_IMETHODIMP nsAccessible::GetSelectionCount(PRInt32 *aSelectionCount)
+ {
+   *aSelectionCount = 0;
+-  nsCOMPtr<nsIAccessible> selected = this;
++  nsIAccessible* selected = this;
+   while ((selected = GetNextWithState(selected, nsIAccessibleStates::STATE_SELECTED)) != nsnull) {
+     ++ *aSelectionCount;
+   }
+@@ -3281,8 +3281,8 @@ NS_IMETHODIMP nsAccessible::AddChildToSe
+ 
+   NS_ENSURE_TRUE(aIndex >= 0, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIAccessible> child;
+-  GetChildAt(aIndex, getter_AddRefs(child));
++  nsIAccessible* child = nsnull;
++  GetChildAt(aIndex, &child);
+ 
+   PRUint32 state = State(child);
+   if (!(state & nsIAccessibleStates::STATE_SELECTABLE)) {
+@@ -3300,8 +3300,8 @@ NS_IMETHODIMP nsAccessible::RemoveChildF
+ 
+   NS_ENSURE_TRUE(aIndex >= 0, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIAccessible> child;
+-  GetChildAt(aIndex, getter_AddRefs(child));
++  nsIAccessible* child = nsnull;
++  GetChildAt(aIndex, &child);
+ 
+   PRUint32 state = State(child);
+   if (!(state & nsIAccessibleStates::STATE_SELECTED)) {
+@@ -3320,8 +3320,8 @@ NS_IMETHODIMP nsAccessible::IsChildSelec
+   *aIsSelected = PR_FALSE;
+   NS_ENSURE_TRUE(aIndex >= 0, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIAccessible> child;
+-  GetChildAt(aIndex, getter_AddRefs(child));
++  nsIAccessible* child = nsnull;
++  GetChildAt(aIndex, &child);
+ 
+   PRUint32 state = State(child);
+   if (state & nsIAccessibleStates::STATE_SELECTED) {
+@@ -3332,7 +3332,7 @@ NS_IMETHODIMP nsAccessible::IsChildSelec
+ 
+ NS_IMETHODIMP nsAccessible::ClearSelection()
+ {
+-  nsCOMPtr<nsIAccessible> selected = this;
++  nsIAccessible* selected = this;
+   while ((selected = GetNextWithState(selected, nsIAccessibleStates::STATE_SELECTED)) != nsnull) {
+     selected->SetSelected(PR_FALSE);
+   }
+@@ -3341,7 +3341,7 @@ NS_IMETHODIMP nsAccessible::ClearSelecti
+ 
+ NS_IMETHODIMP nsAccessible::SelectAllSelection(PRBool *_retval)
+ {
+-  nsCOMPtr<nsIAccessible> selectable = this;
++  nsIAccessible* selectable = this;
+   while ((selectable = GetNextWithState(selectable, nsIAccessibleStates::STATE_SELECTED)) != nsnull) {
+     selectable->SetSelected(PR_TRUE);
+   }
+@@ -3392,13 +3392,13 @@ nsAccessible::GetURI(PRInt32 aIndex, nsI
+     return NS_ERROR_INVALID_ARG;
+ 
+   // Check if it's simple xlink.
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   if (nsAccUtils::IsXLink(content)) {
+     nsAutoString href;
+     content->GetAttr(kNameSpaceID_XLink, nsAccessibilityAtoms::href, href);
+ 
+-    nsCOMPtr<nsIURI> baseURI = content->GetBaseURI();
+-    nsCOMPtr<nsIDocument> document = content->GetOwnerDoc();
++    nsIURI* baseURI = content->GetBaseURI();
++    nsIDocument* document = content->GetOwnerDoc();
+     return NS_NewURI(aURI, href,
+                      document ? document->GetDocumentCharacterSet().get() : nsnull,
+                      baseURI);
+@@ -3449,14 +3449,14 @@ nsresult nsAccessible::GetLinkOffset(PRI
+ nsresult nsAccessible::GetLinkOffset(PRInt32* aStartOffset, PRInt32* aEndOffset)
+ {
+   *aStartOffset = *aEndOffset = 0;
+-  nsCOMPtr<nsIAccessible> parent(GetParent());
++  nsIAccessible* parent(GetParent());
+   if (!parent) {
+     return NS_ERROR_FAILURE;
+   }
+ 
+-  nsCOMPtr<nsIAccessible> accessible, nextSibling;
++  nsIAccessible* accessible = nsnull, *nextSibling = nsnull;
+   PRInt32 characterCount = 0;
+-  parent->GetFirstChild(getter_AddRefs(accessible));
++  parent->GetFirstChild(&accessible);
+ 
+   while (accessible) {
+     if (IsText(accessible)) {
+@@ -3470,8 +3470,8 @@ nsresult nsAccessible::GetLinkOffset(PRI
+     else {
+       ++ characterCount;
+     }
+-    accessible->GetNextSibling(getter_AddRefs(nextSibling));
+-    accessible.swap(nextSibling);
++    accessible->GetNextSibling(&nextSibling);
++    swap(accessible, nextSibling);
+   }
+ 
+   return NS_ERROR_FAILURE;
+@@ -3482,7 +3482,7 @@ PRInt32 nsAccessible::TextLength(nsIAcce
+   if (!IsText(aAccessible))
+     return 1;
+ 
+-  nsCOMPtr<nsPIAccessNode> pAccNode(do_QueryInterface(aAccessible));
++  nsPIAccessNode* pAccNode(do_QueryInterface(aAccessible));
+   NS_ASSERTION(pAccNode, "QI to nsPIAccessNode failed");
+ 
+   nsIFrame *frame = pAccNode->GetFrame();
+@@ -3500,7 +3500,7 @@ PRInt32 nsAccessible::TextLength(nsIAcce
+   // They don't have their own frame.
+   // XXX In the future, list bullets may have frame and anon content, so 
+   // we should be able to remove this at that point
+-  nsCOMPtr<nsPIAccessible> pAcc(do_QueryInterface(aAccessible));
++  nsPIAccessible* pAcc(do_QueryInterface(aAccessible));
+   NS_ASSERTION(pAcc, "QI to nsPIAccessible failed");
+ 
+   nsAutoString text;
+@@ -3514,16 +3514,16 @@ nsAccessible::AppendTextTo(nsAString& aT
+   return NS_OK;
+ }
+ 
+-already_AddRefed<nsIAccessible>
++nsIAccessible*
+ nsAccessible::GetFirstAvailableAccessible(nsIDOMNode *aStartNode, PRBool aRequireLeaf)
+ {
+   nsIAccessibilityService *accService = GetAccService();
+-  nsCOMPtr<nsIAccessible> accessible;
+-  nsCOMPtr<nsIDOMTreeWalker> walker; 
+-  nsCOMPtr<nsIDOMNode> currentNode(aStartNode);
++  nsIAccessible* accessible = nsnull;
++  nsIDOMTreeWalker* walker = nsnull; 
++  nsIDOMNode* currentNode(aStartNode);
+ 
+   while (currentNode) {
+-    accService->GetAccessibleInWeakShell(currentNode, mWeakShell, getter_AddRefs(accessible)); // AddRef'd
++    accService->GetAccessibleInWeakShell(currentNode, mWeakShell, &accessible); // AddRef'd
+     if (accessible && (!aRequireLeaf || IsLeaf(accessible))) {
+       nsIAccessible *retAccessible = accessible;
+       NS_ADDREF(retAccessible);
+@@ -3532,18 +3532,18 @@ nsAccessible::GetFirstAvailableAccessibl
+     if (!walker) {
+       // Instantiate walker lazily since we won't need it in 90% of the cases
+       // where the first DOM node we're given provides an accessible
+-      nsCOMPtr<nsIDOMDocument> document;
+-      currentNode->GetOwnerDocument(getter_AddRefs(document));
+-      nsCOMPtr<nsIDOMDocumentTraversal> trav = do_QueryInterface(document);
++      nsIDOMDocument* document = nsnull;
++      currentNode->GetOwnerDocument(&document);
++      nsIDOMDocumentTraversal* trav = do_QueryInterface(document);
+       NS_ASSERTION(trav, "No DOM document traversal for document");
+       NS_ENSURE_TRUE(trav, nsnull);
+       trav->CreateTreeWalker(mDOMNode, nsIDOMNodeFilter::SHOW_ELEMENT | nsIDOMNodeFilter::SHOW_TEXT,
+-                            nsnull, PR_FALSE, getter_AddRefs(walker));
++                            nsnull, PR_FALSE, &walker);
+       NS_ENSURE_TRUE(walker, nsnull);
+       walker->SetCurrentNode(currentNode);
+     }
+ 
+-    walker->NextNode(getter_AddRefs(currentNode));
++    walker->NextNode(&currentNode);
+   }
+ 
+   return nsnull;
+@@ -3599,7 +3599,7 @@ nsAccessible::GetAttrValue(nsIAtom *aPro
+  if (!mRoleMapEntry || mRoleMapEntry->valueRule == eNoValue)
+     return NS_OK_NO_ARIA_VALUE;
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   NS_ENSURE_STATE(content);
+ 
+   PRInt32 result = NS_OK;
+diff --git a/accessible/src/base/nsAccessible.h b/accessible/src/base/nsAccessible.h
+--- a/accessible/src/base/nsAccessible.h
++++ b/accessible/src/base/nsAccessible.h
+@@ -147,7 +147,7 @@ public:
+    */
+   static PRBool MustPrune(nsIAccessible *aAccessible);
+   
+-  already_AddRefed<nsIAccessible> GetParent() {
++  nsIAccessible* GetParent() {
+     nsIAccessible *parent = nsnull;
+     GetParent(&parent);
+     return parent;
+@@ -204,9 +204,9 @@ protected:
+   
+   // nsCOMPtr<>& is useful here, because getter_AddRefs() nulls the comptr's value, and NextChild
+   // depends on the passed-in comptr being null or already set to a child (finding the next sibling).
+-  nsIAccessible *NextChild(nsCOMPtr<nsIAccessible>& aAccessible);
++  nsIAccessible *NextChild(nsIAccessible*& aAccessible);
+     
+-  already_AddRefed<nsIAccessible> GetNextWithState(nsIAccessible *aStart, PRUint32 matchState);
++  nsIAccessible* GetNextWithState(nsIAccessible *aStart, PRUint32 matchState);
+ 
+   /**
+    * Return an accessible for the given DOM node, or if that node isn't accessible, return the
+@@ -215,10 +215,10 @@ protected:
+    * @param aRequireLeaf, only accept leaf accessible nodes
+    * @return the resulting accessible
+    */   
+-  already_AddRefed<nsIAccessible> GetFirstAvailableAccessible(nsIDOMNode *aStartNode, PRBool aRequireLeaf = PR_FALSE);
++  nsIAccessible* GetFirstAvailableAccessible(nsIDOMNode *aStartNode, PRBool aRequireLeaf = PR_FALSE);
+ 
+   // Selection helpers
+-  static already_AddRefed<nsIAccessible> GetMultiSelectFor(nsIDOMNode *aNode);
++  static nsIAccessible* GetMultiSelectFor(nsIDOMNode *aNode);
+ 
+   // Hyperlink helpers
+   virtual nsresult GetLinkOffset(PRInt32* aStartOffset, PRInt32* aEndOffset);
+diff --git a/accessible/src/base/nsAccessibleEventData.cpp b/accessible/src/base/nsAccessibleEventData.cpp
+--- a/accessible/src/base/nsAccessibleEventData.cpp
++++ b/accessible/src/base/nsAccessibleEventData.cpp
+@@ -88,8 +88,8 @@ void nsAccEvent::GetLastEventAttributes(
+ 
+ void nsAccEvent::CaptureIsFromUserInput(PRBool aIsAsynch)
+ {
+-  nsCOMPtr<nsIDOMNode> eventNode;
+-  GetDOMNode(getter_AddRefs(eventNode));
++  nsIDOMNode* eventNode = nsnull;
++  GetDOMNode(&eventNode);
+   if (!eventNode) {
+     NS_NOTREACHED("There should always be a DOM node for an event");
+     return;
+@@ -124,8 +124,8 @@ void nsAccEvent::PrepareForEvent(nsIAcce
+                                  PRBool aForceIsFromUserInput)
+ {
+   gLastEventFromUserInput = aForceIsFromUserInput;
+-  nsCOMPtr<nsIDOMNode> eventNode;
+-  aEvent->GetDOMNode(getter_AddRefs(eventNode));
++  nsIDOMNode* eventNode = nsnull;
++  aEvent->GetDOMNode(&eventNode);
+   if (!gLastEventFromUserInput) {  // Caller is not forcing user input flag
+     aEvent->GetIsFromUserInput(&gLastEventFromUserInput);
+     if (!gLastEventFromUserInput) {
+@@ -152,18 +152,18 @@ void nsAccEvent::PrepareForEvent(nsIDOMN
+     return;
+   }
+ 
+-  nsCOMPtr<nsIDOMDocument> domDoc;
+-  aEventNode->GetOwnerDocument(getter_AddRefs(domDoc));
++  nsIDOMDocument* domDoc = nsnull;
++  aEventNode->GetOwnerDocument(&domDoc);
+   if (!domDoc) {  // IF the node is a document itself
+     domDoc = do_QueryInterface(aEventNode);
+   }
+-  nsCOMPtr<nsIDocument> doc = do_QueryInterface(domDoc);
++  nsIDocument* doc = do_QueryInterface(domDoc);
+   if (!doc) {
+     NS_NOTREACHED("There should always be a document for an event");
+     return;
+   }
+ 
+-  nsCOMPtr<nsIPresShell> presShell = doc->GetPrimaryShell();
++  nsIPresShell* presShell = doc->GetPrimaryShell();
+   if (!presShell) {
+     NS_NOTREACHED("Threre should always be an pres shell for an event");
+     return;
+@@ -205,7 +205,7 @@ nsAccEvent::GetDOMNode(nsIDOMNode **aDOM
+   *aDOMNode = nsnull;
+ 
+   if (!mDOMNode) {
+-    nsCOMPtr<nsIAccessNode> accessNode(do_QueryInterface(mAccessible));
++    nsIAccessNode* accessNode(do_QueryInterface(mAccessible));
+     NS_ENSURE_TRUE(accessNode, NS_ERROR_FAILURE);
+     accessNode->GetDOMNode(getter_AddRefs(mDOMNode));
+   }
+@@ -222,11 +222,11 @@ nsAccEvent::GetAccessibleDocument(nsIAcc
+ 
+   if (!mDocAccessible) {
+     if (!mAccessible) {
+-      nsCOMPtr<nsIAccessible> accessible;
+-      GetAccessible(getter_AddRefs(accessible));
++      nsIAccessible* accessible = nsnull;
++      GetAccessible(&accessible);
+     }
+ 
+-    nsCOMPtr<nsIAccessNode> accessNode(do_QueryInterface(mAccessible));
++    nsIAccessNode* accessNode(do_QueryInterface(mAccessible));
+     NS_ENSURE_TRUE(accessNode, NS_ERROR_FAILURE);
+     accessNode->GetAccessibleDocument(getter_AddRefs(mDocAccessible));
+   }
+@@ -235,13 +235,13 @@ nsAccEvent::GetAccessibleDocument(nsIAcc
+   return NS_OK;
+ }
+ 
+-already_AddRefed<nsIAccessible>
++nsIAccessible*
+ nsAccEvent::GetAccessibleByNode()
+ {
+   if (!mDOMNode)
+     return nsnull;
+ 
+-  nsCOMPtr<nsIAccessibilityService> accService = 
++  nsIAccessibilityService* accService = 
+     do_GetService("@mozilla.org/accessibilityService;1");
+   if (!accService)
+     return nsnull;
+@@ -256,20 +256,20 @@ nsAccEvent::GetAccessibleByNode()
+   nsAutoString localName;
+   mDOMNode->GetLocalName(localName);
+   if (localName.EqualsLiteral("tree")) {
+-    nsCOMPtr<nsIDOMXULMultiSelectControlElement> multiSelect =
++    nsIDOMXULMultiSelectControlElement* multiSelect =
+       do_QueryInterface(mDOMNode);
+     if (multiSelect) {
+       PRInt32 treeIndex = -1;
+       multiSelect->GetCurrentIndex(&treeIndex);
+       if (treeIndex >= 0) {
+-        nsCOMPtr<nsIAccessibleTreeCache> treeCache(do_QueryInterface(accessible));
++        nsIAccessibleTreeCache* treeCache(do_QueryInterface(accessible));
+         NS_IF_RELEASE(accessible);
+-        nsCOMPtr<nsIAccessible> treeItemAccessible;
++        nsIAccessible* treeItemAccessible = nsnull;
+         if (!treeCache ||
+             NS_FAILED(treeCache->GetCachedTreeitemAccessible(
+                       treeIndex,
+                       nsnull,
+-                      getter_AddRefs(treeItemAccessible))) ||
++                      &treeItemAccessible)) ||
+                       !treeItemAccessible) {
+           return nsnull;
+         }
+@@ -288,12 +288,12 @@ nsAccEvent::ApplyEventRules(nsCOMArray<n
+ {
+   PRUint32 numQueuedEvents = aEventsToFire.Count();
+   for (PRInt32 tail = numQueuedEvents - 1; tail >= 0; tail --) {
+-    nsRefPtr<nsAccEvent> tailEvent = GetAccEventPtr(aEventsToFire[tail]);
++    nsAccEvent* tailEvent = GetAccEventPtr(aEventsToFire[tail]);
+     switch(tailEvent->mEventRule) {
+       case nsAccEvent::eCoalesceFromSameSubtree:
+       {
+         for (PRInt32 index = 0; index < tail; index ++) {
+-          nsRefPtr<nsAccEvent> thisEvent = GetAccEventPtr(aEventsToFire[index]);
++          nsAccEvent* thisEvent = GetAccEventPtr(aEventsToFire[index]);
+           if (thisEvent->mEventType != tailEvent->mEventType)
+             continue; // Different type
+ 
+@@ -342,7 +342,7 @@ nsAccEvent::ApplyEventRules(nsCOMArray<n
+       {
+         // Check for repeat events.
+         for (PRInt32 index = 0; index < tail; index ++) {
+-          nsRefPtr<nsAccEvent> accEvent = GetAccEventPtr(aEventsToFire[index]);
++          nsAccEvent* accEvent = GetAccEventPtr(aEventsToFire[index]);
+           if (accEvent->mEventType == tailEvent->mEventType &&
+               accEvent->mEventRule == tailEvent->mEventRule &&
+               accEvent->mDOMNode == tailEvent->mDOMNode) {
+@@ -362,7 +362,7 @@ nsAccEvent::ApplyToSiblings(nsCOMArray<n
+                              EEventRule aEventRule)
+ {
+   for (PRUint32 index = aStart; index < aEnd; index ++) {
+-    nsRefPtr<nsAccEvent> accEvent = GetAccEventPtr(aEventsToFire[index]);
++    nsAccEvent* accEvent = GetAccEventPtr(aEventsToFire[index]);
+     if (accEvent->mEventType == aEventType &&
+         accEvent->mEventRule != nsAccEvent::eDoNotEmit &&
+         nsAccUtils::AreSiblings(accEvent->mDOMNode, aDOMNode)) {
+@@ -402,7 +402,7 @@ nsAccStateChangeEvent::
+   // Use GetAccessibleByNode() because we do not want to store an accessible
+   // since it leads to problems with delayed events in the case when
+   // an accessible gets reorder event before delayed event is processed.
+-  nsCOMPtr<nsIAccessible> accessible(GetAccessibleByNode());
++  nsIAccessible* accessible(GetAccessibleByNode());
+   if (accessible) {
+     PRUint32 state = 0, extraState = 0;
+     accessible->GetFinalState(&state, mIsExtraState ? &extraState : nsnull);
+@@ -445,7 +445,7 @@ nsAccTextChangeEvent::
+              aAccessible, aIsAsynch),
+   mStart(aStart), mLength(aLength), mIsInserted(aIsInserted)
+ {
+-  nsCOMPtr<nsIAccessibleText> textAccessible = do_QueryInterface(aAccessible);
++  nsIAccessibleText* textAccessible = do_QueryInterface(aAccessible);
+   NS_ASSERTION(textAccessible, "Should not be firing test change event for non-text accessible!!!");
+   if (textAccessible) {
+     textAccessible->GetText(aStart, aStart + aLength, mModifiedText);
+diff --git a/accessible/src/base/nsAccessibleEventData.h b/accessible/src/base/nsAccessibleEventData.h
+--- a/accessible/src/base/nsAccessibleEventData.h
++++ b/accessible/src/base/nsAccessibleEventData.h
+@@ -100,7 +100,7 @@ public:
+                                      nsIPersistentProperties *aAttributes);
+ 
+ protected:
+-  already_AddRefed<nsIAccessible> GetAccessibleByNode();
++  nsIAccessible* GetAccessibleByNode();
+ 
+   void CaptureIsFromUserInput(PRBool aIsAsynch);
+   PRBool mIsFromUserInput;
+@@ -122,7 +122,7 @@ public:
+     return eventType;
+   }
+   static EEventRule EventRule(nsIAccessibleEvent *aAccEvent) {
+-    nsRefPtr<nsAccEvent> accEvent = GetAccEventPtr(aAccEvent);
++    nsAccEvent* accEvent = GetAccEventPtr(aAccEvent);
+     return accEvent->mEventRule;
+   }
+   static PRBool IsFromUserInput(nsIAccessibleEvent *aAccEvent) {
+@@ -164,7 +164,7 @@ public:
+   static void ApplyEventRules(nsCOMArray<nsIAccessibleEvent> &aEventsToFire);
+ 
+ private:
+-  static already_AddRefed<nsAccEvent> GetAccEventPtr(nsIAccessibleEvent *aAccEvent) {
++  static nsAccEvent* GetAccEventPtr(nsIAccessibleEvent *aAccEvent) {
+     nsAccEvent* accEvent = nsnull;
+     aAccEvent->QueryInterface(NS_GET_IID(nsAccEvent), (void**)&accEvent);
+     return accEvent;
+diff --git a/accessible/src/base/nsAccessibleRelation.cpp b/accessible/src/base/nsAccessibleRelation.cpp
+--- a/accessible/src/base/nsAccessibleRelation.cpp
++++ b/accessible/src/base/nsAccessibleRelation.cpp
+@@ -86,7 +86,7 @@ nsAccessibleRelation::GetTargets(nsIArra
+ {
+   NS_ENSURE_ARG_POINTER(aRelations);
+ 
+-  nsCOMPtr<nsIMutableArray> relations = do_CreateInstance(NS_ARRAY_CONTRACTID);
++  nsIMutableArray* relations = do_CreateInstance(NS_ARRAY_CONTRACTID);
+   NS_ENSURE_TRUE(relations, NS_ERROR_OUT_OF_MEMORY);
+ 
+   relations->AppendElement(mTarget, PR_FALSE);
+diff --git a/accessible/src/base/nsAccessibleTreeWalker.cpp b/accessible/src/base/nsAccessibleTreeWalker.cpp
+--- a/accessible/src/base/nsAccessibleTreeWalker.cpp
++++ b/accessible/src/base/nsAccessibleTreeWalker.cpp
+@@ -71,7 +71,7 @@ nsAccessibleTreeWalker::~nsAccessibleTre
+ 
+ void nsAccessibleTreeWalker::GetKids(nsIDOMNode *aParentNode)
+ {
+-  nsCOMPtr<nsIContent> parentContent(do_QueryInterface(aParentNode));
++  nsIContent* parentContent(do_QueryInterface(aParentNode));
+   if (!parentContent || !parentContent->IsNodeOfType(nsINode::eHTML)) {
+     mState.frame = nsnull;  // Don't walk frames in non-HTML content, just walk the DOM.
+   }
+@@ -209,7 +209,7 @@ NS_IMETHODIMP nsAccessibleTreeWalker::Ge
+     return NS_ERROR_FAILURE;
+   }
+ 
+-  nsCOMPtr<nsIDOMNode> parent(mState.domNode);
++  nsIDOMNode* parent(mState.domNode);
+   GetKids(parent); // Side effects change our state (mState)
+ 
+   // Recursive loop: depth first search for first accessible child
+@@ -282,7 +282,7 @@ PRBool nsAccessibleTreeWalker::GetAccess
+   }
+ 
+   mState.accessible = nsnull;
+-  nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
++  nsIPresShell* presShell(do_QueryReferent(mWeakShell));
+ 
+   mAccService->GetAccessible(mState.domNode, presShell, mWeakShell,
+                              &mState.frame, &mState.isHidden,
+diff --git a/accessible/src/base/nsAccessibleTreeWalker.h b/accessible/src/base/nsAccessibleTreeWalker.h
+--- a/accessible/src/base/nsAccessibleTreeWalker.h
++++ b/accessible/src/base/nsAccessibleTreeWalker.h
+@@ -89,8 +89,8 @@ protected:
+   void UpdateFrame(PRBool aTryFirstChild);
+   void GetNextDOMNode();
+ 
+-  nsCOMPtr<nsIWeakReference> mWeakShell;
+-  nsCOMPtr<nsIAccessibilityService> mAccService;
++  nsIWeakReference* mWeakShell;
++  nsIAccessibilityService* mAccService;
+   PRBool mWalkAnonContent;
+ };
+ 
+diff --git a/accessible/src/base/nsApplicationAccessible.cpp b/accessible/src/base/nsApplicationAccessible.cpp
+--- a/accessible/src/base/nsApplicationAccessible.cpp
++++ b/accessible/src/base/nsApplicationAccessible.cpp
+@@ -68,15 +68,15 @@ NS_IMETHODIMP
+ NS_IMETHODIMP
+ nsApplicationAccessible::GetName(nsAString& aName)
+ {
+-  nsCOMPtr<nsIStringBundleService> bundleService =
++  nsIStringBundleService* bundleService =
+     do_GetService(NS_STRINGBUNDLE_CONTRACTID);
+ 
+   NS_ASSERTION(bundleService, "String bundle service must be present!");
+   NS_ENSURE_STATE(bundleService);
+ 
+-  nsCOMPtr<nsIStringBundle> bundle;
++  nsIStringBundle* bundle = nsnull;
+   bundleService->CreateBundle("chrome://branding/locale/brand.properties",
+-                              getter_AddRefs(bundle));
++                              &bundle);
+ 
+   nsXPIDLString appName;
+   if (bundle) {
+@@ -141,13 +141,13 @@ nsApplicationAccessible::GetChildAt(PRIn
+   if (aChildNum < 0)
+     aChildNum = count - 1;
+ 
+-  nsCOMPtr<nsIWeakReference> childWeakRef;
++  nsIWeakReference* childWeakRef = nsnull;
+   rv = mChildren->QueryElementAt(aChildNum, NS_GET_IID(nsIWeakReference),
+-                                 getter_AddRefs(childWeakRef));
++                                 (void**)&childWeakRef);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+   if (childWeakRef) {
+-    nsCOMPtr<nsIAccessible> childAcc(do_QueryReferent(childWeakRef));
++    nsIAccessible* childAcc(do_QueryReferent(childWeakRef));
+     NS_IF_ADDREF(*aChild = childAcc);
+   }
+ 
+@@ -191,16 +191,16 @@ nsApplicationAccessible::CacheChildren()
+ 
+   if (mAccChildCount == eChildCountUninitialized) {
+     mAccChildCount = 0;// Prevent reentry
+-    nsCOMPtr<nsISimpleEnumerator> enumerator;
+-    mChildren->Enumerate(getter_AddRefs(enumerator));
++    nsISimpleEnumerator* enumerator = nsnull;
++    mChildren->Enumerate(&enumerator);
+ 
+-    nsCOMPtr<nsIWeakReference> childWeakRef;
+-    nsCOMPtr<nsIAccessible> accessible;
+-    nsCOMPtr<nsPIAccessible> previousAccessible;
++    nsIWeakReference* childWeakRef = nsnull;
++    nsIAccessible* accessible = nsnull;
++    nsPIAccessible* previousAccessible = nsnull;
+     PRBool hasMoreElements;
+     while(NS_SUCCEEDED(enumerator->HasMoreElements(&hasMoreElements))
+           && hasMoreElements) {
+-      enumerator->GetNext(getter_AddRefs(childWeakRef));
++      enumerator->GetNext((nsISupports**)&childWeakRef);
+       accessible = do_QueryReferent(childWeakRef);
+       if (accessible) {
+         if (previousAccessible)
+@@ -242,7 +242,7 @@ nsApplicationAccessible::RemoveRootAcces
+   PRUint32 index = 0;
+ 
+   // we must use weak ref to get the index
+-  nsCOMPtr<nsIWeakReference> weakPtr = do_GetWeakReference(aRootAccessible);
++  nsIWeakReference* weakPtr = do_GetWeakReference(aRootAccessible);
+   nsresult rv = mChildren->IndexOf(0, weakPtr, &index);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+diff --git a/accessible/src/base/nsBaseWidgetAccessible.cpp b/accessible/src/base/nsBaseWidgetAccessible.cpp
+--- a/accessible/src/base/nsBaseWidgetAccessible.cpp
++++ b/accessible/src/base/nsBaseWidgetAccessible.cpp
+@@ -114,7 +114,7 @@ NS_IMETHODIMP
+ NS_IMETHODIMP
+ nsLinkableAccessible::TakeFocus()
+ {
+-  nsCOMPtr<nsIAccessible> actionAcc = GetActionAccessible();
++  nsIAccessible* actionAcc = GetActionAccessible();
+   if (actionAcc)
+     return actionAcc->TakeFocus();
+ 
+@@ -129,7 +129,7 @@ nsLinkableAccessible::GetState(PRUint32 
+ 
+   if (mIsLink) {
+     *aState |= nsIAccessibleStates::STATE_LINKED;
+-    nsCOMPtr<nsIAccessible> actionAcc = GetActionAccessible();
++    nsIAccessible* actionAcc = GetActionAccessible();
+     if (actionAcc && (State(actionAcc) & nsIAccessibleStates::STATE_TRAVERSED))
+       *aState |= nsIAccessibleStates::STATE_TRAVERSED;
+   }
+@@ -147,7 +147,7 @@ nsLinkableAccessible::GetValue(nsAString
+     return NS_OK;
+ 
+   if (mIsLink) {
+-    nsCOMPtr<nsIAccessible> actionAcc = GetActionAccessible();
++    nsIAccessible* actionAcc = GetActionAccessible();
+     if (actionAcc)
+       return actionAcc->GetValue(aValue);
+   }
+@@ -188,7 +188,7 @@ NS_IMETHODIMP
+ NS_IMETHODIMP
+ nsLinkableAccessible::DoAction(PRUint8 aIndex)
+ {
+-  nsCOMPtr<nsIAccessible> actionAcc = GetActionAccessible();
++  nsIAccessible* actionAcc = GetActionAccessible();
+   if (actionAcc)
+     return actionAcc->DoAction(aIndex);
+ 
+@@ -200,7 +200,7 @@ nsLinkableAccessible::GetKeyboardShortcu
+ {
+   aKeyboardShortcut.Truncate();
+ 
+-  nsCOMPtr<nsIAccessible> actionAcc = GetActionAccessible();
++  nsIAccessible* actionAcc = GetActionAccessible();
+   if (actionAcc)
+     return actionAcc->GetKeyboardShortcut(aKeyboardShortcut);
+ 
+@@ -214,9 +214,9 @@ nsLinkableAccessible::GetURI(PRInt32 aIn
+ nsLinkableAccessible::GetURI(PRInt32 aIndex, nsIURI **aURI)
+ {
+   if (mIsLink) {
+-    nsCOMPtr<nsIAccessible> actionAcc = GetActionAccessible();
++    nsIAccessible* actionAcc = GetActionAccessible();
+     if (actionAcc) {
+-      nsCOMPtr<nsIAccessibleHyperLink> hyperLinkAcc =
++      nsIAccessibleHyperLink* hyperLinkAcc =
+         do_QueryInterface(actionAcc);
+       NS_ASSERTION(hyperLinkAcc,
+                    "nsIAccessibleHyperLink isn't implemented.");
+@@ -252,7 +252,7 @@ void
+ void
+ nsLinkableAccessible::CacheActionContent()
+ {
+-  nsCOMPtr<nsIContent> walkUpContent(do_QueryInterface(mDOMNode));
++  nsIContent* walkUpContent(do_QueryInterface(mDOMNode));
+   PRBool isOnclick = nsAccUtils::HasListener(walkUpContent,
+                                              NS_LITERAL_STRING("click"));
+ 
+@@ -266,11 +266,11 @@ nsLinkableAccessible::CacheActionContent
+     isOnclick = nsAccUtils::HasListener(walkUpContent,
+                                         NS_LITERAL_STRING("click"));
+   
+-    nsCOMPtr<nsIDOMNode> walkUpNode(do_QueryInterface(walkUpContent));
++    nsIDOMNode* walkUpNode(do_QueryInterface(walkUpContent));
+ 
+-    nsCOMPtr<nsIAccessible> walkUpAcc;
++    nsIAccessible* walkUpAcc = nsnull;
+     GetAccService()->GetAccessibleInWeakShell(walkUpNode, mWeakShell,
+-                                              getter_AddRefs(walkUpAcc));
++                                              &walkUpAcc);
+ 
+     if (walkUpAcc && Role(walkUpAcc) == nsIAccessibleRole::ROLE_LINK &&
+         (State(walkUpAcc) & nsIAccessibleStates::STATE_LINKED)) {
+@@ -287,14 +287,14 @@ nsLinkableAccessible::CacheActionContent
+   }
+ }
+ 
+-already_AddRefed<nsIAccessible>
++nsIAccessible*
+ nsLinkableAccessible::GetActionAccessible()
+ {
+   // Return accessible for the action content if it's different from node of
+   // this accessible. If the action accessible is not null then it is used to
+   // redirect methods calls otherwise we use method implementation from the
+   // base class.
+-  nsCOMPtr<nsIDOMNode> actionNode(do_QueryInterface(mActionContent));
++  nsIDOMNode* actionNode(do_QueryInterface(mActionContent));
+   if (!actionNode || mDOMNode == actionNode)
+     return nsnull;
+ 
+diff --git a/accessible/src/base/nsBaseWidgetAccessible.h b/accessible/src/base/nsBaseWidgetAccessible.h
+--- a/accessible/src/base/nsBaseWidgetAccessible.h
++++ b/accessible/src/base/nsBaseWidgetAccessible.h
+@@ -101,7 +101,7 @@ protected:
+   /**
+    * Return an accessible for cached action node.
+    */
+-  already_AddRefed<nsIAccessible> GetActionAccessible();
++  nsIAccessible* GetActionAccessible();
+ 
+   /**
+    * Cache action node.
+diff --git a/accessible/src/base/nsCaretAccessible.cpp b/accessible/src/base/nsCaretAccessible.cpp
+--- a/accessible/src/base/nsCaretAccessible.cpp
++++ b/accessible/src/base/nsCaretAccessible.cpp
+@@ -81,7 +81,7 @@ nsresult nsCaretAccessible::ClearControl
+   mCurrentControl = nsnull;
+   mCurrentControlSelection = nsnull;
+ 
+-  nsCOMPtr<nsISelectionPrivate> selPrivate(do_QueryReferent(mCurrentControlSelection));
++  nsISelectionPrivate* selPrivate(do_QueryReferent(mCurrentControlSelection));
+   if (!selPrivate) {
+     return NS_OK;
+   }
+@@ -100,15 +100,15 @@ nsresult nsCaretAccessible::SetControlSe
+ 
+   // When focus moves such that the caret is part of a new frame selection
+   // this removes the old selection listener and attaches a new one for the current focus
+-  nsCOMPtr<nsIPresShell> presShell = 
++  nsIPresShell* presShell = 
+     mRootAccessible->GetPresShellFor(aCurrentNode);
+   if (!presShell)
+     return NS_ERROR_FAILURE;
+ 
+-  nsCOMPtr<nsIDocument> doc = presShell->GetDocument();
++  nsIDocument* doc = presShell->GetDocument();
+   NS_ENSURE_TRUE(doc, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(aCurrentNode));
++  nsIContent* content(do_QueryInterface(aCurrentNode));
+   // The control selection listener is only for form controls, not for the document
+   // When there is no document, the content will be null
+   if (!content) {
+@@ -121,14 +121,14 @@ nsresult nsCaretAccessible::SetControlSe
+   nsPresContext *presContext = presShell->GetPresContext();
+   NS_ENSURE_TRUE(presContext, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsISelectionController> selCon;
+-  frame->GetSelectionController(presContext, getter_AddRefs(selCon));
++  nsISelectionController* selCon = nsnull;
++  frame->GetSelectionController(presContext, &selCon);
+   NS_ENSURE_TRUE(selCon, NS_ERROR_FAILURE);
+   
+-  nsCOMPtr<nsISelection> domSel;
+-  selCon->GetSelection(nsISelectionController::SELECTION_NORMAL, getter_AddRefs(domSel));
++  nsISelection* domSel = nsnull;
++  selCon->GetSelection(nsISelectionController::SELECTION_NORMAL, &domSel);
+ 
+-  nsCOMPtr<nsISelectionPrivate> selPrivate(do_QueryInterface(domSel));
++  nsISelectionPrivate* selPrivate(do_QueryInterface(domSel));
+   NS_ENSURE_TRUE(selPrivate, NS_ERROR_FAILURE);
+ 
+   mCurrentControlSelection = do_GetWeakReference(domSel);
+@@ -140,12 +140,12 @@ nsCaretAccessible::AddDocSelectionListen
+ {
+   NS_ENSURE_TRUE(mRootAccessible, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsISelectionController> selCon = do_QueryInterface(aShell);
++  nsISelectionController* selCon = do_QueryInterface(aShell);
+   NS_ENSURE_TRUE(selCon, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsISelection> domSel;
+-  selCon->GetSelection(nsISelectionController::SELECTION_NORMAL, getter_AddRefs(domSel));
+-  nsCOMPtr<nsISelectionPrivate> selPrivate = do_QueryInterface(domSel);
++  nsISelection* domSel = nsnull;
++  selCon->GetSelection(nsISelectionController::SELECTION_NORMAL, &domSel);
++  nsISelectionPrivate* selPrivate = do_QueryInterface(domSel);
+   NS_ENSURE_TRUE(selPrivate, NS_ERROR_FAILURE);
+ 
+   return selPrivate->AddSelectionListener(this);
+@@ -154,12 +154,12 @@ nsresult
+ nsresult
+ nsCaretAccessible::RemoveDocSelectionListener(nsIPresShell *aShell)
+ {
+-  nsCOMPtr<nsISelectionController> selCon = do_QueryInterface(aShell);
++  nsISelectionController* selCon = do_QueryInterface(aShell);
+   NS_ENSURE_TRUE(selCon, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsISelection> domSel;
+-  selCon->GetSelection(nsISelectionController::SELECTION_NORMAL, getter_AddRefs(domSel));
+-  nsCOMPtr<nsISelectionPrivate> selPrivate = do_QueryInterface(domSel);
++  nsISelection* domSel = nsnull;
++  selCon->GetSelection(nsISelectionController::SELECTION_NORMAL, &domSel);
++  nsISelectionPrivate* selPrivate = do_QueryInterface(domSel);
+   NS_ENSURE_TRUE(selPrivate, NS_ERROR_FAILURE);
+ 
+   return selPrivate->RemoveSelectionListener(this);
+@@ -171,26 +171,26 @@ NS_IMETHODIMP nsCaretAccessible::NotifyS
+ 
+   mLastUsedSelection = do_GetWeakReference(aSel);
+ 
+-  nsCOMPtr<nsIDocument> doc = do_QueryInterface(aDoc);
++  nsIDocument* doc = do_QueryInterface(aDoc);
+   NS_ENSURE_TRUE(doc, NS_OK);
+   nsIPresShell *presShell = doc->GetPrimaryShell();
+   NS_ENSURE_TRUE(presShell, NS_OK);
+ 
+   // Get first nsIAccessibleText in parent chain and fire caret-move, selection-change event for it
+-  nsCOMPtr<nsIAccessible> accessible;
++  nsIAccessible* accessible = nsnull;
+   nsIAccessibilityService *accService = mRootAccessible->GetAccService();
+   NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
+   // Get accessible from selection's focus node or its parent
+-  nsCOMPtr<nsIDOMNode> focusNode;
+-  aSel->GetFocusNode(getter_AddRefs(focusNode));
++  nsIDOMNode* focusNode = nsnull;
++  aSel->GetFocusNode(&focusNode);
+   if (!focusNode) {
+     mLastTextAccessible = nsnull;
+     return NS_OK; // No selection
+   }
+ 
+-  nsCOMPtr<nsIAccessibleDocument> docAccessible =
++  nsIAccessibleDocument* docAccessible =
+     nsAccessNode::GetDocAccessibleFor(focusNode);
+-  nsCOMPtr<nsIAccessible> accessibleForDoc =
++  nsIAccessible* accessibleForDoc =
+     do_QueryInterface(docAccessible);
+   if (!accessibleForDoc) {
+     return NS_OK;
+@@ -201,27 +201,27 @@ NS_IMETHODIMP nsCaretAccessible::NotifyS
+     return NS_OK;  // Don't fire caret moves until doc loaded
+   }
+ 
+-  nsCOMPtr<nsIDOMNode> nodeWithCaret = focusNode;
++  nsIDOMNode* nodeWithCaret = focusNode;
+ 
+-  nsCOMPtr<nsIAccessibleText> textAcc;
++  nsIAccessibleText* textAcc = nsnull;
+   while (focusNode) {
+     // Make sure to get the correct starting node for selection events inside XBL content trees
+-    nsCOMPtr<nsIDOMNode> relevantNode;
+-    if (NS_SUCCEEDED(accService->GetRelevantContentNodeFor(focusNode, getter_AddRefs(relevantNode))) && relevantNode) {
++    nsIDOMNode* relevantNode = nsnull;
++    if (NS_SUCCEEDED(accService->GetRelevantContentNodeFor(focusNode, &relevantNode)) && relevantNode) {
+       focusNode  = relevantNode;
+     }
+ 
+-    nsCOMPtr<nsIContent> content = do_QueryInterface(focusNode);
++    nsIContent* content = do_QueryInterface(focusNode);
+     if (!content || !content->IsNodeOfType(nsINode::eTEXT)) {
+-      accService->GetAccessibleInShell(focusNode, presShell,  getter_AddRefs(accessible));
++      accService->GetAccessibleInShell(focusNode, presShell,  &accessible);
+       textAcc = do_QueryInterface(accessible);
+       if (textAcc) {
+         break;
+       }
+     }
+-    nsCOMPtr<nsIDOMNode> parentNode;
+-    focusNode->GetParentNode(getter_AddRefs(parentNode));
+-    focusNode.swap(parentNode);
++    nsIDOMNode* parentNode = nsnull;
++    focusNode->GetParentNode(&parentNode);
++    swap(focusNode, parentNode);
+   }
+   NS_ASSERTION(textAcc, "No nsIAccessibleText for caret move event!"); // No nsIAccessibleText for caret move event!
+   NS_ENSURE_TRUE(textAcc, NS_ERROR_FAILURE);
+@@ -240,7 +240,7 @@ NS_IMETHODIMP nsCaretAccessible::NotifyS
+   mLastCaretOffset = caretOffset;
+   mLastTextAccessible = textAcc;
+ 
+-  nsCOMPtr<nsIAccessibleCaretMoveEvent> event =
++  nsIAccessibleCaretMoveEvent* event =
+     new nsAccCaretMoveEvent(focusNode);
+   NS_ENSURE_TRUE(event, NS_ERROR_OUT_OF_MEMORY);
+ 
+@@ -259,23 +259,23 @@ nsCaretAccessible::GetCaretRect(nsIWidge
+     return caretRect;    // Return empty rect
+   }
+ 
+-  nsCOMPtr<nsIAccessNode> lastAccessNode(do_QueryInterface(mLastTextAccessible));
++  nsIAccessNode* lastAccessNode(do_QueryInterface(mLastTextAccessible));
+   NS_ENSURE_TRUE(lastAccessNode, caretRect);
+ 
+-  nsCOMPtr<nsIDOMNode> lastNodeWithCaret;
+-  lastAccessNode->GetDOMNode(getter_AddRefs(lastNodeWithCaret));
++  nsIDOMNode* lastNodeWithCaret = nsnull;
++  lastAccessNode->GetDOMNode(&lastNodeWithCaret);
+   NS_ENSURE_TRUE(lastNodeWithCaret, caretRect);
+ 
+-  nsCOMPtr<nsIPresShell> presShell = mRootAccessible->GetPresShellFor(lastNodeWithCaret);
++  nsIPresShell* presShell = mRootAccessible->GetPresShellFor(lastNodeWithCaret);
+   NS_ENSURE_TRUE(presShell, caretRect);
+ 
+-  nsCOMPtr<nsICaret> caret;
+-  presShell->GetCaret(getter_AddRefs(caret));
++  nsICaret* caret = nsnull;
++  presShell->GetCaret(&caret);
+   NS_ENSURE_TRUE(caret, caretRect);
+ 
+   PRBool isCollapsed;
+   nsIView *view;
+-  nsCOMPtr<nsISelection> caretSelection(do_QueryReferent(mLastUsedSelection));
++  nsISelection* caretSelection(do_QueryReferent(mLastUsedSelection));
+   NS_ENSURE_TRUE(caretSelection, caretRect);
+   
+   caret->GetCaretCoordinates(nsICaret::eRenderingViewCoordinates, caretSelection,
+diff --git a/accessible/src/base/nsDocAccessible.cpp b/accessible/src/base/nsDocAccessible.cpp
+--- a/accessible/src/base/nsDocAccessible.cpp
++++ b/accessible/src/base/nsDocAccessible.cpp
+@@ -97,7 +97,7 @@ nsDocAccessible::nsDocAccessible(nsIDOMN
+   // there can be 2 nsDocAccessible's for the content area, although for 2 different
+   // pres shells.
+ 
+-  nsCOMPtr<nsIPresShell> shell(do_QueryReferent(mWeakShell));
++  nsIPresShell* shell(do_QueryReferent(mWeakShell));
+   if (shell) {
+     // Find mDocument
+     mDocument = shell->GetDocument();
+@@ -105,8 +105,8 @@ nsDocAccessible::nsDocAccessible(nsIDOMN
+     // Find mWnd
+     nsIViewManager* vm = shell->GetViewManager();
+     if (vm) {
+-      nsCOMPtr<nsIWidget> widget;
+-      vm->GetWidget(getter_AddRefs(widget));
++      nsIWidget* widget = nsnull;
++      vm->GetWidget(&widget);
+       if (widget) {
+         mWnd = widget->GetNativeData(NS_NATIVE_WINDOW);
+       }
+@@ -116,9 +116,9 @@ nsDocAccessible::nsDocAccessible(nsIDOMN
+   // XXX aaronl should we use an algorithm for the initial cache size?
+   mAccessNodeCache.Init(kDefaultCacheSize);
+ 
+-  nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem =
++  nsIDocShellTreeItem* docShellTreeItem =
+     nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
+-  nsCOMPtr<nsIDocShell> docShell = do_QueryInterface(docShellTreeItem);
++  nsIDocShell* docShell = do_QueryInterface(docShellTreeItem);
+   if (docShell) {
+     PRUint32 busyFlags;
+     docShell->GetBusyFlags(&busyFlags);
+@@ -173,11 +173,11 @@ NS_IMETHODIMP nsDocAccessible::GetRole(P
+ {
+   *aRole = nsIAccessibleRole::ROLE_PANE; // Fall back
+ 
+-  nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem =
++  nsIDocShellTreeItem* docShellTreeItem =
+     nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
+   if (docShellTreeItem) {
+-    nsCOMPtr<nsIDocShellTreeItem> sameTypeRoot;
+-    docShellTreeItem->GetSameTypeRootTreeItem(getter_AddRefs(sameTypeRoot));
++    nsIDocShellTreeItem* sameTypeRoot = nsnull;
++    docShellTreeItem->GetSameTypeRootTreeItem(&sameTypeRoot);
+     PRInt32 itemType;
+     docShellTreeItem->GetItemType(&itemType);
+     if (sameTypeRoot == docShellTreeItem) {
+@@ -187,7 +187,7 @@ NS_IMETHODIMP nsDocAccessible::GetRole(P
+       }
+       else if (itemType == nsIDocShellTreeItem::typeContent) {
+ #ifdef MOZ_XUL
+-        nsCOMPtr<nsIXULDocument> xulDoc(do_QueryInterface(mDocument));
++        nsIXULDocument* xulDoc(do_QueryInterface(mDocument));
+         if (xulDoc) {
+           *aRole = nsIAccessibleRole::ROLE_APPLICATION;
+         } else {
+@@ -216,7 +216,7 @@ NS_IMETHODIMP nsDocAccessible::SetRoleMa
+   nsIDocument *parentDoc = mDocument->GetParentDocument();
+   NS_ENSURE_TRUE(parentDoc, NS_ERROR_FAILURE);
+   nsIContent *ownerContent = parentDoc->FindContentForSubDocument(mDocument);
+-  nsCOMPtr<nsIDOMNode> ownerNode(do_QueryInterface(ownerContent));
++  nsIDOMNode* ownerNode(do_QueryInterface(ownerContent));
+   if (ownerNode) {
+     nsRoleMapEntry *roleMapEntry = nsAccUtils::GetRoleMapEntry(ownerNode);
+     if (roleMapEntry)
+@@ -250,7 +250,7 @@ nsDocAccessible::GetState(PRUint32 *aSta
+     return NS_OK;
+ 
+ #ifdef MOZ_XUL
+-  nsCOMPtr<nsIXULDocument> xulDoc(do_QueryInterface(mDocument));
++  nsIXULDocument* xulDoc(do_QueryInterface(mDocument));
+   if (!xulDoc)
+ #endif
+   {
+@@ -281,8 +281,8 @@ nsDocAccessible::GetState(PRUint32 *aSta
+                nsIAccessibleStates::STATE_OFFSCREEN;
+   }
+ 
+-  nsCOMPtr<nsIEditor> editor;
+-  GetAssociatedEditor(getter_AddRefs(editor));
++  nsIEditor* editor = nsnull;
++  GetAssociatedEditor(&editor);
+   if (!editor) {
+     *aState |= nsIAccessibleStates::STATE_READONLY;
+   }
+@@ -301,7 +301,7 @@ nsDocAccessible::GetARIAState(PRUint32 *
+   nsresult rv = nsAccessible::GetARIAState(aState);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+-  nsCOMPtr<nsPIAccessible> privateParentAccessible = do_QueryInterface(mParent);
++  nsPIAccessible* privateParentAccessible = do_QueryInterface(mParent);
+   if (privateParentAccessible)  // Allow iframe/frame etc. to have final state override via ARIA
+     return privateParentAccessible->GetARIAState(aState);
+ 
+@@ -327,7 +327,7 @@ NS_IMETHODIMP nsDocAccessible::GetFocuse
+ 
+   // Return an accessible for the current global focus, which does not have to
+   // be contained within the current document.
+-  nsCOMPtr<nsIAccessibilityService> accService =
++  nsIAccessibilityService* accService =
+     do_GetService("@mozilla.org/accessibilityService;1");
+   return accService->GetAccessibleFor(gLastFocusedNode, aFocusedChild);
+ }
+@@ -341,12 +341,12 @@ NS_IMETHODIMP nsDocAccessible::TakeFocus
+     return NS_ERROR_FAILURE; // Not focusable
+   }
+ 
+-  nsCOMPtr<nsIDocShellTreeItem> treeItem =
++  nsIDocShellTreeItem* treeItem =
+     nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
+-  nsCOMPtr<nsIDocShell> docShell = do_QueryInterface(treeItem);
++  nsIDocShell* docShell = do_QueryInterface(treeItem);
+   NS_ENSURE_TRUE(docShell, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIPresShell> shell(GetPresShell());
++  nsIPresShell* shell(GetPresShell());
+   if (!shell) {
+     NS_WARNING("Was not shutdown properly via InvalidateCacheSubtree()");
+     return NS_ERROR_FAILURE;
+@@ -369,12 +369,12 @@ NS_IMETHODIMP nsDocAccessible::GetURL(ns
+   if (!mDocument) {
+     return NS_ERROR_FAILURE; // Document has been shut down
+   }
+-  nsCOMPtr<nsISupports> container = mDocument->GetContainer();
+-  nsCOMPtr<nsIWebNavigation> webNav(do_GetInterface(container));
++  nsISupports* container = mDocument->GetContainer();
++  nsIWebNavigation* webNav(do_GetInterface(container));
+   nsCAutoString theURL;
+   if (webNav) {
+-    nsCOMPtr<nsIURI> pURI;
+-    webNav->GetCurrentURI(getter_AddRefs(pURI));
++    nsIURI* pURI = nsnull;
++    webNav->GetCurrentURI(&pURI);
+     if (pURI)
+       pURI->GetSpec(theURL);
+   }
+@@ -394,7 +394,7 @@ NS_IMETHODIMP nsDocAccessible::GetTitle(
+ 
+ NS_IMETHODIMP nsDocAccessible::GetMimeType(nsAString& aMimeType)
+ {
+-  nsCOMPtr<nsIDOMNSDocument> domnsDocument(do_QueryInterface(mDocument));
++  nsIDOMNSDocument* domnsDocument(do_QueryInterface(mDocument));
+   if (domnsDocument) {
+     return domnsDocument->GetContentType(aMimeType);
+   }
+@@ -403,17 +403,17 @@ NS_IMETHODIMP nsDocAccessible::GetMimeTy
+ 
+ NS_IMETHODIMP nsDocAccessible::GetDocType(nsAString& aDocType)
+ {
+-  nsCOMPtr<nsIDOMDocument> domDoc(do_QueryInterface(mDocument));
+-  nsCOMPtr<nsIDOMDocumentType> docType;
++  nsIDOMDocument* domDoc(do_QueryInterface(mDocument));
++  nsIDOMDocumentType* docType = nsnull;
+ 
+ #ifdef MOZ_XUL
+-  nsCOMPtr<nsIXULDocument> xulDoc(do_QueryInterface(mDocument));
++  nsIXULDocument* xulDoc(do_QueryInterface(mDocument));
+   if (xulDoc) {
+     aDocType.AssignLiteral("window"); // doctype not implemented for XUL at time of writing - causes assertion
+     return NS_OK;
+   } else
+ #endif
+-  if (domDoc && NS_SUCCEEDED(domDoc->GetDoctype(getter_AddRefs(docType))) && docType) {
++  if (domDoc && NS_SUCCEEDED(domDoc->GetDoctype(&docType)) && docType) {
+     return docType->GetPublicId(aDocType);
+   }
+ 
+@@ -423,7 +423,7 @@ NS_IMETHODIMP nsDocAccessible::GetNameSp
+ NS_IMETHODIMP nsDocAccessible::GetNameSpaceURIForID(PRInt16 aNameSpaceID, nsAString& aNameSpaceURI)
+ {
+   if (mDocument) {
+-    nsCOMPtr<nsINameSpaceManager> nameSpaceManager =
++    nsINameSpaceManager* nameSpaceManager =
+         do_GetService(NS_NAMESPACEMANAGER_CONTRACTID);
+     if (nameSpaceManager)
+       return nameSpaceManager->GetNameSpaceURI(aNameSpaceID, aNameSpaceURI);
+@@ -453,7 +453,7 @@ NS_IMETHODIMP nsDocAccessible::GetWindow
+ 
+ NS_IMETHODIMP nsDocAccessible::GetDocument(nsIDOMDocument **aDOMDoc)
+ {
+-  nsCOMPtr<nsIDOMDocument> domDoc(do_QueryInterface(mDocument));
++  nsIDOMDocument* domDoc(do_QueryInterface(mDocument));
+   *aDOMDoc = domDoc;
+ 
+   if (domDoc) {
+@@ -475,13 +475,13 @@ NS_IMETHODIMP nsDocAccessible::GetAssoci
+     return NS_OK; // Document not editable
+   }
+ 
+-  nsCOMPtr<nsISupports> container = mDocument->GetContainer();
+-  nsCOMPtr<nsIEditingSession> editingSession(do_GetInterface(container));
++  nsISupports* container = mDocument->GetContainer();
++  nsIEditingSession* editingSession(do_GetInterface(container));
+   if (!editingSession)
+     return NS_OK; // No editing session interface
+ 
+-  nsCOMPtr<nsIEditor> editor;
+-  editingSession->GetEditorForWindow(mDocument->GetWindow(), getter_AddRefs(editor));
++  nsIEditor* editor = nsnull;
++  editingSession->GetEditorForWindow(mDocument->GetWindow(), &editor);
+   if (!editor) {
+     return NS_OK;
+   }
+@@ -522,10 +522,10 @@ nsDocAccessible::CacheAccessNode(void *a
+   // The unique ID may be presented in the cache if originally we created
+   // access node object and then we want to create accessible object when
+   // DOM node is changed.
+-  nsCOMPtr<nsIAccessNode> accessNode;
+-  GetCacheEntry(mAccessNodeCache, aUniqueID, getter_AddRefs(accessNode));
++  nsIAccessNode* accessNode = nsnull;
++  GetCacheEntry(mAccessNodeCache, aUniqueID, &accessNode);
+   if (accessNode) {
+-    nsCOMPtr<nsPIAccessNode> prAccessNode = do_QueryInterface(accessNode);
++    nsPIAccessNode* prAccessNode = do_QueryInterface(accessNode);
+     prAccessNode->Shutdown();
+   }
+ 
+@@ -542,9 +542,9 @@ NS_IMETHODIMP nsDocAccessible::GetParent
+     nsIDocument *parentDoc = mDocument->GetParentDocument();
+     NS_ENSURE_TRUE(parentDoc, NS_ERROR_FAILURE);
+     nsIContent *ownerContent = parentDoc->FindContentForSubDocument(mDocument);
+-    nsCOMPtr<nsIDOMNode> ownerNode(do_QueryInterface(ownerContent));
++    nsIDOMNode* ownerNode(do_QueryInterface(ownerContent));
+     if (ownerNode) {
+-      nsCOMPtr<nsIAccessibilityService> accService =
++      nsIAccessibilityService* accService =
+         do_GetService("@mozilla.org/accessibilityService;1");
+       if (accService) {
+         // XXX aaronl: ideally we would traverse the presshell chain
+@@ -565,8 +565,8 @@ NS_IMETHODIMP nsDocAccessible::Init()
+ 
+   AddEventListeners();
+ 
+-  nsCOMPtr<nsIAccessible> parentAccessible;  // Ensure outer doc mParent accessible
+-  GetParent(getter_AddRefs(parentAccessible));
++  nsIAccessible* parentAccessible = nsnull;  // Ensure outer doc mParent accessible
++  GetParent(&parentAccessible);
+ 
+   return nsHyperTextAccessibleWrap::Init();
+ }
+@@ -577,7 +577,7 @@ NS_IMETHODIMP nsDocAccessible::Shutdown(
+     return NS_OK;  // Already shutdown
+   }
+ 
+-  nsCOMPtr<nsIDocShellTreeItem> treeItem =
++  nsIDocShellTreeItem* treeItem =
+     nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
+   ShutdownChildDocuments(treeItem);
+ 
+@@ -587,7 +587,7 @@ NS_IMETHODIMP nsDocAccessible::Shutdown(
+ 
+   ClearCache(mAccessNodeCache);
+ 
+-  nsCOMPtr<nsIDocument> kungFuDeathGripDoc = mDocument;
++  nsIDocument* kungFuDeathGripDoc = mDocument;
+   mDocument = nsnull;
+ 
+   nsHyperTextAccessibleWrap::Shutdown();
+@@ -618,20 +618,20 @@ NS_IMETHODIMP nsDocAccessible::Shutdown(
+ 
+ void nsDocAccessible::ShutdownChildDocuments(nsIDocShellTreeItem *aStart)
+ {
+-  nsCOMPtr<nsIDocShellTreeNode> treeNode(do_QueryInterface(aStart));
++  nsIDocShellTreeNode* treeNode(do_QueryInterface(aStart));
+   if (treeNode) {
+     PRInt32 subDocuments;
+     treeNode->GetChildCount(&subDocuments);
+     for (PRInt32 count = 0; count < subDocuments; count ++) {
+-      nsCOMPtr<nsIDocShellTreeItem> treeItemChild;
+-      treeNode->GetChildAt(count, getter_AddRefs(treeItemChild));
++      nsIDocShellTreeItem* treeItemChild = nsnull;
++      treeNode->GetChildAt(count, &treeItemChild);
+       NS_ASSERTION(treeItemChild, "No tree item when there should be");
+       if (!treeItemChild) {
+         continue;
+       }
+-      nsCOMPtr<nsIAccessibleDocument> docAccessible =
++      nsIAccessibleDocument* docAccessible =
+         GetDocAccessibleFor(treeItemChild);
+-      nsCOMPtr<nsPIAccessNode> accessNode = do_QueryInterface(docAccessible);
++      nsPIAccessNode* accessNode = do_QueryInterface(docAccessible);
+       if (accessNode) {
+         accessNode->Shutdown();
+       }
+@@ -641,7 +641,7 @@ void nsDocAccessible::ShutdownChildDocum
+ 
+ nsIFrame* nsDocAccessible::GetFrame()
+ {
+-  nsCOMPtr<nsIPresShell> shell(do_QueryReferent(mWeakShell));
++  nsIPresShell* shell(do_QueryReferent(mWeakShell));
+ 
+   nsIFrame* root = nsnull;
+   if (shell)
+@@ -699,11 +699,11 @@ nsresult nsDocAccessible::AddEventListen
+   // 1) Set up scroll position listener
+   // 2) Check for editor and listen for changes to editor
+ 
+-  nsCOMPtr<nsIPresShell> presShell(GetPresShell());
++  nsIPresShell* presShell(GetPresShell());
+   NS_ENSURE_TRUE(presShell, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsISupports> container = mDocument->GetContainer();
+-  nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem(do_QueryInterface(container));
++  nsISupports* container = mDocument->GetContainer();
++  nsIDocShellTreeItem* docShellTreeItem(do_QueryInterface(container));
+   NS_ENSURE_TRUE(docShellTreeItem, NS_ERROR_FAILURE);
+ 
+   // Make sure we're a content docshell
+@@ -715,20 +715,20 @@ nsresult nsDocAccessible::AddEventListen
+ 
+   if (isContent) {
+     // We're not an editor yet, but we might become one
+-    nsCOMPtr<nsICommandManager> commandManager = do_GetInterface(docShellTreeItem);
++    nsICommandManager* commandManager = do_GetInterface(docShellTreeItem);
+     if (commandManager) {
+       commandManager->AddCommandObserver(this, "obs_documentCreated");
+     }
+   }
+ 
+-  nsCOMPtr<nsIDocShellTreeItem> rootTreeItem;
+-  docShellTreeItem->GetRootTreeItem(getter_AddRefs(rootTreeItem));
++  nsIDocShellTreeItem* rootTreeItem = nsnull;
++  docShellTreeItem->GetRootTreeItem(&rootTreeItem);
+   if (rootTreeItem) {
+-    nsCOMPtr<nsIAccessibleDocument> rootAccDoc =
++    nsIAccessibleDocument* rootAccDoc =
+       GetDocAccessibleFor(rootTreeItem, PR_TRUE); // Ensure root accessible is created;
+-    nsRefPtr<nsRootAccessible> rootAccessible = GetRootAccessible(); // Then get it as ref ptr
++    nsRootAccessible* rootAccessible = GetRootAccessible(); // Then get it as ref ptr
+     NS_ENSURE_TRUE(rootAccessible, NS_ERROR_FAILURE);
+-    nsRefPtr<nsCaretAccessible> caretAccessible = rootAccessible->GetCaretAccessible();
++    nsCaretAccessible* caretAccessible = rootAccessible->GetCaretAccessible();
+     if (caretAccessible) {
+       caretAccessible->AddDocSelectionListener(presShell);
+     }
+@@ -754,24 +754,24 @@ nsresult nsDocAccessible::RemoveEventLis
+     NS_RELEASE_THIS(); // Kung fu death grip
+   }
+ 
+-  nsRefPtr<nsRootAccessible> rootAccessible(GetRootAccessible());
++  nsRootAccessible* rootAccessible(GetRootAccessible());
+   if (rootAccessible) {
+-    nsRefPtr<nsCaretAccessible> caretAccessible = rootAccessible->GetCaretAccessible();
++    nsCaretAccessible* caretAccessible = rootAccessible->GetCaretAccessible();
+     if (caretAccessible) {
+       // Don't use GetPresShell() which can call Shutdown() if it sees dead pres shell
+-      nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
++      nsIPresShell* presShell(do_QueryReferent(mWeakShell));
+       caretAccessible->RemoveDocSelectionListener(presShell);
+     }
+   }
+ 
+-  nsCOMPtr<nsISupports> container = mDocument->GetContainer();
+-  nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem(do_QueryInterface(container));
++  nsISupports* container = mDocument->GetContainer();
++  nsIDocShellTreeItem* docShellTreeItem(do_QueryInterface(container));
+   NS_ENSURE_TRUE(docShellTreeItem, NS_ERROR_FAILURE);
+ 
+   PRInt32 itemType;
+   docShellTreeItem->GetItemType(&itemType);
+   if (itemType == nsIDocShellTreeItem::typeContent) {
+-    nsCOMPtr<nsICommandManager> commandManager = do_GetInterface(docShellTreeItem);
++    nsICommandManager* commandManager = do_GetInterface(docShellTreeItem);
+     if (commandManager) {
+       commandManager->RemoveCommandObserver(this, "obs_documentCreated");
+     }
+@@ -785,12 +785,12 @@ NS_IMETHODIMP nsDocAccessible::FireAncho
+   if (!mIsContentLoaded || !mDocument) {
+     return NS_OK;
+   }
+-  nsCOMPtr<nsISupports> container = mDocument->GetContainer();
+-  nsCOMPtr<nsIWebNavigation> webNav(do_GetInterface(container));
++  nsISupports* container = mDocument->GetContainer();
++  nsIWebNavigation* webNav(do_GetInterface(container));
+   nsCAutoString theURL;
+   if (webNav) {
+-    nsCOMPtr<nsIURI> pURI;
+-    webNav->GetCurrentURI(getter_AddRefs(pURI));
++    nsIURI* pURI = nsnull;
++    webNav->GetCurrentURI(&pURI);
+     if (pURI) {
+       pURI->GetSpec(theURL);
+     }
+@@ -833,19 +833,19 @@ NS_IMETHODIMP nsDocAccessible::FireDocLo
+     mIsLoadCompleteFired = PR_TRUE;
+   }
+ 
+-  nsCOMPtr<nsIDocShellTreeItem> treeItem =
++  nsIDocShellTreeItem* treeItem =
+     nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
+   if (!treeItem) {
+     return NS_OK;
+   }
+-  nsCOMPtr<nsIDocShellTreeItem> sameTypeRoot;
+-  treeItem->GetSameTypeRootTreeItem(getter_AddRefs(sameTypeRoot));
++  nsIDocShellTreeItem* sameTypeRoot = nsnull;
++  treeItem->GetSameTypeRootTreeItem(&sameTypeRoot);
+ 
+   if (isFinished) {
+     // Need to wait until scrollable view is available
+     AddScrollListener();
+-    nsCOMPtr<nsIAccessible> parent(nsAccessible::GetParent());
+-    nsCOMPtr<nsPIAccessible> privateAccessible(do_QueryInterface(parent));
++    nsIAccessible* parent(nsAccessible::GetParent());
++    nsPIAccessible* privateAccessible(do_QueryInterface(parent));
+     if (privateAccessible) {
+       // Make the parent forget about the old document as a child
+       privateAccessible->InvalidateChildren();
+@@ -857,13 +857,13 @@ NS_IMETHODIMP nsDocAccessible::FireDocLo
+     }
+     // Fire STATE_CHANGE event for doc load finish if focus is in same doc tree
+     if (gLastFocusedNode) {
+-      nsCOMPtr<nsIDocShellTreeItem> focusedTreeItem =
++      nsIDocShellTreeItem* focusedTreeItem =
+         nsAccUtils::GetDocShellTreeItemFor(gLastFocusedNode);
+       if (focusedTreeItem) {
+-        nsCOMPtr<nsIDocShellTreeItem> sameTypeRootOfFocus;
+-        focusedTreeItem->GetSameTypeRootTreeItem(getter_AddRefs(sameTypeRootOfFocus));
++        nsIDocShellTreeItem* sameTypeRootOfFocus = nsnull;
++        focusedTreeItem->GetSameTypeRootTreeItem(&sameTypeRootOfFocus);
+         if (sameTypeRoot == sameTypeRootOfFocus) {
+-          nsCOMPtr<nsIAccessibleStateChangeEvent> accEvent =
++          nsIAccessibleStateChangeEvent* accEvent =
+             new nsAccStateChangeEvent(this, nsIAccessibleStates::STATE_BUSY, PR_FALSE, PR_FALSE);
+           FireAccessibleEvent(accEvent);
+           FireAnchorJumpEvent();
+@@ -877,7 +877,7 @@ NS_IMETHODIMP nsDocAccessible::FireDocLo
+     if (!isFinished) {
+       // Fire state change event to set STATE_BUSY when document is loading. For
+       // example, Window-Eyes expects to get it.
+-      nsCOMPtr<nsIAccessibleStateChangeEvent> accEvent =
++      nsIAccessibleStateChangeEvent* accEvent =
+         new nsAccStateChangeEvent(this, nsIAccessibleStates::STATE_BUSY,
+                                   PR_FALSE, PR_TRUE);
+       FireAccessibleEvent(accEvent);
+@@ -911,7 +911,7 @@ void nsDocAccessible::ScrollTimerCallbac
+ 
+ void nsDocAccessible::AddScrollListener()
+ {
+-  nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
++  nsIPresShell* presShell(do_QueryReferent(mWeakShell));
+ 
+   nsIViewManager* vm = nsnull;
+   if (presShell)
+@@ -927,7 +927,7 @@ void nsDocAccessible::AddScrollListener(
+ 
+ void nsDocAccessible::RemoveScrollListener()
+ {
+-  nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
++  nsIPresShell* presShell(do_QueryReferent(mWeakShell));
+ 
+   nsIViewManager* vm = nsnull;
+   if (presShell)
+@@ -972,7 +972,7 @@ NS_IMETHODIMP nsDocAccessible::Observe(n
+ {
+   if (!nsCRT::strcmp(aTopic,"obs_documentCreated")) {    
+     // State editable will now be set, readonly is now clear
+-    nsCOMPtr<nsIAccessibleStateChangeEvent> event =
++    nsIAccessibleStateChangeEvent* event =
+       new nsAccStateChangeEvent(this, nsIAccessibleStates::EXT_STATE_EDITABLE,
+                                 PR_TRUE, PR_TRUE);
+     FireAccessibleEvent(event);
+@@ -996,10 +996,10 @@ nsDocAccessible::AttributeChanged(nsIDoc
+   AttributeChangedImpl(aContent, aNameSpaceID, aAttribute);
+ 
+   // If it was the focused node, cache the new state
+-  nsCOMPtr<nsIDOMNode> targetNode = do_QueryInterface(aContent);
++  nsIDOMNode* targetNode = do_QueryInterface(aContent);
+   if (targetNode == gLastFocusedNode) {
+-    nsCOMPtr<nsIAccessible> focusedAccessible;
+-    GetAccService()->GetAccessibleFor(targetNode, getter_AddRefs(focusedAccessible));
++    nsIAccessible* focusedAccessible = nsnull;
++    GetAccService()->GetAccessibleFor(targetNode, &focusedAccessible);
+     if (focusedAccessible) {
+       gLastFocusedAccessiblesState = State(focusedAccessible);
+     }
+@@ -1020,8 +1020,8 @@ nsDocAccessible::AttributeChangedImpl(ns
+   // Otherwise it may just be a state change, for example an object changing
+   // its visibility
+ 
+-  nsCOMPtr<nsISupports> container = mDocument->GetContainer();
+-  nsCOMPtr<nsIDocShell> docShell = do_QueryInterface(container);
++  nsISupports* container = mDocument->GetContainer();
++  nsIDocShell* docShell = do_QueryInterface(container);
+   if (!docShell) {
+     return;
+   }
+@@ -1032,12 +1032,12 @@ nsDocAccessible::AttributeChangedImpl(ns
+     return; // Still loading, ignore setting of initial attributes
+   }
+ 
+-  nsCOMPtr<nsIPresShell> shell = GetPresShell();
++  nsIPresShell* shell = GetPresShell();
+   if (!shell) {
+     return; // Document has been shut down
+   }
+ 
+-  nsCOMPtr<nsIDOMNode> targetNode(do_QueryInterface(aContent));
++  nsIDOMNode* targetNode(do_QueryInterface(aContent));
+   NS_ASSERTION(targetNode, "No node for attr modified");
+   if (!targetNode || !IsNodeRelevant(targetNode)) {
+     return;
+@@ -1057,12 +1057,12 @@ nsDocAccessible::AttributeChangedImpl(ns
+     // disabled really is going to mean the same thing in any namespace.
+     // We use the attribute instead of the disabled state bit because
+     // ARIA's aria-disabled does not affect the disabled state bit
+-    nsCOMPtr<nsIAccessibleStateChangeEvent> enabledChangeEvent =
++    nsIAccessibleStateChangeEvent* enabledChangeEvent =
+       new nsAccStateChangeEvent(targetNode,
+                                 nsIAccessibleStates::EXT_STATE_ENABLED,
+                                 PR_TRUE);
+     FireDelayedAccessibleEvent(enabledChangeEvent);
+-    nsCOMPtr<nsIAccessibleStateChangeEvent> sensitiveChangeEvent =
++    nsIAccessibleStateChangeEvent* sensitiveChangeEvent =
+       new nsAccStateChangeEvent(targetNode,
+                                 nsIAccessibleStates::EXT_STATE_SENSITIVE,
+                                 PR_TRUE);
+@@ -1101,7 +1101,7 @@ nsDocAccessible::AttributeChangedImpl(ns
+   if (aAttribute == nsAccessibilityAtoms::selected ||
+       aAttribute == nsAccessibilityAtoms::aria_selected) {
+     // ARIA or XUL selection
+-    nsCOMPtr<nsIAccessible> multiSelect = GetMultiSelectFor(targetNode);
++    nsIAccessible* multiSelect = GetMultiSelectFor(targetNode);
+     // Multi selects use selection_add and selection_remove
+     // Single select widgets just mirror event_selection for
+     // whatever gets event_focus, which is done in
+@@ -1110,10 +1110,10 @@ nsDocAccessible::AttributeChangedImpl(ns
+     if (multiSelect) {
+       // Need to find the right event to use here, SELECTION_WITHIN would
+       // seem right but we had started using it for something else
+-      nsCOMPtr<nsIAccessNode> multiSelectAccessNode =
++      nsIAccessNode* multiSelectAccessNode =
+         do_QueryInterface(multiSelect);
+-      nsCOMPtr<nsIDOMNode> multiSelectDOMNode;
+-      multiSelectAccessNode->GetDOMNode(getter_AddRefs(multiSelectDOMNode));
++      nsIDOMNode* multiSelectDOMNode = nsnull;
++      multiSelectAccessNode->GetDOMNode(&multiSelectDOMNode);
+       NS_ASSERTION(multiSelectDOMNode, "A new accessible without a DOM node!");
+       FireDelayedToolkitEvent(nsIAccessibleEvent::EVENT_SELECTION_WITHIN,
+                               multiSelectDOMNode,
+@@ -1134,7 +1134,7 @@ nsDocAccessible::AttributeChangedImpl(ns
+   }
+ 
+   if (aAttribute == nsAccessibilityAtoms::contenteditable) {
+-    nsCOMPtr<nsIAccessibleStateChangeEvent> editableChangeEvent =
++    nsIAccessibleStateChangeEvent* editableChangeEvent =
+       new nsAccStateChangeEvent(targetNode,
+                                 nsIAccessibleStates::EXT_STATE_EDITABLE,
+                                 PR_TRUE);
+@@ -1146,12 +1146,12 @@ void
+ void
+ nsDocAccessible::ARIAAttributeChanged(nsIContent* aContent, nsIAtom* aAttribute)
+ {
+-  nsCOMPtr<nsIDOMNode> targetNode(do_QueryInterface(aContent));
++  nsIDOMNode* targetNode(do_QueryInterface(aContent));
+   if (!targetNode)
+     return;
+ 
+   if (aAttribute == nsAccessibilityAtoms::aria_required) {
+-    nsCOMPtr<nsIAccessibleStateChangeEvent> event =
++    nsIAccessibleStateChangeEvent* event =
+       new nsAccStateChangeEvent(targetNode,
+                                 nsIAccessibleStates::STATE_REQUIRED,
+                                 PR_FALSE);
+@@ -1160,7 +1160,7 @@ nsDocAccessible::ARIAAttributeChanged(ns
+   }
+ 
+   if (aAttribute == nsAccessibilityAtoms::aria_invalid) {
+-    nsCOMPtr<nsIAccessibleStateChangeEvent> event =
++    nsIAccessibleStateChangeEvent* event =
+       new nsAccStateChangeEvent(targetNode,
+                                 nsIAccessibleStates::STATE_INVALID,
+                                 PR_FALSE);
+@@ -1171,9 +1171,9 @@ nsDocAccessible::ARIAAttributeChanged(ns
+   if (aAttribute == nsAccessibilityAtoms::aria_activedescendant) {
+     // The activedescendant universal property redirects accessible focus events
+     // to the element with the id that activedescendant points to
+-    nsCOMPtr<nsIDOMNode> currentFocus = GetCurrentFocus();
++    nsIDOMNode* currentFocus = GetCurrentFocus();
+     if (SameCOMIdentity(GetRoleContent(currentFocus), targetNode)) {
+-      nsRefPtr<nsRootAccessible> rootAcc = GetRootAccessible();
++      nsRootAccessible* rootAcc = GetRootAccessible();
+       if (rootAcc)
+         rootAcc->FireAccessibleFocusEvent(nsnull, currentFocus, nsnull, PR_TRUE);
+     }
+@@ -1194,7 +1194,7 @@ nsDocAccessible::ARIAAttributeChanged(ns
+     const PRUint32 kState = (aAttribute == nsAccessibilityAtoms::aria_checked) ?
+                             nsIAccessibleStates::STATE_CHECKED : 
+                             nsIAccessibleStates::STATE_PRESSED;
+-    nsCOMPtr<nsIAccessibleStateChangeEvent> event =
++    nsIAccessibleStateChangeEvent* event =
+       new nsAccStateChangeEvent(targetNode, kState, PR_FALSE);
+     FireDelayedAccessibleEvent(event);
+     if (targetNode == gLastFocusedNode) {
+@@ -1202,13 +1202,13 @@ nsDocAccessible::ARIAAttributeChanged(ns
+       // otherwise we would need access to the old attribute value in this listener.
+       // This is because we don't know if the previous value of aria-checked or aria-pressed was "mixed"
+       // without caching that info.
+-      nsCOMPtr<nsIAccessible> accessible;
+-      event->GetAccessible(getter_AddRefs(accessible));
++      nsIAccessible* accessible = nsnull;
++      event->GetAccessible(&accessible);
+       if (accessible) {
+         PRBool wasMixed = (gLastFocusedAccessiblesState & nsIAccessibleStates::STATE_MIXED) != 0;
+         PRBool isMixed  = (State(accessible) & nsIAccessibleStates::STATE_MIXED) != 0;
+         if (wasMixed != isMixed) {
+-          nsCOMPtr<nsIAccessibleStateChangeEvent> event =
++          nsIAccessibleStateChangeEvent* event =
+             new nsAccStateChangeEvent(targetNode,
+                                       nsIAccessibleStates::STATE_MIXED,
+                                       PR_FALSE, isMixed);
+@@ -1220,7 +1220,7 @@ nsDocAccessible::ARIAAttributeChanged(ns
+   }
+ 
+   if (aAttribute == nsAccessibilityAtoms::aria_expanded) {
+-    nsCOMPtr<nsIAccessibleStateChangeEvent> event =
++    nsIAccessibleStateChangeEvent* event =
+       new nsAccStateChangeEvent(targetNode,
+                                 nsIAccessibleStates::STATE_EXPANDED,
+                                 PR_FALSE);
+@@ -1229,7 +1229,7 @@ nsDocAccessible::ARIAAttributeChanged(ns
+   }
+ 
+   if (aAttribute == nsAccessibilityAtoms::aria_readonly) {
+-    nsCOMPtr<nsIAccessibleStateChangeEvent> event =
++    nsIAccessibleStateChangeEvent* event =
+       new nsAccStateChangeEvent(targetNode,
+                                 nsIAccessibleStates::STATE_READONLY,
+                                 PR_FALSE);
+@@ -1264,7 +1264,7 @@ void nsDocAccessible::ContentAppended(ns
+ 
+   PRUint32 childCount = aContainer->GetChildCount();
+   for (PRUint32 index = aNewIndexInContainer; index < childCount; index ++) {
+-    nsCOMPtr<nsIContent> child(aContainer->GetChildAt(index));
++    nsIContent* child(aContainer->GetChildAt(index));
+     // InvalidateCacheSubtree will not fire the EVENT_SHOW for the new node
+     // unless an accessible can be created for the passed in node, which it
+     // can't do unless the node is visible. The right thing happens there so
+@@ -1334,7 +1334,7 @@ nsDocAccessible::FireValueChangeForTextF
+     return;
+ 
+   // Dependent value change event for text changes in textfields
+-  nsCOMPtr<nsIAccessibleEvent> valueChangeEvent =
++  nsIAccessibleEvent* valueChangeEvent =
+     new nsAccEvent(nsIAccessibleEvent::EVENT_VALUE_CHANGE, aPossibleTextFieldAccessible,
+                    PR_FALSE, nsAccEvent::eRemoveDupes);
+   FireDelayedAccessibleEvent(valueChangeEvent );
+@@ -1349,18 +1349,18 @@ nsDocAccessible::FireTextChangeEventForT
+     return;
+   }
+ 
+-  nsCOMPtr<nsIDOMNode> node(do_QueryInterface(aContent));
++  nsIDOMNode* node(do_QueryInterface(aContent));
+   if (!node)
+     return;
+ 
+-  nsCOMPtr<nsIAccessible> accessible;
+-  nsresult rv = GetAccessibleInParentChain(node, PR_TRUE, getter_AddRefs(accessible));
++  nsIAccessible* accessible = nsnull;
++  nsresult rv = GetAccessibleInParentChain(node, PR_TRUE, &accessible);
+   if (NS_FAILED(rv) || !accessible)
+     return;
+ 
+-  nsRefPtr<nsHyperTextAccessible> textAccessible;
++  nsHyperTextAccessible* textAccessible = nsnull;
+   rv = accessible->QueryInterface(NS_GET_IID(nsHyperTextAccessible),
+-                                  getter_AddRefs(textAccessible));
++                                  (void**)&textAccessible);
+   if (NS_FAILED(rv) || !textAccessible)
+     return;
+ 
+@@ -1376,7 +1376,7 @@ nsDocAccessible::FireTextChangeEventForT
+     aInfo->mChangeEnd - start; // text has been removed
+ 
+   if (length > 0) {
+-    nsCOMPtr<nsIPresShell> shell(do_QueryReferent(mWeakShell));
++    nsIPresShell* shell(do_QueryReferent(mWeakShell));
+     if (!shell)
+       return;
+ 
+@@ -1395,7 +1395,7 @@ nsDocAccessible::FireTextChangeEventForT
+     if (NS_FAILED(rv))
+       return;
+ 
+-    nsCOMPtr<nsIAccessibleTextChangeEvent> event =
++    nsIAccessibleTextChangeEvent* event =
+       new nsAccTextChangeEvent(accessible, offset,
+                                renderedEndOffset - renderedStartOffset,
+                                aIsInserted, PR_FALSE);
+@@ -1405,25 +1405,25 @@ nsDocAccessible::FireTextChangeEventForT
+   }
+ }
+ 
+-already_AddRefed<nsIAccessibleTextChangeEvent>
++nsIAccessibleTextChangeEvent*
+ nsDocAccessible::CreateTextChangeEventForNode(nsIAccessible *aContainerAccessible,
+                                               nsIDOMNode *aChangeNode,
+                                               nsIAccessible *aAccessibleForChangeNode,
+                                               PRBool aIsInserting,
+                                               PRBool aIsAsynch)
+ {
+-  nsRefPtr<nsHyperTextAccessible> textAccessible;
++  nsHyperTextAccessible* textAccessible = nsnull;
+   aContainerAccessible->QueryInterface(NS_GET_IID(nsHyperTextAccessible),
+-                                       getter_AddRefs(textAccessible));
++                                       (void**)&textAccessible);
+   if (!textAccessible) {
+     return nsnull;
+   }
+ 
+   PRInt32 offset;
+   PRInt32 length = 0;
+-  nsCOMPtr<nsIAccessible> changeAccessible;
++  nsIAccessible* changeAccessible = nsnull;
+   nsresult rv = textAccessible->DOMPointToHypertextOffset(aChangeNode, -1, &offset,
+-                                                          getter_AddRefs(changeAccessible));
++                                                          &changeAccessible);
+   NS_ENSURE_SUCCESS(rv, nsnull);
+ 
+   if (!aAccessibleForChangeNode) {
+@@ -1435,21 +1435,21 @@ nsDocAccessible::CreateTextChangeEventFo
+     if (!changeAccessible) {
+       return nsnull; // No descendant content that represents any text in the hypertext parent
+     }
+-    nsCOMPtr<nsIAccessible> child = changeAccessible;
++    nsIAccessible* child = changeAccessible;
+     while (PR_TRUE) {
+-      nsCOMPtr<nsIAccessNode> childAccessNode =
++      nsIAccessNode* childAccessNode =
+         do_QueryInterface(changeAccessible);
+-      nsCOMPtr<nsIDOMNode> childNode;
+-      childAccessNode->GetDOMNode(getter_AddRefs(childNode));
++      nsIDOMNode* childNode = nsnull;
++      childAccessNode->GetDOMNode(&childNode);
+       if (!nsAccUtils::IsAncestorOf(aChangeNode, childNode)) {
+         break;  // We only want accessibles with DOM nodes as children of this node
+       }
+       length += TextLength(child);
+-      child->GetNextSibling(getter_AddRefs(changeAccessible));
++      child->GetNextSibling(&changeAccessible);
+       if (!changeAccessible) {
+         break;
+       }
+-      child.swap(changeAccessible);
++      swap(child, changeAccessible);
+     }
+   }
+   else {
+@@ -1458,8 +1458,8 @@ nsDocAccessible::CreateTextChangeEventFo
+     length = TextLength(aAccessibleForChangeNode);
+     if (Role(aAccessibleForChangeNode) == nsIAccessibleRole::ROLE_WHITESPACE) {  // newline
+       // Don't fire event for the first html:br in an editor.
+-      nsCOMPtr<nsIEditor> editor;
+-      textAccessible->GetAssociatedEditor(getter_AddRefs(editor));
++      nsIEditor* editor = nsnull;
++      textAccessible->GetAssociatedEditor(&editor);
+       if (editor) {
+         PRBool isEmpty = PR_FALSE;
+         editor->GetDocumentIsEmpty(&isEmpty);
+@@ -1486,7 +1486,7 @@ nsresult nsDocAccessible::FireDelayedToo
+                                                   nsAccEvent::EEventRule aAllowDupes,
+                                                   PRBool aIsAsynch)
+ {
+-  nsCOMPtr<nsIAccessibleEvent> event =
++  nsIAccessibleEvent* event =
+     new nsAccEvent(aEvent, aDOMNode, aIsAsynch, aAllowDupes);
+   NS_ENSURE_TRUE(event, NS_ERROR_OUT_OF_MEMORY);
+ 
+@@ -1522,23 +1522,23 @@ NS_IMETHODIMP nsDocAccessible::FlushPend
+   mInFlushPendingEvents = PR_TRUE;
+   PRUint32 length = mEventsToFire.Count();
+   NS_ASSERTION(length, "How did we get here without events to fire?");
+-  nsCOMPtr<nsIPresShell> presShell = GetPresShell();
++  nsIPresShell* presShell = GetPresShell();
+   if (!presShell)
+     length = 0; // The doc is now shut down, don't fire events in it anymore
+   else
+     nsAccEvent::ApplyEventRules(mEventsToFire);
+   
+   for (PRUint32 index = 0; index < length; index ++) {
+-    nsCOMPtr<nsIAccessibleEvent> accessibleEvent(
++    nsIAccessibleEvent* accessibleEvent(
+       do_QueryInterface(mEventsToFire[index]));
+ 
+     if (nsAccEvent::EventRule(accessibleEvent) == nsAccEvent::eDoNotEmit)
+       continue;
+ 
+-    nsCOMPtr<nsIAccessible> accessible;
+-    accessibleEvent->GetAccessible(getter_AddRefs(accessible));
+-    nsCOMPtr<nsIDOMNode> domNode;
+-    accessibleEvent->GetDOMNode(getter_AddRefs(domNode));
++    nsIAccessible* accessible = nsnull;
++    accessibleEvent->GetAccessible(&accessible);
++    nsIDOMNode* domNode = nsnull;
++    accessibleEvent->GetDOMNode(&domNode);
+     PRUint32 eventType = nsAccEvent::EventType(accessibleEvent);
+     PRBool isFromUserInput = nsAccEvent::IsFromUserInput(accessibleEvent);
+ 
+@@ -1549,7 +1549,7 @@ NS_IMETHODIMP nsDocAccessible::FlushPend
+       // However, we only keep track of the old frame type for the focus, where it's very
+       // important not to destroy and recreate the accessible for minor style changes,
+       // such as a:focus { overflow: scroll; }
+-      nsCOMPtr<nsIContent> focusContent(do_QueryInterface(domNode));
++      nsIContent* focusContent(do_QueryInterface(domNode));
+       if (focusContent) {
+         nsIFrame *focusFrame = presShell->GetRealPrimaryFrameFor(focusContent);
+         nsIAtom *newFrameType =
+@@ -1568,12 +1568,12 @@ NS_IMETHODIMP nsDocAccessible::FlushPend
+ 
+     if (eventType == nsIAccessibleEvent::EVENT_DOM_CREATE || 
+         eventType == nsIAccessibleEvent::EVENT_ASYNCH_SHOW) {
+-      nsCOMPtr<nsIAccessible> containerAccessible;
++      nsIAccessible* containerAccessible = nsnull;
+       if (eventType == nsIAccessibleEvent::EVENT_ASYNCH_SHOW) {
+         if (accessible) {
+           // For asynch show, delayed invalidatation of parent's children
+-          accessible->GetParent(getter_AddRefs(containerAccessible));
+-          nsCOMPtr<nsPIAccessible> privateContainerAccessible =
++          accessible->GetParent(&containerAccessible);
++          nsPIAccessible* privateContainerAccessible =
+             do_QueryInterface(containerAccessible);
+           if (privateContainerAccessible)
+             privateContainerAccessible->InvalidateChildren();
+@@ -1592,12 +1592,12 @@ NS_IMETHODIMP nsDocAccessible::FlushPend
+       if (domNode && domNode != mDOMNode) {
+         if (!containerAccessible) {
+           GetAccessibleInParentChain(domNode, PR_TRUE,
+-                                     getter_AddRefs(containerAccessible));
++                                     &containerAccessible);
+           if (!containerAccessible)
+             containerAccessible = this;
+         }
+ 
+-        nsCOMPtr<nsIAccessibleTextChangeEvent> textChangeEvent =
++        nsIAccessibleTextChangeEvent* textChangeEvent =
+           CreateTextChangeEventForNode(containerAccessible, domNode, accessible, PR_TRUE, PR_TRUE);
+         if (textChangeEvent) {
+           nsAccEvent::PrepareForEvent(textChangeEvent, isFromUserInput);
+@@ -1615,7 +1615,7 @@ NS_IMETHODIMP nsDocAccessible::FlushPend
+ 
+     if (accessible) {
+       if (eventType == nsIAccessibleEvent::EVENT_INTERNAL_LOAD) {
+-        nsCOMPtr<nsPIAccessibleDocument> docAccessible =
++        nsPIAccessibleDocument* docAccessible =
+           do_QueryInterface(accessible);
+         NS_ASSERTION(docAccessible, "No doc accessible for doc load event");
+         if (docAccessible) {
+@@ -1623,7 +1623,7 @@ NS_IMETHODIMP nsDocAccessible::FlushPend
+         }
+       }
+       else if (eventType == nsIAccessibleEvent::EVENT_TEXT_CARET_MOVED) {
+-        nsCOMPtr<nsIAccessibleText> accessibleText = do_QueryInterface(accessible);
++        nsIAccessibleText* accessibleText = do_QueryInterface(accessible);
+         PRInt32 caretOffset;
+         if (accessibleText && NS_SUCCEEDED(accessibleText->GetCaretOffset(&caretOffset))) {
+ #ifdef DEBUG_A11Y
+@@ -1638,7 +1638,7 @@ NS_IMETHODIMP nsDocAccessible::FlushPend
+           GetAccService()->GetAccessibleFor(gLastFocusedNode, getter_AddRefs(accForFocus));
+           nsAccUtils::FireAccEvent(nsIAccessibleEvent::EVENT_ALERT, accForFocus);
+ #endif
+-          nsCOMPtr<nsIAccessibleCaretMoveEvent> caretMoveEvent =
++          nsIAccessibleCaretMoveEvent* caretMoveEvent =
+             new nsAccCaretMoveEvent(accessible, caretOffset);
+           if (!caretMoveEvent)
+             break; // Out of memory, break out to release kung fu death grip
+@@ -1662,8 +1662,8 @@ NS_IMETHODIMP nsDocAccessible::FlushPend
+         if (eventType == nsIAccessibleEvent::EVENT_ASYNCH_HIDE ||
+             eventType == nsIAccessibleEvent::EVENT_DOM_DESTROY) {
+           // Shutdown nsIAccessNode's or nsIAccessibles for any DOM nodes in this subtree
+-          nsCOMPtr<nsIDOMNode> hidingNode;
+-          accessibleEvent->GetDOMNode(getter_AddRefs(hidingNode));
++          nsIDOMNode* hidingNode = nsnull;
++          accessibleEvent->GetDOMNode(&hidingNode);
+           if (hidingNode) {
+             RefreshNodes(hidingNode); // Will this bite us with asynch events
+           }
+@@ -1694,17 +1694,17 @@ void nsDocAccessible::FlushEventsCallbac
+ 
+ void nsDocAccessible::InvalidateChildrenInSubtree(nsIDOMNode *aStartNode)
+ {
+-  nsCOMPtr<nsIAccessNode> accessNode;
+-  GetCachedAccessNode(aStartNode, getter_AddRefs(accessNode));
+-  nsCOMPtr<nsPIAccessible> accessible(do_QueryInterface(accessNode));
++  nsIAccessNode* accessNode = nsnull;
++  GetCachedAccessNode(aStartNode, &accessNode);
++  nsPIAccessible* accessible(do_QueryInterface(accessNode));
+   if (accessible)
+     accessible->InvalidateChildren();
+ 
+   // Invalidate accessible children in the DOM subtree 
+-  nsCOMPtr<nsINode> node = do_QueryInterface(aStartNode);
++  nsINode* node = do_QueryInterface(aStartNode);
+   PRInt32 index, numChildren = node->GetChildCount();
+   for (index = 0; index < numChildren; index ++) {
+-    nsCOMPtr<nsIDOMNode> childNode = do_QueryInterface(node->GetChildAt(index));
++    nsIDOMNode* childNode = do_QueryInterface(node->GetChildAt(index));
+     if (childNode)
+       InvalidateChildrenInSubtree(childNode);
+   }
+@@ -1716,19 +1716,19 @@ void nsDocAccessible::RefreshNodes(nsIDO
+     return; // All we have is a doc accessible. There is nothing to invalidate, quit early
+   }
+ 
+-  nsCOMPtr<nsIAccessNode> accessNode;
+-  GetCachedAccessNode(aStartNode, getter_AddRefs(accessNode));
++  nsIAccessNode* accessNode = nsnull;
++  GetCachedAccessNode(aStartNode, &accessNode);
+ 
+   // Shut down accessible subtree, which may have been created for
+   // anonymous content subtree
+-  nsCOMPtr<nsIAccessible> accessible(do_QueryInterface(accessNode));
++  nsIAccessible* accessible(do_QueryInterface(accessNode));
+   if (accessible) {
+     // Fire menupopup end if a menu goes away
+     PRUint32 role = Role(accessible);
+     if (role == nsIAccessibleRole::ROLE_MENUPOPUP) {
+-      nsCOMPtr<nsIDOMNode> domNode;
+-      accessNode->GetDOMNode(getter_AddRefs(domNode));
+-      nsCOMPtr<nsIDOMXULPopupElement> popup(do_QueryInterface(domNode));
++      nsIDOMNode* domNode = nsnull;
++      accessNode->GetDOMNode(&domNode);
++      nsIDOMXULPopupElement* popup(do_QueryInterface(domNode));
+       if (!popup) {
+         // Popup elements already fire these via DOMMenuInactive
+         // handling in nsRootAccessible::HandleEvent
+@@ -1736,28 +1736,28 @@ void nsDocAccessible::RefreshNodes(nsIDO
+                                  accessible);
+       }
+     }
+-    nsCOMPtr<nsPIAccessible> privateAccessible = do_QueryInterface(accessible);
++    nsPIAccessible* privateAccessible = do_QueryInterface(accessible);
+     NS_ASSERTION(privateAccessible, "No nsPIAccessible for nsIAccessible");
+ 
+-    nsCOMPtr<nsIAccessible> childAccessible;
++    nsIAccessible* childAccessible = nsnull;
+     // we only need to shutdown the accessibles here if one of them has been created
+-    privateAccessible->GetCachedFirstChild(getter_AddRefs(childAccessible));
++    privateAccessible->GetCachedFirstChild(&childAccessible);
+     if (childAccessible) {
+-      nsCOMPtr<nsIArray> children;
++      nsIArray* children = nsnull;
+       // use GetChildren() to fetch children at one time, instead of using
+       // GetNextSibling(), because after we shutdown the first child,
+       // mNextSibling will be set null.
+-      accessible->GetChildren(getter_AddRefs(children));
++      accessible->GetChildren(&children);
+       PRUint32 childCount =0;
+       if (children)
+         children->GetLength(&childCount);
+-      nsCOMPtr<nsIDOMNode> possibleAnonNode;
++      nsIDOMNode* possibleAnonNode = nsnull;
+       for (PRUint32 index = 0; index < childCount; index++) {
+-        nsCOMPtr<nsIAccessNode> childAccessNode;
++        nsIAccessNode* childAccessNode = nsnull;
+         children->QueryElementAt(index, NS_GET_IID(nsIAccessNode),
+-                                 getter_AddRefs(childAccessNode));
+-        childAccessNode->GetDOMNode(getter_AddRefs(possibleAnonNode));
+-        nsCOMPtr<nsIContent> iterContent = do_QueryInterface(possibleAnonNode);
++                                 (void**)&childAccessNode);
++        childAccessNode->GetDOMNode(&possibleAnonNode);
++        nsIContent* iterContent = do_QueryInterface(possibleAnonNode);
+         if (iterContent && (iterContent->IsNativeAnonymous() ||
+                             iterContent->GetBindingParent())) {
+           // GetBindingParent() check is a perf win -- make sure we don't
+@@ -1771,12 +1771,12 @@ void nsDocAccessible::RefreshNodes(nsIDO
+ 
+   // Shutdown ordinary content subtree as well -- there may be
+   // access node children which are not full accessible objects
+-  nsCOMPtr<nsIDOMNode> nextNode, iterNode;
+-  aStartNode->GetFirstChild(getter_AddRefs(nextNode));
++  nsIDOMNode* nextNode = nsnull, *iterNode = nsnull;
++  aStartNode->GetFirstChild(&nextNode);
+   while (nextNode) {
+-    nextNode.swap(iterNode);
++    swap(nextNode, iterNode);
+     RefreshNodes(iterNode);
+-    iterNode->GetNextSibling(getter_AddRefs(nextNode));
++    iterNode->GetNextSibling(&nextNode);
+   }
+ 
+   if (!accessNode)
+@@ -1794,7 +1794,7 @@ void nsDocAccessible::RefreshNodes(nsIDO
+   // Shut down the actual accessible or access node
+   void *uniqueID;
+   accessNode->GetUniqueID(&uniqueID);
+-  nsCOMPtr<nsPIAccessNode> privateAccessNode(do_QueryInterface(accessNode));
++  nsPIAccessNode* privateAccessNode(do_QueryInterface(accessNode));
+   privateAccessNode->Shutdown();
+ 
+   // Remove from hash table as well
+@@ -1830,9 +1830,9 @@ NS_IMETHODIMP nsDocAccessible::Invalidat
+   // Otherwise we might miss the nsAccessNode's that are not nsAccessible's.
+ 
+   NS_ENSURE_TRUE(mDOMNode, NS_ERROR_FAILURE);
+-  nsCOMPtr<nsIDOMNode> childNode = aChild ? do_QueryInterface(aChild) : mDOMNode;
++  nsIDOMNode* childNode = aChild ? do_QueryInterface(aChild) : mDOMNode;
+ 
+-  nsCOMPtr<nsIPresShell> presShell = GetPresShell();
++  nsIPresShell* presShell = GetPresShell();
+   NS_ENSURE_TRUE(presShell, NS_ERROR_FAILURE);
+   
+   if (!mIsContentLoaded) {
+@@ -1853,12 +1853,12 @@ NS_IMETHODIMP nsDocAccessible::Invalidat
+       // Changes during page load, but not caused by user input
+       // Just invalidate accessible hierarchy and return,
+       // otherwise the page load time slows down way too much
+-      nsCOMPtr<nsIAccessible> containerAccessible;
+-      GetAccessibleInParentChain(childNode, PR_FALSE, getter_AddRefs(containerAccessible));
++      nsIAccessible* containerAccessible = nsnull;
++      GetAccessibleInParentChain(childNode, PR_FALSE, &containerAccessible);
+       if (!containerAccessible) {
+         containerAccessible = this;
+       }
+-      nsCOMPtr<nsPIAccessible> privateContainer = do_QueryInterface(containerAccessible);
++      nsPIAccessible* privateContainer = do_QueryInterface(containerAccessible);
+       return privateContainer->InvalidateChildren();
+     }     
+     // else: user input, so we must fall through and for full handling,
+@@ -1867,9 +1867,9 @@ NS_IMETHODIMP nsDocAccessible::Invalidat
+   }
+ 
+   // Update last change state information
+-  nsCOMPtr<nsIAccessNode> childAccessNode;
+-  GetCachedAccessNode(childNode, getter_AddRefs(childAccessNode));
+-  nsCOMPtr<nsIAccessible> childAccessible = do_QueryInterface(childAccessNode);
++  nsIAccessNode* childAccessNode = nsnull;
++  GetCachedAccessNode(childNode, &childAccessNode);
++  nsIAccessible* childAccessible = do_QueryInterface(childAccessNode);
+ 
+ #ifdef DEBUG_A11Y
+   nsAutoString localName;
+@@ -1895,8 +1895,8 @@ NS_IMETHODIMP nsDocAccessible::Invalidat
+   }
+ #endif
+ 
+-  nsCOMPtr<nsIAccessible> containerAccessible;
+-  GetAccessibleInParentChain(childNode, PR_TRUE, getter_AddRefs(containerAccessible));
++  nsIAccessible* containerAccessible = nsnull;
++  GetAccessibleInParentChain(childNode, PR_TRUE, &containerAccessible);
+   if (!containerAccessible) {
+     containerAccessible = this;
+   }
+@@ -1904,7 +1904,7 @@ NS_IMETHODIMP nsDocAccessible::Invalidat
+   if (!isShowing) {
+     // Fire EVENT_ASYNCH_HIDE or EVENT_DOM_DESTROY
+     if (isHiding) {
+-      nsCOMPtr<nsIContent> content(do_QueryInterface(childNode));
++      nsIContent* content(do_QueryInterface(childNode));
+       if (content) {
+         nsIFrame *frame = presShell->GetPrimaryFrameFor(content);
+         if (frame) {
+@@ -1934,7 +1934,7 @@ NS_IMETHODIMP nsDocAccessible::Invalidat
+       // XXX Collate events when a range is deleted
+       // XXX We need a way to ignore SplitNode and JoinNode() when they
+       // do not affect the text within the hypertext
+-      nsCOMPtr<nsIAccessibleTextChangeEvent> textChangeEvent =
++      nsIAccessibleTextChangeEvent* textChangeEvent =
+         CreateTextChangeEventForNode(containerAccessible, childNode, childAccessible,
+                                      PR_FALSE, isAsynch);
+       if (textChangeEvent) {
+@@ -1954,7 +1954,7 @@ NS_IMETHODIMP nsDocAccessible::Invalidat
+     if (!isAsynch) {
+       // DOM already updated with new objects -- invalidate parent's children now
+       // For asynch we must wait until layout updates before we invalidate the children
+-      nsCOMPtr<nsPIAccessible> privateContainerAccessible =
++      nsPIAccessible* privateContainerAccessible =
+         do_QueryInterface(containerAccessible);
+       if (privateContainerAccessible) {
+         privateContainerAccessible->InvalidateChildren();
+@@ -1984,13 +1984,13 @@ NS_IMETHODIMP nsDocAccessible::Invalidat
+     nsIContent *ancestor = aChild;
+     while (PR_TRUE) {
+       if (roleMapEntry && roleMapEntry->role == nsIAccessibleRole::ROLE_ALERT) {
+-        nsCOMPtr<nsIDOMNode> alertNode(do_QueryInterface(ancestor));
++        nsIDOMNode* alertNode(do_QueryInterface(ancestor));
+         FireDelayedToolkitEvent(nsIAccessibleEvent::EVENT_ALERT, alertNode,
+                                 nsAccEvent::eRemoveDupes, isAsynch);
+         break;
+       }
+       ancestor = ancestor->GetParent();
+-      nsCOMPtr<nsIDOMNode> ancestorNode = do_QueryInterface(ancestor);
++      nsIDOMNode* ancestorNode = do_QueryInterface(ancestor);
+       if (!ancestorNode) {
+         break;
+       }
+@@ -2003,7 +2003,7 @@ NS_IMETHODIMP nsDocAccessible::Invalidat
+   if (childAccessible) {
+     // Fire an event so the MSAA clients know the children have changed. Also
+     // the event is used internally by MSAA part.
+-    nsCOMPtr<nsIAccessibleEvent> reorderEvent =
++    nsIAccessibleEvent* reorderEvent =
+       new nsAccEvent(nsIAccessibleEvent::EVENT_REORDER, containerAccessible,
+                      isAsynch, nsAccEvent::eCoalesceFromSameSubtree);
+     NS_ENSURE_TRUE(reorderEvent, NS_ERROR_OUT_OF_MEMORY);
+@@ -2020,14 +2020,14 @@ nsDocAccessible::GetAccessibleInParentCh
+ {
+   // Find accessible in parent chain of DOM nodes, or return null
+   *aAccessible = nsnull;
+-  nsCOMPtr<nsIDOMNode> currentNode(aNode), parentNode;
+-  nsCOMPtr<nsIAccessNode> accessNode;
++  nsIDOMNode* currentNode(aNode), *parentNode = nsnull;
++  nsIAccessNode* accessNode = nsnull;
+ 
+   nsIAccessibilityService *accService = GetAccService();
+   NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
+ 
+   do {
+-    currentNode->GetParentNode(getter_AddRefs(parentNode));
++    currentNode->GetParentNode(&parentNode);
+     currentNode = parentNode;
+     if (!currentNode) {
+       NS_ADDREF_THIS();
+@@ -2035,16 +2035,16 @@ nsDocAccessible::GetAccessibleInParentCh
+       break;
+     }
+ 
+-    nsCOMPtr<nsIDOMNode> relevantNode;
+-    if (NS_SUCCEEDED(accService->GetRelevantContentNodeFor(currentNode, getter_AddRefs(relevantNode))) && relevantNode) {
++    nsIDOMNode* relevantNode = nsnull;
++    if (NS_SUCCEEDED(accService->GetRelevantContentNodeFor(currentNode, &relevantNode)) && relevantNode) {
+       currentNode = relevantNode;
+     }
+     if (aCanCreate) {
+       accService->GetAccessibleInWeakShell(currentNode, mWeakShell, aAccessible);
+     }
+     else { // Only return cached accessibles, don't create anything
+-      nsCOMPtr<nsIAccessNode> accessNode;
+-      GetCachedAccessNode(currentNode, getter_AddRefs(accessNode)); // AddRefs
++      nsIAccessNode* accessNode = nsnull;
++      GetCachedAccessNode(currentNode, &accessNode); // AddRefs
+       if (accessNode) {
+         CallQueryInterface(accessNode, aAccessible); // AddRefs
+       }
+@@ -2060,18 +2060,18 @@ nsDocAccessible::FireShowHideEvents(nsID
+ {
+   NS_ENSURE_ARG(aDOMNode);
+ 
+-  nsCOMPtr<nsIAccessible> accessible;
++  nsIAccessible* accessible = nsnull;
+   if (!aAvoidOnThisNode) {
+     if (aEventType == nsIAccessibleEvent::EVENT_ASYNCH_HIDE ||
+         aEventType == nsIAccessibleEvent::EVENT_DOM_DESTROY) {
+       // Don't allow creation for accessibles when nodes going away
+-      nsCOMPtr<nsIAccessNode> accessNode;
+-      GetCachedAccessNode(aDOMNode, getter_AddRefs(accessNode));
++      nsIAccessNode* accessNode = nsnull;
++      GetCachedAccessNode(aDOMNode, &accessNode);
+       accessible = do_QueryInterface(accessNode);
+     } else {
+       // Allow creation of new accessibles for show events
+       GetAccService()->GetAttachedAccessibleFor(aDOMNode,
+-                                                getter_AddRefs(accessible));
++                                                &accessible);
+     }
+   }
+ 
+@@ -2081,7 +2081,7 @@ nsDocAccessible::FireShowHideEvents(nsID
+     PRBool isAsynch = aEventType == nsIAccessibleEvent::EVENT_ASYNCH_HIDE ||
+                       aEventType == nsIAccessibleEvent::EVENT_ASYNCH_SHOW;
+ 
+-    nsCOMPtr<nsIAccessibleEvent> event =
++    nsIAccessibleEvent* event =
+       new nsAccEvent(aEventType, accessible, isAsynch,
+                      nsAccEvent::eCoalesceFromSameSubtree);
+     NS_ENSURE_TRUE(event, NS_ERROR_OUT_OF_MEMORY);
+@@ -2096,10 +2096,10 @@ nsDocAccessible::FireShowHideEvents(nsID
+ 
+   // Could not find accessible to show hide yet, so fire on any
+   // accessible descendants in this subtree
+-  nsCOMPtr<nsINode> node(do_QueryInterface(aDOMNode));
++  nsINode* node(do_QueryInterface(aDOMNode));
+   PRUint32 count = node->GetChildCount();
+   for (PRUint32 index = 0; index < count; index++) {
+-    nsCOMPtr<nsIDOMNode> childNode = do_QueryInterface(node->GetChildAt(index));
++    nsIDOMNode* childNode = do_QueryInterface(node->GetChildAt(index));
+     nsresult rv = FireShowHideEvents(childNode, PR_FALSE, aEventType,
+                                      aDelay, aForceIsFromUserInput);
+     NS_ENSURE_SUCCESS(rv, rv);
+diff --git a/accessible/src/base/nsDocAccessible.h b/accessible/src/base/nsDocAccessible.h
+--- a/accessible/src/base/nsDocAccessible.h
++++ b/accessible/src/base/nsDocAccessible.h
+@@ -183,7 +183,7 @@ class nsDocAccessible : public nsHyperTe
+      * @param aAccessibleForChangeNode, the accessible for that node, or nsnull if none exists
+      * @param aIsInserting, is aChangeNode being created or shown (vs. removed or hidden)
+      */
+-    already_AddRefed<nsIAccessibleTextChangeEvent>
++    nsIAccessibleTextChangeEvent*
+     CreateTextChangeEventForNode(nsIAccessible *aContainerAccessible,
+                                  nsIDOMNode *aChangeNode,
+                                  nsIAccessible *aAccessibleForNode,
+diff --git a/accessible/src/base/nsOuterDocAccessible.cpp b/accessible/src/base/nsOuterDocAccessible.cpp
+--- a/accessible/src/base/nsOuterDocAccessible.cpp
++++ b/accessible/src/base/nsOuterDocAccessible.cpp
+@@ -105,25 +105,25 @@ void nsOuterDocAccessible::CacheChildren
+   // The outer node is a something like a <browser>, <frame>, <iframe>, <page> or
+   // <editor> tag, whereas the inner node corresponds to the inner document root.
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   NS_ASSERTION(content, "No nsIContent for <browser>/<iframe>/<editor> dom node");
+ 
+-  nsCOMPtr<nsIDocument> outerDoc = content->GetDocument();
++  nsIDocument* outerDoc = content->GetDocument();
+   if (!outerDoc) {
+     return;
+   }
+ 
+   nsIDocument *innerDoc = outerDoc->GetSubDocumentFor(content);
+-  nsCOMPtr<nsIDOMNode> innerNode(do_QueryInterface(innerDoc));
++  nsIDOMNode* innerNode(do_QueryInterface(innerDoc));
+   if (!innerNode) {
+     return;
+   }
+ 
+-  nsCOMPtr<nsIAccessible> innerAccessible;
+-  nsCOMPtr<nsIAccessibilityService> accService = 
++  nsIAccessible* innerAccessible = nsnull;
++  nsIAccessibilityService* accService = 
+     do_GetService("@mozilla.org/accessibilityService;1");
+-  accService->GetAccessibleFor(innerNode, getter_AddRefs(innerAccessible));
+-  nsCOMPtr<nsPIAccessible> privateInnerAccessible = 
++  accService->GetAccessibleFor(innerNode, &innerAccessible);
++  nsPIAccessible* privateInnerAccessible = 
+     do_QueryInterface(innerAccessible);
+   if (!privateInnerAccessible) {
+     return;
+diff --git a/accessible/src/base/nsRootAccessible.cpp b/accessible/src/base/nsRootAccessible.cpp
+--- a/accessible/src/base/nsRootAccessible.cpp
++++ b/accessible/src/base/nsRootAccessible.cpp
+@@ -132,14 +132,14 @@ NS_IMETHODIMP nsRootAccessible::GetName(
+     }
+   }
+ 
+-  nsCOMPtr<nsIDocShellTreeItem> docShellAsItem =
++  nsIDocShellTreeItem* docShellAsItem =
+     nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
+   NS_ENSURE_TRUE(docShellAsItem, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIDocShellTreeOwner> treeOwner;
+-  docShellAsItem->GetTreeOwner(getter_AddRefs(treeOwner));
++  nsIDocShellTreeOwner* treeOwner = nsnull;
++  docShellAsItem->GetTreeOwner(&treeOwner);
+ 
+-  nsCOMPtr<nsIBaseWindow> baseWindow(do_QueryInterface(treeOwner));
++  nsIBaseWindow* baseWindow(do_QueryInterface(treeOwner));
+   if (baseWindow) {
+     nsXPIDLString title;
+     baseWindow->GetTitle(getter_Copies(title));
+@@ -156,7 +156,7 @@ NS_IMETHODIMP nsRootAccessible::GetParen
+   NS_ENSURE_ARG_POINTER(aParent);
+   *aParent = nsnull;
+ 
+-  nsRefPtr<nsApplicationAccessibleWrap> root = GetApplicationAccessible();
++  nsApplicationAccessibleWrap* root = GetApplicationAccessible();
+   NS_IF_ADDREF(*aParent = root);
+ 
+   return NS_OK;
+@@ -172,7 +172,7 @@ NS_IMETHODIMP nsRootAccessible::GetRole(
+   // If it's a <dialog> or <wizard>, use nsIAccessibleRole::ROLE_DIALOG instead
+   nsIContent *rootContent = mDocument->GetRootContent();
+   if (rootContent) {
+-    nsCOMPtr<nsIDOMElement> rootElement(do_QueryInterface(rootContent));
++    nsIDOMElement* rootElement(do_QueryInterface(rootContent));
+     if (rootElement) {
+       nsAutoString name;
+       rootElement->GetLocalName(name);
+@@ -192,13 +192,13 @@ PRUint32 nsRootAccessible::GetChromeFlag
+   // Return the flag set for the top level window as defined 
+   // by nsIWebBrowserChrome::CHROME_WINDOW_[FLAGNAME]
+   // Not simple: nsIXULWindow is not just a QI from nsIDOMWindow
+-  nsCOMPtr<nsIDocShellTreeItem> treeItem =
++  nsIDocShellTreeItem* treeItem =
+     nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
+   NS_ENSURE_TRUE(treeItem, 0);
+-  nsCOMPtr<nsIDocShellTreeOwner> treeOwner;
+-  treeItem->GetTreeOwner(getter_AddRefs(treeOwner));
++  nsIDocShellTreeOwner* treeOwner = nsnull;
++  treeItem->GetTreeOwner(&treeOwner);
+   NS_ENSURE_TRUE(treeOwner, 0);
+-  nsCOMPtr<nsIXULWindow> xulWin(do_GetInterface(treeOwner));
++  nsIXULWindow* xulWin(do_GetInterface(treeOwner));
+   if (!xulWin) {
+     return 0;
+   }
+@@ -232,9 +232,9 @@ nsRootAccessible::GetState(PRUint32 *aSt
+   if (!aExtraState)
+     return NS_OK;
+ 
+-  nsCOMPtr<nsIDOMWindow> domWin;
+-  GetWindow(getter_AddRefs(domWin));
+-  nsCOMPtr<nsPIDOMWindow> privateDOMWindow(do_QueryInterface(domWin));
++  nsIDOMWindow* domWin = nsnull;
++  GetWindow(&domWin);
++  nsPIDOMWindow* privateDOMWindow(do_QueryInterface(domWin));
+   if (privateDOMWindow) {
+     nsIFocusController *focusController =
+       privateDOMWindow->GetRootFocusController();
+@@ -258,15 +258,15 @@ void
+ void
+ nsRootAccessible::GetChromeEventHandler(nsIDOMEventTarget **aChromeTarget)
+ {
+-  nsCOMPtr<nsIDOMWindow> domWin;
+-  GetWindow(getter_AddRefs(domWin));
+-  nsCOMPtr<nsPIDOMWindow> privateDOMWindow(do_QueryInterface(domWin));
+-  nsCOMPtr<nsPIDOMEventTarget> chromeEventHandler;
++  nsIDOMWindow* domWin = nsnull;
++  GetWindow(&domWin);
++  nsPIDOMWindow* privateDOMWindow(do_QueryInterface(domWin));
++  nsPIDOMEventTarget* chromeEventHandler = nsnull;
+   if (privateDOMWindow) {
+     chromeEventHandler = privateDOMWindow->GetChromeEventHandler();
+   }
+ 
+-  nsCOMPtr<nsIDOMEventTarget> target(do_QueryInterface(chromeEventHandler));
++  nsIDOMEventTarget* target(do_QueryInterface(chromeEventHandler));
+ 
+   *aChromeTarget = target;
+   NS_IF_ADDREF(*aChromeTarget);
+@@ -311,7 +311,7 @@ nsresult nsRootAccessible::AddEventListe
+   // receive untrusted events (synthetic events generated by untrusted code).
+   // For example, XBL bindings implementations for elements that are hosted in
+   // non chrome document fire untrusted events.
+-  nsCOMPtr<nsIDOMNSEventTarget> nstarget(do_QueryInterface(mDocument));
++  nsIDOMNSEventTarget* nstarget(do_QueryInterface(mDocument));
+ 
+   if (nstarget) {
+     for (const char* const* e = docEvents,
+@@ -323,8 +323,8 @@ nsresult nsRootAccessible::AddEventListe
+     }
+   }
+ 
+-  nsCOMPtr<nsIDOMEventTarget> target;
+-  GetChromeEventHandler(getter_AddRefs(target));
++  nsIDOMEventTarget* target = nsnull;
++  GetChromeEventHandler(&target);
+   if (target) {
+     target->AddEventListener(NS_LITERAL_STRING("pagehide"), this, PR_TRUE);
+   }
+@@ -338,7 +338,7 @@ nsresult nsRootAccessible::AddEventListe
+ 
+ nsresult nsRootAccessible::RemoveEventListeners()
+ {
+-  nsCOMPtr<nsIDOMEventTarget> target(do_QueryInterface(mDocument));
++  nsIDOMEventTarget* target(do_QueryInterface(mDocument));
+   if (target) { 
+     for (const char* const* e = docEvents,
+                    * const* e_end = docEvents + NS_ARRAY_LENGTH(docEvents);
+@@ -348,7 +348,7 @@ nsresult nsRootAccessible::RemoveEventLi
+     }
+   }
+ 
+-  GetChromeEventHandler(getter_AddRefs(target));
++  GetChromeEventHandler(&target);
+   if (target) {
+     target->RemoveEventListener(NS_LITERAL_STRING("pagehide"), this, PR_TRUE);
+   }
+@@ -383,7 +383,7 @@ void nsRootAccessible::TryFireEarlyLoadE
+ 
+   // This also works for firing events for error pages
+ 
+-  nsCOMPtr<nsIDocShellTreeItem> treeItem =
++  nsIDocShellTreeItem* treeItem =
+     nsAccUtils::GetDocShellTreeItemFor(aDocNode);
+   NS_ASSERTION(treeItem, "No docshelltreeitem for aDocNode");
+   if (!treeItem) {
+@@ -397,7 +397,7 @@ void nsRootAccessible::TryFireEarlyLoadE
+ 
+   // The doc accessible should already be created as a result of the
+   // OnStateChange() for the initiation of page loading
+-  nsCOMPtr<nsIDocShellTreeNode> treeNode(do_QueryInterface(treeItem));
++  nsIDocShellTreeNode* treeNode(do_QueryInterface(treeItem));
+   if (treeNode) {
+     PRInt32 subDocuments;
+     treeNode->GetChildCount(&subDocuments);
+@@ -405,8 +405,8 @@ void nsRootAccessible::TryFireEarlyLoadE
+       return;
+     }
+   }
+-  nsCOMPtr<nsIDocShellTreeItem> rootContentTreeItem;
+-  treeItem->GetSameTypeRootTreeItem(getter_AddRefs(rootContentTreeItem));
++  nsIDocShellTreeItem* rootContentTreeItem = nsnull;
++  treeItem->GetSameTypeRootTreeItem(&rootContentTreeItem);
+   NS_ASSERTION(rootContentTreeItem, "No root content tree item");
+   if (rootContentTreeItem == treeItem) {
+     // No frames or iframes, so we can fire the doc load finished event early
+@@ -421,7 +421,7 @@ PRBool nsRootAccessible::FireAccessibleF
+                                                   PRBool aIsAsynch)
+ {
+   if (mCaretAccessible) {
+-    nsCOMPtr<nsIDOMNSEvent> nsevent(do_QueryInterface(aFocusEvent));
++    nsIDOMNSEvent* nsevent(do_QueryInterface(aFocusEvent));
+     if (nsevent) {
+       // Use the originally focused node where the selection lives.
+       // For example, use the anonymous HTML:input instead of the containing
+@@ -431,9 +431,9 @@ PRBool nsRootAccessible::FireAccessibleF
+       // This happens because when some bindings handle focus, they retarget
+       // focus to the appropriate child inside of themselves, but DOM focus
+       // stays outside on that binding parent.
+-      nsCOMPtr<nsIDOMEventTarget> domEventTarget;
+-      nsevent->GetOriginalTarget(getter_AddRefs(domEventTarget));
+-      nsCOMPtr<nsIDOMNode> realFocusedNode(do_QueryInterface(domEventTarget));
++      nsIDOMEventTarget* domEventTarget = nsnull;
++      nsevent->GetOriginalTarget(&domEventTarget);
++      nsIDOMNode* realFocusedNode(do_QueryInterface(domEventTarget));
+       if (!realFocusedNode) {
+         // When FireCurrentFocusEvent() synthesizes a focus event,
+         // the orignal target does not exist, so use the passed-in node
+@@ -447,22 +447,22 @@ PRBool nsRootAccessible::FireAccessibleF
+   }
+ 
+   // Check for aria-activedescendant, which changes which element has focus
+-  nsCOMPtr<nsIDOMNode> finalFocusNode = aNode;
+-  nsCOMPtr<nsIAccessible> finalFocusAccessible = aAccessible;
+-  nsCOMPtr<nsIContent> finalFocusContent = GetRoleContent(finalFocusNode);
++  nsIDOMNode* finalFocusNode = aNode;
++  nsIAccessible* finalFocusAccessible = aAccessible;
++  nsIContent* finalFocusContent = GetRoleContent(finalFocusNode);
+   if (finalFocusContent) {
+     nsAutoString id;
+     if (finalFocusContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::aria_activedescendant, id)) {
+-      nsCOMPtr<nsIDOMDocument> domDoc;
+-      aNode->GetOwnerDocument(getter_AddRefs(domDoc));
++      nsIDOMDocument* domDoc = nsnull;
++      aNode->GetOwnerDocument(&domDoc);
+       if (!domDoc) {  // Maybe the passed-in node actually is a doc
+         domDoc = do_QueryInterface(aNode);
+       }
+       if (!domDoc) {
+         return PR_FALSE;
+       }
+-      nsCOMPtr<nsIDOMElement> relatedEl;
+-      domDoc->GetElementById(id, getter_AddRefs(relatedEl));
++      nsIDOMElement* relatedEl = nsnull;
++      domDoc->GetElementById(id, &relatedEl);
+       finalFocusNode = do_QueryInterface(relatedEl);
+       if (!finalFocusNode) {
+         // If aria-activedescendant is set to nonextistant ID, then treat as focus
+@@ -479,7 +479,7 @@ PRBool nsRootAccessible::FireAccessibleF
+   }
+ 
+   if (!finalFocusAccessible) {
+-    GetAccService()->GetAccessibleFor(finalFocusNode, getter_AddRefs(finalFocusAccessible));      
++    GetAccService()->GetAccessibleFor(finalFocusNode, &finalFocusAccessible);      
+     // For activedescendant, the ARIA spec does not require that the user agent
+     // checks whether finalFocusNode is actually a descendant of the element with
+     // the activedescendant attribute.
+@@ -495,9 +495,9 @@ PRBool nsRootAccessible::FireAccessibleF
+       PRUint32 naturalRole; // The natural role is the role that this type of element normally has
+       finalFocusAccessible->GetRole(&naturalRole);
+       if (role != naturalRole) { // Must be a DHTML menuitem
+-        nsCOMPtr<nsIAccessible> menuBarAccessible =
++        nsIAccessible* menuBarAccessible =
+           nsAccUtils::GetAncestorWithRole(finalFocusAccessible, nsIAccessibleRole::ROLE_MENUBAR);
+-        nsCOMPtr<nsIAccessNode> menuBarAccessNode = do_QueryInterface(menuBarAccessible);
++        nsIAccessNode* menuBarAccessNode = do_QueryInterface(menuBarAccessible);
+         if (menuBarAccessNode) {
+           menuBarAccessNode->GetDOMNode(getter_AddRefs(mCurrentARIAMenubar));
+           if (mCurrentARIAMenubar) {
+@@ -508,7 +508,7 @@ PRBool nsRootAccessible::FireAccessibleF
+     }
+   }
+   else if (mCurrentARIAMenubar) {
+-    nsCOMPtr<nsIAccessibleEvent> menuEndEvent =
++    nsIAccessibleEvent* menuEndEvent =
+       new nsAccEvent(nsIAccessibleEvent::EVENT_MENU_END, mCurrentARIAMenubar,
+                      PR_FALSE, nsAccEvent::eAllowDupes);
+     if (menuEndEvent) {
+@@ -521,18 +521,18 @@ PRBool nsRootAccessible::FireAccessibleF
+   gLastFocusedNode = finalFocusNode;
+   NS_IF_ADDREF(gLastFocusedNode);
+ 
+-  nsCOMPtr<nsIContent> focusContent = do_QueryInterface(gLastFocusedNode);
++  nsIContent* focusContent = do_QueryInterface(gLastFocusedNode);
+   nsIFrame *focusFrame = nsnull;
+   if (focusContent) {
+-    nsCOMPtr<nsIPresShell> shell = nsAccessNode::GetPresShellFor(gLastFocusedNode);
++    nsIPresShell* shell = nsAccessNode::GetPresShellFor(gLastFocusedNode);
+     focusFrame = shell->GetRealPrimaryFrameFor(focusContent);
+   }
+   gLastFocusedFrameType = (focusFrame && focusFrame->GetStyleVisibility()->IsVisible()) ? focusFrame->GetType() : 0;
+ 
+-  nsCOMPtr<nsIAccessibleDocument> docAccessible = do_QueryInterface(finalFocusAccessible);
++  nsIAccessibleDocument* docAccessible = do_QueryInterface(finalFocusAccessible);
+   if (docAccessible) {
+     // Doc is gaining focus, but actual focus may be on an element within document
+-    nsCOMPtr<nsIDOMNode> realFocusedNode = GetCurrentFocus();
++    nsIDOMNode* realFocusedNode = GetCurrentFocus();
+     if (realFocusedNode != aNode || realFocusedNode == mDOMNode) {
+       // Suppress document focus, because real DOM focus will be fired next,
+       // and that's what we care about
+@@ -551,24 +551,24 @@ return PR_FALSE;
+ 
+ void nsRootAccessible::FireCurrentFocusEvent()
+ {
+-  nsCOMPtr<nsIDOMNode> focusedNode = GetCurrentFocus();
++  nsIDOMNode* focusedNode = GetCurrentFocus();
+   if (!focusedNode) {
+     return; // No current focus
+   }
+ 
+   // Simulate a focus event so that we can reuse code that fires focus for container children like treeitems
+-  nsCOMPtr<nsIDOMDocumentEvent> docEvent = do_QueryInterface(mDocument);
++  nsIDOMDocumentEvent* docEvent = do_QueryInterface(mDocument);
+   if (docEvent) {
+-    nsCOMPtr<nsIDOMEvent> event;
++    nsIDOMEvent* event = nsnull;
+     if (NS_SUCCEEDED(docEvent->CreateEvent(NS_LITERAL_STRING("Events"),
+-                                           getter_AddRefs(event))) &&
++                                           &event)) &&
+         NS_SUCCEEDED(event->InitEvent(NS_LITERAL_STRING("focus"), PR_TRUE, PR_TRUE))) {
+       // Get the target node we really want for the event.
+       nsIAccessibilityService* accService = GetAccService();
+       if (accService) {
+-        nsCOMPtr<nsIDOMNode> targetNode;
++        nsIDOMNode* targetNode = nsnull;
+         accService->GetRelevantContentNodeFor(focusedNode,
+-                                            getter_AddRefs(targetNode));
++                                            &targetNode);
+         if (targetNode) {
+           HandleEventWithTarget(event, targetNode);
+         }
+@@ -583,8 +583,8 @@ NS_IMETHODIMP nsRootAccessible::HandleEv
+ {
+   // Turn DOM events in accessibility events
+   // Get info about event and target
+-  nsCOMPtr<nsIDOMNode> targetNode;
+-  GetTargetNode(aEvent, getter_AddRefs(targetNode));
++  nsIDOMNode* targetNode = nsnull;
++  GetTargetNode(aEvent, &targetNode);
+   if (!targetNode)
+     return NS_ERROR_FAILURE;
+   
+@@ -621,16 +621,16 @@ nsresult nsRootAccessible::HandleEventWi
+     // so that we don't destroy something still in use, like wizard page. 
+     // And we only get cached document accessible to destroy, so that we don't
+     // create it just to destroy it.
+-    nsCOMPtr<nsIDocument> doc(do_QueryInterface(aTargetNode));
+-    nsCOMPtr<nsIAccessibleDocument> accDoc = GetDocAccessibleFor(doc);
+-    nsCOMPtr<nsPIAccessNode> privateAcc = do_QueryInterface(accDoc);
++    nsIDocument* doc(do_QueryInterface(aTargetNode));
++    nsIAccessibleDocument* accDoc = GetDocAccessibleFor(doc);
++    nsPIAccessNode* privateAcc = do_QueryInterface(accDoc);
+     if (privateAcc) {
+       privateAcc->Shutdown();
+     }
+     return NS_OK;
+   }
+ 
+-  nsCOMPtr<nsIPresShell> eventShell = GetPresShellFor(aTargetNode);
++  nsIPresShell* eventShell = GetPresShellFor(aTargetNode);
+   if (!eventShell) {
+     return NS_OK;
+   }
+@@ -658,16 +658,16 @@ nsresult nsRootAccessible::HandleEventWi
+     FireCurrentFocusEvent();
+   }
+ 
+-  nsCOMPtr<nsIAccessible> accessible;
++  nsIAccessible* accessible = nsnull;
+   accService->GetAccessibleInShell(aTargetNode, eventShell,
+-                                   getter_AddRefs(accessible));
+-  nsCOMPtr<nsPIAccessible> privAcc(do_QueryInterface(accessible));
++                                   &accessible);
++  nsPIAccessible* privAcc(do_QueryInterface(accessible));
+   if (!privAcc)
+     return NS_OK;
+ 
+ #ifdef MOZ_XUL
+   if (isTree) {
+-    nsCOMPtr<nsIAccessibleTreeCache> treeAcc(do_QueryInterface(accessible));
++    nsIAccessibleTreeCache* treeAcc(do_QueryInterface(accessible));
+     NS_ASSERTION(treeAcc,
+                  "Accessible for xul:tree doesn't implement nsIAccessibleTreeCache interface.");
+ 
+@@ -694,7 +694,7 @@ nsresult nsRootAccessible::HandleEventWi
+     PRBool isEnabled = (state & (nsIAccessibleStates::STATE_CHECKED |
+                         nsIAccessibleStates::STATE_SELECTED)) != 0;
+ 
+-    nsCOMPtr<nsIAccessibleStateChangeEvent> accEvent =
++    nsIAccessibleStateChangeEvent* accEvent =
+       new nsAccStateChangeEvent(accessible, nsIAccessibleStates::STATE_CHECKED,
+                                 PR_FALSE, isEnabled);
+     privAcc->FireAccessibleEvent(accEvent);
+@@ -710,7 +710,7 @@ nsresult nsRootAccessible::HandleEventWi
+ 
+     PRBool isEnabled = !!(state & nsIAccessibleStates::STATE_CHECKED);
+ 
+-    nsCOMPtr<nsIAccessibleStateChangeEvent> accEvent =
++    nsIAccessibleStateChangeEvent* accEvent =
+       new nsAccStateChangeEvent(accessible,
+                                 nsIAccessibleStates::STATE_CHECKED,
+                                 PR_FALSE, isEnabled);
+@@ -718,22 +718,22 @@ nsresult nsRootAccessible::HandleEventWi
+     return privAcc->FireAccessibleEvent(accEvent);
+   }
+ 
+-  nsCOMPtr<nsIAccessible> treeItemAccessible;
++  nsIAccessible* treeItemAccessible = nsnull;
+ #ifdef MOZ_XUL
+   // If it's a tree element, need the currently selected item
+   if (isTree) {
+-    nsCOMPtr<nsIDOMXULMultiSelectControlElement> multiSelect =
++    nsIDOMXULMultiSelectControlElement* multiSelect =
+       do_QueryInterface(aTargetNode);
+     if (multiSelect) {
+       PRInt32 treeIndex = -1;
+       multiSelect->GetCurrentIndex(&treeIndex);
+       if (treeIndex >= 0) {
+-        nsCOMPtr<nsIAccessibleTreeCache> treeCache(do_QueryInterface(accessible));
++        nsIAccessibleTreeCache* treeCache(do_QueryInterface(accessible));
+         if (!treeCache ||
+             NS_FAILED(treeCache->GetCachedTreeitemAccessible(
+                       treeIndex,
+                       nsnull,
+-                      getter_AddRefs(treeItemAccessible))) ||
++                      &treeItemAccessible)) ||
+                       !treeItemAccessible) {
+           return NS_ERROR_OUT_OF_MEMORY;
+         }
+@@ -748,7 +748,7 @@ nsresult nsRootAccessible::HandleEventWi
+     PRUint32 state = State(accessible); // collapsed/expanded changed
+     PRBool isEnabled = (state & nsIAccessibleStates::STATE_EXPANDED) != 0;
+ 
+-    nsCOMPtr<nsIAccessibleStateChangeEvent> accEvent =
++    nsIAccessibleStateChangeEvent* accEvent =
+       new nsAccStateChangeEvent(accessible, nsIAccessibleStates::STATE_EXPANDED,
+                                 PR_FALSE, isEnabled);
+     return FireAccessibleEvent(accEvent);
+@@ -757,7 +757,7 @@ nsresult nsRootAccessible::HandleEventWi
+   if (treeItemAccessible && eventType.EqualsLiteral("select")) {
+     // If multiselect tree, we should fire selectionadd or selection removed
+     if (gLastFocusedNode == aTargetNode) {
+-      nsCOMPtr<nsIDOMXULMultiSelectControlElement> multiSel =
++      nsIDOMXULMultiSelectControlElement* multiSel =
+         do_QueryInterface(aTargetNode);
+       nsAutoString selType;
+       multiSel->GetSelType(selType);
+@@ -793,19 +793,19 @@ nsresult nsRootAccessible::HandleEventWi
+     // Keep a reference to the target node. We might want to change
+     // it to the individual radio button or selected item, and send
+     // the focus event to that.
+-    nsCOMPtr<nsIDOMNode> focusedItem(aTargetNode);
++    nsIDOMNode* focusedItem(aTargetNode);
+ 
+     if (!treeItemAccessible) {
+-      nsCOMPtr<nsIDOMXULSelectControlElement> selectControl =
++      nsIDOMXULSelectControlElement* selectControl =
+         do_QueryInterface(aTargetNode);
+       if (selectControl) {
+-        nsCOMPtr<nsIDOMXULMenuListElement> menuList =
++        nsIDOMXULMenuListElement* menuList =
+           do_QueryInterface(aTargetNode);
+         if (!menuList) {
+           // Don't do this for menu lists, the items only get focused
+           // when the list is open, based on DOMMenuitemActive events
+-          nsCOMPtr<nsIDOMXULSelectControlItemElement> selectedItem;
+-          selectControl->GetSelectedItem(getter_AddRefs(selectedItem));
++          nsIDOMXULSelectControlItemElement* selectedItem = nsnull;
++          selectControl->GetSelectedItem(&selectedItem);
+           if (selectedItem)
+             focusedItem = do_QueryInterface(selectedItem);
+ 
+@@ -813,7 +813,7 @@ nsresult nsRootAccessible::HandleEventWi
+             return NS_OK;
+ 
+           accService->GetAccessibleInShell(focusedItem, eventShell,
+-                                           getter_AddRefs(accessible));
++                                           &accessible);
+           if (!accessible)
+             return NS_OK;
+         }
+@@ -856,7 +856,7 @@ nsresult nsRootAccessible::HandleEventWi
+         return NS_OK; // Tree with nothing selected
+       }
+ #endif
+-      nsCOMPtr<nsPIAccessNode> menuAccessNode = do_QueryInterface(accessible);
++      nsPIAccessNode* menuAccessNode = do_QueryInterface(accessible);
+       NS_ENSURE_TRUE(menuAccessNode, NS_ERROR_FAILURE);
+       nsIFrame* menuFrame = menuAccessNode->GetFrame();
+       NS_ENSURE_TRUE(menuFrame, NS_ERROR_FAILURE);
+@@ -871,15 +871,15 @@ nsresult nsRootAccessible::HandleEventWi
+         // is active.
+         return NS_OK;
+       } else {
+-        nsCOMPtr<nsIAccessible> containerAccessible;
+-        accessible->GetParent(getter_AddRefs(containerAccessible));
++        nsIAccessible* containerAccessible = nsnull;
++        accessible->GetParent(&containerAccessible);
+         NS_ENSURE_TRUE(containerAccessible, NS_ERROR_FAILURE);
+         // It is not top level menuitem
+         // Only fire focus event if it is not inside collapsed popup
+         // and not a listitem of a combo box
+         if (State(containerAccessible) & nsIAccessibleStates::STATE_COLLAPSED) {
+-          nsCOMPtr<nsIAccessible> containerParent;
+-          containerAccessible->GetParent(getter_AddRefs(containerParent));
++          nsIAccessible* containerParent = nsnull;
++          containerAccessible->GetParent(&containerParent);
+           NS_ENSURE_TRUE(containerParent, NS_ERROR_FAILURE);
+           if (Role(containerParent) != nsIAccessibleRole::ROLE_COMBOBOX) {
+             return NS_OK;
+@@ -888,12 +888,12 @@ nsresult nsRootAccessible::HandleEventWi
+       }
+     }
+     if (!fireFocus) {
+-      nsCOMPtr<nsIDOMNode> realFocusedNode = GetCurrentFocus();
+-      nsCOMPtr<nsIContent> realFocusedContent = do_QueryInterface(realFocusedNode);
+-      nsCOMPtr<nsIContent> targetContent = do_QueryInterface(aTargetNode);
++      nsIDOMNode* realFocusedNode = GetCurrentFocus();
++      nsIContent* realFocusedContent = do_QueryInterface(realFocusedNode);
++      nsIContent* targetContent = do_QueryInterface(aTargetNode);
+       nsIContent *containerContent = targetContent;
+       while (containerContent) {
+-        nsCOMPtr<nsIDOMXULPopupElement> popup = do_QueryInterface(containerContent);
++        nsIDOMXULPopupElement* popup = do_QueryInterface(containerContent);
+         if (popup || containerContent == realFocusedContent) { 
+           // If we're inside the focus or a popup we can fire focus events
+           // for the changed active item
+@@ -932,14 +932,14 @@ void nsRootAccessible::GetTargetNode(nsI
+ {
+   *aTargetNode = nsnull;
+ 
+-  nsCOMPtr<nsIDOMNSEvent> nsevent(do_QueryInterface(aEvent));
++  nsIDOMNSEvent* nsevent(do_QueryInterface(aEvent));
+ 
+   if (!nsevent)
+     return;
+ 
+-  nsCOMPtr<nsIDOMEventTarget> domEventTarget;
+-  nsevent->GetOriginalTarget(getter_AddRefs(domEventTarget));
+-  nsCOMPtr<nsIDOMNode> eventTarget(do_QueryInterface(domEventTarget));
++  nsIDOMEventTarget* domEventTarget = nsnull;
++  nsevent->GetOriginalTarget(&domEventTarget);
++  nsIDOMNode* eventTarget(do_QueryInterface(domEventTarget));
+   if (!eventTarget)
+     return;
+ 
+@@ -967,7 +967,7 @@ nsRootAccessible::Init()
+   nsresult rv = nsDocAccessibleWrap::Init();
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+-  nsRefPtr<nsApplicationAccessibleWrap> root = GetApplicationAccessible();
++  nsApplicationAccessibleWrap* root = GetApplicationAccessible();
+   NS_ENSURE_STATE(root);
+ 
+   root->AddRootAccessible(this);
+@@ -981,7 +981,7 @@ NS_IMETHODIMP nsRootAccessible::Shutdown
+     return NS_OK;  // Already shutdown
+   }
+ 
+-  nsRefPtr<nsApplicationAccessibleWrap> root = GetApplicationAccessible();
++  nsApplicationAccessibleWrap* root = GetApplicationAccessible();
+   NS_ENSURE_STATE(root);
+ 
+   root->RemoveRootAccessible(this);
+@@ -996,7 +996,7 @@ NS_IMETHODIMP nsRootAccessible::Shutdown
+   return nsDocAccessibleWrap::Shutdown();
+ }
+ 
+-already_AddRefed<nsIDocShellTreeItem>
++nsIDocShellTreeItem*
+ nsRootAccessible::GetContentDocShell(nsIDocShellTreeItem *aStart)
+ {
+   if (!aStart) {
+@@ -1006,9 +1006,9 @@ nsRootAccessible::GetContentDocShell(nsI
+   PRInt32 itemType;
+   aStart->GetItemType(&itemType);
+   if (itemType == nsIDocShellTreeItem::typeContent) {
+-    nsCOMPtr<nsIAccessibleDocument> accDoc =
++    nsIAccessibleDocument* accDoc =
+       GetDocAccessibleFor(aStart, PR_TRUE);
+-    nsCOMPtr<nsIAccessible> accessible = do_QueryInterface(accDoc);
++    nsIAccessible* accessible = do_QueryInterface(accDoc);
+     // If ancestor chain of accessibles is not completely visible,
+     // don't use this one. This happens for example if it's inside
+     // a background tab (tabbed browsing)
+@@ -1016,24 +1016,24 @@ nsRootAccessible::GetContentDocShell(nsI
+       if (State(accessible) & nsIAccessibleStates::STATE_INVISIBLE) {
+         return nsnull;
+       }
+-      nsCOMPtr<nsIAccessible> ancestor;
+-      accessible->GetParent(getter_AddRefs(ancestor));
++      nsIAccessible* ancestor = nsnull;
++      accessible->GetParent(&ancestor);
+       if (ancestor == this) {
+         break; // Don't check past original root accessible we started with
+       }
+-      accessible.swap(ancestor);
++      swap(accessible, ancestor);
+     }
+ 
+     NS_ADDREF(aStart);
+     return aStart;
+   }
+-  nsCOMPtr<nsIDocShellTreeNode> treeNode(do_QueryInterface(aStart));
++  nsIDocShellTreeNode* treeNode(do_QueryInterface(aStart));
+   if (treeNode) {
+     PRInt32 subDocuments;
+     treeNode->GetChildCount(&subDocuments);
+     for (PRInt32 count = 0; count < subDocuments; count ++) {
+-      nsCOMPtr<nsIDocShellTreeItem> treeItemChild, contentTreeItem;
+-      treeNode->GetChildAt(count, getter_AddRefs(treeItemChild));
++      nsIDocShellTreeItem* treeItemChild = nsnull, *contentTreeItem = nsnull;
++      treeNode->GetChildAt(count, &treeItemChild);
+       NS_ENSURE_TRUE(treeItemChild, nsnull);
+       contentTreeItem = GetContentDocShell(treeItemChild);
+       if (contentTreeItem) {
+@@ -1054,12 +1054,12 @@ NS_IMETHODIMP nsRootAccessible::GetAcces
+     return nsDocAccessibleWrap::GetAccessibleRelated(aRelationType, aRelated);
+   }
+ 
+-  nsCOMPtr<nsIDocShellTreeItem> treeItem =
++  nsIDocShellTreeItem* treeItem =
+     nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
+-  nsCOMPtr<nsIDocShellTreeItem> contentTreeItem = GetContentDocShell(treeItem);
++  nsIDocShellTreeItem* contentTreeItem = GetContentDocShell(treeItem);
+   // there may be no content area, so we need a null check
+   if (contentTreeItem) {
+-    nsCOMPtr<nsIAccessibleDocument> accDoc =
++    nsIAccessibleDocument* accDoc =
+       GetDocAccessibleFor(contentTreeItem, PR_TRUE);
+     NS_ASSERTION(accDoc, "No EMBEDS document");
+     if (accDoc) {
+@@ -1075,7 +1075,7 @@ NS_IMETHODIMP nsRootAccessible::FireDocL
+     return NS_OK;  // Document has been shut down
+   }
+ 
+-  nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem =
++  nsIDocShellTreeItem* docShellTreeItem =
+     nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
+   NS_ASSERTION(docShellTreeItem, "No doc shell tree item for document");
+   NS_ENSURE_TRUE(docShellTreeItem, NS_ERROR_FAILURE);
+@@ -1096,19 +1096,19 @@ nsRootAccessible::HandleTreeRowCountChan
+ nsRootAccessible::HandleTreeRowCountChangedEvent(nsIDOMEvent *aEvent,
+                                                  nsIAccessibleTreeCache *aAccessible)
+ {
+-  nsCOMPtr<nsIDOMDataContainerEvent> dataEvent(do_QueryInterface(aEvent));
++  nsIDOMDataContainerEvent* dataEvent(do_QueryInterface(aEvent));
+   if (!dataEvent)
+     return NS_OK;
+ 
+-  nsCOMPtr<nsIVariant> indexVariant;
++  nsIVariant* indexVariant = nsnull;
+   dataEvent->GetData(NS_LITERAL_STRING("index"),
+-                     getter_AddRefs(indexVariant));
++                     &indexVariant);
+   if (!indexVariant)
+     return NS_OK;
+ 
+-  nsCOMPtr<nsIVariant> countVariant;
++  nsIVariant* countVariant = nsnull;
+   dataEvent->GetData(NS_LITERAL_STRING("count"),
+-                     getter_AddRefs(countVariant));
++                     &countVariant);
+   if (!countVariant)
+     return NS_OK;
+ 
+@@ -1123,33 +1123,33 @@ nsRootAccessible::HandleTreeInvalidatedE
+ nsRootAccessible::HandleTreeInvalidatedEvent(nsIDOMEvent *aEvent,
+                                              nsIAccessibleTreeCache *aAccessible)
+ {
+-  nsCOMPtr<nsIDOMDataContainerEvent> dataEvent(do_QueryInterface(aEvent));
++  nsIDOMDataContainerEvent* dataEvent(do_QueryInterface(aEvent));
+   if (!dataEvent)
+     return NS_OK;
+ 
+   PRInt32 startRow = 0, endRow = -1, startCol = 0, endCol = -1;
+ 
+-  nsCOMPtr<nsIVariant> startRowVariant;
++  nsIVariant* startRowVariant = nsnull;
+   dataEvent->GetData(NS_LITERAL_STRING("startrow"),
+-                     getter_AddRefs(startRowVariant));
++                     &startRowVariant);
+   if (startRowVariant)
+     startRowVariant->GetAsInt32(&startRow);
+ 
+-  nsCOMPtr<nsIVariant> endRowVariant;
++  nsIVariant* endRowVariant = nsnull;
+   dataEvent->GetData(NS_LITERAL_STRING("endrow"),
+-                     getter_AddRefs(endRowVariant));
++                     &endRowVariant);
+   if (endRowVariant)
+     endRowVariant->GetAsInt32(&endRow);
+ 
+-  nsCOMPtr<nsIVariant> startColVariant;
++  nsIVariant* startColVariant = nsnull;
+   dataEvent->GetData(NS_LITERAL_STRING("startcolumn"),
+-                     getter_AddRefs(startColVariant));
++                     &startColVariant);
+   if (startColVariant)
+     startColVariant->GetAsInt32(&startCol);
+ 
+-  nsCOMPtr<nsIVariant> endColVariant;
++  nsIVariant* endColVariant = nsnull;
+   dataEvent->GetData(NS_LITERAL_STRING("endcolumn"),
+-                     getter_AddRefs(endColVariant));
++                     &endColVariant);
+   if (endColVariant)
+     endColVariant->GetAsInt32(&endCol);
+ 
+diff --git a/accessible/src/base/nsRootAccessible.h b/accessible/src/base/nsRootAccessible.h
+--- a/accessible/src/base/nsRootAccessible.h
++++ b/accessible/src/base/nsRootAccessible.h
+@@ -143,7 +143,7 @@ class nsRootAccessible : public nsDocAcc
+ #ifdef MOZ_XUL
+     PRUint32 GetChromeFlags();
+ #endif
+-    already_AddRefed<nsIDocShellTreeItem>
++    nsIDocShellTreeItem*
+            GetContentDocShell(nsIDocShellTreeItem *aStart);
+     nsRefPtr<nsCaretAccessible> mCaretAccessible;
+     nsCOMPtr<nsIDOMNode> mCurrentARIAMenubar;
+diff --git a/accessible/src/html/nsHTMLAreaAccessible.cpp b/accessible/src/html/nsHTMLAreaAccessible.cpp
+--- a/accessible/src/html/nsHTMLAreaAccessible.cpp
++++ b/accessible/src/html/nsHTMLAreaAccessible.cpp
+@@ -74,7 +74,7 @@ nsHTMLAreaAccessible::GetName(nsAString 
+       return NS_OK;
+   }
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   if (!content->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::alt,
+                         aName) &&  
+       !content->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::title,
+@@ -91,7 +91,7 @@ nsHTMLAreaAccessible::GetDescription(nsA
+   aDescription.Truncate();
+ 
+   // Still to do - follow IE's standard here
+-  nsCOMPtr<nsIDOMHTMLAreaElement> area(do_QueryInterface(mDOMNode));
++  nsIDOMHTMLAreaElement* area(do_QueryInterface(mDOMNode));
+   if (area) 
+     area->GetShape(aDescription);
+ 
+@@ -136,7 +136,7 @@ nsHTMLAreaAccessible::GetBounds(PRInt32 
+   nsPresContext *presContext = GetPresContext();
+   NS_ENSURE_TRUE(presContext, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIContent> ourContent(do_QueryInterface(mDOMNode));
++  nsIContent* ourContent(do_QueryInterface(mDOMNode));
+   NS_ENSURE_TRUE(ourContent, NS_ERROR_FAILURE);
+ 
+   nsIFrame *frame = GetFrame();
+@@ -145,8 +145,8 @@ nsHTMLAreaAccessible::GetBounds(PRInt32 
+   nsresult rv = frame->QueryInterface(NS_GET_IID(nsIImageFrame), (void**)&imageFrame);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+-  nsCOMPtr<nsIImageMap> map;
+-  imageFrame->GetImageMap(presContext, getter_AddRefs(map));
++  nsIImageMap* map = nsnull;
++  imageFrame->GetImageMap(presContext, &map);
+   NS_ENSURE_TRUE(map, NS_ERROR_FAILURE);
+ 
+   nsRect rect, orgRectPixels;
+diff --git a/accessible/src/html/nsHTMLFormControlAccessible.cpp b/accessible/src/html/nsHTMLFormControlAccessible.cpp
+--- a/accessible/src/html/nsHTMLFormControlAccessible.cpp
++++ b/accessible/src/html/nsHTMLFormControlAccessible.cpp
+@@ -113,7 +113,7 @@ nsHTMLCheckboxAccessible::GetState(PRUin
+ 
+   PRBool checked = PR_FALSE;   // Radio buttons and check boxes can be checked
+ 
+-  nsCOMPtr<nsIDOMHTMLInputElement> htmlCheckboxElement(do_QueryInterface(mDOMNode));
++  nsIDOMHTMLInputElement* htmlCheckboxElement(do_QueryInterface(mDOMNode));
+   if (htmlCheckboxElement)
+     htmlCheckboxElement->GetChecked(&checked);
+ 
+@@ -142,7 +142,7 @@ nsHTMLRadioButtonAccessible::GetState(PR
+   
+   PRBool checked = PR_FALSE;   // Radio buttons and check boxes can be checked
+ 
+-  nsCOMPtr<nsIDOMHTMLInputElement> htmlRadioElement(do_QueryInterface(mDOMNode));
++  nsIDOMHTMLInputElement* htmlRadioElement(do_QueryInterface(mDOMNode));
+   if (htmlRadioElement)
+     htmlRadioElement->GetChecked(&checked);
+ 
+@@ -166,7 +166,7 @@ nsHTMLRadioButtonAccessible::GetAttribut
+   nsAutoString tagName;
+   mDOMNode->GetLocalName(tagName);
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   NS_ENSURE_STATE(content);
+ 
+   nsAutoString type;
+@@ -174,18 +174,18 @@ nsHTMLRadioButtonAccessible::GetAttribut
+   nsAutoString name;
+   content->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::name, name);
+ 
+-  nsCOMPtr<nsIDOMNodeList> inputs;
++  nsIDOMNodeList* inputs = nsnull;
+ 
+-  nsCOMPtr<nsIDOMHTMLInputElement> radio(do_QueryInterface(mDOMNode));
+-  nsCOMPtr<nsIDOMHTMLFormElement> form;
+-  radio->GetForm(getter_AddRefs(form));
++  nsIDOMHTMLInputElement* radio(do_QueryInterface(mDOMNode));
++  nsIDOMHTMLFormElement* form = nsnull;
++  radio->GetForm(&form);
+   if (form) {
+-    form->GetElementsByTagNameNS(nsURI, tagName, getter_AddRefs(inputs));
++    form->GetElementsByTagNameNS(nsURI, tagName, &inputs);
+   } else {
+-    nsCOMPtr<nsIDOMDocument> document;
+-    mDOMNode->GetOwnerDocument(getter_AddRefs(document));
++    nsIDOMDocument* document = nsnull;
++    mDOMNode->GetOwnerDocument(&document);
+     if (document)
+-      document->GetElementsByTagNameNS(nsURI, tagName, getter_AddRefs(inputs));
++      document->GetElementsByTagNameNS(nsURI, tagName, &inputs);
+   }
+ 
+   NS_ENSURE_TRUE(inputs, NS_OK);
+@@ -198,10 +198,10 @@ nsHTMLRadioButtonAccessible::GetAttribut
+   PRInt32 count = 0;
+ 
+   for (PRUint32 index = 0; index < inputsCount; index++) {
+-    nsCOMPtr<nsIDOMNode> itemNode;
+-    inputs->Item(index, getter_AddRefs(itemNode));
++    nsIDOMNode* itemNode = nsnull;
++    inputs->Item(index, &itemNode);
+ 
+-    nsCOMPtr<nsIContent> item(do_QueryInterface(itemNode));
++    nsIContent* item(do_QueryInterface(itemNode));
+     if (item &&
+         item->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::type,
+                           type, eCaseMatters) &&
+@@ -258,7 +258,7 @@ nsHTMLButtonAccessible::GetState(PRUint3
+   if (!mDOMNode)
+     return NS_OK;
+ 
+-  nsCOMPtr<nsIDOMElement> element(do_QueryInterface(mDOMNode));
++  nsIDOMElement* element(do_QueryInterface(mDOMNode));
+   NS_ENSURE_TRUE(element, NS_ERROR_FAILURE);
+ 
+   nsAutoString buttonType;
+@@ -277,7 +277,7 @@ NS_IMETHODIMP nsHTMLButtonAccessible::Ge
+ 
+ NS_IMETHODIMP nsHTMLButtonAccessible::GetName(nsAString& aName)
+ {
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   if (!content) {
+     return NS_ERROR_FAILURE; // Node shut down
+   }
+@@ -364,7 +364,7 @@ nsHTML4ButtonAccessible::GetState(PRUint
+   if (!mDOMNode)
+     return NS_OK;
+ 
+-  nsCOMPtr<nsIDOMElement> element(do_QueryInterface(mDOMNode));
++  nsIDOMElement* element(do_QueryInterface(mDOMNode));
+   NS_ASSERTION(element, "No element for button's dom node!");
+ 
+   *aState |= nsIAccessibleStates::STATE_FOCUSABLE;
+@@ -389,7 +389,7 @@ NS_IMETHODIMP nsHTMLTextFieldAccessible:
+ NS_IMETHODIMP nsHTMLTextFieldAccessible::GetRole(PRUint32 *aRole)
+ {
+   *aRole = nsIAccessibleRole::ROLE_ENTRY;
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   if (content &&
+       content->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::type,
+                            nsAccessibilityAtoms::password, eIgnoreCase)) {
+@@ -400,7 +400,7 @@ NS_IMETHODIMP nsHTMLTextFieldAccessible:
+ 
+ NS_IMETHODIMP nsHTMLTextFieldAccessible::GetName(nsAString& aName)
+ {
+-  nsCOMPtr<nsIContent> content = do_QueryInterface(mDOMNode);
++  nsIContent* content = do_QueryInterface(mDOMNode);
+   if (!content) {
+     return NS_ERROR_FAILURE;
+   }
+@@ -413,8 +413,8 @@ NS_IMETHODIMP nsHTMLTextFieldAccessible:
+   // This means we're part of another control, so use parent accessible for name.
+   // This ensures that a textbox inside of a XUL widget gets
+   // an accessible name.
+-  nsCOMPtr<nsIAccessible> parent;
+-  rv = GetParent(getter_AddRefs(parent));
++  nsIAccessible* parent = nsnull;
++  rv = GetParent(&parent);
+   return parent ? parent->GetName(aName) : rv;
+ }
+ 
+@@ -425,12 +425,12 @@ NS_IMETHODIMP nsHTMLTextFieldAccessible:
+   if (state & nsIAccessibleStates::STATE_PROTECTED)    // Don't return password text!
+     return NS_ERROR_FAILURE;
+ 
+-  nsCOMPtr<nsIDOMHTMLTextAreaElement> textArea(do_QueryInterface(mDOMNode));
++  nsIDOMHTMLTextAreaElement* textArea(do_QueryInterface(mDOMNode));
+   if (textArea) {
+     return textArea->GetValue(_retval);
+   }
+   
+-  nsCOMPtr<nsIDOMHTMLInputElement> inputElement(do_QueryInterface(mDOMNode));
++  nsIDOMHTMLInputElement* inputElement(do_QueryInterface(mDOMNode));
+   if (inputElement) {
+     return inputElement->GetValue(_retval);
+   }
+@@ -447,7 +447,7 @@ nsHTMLTextFieldAccessible::GetState(PRUi
+     return NS_OK;
+ 
+   // can be focusable, focused, protected. readonly, unavailable, selected
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   NS_ASSERTION(content, "Should not have gotten here if upcalled GetExtState() succeeded");
+ 
+   if (content->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::type,
+@@ -455,8 +455,8 @@ nsHTMLTextFieldAccessible::GetState(PRUi
+     *aState |= nsIAccessibleStates::STATE_PROTECTED;
+   }
+   else {
+-    nsCOMPtr<nsIAccessible> parent;
+-    GetParent(getter_AddRefs(parent));
++    nsIAccessible* parent = nsnull;
++    GetParent(&parent);
+     if (parent && Role(parent) == nsIAccessibleRole::ROLE_AUTOCOMPLETE) {
+       *aState |= nsIAccessibleStates::STATE_HASPOPUP;
+     }
+@@ -469,7 +469,7 @@ nsHTMLTextFieldAccessible::GetState(PRUi
+   if (!aExtraState)
+     return NS_OK;
+ 
+-  nsCOMPtr<nsIDOMHTMLInputElement> htmlInput(do_QueryInterface(mDOMNode));
++  nsIDOMHTMLInputElement* htmlInput(do_QueryInterface(mDOMNode));
+   // Is it an <input> or a <textarea> ?
+   if (htmlInput) {
+     *aExtraState |= nsIAccessibleStates::EXT_STATE_SINGLE_LINE;
+@@ -481,7 +481,7 @@ nsHTMLTextFieldAccessible::GetState(PRUi
+   if (!(*aExtraState & nsIAccessibleStates::EXT_STATE_EDITABLE))
+     return NS_OK;
+ 
+-  nsCOMPtr<nsIContent> bindingContent = content->GetBindingParent();
++  nsIContent* bindingContent = content->GetBindingParent();
+   if (bindingContent &&
+       bindingContent->NodeInfo()->Equals(nsAccessibilityAtoms::textbox,
+                                          kNameSpaceID_XUL) &&
+@@ -503,9 +503,9 @@ nsHTMLTextFieldAccessible::GetState(PRUi
+                      autocomplete);
+ 
+     if (!autocomplete.LowerCaseEqualsLiteral("off")) {
+-      nsCOMPtr<nsIDOMHTMLFormElement> form;
+-      htmlInput->GetForm(getter_AddRefs(form));
+-      nsCOMPtr<nsIContent> formContent(do_QueryInterface(form));
++      nsIDOMHTMLFormElement* form = nsnull;
++      htmlInput->GetForm(&form);
++      nsIContent* formContent(do_QueryInterface(form));
+       if (formContent) {
+         formContent->GetAttr(kNameSpaceID_None,
+                              nsAccessibilityAtoms::autocomplete, autocomplete);
+@@ -537,7 +537,7 @@ NS_IMETHODIMP nsHTMLTextFieldAccessible:
+ NS_IMETHODIMP nsHTMLTextFieldAccessible::DoAction(PRUint8 index)
+ {
+   if (index == 0) {
+-    nsCOMPtr<nsIDOMNSHTMLElement> element(do_QueryInterface(mDOMNode));
++    nsIDOMNSHTMLElement* element(do_QueryInterface(mDOMNode));
+     if ( element ) {
+       return element->Focus();
+     }
+@@ -549,17 +549,17 @@ NS_IMETHODIMP nsHTMLTextFieldAccessible:
+ NS_IMETHODIMP nsHTMLTextFieldAccessible::GetAssociatedEditor(nsIEditor **aEditor)
+ {
+   *aEditor = nsnull;
+-  nsCOMPtr<nsIDOMNSEditableElement> editableElt(do_QueryInterface(mDOMNode));
++  nsIDOMNSEditableElement* editableElt(do_QueryInterface(mDOMNode));
+   NS_ENSURE_TRUE(editableElt, NS_ERROR_FAILURE);
+ 
+   // nsGenericHTMLElement::GetEditor has a security check.
+   // Make sure we're not restricted by the permissions of
+   // whatever script is currently running.
+-  nsCOMPtr<nsIJSContextStack> stack =
++  nsIJSContextStack* stack =
+     do_GetService("@mozilla.org/js/xpc/ContextStack;1");
+   PRBool pushed = stack && NS_SUCCEEDED(stack->Push(nsnull));
+ 
+-  nsCOMPtr<nsIEditor> editor;
++  nsIEditor* editor = nsnull;
+   nsresult rv = editableElt->GetEditor(aEditor);
+ 
+   if (pushed) {
+@@ -590,7 +590,7 @@ NS_IMETHODIMP nsHTMLGroupboxAccessible::
+ 
+ nsIContent* nsHTMLGroupboxAccessible::GetLegend()
+ {
+-  nsCOMPtr<nsIContent> content = do_QueryInterface(mDOMNode);
++  nsIContent* content = do_QueryInterface(mDOMNode);
+   NS_ENSURE_TRUE(content, nsnull);
+ 
+   nsresult count = 0;
+@@ -646,7 +646,7 @@ nsHTMLGroupboxAccessible::GetAccessibleR
+ 
+   if (aRelationType == nsIAccessibleRelation::RELATION_LABELLED_BY) {
+     // No override for label, so use <legend> for this <fieldset>
+-    nsCOMPtr<nsIDOMNode> legendNode = do_QueryInterface(GetLegend());
++    nsIDOMNode* legendNode = do_QueryInterface(GetLegend());
+     if (legendNode) {
+       GetAccService()->GetAccessibleInWeakShell(legendNode, mWeakShell, aRelated);
+     }
+@@ -674,16 +674,16 @@ nsHTMLLegendAccessible::GetAccessibleRel
+ 
+   if (aRelationType == nsIAccessibleRelation::RELATION_LABEL_FOR) {
+     // Look for groupbox parent
+-    nsCOMPtr<nsIContent> content = do_QueryInterface(mDOMNode);
++    nsIContent* content = do_QueryInterface(mDOMNode);
+     if (!content) {
+       return NS_ERROR_FAILURE;  // Node already shut down
+     }
+-    nsCOMPtr<nsIAccessible> groupboxAccessible = GetParent();
++    nsIAccessible* groupboxAccessible = GetParent();
+     if (groupboxAccessible &&
+         Role(groupboxAccessible) == nsIAccessibleRole::ROLE_GROUPING) {
+-      nsCOMPtr<nsIAccessible> testLabelAccessible;
++      nsIAccessible* testLabelAccessible = nsnull;
+       groupboxAccessible->GetAccessibleRelated(nsIAccessibleRelation::RELATION_LABELLED_BY,
+-                                               getter_AddRefs(testLabelAccessible));
++                                               &testLabelAccessible);
+       if (testLabelAccessible == this) {
+         // We're the first child of the parent groupbox
+         NS_ADDREF(*aRelated = groupboxAccessible);
+diff --git a/accessible/src/html/nsHTMLImageAccessible.cpp b/accessible/src/html/nsHTMLImageAccessible.cpp
+--- a/accessible/src/html/nsHTMLImageAccessible.cpp
++++ b/accessible/src/html/nsHTMLImageAccessible.cpp
+@@ -64,8 +64,8 @@ nsHTMLImageAccessible::nsHTMLImageAccess
+ nsHTMLImageAccessible::nsHTMLImageAccessible(nsIDOMNode* aDOMNode, nsIWeakReference* aShell):
+ nsLinkableAccessible(aDOMNode, aShell), mAccessNodeCache(nsnull)
+ { 
+-  nsCOMPtr<nsIDOMElement> element(do_QueryInterface(aDOMNode));
+-  nsCOMPtr<nsIPresShell> shell(do_QueryReferent(mWeakShell));
++  nsIDOMElement* element(do_QueryInterface(aDOMNode));
++  nsIPresShell* shell(do_QueryReferent(mWeakShell));
+   if (!shell)
+     return;
+ 
+@@ -73,7 +73,7 @@ nsLinkableAccessible(aDOMNode, aShell), 
+   nsAutoString mapElementName;
+ 
+   if (doc && element) {
+-    nsCOMPtr<nsIHTMLDocument> htmlDoc(do_QueryInterface(doc));
++    nsIHTMLDocument* htmlDoc(do_QueryInterface(doc));
+     element->GetAttribute(NS_LITERAL_STRING("usemap"),mapElementName);
+     if (htmlDoc && !mapElementName.IsEmpty()) {
+       if (mapElementName.CharAt(0) == '#')
+@@ -105,16 +105,16 @@ nsHTMLImageAccessible::GetState(PRUint32
+   if (!mDOMNode)
+     return NS_OK;
+ 
+-  nsCOMPtr<nsIImageLoadingContent> content(do_QueryInterface(mDOMNode));
+-  nsCOMPtr<imgIRequest> imageRequest;
++  nsIImageLoadingContent* content(do_QueryInterface(mDOMNode));
++  imgIRequest* imageRequest = nsnull;
+ 
+   if (content)
+     content->GetRequest(nsIImageLoadingContent::CURRENT_REQUEST,
+-                        getter_AddRefs(imageRequest));
++                        &imageRequest);
+ 
+-  nsCOMPtr<imgIContainer> imgContainer;
++  imgIContainer* imgContainer = nsnull;
+   if (imageRequest)
+-    imageRequest->GetImage(getter_AddRefs(imgContainer));
++    imageRequest->GetImage(&imgContainer);
+ 
+   if (imgContainer) {
+     PRUint32 numFrames;
+@@ -134,7 +134,7 @@ NS_IMETHODIMP nsHTMLImageAccessible::Get
+   if (IsDefunct())
+     return NS_ERROR_FAILURE;
+   
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   NS_ASSERTION(content, "Image node always supports nsIContent");
+     
+   // No alt attribute means AT can repair if there is no accessible name
+@@ -182,7 +182,7 @@ void nsHTMLImageAccessible::CacheChildre
+   }
+ 
+   mAccChildCount = 0;
+-  nsCOMPtr<nsIDOMHTMLCollection> mapAreas = GetAreaCollection();
++  nsIDOMHTMLCollection* mapAreas = GetAreaCollection();
+   if (!mapAreas)
+     return;
+ 
+@@ -190,8 +190,8 @@ void nsHTMLImageAccessible::CacheChildre
+   mapAreas->GetLength(&numMapAreas);
+   PRInt32 childCount = 0;
+   
+-  nsCOMPtr<nsIAccessible> areaAccessible;
+-  nsCOMPtr<nsPIAccessible> privatePrevAccessible;
++  nsIAccessible* areaAccessible = nsnull;
++  nsPIAccessible* privatePrevAccessible = nsnull;
+   while (childCount < (PRInt32)numMapAreas && 
+          (areaAccessible = GetAreaAccessible(mapAreas, childCount)) != nsnull) {
+     if (privatePrevAccessible) {
+@@ -214,21 +214,21 @@ NS_IMETHODIMP nsHTMLImageAccessible::DoA
+ {
+   if (index == eAction_ShowLongDescription) {
+     //get the long description uri and open in a new window
+-    nsCOMPtr<nsIDOMHTMLImageElement> element(do_QueryInterface(mDOMNode));
++    nsIDOMHTMLImageElement* element(do_QueryInterface(mDOMNode));
+     NS_ENSURE_TRUE(element, NS_ERROR_FAILURE);
+     nsAutoString longDesc;
+     nsresult rv = element->GetLongDesc(longDesc);
+     NS_ENSURE_SUCCESS(rv, rv);
+-    nsCOMPtr<nsIDOMDocument> domDocument;
+-    rv = mDOMNode->GetOwnerDocument(getter_AddRefs(domDocument));
++    nsIDOMDocument* domDocument = nsnull;
++    rv = mDOMNode->GetOwnerDocument(&domDocument);
+     NS_ENSURE_SUCCESS(rv, rv);
+-    nsCOMPtr<nsIDocument> document(do_QueryInterface(domDocument));
+-    nsCOMPtr<nsPIDOMWindow> piWindow = document->GetWindow();
+-    nsCOMPtr<nsIDOMWindowInternal> win(do_QueryInterface(piWindow));
++    nsIDocument* document(do_QueryInterface(domDocument));
++    nsPIDOMWindow* piWindow = document->GetWindow();
++    nsIDOMWindowInternal* win(do_QueryInterface(piWindow));
+     NS_ENSURE_TRUE(win, NS_ERROR_FAILURE);
+-    nsCOMPtr<nsIDOMWindow> tmp;
++    nsIDOMWindow* tmp = nsnull;
+     return win->Open(longDesc, NS_LITERAL_STRING(""), NS_LITERAL_STRING(""),
+-                     getter_AddRefs(tmp));
++                     &tmp);
+   }
+   return nsLinkableAccessible::DoAction(index);
+ }
+@@ -255,16 +255,16 @@ nsHTMLImageAccessible::GetURI(PRInt32 aI
+   if (!mMapElement)
+     return nsLinkableAccessible::GetURI(aIndex, aURI);
+ 
+-  nsCOMPtr<nsIDOMHTMLCollection> mapAreas = GetAreaCollection();
++  nsIDOMHTMLCollection* mapAreas = GetAreaCollection();
+   if (!mapAreas)
+     return NS_OK;
+   
+-  nsCOMPtr<nsIDOMNode> domNode;
+-  mapAreas->Item(aIndex, getter_AddRefs(domNode));
++  nsIDOMNode* domNode = nsnull;
++  mapAreas->Item(aIndex, &domNode);
+   if (!domNode)
+     return NS_ERROR_INVALID_ARG;
+ 
+-  nsCOMPtr<nsILink> link(do_QueryInterface(domNode));
++  nsILink* link(do_QueryInterface(domNode));
+   if (link)
+     link->GetHrefURI(aURI);
+ 
+@@ -280,9 +280,9 @@ nsHTMLImageAccessible::GetAnchor(PRInt32
+   if (!mMapElement)
+     return nsLinkableAccessible::GetAnchor(aIndex, aAccessible);
+ 
+-  nsCOMPtr<nsIDOMHTMLCollection> mapAreas = GetAreaCollection();
++  nsIDOMHTMLCollection* mapAreas = GetAreaCollection();
+   if (mapAreas) {
+-    nsCOMPtr<nsIAccessible> accessible;
++    nsIAccessible* accessible = nsnull;
+     accessible = GetAreaAccessible(mapAreas, aIndex);
+     if (!accessible)
+       return NS_ERROR_INVALID_ARG;
+@@ -344,7 +344,7 @@ nsHTMLImageAccessible::GetAttributesInte
+   nsresult rv = nsLinkableAccessible::GetAttributesInternal(aAttributes);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+ 
+   nsAutoString src;
+   content->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::src, src);
+@@ -354,7 +354,7 @@ nsHTMLImageAccessible::GetAttributesInte
+   return NS_OK;
+ }
+ 
+-already_AddRefed<nsIDOMHTMLCollection>
++nsIDOMHTMLCollection*
+ nsHTMLImageAccessible::GetAreaCollection()
+ {
+   if (!mMapElement)
+@@ -368,28 +368,28 @@ nsHTMLImageAccessible::GetAreaCollection
+   return mapAreas;
+ }
+ 
+-already_AddRefed<nsIAccessible>
++nsIAccessible*
+ nsHTMLImageAccessible::GetAreaAccessible(nsIDOMHTMLCollection *aAreaCollection,
+                                          PRInt32 aAreaNum)
+ {
+   if (!aAreaCollection)
+     return nsnull;
+ 
+-  nsCOMPtr<nsIDOMNode> domNode;
+-  aAreaCollection->Item(aAreaNum,getter_AddRefs(domNode));
++  nsIDOMNode* domNode = nsnull;
++  aAreaCollection->Item(aAreaNum,&domNode);
+   if (!domNode)
+     return nsnull;
+   
+-  nsCOMPtr<nsIAccessNode> accessNode;
++  nsIAccessNode* accessNode = nsnull;
+   GetCacheEntry(*mAccessNodeCache, (void*)(aAreaNum),
+-                getter_AddRefs(accessNode));
++                &accessNode);
+   
+   if (!accessNode) {
+     accessNode = new nsHTMLAreaAccessible(domNode, this, mWeakShell);
+     if (!accessNode)
+       return nsnull;
+     
+-    nsCOMPtr<nsPIAccessNode> privateAccessNode(do_QueryInterface(accessNode));
++    nsPIAccessNode* privateAccessNode(do_QueryInterface(accessNode));
+     NS_ASSERTION(privateAccessNode,
+                  "Accessible doesn't implement nsPIAccessNode");
+     
+diff --git a/accessible/src/html/nsHTMLImageAccessible.h b/accessible/src/html/nsHTMLImageAccessible.h
+--- a/accessible/src/html/nsHTMLImageAccessible.h
++++ b/accessible/src/html/nsHTMLImageAccessible.h
+@@ -84,8 +84,8 @@ protected:
+   // nsAccessible
+   virtual void CacheChildren();
+ 
+-  already_AddRefed<nsIDOMHTMLCollection> GetAreaCollection();
+-  already_AddRefed<nsIAccessible>
++  nsIDOMHTMLCollection* GetAreaCollection();
++  nsIAccessible*
+     GetAreaAccessible(nsIDOMHTMLCollection* aAreaNodes, PRInt32 aAreaNum);
+ 
+   // Reference on linked map element if any.
+diff --git a/accessible/src/html/nsHTMLLinkAccessible.cpp b/accessible/src/html/nsHTMLLinkAccessible.cpp
+--- a/accessible/src/html/nsHTMLLinkAccessible.cpp
++++ b/accessible/src/html/nsHTMLLinkAccessible.cpp
+@@ -65,7 +65,7 @@ nsHTMLLinkAccessible::GetName(nsAString&
+   if (IsDefunct())
+     return NS_ERROR_FAILURE;
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   nsresult rv = AppendFlatStringFromSubtree(content, &aName);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+@@ -97,7 +97,7 @@ nsHTMLLinkAccessible::GetState(PRUint32 
+ 
+   *aState  &= ~nsIAccessibleStates::STATE_READONLY;
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   if (content && content->HasAttr(kNameSpaceID_None,
+                                   nsAccessibilityAtoms::name)) {
+     // This is how we indicate it is a named anchor
+@@ -106,7 +106,7 @@ nsHTMLLinkAccessible::GetState(PRUint32 
+     *aState |= nsIAccessibleStates::STATE_SELECTABLE;
+   }
+ 
+-  nsCOMPtr<nsILink> link = do_QueryInterface(mDOMNode);
++  nsILink* link = do_QueryInterface(mDOMNode);
+   NS_ENSURE_STATE(link);
+ 
+   nsLinkState linkState;
+@@ -140,7 +140,7 @@ nsHTMLLinkAccessible::GetValue(nsAString
+   if (!aValue.IsEmpty())
+     return NS_OK;
+   
+-  nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
++  nsIPresShell* presShell(do_QueryReferent(mWeakShell));
+   if (mDOMNode && presShell)
+     return presShell->GetLinkLocation(mDOMNode, aValue);
+ 
+@@ -188,7 +188,7 @@ nsHTMLLinkAccessible::DoAction(PRUint8 a
+   if (IsDefunct())
+     return NS_ERROR_FAILURE;
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   return DoCommand(content);
+ }
+ 
+@@ -204,7 +204,7 @@ nsHTMLLinkAccessible::GetURI(PRInt32 aIn
+   if (aIndex != 0)
+     return NS_ERROR_INVALID_ARG;
+ 
+-  nsCOMPtr<nsILink> link(do_QueryInterface(mDOMNode));
++  nsILink* link(do_QueryInterface(mDOMNode));
+   NS_ENSURE_STATE(link);
+ 
+   return link->GetHrefURI(aURI);
+@@ -216,7 +216,7 @@ PRBool
+ PRBool
+ nsHTMLLinkAccessible::IsLinked()
+ {
+-  nsCOMPtr<nsILink> link(do_QueryInterface(mDOMNode));
++  nsILink* link(do_QueryInterface(mDOMNode));
+   if (!link)
+     return PR_FALSE;
+ 
+diff --git a/accessible/src/html/nsHTMLSelectAccessible.cpp b/accessible/src/html/nsHTMLSelectAccessible.cpp
+--- a/accessible/src/html/nsHTMLSelectAccessible.cpp
++++ b/accessible/src/html/nsHTMLSelectAccessible.cpp
+@@ -83,9 +83,9 @@ nsHTMLSelectableAccessible::iterator::it
+   mLength = mIndex = 0;
+   mSelCount = 0;
+ 
+-  nsCOMPtr<nsIDOMHTMLSelectElement> htmlSelect(do_QueryInterface(mParentSelect->mDOMNode));
++  nsIDOMHTMLSelectElement* htmlSelect(do_QueryInterface(mParentSelect->mDOMNode));
+   if (htmlSelect) {
+-    htmlSelect->GetOptions(getter_AddRefs(mOptions));
++    htmlSelect->GetOptions(&mOptions);
+     if (mOptions)
+       mOptions->GetLength(&mLength);
+   }
+@@ -94,9 +94,9 @@ PRBool nsHTMLSelectableAccessible::itera
+ PRBool nsHTMLSelectableAccessible::iterator::Advance() 
+ {
+   if (mIndex < mLength) {
+-    nsCOMPtr<nsIDOMNode> tempNode;
++    nsIDOMNode* tempNode = nsnull;
+     if (mOptions) {
+-      mOptions->Item(mIndex, getter_AddRefs(tempNode));
++      mOptions->Item(mIndex, &tempNode);
+       mOption = do_QueryInterface(tempNode);
+     }
+     mIndex++;
+@@ -121,13 +121,13 @@ void nsHTMLSelectableAccessible::iterato
+                                                                    nsPresContext *aContext)
+ {
+   PRBool isSelected = PR_FALSE;
+-  nsCOMPtr<nsIAccessible> tempAccess;
++  nsIAccessible* tempAccess = nsnull;
+ 
+   if (mOption) {
+     mOption->GetSelected(&isSelected);
+     if (isSelected) {
+-      nsCOMPtr<nsIDOMNode> optionNode(do_QueryInterface(mOption));
+-      aAccService->GetAccessibleInWeakShell(optionNode, mWeakShell, getter_AddRefs(tempAccess));
++      nsIDOMNode* optionNode(do_QueryInterface(mOption));
++      aAccService->GetAccessibleInWeakShell(optionNode, mWeakShell, &tempAccess);
+     }
+   }
+ 
+@@ -148,7 +148,7 @@ PRBool nsHTMLSelectableAccessible::itera
+     mOption->GetSelected(&isSelected);
+     if (isSelected) {
+       if (mSelCount == aIndex) {
+-        nsCOMPtr<nsIDOMNode> optionNode(do_QueryInterface(mOption));
++        nsIDOMNode* optionNode(do_QueryInterface(mOption));
+         aAccService->GetAccessibleInWeakShell(optionNode, mWeakShell, aAccessible);
+         return PR_TRUE;
+       }
+@@ -178,18 +178,18 @@ NS_IMETHODIMP nsHTMLSelectableAccessible
+ {
+   *aSelState = PR_FALSE;
+ 
+-  nsCOMPtr<nsIDOMHTMLSelectElement> htmlSelect(do_QueryInterface(mDOMNode));
++  nsIDOMHTMLSelectElement* htmlSelect(do_QueryInterface(mDOMNode));
+   if (!htmlSelect)
+     return NS_ERROR_FAILURE;
+ 
+-  nsCOMPtr<nsIDOMHTMLOptionsCollection> options;
+-  htmlSelect->GetOptions(getter_AddRefs(options));
++  nsIDOMHTMLOptionsCollection* options = nsnull;
++  htmlSelect->GetOptions(&options);
+   if (!options)
+     return NS_ERROR_FAILURE;
+ 
+-  nsCOMPtr<nsIDOMNode> tempNode;
+-  options->Item(aIndex, getter_AddRefs(tempNode));
+-  nsCOMPtr<nsIDOMHTMLOptionElement> tempOption(do_QueryInterface(tempNode));
++  nsIDOMNode* tempNode = nsnull;
++  options->Item(aIndex, &tempNode);
++  nsIDOMHTMLOptionElement* tempOption(do_QueryInterface(tempNode));
+   if (!tempOption)
+     return NS_ERROR_FAILURE;
+ 
+@@ -207,11 +207,11 @@ NS_IMETHODIMP nsHTMLSelectableAccessible
+ {
+   *_retval = nsnull;
+ 
+-  nsCOMPtr<nsIAccessibilityService> accService(do_GetService("@mozilla.org/accessibilityService;1"));
++  nsIAccessibilityService* accService(do_GetService("@mozilla.org/accessibilityService;1"));
+   if (!accService)
+     return NS_ERROR_FAILURE;
+ 
+-  nsCOMPtr<nsIMutableArray> selectedAccessibles =
++  nsIMutableArray* selectedAccessibles =
+     do_CreateInstance(NS_ARRAY_CONTRACTID);
+   NS_ENSURE_STATE(selectedAccessibles);
+   
+@@ -237,7 +237,7 @@ NS_IMETHODIMP nsHTMLSelectableAccessible
+ {
+   *_retval = nsnull;
+ 
+-  nsCOMPtr<nsIAccessibilityService> accService(do_GetService("@mozilla.org/accessibilityService;1"));
++  nsIAccessibilityService* accService(do_GetService("@mozilla.org/accessibilityService;1"));
+   if (!accService)
+     return NS_ERROR_FAILURE;
+ 
+@@ -294,7 +294,7 @@ NS_IMETHODIMP nsHTMLSelectableAccessible
+ {
+   *_retval = PR_FALSE;
+   
+-  nsCOMPtr<nsIDOMHTMLSelectElement> htmlSelect(do_QueryInterface(mDOMNode));
++  nsIDOMHTMLSelectElement* htmlSelect(do_QueryInterface(mDOMNode));
+   if (!htmlSelect)
+     return NS_ERROR_FAILURE;
+ 
+@@ -333,14 +333,14 @@ nsHTMLSelectListAccessible::GetState(PRU
+   if (!mDOMNode)
+     return NS_OK;
+ 
+-  nsCOMPtr<nsIDOMHTMLSelectElement> select (do_QueryInterface(mDOMNode));
++  nsIDOMHTMLSelectElement* select (do_QueryInterface(mDOMNode));
+   if (select) {
+     if (*aState & nsIAccessibleStates::STATE_FOCUSED) {
+       // Treat first focusable option node as actual focus, in order
+       // to avoid confusing JAWS, which needs focus on the option
+-      nsCOMPtr<nsIDOMNode> focusedOption;
++      nsIDOMNode* focusedOption = nsnull;
+       nsHTMLSelectOptionAccessible::GetFocusedOptionNode(mDOMNode, 
+-                                                         getter_AddRefs(focusedOption));
++                                                         &focusedOption);
+       if (focusedOption) { // Clear focused state since it is on option
+         *aState &= ~nsIAccessibleStates::STATE_FOCUSED;
+       }
+@@ -366,25 +366,25 @@ NS_IMETHODIMP nsHTMLSelectListAccessible
+   return NS_OK;
+ }
+ 
+-already_AddRefed<nsIAccessible>
++nsIAccessible*
+ nsHTMLSelectListAccessible::AccessibleForOption(nsIAccessibilityService *aAccService,
+                                                 nsIContent *aContent,
+                                                 nsIAccessible *aLastGoodAccessible,
+                                                 PRInt32 *aChildCount)
+ {
+-  nsCOMPtr<nsIDOMNode> domNode(do_QueryInterface(aContent));
++  nsIDOMNode* domNode(do_QueryInterface(aContent));
+   NS_ASSERTION(domNode, "DOM node is null");
+   // Accessibility service will initialize & cache any accessibles created
+-  nsCOMPtr<nsIAccessible> accessible;
+-  aAccService->GetAccessibleInWeakShell(domNode, mWeakShell, getter_AddRefs(accessible));
+-  nsCOMPtr<nsPIAccessible> privateAccessible(do_QueryInterface(accessible));
++  nsIAccessible* accessible = nsnull;
++  aAccService->GetAccessibleInWeakShell(domNode, mWeakShell, &accessible);
++  nsPIAccessible* privateAccessible(do_QueryInterface(accessible));
+   if (!privateAccessible) {
+     return nsnull;
+   }
+ 
+   ++ *aChildCount;
+   privateAccessible->SetParent(this);
+-  nsCOMPtr<nsPIAccessible> privatePrevAccessible(do_QueryInterface(aLastGoodAccessible));
++  nsPIAccessible* privatePrevAccessible(do_QueryInterface(aLastGoodAccessible));
+   if (privatePrevAccessible) {
+     privatePrevAccessible->SetNextSibling(accessible);
+   }
+@@ -396,7 +396,7 @@ nsHTMLSelectListAccessible::AccessibleFo
+   return returnAccessible;
+ }
+ 
+-already_AddRefed<nsIAccessible>
++nsIAccessible*
+ nsHTMLSelectListAccessible::CacheOptSiblings(nsIAccessibilityService *aAccService,
+                                              nsIContent *aParentContent,
+                                              nsIAccessible *aLastGoodAccessible,
+@@ -405,15 +405,15 @@ nsHTMLSelectListAccessible::CacheOptSibl
+   // Recursive helper for CacheChildren()
+ 
+   PRUint32 numChildren = aParentContent->GetChildCount();
+-  nsCOMPtr<nsIAccessible> lastGoodAccessible(aLastGoodAccessible);
+-  nsCOMPtr<nsIAccessible> newAccessible;
++  nsIAccessible* lastGoodAccessible(aLastGoodAccessible);
++  nsIAccessible* newAccessible = nsnull;
+ 
+   for (PRUint32 count = 0; count < numChildren; count ++) {
+     nsIContent *childContent = aParentContent->GetChildAt(count);
+     if (!childContent->IsNodeOfType(nsINode::eHTML)) {
+       continue;
+     }
+-    nsCOMPtr<nsIAtom> tag = childContent->Tag();
++    nsIAtom* tag = childContent->Tag();
+     if (tag == nsAccessibilityAtoms::option || tag == nsAccessibilityAtoms::optgroup) {
+       newAccessible = AccessibleForOption(aAccService,
+                                            childContent,
+@@ -432,7 +432,7 @@ nsHTMLSelectListAccessible::CacheOptSibl
+     }
+   }
+   if (lastGoodAccessible) {
+-    nsCOMPtr<nsPIAccessible> privateLastAcc =
++    nsPIAccessible* privateLastAcc =
+       do_QueryInterface(lastGoodAccessible);
+     privateLastAcc->SetNextSibling(nsnull);
+     NS_ADDREF(aLastGoodAccessible = lastGoodAccessible);
+@@ -451,8 +451,8 @@ void nsHTMLSelectListAccessible::CacheCh
+   // Cache the number of <optgroup> and <option> DOM decendents,
+   // as well as the accessibles for them. Avoid whitespace text nodes.
+ 
+-  nsCOMPtr<nsIContent> selectContent(do_QueryInterface(mDOMNode));
+-  nsCOMPtr<nsIAccessibilityService> accService(do_GetService("@mozilla.org/accessibilityService;1"));
++  nsIContent* selectContent(do_QueryInterface(mDOMNode));
++  nsIAccessibilityService* accService(do_GetService("@mozilla.org/accessibilityService;1"));
+   if (!selectContent || !accService) {
+     mAccChildCount = eChildCountUninitialized;
+     return;
+@@ -464,7 +464,7 @@ void nsHTMLSelectListAccessible::CacheCh
+ 
+   mAccChildCount = 0; // Avoid reentry
+   PRInt32 childCount = 0;
+-  nsCOMPtr<nsIAccessible> lastGoodAccessible =
++  nsIAccessible* lastGoodAccessible =
+     CacheOptSiblings(accService, selectContent, nsnull, &childCount);
+   mAccChildCount = childCount;
+ }
+@@ -475,23 +475,23 @@ nsHTMLSelectOptionAccessible::nsHTMLSele
+ nsHTMLSelectOptionAccessible::nsHTMLSelectOptionAccessible(nsIDOMNode* aDOMNode, nsIWeakReference* aShell):
+ nsHyperTextAccessibleWrap(aDOMNode, aShell)
+ {
+-  nsCOMPtr<nsIAccessibilityService> accService(do_GetService("@mozilla.org/accessibilityService;1"));
+-  nsCOMPtr<nsIDOMNode> parentNode;
+-  aDOMNode->GetParentNode(getter_AddRefs(parentNode));
+-  nsCOMPtr<nsIAccessible> parentAccessible;
++  nsIAccessibilityService* accService(do_GetService("@mozilla.org/accessibilityService;1"));
++  nsIDOMNode* parentNode = nsnull;
++  aDOMNode->GetParentNode(&parentNode);
++  nsIAccessible* parentAccessible = nsnull;
+   if (parentNode) {
+     // If the parent node is a Combobox, then the option's accessible parent
+     // is nsHTMLComboboxListAccessible, not the nsHTMLComboboxAccessible that
+     // GetParent would normally return. This is because the 
+     // nsHTMLComboboxListAccessible is inserted into the accessible hierarchy
+     // where there is no DOM node for it.
+-    accService->GetAccessibleInWeakShell(parentNode, mWeakShell, getter_AddRefs(parentAccessible));
++    accService->GetAccessibleInWeakShell(parentNode, mWeakShell, &parentAccessible);
+     if (parentAccessible) {
+       PRUint32 role;
+       parentAccessible->GetRole(&role);
+       if (role == nsIAccessibleRole::ROLE_COMBOBOX) {
+-        nsCOMPtr<nsIAccessible> comboAccessible(parentAccessible);
+-        comboAccessible->GetLastChild(getter_AddRefs(parentAccessible));
++        nsIAccessible* comboAccessible(parentAccessible);
++        comboAccessible->GetLastChild(&parentAccessible);
+       }
+     }
+   }
+@@ -517,7 +517,7 @@ NS_IMETHODIMP nsHTMLSelectOptionAccessib
+ {
+   // CASE #1 -- great majority of the cases
+   // find the label attribute - this is what the W3C says we should use
+-  nsCOMPtr<nsIDOMElement> domElement(do_QueryInterface(mDOMNode));
++  nsIDOMElement* domElement(do_QueryInterface(mDOMNode));
+   if (!domElement)
+     return NS_ERROR_FAILURE;
+ 
+@@ -528,11 +528,11 @@ NS_IMETHODIMP nsHTMLSelectOptionAccessib
+   
+   // CASE #2 -- no label parameter, get the first child, 
+   // use it if it is a text node
+-  nsCOMPtr<nsIDOMNode> child;
+-  mDOMNode->GetFirstChild(getter_AddRefs(child));
++  nsIDOMNode* child = nsnull;
++  mDOMNode->GetFirstChild(&child);
+ 
+   if (child) {
+-    nsCOMPtr<nsIContent> text = do_QueryInterface(child);
++    nsIContent* text = do_QueryInterface(child);
+     if (text && text->IsNodeOfType(nsINode::eTEXT)) {
+       nsAutoString txtValue;
+       rv = AppendFlatStringFromContentNode(text, &txtValue);
+@@ -560,9 +560,9 @@ nsHTMLSelectOptionAccessible::GetAttribu
+   nsresult rv = nsHyperTextAccessibleWrap::GetAttributesInternal(aAttributes);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+-  nsCOMPtr<nsIDOMNode> parentNode;
+-  mDOMNode->GetParentNode(getter_AddRefs(parentNode));
+-  nsCOMPtr<nsIDOMElement> parentElement(do_QueryInterface(parentNode));
++  nsIDOMNode* parentNode = nsnull;
++  mDOMNode->GetParentNode(&parentNode);
++  nsIDOMElement* parentElement(do_QueryInterface(parentNode));
+   NS_ENSURE_TRUE(parentElement, NS_ERROR_FAILURE);
+   nsAutoString parentTagName;
+   parentNode->GetLocalName(parentTagName);
+@@ -574,14 +574,14 @@ nsHTMLSelectOptionAccessible::GetAttribu
+ 
+   nsAutoString tagName;
+   mDOMNode->GetLocalName(tagName);  // Will be looking for similar DOM siblings
+-  nsCOMPtr<nsIDOMNodeList> siblings;
+-  parentElement->GetElementsByTagName(tagName, getter_AddRefs(siblings));
++  nsIDOMNodeList* siblings = nsnull;
++  parentElement->GetElementsByTagName(tagName, &siblings);
+   PRInt32 posInSet = 0;
+   PRUint32 setSize = 0;
+   if (siblings) {
+     siblings->GetLength(&setSize);
+-    nsCOMPtr<nsIDOMNode> itemNode;
+-    while (NS_SUCCEEDED(siblings->Item(posInSet ++, getter_AddRefs(itemNode))) &&
++    nsIDOMNode* itemNode = nsnull;
++    while (NS_SUCCEEDED(siblings->Item(posInSet ++, &itemNode)) &&
+            itemNode != mDOMNode) {
+       // Keep looping, to increment posInSet
+     }
+@@ -595,9 +595,9 @@ nsIFrame* nsHTMLSelectOptionAccessible::
+ nsIFrame* nsHTMLSelectOptionAccessible::GetBoundsFrame()
+ {
+   PRUint32 state;
+-  nsCOMPtr<nsIContent> content = GetSelectState(&state);
++  nsIContent* content = GetSelectState(&state);
+   if (state & nsIAccessibleStates::STATE_COLLAPSED) {
+-    nsCOMPtr<nsIPresShell> presShell(GetPresShell());
++    nsIPresShell* presShell(GetPresShell());
+     if (!presShell) {
+       return nsnull;
+     }
+@@ -626,13 +626,13 @@ nsHTMLSelectOptionAccessible::GetState(P
+     return NS_OK;
+ 
+   PRUint32 selectState, selectExtState;
+-  nsCOMPtr<nsIContent> selectContent = GetSelectState(&selectState,
++  nsIContent* selectContent = GetSelectState(&selectState,
+                                                       &selectExtState);
+   if (selectState & nsIAccessibleStates::STATE_INVISIBLE) {
+     return NS_OK;
+   }
+ 
+-  nsCOMPtr<nsIDOMNode> selectNode = do_QueryInterface(selectContent); 
++  nsIDOMNode* selectNode = do_QueryInterface(selectContent); 
+   NS_ENSURE_TRUE(selectNode, NS_ERROR_FAILURE);
+ 
+   // Is disabled?
+@@ -646,8 +646,8 @@ nsHTMLSelectOptionAccessible::GetState(P
+     // GetFocusedOptionNode() ensures that an option node is 
+     // returned in this case, as long as some focusable option exists
+     // in the listbox
+-    nsCOMPtr<nsIDOMNode> focusedOptionNode;
+-    GetFocusedOptionNode(selectNode, getter_AddRefs(focusedOptionNode));
++    nsIDOMNode* focusedOptionNode = nsnull;
++    GetFocusedOptionNode(selectNode, &focusedOptionNode);
+     if (focusedOptionNode == mDOMNode) {
+       *aState |= nsIAccessibleStates::STATE_FOCUSED;
+     }
+@@ -655,7 +655,7 @@ nsHTMLSelectOptionAccessible::GetState(P
+ 
+   // Are we selected?
+   PRBool isSelected = PR_FALSE;
+-  nsCOMPtr<nsIDOMHTMLOptionElement> option (do_QueryInterface(mDOMNode));
++  nsIDOMHTMLOptionElement* option (do_QueryInterface(mDOMNode));
+   if (option) {
+     option->GetSelected(&isSelected);
+     if ( isSelected ) 
+@@ -685,7 +685,7 @@ nsHTMLSelectOptionAccessible::GetState(P
+     // visibility implementation unless they get reimplemented in layout
+     *aState &= ~nsIAccessibleStates::STATE_OFFSCREEN;
+     // <select> is not collapsed: compare bounds to calculate STATE_OFFSCREEN
+-    nsCOMPtr<nsIAccessible> listAccessible = GetParent();
++    nsIAccessible* listAccessible = GetParent();
+     if (listAccessible) {
+       PRInt32 optionX, optionY, optionWidth, optionHeight;
+       PRInt32 listX, listY, listWidth, listHeight;
+@@ -719,17 +719,17 @@ NS_IMETHODIMP nsHTMLSelectOptionAccessib
+ NS_IMETHODIMP nsHTMLSelectOptionAccessible::DoAction(PRUint8 index)
+ {
+   if (index == eAction_Select) {   // default action
+-    nsCOMPtr<nsIDOMHTMLOptionElement> newHTMLOption(do_QueryInterface(mDOMNode));
++    nsIDOMHTMLOptionElement* newHTMLOption(do_QueryInterface(mDOMNode));
+     if (!newHTMLOption) 
+       return NS_ERROR_FAILURE;
+     // Clear old selection
+-    nsCOMPtr<nsIDOMNode> oldHTMLOptionNode, selectNode;
+-    nsCOMPtr<nsIAccessible> parent(GetParent());
+-    nsCOMPtr<nsIAccessNode> accessNode(do_QueryInterface(parent));
++    nsIDOMNode* oldHTMLOptionNode = nsnull, *selectNode = nsnull;
++    nsIAccessible* parent(GetParent());
++    nsIAccessNode* accessNode(do_QueryInterface(parent));
+     NS_ASSERTION(accessNode, "Unable to QI to nsIAccessNode");
+-    accessNode->GetDOMNode(getter_AddRefs(selectNode));
+-    GetFocusedOptionNode(selectNode, getter_AddRefs(oldHTMLOptionNode));
+-    nsCOMPtr<nsIDOMHTMLOptionElement> oldHTMLOption(do_QueryInterface(oldHTMLOptionNode));
++    accessNode->GetDOMNode(&selectNode);
++    GetFocusedOptionNode(selectNode, &oldHTMLOptionNode);
++    nsIDOMHTMLOptionElement* oldHTMLOption(do_QueryInterface(oldHTMLOptionNode));
+     if (oldHTMLOption)
+       oldHTMLOption->SetSelected(PR_FALSE);
+     // Set new selection
+@@ -737,19 +737,19 @@ NS_IMETHODIMP nsHTMLSelectOptionAccessib
+ 
+     // If combo box, and open, close it
+     // First, get the <select> widgets list control frame
+-    nsCOMPtr<nsIDOMNode> testSelectNode;
+-    nsCOMPtr<nsIDOMNode> thisNode(do_QueryInterface(mDOMNode));
++    nsIDOMNode* testSelectNode = nsnull;
++    nsIDOMNode* thisNode(do_QueryInterface(mDOMNode));
+     do {
+-      thisNode->GetParentNode(getter_AddRefs(testSelectNode));
+-      nsCOMPtr<nsIDOMHTMLSelectElement> selectControl(do_QueryInterface(testSelectNode));
++      thisNode->GetParentNode(&testSelectNode);
++      nsIDOMHTMLSelectElement* selectControl(do_QueryInterface(testSelectNode));
+       if (selectControl)
+         break;
+       thisNode = testSelectNode;
+     } while (testSelectNode);
+ 
+-    nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
+-    nsCOMPtr<nsIContent> selectContent(do_QueryInterface(testSelectNode));
+-    nsCOMPtr<nsIDOMHTMLOptionElement> option(do_QueryInterface(mDOMNode));
++    nsIPresShell* presShell(do_QueryReferent(mWeakShell));
++    nsIContent* selectContent(do_QueryInterface(testSelectNode));
++    nsIDOMHTMLOptionElement* option(do_QueryInterface(mDOMNode));
+ 
+     if (!testSelectNode || !selectContent || !presShell || !option) 
+       return NS_ERROR_FAILURE;
+@@ -787,8 +787,8 @@ nsresult nsHTMLSelectOptionAccessible::G
+   *aFocusedOptionNode = nsnull;
+   NS_ASSERTION(aListNode, "Called GetFocusedOptionNode without a valid list node");
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(aListNode));
+-  nsCOMPtr<nsIDocument> document = content->GetDocument();
++  nsIContent* content(do_QueryInterface(aListNode));
++  nsIDocument* document = content->GetDocument();
+   nsIPresShell *shell = nsnull;
+   if (document)
+     shell = document->GetPrimaryShell();
+@@ -802,11 +802,11 @@ nsresult nsHTMLSelectOptionAccessible::G
+   PRInt32 focusedOptionIndex = 0;
+ 
+   // Get options
+-  nsCOMPtr<nsIDOMHTMLSelectElement> selectElement(do_QueryInterface(aListNode));
++  nsIDOMHTMLSelectElement* selectElement(do_QueryInterface(aListNode));
+   NS_ASSERTION(selectElement, "No select element where it should be");
+ 
+-  nsCOMPtr<nsIDOMHTMLOptionsCollection> options;
+-  nsresult rv = selectElement->GetOptions(getter_AddRefs(options));
++  nsIDOMHTMLOptionsCollection* options = nsnull;
++  nsresult rv = selectElement->GetOptions(&options);
+   
+   if (NS_SUCCEEDED(rv)) {
+     nsIListControlFrame *listFrame = nsnull;
+@@ -818,11 +818,11 @@ nsresult nsHTMLSelectOptionAccessible::G
+       // the first selected item.
+       focusedOptionIndex = listFrame->GetSelectedIndex();
+       if (focusedOptionIndex == -1) {
+-        nsCOMPtr<nsIDOMNode> nextOption;
++        nsIDOMNode* nextOption = nsnull;
+         while (PR_TRUE) {
+           ++ focusedOptionIndex;
+-          options->Item(focusedOptionIndex, getter_AddRefs(nextOption));
+-          nsCOMPtr<nsIDOMHTMLOptionElement> optionElement = do_QueryInterface(nextOption);
++          options->Item(focusedOptionIndex, &nextOption);
++          nsIDOMHTMLOptionElement* optionElement = do_QueryInterface(nextOption);
+           if (!optionElement) {
+             break;
+           }
+@@ -853,19 +853,19 @@ void nsHTMLSelectOptionAccessible::Selec
+     return;
+   }
+ 
+-  nsCOMPtr<nsIDOMNode> optionNode(do_QueryInterface(aPossibleOption));
++  nsIDOMNode* optionNode(do_QueryInterface(aPossibleOption));
+   NS_ASSERTION(optionNode, "No option node for nsIContent with option tag!");
+ 
+-  nsCOMPtr<nsIAccessible> multiSelect = GetMultiSelectFor(optionNode);
+-  nsCOMPtr<nsPIAccessible> privateMultiSelect = do_QueryInterface(multiSelect);
++  nsIAccessible* multiSelect = GetMultiSelectFor(optionNode);
++  nsPIAccessible* privateMultiSelect = do_QueryInterface(multiSelect);
+   if (!privateMultiSelect) {
+     return;
+   }
+ 
+-  nsCOMPtr<nsIAccessibilityService> accService = 
++  nsIAccessibilityService* accService = 
+     do_GetService("@mozilla.org/accessibilityService;1");
+-  nsCOMPtr<nsIAccessible> optionAccessible;
+-  accService->GetAccessibleFor(optionNode, getter_AddRefs(optionAccessible));
++  nsIAccessible* optionAccessible = nsnull;
++  accService->GetAccessibleFor(optionNode, &optionAccessible);
+   if (!optionAccessible) {
+     return;
+   }
+@@ -888,17 +888,17 @@ nsIContent* nsHTMLSelectOptionAccessible
+ nsIContent* nsHTMLSelectOptionAccessible::GetSelectState(PRUint32* aState,
+                                                          PRUint32* aExtraState)
+ {
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   while (content && content->Tag() != nsAccessibilityAtoms::select) {
+     content = content->GetParent();
+   }
+ 
+-  nsCOMPtr<nsIDOMNode> selectNode(do_QueryInterface(content));
++  nsIDOMNode* selectNode(do_QueryInterface(content));
+   if (selectNode) {
+-    nsCOMPtr<nsIAccessibilityService> accService = GetAccService();
++    nsIAccessibilityService* accService = GetAccService();
+     if (accService) {
+-      nsCOMPtr<nsIAccessible> selAcc;
+-      accService->GetAccessibleFor(selectNode, getter_AddRefs(selAcc));
++      nsIAccessible* selAcc = nsnull;
++      accService->GetAccessibleFor(selectNode, &selAcc);
+       if (selAcc) {
+         selAcc->GetFinalState(aState, aExtraState);
+         return content;
+@@ -1114,18 +1114,18 @@ NS_IMETHODIMP nsHTMLComboboxAccessible::
+     return NS_OK;
+   }
+   // Use description of currently focused option
+-  nsCOMPtr<nsIAccessible> optionAccessible = GetFocusedOptionAccessible();
++  nsIAccessible* optionAccessible = GetFocusedOptionAccessible();
+   return optionAccessible ? optionAccessible->GetDescription(aDescription) : NS_OK;
+ }
+ 
+-already_AddRefed<nsIAccessible>
++nsIAccessible*
+ nsHTMLComboboxAccessible::GetFocusedOptionAccessible()
+ {
+   if (!mWeakShell) {
+     return nsnull;  // Shut down
+   }
+-  nsCOMPtr<nsIDOMNode> focusedOptionNode;
+-  nsHTMLSelectOptionAccessible::GetFocusedOptionNode(mDOMNode, getter_AddRefs(focusedOptionNode));
++  nsIDOMNode* focusedOptionNode = nsnull;
++  nsHTMLSelectOptionAccessible::GetFocusedOptionNode(mDOMNode, &focusedOptionNode);
+   nsIAccessibilityService *accService = GetAccService();
+   if (!focusedOptionNode || !accService) {
+     return nsnull;
+@@ -1145,7 +1145,7 @@ NS_IMETHODIMP nsHTMLComboboxAccessible::
+ NS_IMETHODIMP nsHTMLComboboxAccessible::GetValue(nsAString& aValue)
+ {
+   // Use label of currently focused option
+-  nsCOMPtr<nsIAccessible> optionAccessible = GetFocusedOptionAccessible();
++  nsIAccessible* optionAccessible = GetFocusedOptionAccessible();
+   NS_ENSURE_TRUE(optionAccessible, NS_ERROR_FAILURE);
+   return optionAccessible->GetName(aValue);
+ }
+@@ -1498,8 +1498,8 @@ void nsHTMLComboboxListAccessible::GetBo
+ {
+   *aBoundingFrame = nsnull;
+ 
+-  nsCOMPtr<nsIAccessible> comboAccessible;
+-  GetParent(getter_AddRefs(comboAccessible));
++  nsIAccessible* comboAccessible = nsnull;
++  GetParent(&comboAccessible);
+   if (!comboAccessible) {
+     return;
+   }
+@@ -1508,16 +1508,16 @@ void nsHTMLComboboxListAccessible::GetBo
+     return;
+   }
+    // get our first option
+-  nsCOMPtr<nsIDOMNode> child;
+-  mDOMNode->GetFirstChild(getter_AddRefs(child));
++  nsIDOMNode* child = nsnull;
++  mDOMNode->GetFirstChild(&child);
+ 
+   // now get its frame
+-  nsCOMPtr<nsIPresShell> shell = GetPresShell();
++  nsIPresShell* shell = GetPresShell();
+   if (!shell) {
+     return;
+   }
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(child));
++  nsIContent* content(do_QueryInterface(child));
+   if (!content) {
+     return;
+   }
+diff --git a/accessible/src/html/nsHTMLSelectAccessible.h b/accessible/src/html/nsHTMLSelectAccessible.h
+--- a/accessible/src/html/nsHTMLSelectAccessible.h
++++ b/accessible/src/html/nsHTMLSelectAccessible.h
+@@ -96,9 +96,9 @@ protected:
+     PRUint32 mLength;
+     PRUint32 mIndex;
+     PRInt32 mSelCount;
+-    nsCOMPtr<nsIDOMHTMLOptionsCollection> mOptions;
+-    nsCOMPtr<nsIDOMHTMLOptionElement> mOption;
+-    nsCOMPtr<nsIWeakReference> mWeakShell;
++    nsIDOMHTMLOptionsCollection* mOptions;
++    nsIDOMHTMLOptionElement* mOption;
++    nsIWeakReference* mWeakShell;
+     nsHTMLSelectableAccessible *mParentSelect;
+ 
+   public:
+@@ -133,12 +133,12 @@ public:
+   void CacheChildren();
+ 
+ protected:
+-  already_AddRefed<nsIAccessible>
++  nsIAccessible*
+     AccessibleForOption(nsIAccessibilityService *aAccService,
+                         nsIContent *aContent,
+                         nsIAccessible *aLastGoodAccessible,
+                         PRInt32 *aChildCount);
+-  already_AddRefed<nsIAccessible>
++  nsIAccessible*
+     CacheOptSiblings(nsIAccessibilityService *aAccService,
+                      nsIContent *aParentContent,
+                      nsIAccessible *aLastGoodAccessible,
+@@ -229,7 +229,7 @@ public:
+   NS_IMETHOD Shutdown();
+ 
+ protected:
+-  already_AddRefed<nsIAccessible> GetFocusedOptionAccessible();
++  nsIAccessible* GetFocusedOptionAccessible();
+ 
+ private:
+   nsRefPtr<nsHTMLComboboxListAccessible> mListAccessible;
+diff --git a/accessible/src/html/nsHTMLTableAccessible.cpp b/accessible/src/html/nsHTMLTableAccessible.cpp
+--- a/accessible/src/html/nsHTMLTableAccessible.cpp
++++ b/accessible/src/html/nsHTMLTableAccessible.cpp
+@@ -86,9 +86,9 @@ nsHTMLTableCellAccessible::GetAttributes
+   nsresult rv = nsHyperTextAccessibleWrap::GetAttributesInternal(aAttributes);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+ 
+-  nsCOMPtr<nsIPresShell> shell = GetPresShell();
++  nsIPresShell* shell = GetPresShell();
+   NS_ENSURE_STATE(shell);
+   
+   nsIFrame *frame = shell->GetPrimaryFrameFor(content);
+@@ -103,10 +103,10 @@ nsHTMLTableCellAccessible::GetAttributes
+   rv = cellLayout->GetCellIndexes(rowIdx, cellIdx);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+-  nsCOMPtr<nsIAccessible> childAcc(this);
++  nsIAccessible* childAcc(this);
+ 
+-  nsCOMPtr<nsIAccessible> parentAcc;
+-  rv = childAcc->GetParent(getter_AddRefs(parentAcc));
++  nsIAccessible* parentAcc = nsnull;
++  rv = childAcc->GetParent(&parentAcc);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+   while (parentAcc) {
+@@ -114,7 +114,7 @@ nsHTMLTableCellAccessible::GetAttributes
+       // Table accessible must implement nsIAccessibleTable interface but if
+       // it isn't happen (for example because of ARIA usage) we shouldn't fail
+       // on getting other attributes.
+-      nsCOMPtr<nsIAccessibleTable> tableAcc(do_QueryInterface(parentAcc));
++      nsIAccessibleTable* tableAcc(do_QueryInterface(parentAcc));
+       if (!tableAcc)
+         return NS_OK;
+ 
+@@ -129,8 +129,8 @@ nsHTMLTableCellAccessible::GetAttributes
+       return NS_OK;
+     }
+ 
+-    parentAcc.swap(childAcc);
+-    rv = childAcc->GetParent(getter_AddRefs(parentAcc));
++    swap(parentAcc, childAcc);
++    rv = childAcc->GetParent(&parentAcc);
+     NS_ENSURE_SUCCESS(rv, rv);
+   }
+ 
+@@ -157,24 +157,24 @@ void nsHTMLTableAccessible::CacheChildre
+   
+   if (mAccChildCount == eChildCountUninitialized) {
+     nsAccessible::CacheChildren();
+-    nsCOMPtr<nsIAccessible> captionAccessible;
++    nsIAccessible* captionAccessible = nsnull;
+     while (NextChild(captionAccessible)) {
+       if (Role(captionAccessible) == nsIAccessibleRole::ROLE_CAPTION) {
+-        nsCOMPtr<nsIAccessible> captionParentAccessible;
+-        captionAccessible->GetParent(getter_AddRefs(captionParentAccessible));
++        nsIAccessible* captionParentAccessible = nsnull;
++        captionAccessible->GetParent(&captionParentAccessible);
+         if (captionParentAccessible != this) {
+           NS_WARNING("Should not happen: parser ensures caption is the table's child, not the tbody's");
+           return;
+         }
+-        nsCOMPtr<nsIAccessible> beforeCaptionAccessible;
+-        captionAccessible->GetPreviousSibling(getter_AddRefs(beforeCaptionAccessible));
++        nsIAccessible* beforeCaptionAccessible = nsnull;
++        captionAccessible->GetPreviousSibling(&beforeCaptionAccessible);
+         if (beforeCaptionAccessible) {
+           // Move caption accessible so that it's the first child
+-          nsCOMPtr<nsIAccessible> afterCaptionAccessible;
+-          captionAccessible->GetNextSibling(getter_AddRefs(afterCaptionAccessible));
+-          nsCOMPtr<nsPIAccessible> privateAcc = do_QueryInterface(beforeCaptionAccessible);
++          nsIAccessible* afterCaptionAccessible = nsnull;
++          captionAccessible->GetNextSibling(&afterCaptionAccessible);
++          nsPIAccessible* privateAcc = do_QueryInterface(beforeCaptionAccessible);
+           privateAcc->SetNextSibling(afterCaptionAccessible);
+-          GetFirstChild(getter_AddRefs(afterCaptionAccessible));
++          GetFirstChild(&afterCaptionAccessible);
+           SetFirstChild(captionAccessible);
+           privateAcc = do_QueryInterface(captionAccessible);
+           privateAcc->SetNextSibling(afterCaptionAccessible);        
+@@ -210,7 +210,7 @@ NS_IMETHODIMP nsHTMLTableAccessible::Get
+ 
+   nsAccessible::GetName(aName);
+   if (aName.IsEmpty()) {
+-    nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++    nsIContent* content(do_QueryInterface(mDOMNode));
+     if (content) { 
+       content->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::summary, aName);
+     }
+@@ -268,8 +268,8 @@ NS_IMETHODIMP
+ NS_IMETHODIMP
+ nsHTMLTableAccessible::GetCaption(nsIAccessible **aCaption)
+ {
+-  nsCOMPtr<nsIAccessible> firstChild;
+-  GetFirstChild(getter_AddRefs(firstChild));
++  nsIAccessible* firstChild = nsnull;
++  GetFirstChild(&firstChild);
+   if (firstChild && Role(firstChild) == nsIAccessibleRole::ROLE_CAPTION) {
+     NS_ADDREF(*aCaption = firstChild);
+   }
+@@ -279,7 +279,7 @@ NS_IMETHODIMP
+ NS_IMETHODIMP
+ nsHTMLTableAccessible::GetSummary(nsAString &aSummary)
+ {
+-  nsCOMPtr<nsIDOMHTMLTableElement> table(do_QueryInterface(mDOMNode));
++  nsIDOMHTMLTableElement* table(do_QueryInterface(mDOMNode));
+   NS_ENSURE_TRUE(table, NS_ERROR_FAILURE);
+ 
+   return table->GetSummary(aSummary);
+@@ -301,36 +301,36 @@ nsHTMLTableAccessible::GetColumnHeader(n
+ {
+   nsresult rv = NS_OK;
+ 
+-  nsCOMPtr<nsIDOMHTMLTableElement> table(do_QueryInterface(mDOMNode));
++  nsIDOMHTMLTableElement* table(do_QueryInterface(mDOMNode));
+   NS_ENSURE_TRUE(table, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIDOMHTMLTableSectionElement> section;
+-  rv = table->GetTHead(getter_AddRefs(section));
++  nsIDOMHTMLTableSectionElement* section = nsnull;
++  rv = table->GetTHead(&section);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+-  nsCOMPtr<nsIAccessibilityService>
++  nsIAccessibilityService*
+     accService(do_GetService("@mozilla.org/accessibilityService;1"));
+   NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIAccessible> accHead;
+-  nsCOMPtr<nsIDOMNode> sectionNode(do_QueryInterface(section));
++  nsIAccessible* accHead = nsnull;
++  nsIDOMNode* sectionNode(do_QueryInterface(section));
+   if (sectionNode) {
+     rv = accService->GetCachedAccessible(sectionNode, mWeakShell,
+-                                         getter_AddRefs(accHead));
++                                         &accHead);
+     NS_ENSURE_SUCCESS(rv, rv);
+   }
+ 
+   if (!accHead) {
+      accService->CreateHTMLTableHeadAccessible(section,
+-                                               getter_AddRefs(accHead));
++                                               &accHead);
+                                                    
+-    nsCOMPtr<nsPIAccessNode> accessNode(do_QueryInterface(accHead));
++    nsPIAccessNode* accessNode(do_QueryInterface(accHead));
+     NS_ENSURE_TRUE(accHead, NS_ERROR_FAILURE);
+     rv = accessNode->Init();
+     NS_ENSURE_SUCCESS(rv, rv);
+   }
+ 
+-  nsCOMPtr<nsIAccessibleTable> accTableHead(do_QueryInterface(accHead));
++  nsIAccessibleTable* accTableHead(do_QueryInterface(accHead));
+   NS_ENSURE_TRUE(accTableHead, NS_ERROR_FAILURE);
+ 
+   *aColumnHeader = accTableHead;
+@@ -577,11 +577,11 @@ nsHTMLTableAccessible::CellRefAt(PRInt32
+ 
+   nsresult rv = NS_OK;
+ 
+-  nsCOMPtr<nsIDOMElement> cellElement;
+-  rv = GetCellAt(aRow, aColumn, *getter_AddRefs(cellElement));
++  nsIDOMElement* cellElement = nsnull;
++  rv = GetCellAt(aRow, aColumn, *&cellElement);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+-  nsCOMPtr<nsIAccessibilityService>
++  nsIAccessibilityService*
+     accService(do_GetService("@mozilla.org/accessibilityService;1"));
+   NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
+ 
+@@ -638,11 +638,11 @@ nsHTMLTableAccessible::GetColumnExtentAt
+ 
+   nsresult rv = NS_OK;
+ 
+-  nsCOMPtr<nsIDOMElement> domElement;
+-  rv = GetCellAt(aRow, aColumn, *getter_AddRefs(domElement));
++  nsIDOMElement* domElement = nsnull;
++  rv = GetCellAt(aRow, aColumn, *&domElement);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+-  nsCOMPtr<nsIDOMHTMLTableCellElement> cell(do_QueryInterface(domElement));
++  nsIDOMHTMLTableCellElement* cell(do_QueryInterface(domElement));
+   NS_ENSURE_TRUE(cell, NS_ERROR_FAILURE);
+ 
+   return cell->GetColSpan(_retval);
+@@ -656,11 +656,11 @@ nsHTMLTableAccessible::GetRowExtentAt(PR
+ 
+   nsresult rv = NS_OK;
+ 
+-  nsCOMPtr<nsIDOMElement> domElement;
+-  rv = GetCellAt(aRow, aColumn, *getter_AddRefs(domElement));
++  nsIDOMElement* domElement = nsnull;
++  rv = GetCellAt(aRow, aColumn, *&domElement);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+-  nsCOMPtr<nsIDOMHTMLTableCellElement> cell(do_QueryInterface(domElement));
++  nsIDOMHTMLTableCellElement* cell(do_QueryInterface(domElement));
+   NS_ENSURE_TRUE(cell, NS_ERROR_FAILURE);
+ 
+   return cell->GetRowSpan(_retval);
+@@ -740,11 +740,11 @@ nsHTMLTableAccessible::IsCellSelected(PR
+   nsresult rv = GetTableLayout(&tableLayout);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+-  nsCOMPtr<nsIDOMElement> domElement;
++  nsIDOMElement* domElement = nsnull;
+   PRInt32 startRowIndex = 0, startColIndex = 0,
+           rowSpan, colSpan, actualRowSpan, actualColSpan;
+ 
+-  rv = tableLayout->GetCellDataAt(aRow, aColumn, *getter_AddRefs(domElement),
++  rv = tableLayout->GetCellDataAt(aRow, aColumn, *&domElement,
+                                   startRowIndex, startColIndex,
+                                   rowSpan, colSpan,
+                                   actualRowSpan, actualColSpan, *aIsSelected);
+@@ -804,20 +804,20 @@ nsHTMLTableAccessible::SelectRowOrColumn
+ {
+   PRBool doSelectRow = (aTarget == nsISelectionPrivate::TABLESELECTION_ROW);
+ 
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   if (!content)
+     return NS_OK;
+ 
+-  nsCOMPtr<nsIDocument> document = content->GetCurrentDoc();
++  nsIDocument* document = content->GetCurrentDoc();
+   NS_ENSURE_STATE(document);
+ 
+-  nsCOMPtr<nsISelectionController> selController(
++  nsISelectionController* selController(
+     do_QueryInterface(document->GetPrimaryShell()));
+   NS_ENSURE_STATE(selController);
+ 
+-  nsCOMPtr<nsISelection> selection;
++  nsISelection* selection = nsnull;
+   selController->GetSelection(nsISelectionController::SELECTION_NORMAL,
+-                              getter_AddRefs(selection));
++                              &selection);
+   NS_ENSURE_STATE(selection);
+ 
+   PRInt32 count = 0;
+@@ -825,11 +825,11 @@ nsHTMLTableAccessible::SelectRowOrColumn
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+   for (PRInt32 index = 0; index < count; index++) {
+-    nsCOMPtr<nsIDOMElement> cellElm;
++    nsIDOMElement* cellElm = nsnull;
+     PRInt32 column = doSelectRow ? index : aIndex;
+     PRInt32 row = doSelectRow ? aIndex : index;
+ 
+-    rv = GetCellAt(row, column, *getter_AddRefs(cellElm));
++    rv = GetCellAt(row, column, *&cellElm);
+     NS_ENSURE_SUCCESS(rv, rv);
+ 
+     rv = SelectCell(selection, document, cellElm, aDoSelect);
+@@ -846,32 +846,32 @@ nsHTMLTableAccessible::SelectCell(nsISel
+                                   PRBool aDoSelect)
+ {
+   if (aDoSelect) {
+-    nsCOMPtr<nsIDOMDocumentRange> documentRange(do_QueryInterface(aDocument));
++    nsIDOMDocumentRange* documentRange(do_QueryInterface(aDocument));
+     NS_ENSURE_STATE(documentRange);
+ 
+-    nsCOMPtr<nsIDOMRange> range;
+-    documentRange->CreateRange(getter_AddRefs(range));
++    nsIDOMRange* range = nsnull;
++    documentRange->CreateRange(&range);
+ 
+-    nsCOMPtr<nsIDOMNode> cellNode(do_QueryInterface(aCellElement));
++    nsIDOMNode* cellNode(do_QueryInterface(aCellElement));
+     NS_ENSURE_STATE(cellNode);
+ 
+     range->SelectNode(cellNode);
+     return aSelection->AddRange(range);
+   }
+ 
+-  nsCOMPtr<nsIContent> cell(do_QueryInterface(aCellElement));
++  nsIContent* cell(do_QueryInterface(aCellElement));
+   NS_ENSURE_STATE(cell);
+ 
+-  nsCOMPtr<nsIContent> cellParent = cell->GetParent();
++  nsIContent* cellParent = cell->GetParent();
+   NS_ENSURE_STATE(cellParent);
+ 
+   PRInt32 offset = cellParent->IndexOf(cell);
+   NS_ENSURE_STATE(offset != -1);
+ 
+-  nsCOMPtr<nsIDOMNode> parent(do_QueryInterface(cellParent));
++  nsIDOMNode* parent(do_QueryInterface(cellParent));
+   NS_ENSURE_STATE(parent);
+ 
+-  nsCOMPtr<nsISelection2> selection2(do_QueryInterface(aSelection));
++  nsISelection2* selection2(do_QueryInterface(aSelection));
+   NS_ENSURE_STATE(selection2);
+ 
+   nsCOMArray<nsIDOMRange> ranges;
+@@ -891,17 +891,17 @@ nsHTMLTableAccessible::GetTableNode(nsID
+ {
+   nsresult rv = NS_OK;
+ 
+-  nsCOMPtr<nsIDOMHTMLTableElement> table(do_QueryInterface(mDOMNode));
++  nsIDOMHTMLTableElement* table(do_QueryInterface(mDOMNode));
+   if (table) {
+     *_retval = table;
+     NS_IF_ADDREF(*_retval);
+     return rv;
+   }
+ 
+-  nsCOMPtr<nsIDOMHTMLTableSectionElement> section(do_QueryInterface(mDOMNode));
++  nsIDOMHTMLTableSectionElement* section(do_QueryInterface(mDOMNode));
+   if (section) {
+-    nsCOMPtr<nsIDOMNode> parent;
+-    rv = section->GetParentNode(getter_AddRefs(parent));
++    nsIDOMNode* parent = nsnull;
++    rv = section->GetParentNode(&parent);
+     NS_ENSURE_SUCCESS(rv, rv);
+ 
+     *_retval = parent;
+@@ -917,14 +917,14 @@ nsHTMLTableAccessible::GetTableLayout(ns
+ {
+   *aTableLayout = nsnull;
+ 
+-  nsCOMPtr<nsIDOMNode> tableNode;
+-  GetTableNode(getter_AddRefs(tableNode));
+-  nsCOMPtr<nsIContent> tableContent(do_QueryInterface(tableNode));
++  nsIDOMNode* tableNode = nsnull;
++  GetTableNode(&tableNode);
++  nsIContent* tableContent(do_QueryInterface(tableNode));
+   if (!tableContent) {
+     return NS_ERROR_FAILURE; // Table shut down
+   }
+ 
+-  nsCOMPtr<nsIPresShell> shell = GetPresShell();
++  nsIPresShell* shell = GetPresShell();
+   NS_ENSURE_TRUE(shell, NS_ERROR_FAILURE);
+ 
+   nsIFrame *frame = shell->GetPrimaryFrameFor(tableContent);
+@@ -963,13 +963,13 @@ NS_IMETHODIMP nsHTMLTableAccessible::Get
+     return NS_OK;
+   }
+ 
+-  nsCOMPtr<nsIAccessible> captionAccessible;
+-  GetCaption(getter_AddRefs(captionAccessible));
+-  nsCOMPtr<nsIAccessNode> captionAccessNode = do_QueryInterface(captionAccessible);
++  nsIAccessible* captionAccessible = nsnull;
++  GetCaption(&captionAccessible);
++  nsIAccessNode* captionAccessNode = do_QueryInterface(captionAccessible);
+   if (captionAccessNode) {
+-    nsCOMPtr<nsIDOMNode> captionNode;
+-    captionAccessNode->GetDOMNode(getter_AddRefs(captionNode));
+-    nsCOMPtr<nsIContent> captionContent = do_QueryInterface(captionNode);
++    nsIDOMNode* captionNode = nsnull;
++    captionAccessNode->GetDOMNode(&captionNode);
++    nsIContent* captionContent = do_QueryInterface(captionNode);
+     if (captionContent) {
+       AppendFlatStringFromSubtree(captionContent, &aDescription);
+     }
+@@ -990,21 +990,21 @@ NS_IMETHODIMP nsHTMLTableAccessible::Get
+ 
+ PRBool nsHTMLTableAccessible::HasDescendant(char *aTagName, PRBool aAllowEmpty)
+ {
+-  nsCOMPtr<nsIDOMElement> tableElt(do_QueryInterface(mDOMNode));
++  nsIDOMElement* tableElt(do_QueryInterface(mDOMNode));
+   NS_ENSURE_TRUE(tableElt, PR_FALSE);
+ 
+-  nsCOMPtr<nsIDOMNodeList> nodeList;
++  nsIDOMNodeList* nodeList = nsnull;
+   nsAutoString tagName;
+   tagName.AssignWithConversion(aTagName);
+-  tableElt->GetElementsByTagName(tagName, getter_AddRefs(nodeList));
++  tableElt->GetElementsByTagName(tagName, &nodeList);
+   NS_ENSURE_TRUE(nodeList, PR_FALSE);
+   PRUint32 length;
+   nodeList->GetLength(&length);
+   
+   if (length == 1) {
+     // Make sure it's not the table itself
+-    nsCOMPtr<nsIDOMNode> foundItem;
+-    nodeList->Item(0, getter_AddRefs(foundItem));
++    nsIDOMNode* foundItem = nsnull;
++    nodeList->Item(0, &foundItem);
+     if (foundItem == mDOMNode) {
+       return PR_FALSE;
+     }
+@@ -1012,7 +1012,7 @@ PRBool nsHTMLTableAccessible::HasDescend
+       // Make sure that the item we found has contents
+       // and either has multiple children or the
+       // found item is not a whitespace-only text node
+-      nsCOMPtr<nsIContent> foundItemContent = do_QueryInterface(foundItem);
++      nsIContent* foundItemContent = do_QueryInterface(foundItem);
+       if (!foundItemContent) {
+         return PR_FALSE;
+       }
+@@ -1051,12 +1051,12 @@ NS_IMETHODIMP nsHTMLTableAccessible::IsP
+ 
+   *aIsProbablyForLayout = PR_FALSE;
+   
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+   if (!content) {
+     return NS_ERROR_FAILURE; // Table shut down
+   }
+ 
+-  nsCOMPtr<nsIAccessible> docAccessible = do_QueryInterface(nsCOMPtr<nsIAccessibleDocument>(GetDocAccessible()));
++  nsIAccessible* docAccessible = do_QueryInterface((nsIAccessibleDocument*)(GetDocAccessible()));
+   if (docAccessible) {
+     PRUint32 state, extState;
+     docAccessible->GetFinalState(&state, &extState);
+@@ -1105,13 +1105,13 @@ NS_IMETHODIMP nsHTMLTableAccessible::IsP
+   // Now we know there are 2-4 columns and 2 or more rows
+   // Check to see if there are visible borders on the cells
+   // XXX currently, we just check the first cell -- do we really need to do more?
+-  nsCOMPtr<nsIDOMElement> cellElement;
+-  nsresult rv = GetCellAt(0, 0, *getter_AddRefs(cellElement));
++  nsIDOMElement* cellElement = nsnull;
++  nsresult rv = GetCellAt(0, 0, *&cellElement);
+   NS_ENSURE_SUCCESS(rv, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIContent> cellContent(do_QueryInterface(cellElement));
++  nsIContent* cellContent(do_QueryInterface(cellElement));
+   NS_ENSURE_TRUE(cellContent, NS_ERROR_FAILURE);
+-  nsCOMPtr<nsIPresShell> shell(GetPresShell());
++  nsIPresShell* shell(GetPresShell());
+   nsIFrame *cellFrame = shell->GetPrimaryFrameFor(cellContent);
+   if (!cellFrame) {
+     return NS_OK;
+@@ -1128,19 +1128,19 @@ NS_IMETHODIMP nsHTMLTableAccessible::IsP
+ 
+   // Check for styled background color across the row
+   // Alternating background color is a common way 
+-  nsCOMPtr<nsIDOMNodeList> nodeList;
+-  nsCOMPtr<nsIDOMElement> tableElt(do_QueryInterface(mDOMNode));    
+-  tableElt->GetElementsByTagName(NS_LITERAL_STRING("tr"), getter_AddRefs(nodeList));
++  nsIDOMNodeList* nodeList = nsnull;
++  nsIDOMElement* tableElt(do_QueryInterface(mDOMNode));    
++  tableElt->GetElementsByTagName(NS_LITERAL_STRING("tr"), &nodeList);
+   NS_ENSURE_TRUE(nodeList, NS_ERROR_FAILURE);
+   PRUint32 length;
+   nodeList->GetLength(&length);
+   nsAutoString color, lastRowColor;
+   for (PRInt32 rowCount = 0; rowCount < rows; rowCount ++) {
+-    nsCOMPtr<nsIDOMNode> rowNode;
+-    nodeList->Item(rowCount, getter_AddRefs(rowNode));
+-    nsCOMPtr<nsIDOMElement> rowElement = do_QueryInterface(rowNode);
+-    nsCOMPtr<nsIDOMCSSStyleDeclaration> styleDecl;
+-    GetComputedStyleDeclaration(EmptyString(), rowElement, getter_AddRefs(styleDecl));
++    nsIDOMNode* rowNode = nsnull;
++    nodeList->Item(rowCount, &rowNode);
++    nsIDOMElement* rowElement = do_QueryInterface(rowNode);
++    nsIDOMCSSStyleDeclaration* styleDecl = nsnull;
++    GetComputedStyleDeclaration(EmptyString(), rowElement, &styleDecl);
+     NS_ENSURE_TRUE(styleDecl, NS_ERROR_FAILURE);
+     lastRowColor = color;
+     styleDecl->GetPropertyValue(NS_LITERAL_STRING("background-color"), color);
+@@ -1165,8 +1165,8 @@ NS_IMETHODIMP nsHTMLTableAccessible::IsP
+     nsIFrame *tableFrame = GetFrame();
+     NS_ENSURE_TRUE(tableFrame , NS_ERROR_FAILURE);
+     nsSize tableSize  = tableFrame->GetSize();
+-    nsCOMPtr<nsIAccessibleDocument> docAccessible = GetDocAccessible();
+-    nsCOMPtr<nsPIAccessNode> docAccessNode(do_QueryInterface(docAccessible));
++    nsIAccessibleDocument* docAccessible = GetDocAccessible();
++    nsPIAccessNode* docAccessNode(do_QueryInterface(docAccessible));
+     NS_ENSURE_TRUE(docAccessNode, NS_ERROR_FAILURE);
+     nsIFrame *docFrame = docAccessNode->GetFrame();
+     NS_ENSURE_TRUE(docFrame , NS_ERROR_FAILURE);
+@@ -1233,11 +1233,11 @@ nsHTMLTableHeadAccessible::GetRows(PRInt
+ {
+   nsresult rv = NS_OK;
+ 
+-  nsCOMPtr<nsIDOMHTMLTableSectionElement> head(do_QueryInterface(mDOMNode));
++  nsIDOMHTMLTableSectionElement* head(do_QueryInterface(mDOMNode));
+   NS_ENSURE_TRUE(head, NS_ERROR_FAILURE);
+ 
+-  nsCOMPtr<nsIDOMHTMLCollection> rows;
+-  rv = head->GetRows(getter_AddRefs(rows));
++  nsIDOMHTMLCollection* rows = nsnull;
++  rv = head->GetRows(&rows);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+   return rows->GetLength((PRUint32 *)aRows);
+diff --git a/accessible/src/html/nsHTMLTextAccessible.cpp b/accessible/src/html/nsHTMLTextAccessible.cpp
+--- a/accessible/src/html/nsHTMLTextAccessible.cpp
++++ b/accessible/src/html/nsHTMLTextAccessible.cpp
+@@ -80,8 +80,8 @@ nsHTMLTextAccessible::GetState(PRUint32 
+   if (!mDOMNode)
+     return NS_OK;
+ 
+-  nsCOMPtr<nsIAccessible> docAccessible = 
+-    do_QueryInterface(nsCOMPtr<nsIAccessibleDocument>(GetDocAccessible()));
++  nsIAccessible* docAccessible = 
++    do_QueryInterface((nsIAccessibleDocument*)(GetDocAccessible()));
+   if (docAccessible) {
+      PRUint32 state, extState;
+      docAccessible->GetFinalState(&state, &extState);
+@@ -161,7 +161,7 @@ NS_IMETHODIMP nsHTMLLabelAccessible::Get
+ NS_IMETHODIMP nsHTMLLabelAccessible::GetName(nsAString& aReturn)
+ { 
+   nsresult rv = NS_ERROR_FAILURE;
+-  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
++  nsIContent* content(do_QueryInterface(mDOMNode));
+ 
+   nsAutoString name;
+   if (content)
+@@ -221,7 +221,7 @@ nsHTMLLIAccessible::nsHTMLLIAccessible(n
+   if (!aBulletText.IsEmpty()) {
+     mBulletAccessible = new nsHTMLListBulletAccessible(mDOMNode, mWeakShell, 
+                                                        aBulletText);
+-    nsCOMPtr<nsPIAccessNode> bulletANode(mBulletAccessible);
++    nsPIAccessNode* bulletANode(mBulletAccessible);
+     if (bulletANode) {
+       bulletANode->Init();
+     }
+diff --git a/accessible/src/html/nsHyperTextAccessible.cpp b/accessible/src/html/nsHyperTextAccessible.cpp
+--- a/accessible/src/html/nsHyperTextAccessible.cpp
++++ b/accessible/src/html/nsHyperTextAccessible.cpp
+@@ -80,7 +80,7 @@ nsresult nsHyperTextAccessible::QueryInt
+ {
+   *aInstancePtr = nsnull;
+ 
+-  nsCOMPtr<nsIDOMXULDocument> xulDoc(do_QueryInterface(mDOMNode));
++  nsIDOMXULDocument* xulDoc(do_QueryInterface(mDOMNode));
+   if (mDOMNode && !xulDoc) {
+     // We need XUL doc check for now because for now nsDocAccessible must
+     // inherit from nsHyperTextAccessible in order for HTML document accessibles
+@@ -133,7 +133,7 @@ nsAccessibleWrap(aNode, aShell)
+ 
+ NS_IMETHODIMP nsHyperTextAccessible::GetRole(PRUint32 *aRole)
+ {
+-  nsCOMPtr<nsIContent> content = do_QueryInterface(mDOMNode);
++  nsIContent* content = do_QueryInterface(mDOMNode);
+   if (!content) {
+     return NS_ERROR_FAILURE;
+   }