A bunch of manual fixes to get things running... found a garburator bug and need to go back now... :-(
authorbenjamin@smedbergs.us
Thu, 08 Nov 2007 19:06:07 -0500
changeset 50 e3f23db3ec2213343262434cb811173f1d3d5bfc
parent 49 2dba947841b0525d01569a3133f4eb95a45a5d8e
child 51 582be821e1d70635bcc04f7cb7ab588f2ddf464e
push id1
push userbsmedberg@mozilla.com
push dateTue, 15 Apr 2008 21:51:22 +0000
A bunch of manual fixes to get things running... found a garburator bug and need to go back now... :-(
TArray-allocator
TArray-extra
automatic-garburator-psm.patch
automatic-garburator.patch
automatic-remove-addrefs.patch
compmgr-loadertype
fix-allocator.patch
fix-garburator.patch
gc-hashtables.patch
hashentry-fixups.patch
jscomponentloader-gc
layout-suck
more-hashtables.patch
necko-gc
observerlist-gc
series
uconverter-suck
widget-suck
xpconnect-allocations
xpinstall-suck
new file mode 100644
--- /dev/null
+++ b/TArray-allocator
@@ -0,0 +1,616 @@
+diff --git a/xpcom/glue/nsTArray.cpp b/xpcom/glue/nsTArray.cpp
+deleted file mode 100644
+--- a/xpcom/glue/nsTArray.cpp
++++ /dev/null
+@@ -1,278 +0,0 @@
+-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+-/* vim:set ts=2 sw=2 sts=2 et cindent: */
+-/* ***** BEGIN LICENSE BLOCK *****
+- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+- *
+- * The contents of this file are subject to the Mozilla Public License Version
+- * 1.1 (the "License"); you may not use this file except in compliance with
+- * the License. You may obtain a copy of the License at
+- * http://www.mozilla.org/MPL/
+- *
+- * Software distributed under the License is distributed on an "AS IS" basis,
+- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+- * for the specific language governing rights and limitations under the
+- * License.
+- *
+- * The Original Code is C++ array template.
+- *
+- * The Initial Developer of the Original Code is Google Inc.
+- * Portions created by the Initial Developer are Copyright (C) 2005
+- * the Initial Developer. All Rights Reserved.
+- *
+- * Contributor(s):
+- *  Darin Fisher <darin@meer.net>
+- *
+- * Alternatively, the contents of this file may be used under the terms of
+- * either the GNU General Public License Version 2 or later (the "GPL"), or
+- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+- * in which case the provisions of the GPL or the LGPL are applicable instead
+- * of those above. If you wish to allow use of your version of this file only
+- * under the terms of either the GPL or the LGPL, and not to allow others to
+- * use your version of this file under the terms of the MPL, indicate your
+- * decision by deleting the provisions above and replace them with the notice
+- * and other provisions required by the GPL or the LGPL. If you do not delete
+- * the provisions above, a recipient may use your version of this file under
+- * the terms of any one of the MPL, the GPL or the LGPL.
+- *
+- * ***** END LICENSE BLOCK ***** */
+-
+-#include <string.h>
+-#include "nsTArray.h"
+-#include "nsXPCOM.h"
+-#include "nsDebug.h"
+-
+-nsTArray_base::Header nsTArray_base::sEmptyHdr = { 0, 0, 0 };
+-
+-nsTArray_base::nsTArray_base()
+-  : mHdr(&sEmptyHdr) {
+-  MOZ_COUNT_CTOR(nsTArray_base);
+-}
+-
+-nsTArray_base::~nsTArray_base() {
+-  MOZ_COUNT_DTOR(nsTArray_base);
+-}
+-
+-PRBool
+-nsTArray_base::EnsureCapacity(size_type capacity, size_type elemSize) {
+-  // This should be the most common case so test this first
+-  if (capacity <= mHdr->mCapacity)
+-    return PR_TRUE;
+-
+-  // If the requested memory allocation exceeds size_type(-1)/2, then our
+-  // doubling algorithm may not be able to allocate it.  Additionally we
+-  // couldn't fit in the Header::mCapacity member. Just bail out in cases
+-  // like that.  We don't want to be allocating 2 GB+ arrays anyway.
+-  if (capacity * elemSize > size_type(-1)/2) {
+-    NS_ERROR("Attempting to allocate excessively large array");
+-    return PR_FALSE;
+-  }
+-
+-  if (mHdr == &sEmptyHdr) {
+-    // NS_Alloc new data
+-    Header *header = static_cast<Header*>
+-                                (NS_Alloc(sizeof(Header) + capacity * elemSize));
+-    if (!header)
+-      return PR_FALSE;
+-    header->mLength = 0;
+-    header->mCapacity = capacity;
+-    header->mIsAutoArray = 0;
+-    mHdr = header;
+-    
+-    return PR_TRUE;
+-  }
+-
+-  // Use doubling algorithm when forced to increase available capacity.
+-  NS_ASSERTION(mHdr->mCapacity > 0, "should not have buffer of zero size");
+-  size_type temp = mHdr->mCapacity;
+-  while (temp < capacity)
+-    temp <<= 1;
+-  capacity = temp;
+-
+-  Header *header;
+-  if (UsesAutoArrayBuffer()) {
+-    // NS_Alloc and copy
+-    header = static_cast<Header*>
+-                        (NS_Alloc(sizeof(Header) + capacity * elemSize));
+-    if (!header)
+-      return PR_FALSE;
+-
+-    memcpy(header, mHdr, sizeof(Header) + Length() * elemSize);
+-  } else {
+-    // NS_Realloc existing data
+-    size_type size = sizeof(Header) + capacity * elemSize;
+-    header = static_cast<Header*>(NS_Realloc(mHdr, size));
+-    if (!header)
+-      return PR_FALSE;
+-  }
+-
+-  header->mCapacity = capacity;
+-  mHdr = header;
+-
+-  return PR_TRUE;
+-}
+-
+-void
+-nsTArray_base::ShrinkCapacity(size_type elemSize) {
+-  if (mHdr == &sEmptyHdr || UsesAutoArrayBuffer())
+-    return;
+-
+-  if (mHdr->mLength >= mHdr->mCapacity)  // should never be greater than...
+-    return;
+-
+-  size_type length = Length();
+-
+-  if (IsAutoArray() && GetAutoArrayBuffer()->mCapacity >= length) {
+-    Header* header = GetAutoArrayBuffer();
+-
+-    // copy data, but don't copy the header to avoid overwritng mCapacity
+-    header->mLength = length;
+-    memcpy(header + 1, mHdr + 1, length * elemSize);
+-
+-    NS_Free(mHdr);
+-    mHdr = header;
+-    return;
+-  }
+-
+-  if (length == 0) {
+-    NS_ASSERTION(!IsAutoArray(), "autoarray should have fit 0 elements");
+-    NS_Free(mHdr);
+-    mHdr = &sEmptyHdr;
+-    return;
+-  }
+-
+-  size_type size = sizeof(Header) + length * elemSize;
+-  void *ptr = NS_Realloc(mHdr, size);
+-  if (!ptr)
+-    return;
+-  mHdr = static_cast<Header*>(ptr);
+-  mHdr->mCapacity = length;
+-}
+-
+-void
+-nsTArray_base::ShiftData(index_type start, size_type oldLen, size_type newLen,
+-                         size_type elemSize) {
+-  if (oldLen == newLen)
+-    return;
+-
+-  // Determine how many elements need to be shifted
+-  size_type num = mHdr->mLength - (start + oldLen);
+-
+-  // Compute the resulting length of the array
+-  mHdr->mLength += newLen - oldLen;
+-  if (mHdr->mLength == 0) {
+-    ShrinkCapacity(elemSize);
+-  } else {
+-    // Maybe nothing needs to be shifted
+-    if (num == 0)
+-      return;
+-    // Perform shift (change units to bytes first)
+-    start *= elemSize;
+-    newLen *= elemSize;
+-    oldLen *= elemSize;
+-    num *= elemSize;
+-    char *base = reinterpret_cast<char*>(mHdr + 1) + start;
+-    memmove(base + newLen, base + oldLen, num);
+-  }
+-}
+-
+-PRBool
+-nsTArray_base::InsertSlotsAt(index_type index, size_type count,
+-                             size_type elementSize) {
+-  NS_ASSERTION(index <= Length(), "Bogus insertion index");
+-  size_type newLen = Length() + count;
+-
+-  EnsureCapacity(newLen, elementSize);
+-
+-  // Check for out of memory conditions
+-  if (Capacity() < newLen)
+-    return PR_FALSE;
+-
+-  // Move the existing elements as needed.  Note that this will
+-  // change our mLength, so no need to call IncrementLength.
+-  ShiftData(index, 0, count, elementSize);
+-      
+-  return PR_TRUE;
+-}
+-
+-PRBool
+-nsTArray_base::SwapArrayElements(nsTArray_base& other, size_type elemSize)
+-{
+-#ifdef DEBUG
+-  PRBool isAuto = IsAutoArray();
+-  PRBool otherIsAuto = other.IsAutoArray();
+-#endif
+-
+-  if (!EnsureNotUsingAutoArrayBuffer(elemSize) ||
+-      !other.EnsureNotUsingAutoArrayBuffer(elemSize)) {
+-    return PR_FALSE;
+-  }
+-
+-  NS_ASSERTION(isAuto == IsAutoArray(), "lost auto info");
+-  NS_ASSERTION(otherIsAuto == other.IsAutoArray(), "lost auto info");
+-  NS_ASSERTION(!UsesAutoArrayBuffer() && !other.UsesAutoArrayBuffer(),
+-               "both should be using an alloced buffer now");
+-
+-  // If the two arrays have different mIsAutoArray values (i.e. one is an
+-  // autoarray and one is not) then simply switching the buffers is going to
+-  // make that bit wrong. We therefore adjust these mIsAutoArray bits before
+-  // switching the buffers so that once the buffers are switched the
+-  // mIsAutoArray bits are right again.
+-  // However, we have to watch out so that we don't set the bit on
+-  // sEmptyHeader. If an array (A) uses the empty header (and the other (B)
+-  // therefore must be an nsAutoTArray) we make A point to the B's autobuffer
+-  // so that when the buffers are switched B points to its own autobuffer.
+-
+-  // Adjust mIsAutoArray flags before swapping the buffers
+-  if (IsAutoArray() && !other.IsAutoArray()) {
+-    if (other.mHdr == &sEmptyHdr) {
+-      // Set other to use our built-in buffer so that we use it
+-      // after the swap below.
+-      other.mHdr = GetAutoArrayBuffer();
+-      other.mHdr->mLength = 0;
+-    }
+-    else {
+-      other.mHdr->mIsAutoArray = 1;
+-    }
+-    mHdr->mIsAutoArray = 0;
+-  }
+-  else if (!IsAutoArray() && other.IsAutoArray()) {
+-    if (mHdr == &sEmptyHdr) {
+-      // Set us to use other's built-in buffer so that other use it
+-      // after the swap below.
+-      mHdr = other.GetAutoArrayBuffer();
+-      mHdr->mLength = 0;
+-    }
+-    else {
+-      mHdr->mIsAutoArray = 1;
+-    }
+-    other.mHdr->mIsAutoArray = 0;
+-  }
+-
+-  // Swap the buffers
+-  Header *h = other.mHdr;
+-  other.mHdr = mHdr;
+-  mHdr = h;
+-
+-  NS_ASSERTION(isAuto == IsAutoArray(), "lost auto info");
+-  NS_ASSERTION(otherIsAuto == other.IsAutoArray(), "lost auto info");
+-
+-  return PR_TRUE;
+-}
+-
+-PRBool
+-nsTArray_base::EnsureNotUsingAutoArrayBuffer(size_type elemSize)
+-{
+-  if (UsesAutoArrayBuffer()) {
+-    size_type size = sizeof(Header) + Length() * elemSize;
+-
+-    Header* header = static_cast<Header*>(NS_Alloc(size));
+-    if (!header)
+-      return PR_FALSE;
+-
+-    memcpy(header, mHdr, size);
+-    header->mCapacity = Length();
+-    mHdr = header;
+-  }
+-  
+-  return PR_TRUE;
+-}
+diff --git a/xpcom/glue/nsTArray.h b/xpcom/glue/nsTArray.h
+--- a/xpcom/glue/nsTArray.h
++++ b/xpcom/glue/nsTArray.h
+@@ -43,6 +43,7 @@
+ #include "nsQuickSort.h"
+ #include "nsDebug.h"
+ #include "nsTraceRefcnt.h"
++#include "nsAllocator.h"
+ #include NEW_H
+ 
+ //
+@@ -50,7 +51,8 @@
+ // directly.  It holds common implementation code that does not depend on the
+ // element type of the nsTArray.
+ //
+-class NS_COM_GLUE nsTArray_base {
++template<class Allocator>
++class nsTArray_base {
+   public:
+     typedef PRUint32 size_type;
+     typedef PRUint32 index_type;
+@@ -253,12 +255,18 @@ class nsDefaultComparator {
+ // The Equals method is used for searching, and the LessThan method is used
+ // for sorting.
+ //
+-template<class E>
+-class nsTArray : public nsTArray_base {
++template<class E, class Allocator=CAllocator>
++class nsTArray : public nsTArray_base<Allocator> {
+   public:
+     typedef E                        elem_type;
+-    typedef nsTArray<E>              self_type;
++    typedef nsTArray<E, Allocator>   self_type;
+     typedef nsTArrayElementTraits<E> elem_traits;
++    typedef typename nsTArray_base<Allocator>::size_type size_type;
++    typedef typename nsTArray_base<Allocator>::index_type index_type;
++    using nsTArray_base<Allocator>::NoIndex;
++    using nsTArray_base<Allocator>::Length;
++    using nsTArray_base<Allocator>::mHdr;
++    using nsTArray_base<Allocator>::ShrinkCapacity;
+ 
+     //
+     // Finalization method
+@@ -626,7 +634,7 @@ class nsTArray : public nsTArray_base {
+     //              greater than the current length of the array.
+     // @param count the number of elements to insert
+     elem_type *InsertElementsAt(index_type index, size_type count) {
+-      if (!nsTArray_base::InsertSlotsAt(index, count, sizeof(elem_type))) {
++      if (!nsTArray_base<Allocator>::InsertSlotsAt(index, count, sizeof(elem_type))) {
+         return nsnull;
+       }
+ 
+@@ -649,7 +657,7 @@ class nsTArray : public nsTArray_base {
+     template<class Item>
+     elem_type *InsertElementsAt(index_type index, size_type count,
+                                 const Item& item) {
+-      if (!nsTArray_base::InsertSlotsAt(index, count, sizeof(elem_type))) {
++      if (!nsTArray_base<Allocator>::InsertSlotsAt(index, count, sizeof(elem_type))) {
+         return nsnull;
+       }
+ 
+@@ -735,4 +743,260 @@ class nsAutoTArray : public nsTArray<E> 
+     char mAutoBuf[sizeof(Header) + N * sizeof(elem_type)];
+ };
+ 
++template<class Allocator>
++typename nsTArray_base<Allocator>::Header
++nsTArray_base<Allocator>::sEmptyHdr = { 0, 0, 0 };
++
++template<class Allocator>
++nsTArray_base<Allocator>::nsTArray_base()
++  : mHdr(&sEmptyHdr)
++{
++  MOZ_COUNT_CTOR(nsTArray_base);
++}
++
++template<class Allocator>
++nsTArray_base<Allocator>::~nsTArray_base()
++{
++  MOZ_COUNT_DTOR(nsTArray_base);
++}
++
++template<class Allocator>
++PRBool
++nsTArray_base<Allocator>::EnsureCapacity(size_type capacity,
++                                         size_type elemSize)
++{
++  // This should be the most common case so test this first
++  if (capacity <= mHdr->mCapacity)
++    return PR_TRUE;
++
++  // If the requested memory allocation exceeds size_type(-1)/2, then our
++  // doubling algorithm may not be able to allocate it.  Additionally we
++  // couldn't fit in the Header::mCapacity member. Just bail out in cases
++  // like that.  We don't want to be allocating 2 GB+ arrays anyway.
++  if (capacity * elemSize > size_type(-1)/2) {
++    NS_ERROR("Attempting to allocate excessively large array");
++    return PR_FALSE;
++  }
++
++  if (mHdr == &sEmptyHdr) {
++    // Alloc new data
++    Header *header = static_cast<Header*>
++      (Allocator::Alloc(sizeof(Header) + capacity * elemSize));
++    if (!header)
++      return PR_FALSE;
++    header->mLength = 0;
++    header->mCapacity = capacity;
++    header->mIsAutoArray = 0;
++    mHdr = header;
++    
++    return PR_TRUE;
++  }
++
++  // Use doubling algorithm when forced to increase available capacity.
++  NS_ASSERTION(mHdr->mCapacity > 0, "should not have buffer of zero size");
++  size_type temp = mHdr->mCapacity;
++  while (temp < capacity)
++    temp <<= 1;
++  capacity = temp;
++
++  Header *header;
++  if (UsesAutoArrayBuffer()) {
++    // Alloc and copy
++    header = static_cast<Header*>
++      (Allocator::Alloc(sizeof(Header) + capacity * elemSize));
++    if (!header)
++      return PR_FALSE;
++
++    memcpy(header, mHdr, sizeof(Header) + Length() * elemSize);
++  } else {
++    // Realloc existing data
++    size_type oldsize = sizeof(Header) + mHdr->mCapacity * elemSize;
++    size_type size = sizeof(Header) + capacity * elemSize;
++    header = static_cast<Header*>(Allocator::Realloc(mHdr, oldsize, size));
++    if (!header)
++      return PR_FALSE;
++  }
++
++  header->mCapacity = capacity;
++  mHdr = header;
++
++  return PR_TRUE;
++}
++
++template<class Allocator>
++void
++nsTArray_base<Allocator>::ShrinkCapacity(size_type elemSize)
++{
++  if (mHdr == &sEmptyHdr || UsesAutoArrayBuffer())
++    return;
++
++  if (mHdr->mLength >= mHdr->mCapacity)  // should never be greater than...
++    return;
++
++  size_type length = Length();
++
++  if (IsAutoArray() && GetAutoArrayBuffer()->mCapacity >= length) {
++    Header* header = GetAutoArrayBuffer();
++
++    // copy data, but don't copy the header to avoid overwritng mCapacity
++    header->mLength = length;
++    memcpy(header + 1, mHdr + 1, length * elemSize);
++
++    Allocator::Free(mHdr);
++    mHdr = header;
++    return;
++  }
++
++  if (length == 0) {
++    NS_ASSERTION(!IsAutoArray(), "autoarray should have fit 0 elements");
++    Allocator::Free(mHdr);
++    mHdr = &sEmptyHdr;
++    return;
++  }
++
++  size_type oldsize = sizeof(Header) + mHdr->mCapacity * elemSize;
++  size_type size = sizeof(Header) + length * elemSize;
++  void *ptr = Allocator::Realloc(mHdr, oldsize, size);
++  if (!ptr)
++    return;
++  mHdr = static_cast<Header*>(ptr);
++  mHdr->mCapacity = length;
++}
++
++template<class Allocator>
++void
++nsTArray_base<Allocator>::ShiftData(index_type start, size_type oldLen,
++                                    size_type newLen, size_type elemSize)
++{
++  if (oldLen == newLen)
++    return;
++
++  // Determine how many elements need to be shifted
++  size_type num = mHdr->mLength - (start + oldLen);
++
++  // Compute the resulting length of the array
++  mHdr->mLength += newLen - oldLen;
++  if (mHdr->mLength == 0) {
++    ShrinkCapacity(elemSize);
++  } else {
++    // Maybe nothing needs to be shifted
++    if (num == 0)
++      return;
++    // Perform shift (change units to bytes first)
++    start *= elemSize;
++    newLen *= elemSize;
++    oldLen *= elemSize;
++    num *= elemSize;
++    char *base = reinterpret_cast<char*>(mHdr + 1) + start;
++    memmove(base + newLen, base + oldLen, num);
++  }
++}
++
++template<class Allocator>
++PRBool
++nsTArray_base<Allocator>::InsertSlotsAt(index_type index, size_type count,
++                                        size_type elementSize)
++{
++  NS_ASSERTION(index <= Length(), "Bogus insertion index");
++  size_type newLen = Length() + count;
++
++  EnsureCapacity(newLen, elementSize);
++
++  // Check for out of memory conditions
++  if (Capacity() < newLen)
++    return PR_FALSE;
++
++  // Move the existing elements as needed.  Note that this will
++  // change our mLength, so no need to call IncrementLength.
++  ShiftData(index, 0, count, elementSize);
++      
++  return PR_TRUE;
++}
++
++template<class Allocator>
++PRBool
++nsTArray_base<Allocator>::SwapArrayElements(nsTArray_base& other,
++                                            size_type elemSize)
++{
++#ifdef DEBUG
++  PRBool isAuto = IsAutoArray();
++  PRBool otherIsAuto = other.IsAutoArray();
++#endif
++
++  if (!EnsureNotUsingAutoArrayBuffer(elemSize) ||
++      !other.EnsureNotUsingAutoArrayBuffer(elemSize)) {
++    return PR_FALSE;
++  }
++
++  NS_ASSERTION(isAuto == IsAutoArray(), "lost auto info");
++  NS_ASSERTION(otherIsAuto == other.IsAutoArray(), "lost auto info");
++  NS_ASSERTION(!UsesAutoArrayBuffer() && !other.UsesAutoArrayBuffer(),
++               "both should be using an alloced buffer now");
++
++  // If the two arrays have different mIsAutoArray values (i.e. one is an
++  // autoarray and one is not) then simply switching the buffers is going to
++  // make that bit wrong. We therefore adjust these mIsAutoArray bits before
++  // switching the buffers so that once the buffers are switched the
++  // mIsAutoArray bits are right again.
++  // However, we have to watch out so that we don't set the bit on
++  // sEmptyHeader. If an array (A) uses the empty header (and the other (B)
++  // therefore must be an nsAutoTArray) we make A point to the B's autobuffer
++  // so that when the buffers are switched B points to its own autobuffer.
++
++  // Adjust mIsAutoArray flags before swapping the buffers
++  if (IsAutoArray() && !other.IsAutoArray()) {
++    if (other.mHdr == &sEmptyHdr) {
++      // Set other to use our built-in buffer so that we use it
++      // after the swap below.
++      other.mHdr = GetAutoArrayBuffer();
++      other.mHdr->mLength = 0;
++    }
++    else {
++      other.mHdr->mIsAutoArray = 1;
++    }
++    mHdr->mIsAutoArray = 0;
++  }
++  else if (!IsAutoArray() && other.IsAutoArray()) {
++    if (mHdr == &sEmptyHdr) {
++      // Set us to use other's built-in buffer so that other use it
++      // after the swap below.
++      mHdr = other.GetAutoArrayBuffer();
++      mHdr->mLength = 0;
++    }
++    else {
++      mHdr->mIsAutoArray = 1;
++    }
++    other.mHdr->mIsAutoArray = 0;
++  }
++
++  // Swap the buffers
++  Header *h = other.mHdr;
++  other.mHdr = mHdr;
++  mHdr = h;
++
++  NS_ASSERTION(isAuto == IsAutoArray(), "lost auto info");
++  NS_ASSERTION(otherIsAuto == other.IsAutoArray(), "lost auto info");
++
++  return PR_TRUE;
++}
++
++template<class Allocator>
++PRBool
++nsTArray_base<Allocator>::EnsureNotUsingAutoArrayBuffer(size_type elemSize)
++{
++  if (UsesAutoArrayBuffer()) {
++    size_type size = sizeof(Header) + Length() * elemSize;
++
++    Header* header = static_cast<Header*>(Allocator::Alloc(size));
++    if (!header)
++      return PR_FALSE;
++
++    memcpy(header, mHdr, size);
++    header->mCapacity = Length();
++    mHdr = header;
++  }
++  
++  return PR_TRUE;
++}
++
+ #endif  // nsTArray_h__
+diff --git a/xpcom/glue/objs.mk b/xpcom/glue/objs.mk
+--- a/xpcom/glue/objs.mk
++++ b/xpcom/glue/objs.mk
+@@ -60,7 +60,6 @@ XPCOM_GLUE_SRC_LCPPSRCS =        \
+   nsTHashtable.cpp               \
+   nsQuickSort.cpp                \
+   nsVoidArray.cpp                \
+-  nsTArray.cpp                   \
+   nsThreadUtils.cpp              \
+   nsTObserverArray.cpp           \
+   nsDeque.cpp \
new file mode 100644
--- /dev/null
+++ b/TArray-extra
@@ -0,0 +1,83 @@
+diff --git a/content/html/content/public/nsIForm.h b/content/html/content/public/nsIForm.h
+--- a/content/html/content/public/nsIForm.h
++++ b/content/html/content/public/nsIForm.h
+@@ -39,11 +39,11 @@
+ 
+ #include "nsISupports.h"
+ #include "nsAString.h"
++#include "nsTArray.h"
+ 
+ class nsIFormControl;
+ class nsISimpleEnumerator;
+ class nsIURI;
+-template<class T> class nsTArray;
+ 
+ #define NS_FORM_METHOD_GET  0
+ #define NS_FORM_METHOD_POST 1
+diff --git a/layout/generic/nsIAnonymousContentCreator.h b/layout/generic/nsIAnonymousContentCreator.h
+--- a/layout/generic/nsIAnonymousContentCreator.h
++++ b/layout/generic/nsIAnonymousContentCreator.h
+@@ -45,10 +45,10 @@
+ 
+ #include "nsISupports.h"
+ #include "nsIContent.h"
++#include "nsTArray.h"
+ 
+ class nsPresContext;
+ class nsIFrame;
+-template <class T> class nsTArray;
+ 
+ // {7568a516-3831-4db4-88a7-a42578acc136}
+ #define NS_IANONYMOUS_CONTENT_CREATOR_IID \
+diff --git a/toolkit/components/places/src/nsMaybeWeakPtr.cpp b/toolkit/components/places/src/nsMaybeWeakPtr.cpp
+--- a/toolkit/components/places/src/nsMaybeWeakPtr.cpp
++++ b/toolkit/components/places/src/nsMaybeWeakPtr.cpp
+@@ -61,7 +61,7 @@ nsMaybeWeakPtr_base::GetValueAs(const ns
+ }
+ 
+ /* static */ nsresult
+-nsMaybeWeakPtrArray_base::AppendWeakElementBase(nsTArray_base *aArray,
++nsMaybeWeakPtrArray_base::AppendWeakElementBase(nsTArray_base<CAllocator> *aArray,
+                                                 nsISupports *aElement,
+                                                 PRBool aOwnsWeak)
+ {
+@@ -85,7 +85,7 @@ nsMaybeWeakPtrArray_base::AppendWeakElem
+ }
+ 
+ /* static */ nsresult
+-nsMaybeWeakPtrArray_base::RemoveWeakElementBase(nsTArray_base *aArray,
++nsMaybeWeakPtrArray_base::RemoveWeakElementBase(nsTArray_base<CAllocator> *aArray,
+                                                 nsISupports *aElement)
+ {
+   isupports_type *array = static_cast<isupports_type*>(aArray);
+diff --git a/toolkit/components/places/src/nsMaybeWeakPtr.h b/toolkit/components/places/src/nsMaybeWeakPtr.h
+--- a/toolkit/components/places/src/nsMaybeWeakPtr.h
++++ b/toolkit/components/places/src/nsMaybeWeakPtr.h
+@@ -100,9 +100,9 @@ class nsMaybeWeakPtrArray_base
+ class nsMaybeWeakPtrArray_base
+ {
+ protected:
+-  static nsresult AppendWeakElementBase(nsTArray_base *aArray,
++  static nsresult AppendWeakElementBase(nsTArray_base<CAllocator> *aArray,
+                                         nsISupports *aElement, PRBool aWeak);
+-  static nsresult RemoveWeakElementBase(nsTArray_base *aArray,
++  static nsresult RemoveWeakElementBase(nsTArray_base<CAllocator> *aArray,
+                                          nsISupports *aElement);
+ 
+   typedef nsTArray< nsMaybeWeakPtr<nsISupports> > isupports_type;
+diff --git a/toolkit/components/satchel/src/nsStorageFormHistory.h b/toolkit/components/satchel/src/nsStorageFormHistory.h
+--- a/toolkit/components/satchel/src/nsStorageFormHistory.h
++++ b/toolkit/components/satchel/src/nsStorageFormHistory.h
+@@ -56,11 +56,11 @@
+ #ifdef MOZ_MORKREADER
+ #include "nsMorkReader.h"
+ #endif
++#include "nsTArray.h"
+ 
+ class nsIAutoCompleteSimpleResult;
+ class nsIAutoCompleteResult;
+ class nsFormHistory;
+-template <class E> class nsTArray;
+ 
+ #define NS_IFORMHISTORYPRIVATE_IID \
+ {0xc4a47315, 0xaeb5, 0x4039, {0x9f, 0x34, 0x45, 0x11, 0xb3, 0xa7, 0x58, 0xdd}}
new file mode 100644
--- /dev/null
+++ b/automatic-garburator-psm.patch
@@ -0,0 +1,3773 @@
+diff --git a/security/manager/boot/src/nsSecureBrowserUIImpl.cpp b/security/manager/boot/src/nsSecureBrowserUIImpl.cpp
+--- a/security/manager/boot/src/nsSecureBrowserUIImpl.cpp
++++ b/security/manager/boot/src/nsSecureBrowserUIImpl.cpp
+@@ -188,7 +188,7 @@ nsSecureBrowserUIImpl::Init(nsIDOMWindow
+   nsresult rv = NS_OK;
+   mWindow = window;
+ 
+-  nsCOMPtr<nsIStringBundleService> service(do_GetService(NS_STRINGBUNDLE_CONTRACTID, &rv));
++  nsIStringBundleService* service(do_GetService(NS_STRINGBUNDLE_CONTRACTID, &rv));
+   if (NS_FAILED(rv)) return rv;
+   
+   // We do not need to test for mStringBundle here...
+@@ -200,12 +200,12 @@ nsSecureBrowserUIImpl::Init(nsIDOMWindow
+   
+   
+   // hook up to the form post notifications:
+-  nsCOMPtr<nsIObserverService> svc(do_GetService("@mozilla.org/observer-service;1", &rv));
++  nsIObserverService* svc(do_GetService("@mozilla.org/observer-service;1", &rv));
+   if (NS_SUCCEEDED(rv)) {
+     rv = svc->AddObserver(this, NS_FORMSUBMIT_SUBJECT, PR_TRUE);
+   }
+   
+-  nsCOMPtr<nsPIDOMWindow> piwindow(do_QueryInterface(mWindow));
++  nsPIDOMWindow* piwindow(do_QueryInterface(mWindow));
+   if (!piwindow) return NS_ERROR_FAILURE;
+ 
+   nsIDocShell *docShell = piwindow->GetDocShell();
+@@ -218,7 +218,7 @@ nsSecureBrowserUIImpl::Init(nsIDOMWindow
+ 
+   /* GetWebProgress(mWindow) */
+   // hook up to the webprogress notifications.
+-  nsCOMPtr<nsIWebProgress> wp(do_GetInterface(docShell));
++  nsIWebProgress* wp(do_GetInterface(docShell));
+   if (!wp) return NS_ERROR_FAILURE;
+   /* end GetWebProgress */
+   
+@@ -303,10 +303,10 @@ static nsresult IsChildOfDomWindow(nsIDO
+     return NS_OK;
+   }
+   
+-  nsCOMPtr<nsIDOMWindow> childsParent;
+-  child->GetParent(getter_AddRefs(childsParent));
+-  
+-  if (childsParent && childsParent.get() != child)
++  nsIDOMWindow* childsParent;
++  child->GetParent(&childsParent);
++  
++  if (childsParent && childsParent != child)
+     IsChildOfDomWindow(parent, childsParent, value);
+   
+   return NS_OK;
+@@ -318,9 +318,9 @@ static PRUint32 GetSecurityStateFromChan
+   PRUint32 securityState;
+ 
+   // qi for the psm information about this channel load.
+-  nsCOMPtr<nsISupports> info;
+-  aChannel->GetSecurityInfo(getter_AddRefs(info));
+-  nsCOMPtr<nsITransportSecurityInfo> psmInfo(do_QueryInterface(info));
++  nsISupports* info;
++  aChannel->GetSecurityInfo(&info);
++  nsITransportSecurityInfo* psmInfo(do_QueryInterface(info));
+   if (!psmInfo) {
+     PR_LOG(gSecureDocLog, PR_LOG_DEBUG, ("SecureUI: GetSecurityState:%p - no nsITransportSecurityInfo for %p\n",
+                                          aChannel, (nsISupports *)info));
+@@ -352,9 +352,9 @@ nsSecureBrowserUIImpl::Notify(nsIDOMHTML
+   if (!window || !actionURL || !aDOMForm)
+     return NS_OK;
+   
+-  nsCOMPtr<nsIContent> formNode = do_QueryInterface(aDOMForm);
+-
+-  nsCOMPtr<nsIDocument> document = formNode->GetDocument();
++  nsIContent* formNode = do_QueryInterface(aDOMForm);
++
++  nsIDocument* document = formNode->GetDocument();
+   if (!document) return NS_OK;
+ 
+   nsIPrincipal *principal = formNode->NodePrincipal();
+@@ -365,14 +365,14 @@ nsSecureBrowserUIImpl::Notify(nsIDOMHTML
+     return NS_OK;
+   }
+ 
+-  nsCOMPtr<nsIURI> formURL;
+-  if (NS_FAILED(principal->GetURI(getter_AddRefs(formURL))) ||
++  nsIURI* formURL;
++  if (NS_FAILED(principal->GetURI(&formURL)) ||
+       !formURL)
+   {
+     formURL = document->GetDocumentURI();
+   }
+ 
+-  nsCOMPtr<nsIDOMWindow> postingWindow =
++  nsIDOMWindow* postingWindow =
+     do_QueryInterface(document->GetWindow());
+   // We can't find this document's window, cancel it.
+   if (!postingWindow)
+@@ -430,7 +430,7 @@ nsresult
+ nsresult
+ nsSecureBrowserUIImpl::EvaluateAndUpdateSecurityState(nsIRequest *aRequest)
+ {
+-  nsCOMPtr<nsIChannel> channel(do_QueryInterface(aRequest));
++  nsIChannel* channel(do_QueryInterface(aRequest));
+ 
+   mNewToplevelSecurityState = nsIWebProgressListener::STATE_IS_INSECURE;
+   mNewToplevelIsEV = PR_FALSE;
+@@ -443,21 +443,21 @@ nsSecureBrowserUIImpl::EvaluateAndUpdate
+             mNewToplevelSecurityState));
+ 
+     // Get SSL Status information if possible
+-    nsCOMPtr<nsISupports> info;
+-    channel->GetSecurityInfo(getter_AddRefs(info));
+-    nsCOMPtr<nsISSLStatusProvider> sp = do_QueryInterface(info);
++    nsISupports* info;
++    channel->GetSecurityInfo(&info);
++    nsISSLStatusProvider* sp = do_QueryInterface(info);
+     if (sp) {
+       // Ignore result
+       sp->GetSSLStatus(getter_AddRefs(mSSLStatus));
+     }
+ 
+     if (info) {
+-      nsCOMPtr<nsITransportSecurityInfo> secInfo(do_QueryInterface(info));
++      nsITransportSecurityInfo* secInfo(do_QueryInterface(info));
+       if (secInfo) {
+         secInfo->GetShortSecurityDescription(getter_Copies(mInfoTooltip));
+       }
+ 
+-      nsCOMPtr<nsIIdentityInfo> idinfo = do_QueryInterface(info);
++      nsIIdentityInfo* idinfo = do_QueryInterface(info);
+       if (idinfo) {
+         PRBool aTemp;
+         if (NS_SUCCEEDED(idinfo->GetIsExtendedValidation(&aTemp)))
+@@ -479,7 +479,7 @@ nsSecureBrowserUIImpl::UpdateSubrequestM
+   // For wyciwyg channels in subdocuments we only update our
+   // subrequest state members.
+   PRUint32 reqState = nsIWebProgressListener::STATE_IS_INSECURE;
+-  nsCOMPtr<nsIChannel> channel(do_QueryInterface(aRequest));
++  nsIChannel* channel(do_QueryInterface(aRequest));
+ 
+   if (channel) {
+     reqState = GetSecurityStateFromChannel(channel);
+@@ -604,10 +604,10 @@ nsSecureBrowserUIImpl::OnStateChange(nsI
+     regardless of whether the load flags indicate a top level document.
+   */
+ 
+-  nsCOMPtr<nsIDOMWindow> windowForProgress;
+-  aWebProgress->GetDOMWindow(getter_AddRefs(windowForProgress));
+-
+-  const PRBool isToplevelProgress = (windowForProgress.get() == mWindow.get());
++  nsIDOMWindow* windowForProgress;
++  aWebProgress->GetDOMWindow(&windowForProgress);
++
++  const PRBool isToplevelProgress = (windowForProgress == mWindow.get());
+   
+ #ifdef PR_LOGGING
+   if (windowForProgress)
+@@ -653,12 +653,12 @@ nsSecureBrowserUIImpl::OnStateChange(nsI
+   }
+ #endif
+ 
+-  nsCOMPtr<nsIChannel> channel(do_QueryInterface(aRequest));
++  nsIChannel* channel(do_QueryInterface(aRequest));
+ 
+   if (channel)
+   {
+-    nsCOMPtr<nsIURI> uri;
+-    channel->GetURI(getter_AddRefs(uri));
++    nsIURI* uri;
++    channel->GetURI(&uri);
+     if (uri)
+     {
+       PRBool vs;
+@@ -703,13 +703,13 @@ nsSecureBrowserUIImpl::OnStateChange(nsI
+   PRBool isSubDocumentRelevant = PR_TRUE;
+ 
+   // We are only interested in requests that load in the browser window...
+-  nsCOMPtr<nsIHttpChannel> httpRequest(do_QueryInterface(aRequest));
++  nsIHttpChannel* httpRequest(do_QueryInterface(aRequest));
+   if (!httpRequest) {
+-    nsCOMPtr<nsIFileChannel> fileRequest(do_QueryInterface(aRequest));
++    nsIFileChannel* fileRequest(do_QueryInterface(aRequest));
+     if (!fileRequest) {
+-      nsCOMPtr<nsIWyciwygChannel> wyciwygRequest(do_QueryInterface(aRequest));
++      nsIWyciwygChannel* wyciwygRequest(do_QueryInterface(aRequest));
+       if (!wyciwygRequest) {
+-        nsCOMPtr<nsIFTPChannel> ftpRequest(do_QueryInterface(aRequest));
++        nsIFTPChannel* ftpRequest(do_QueryInterface(aRequest));
+         if (!ftpRequest) {
+           PR_LOG(gSecureDocLog, PR_LOG_DEBUG,
+                  ("SecureUI:%p: OnStateChange: not relevant for sub content\n", this));
+@@ -1224,10 +1224,10 @@ nsSecureBrowserUIImpl::OnLocationChange(
+   // loading may never end in some edge cases (perhaps by a site with malicious
+   // intent).
+ 
+-  nsCOMPtr<nsIDOMWindow> windowForProgress;
+-  aWebProgress->GetDOMWindow(getter_AddRefs(windowForProgress));
+-
+-  if (windowForProgress.get() == mWindow.get()) {
++  nsIDOMWindow* windowForProgress;
++  aWebProgress->GetDOMWindow(&windowForProgress);
++
++  if (windowForProgress == mWindow.get()) {
+     // For toplevel channels, update the security state right away.
+     return EvaluateAndUpdateSecurityState(aRequest);
+   }
+@@ -1268,12 +1268,12 @@ nsSecureBrowserUIImpl::OnSecurityChange(
+                                         PRUint32 state)
+ {
+ #if defined(DEBUG)
+-  nsCOMPtr<nsIChannel> channel(do_QueryInterface(aRequest));
++  nsIChannel* channel(do_QueryInterface(aRequest));
+   if (!channel)
+     return NS_OK;
+ 
+-  nsCOMPtr<nsIURI> aURI;
+-  channel->GetURI(getter_AddRefs(aURI));
++  nsIURI* aURI;
++  channel->GetURI(&aURI);
+   
+   if (aURI) {
+     nsCAutoString temp;
+@@ -1413,7 +1413,7 @@ NS_IMETHODIMP nsUIContext::GetInterface(
+   nsresult rv;
+ 
+   if (uuid.Equals(NS_GET_IID(nsIPrompt))) {
+-    nsCOMPtr<nsIDOMWindowInternal> internal = do_QueryInterface(mWindow, &rv);
++    nsIDOMWindowInternal* internal = do_QueryInterface(mWindow, &rv);
+     if (NS_FAILED(rv)) return rv;
+ 
+     nsIPrompt *prompt;
+@@ -1434,16 +1434,16 @@ GetNSSDialogs(nsISecurityWarningDialogs 
+ GetNSSDialogs(nsISecurityWarningDialogs **result)
+ {
+   nsresult rv;
+-  nsCOMPtr<nsISecurityWarningDialogs> my_result(do_GetService(NS_SECURITYWARNINGDIALOGS_CONTRACTID, &rv));
++  nsISecurityWarningDialogs* my_result(do_GetService(NS_SECURITYWARNINGDIALOGS_CONTRACTID, &rv));
+ 
+   if (NS_FAILED(rv)) 
+     return rv;
+ 
+-  nsCOMPtr<nsISupports> proxiedResult;
++  nsISupports* proxiedResult;
+   NS_GetProxyForObject(NS_PROXY_TO_MAIN_THREAD,
+                        NS_GET_IID(nsISecurityWarningDialogs),
+                        my_result, NS_PROXY_SYNC,
+-                       getter_AddRefs(proxiedResult));
++                       (void**)&proxiedResult);
+ 
+   if (!proxiedResult) {
+     return NS_ERROR_FAILURE;
+@@ -1455,12 +1455,12 @@ PRBool nsSecureBrowserUIImpl::
+ PRBool nsSecureBrowserUIImpl::
+ ConfirmEnteringSecure()
+ {
+-  nsCOMPtr<nsISecurityWarningDialogs> dialogs;
+-
+-  GetNSSDialogs(getter_AddRefs(dialogs));
++  nsISecurityWarningDialogs* dialogs;
++
++  GetNSSDialogs(&dialogs);
+   if (!dialogs) return PR_FALSE;  // Should this allow PR_TRUE for unimplemented?
+ 
+-  nsCOMPtr<nsIInterfaceRequestor> ctx = new nsUIContext(mWindow);
++  nsIInterfaceRequestor* ctx = new nsUIContext(mWindow);
+ 
+   PRBool confirms;
+   dialogs->ConfirmEnteringSecure(ctx, &confirms);
+@@ -1471,12 +1471,12 @@ PRBool nsSecureBrowserUIImpl::
+ PRBool nsSecureBrowserUIImpl::
+ ConfirmEnteringWeak()
+ {
+-  nsCOMPtr<nsISecurityWarningDialogs> dialogs;
+-
+-  GetNSSDialogs(getter_AddRefs(dialogs));
++  nsISecurityWarningDialogs* dialogs;
++
++  GetNSSDialogs(&dialogs);
+   if (!dialogs) return PR_FALSE;  // Should this allow PR_TRUE for unimplemented?
+ 
+-  nsCOMPtr<nsIInterfaceRequestor> ctx = new nsUIContext(mWindow);
++  nsIInterfaceRequestor* ctx = new nsUIContext(mWindow);
+ 
+   PRBool confirms;
+   dialogs->ConfirmEnteringWeak(ctx, &confirms);
+@@ -1487,12 +1487,12 @@ PRBool nsSecureBrowserUIImpl::
+ PRBool nsSecureBrowserUIImpl::
+ ConfirmLeavingSecure()
+ {
+-  nsCOMPtr<nsISecurityWarningDialogs> dialogs;
+-
+-  GetNSSDialogs(getter_AddRefs(dialogs));
++  nsISecurityWarningDialogs* dialogs;
++
++  GetNSSDialogs(&dialogs);
+   if (!dialogs) return PR_FALSE;  // Should this allow PR_TRUE for unimplemented?
+ 
+-  nsCOMPtr<nsIInterfaceRequestor> ctx = new nsUIContext(mWindow);
++  nsIInterfaceRequestor* ctx = new nsUIContext(mWindow);
+ 
+   PRBool confirms;
+   dialogs->ConfirmLeavingSecure(ctx, &confirms);
+@@ -1503,12 +1503,12 @@ PRBool nsSecureBrowserUIImpl::
+ PRBool nsSecureBrowserUIImpl::
+ ConfirmMixedMode()
+ {
+-  nsCOMPtr<nsISecurityWarningDialogs> dialogs;
+-
+-  GetNSSDialogs(getter_AddRefs(dialogs));
++  nsISecurityWarningDialogs* dialogs;
++
++  GetNSSDialogs(&dialogs);
+   if (!dialogs) return PR_FALSE;  // Should this allow PR_TRUE for unimplemented?
+ 
+-  nsCOMPtr<nsIInterfaceRequestor> ctx = new nsUIContext(mWindow);
++  nsIInterfaceRequestor* ctx = new nsUIContext(mWindow);
+ 
+   PRBool confirms;
+   dialogs->ConfirmMixedMode(ctx, &confirms);
+@@ -1526,12 +1526,12 @@ ConfirmPostToInsecure()
+ {
+   nsresult rv;
+ 
+-  nsCOMPtr<nsISecurityWarningDialogs> dialogs;
+-
+-  GetNSSDialogs(getter_AddRefs(dialogs));
++  nsISecurityWarningDialogs* dialogs;
++
++  GetNSSDialogs(&dialogs);
+   if (!dialogs) return PR_FALSE;  // Should this allow PR_TRUE for unimplemented?
+ 
+-  nsCOMPtr<nsIInterfaceRequestor> ctx = new nsUIContext(mWindow);
++  nsIInterfaceRequestor* ctx = new nsUIContext(mWindow);
+ 
+   PRBool result;
+ 
+@@ -1551,12 +1551,12 @@ ConfirmPostToInsecureFromSecure()
+ {
+   nsresult rv;
+ 
+-  nsCOMPtr<nsISecurityWarningDialogs> dialogs;
+-
+-  GetNSSDialogs(getter_AddRefs(dialogs));
++  nsISecurityWarningDialogs* dialogs;
++
++  GetNSSDialogs(&dialogs);
+   if (!dialogs) return PR_FALSE;  // Should this allow PR_TRUE for unimplemented?
+ 
+-  nsCOMPtr<nsIInterfaceRequestor> ctx = new nsUIContext(mWindow);
++  nsIInterfaceRequestor* ctx = new nsUIContext(mWindow);
+ 
+   PRBool result;
+ 
+diff --git a/security/manager/boot/src/nsSecurityWarningDialogs.cpp b/security/manager/boot/src/nsSecurityWarningDialogs.cpp
+--- a/security/manager/boot/src/nsSecurityWarningDialogs.cpp
++++ b/security/manager/boot/src/nsSecurityWarningDialogs.cpp
+@@ -75,7 +75,7 @@ nsSecurityWarningDialogs::Init()
+   mPrefBranch = do_GetService(NS_PREFSERVICE_CONTRACTID, &rv);
+   if (NS_FAILED(rv)) return rv;
+ 
+-  nsCOMPtr<nsIStringBundleService> service =
++  nsIStringBundleService* service =
+            do_GetService(NS_STRINGBUNDLE_CONTRACTID, &rv);
+   if (NS_FAILED(rv)) return rv;
+   
+@@ -168,7 +168,7 @@ nsSecurityWarningDialogs::AlertDialog(ns
+     prefValue = PR_FALSE;
+ 
+   // Get Prompt to use
+-  nsCOMPtr<nsIPrompt> prompt = do_GetInterface(ctx);
++  nsIPrompt* prompt = do_GetInterface(ctx);
+   if (!prompt) return NS_ERROR_FAILURE;
+ 
+   // Get messages strings from localization file
+@@ -254,7 +254,7 @@ nsSecurityWarningDialogs::ConfirmDialog(
+     prefValue = PR_FALSE;
+ 
+   // Get Prompt to use
+-  nsCOMPtr<nsIPrompt> prompt = do_GetInterface(ctx);
++  nsIPrompt* prompt = do_GetInterface(ctx);
+   if (!prompt) return NS_ERROR_FAILURE;
+ 
+   // Get messages strings from localization file
+diff --git a/security/manager/pki/src/nsASN1Tree.cpp b/security/manager/pki/src/nsASN1Tree.cpp
+--- a/security/manager/pki/src/nsASN1Tree.cpp
++++ b/security/manager/pki/src/nsASN1Tree.cpp
+@@ -99,8 +99,8 @@ void nsNSSASN1Tree::InitChildsRecursivel
+     return;
+   }
+ 
+-  nsCOMPtr<nsIMutableArray> asn1Objects;
+-  n->seq->GetASN1Objects(getter_AddRefs(asn1Objects));
++  nsIMutableArray* asn1Objects;
++  n->seq->GetASN1Objects(&asn1Objects);
+   PRUint32 numObjects;
+   asn1Objects->GetLength(&numObjects);
+   
+@@ -113,7 +113,7 @@ void nsNSSASN1Tree::InitChildsRecursivel
+   myNode *prev = nsnull;
+   
+   PRUint32 i;
+-  nsCOMPtr<nsISupports> isupports;
++  nsISupports* isupports;
+   for (i=0; i<numObjects; i++) {
+     if (0 == i) {
+       n->child = walk = new myNode;
+diff --git a/security/manager/pki/src/nsFormSigningDialog.cpp b/security/manager/pki/src/nsFormSigningDialog.cpp
+--- a/security/manager/pki/src/nsFormSigningDialog.cpp
++++ b/security/manager/pki/src/nsFormSigningDialog.cpp
+@@ -67,10 +67,10 @@ nsFormSigningDialog::ConfirmSignText(nsI
+   *aCanceled = PR_TRUE;
+ 
+   // Get the parent window for the dialog
+-  nsCOMPtr<nsIDOMWindowInternal> parent = do_GetInterface(aContext);
++  nsIDOMWindowInternal* parent = do_GetInterface(aContext);
+ 
+   nsresult rv;
+-  nsCOMPtr<nsIDialogParamBlock> block =
++  nsIDialogParamBlock* block =
+     do_CreateInstance(NS_DIALOGPARAMBLOCK_CONTRACTID, &rv);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+diff --git a/security/manager/pki/src/nsNSSDialogHelper.cpp b/security/manager/pki/src/nsNSSDialogHelper.cpp
+--- a/security/manager/pki/src/nsNSSDialogHelper.cpp
++++ b/security/manager/pki/src/nsNSSDialogHelper.cpp
+@@ -55,29 +55,29 @@ nsNSSDialogHelper::openDialog(
+     nsISupports *params)
+ {
+   nsresult rv;
+-  nsCOMPtr<nsIWindowWatcher> windowWatcher = 
++  nsIWindowWatcher* windowWatcher = 
+            do_GetService(NS_WINDOWWATCHER_CONTRACTID, &rv);
+   if (NS_FAILED(rv)) return rv;
+ 
+   nsIDOMWindowInternal *parent = window;
+ 
+-  nsCOMPtr<nsIDOMWindowInternal> activeParent;
++  nsIDOMWindowInternal* activeParent;
+   if (!parent) {
+-    nsCOMPtr<nsIDOMWindow> active;
+-    windowWatcher->GetActiveWindow(getter_AddRefs(active));
++    nsIDOMWindow* active;
++    windowWatcher->GetActiveWindow(&active);
+     if (active) {
+-      active->QueryInterface(NS_GET_IID(nsIDOMWindowInternal), getter_AddRefs(activeParent));
++      active->QueryInterface(NS_GET_IID(nsIDOMWindowInternal), (void**)&activeParent);
+       parent = activeParent;
+     }
+   }
+ 
+-  nsCOMPtr<nsIDOMWindow> newWindow;
++  nsIDOMWindow* newWindow;
+   rv = windowWatcher->OpenWindow(parent,
+                                  url,
+                                  "_blank",
+                                  nsNSSDialogHelper::kDefaultOpenWindowParam,
+                                  params,
+-                                 getter_AddRefs(newWindow));
++                                 &newWindow);
+   return rv;
+ }
+ 
+diff --git a/security/manager/pki/src/nsNSSDialogs.cpp b/security/manager/pki/src/nsNSSDialogs.cpp
+--- a/security/manager/pki/src/nsNSSDialogs.cpp
++++ b/security/manager/pki/src/nsNSSDialogs.cpp
+@@ -91,7 +91,7 @@ nsNSSDialogs::Init()
+ {
+   nsresult rv;
+ 
+-  nsCOMPtr<nsIStringBundleService> service =
++  nsIStringBundleService* service =
+            do_GetService(NS_STRINGBUNDLE_CONTRACTID, &rv);
+   if (NS_FAILED(rv)) return rv;
+   
+@@ -109,9 +109,9 @@ nsNSSDialogs::SetPassword(nsIInterfaceRe
+   *_canceled = PR_FALSE;
+ 
+   // Get the parent window for the dialog
+-  nsCOMPtr<nsIDOMWindowInternal> parent = do_GetInterface(ctx);
+-
+-  nsCOMPtr<nsIDialogParamBlock> block =
++  nsIDOMWindowInternal* parent = do_GetInterface(ctx);
++
++  nsIDialogParamBlock* block =
+            do_CreateInstance(NS_DIALOGPARAMBLOCK_CONTRACTID);
+   if (!block) return NS_ERROR_FAILURE;
+ 
+@@ -144,8 +144,8 @@ nsNSSDialogs::GetPassword(nsIInterfaceRe
+   nsresult rv;
+   *_canceled = PR_FALSE;
+   // Get the parent window for the dialog
+-  nsCOMPtr<nsIDOMWindowInternal> parent = do_GetInterface(ctx);
+-  nsCOMPtr<nsIDialogParamBlock> block = 
++  nsIDOMWindowInternal* parent = do_GetInterface(ctx);
++  nsIDialogParamBlock* block = 
+            do_CreateInstance(NS_DIALOGPARAMBLOCK_CONTRACTID);
+   if (!block) return NS_ERROR_FAILURE;
+   // Set the token name in the window
+@@ -173,7 +173,7 @@ nsNSSDialogs::CrlImportStatusDialog(nsII
+ {
+   nsresult rv;
+ 
+-  nsCOMPtr<nsIPKIParamBlock> block =
++  nsIPKIParamBlock* block =
+            do_CreateInstance(NS_PKIPARAMBLOCK_CONTRACTID,&rv);
+   if (NS_FAILED(rv))
+     return rv;
+@@ -199,9 +199,9 @@ nsNSSDialogs::ConfirmDownloadCACert(nsII
+   *_retval = PR_TRUE;
+ 
+   // Get the parent window for the dialog
+-  nsCOMPtr<nsIDOMWindowInternal> parent = do_GetInterface(ctx);
+-
+-  nsCOMPtr<nsIPKIParamBlock> block =
++  nsIDOMWindowInternal* parent = do_GetInterface(ctx);
++
++  nsIPKIParamBlock* block =
+            do_CreateInstance(NS_PKIPARAMBLOCK_CONTRACTID);
+   if (!block)
+     return NS_ERROR_FAILURE;
+@@ -218,7 +218,7 @@ nsNSSDialogs::ConfirmDownloadCACert(nsII
+   PRInt32 status;
+   PRInt32 ssl, email, objsign;
+ 
+-  nsCOMPtr<nsIDialogParamBlock> dlgParamBlock = do_QueryInterface(block);
++  nsIDialogParamBlock* dlgParamBlock = do_QueryInterface(block);
+   
+   rv = dlgParamBlock->GetInt(1, &status);
+   if (NS_FAILED(rv)) return rv;
+@@ -246,9 +246,9 @@ nsNSSDialogs::NotifyCACertExists(nsIInte
+   nsresult rv;
+ 
+   // Get the parent window for the dialog
+-  nsCOMPtr<nsIDOMWindowInternal> parent = do_GetInterface(ctx);
+-
+-  nsCOMPtr<nsIDialogParamBlock> block =
++  nsIDOMWindowInternal* parent = do_GetInterface(ctx);
++
++  nsIDialogParamBlock* block =
+            do_CreateInstance(NS_DIALOGPARAMBLOCK_CONTRACTID);
+   if (!block) return NS_ERROR_FAILURE;
+ 
+@@ -270,9 +270,9 @@ nsNSSDialogs::ChooseCertificate(nsIInter
+   *canceled = PR_FALSE;
+ 
+   // Get the parent window for the dialog
+-  nsCOMPtr<nsIDOMWindowInternal> parent = do_GetInterface(ctx);
+-
+-  nsCOMPtr<nsIDialogParamBlock> block =
++  nsIDOMWindowInternal* parent = do_GetInterface(ctx);
++
++  nsIDialogParamBlock* block =
+            do_CreateInstance(NS_DIALOGPARAMBLOCK_CONTRACTID);
+   if (!block) return NS_ERROR_FAILURE;
+ 
+@@ -333,9 +333,9 @@ nsNSSDialogs::PickCertificate(nsIInterfa
+   *canceled = PR_FALSE;
+ 
+   // Get the parent window for the dialog
+-  nsCOMPtr<nsIDOMWindowInternal> parent = do_GetInterface(ctx);
+-
+-  nsCOMPtr<nsIDialogParamBlock> block =
++  nsIDOMWindowInternal* parent = do_GetInterface(ctx);
++
++  nsIDialogParamBlock* block =
+            do_CreateInstance(NS_DIALOGPARAMBLOCK_CONTRACTID);
+   if (!block) return NS_ERROR_FAILURE;
+ 
+@@ -383,8 +383,8 @@ nsNSSDialogs::SetPKCS12FilePassword(nsII
+   nsresult rv;
+   *_retval = PR_TRUE;
+   // Get the parent window for the dialog
+-  nsCOMPtr<nsIDOMWindowInternal> parent = do_GetInterface(ctx);
+-  nsCOMPtr<nsIDialogParamBlock> block =
++  nsIDOMWindowInternal* parent = do_GetInterface(ctx);
++  nsIDialogParamBlock* block =
+            do_CreateInstance(NS_DIALOGPARAMBLOCK_CONTRACTID);
+   if (!block) return NS_ERROR_FAILURE;
+   // open up the window
+@@ -417,8 +417,8 @@ nsNSSDialogs::GetPKCS12FilePassword(nsII
+   nsresult rv;
+   *_retval = PR_TRUE;
+   // Get the parent window for the dialog
+-  nsCOMPtr<nsIDOMWindowInternal> parent = do_GetInterface(ctx);
+-  nsCOMPtr<nsIDialogParamBlock> block =
++  nsIDOMWindowInternal* parent = do_GetInterface(ctx);
++  nsIDialogParamBlock* block =
+            do_CreateInstance(NS_DIALOGPARAMBLOCK_CONTRACTID);
+   if (!block) return NS_ERROR_FAILURE;
+   // open up the window
+@@ -450,7 +450,7 @@ nsNSSDialogs::ViewCert(nsIInterfaceReque
+ {
+   nsresult rv;
+ 
+-  nsCOMPtr<nsIPKIParamBlock> block =
++  nsIPKIParamBlock* block =
+            do_CreateInstance(NS_PKIPARAMBLOCK_CONTRACTID);
+   if (!block)
+     return NS_ERROR_FAILURE;
+@@ -460,7 +460,7 @@ nsNSSDialogs::ViewCert(nsIInterfaceReque
+     return rv;
+ 
+   // Get the parent window for the dialog
+-  nsCOMPtr<nsIDOMWindowInternal> parent = do_GetInterface(ctx);
++  nsIDOMWindowInternal* parent = do_GetInterface(ctx);
+ 
+   rv = nsNSSDialogHelper::openDialog(parent,
+                                      "chrome://pippki/content/certViewer.xul",
+@@ -474,7 +474,7 @@ nsNSSDialogs::DisplayGeneratingKeypairIn
+   nsresult rv;
+ 
+   // Get the parent window for the dialog
+-  nsCOMPtr<nsIDOMWindowInternal> parent = do_GetInterface(aCtx);
++  nsIDOMWindowInternal* parent = do_GetInterface(aCtx);
+ 
+   rv = nsNSSDialogHelper::openDialog(parent,
+                                      "chrome://pippki/content/createCertInfo.xul",
+@@ -490,9 +490,9 @@ nsNSSDialogs::ChooseToken(nsIInterfaceRe
+   *aCanceled = PR_FALSE;
+ 
+   // Get the parent window for the dialog
+-  nsCOMPtr<nsIDOMWindowInternal> parent = do_GetInterface(aCtx);
+-
+-  nsCOMPtr<nsIDialogParamBlock> block =
++  nsIDOMWindowInternal* parent = do_GetInterface(aCtx);
++
++  nsIDialogParamBlock* block =
+            do_CreateInstance(NS_DIALOGPARAMBLOCK_CONTRACTID);
+   if (!block) return NS_ERROR_FAILURE;
+ 
+@@ -533,7 +533,7 @@ nsNSSDialogs::ConfirmKeyEscrow(nsIX509Ce
+ 
+   nsresult rv;
+ 
+-  nsCOMPtr<nsIPKIParamBlock> block =
++  nsIPKIParamBlock* block =
+            do_CreateInstance(NS_PKIPARAMBLOCK_CONTRACTID);
+   if (!block)
+     return NS_ERROR_FAILURE;
+@@ -550,7 +550,7 @@ nsNSSDialogs::ConfirmKeyEscrow(nsIX509Ce
+     return rv;
+ 
+   PRInt32 status=0;
+-  nsCOMPtr<nsIDialogParamBlock> dlgParamBlock = do_QueryInterface(block);
++  nsIDialogParamBlock* dlgParamBlock = do_QueryInterface(block);
+   rv = dlgParamBlock->GetInt(1, &status);
+  
+   if (status) {
+diff --git a/security/manager/ssl/src/nsCMS.cpp b/security/manager/ssl/src/nsCMS.cpp
+--- a/security/manager/ssl/src/nsCMS.cpp
++++ b/security/manager/ssl/src/nsCMS.cpp
+@@ -529,7 +529,7 @@ NS_IMETHODIMP nsCMSMessage::CreateEncryp
+   SECOidTag bulkAlgTag;
+   int keySize;
+   PRUint32 i;
+-  nsCOMPtr<nsIX509Cert2> nssRecipientCert;
++  nsIX509Cert2* nssRecipientCert;
+   nsresult rv = NS_ERROR_FAILURE;
+ 
+   // Check the recipient certificates //
+@@ -542,7 +542,7 @@ NS_IMETHODIMP nsCMSMessage::CreateEncryp
+   }
+ 
+   for (i=0; i<recipientCertCount; i++) {
+-    nsCOMPtr<nsIX509Cert> x509cert = do_QueryElementAt(aRecipientCerts, i);
++    nsIX509Cert* x509cert = do_QueryElementAt(aRecipientCerts, i);
+ 
+     nssRecipientCert = do_QueryInterface(x509cert);
+ 
+@@ -621,7 +621,7 @@ NS_IMETHODIMP nsCMSMessage::CreateSigned
+   NSSCMSSignedData *sigd;
+   NSSCMSSignerInfo *signerinfo;
+   CERTCertificate *scert = nsnull, *ecert = nsnull;
+-  nsCOMPtr<nsIX509Cert2> aSigningCert2 = do_QueryInterface(aSigningCert);
++  nsIX509Cert2* aSigningCert2 = do_QueryInterface(aSigningCert);
+   nsresult rv = NS_ERROR_FAILURE;
+ 
+   /* Get the certs */
+@@ -633,7 +633,7 @@ NS_IMETHODIMP nsCMSMessage::CreateSigned
+   }
+ 
+   if (aEncryptCert) {
+-    nsCOMPtr<nsIX509Cert2> aEncryptCert2 = do_QueryInterface(aEncryptCert);
++    nsIX509Cert2* aEncryptCert2 = do_QueryInterface(aEncryptCert);
+     if (aEncryptCert2) {
+       ecert = aEncryptCert2->GetCert();
+     }
+diff --git a/security/manager/ssl/src/nsCMSSecureMessage.cpp b/security/manager/ssl/src/nsCMSSecureMessage.cpp
+--- a/security/manager/ssl/src/nsCMSSecureMessage.cpp
++++ b/security/manager/ssl/src/nsCMSSecureMessage.cpp
+@@ -93,11 +93,11 @@ GetCertByPrefID(const char *certID, char
+   nsresult rv = NS_OK;
+   CERTCertificate *cert = 0;
+   nsXPIDLCString nickname;
+-  nsCOMPtr<nsIInterfaceRequestor> ctx = new PipUIContext();
++  nsIInterfaceRequestor* ctx = new PipUIContext();
+ 
+   *_retval = 0;
+ 
+-  nsCOMPtr<nsIPrefBranch> prefs = do_GetService(NS_PREFSERVICE_CONTRACTID, &rv);
++  nsIPrefBranch* prefs = do_GetService(NS_PREFSERVICE_CONTRACTID, &rv);
+   if (NS_FAILED(rv)) {
+     goto done;
+   }
+@@ -145,7 +145,7 @@ DecodeCert(const char *value, nsIX509Cer
+     return rv;
+   }
+ 
+-  nsCOMPtr<nsIX509Cert> cert =  nsNSSCertificate::ConstructFromDER((char *)data, length);
++  nsIX509Cert* cert =  nsNSSCertificate::ConstructFromDER((char *)data, length);
+ 
+   if (cert) {
+     *_retval = cert;
+@@ -176,7 +176,7 @@ SendMessage(const char *msg, const char 
+   SECItem output;
+   PLArenaPool *arena = PORT_NewArena(1024);
+   SECStatus s;
+-  nsCOMPtr<nsIInterfaceRequestor> ctx = new PipUIContext();
++  nsIInterfaceRequestor* ctx = new PipUIContext();
+ 
+   /* Step 0. Create a CMS Message */
+   cmsMsg = NSS_CMSMessage_Create(NULL);
+@@ -301,7 +301,7 @@ ReceiveMessage(const char *msg, char **_
+   PRInt32 derLen;
+   NSSCMSMessage *cmsMsg = 0;
+   SECItem *content;
+-  nsCOMPtr<nsIInterfaceRequestor> ctx = new PipUIContext();
++  nsIInterfaceRequestor* ctx = new PipUIContext();
+ 
+   /* Step 1. Decode the base64 wrapper */
+   rv = decode(msg, &der, &derLen);
+diff --git a/security/manager/ssl/src/nsCRLInfo.cpp b/security/manager/ssl/src/nsCRLInfo.cpp
+--- a/security/manager/ssl/src/nsCRLInfo.cpp
++++ b/security/manager/ssl/src/nsCRLInfo.cpp
+@@ -94,7 +94,7 @@ nsCRLInfo::nsCRLInfo(CERTSignedCrl *sign
+     PORT_Free(ou);
+   }
+   
+-  nsCOMPtr<nsIDateTimeFormat> dateFormatter = do_CreateInstance(NS_DATETIMEFORMAT_CONTRACTID);
++  nsIDateTimeFormat* dateFormatter = do_CreateInstance(NS_DATETIMEFORMAT_CONTRACTID);
+   
+   // Last Update time
+   if (crl->lastUpdate.len) {
+diff --git a/security/manager/ssl/src/nsCRLManager.cpp b/security/manager/ssl/src/nsCRLManager.cpp
+--- a/security/manager/ssl/src/nsCRLManager.cpp
++++ b/security/manager/ssl/src/nsCRLManager.cpp
+@@ -93,12 +93,12 @@ nsCRLManager::ImportCrl (PRUint8 *aData,
+   SECStatus sec_rv;
+   CERTSignedCrl *crl;
+   nsCAutoString url;
+-  nsCOMPtr<nsICRLInfo> crlData;
++  nsICRLInfo* crlData;
+   PRBool importSuccessful;
+   PRInt32 errorCode;
+   nsString errorMessage;
+   
+-  nsCOMPtr<nsINSSComponent> nssComponent(do_GetService(kNSSComponentCID, &rv));
++  nsINSSComponent* nssComponent(do_GetService(kNSSComponentCID, &rv));
+   if (NS_FAILED(rv)) return rv;
+ 	         
+   aURI->GetSpec(url);
+@@ -184,10 +184,10 @@ done:
+     if (!importSuccessful){
+       nsString message;
+       nsString temp;
+-      nsCOMPtr<nsIWindowWatcher> wwatch(do_GetService(NS_WINDOWWATCHER_CONTRACTID));
+-      nsCOMPtr<nsIPrompt> prompter;
++      nsIWindowWatcher* wwatch(do_GetService(NS_WINDOWWATCHER_CONTRACTID));
++      nsIPrompt* prompter;
+       if (wwatch){
+-        wwatch->GetNewPrompter(0, getter_AddRefs(prompter));
++        wwatch->GetNewPrompter(0, &prompter);
+         nssComponent->GetPIPNSSBundleString("CrlImportFailure1x", message);
+         message.Append(NS_LITERAL_STRING("\n").get());
+         message.Append(errorMessage);
+@@ -203,7 +203,7 @@ done:
+         }
+       }
+     } else {
+-      nsCOMPtr<nsICertificateDialogs> certDialogs;
++      nsICertificateDialogs* certDialogs;
+       // Not being able to display the success dialog should not
+       // be a fatal error, so don't return a failure code.
+       {
+@@ -212,12 +212,12 @@ done:
+           rv = NS_ERROR_NOT_AVAILABLE;
+         }
+         else {
+-          rv = ::getNSSDialogs(getter_AddRefs(certDialogs),
++          rv = ::getNSSDialogs((void**)&certDialogs,
+             NS_GET_IID(nsICertificateDialogs), NS_CERTIFICATEDIALOGS_CONTRACTID);
+         }
+       }
+       if (NS_SUCCEEDED(rv)) {
+-        nsCOMPtr<nsIInterfaceRequestor> cxt = new PipUIContext();
++        nsIInterfaceRequestor* cxt = new PipUIContext();
+         certDialogs->CrlImportStatusDialog(cxt, crlData);
+       }
+     }
+@@ -225,8 +225,8 @@ done:
+     if(crlKey == nsnull){
+       return NS_ERROR_FAILURE;
+     }
+-    nsCOMPtr<nsIPrefService> prefSvc = do_GetService(NS_PREFSERVICE_CONTRACTID,&rv);
+-    nsCOMPtr<nsIPrefBranch> pref = do_GetService(NS_PREFSERVICE_CONTRACTID,&rv);
++    nsIPrefService* prefSvc = do_GetService(NS_PREFSERVICE_CONTRACTID,&rv);
++    nsIPrefBranch* pref = do_GetService(NS_PREFSERVICE_CONTRACTID,&rv);
+     if (NS_FAILED(rv)){
+       return rv;
+     }
+@@ -316,7 +316,7 @@ nsCRLManager::UpdateCRLFromURL( const PR
+   nsresult rv;
+   nsAutoString downloadUrl(url);
+   nsAutoString dbKey(key);
+-  nsCOMPtr<nsINSSComponent> nssComponent(do_GetService(kNSSComponentCID, &rv));
++  nsINSSComponent* nssComponent(do_GetService(kNSSComponentCID, &rv));
+   if(NS_FAILED(rv)){
+     *res = PR_FALSE;
+     return rv;
+@@ -336,7 +336,7 @@ nsCRLManager::RescheduleCRLAutoUpdate(vo
+ nsCRLManager::RescheduleCRLAutoUpdate(void)
+ {
+   nsresult rv;
+-  nsCOMPtr<nsINSSComponent> nssComponent(do_GetService(kNSSComponentCID, &rv));
++  nsINSSComponent* nssComponent(do_GetService(kNSSComponentCID, &rv));
+   if(NS_FAILED(rv)){
+     return rv;
+   }
+@@ -358,7 +358,7 @@ nsCRLManager::GetCrls(nsIArray ** aCrls)
+   CERTCrlHeadNode *head = nsnull;
+   CERTCrlNode *node = nsnull;
+   nsresult rv;
+-  nsCOMPtr<nsIMutableArray> crlsArray =
++  nsIMutableArray* crlsArray =
+     do_CreateInstance(NS_ARRAY_CONTRACTID, &rv);
+   if (NS_FAILED(rv)) {
+     return rv;
+@@ -373,7 +373,7 @@ nsCRLManager::GetCrls(nsIArray ** aCrls)
+   if (head) {
+     for (node=head->first; node != nsnull; node = node->next) {
+ 
+-      nsCOMPtr<nsICRLInfo> entry = new nsCRLInfo((node->crl));
++      nsICRLInfo* entry = new nsCRLInfo((node->crl));
+       crlsArray->AppendElement(entry, PR_FALSE);
+     }
+     PORT_FreeArena(head->arena, PR_FALSE);
+@@ -486,7 +486,7 @@ nsCRLManager::ComputeNextAutoUpdateTime(
+ 
+   nsAutoString nextAutoUpdateDate;
+   PRExplodedTime explodedTime;
+-  nsCOMPtr<nsIDateTimeFormat> dateFormatter = do_CreateInstance(NS_DATETIMEFORMAT_CONTRACTID, &rv);
++  nsIDateTimeFormat* dateFormatter = do_CreateInstance(NS_DATETIMEFORMAT_CONTRACTID, &rv);
+   if (NS_FAILED(rv))
+     return rv;
+   PR_ExplodeTime(tempTime, PR_GMTParameters, &explodedTime);
+diff --git a/security/manager/ssl/src/nsCertOverrideService.cpp b/security/manager/ssl/src/nsCertOverrideService.cpp
+--- a/security/manager/ssl/src/nsCertOverrideService.cpp
++++ b/security/manager/ssl/src/nsCertOverrideService.cpp
+@@ -151,7 +151,7 @@ nsCertOverrideService::Init()
+ 
+   Read();
+ 
+-  nsCOMPtr<nsIObserverService> mObserverService = 
++  nsIObserverService* mObserverService = 
+     do_GetService("@mozilla.org/observer-service;1");
+ 
+   if (mObserverService) {
+@@ -216,13 +216,13 @@ nsCertOverrideService::Read()
+   nsAutoMonitor lock(monitor);
+ 
+   nsresult rv;
+-  nsCOMPtr<nsIInputStream> fileInputStream;
+-  rv = NS_NewLocalFileInputStream(getter_AddRefs(fileInputStream), mSettingsFile);
++  nsIInputStream* fileInputStream;
++  rv = NS_NewLocalFileInputStream(&fileInputStream, mSettingsFile);
+   if (NS_FAILED(rv)) {
+     return rv;
+   }
+ 
+-  nsCOMPtr<nsILineInputStream> lineInputStream = do_QueryInterface(fileInputStream, &rv);
++  nsILineInputStream* lineInputStream = do_QueryInterface(fileInputStream, &rv);
+   if (NS_FAILED(rv)) {
+     return rv;
+   }
+@@ -321,8 +321,8 @@ nsCertOverrideService::Write()
+   }
+ 
+   nsresult rv;
+-  nsCOMPtr<nsIOutputStream> fileOutputStream;
+-  rv = NS_NewSafeLocalFileOutputStream(getter_AddRefs(fileOutputStream),
++  nsIOutputStream* fileOutputStream;
++  rv = NS_NewSafeLocalFileOutputStream(&fileOutputStream,
+                                        mSettingsFile,
+                                        -1,
+                                        0600);
+@@ -332,8 +332,8 @@ nsCertOverrideService::Write()
+   }
+ 
+   // get a buffered output stream 4096 bytes big, to optimize writes
+-  nsCOMPtr<nsIOutputStream> bufferedOutputStream;
+-  rv = NS_NewBufferedOutputStream(getter_AddRefs(bufferedOutputStream), fileOutputStream, 4096);
++  nsIOutputStream* bufferedOutputStream;
++  rv = NS_NewBufferedOutputStream(&bufferedOutputStream, fileOutputStream, 4096);
+   if (NS_FAILED(rv)) {
+     return rv;
+   }
+@@ -351,7 +351,7 @@ nsCertOverrideService::Write()
+ 
+   // All went ok. Maybe except for problems in Write(), but the stream detects
+   // that for us
+-  nsCOMPtr<nsISafeOutputStream> safeStream = do_QueryInterface(bufferedOutputStream);
++  nsISafeOutputStream* safeStream = do_QueryInterface(bufferedOutputStream);
+   NS_ASSERTION(safeStream, "expected a safe output stream!");
+   if (safeStream) {
+     rv = safeStream->Finish();
+@@ -370,7 +370,7 @@ GetCertFingerprintByOidTag(CERTCertifica
+                            nsCString &fp)
+ {
+   unsigned int hash_len = HASH_ResultLenByOidTag(aOidTag);
+-  nsRefPtr<nsStringBuffer> fingerprint = nsStringBuffer::Alloc(hash_len);
++  nsStringBuffer* fingerprint = nsStringBuffer::Alloc(hash_len);
+   if (!fingerprint)
+     return NS_ERROR_OUT_OF_MEMORY;
+ 
+@@ -390,7 +390,7 @@ GetCertFingerprintByOidTag(nsIX509Cert *
+                            SECOidTag aOidTag, 
+                            nsCString &fp)
+ {
+-  nsCOMPtr<nsIX509Cert2> cert2 = do_QueryInterface(aCert);
++  nsIX509Cert2* cert2 = do_QueryInterface(aCert);
+   if (!cert2)
+     return NS_ERROR_FAILURE;
+ 
+@@ -530,7 +530,7 @@ GetCertFingerprintByDottedOidString(nsIX
+                                     const nsCString &dottedOid, 
+                                     nsCString &fp)
+ {
+-  nsCOMPtr<nsIX509Cert2> cert2 = do_QueryInterface(aCert);
++  nsIX509Cert2* cert2 = do_QueryInterface(aCert);
+   if (!cert2)
+     return NS_ERROR_FAILURE;
+ 
+@@ -551,7 +551,7 @@ nsCertOverrideService::RememberValidityO
+   if (aHostNameWithPort.IsEmpty())
+     return NS_ERROR_INVALID_ARG;
+ 
+-  nsCOMPtr<nsIX509Cert2> cert2 = do_QueryInterface(aCert);
++  nsIX509Cert2* cert2 = do_QueryInterface(aCert);
+   if (!cert2)
+     return NS_ERROR_FAILURE;
+ 
+diff --git a/security/manager/ssl/src/nsCertPicker.cpp b/security/manager/ssl/src/nsCertPicker.cpp
+--- a/security/manager/ssl/src/nsCertPicker.cpp
++++ b/security/manager/ssl/src/nsCertPicker.cpp
+@@ -82,7 +82,7 @@ NS_IMETHODIMP nsCertPicker::PickByUsage(
+   {
+     // Iterate over all certs. This assures that user is logged in to all hardware tokens.
+     CERTCertList *allcerts = nsnull;
+-    nsCOMPtr<nsIInterfaceRequestor> ctx = new PipUIContext();
++    nsIInterfaceRequestor* ctx = new PipUIContext();
+     allcerts = PK11_ListCerts(PK11CertListUnique, ctx);
+     CERT_DestroyCertList(allcerts);
+   }
+diff --git a/security/manager/ssl/src/nsCertTree.cpp b/security/manager/ssl/src/nsCertTree.cpp
+--- a/security/manager/ssl/src/nsCertTree.cpp
++++ b/security/manager/ssl/src/nsCertTree.cpp
+@@ -245,11 +245,11 @@ nsCertTree::CountOrganizations()
+   PRUint32 i, certCount;
+   certCount = mDispInfo.Length();
+   if (certCount == 0) return 0;
+-  nsCOMPtr<nsIX509Cert> orgCert = nsnull;
++  nsIX509Cert* orgCert = nsnull;
+   if (mDispInfo.ElementAt(0)->mAddonInfo) {
+     orgCert = mDispInfo.ElementAt(0)->mAddonInfo->mCert;
+   }
+-  nsCOMPtr<nsIX509Cert> nextCert = nsnull;
++  nsIX509Cert* nextCert = nsnull;
+   PRInt32 orgCount = 1;
+   for (i=1; i<certCount; i++) {
+     nextCert = nsnull;
+@@ -293,7 +293,7 @@ nsIX509Cert *
+ nsIX509Cert *
+ nsCertTree::GetCertAtIndex(PRInt32 index, PRInt32 *outAbsoluteCertOffset)
+ {
+-  nsRefPtr<nsCertTreeDispInfo> certdi =
++  nsCertTreeDispInfo* certdi =
+     getter_AddRefs(GetDispInfoAtIndex(index, outAbsoluteCertOffset));
+   if (!certdi)
+     return nsnull;
+@@ -321,9 +321,9 @@ nsCertTree::GetDispInfoAtIndex(PRInt32 i
+       PRInt32 certIndex = cIndex + index - idx;
+       if (outAbsoluteCertOffset)
+         *outAbsoluteCertOffset = certIndex;
+-      nsRefPtr<nsCertTreeDispInfo> certdi = mDispInfo.ElementAt(certIndex);
++      nsCertTreeDispInfo* certdi = mDispInfo.ElementAt(certIndex);
+       if (certdi) {
+-        nsCertTreeDispInfo *raw = certdi.get();
++        nsCertTreeDispInfo *raw = certdi;
+         return raw;
+       }
+       break;
+@@ -549,7 +549,7 @@ nsCertTree::GetCertsByTypeFromCertList(C
+       }
+     }
+ 
+-    nsCOMPtr<nsIX509Cert> pipCert = new nsNSSCertificate(node->cert);
++    nsIX509Cert* pipCert = new nsNSSCertificate(node->cert);
+     if (!pipCert)
+       return NS_ERROR_OUT_OF_MEMORY;
+ 
+@@ -572,7 +572,7 @@ nsCertTree::GetCertsByTypeFromCertList(C
+       }
+     }
+ 
+-    nsRefPtr<nsCertAddonInfo> certai = new nsCertAddonInfo;
++    nsCertAddonInfo* certai = new nsCertAddonInfo;
+     if (!certai)
+       return NS_ERROR_OUT_OF_MEMORY;
+ 
+@@ -582,8 +582,8 @@ nsCertTree::GetCertsByTypeFromCertList(C
+     if (wantThisCert || addOverrides) {
+       int InsertPosition = 0;
+       for (; InsertPosition < count; ++InsertPosition) {
+-        nsCOMPtr<nsIX509Cert> cert = nsnull;
+-        nsRefPtr<nsCertTreeDispInfo> elem = mDispInfo.ElementAt(InsertPosition);
++        nsIX509Cert* cert = nsnull;
++        nsCertTreeDispInfo* elem = mDispInfo.ElementAt(InsertPosition);
+         if (elem->mAddonInfo) {
+           cert = mDispInfo.ElementAt(InsertPosition)->mAddonInfo->mCert;
+         }
+@@ -638,7 +638,7 @@ nsCertTree::GetCertsByType(PRUint32     
+ {
+   nsNSSShutDownPreventionLock locker;
+   CERTCertList *certList = NULL;
+-  nsCOMPtr<nsIInterfaceRequestor> cxt = new PipUIContext();
++  nsIInterfaceRequestor* cxt = new PipUIContext();
+   certList = PK11_ListCerts(PK11CertListUnique, cxt);
+   nsresult rv = GetCertsByTypeFromCertList(certList, aType, aCertCmpFn, aCertCmpFnArg);
+   if (certList)
+@@ -712,7 +712,7 @@ nsCertTree::UpdateUIContents()
+ 
+ if (count) {
+   PRUint32 j = 0;
+-  nsCOMPtr<nsIX509Cert> orgCert = nsnull;
++  nsIX509Cert* orgCert = nsnull;
+   if (mDispInfo.ElementAt(j)->mAddonInfo) {
+     orgCert = mDispInfo.ElementAt(j)->mAddonInfo->mCert;
+   }
+@@ -730,7 +730,7 @@ if (count) {
+     mTreeArray[i].certIndex = j;
+     mTreeArray[i].numChildren = 1;
+     if (++j >= count) break;
+-    nsCOMPtr<nsIX509Cert> nextCert = nsnull;
++    nsIX509Cert* nextCert = nsnull;
+     if (mDispInfo.ElementAt(j)->mAddonInfo) {
+       nextCert = mDispInfo.ElementAt(j)->mAddonInfo->mCert;
+     }
+@@ -762,7 +762,7 @@ nsCertTree::DeleteEntryObject(PRUint32 i
+     return NS_ERROR_FAILURE;
+   }
+ 
+-  nsCOMPtr<nsIX509CertDB> certdb = 
++  nsIX509CertDB* certdb = 
+     do_GetService("@mozilla.org/security/x509certdb;1");
+   if (!certdb) {
+     return NS_ERROR_FAILURE;
+@@ -779,8 +779,8 @@ nsCertTree::DeleteEntryObject(PRUint32 i
+     if (index < idx + nc) { // cert is within range of this thread
+       PRInt32 certIndex = cIndex + index - idx;
+ 
+-      nsRefPtr<nsCertTreeDispInfo> certdi = mDispInfo.ElementAt(certIndex);
+-      nsCOMPtr<nsIX509Cert> cert = nsnull;
++      nsCertTreeDispInfo* certdi = mDispInfo.ElementAt(certIndex);
++      nsIX509Cert* cert = nsnull;
+       if (certdi->mAddonInfo) {
+         cert = certdi->mAddonInfo->mCert;
+       }
+@@ -808,7 +808,7 @@ nsCertTree::DeleteEntryObject(PRUint32 i
+           CERTCertificate *nsscert = nsnull;
+           CERTCertificateCleaner nsscertCleaner(nsscert);
+ 
+-          nsCOMPtr<nsIX509Cert2> cert2 = do_QueryInterface(cert);
++          nsIX509Cert2* cert2 = do_QueryInterface(cert);
+           if (cert2) {
+             nsscert = cert2->GetCert();
+           }
+@@ -871,7 +871,7 @@ nsCertTree::GetTreeItem(PRUint32 aIndex,
+ {
+   NS_ENSURE_ARG(_treeitem);
+ 
+-  nsRefPtr<nsCertTreeDispInfo> certdi = 
++  nsCertTreeDispInfo* certdi = 
+     getter_AddRefs(GetDispInfoAtIndex(aIndex));
+   if (!certdi)
+     return NS_ERROR_FAILURE;
+@@ -885,7 +885,7 @@ nsCertTree::IsHostPortOverride(PRUint32 
+ {
+   NS_ENSURE_ARG(_retval);
+ 
+-  nsRefPtr<nsCertTreeDispInfo> certdi = 
++  nsCertTreeDispInfo* certdi = 
+     getter_AddRefs(GetDispInfoAtIndex(aIndex));
+   if (!certdi)
+     return NS_ERROR_FAILURE;
+@@ -1105,12 +1105,12 @@ nsCertTree::GetCellText(PRInt32 row, nsI
+   }
+ 
+   PRInt32 absoluteCertOffset;
+-  nsRefPtr<nsCertTreeDispInfo> certdi = 
++  nsCertTreeDispInfo* certdi = 
+     getter_AddRefs(GetDispInfoAtIndex(row, &absoluteCertOffset));
+   if (!certdi)
+     return NS_ERROR_FAILURE;
+ 
+-  nsCOMPtr<nsIX509Cert> cert = nsnull;
++  nsIX509Cert* cert = nsnull;
+   if (certdi->mAddonInfo) {
+     cert = certdi->mAddonInfo->mCert;
+   }
+@@ -1123,7 +1123,7 @@ nsCertTree::GetCellText(PRInt32 row, nsI
+     mCellText->GetLength(&arrayLength);
+   }
+   if (arrayIndex < arrayLength) {
+-    nsCOMPtr<nsISupportsString> myString(do_QueryElementAt(mCellText, arrayIndex));
++    nsISupportsString* myString(do_QueryElementAt(mCellText, arrayIndex));
+     if (myString) {
+       myString->GetData(_retval);
+       return NS_OK;
+@@ -1200,16 +1200,16 @@ nsCertTree::GetCellText(PRInt32 row, nsI
+         break;
+     }
+   } else if (NS_LITERAL_STRING("issuedcol").Equals(colID) && cert) {
+-    nsCOMPtr<nsIX509CertValidity> validity;
+-
+-    rv = cert->GetValidity(getter_AddRefs(validity));
++    nsIX509CertValidity* validity;
++
++    rv = cert->GetValidity(&validity);
+     if (NS_SUCCEEDED(rv)) {
+       validity->GetNotBeforeLocalDay(_retval);
+     }
+   } else if (NS_LITERAL_STRING("expiredcol").Equals(colID) && cert) {
+-    nsCOMPtr<nsIX509CertValidity> validity;
+-
+-    rv = cert->GetValidity(getter_AddRefs(validity));
++    nsIX509CertValidity* validity;
++
++    rv = cert->GetValidity(&validity);
+     if (NS_SUCCEEDED(rv)) {
+       validity->GetNotAfterLocalDay(_retval);
+     }
+@@ -1234,7 +1234,7 @@ nsCertTree::GetCellText(PRInt32 row, nsI
+       _retval = NS_LITERAL_STRING("*");
+     }
+   } else if (NS_LITERAL_STRING("typecol").Equals(colID) && cert) {
+-    nsCOMPtr<nsIX509Cert2> pipCert = do_QueryInterface(cert);
++    nsIX509Cert2* pipCert = do_QueryInterface(cert);
+     PRUint32 type = nsIX509Cert::UNKNOWN_CERT;
+ 
+     if (pipCert) {
+@@ -1263,7 +1263,7 @@ nsCertTree::GetCellText(PRInt32 row, nsI
+     return NS_ERROR_FAILURE;
+   }
+   if (mCellText) {
+-    nsCOMPtr<nsISupportsString> text(do_CreateInstance(NS_SUPPORTS_STRING_CONTRACTID, &rv));
++    nsISupportsString* text(do_CreateInstance(NS_SUPPORTS_STRING_CONTRACTID, &rv));
+     NS_ENSURE_SUCCESS(rv, rv);
+     text->SetData(_retval);
+     mCellText->ReplaceElementAt(text, arrayIndex, PR_FALSE);
+@@ -1460,10 +1460,10 @@ nsCertTree::CmpInitCriterion(nsIX509Cert
+     case sort_IssuedDateDescending:
+       {
+         nsresult rv;
+-        nsCOMPtr<nsIX509CertValidity> validity;
++        nsIX509CertValidity* validity;
+         PRTime notBefore;
+ 
+-        rv = cert->GetValidity(getter_AddRefs(validity));
++        rv = cert->GetValidity(&validity);
+         if (NS_SUCCEEDED(rv)) {
+           rv = validity->GetNotBefore(&notBefore);
+         }
+diff --git a/security/manager/ssl/src/nsCertVerificationThread.cpp b/security/manager/ssl/src/nsCertVerificationThread.cpp
+--- a/security/manager/ssl/src/nsCertVerificationThread.cpp
++++ b/security/manager/ssl/src/nsCertVerificationThread.cpp
+@@ -53,8 +53,8 @@ void nsCertVerificationJob::Run()
+   PRUint32 count;
+   PRUnichar **usages;
+ 
+-  nsCOMPtr<nsICertVerificationResult> ires;
+-  nsRefPtr<nsCertVerificationResult> vres = new nsCertVerificationResult;
++  nsICertVerificationResult* ires;
++  nsCertVerificationResult* vres = new nsCertVerificationResult;
+   if (vres)
+   {
+     nsresult rv = mCert->GetUsagesArray(PR_FALSE, // do not ignore OCSP
+@@ -72,7 +72,7 @@ void nsCertVerificationJob::Run()
+     ires = vres;
+   }
+   
+-  nsCOMPtr<nsIX509Cert3> c3 = do_QueryInterface(mCert);
++  nsIX509Cert3* c3 = do_QueryInterface(mCert);
+   mListener->Notify(c3, ires);
+ }
+ 
+@@ -88,7 +88,7 @@ void nsSMimeVerificationJob::Run()
+   else
+     rv = mMessage->VerifySignature();
+   
+-  nsCOMPtr<nsICMSMessage2> m2 = do_QueryInterface(mMessage);
++  nsICMSMessage2* m2 = do_QueryInterface(mMessage);
+   mListener->Notify(m2, rv);
+ }
+ 
+diff --git a/security/manager/ssl/src/nsCrypto.cpp b/security/manager/ssl/src/nsCrypto.cpp
+--- a/security/manager/ssl/src/nsCrypto.cpp
++++ b/security/manager/ssl/src/nsCrypto.cpp
+@@ -287,7 +287,7 @@ nsCrypto::SetEnableSmartCardEvents(PRBoo
+   // NSS) even if it isn't already going. Starting the nssComponent is a 
+   // prerequisite for getting smartCard events.
+   if (aEnable) {
+-    nsCOMPtr<nsINSSComponent> nssComponent(do_GetService(kNSSComponentCID, &rv));
++    nsINSSComponent* nssComponent(do_GetService(kNSSComponentCID, &rv));
+   }
+ 
+   if (NS_FAILED(rv)) {
+@@ -343,7 +343,7 @@ cryptojs_GetObjectPrincipal(JSContext *a
+                     privateNsISupports)
+     {
+       nsISupports *supports = (nsISupports *) JS_GetPrivate(aCx, parent);
+-      nsCOMPtr<nsIScriptObjectPrincipal> objPrin = do_QueryInterface(supports);
++      nsIScriptObjectPrincipal* objPrin = do_QueryInterface(supports);
+               
+       if (!objPrin)
+       {
+@@ -351,7 +351,7 @@ cryptojs_GetObjectPrincipal(JSContext *a
+          * If it's a wrapped native, check the underlying native
+          * instead.
+          */
+-        nsCOMPtr<nsIXPConnectWrappedNative> xpcNative = 
++        nsIXPConnectWrappedNative* xpcNative = 
+                                             do_QueryInterface(supports);
+ 
+         if (xpcNative) {
+@@ -400,7 +400,7 @@ cryptojs_GetFramePrincipal(JSContext *cx
+   return cryptojs_GetFunctionObjectPrincipal(cx, obj, principal);
+ }
+ 
+-already_AddRefed<nsIPrincipal>
++nsIPrincipal*
+ nsCrypto::GetScriptPrincipal(JSContext *cx)
+ {
+   JSStackFrame *fp = nsnull;
+@@ -420,7 +420,7 @@ nsCrypto::GetScriptPrincipal(JSContext *
+ 
+   if (scriptContext)
+   {
+-    nsCOMPtr<nsIScriptObjectPrincipal> globalData =
++    nsIScriptObjectPrincipal* globalData =
+       do_QueryInterface(scriptContext->GetGlobalObject());
+     NS_ENSURE_TRUE(globalData, nsnull);
+     principal = globalData->GetPrincipal();
+@@ -813,7 +813,7 @@ cryptojs_generateOneKeyPair(JSContext *c
+ {
+   nsIGeneratingKeypairInfoDialogs * dialogs;
+   nsKeygenThread *KeygenRunnable = 0;
+-  nsCOMPtr<nsIKeygenThread> runnable;
++  nsIKeygenThread* runnable;
+ 
+   PRUint32 mechanism = cryptojs_convert_to_mechanism(keyPairInfo->keyGenType);
+   void *keyGenParams = nsConvertToActualKeyGenParams(mechanism, params, 
+@@ -1921,12 +1921,12 @@ nsCrypto::GenerateCRMFRequest(nsIDOMCRMF
+   nsNSSShutDownPreventionLock locker;
+   *aReturn = nsnull;
+   nsresult nrv;
+-  nsCOMPtr<nsIXPConnect> xpc(do_GetService(nsIXPConnect::GetCID(), &nrv));
++  nsIXPConnect* xpc(do_GetService(nsIXPConnect::GetCID(), &nrv));
+   NS_ENSURE_SUCCESS(nrv, nrv);
+ 
+-  nsCOMPtr<nsIXPCNativeCallContext> ncc;
+-
+-  nrv = xpc->GetCurrentNativeCallContext(getter_AddRefs(ncc));
++  nsIXPCNativeCallContext* ncc;
++
++  nrv = xpc->GetCurrentNativeCallContext(&ncc);
+   NS_ENSURE_SUCCESS(nrv, nrv);
+ 
+   if (!ncc)
+@@ -1945,7 +1945,7 @@ nsCrypto::GenerateCRMFRequest(nsIDOMCRMF
+   ncc->GetJSContext(&cx);
+ 
+   JSObject* script_obj = nsnull;
+-  nsCOMPtr<nsIXPConnectJSObjectHolder> holder;
++  nsIXPConnectJSObjectHolder* holder;
+ 
+   JSAutoRequest ar(cx);
+ 
+@@ -1998,7 +1998,7 @@ nsCrypto::GenerateCRMFRequest(nsIDOMCRMF
+ 
+   nrv = xpc->WrapNative(cx, ::JS_GetGlobalObject(cx),
+                         static_cast<nsIDOMCrypto *>(this),
+-                        NS_GET_IID(nsIDOMCrypto), getter_AddRefs(holder));
++                        NS_GET_IID(nsIDOMCrypto), &holder);
+   NS_ENSURE_SUCCESS(nrv, nrv);
+ 
+   nrv = holder->GetJSObject(&script_obj);
+@@ -2009,7 +2009,7 @@ nsCrypto::GenerateCRMFRequest(nsIDOMCRMF
+   //Don't addref this copy.  That way ths reference goes away
+   //at the same the nsIX09Cert ref goes away.
+   nsNSSCertificate *escrowCert = nsnull;
+-  nsCOMPtr<nsIX509Cert> nssCert;
++  nsIX509Cert* nssCert;
+   PRBool willEscrow = PR_FALSE;
+   if (eaCert) {
+     SECItem certDer = {siBuffer, nsnull, 0};
+@@ -2029,8 +2029,8 @@ nsCrypto::GenerateCRMFRequest(nsIDOMCRMF
+     if (!nssCert)
+       return NS_ERROR_OUT_OF_MEMORY;
+ 
+-    nsCOMPtr<nsIDOMCryptoDialogs> dialogs;
+-    nsresult rv = getNSSDialogs(getter_AddRefs(dialogs),
++    nsIDOMCryptoDialogs* dialogs;
++    nsresult rv = getNSSDialogs((void**)&dialogs,
+                                 NS_GET_IID(nsIDOMCryptoDialogs),
+                                 NS_DOMCRYPTODIALOGS_CONTRACTID);
+     if (NS_FAILED(rv))
+@@ -2050,7 +2050,7 @@ nsCrypto::GenerateCRMFRequest(nsIDOMCRMF
+       return NS_OK;
+     willEscrow = PR_TRUE;
+   }
+-  nsCOMPtr<nsIInterfaceRequestor> uiCxt = new PipUIContext;
++  nsIInterfaceRequestor* uiCxt = new PipUIContext;
+   PRInt32 numRequests = (argc - 5)/3;
+   nsKeyPairInfo *keyids = new nsKeyPairInfo[numRequests];
+   if (keyids == nsnull) {
+@@ -2112,7 +2112,7 @@ nsCrypto::GenerateCRMFRequest(nsIDOMCRMF
+   //
+ 
+ 
+-  nsCOMPtr<nsIPrincipal>principals;
++  nsIPrincipal*principals;
+   principals = GetScriptPrincipal(cx);
+   NS_ASSERTION(principals, "Couldn't get the principals");
+   nsCryptoRunArgs *args = new nsCryptoRunArgs();
+@@ -2161,10 +2161,10 @@ void
+ void
+ alertUser(const PRUnichar *message)
+ {
+-  nsCOMPtr<nsIWindowWatcher> wwatch(do_GetService(NS_WINDOWWATCHER_CONTRACTID));
+-  nsCOMPtr<nsIPrompt> prompter;
++  nsIWindowWatcher* wwatch(do_GetService(NS_WINDOWWATCHER_CONTRACTID));
++  nsIPrompt* prompter;
+   if (wwatch)
+-    wwatch->GetNewPrompter(0, getter_AddRefs(prompter));
++    wwatch->GetNewPrompter(0, &prompter);
+ 
+   if (prompter) {
+     nsPSMUITracker tracker;
+@@ -2185,7 +2185,7 @@ nsP12Runnable::Run()
+   nsString temp;
+   nsresult rv;
+ 
+-  nsCOMPtr<nsINSSComponent> nssComponent(do_GetService(kNSSComponentCID, &rv));
++  nsINSSComponent* nssComponent(do_GetService(kNSSComponentCID, &rv));
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -2202,19 +2202,19 @@ nsP12Runnable::Run()
+   final.Append(temp.get());
+   alertUser(final.get());
+ 
+-  nsCOMPtr<nsIFilePicker> filePicker = 
++  nsIFilePicker* filePicker = 
+                         do_CreateInstance("@mozilla.org/filepicker;1", &rv);
+   if (!filePicker) {
+     NS_ASSERTION(0, "Could not create a file picker when backing up certs.");
+     return rv;
+   }
+ 
+-  nsCOMPtr<nsIWindowWatcher> wwatch =
++  nsIWindowWatcher* wwatch =
+     (do_GetService(NS_WINDOWWATCHER_CONTRACTID, &rv));
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+-  nsCOMPtr<nsIDOMWindow> window;
+-  wwatch->GetActiveWindow(getter_AddRefs(window));
++  nsIDOMWindow* window;
++  wwatch->GetActiveWindow(&window);
+ 
+   nsString filePickMessage;
+   nssComponent->GetPIPNSSBundleString("chooseP12BackupFileDialog",
+@@ -2232,8 +2232,8 @@ nsP12Runnable::Run()
+     return NS_OK;  //User canceled.  It'd be nice if they couldn't, 
+                    //but oh well.
+ 
+-  nsCOMPtr<nsILocalFile> localFile;
+-  rv = filePicker->GetFile(getter_AddRefs(localFile));
++  nsILocalFile* localFile;
++  rv = filePicker->GetFile(&localFile);
+   if (NS_FAILED(rv))
+     return NS_ERROR_FAILURE;
+ 
+@@ -2279,7 +2279,7 @@ nsCryptoRunnable::Run()
+     return NS_ERROR_FAILURE;
+ 
+   // make sure the right context is on the stack. must not return w/out popping
+-  nsCOMPtr<nsIJSContextStack> stack(do_GetService("@mozilla.org/js/xpc/ContextStack;1"));
++  nsIJSContextStack* stack(do_GetService("@mozilla.org/js/xpc/ContextStack;1"));
+   if (!stack || NS_FAILED(stack->Push(cx))) {
+     return NS_ERROR_FAILURE;
+   }
+@@ -2362,10 +2362,10 @@ nsCrypto::ImportUserCertificates(const n
+   PK11SlotInfo *slot;
+   PRBool freeLocalNickname = PR_FALSE;
+   char *localNick;
+-  nsCOMPtr<nsIInterfaceRequestor> ctx = new PipUIContext();
++  nsIInterfaceRequestor* ctx = new PipUIContext();
+   nsresult rv = NS_OK;
+   CERTCertList *caPubs = nsnull;
+-  nsCOMPtr<nsIPK11Token> token;
++  nsIPK11Token* token;
+ 
+   nickname = ToNewCString(aNickname);
+   cmmfResponse = ToNewCString(aCmmfResponse);
+@@ -2505,7 +2505,7 @@ nsCrypto::ImportUserCertificates(const n
+     // I can't pop up a file picker from the depths of JavaScript,
+     // so I'll just post an event on the UI queue to do the backups
+     // later.
+-    nsCOMPtr<nsIRunnable> p12Runnable = new nsP12Runnable(certArr, numResponses,
++    nsIRunnable* p12Runnable = new nsP12Runnable(certArr, numResponses,
+                                                           token);
+     if (!p12Runnable) {
+       rv = NS_ERROR_FAILURE;
+@@ -2564,14 +2564,14 @@ GetDocumentFromContext(JSContext *cx, ns
+     return;
+   }
+ 
+-  nsCOMPtr<nsIDOMWindow> domWindow = 
++  nsIDOMWindow* domWindow = 
+     do_QueryInterface(scriptContext->GetGlobalObject());
+   if (!domWindow) {
+     return;
+   }
+ 
+-  nsCOMPtr<nsIDOMDocument> domDocument;
+-  domWindow->GetDocument(getter_AddRefs(domDocument));
++  nsIDOMDocument* domDocument;
++  domWindow->GetDocument(&domDocument);
+   if (!domDocument) {
+     return;
+   }
+@@ -2596,10 +2596,10 @@ nsCrypto::SignText(const nsAString& aStr
+ 
+   aResult.Truncate();
+ 
+-  nsCOMPtr<nsIXPCNativeCallContext> ncc;
+-  nsCOMPtr<nsIXPConnect> xpc(do_GetService(nsIXPConnect::GetCID()));
++  nsIXPCNativeCallContext* ncc;
++  nsIXPConnect* xpc(do_GetService(nsIXPConnect::GetCID()));
+   if (xpc) {
+-    xpc->GetCurrentNativeCallContext(getter_AddRefs(ncc));
++    xpc->GetCurrentNativeCallContext(&ncc);
+   }
+ 
+   if (!ncc) {
+@@ -2632,7 +2632,7 @@ nsCrypto::SignText(const nsAString& aStr
+   // It was decided to always behave as if "ask" were specified.
+   // XXX Should we warn in the JS Console for auto?
+ 
+-  nsCOMPtr<nsIInterfaceRequestor> uiContext = new PipUIContext;
++  nsIInterfaceRequestor* uiContext = new PipUIContext;
+   if (!uiContext) {
+     aResult.Append(internalError);
+ 
+@@ -2685,7 +2685,7 @@ nsCrypto::SignText(const nsAString& aStr
+     return NS_OK;
+   }
+ 
+-  nsCOMPtr<nsIFormSigningDialog> fsd =
++  nsIFormSigningDialog* fsd =
+     do_CreateInstance(NS_FORMSIGNINGDIALOG_CONTRACTID);
+   if (!fsd) {
+     aResult.Append(internalError);
+@@ -2693,19 +2693,19 @@ nsCrypto::SignText(const nsAString& aStr
+     return NS_OK;
+   }
+ 
+-  nsCOMPtr<nsIFormSigningDialog> proxied_fsd;
++  nsIFormSigningDialog* proxied_fsd;
+   nsresult rv = NS_GetProxyForObject(NS_PROXY_TO_MAIN_THREAD,
+                                      NS_GET_IID(nsIFormSigningDialog), 
+                                      fsd, NS_PROXY_SYNC,
+-                                     getter_AddRefs(proxied_fsd));
++                                     (void**)&proxied_fsd);
+   if (NS_FAILED(rv)) {
+     aResult.Append(internalError);
+ 
+     return NS_OK;
+   }
+ 
+-  nsCOMPtr<nsIDocument> document;
+-  GetDocumentFromContext(cx, getter_AddRefs(document));
++  nsIDocument* document;
++  GetDocumentFromContext(cx, &document);
+   if (!document) {
+     aResult.Append(internalError);
+ 
+@@ -2761,7 +2761,7 @@ nsCrypto::SignText(const nsAString& aStr
+   for (node = CERT_LIST_HEAD(certList), certsToUse = 0;
+        !CERT_LIST_END(node, certList) && certsToUse < nicknames->numnicknames;
+        node = CERT_LIST_NEXT(node)) {
+-    nsRefPtr<nsNSSCertificate> tempCert = new nsNSSCertificate(node->cert);
++    nsNSSCertificate* tempCert = new nsNSSCertificate(node->cert);
+     if (tempCert) {
+       nsAutoString nickWithSerial, details;
+       rv = tempCert->FormatUIStrings(NS_ConvertUTF8toUTF16(nicknames->nicknames[certsToUse]),
+@@ -2860,7 +2860,7 @@ nsCrypto::SignText(const nsAString& aStr
+     charset.AssignLiteral("windows-1252");
+   }
+ 
+-  nsCOMPtr<nsISaveAsCharset> encoder =
++  nsISaveAsCharset* encoder =
+     do_CreateInstance(NS_SAVEASCHARSET_CONTRACTID);
+   if (encoder) {
+     rv = encoder->Init(charset.get(),
+@@ -2961,7 +2961,7 @@ nsCrypto::Logout()
+ nsCrypto::Logout()
+ {
+   nsresult rv;
+-  nsCOMPtr<nsINSSComponent> nssComponent(do_GetService(kNSSComponentCID, &rv));
++  nsINSSComponent* nssComponent(do_GetService(kNSSComponentCID, &rv));
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -3022,10 +3022,10 @@ confirm_user(const PRUnichar *message)
+ {
+   PRInt32 buttonPressed = 1; // If the user exits by clicking the close box, assume No (button 1)
+ 
+-  nsCOMPtr<nsIWindowWatcher> wwatch(do_GetService(NS_WINDOWWATCHER_CONTRACTID));
+-  nsCOMPtr<nsIPrompt> prompter;
++  nsIWindowWatcher* wwatch(do_GetService(NS_WINDOWWATCHER_CONTRACTID));
++  nsIPrompt* prompter;
+   if (wwatch)
+-    wwatch->GetNewPrompter(0, getter_AddRefs(prompter));
++    wwatch->GetNewPrompter(0, &prompter);
+ 
+   if (prompter) {
+     nsPSMUITracker tracker;
+@@ -3050,7 +3050,7 @@ nsPkcs11::Deletemodule(const nsAString& 
+   nsresult rv;
+   nsString errorMessage;
+ 
+-  nsCOMPtr<nsINSSComponent> nssComponent(do_GetService(kNSSComponentCID, &rv));
++  nsINSSComponent* nssComponent(do_GetService(kNSSComponentCID, &rv));
+   if (aModuleName.IsEmpty()) {
+     *aReturn = JS_ERR_BAD_MODULE_NAME;
+     nssComponent->GetPIPNSSBundleString("DelModuleBadName", errorMessage);
+@@ -3106,7 +3106,7 @@ nsPkcs11::Addmodule(const nsAString& aMo
+ {
+   nsNSSShutDownPreventionLock locker;
+   nsresult rv;
+-  nsCOMPtr<nsINSSComponent> nssComponent(do_GetService(kNSSComponentCID, &rv));
++  nsINSSComponent* nssComponent(do_GetService(kNSSComponentCID, &rv));
+   nsString final;
+   nsAutoString temp;
+ 
+diff --git a/security/manager/ssl/src/nsCrypto.h b/security/manager/ssl/src/nsCrypto.h
+--- a/security/manager/ssl/src/nsCrypto.h
++++ b/security/manager/ssl/src/nsCrypto.h
+@@ -90,7 +90,7 @@ public:
+   NS_DECL_NSIDOMCRYPTO
+ 
+ private:
+-  static already_AddRefed<nsIPrincipal> GetScriptPrincipal(JSContext *cx);
++  static nsIPrincipal* GetScriptPrincipal(JSContext *cx);
+ 
+   PRBool mEnableSmartCardEvents;
+ };
+diff --git a/security/manager/ssl/src/nsKeyModule.cpp b/security/manager/ssl/src/nsKeyModule.cpp
+--- a/security/manager/ssl/src/nsKeyModule.cpp
++++ b/security/manager/ssl/src/nsKeyModule.cpp
+@@ -180,7 +180,7 @@ nsKeyObjectFactory::KeyFromString(PRInt1
+     return NS_ERROR_INVALID_ARG;
+   
+   nsresult rv;
+-  nsCOMPtr<nsIKeyObject> key =
++  nsIKeyObject* key =
+       do_CreateInstance(NS_KEYMODULEOBJECT_CONTRACTID, &rv);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+@@ -212,6 +212,6 @@ nsKeyObjectFactory::KeyFromString(PRInt1
+   rv = key->InitKey(aAlgorithm, (void*)symKey);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+-  key.swap(*_retval);
+-  return NS_OK;
+-}
++  swap(key, *_retval);
++  return NS_OK;
++}
+diff --git a/security/manager/ssl/src/nsKeygenHandler.cpp b/security/manager/ssl/src/nsKeygenHandler.cpp
+--- a/security/manager/ssl/src/nsKeygenHandler.cpp
++++ b/security/manager/ssl/src/nsKeygenHandler.cpp
+@@ -326,7 +326,7 @@ nsKeygenFormProcessor::Create(nsISupport
+   if (!formProc)
+     return NS_ERROR_OUT_OF_MEMORY;
+ 
+-  nsCOMPtr<nsISupports> stabilize = formProc;
++  nsISupports* stabilize = formProc;
+   rv = formProc->Init();
+   if (NS_SUCCEEDED(rv)) {
+     rv = formProc->QueryInterface(aIID, aResult);
+@@ -344,7 +344,7 @@ nsKeygenFormProcessor::Init()
+     return NS_OK;
+ 
+   // Get the key strings //
+-  nsCOMPtr<nsINSSComponent> nssComponent;
++  nsINSSComponent* nssComponent;
+   nssComponent = do_GetService(kNSSComponentCID, &rv);
+   if (NS_FAILED(rv))
+     return rv;
+@@ -545,7 +545,7 @@ nsKeygenFormProcessor::GetPublicKey(nsAS
+     SECKeySizeChoiceInfo *choice = SECKeySizeChoiceList;
+     nsIGeneratingKeypairInfoDialogs * dialogs;
+     nsKeygenThread *KeygenRunnable = 0;
+-    nsCOMPtr<nsIKeygenThread> runnable;
++    nsIKeygenThread* runnable;
+ 
+     // Get the key size //
+     while (choice->name) {
+@@ -820,9 +820,9 @@ nsKeygenFormProcessor::ProcessValue(nsID
+ 				    nsAString& aValue) 
+ { 
+   nsresult rv = NS_OK;
+-  nsCOMPtr<nsIDOMHTMLSelectElement>selectElement;
++  nsIDOMHTMLSelectElement*selectElement;
+   nsresult res = aElement->QueryInterface(kIDOMHTMLSelectElementIID, 
+-					  getter_AddRefs(selectElement));
++					  (void**)&selectElement);
+   if (NS_SUCCEEDED(res)) {
+     nsAutoString keygenvalue;
+     nsAutoString challengeValue;
+diff --git a/security/manager/ssl/src/nsKeygenThread.cpp b/security/manager/ssl/src/nsKeygenThread.cpp
+--- a/security/manager/ssl/src/nsKeygenThread.cpp
++++ b/security/manager/ssl/src/nsKeygenThread.cpp
+@@ -150,12 +150,12 @@ nsresult nsKeygenThread::StartKeyGenerat
+   if (!aObserver)
+     return NS_OK;
+ 
+-  nsCOMPtr<nsIObserver> obs;
++  nsIObserver* obs;
+   NS_GetProxyForObject( NS_PROXY_TO_MAIN_THREAD,
+                         NS_GET_IID(nsIObserver),
+                         aObserver,
+                         NS_PROXY_SYNC | NS_PROXY_ALWAYS,
+-                        getter_AddRefs(obs));
++                        (void**)&obs);
+ 
+   PR_Lock(mutex);
+ 
+@@ -231,7 +231,7 @@ void nsKeygenThread::Run(void)
+   // As long as key generation can't be canceled, we don't need 
+   // to care for cleaning this up.
+ 
+-  nsCOMPtr<nsIObserver> obs;
++  nsIObserver* obs;
+   PR_Lock(mutex);
+ 
+     keygenReady = PR_TRUE;
+diff --git a/security/manager/ssl/src/nsNSSASN1Object.cpp b/security/manager/ssl/src/nsNSSASN1Object.cpp
+--- a/security/manager/ssl/src/nsNSSASN1Object.cpp
++++ b/security/manager/ssl/src/nsNSSASN1Object.cpp
+@@ -126,10 +126,10 @@ buildASN1ObjectFromDER(unsigned char *da
+                        nsIASN1Sequence *parent)
+ {
+   nsresult rv;
+-  nsCOMPtr<nsIASN1Sequence> sequence;
+-  nsCOMPtr<nsIASN1PrintableItem> printableItem;
+-  nsCOMPtr<nsIASN1Object> asn1Obj;
+-  nsCOMPtr<nsIMutableArray> parentObjects;
++  nsIASN1Sequence* sequence;
++  nsIASN1PrintableItem* printableItem;
++  nsIASN1Object* asn1Obj;
++  nsIMutableArray* parentObjects;
+ 
+   NS_ENSURE_ARG_POINTER(parent);
+   if (data >= end)
+@@ -148,7 +148,7 @@ buildASN1ObjectFromDER(unsigned char *da
+   PRInt32 len;
+   PRUint32 type;
+ 
+-  rv = parent->GetASN1Objects(getter_AddRefs(parentObjects));
++  rv = parent->GetASN1Objects(&parentObjects);
+   if (NS_FAILED(rv) || parentObjects == nsnull)
+     return NS_ERROR_FAILURE;
+   while (data < end) {
+@@ -213,7 +213,7 @@ CreateFromDER(unsigned char *data,
+               unsigned int   len,
+               nsIASN1Object **retval)
+ {
+-  nsCOMPtr<nsIASN1Sequence> sequence = new nsNSSASN1Sequence;
++  nsIASN1Sequence* sequence = new nsNSSASN1Sequence;
+   *retval = nsnull;
+   
+   nsresult rv =  buildASN1ObjectFromDER(data, data+len, sequence);
+@@ -221,10 +221,10 @@ CreateFromDER(unsigned char *data,
+   if (NS_SUCCEEDED(rv)) {
+     // The actual object will be the first element inserted
+     // into the sequence of the sequence variable we created.
+-    nsCOMPtr<nsIMutableArray> elements;
+-
+-    sequence->GetASN1Objects(getter_AddRefs(elements));
+-    nsCOMPtr<nsIASN1Object> asn1Obj = do_QueryElementAt(elements, 0);
++    nsIMutableArray* elements;
++
++    sequence->GetASN1Objects(&elements);
++    nsIASN1Object* asn1Obj = do_QueryElementAt(elements, 0);
+     *retval = asn1Obj;
+     if (*retval == nsnull)
+       return NS_ERROR_FAILURE;
+diff --git a/security/manager/ssl/src/nsNSSCallbacks.cpp b/security/manager/ssl/src/nsNSSCallbacks.cpp
+--- a/security/manager/ssl/src/nsNSSCallbacks.cpp
++++ b/security/manager/ssl/src/nsNSSCallbacks.cpp
+@@ -107,29 +107,29 @@ nsHTTPDownloadEvent::Run()
+ 
+   nsresult rv;
+ 
+-  nsCOMPtr<nsIIOService> ios = do_GetIOService();
++  nsIIOService* ios = do_GetIOService();
+   NS_ENSURE_STATE(ios);
+ 
+-  nsCOMPtr<nsIChannel> chan;
+-  ios->NewChannel(mRequestSession->mURL, nsnull, nsnull, getter_AddRefs(chan));
++  nsIChannel* chan;
++  ios->NewChannel(mRequestSession->mURL, nsnull, nsnull, &chan);
+   NS_ENSURE_STATE(chan);
+ 
+   // Create a loadgroup for this new channel.  This way if the channel
+   // is redirected, we'll have a way to cancel the resulting channel.
+-  nsCOMPtr<nsILoadGroup> loadGroup =
++  nsILoadGroup* loadGroup =
+     do_CreateInstance(NS_LOADGROUP_CONTRACTID);
+   chan->SetLoadGroup(loadGroup);
+ 
+   if (mRequestSession->mHasPostData)
+   {
+-    nsCOMPtr<nsIInputStream> uploadStream;
+-    rv = NS_NewPostDataStream(getter_AddRefs(uploadStream),
++    nsIInputStream* uploadStream;
++    rv = NS_NewPostDataStream(&uploadStream,
+                               PR_FALSE,
+                               mRequestSession->mPostData,
+                               0, ios);
+     NS_ENSURE_SUCCESS(rv, rv);
+ 
+-    nsCOMPtr<nsIUploadChannel> uploadChannel(do_QueryInterface(chan));
++    nsIUploadChannel* uploadChannel(do_QueryInterface(chan));
+     NS_ENSURE_STATE(uploadChannel);
+ 
+     rv = uploadChannel->SetUploadStream(uploadStream, 
+@@ -138,7 +138,7 @@ nsHTTPDownloadEvent::Run()
+     NS_ENSURE_SUCCESS(rv, rv);
+   }
+ 
+-  nsCOMPtr<nsIHttpChannel> hchan = do_QueryInterface(chan);
++  nsIHttpChannel* hchan = do_QueryInterface(chan);
+   NS_ENSURE_STATE(hchan);
+ 
+   rv = hchan->SetRequestMethod(mRequestSession->mRequestMethod);
+@@ -341,7 +341,7 @@ nsNSSHttpRequestSession::internal_send_r
+   volatile PRBool &waitFlag = mListener->mWaitFlag;
+   waitFlag = PR_TRUE;
+ 
+-  nsRefPtr<nsHTTPDownloadEvent> event = new nsHTTPDownloadEvent;
++  nsHTTPDownloadEvent* event = new nsHTTPDownloadEvent;
+   if (!event)
+     return SECFailure;
+ 
+@@ -404,7 +404,7 @@ nsNSSHttpRequestSession::internal_send_r
+           request_canceled = PR_TRUE;
+           // but we'll to continue to wait for waitFlag
+           
+-          nsCOMPtr<nsIRunnable> cancelevent = new nsCancelHTTPDownloadEvent;
++          nsIRunnable* cancelevent = new nsCancelHTTPDownloadEvent;
+           rv = NS_DispatchToMainThread(cancelevent);
+           if (NS_FAILED(rv))
+           {
+@@ -568,10 +568,10 @@ nsHTTPListener::OnStreamComplete(nsIStre
+ {
+   mResultCode = aStatus;
+ 
+-  nsCOMPtr<nsIRequest> req;
+-  nsCOMPtr<nsIHttpChannel> hchan;
+-
+-  nsresult rv = aLoader->GetRequest(getter_AddRefs(req));
++  nsIRequest* req;
++  nsIHttpChannel* hchan;
++
++  nsresult rv = aLoader->GetRequest(&req);
+   
+ #ifdef PR_LOGGING
+   if (NS_FAILED(aStatus))
+@@ -630,7 +630,7 @@ PK11PasswordPrompt(PK11SlotInfo* slot, P
+   PRUnichar *password = nsnull;
+   PRBool value = PR_FALSE;
+   nsIInterfaceRequestor *ir = static_cast<nsIInterfaceRequestor*>(arg);
+-  nsCOMPtr<nsIPrompt> proxyPrompt;
++  nsIPrompt* proxyPrompt;
+ 
+   /* TODO: Retry should generate a different dialog message */
+ /*
+@@ -640,19 +640,19 @@ PK11PasswordPrompt(PK11SlotInfo* slot, P
+ 
+   if (!ir)
+   {
+-    nsCOMPtr<nsIWindowWatcher> wwatch(do_GetService(NS_WINDOWWATCHER_CONTRACTID));
++    nsIWindowWatcher* wwatch(do_GetService(NS_WINDOWWATCHER_CONTRACTID));
+     if (!wwatch)
+       return nsnull;
+ 
+-    nsCOMPtr<nsIPrompt> prompter;
+-    wwatch->GetNewPrompter(0, getter_AddRefs(prompter));
++    nsIPrompt* prompter;
++    wwatch->GetNewPrompter(0, &prompter);
+     if (!prompter)
+       return nsnull;
+ 
+     NS_GetProxyForObject(NS_PROXY_TO_MAIN_THREAD,
+                          NS_GET_IID(nsIPrompt),
+                          prompter, NS_PROXY_SYNC,
+-                         getter_AddRefs(proxyPrompt));
++                         (void**)&proxyPrompt);
+     if (!proxyPrompt)
+       return nsnull;
+   }
+@@ -661,15 +661,15 @@ PK11PasswordPrompt(PK11SlotInfo* slot, P
+     // The interface requestor object may not be safe, so
+     // proxy the call to get the nsIPrompt.
+   
+-    nsCOMPtr<nsIInterfaceRequestor> proxiedCallbacks;
++    nsIInterfaceRequestor* proxiedCallbacks;
+     NS_GetProxyForObject(NS_PROXY_TO_MAIN_THREAD,
+                          NS_GET_IID(nsIInterfaceRequestor),
+                          ir,
+                          NS_PROXY_SYNC,
+-                         getter_AddRefs(proxiedCallbacks));
++                         (void**)&proxiedCallbacks);
+   
+     // Get the desired interface
+-    nsCOMPtr<nsIPrompt> prompt(do_GetInterface(proxiedCallbacks));
++    nsIPrompt* prompt(do_GetInterface(proxiedCallbacks));
+     if (!prompt) {
+       NS_ASSERTION(PR_FALSE, "callbacks does not implement nsIPrompt");
+       return nsnull;
+@@ -680,11 +680,11 @@ PK11PasswordPrompt(PK11SlotInfo* slot, P
+                          NS_GET_IID(nsIPrompt),
+                          prompt,
+                          NS_PROXY_SYNC,
+-                         getter_AddRefs(proxyPrompt));
++                         (void**)&proxyPrompt);
+   }
+ 
+   nsAutoString promptString;
+-  nsCOMPtr<nsINSSComponent> nssComponent(do_GetService(kNSSComponentCID, &rv));
++  nsINSSComponent* nssComponent(do_GetService(kNSSComponentCID, &rv));
+ 
+   if (NS_FAILED(rv))
+     return nsnull; 
+@@ -757,7 +757,7 @@ void PR_CALLBACK HandshakeCallback(PRFil
+ 
+   nsAutoString shortDesc;
+   const PRUnichar* formatStrings[1] = { ToNewUnicode(NS_ConvertUTF8toUTF16(caName)) };
+-  nsCOMPtr<nsINSSComponent> nssComponent(do_GetService(kNSSComponentCID, &rv));
++  nsINSSComponent* nssComponent(do_GetService(kNSSComponentCID, &rv));
+   if (NS_SUCCEEDED(rv)) {
+     rv = nssComponent->PIPBundleFormatStringFromName("SignedBy",
+                                                    formatStrings, 1,
+@@ -770,8 +770,8 @@ void PR_CALLBACK HandshakeCallback(PRFil
+     infoObject->SetShortSecurityDescription(shortDesc.get());
+ 
+     /* Set the SSL Status information */
+-    nsCOMPtr<nsSSLStatus> status;
+-    infoObject->GetSSLStatus(getter_AddRefs(status));
++    nsSSLStatus* status;
++    infoObject->GetSSLStatus((class nsISupports**)&status);
+     if (!status) {
+       status = new nsSSLStatus();
+       infoObject->SetSSLStatus(status);
+@@ -779,7 +779,7 @@ void PR_CALLBACK HandshakeCallback(PRFil
+ 
+     CERTCertificate *serverCert = SSL_PeerCertificate(fd);
+     if (serverCert) {
+-      nsRefPtr<nsNSSCertificate> nssc = new nsNSSCertificate(serverCert);
++      nsNSSCertificate* nssc = new nsNSSCertificate(serverCert);
+       CERT_DestroyCertificate(serverCert);
+       serverCert = nsnull;
+       infoObject->SetCert(nssc);
+@@ -816,7 +816,7 @@ SECStatus PR_CALLBACK AuthCertificateCal
+     if (SECSuccess == rv) {
+       CERTCertList *certList = CERT_GetCertChainFromCert(serverCert, PR_Now(), certUsageSSLCA);
+ 
+-      nsCOMPtr<nsINSSComponent> nssComponent;
++      nsINSSComponent* nssComponent;
+       
+       for (CERTCertListNode *node = CERT_LIST_HEAD(certList);
+            !CERT_LIST_END(node, certList);
+@@ -858,8 +858,8 @@ SECStatus PR_CALLBACK AuthCertificateCal
+       // to the caller that contains at least the cert and its status.
+       nsNSSSocketInfo* infoObject = (nsNSSSocketInfo*) fd->higher->secret;
+ 
+-      nsCOMPtr<nsSSLStatus> status;
+-      infoObject->GetSSLStatus(getter_AddRefs(status));
++      nsSSLStatus* status;
++      infoObject->GetSSLStatus((class nsISupports**)&status);
+       if (!status) {
+         status = new nsSSLStatus();
+         infoObject->SetSSLStatus(status);
+diff --git a/security/manager/ssl/src/nsNSSCertCache.cpp b/security/manager/ssl/src/nsNSSCertCache.cpp
+--- a/security/manager/ssl/src/nsNSSCertCache.cpp
++++ b/security/manager/ssl/src/nsNSSCertCache.cpp
+@@ -83,7 +83,7 @@ nsNSSCertCache::CacheAllCerts()
+   if (isAlreadyShutDown())
+     return NS_ERROR_NOT_AVAILABLE;
+ 
+-  nsCOMPtr<nsIInterfaceRequestor> cxt = new PipUIContext();
++  nsIInterfaceRequestor* cxt = new PipUIContext();
+   
+   CERTCertList *newList = PK11_ListCerts(PK11CertListUnique, cxt);
+ 
+diff --git a/security/manager/ssl/src/nsNSSCertHelper.cpp b/security/manager/ssl/src/nsNSSCertHelper.cpp
+--- a/security/manager/ssl/src/nsNSSCertHelper.cpp
++++ b/security/manager/ssl/src/nsNSSCertHelper.cpp
+@@ -125,7 +125,7 @@ ProcessVersion(SECItem         *versionI
+ {
+   nsresult rv;
+   nsAutoString text;
+-  nsCOMPtr<nsIASN1PrintableItem> printableItem = new nsNSSASN1PrintableItem();
++  nsIASN1PrintableItem* printableItem = new nsNSSASN1PrintableItem();
+   if (printableItem == nsnull)
+     return NS_ERROR_OUT_OF_MEMORY;
+  
+@@ -180,7 +180,7 @@ ProcessSerialNumberDER(SECItem         *
+ {
+   nsresult rv;
+   nsAutoString text;
+-  nsCOMPtr<nsIASN1PrintableItem> printableItem = new nsNSSASN1PrintableItem();
++  nsIASN1PrintableItem* printableItem = new nsNSSASN1PrintableItem();
+ 
+   if (printableItem == nsnull)
+     return NS_ERROR_OUT_OF_MEMORY;
+@@ -1635,7 +1635,7 @@ ProcessSingleExtension(CERTCertExtension
+ {
+   nsAutoString text, extvalue;
+   GetOIDText(&extension->id, nssComponent, text);
+-  nsCOMPtr<nsIASN1PrintableItem>extensionItem = new nsNSSASN1PrintableItem();
++  nsIASN1PrintableItem*extensionItem = new nsNSSASN1PrintableItem();
+   if (extensionItem == nsnull)
+     return NS_ERROR_OUT_OF_MEMORY;
+ 
+@@ -1672,7 +1672,7 @@ ProcessSECAlgorithmID(SECAlgorithmID *al
+ {
+   SECOidTag algOIDTag = SECOID_FindOIDTag(&algID->algorithm);
+   SECItem paramsOID = { siBuffer, NULL, 0 };
+-  nsCOMPtr<nsIASN1Sequence> sequence = new nsNSSASN1Sequence();
++  nsIASN1Sequence* sequence = new nsNSSASN1Sequence();
+   if (sequence == nsnull)
+     return NS_ERROR_OUT_OF_MEMORY;
+ 
+@@ -1683,13 +1683,13 @@ ProcessSECAlgorithmID(SECAlgorithmID *al
+     sequence->SetDisplayValue(text);
+     sequence->SetIsValidContainer(PR_FALSE);
+   } else {
+-    nsCOMPtr<nsIASN1PrintableItem> printableItem = new nsNSSASN1PrintableItem();
++    nsIASN1PrintableItem* printableItem = new nsNSSASN1PrintableItem();
+     if (printableItem == nsnull)
+       return NS_ERROR_OUT_OF_MEMORY;
+ 
+     printableItem->SetDisplayValue(text);
+-    nsCOMPtr<nsIMutableArray> asn1Objects;
+-    sequence->GetASN1Objects(getter_AddRefs(asn1Objects));
++    nsIMutableArray* asn1Objects;
++    sequence->GetASN1Objects(&asn1Objects);
+     asn1Objects->AppendElement(printableItem, PR_FALSE);
+     nssComponent->GetPIPNSSBundleString("CertDumpAlgID", text);
+     printableItem->SetDisplayName(text);
+@@ -1721,7 +1721,7 @@ ProcessTime(PRTime dispTime, const PRUni
+             nsIASN1Sequence *parentSequence)
+ {
+   nsresult rv;
+-  nsCOMPtr<nsIDateTimeFormat> dateFormatter =
++  nsIDateTimeFormat* dateFormatter =
+      do_CreateInstance(NS_DATETIMEFORMAT_CONTRACTID, &rv);
+   if (NS_FAILED(rv)) 
+     return rv;
+@@ -1747,14 +1747,14 @@ ProcessTime(PRTime dispTime, const PRUni
+   text.Append(tempString);
+   text.Append(NS_LITERAL_STRING(" GMT)"));
+ 
+-  nsCOMPtr<nsIASN1PrintableItem> printableItem = new nsNSSASN1PrintableItem();
++  nsIASN1PrintableItem* printableItem = new nsNSSASN1PrintableItem();
+   if (printableItem == nsnull)
+     return NS_ERROR_OUT_OF_MEMORY;
+ 
+   printableItem->SetDisplayValue(text);
+   printableItem->SetDisplayName(nsDependentString(displayName));
+-  nsCOMPtr<nsIMutableArray> asn1Objects;
+-  parentSequence->GetASN1Objects(getter_AddRefs(asn1Objects));
++  nsIMutableArray* asn1Objects;
++  parentSequence->GetASN1Objects(&asn1Objects);
+   asn1Objects->AppendElement(printableItem, PR_FALSE);
+   return NS_OK;
+ }
+@@ -1764,7 +1764,7 @@ ProcessSubjectPublicKeyInfo(CERTSubjectP
+                             nsIASN1Sequence *parentSequence,
+                             nsINSSComponent *nssComponent)
+ {
+-  nsCOMPtr<nsIASN1Sequence> spkiSequence = new nsNSSASN1Sequence();
++  nsIASN1Sequence* spkiSequence = new nsNSSASN1Sequence();
+ 
+   if (spkiSequence == nsnull)
+     return NS_ERROR_OUT_OF_MEMORY;
+@@ -1774,17 +1774,17 @@ ProcessSubjectPublicKeyInfo(CERTSubjectP
+   spkiSequence->SetDisplayName(text);
+ 
+   nssComponent->GetPIPNSSBundleString("CertDumpSPKIAlg", text);
+-  nsCOMPtr<nsIASN1Sequence> sequenceItem;
++  nsIASN1Sequence* sequenceItem;
+   nsresult rv = ProcessSECAlgorithmID(&spki->algorithm, nssComponent,
+-                                      getter_AddRefs(sequenceItem));
++                                      &sequenceItem);
+   if (NS_FAILED(rv))
+     return rv;
+   sequenceItem->SetDisplayName(text);
+-  nsCOMPtr<nsIMutableArray> asn1Objects;
+-  spkiSequence->GetASN1Objects(getter_AddRefs(asn1Objects));
++  nsIMutableArray* asn1Objects;
++  spkiSequence->GetASN1Objects(&asn1Objects);
+   asn1Objects->AppendElement(sequenceItem, PR_FALSE);
+ 
+-  nsCOMPtr<nsIASN1PrintableItem> printableItem = new nsNSSASN1PrintableItem();
++  nsIASN1PrintableItem* printableItem = new nsNSSASN1PrintableItem();
+   if (printableItem == nsnull)
+     return NS_ERROR_OUT_OF_MEMORY;
+ 
+@@ -1840,7 +1840,7 @@ ProcessSubjectPublicKeyInfo(CERTSubjectP
+   printableItem->SetDisplayName(text);
+   asn1Objects->AppendElement(printableItem, PR_FALSE);
+   
+-  parentSequence->GetASN1Objects(getter_AddRefs(asn1Objects));
++  parentSequence->GetASN1Objects(&asn1Objects);
+   asn1Objects->AppendElement(spkiSequence, PR_FALSE);
+   return NS_OK;
+ }
+@@ -1850,7 +1850,7 @@ ProcessExtensions(CERTCertExtension **ex
+                   nsIASN1Sequence *parentSequence, 
+                   nsINSSComponent *nssComponent)
+ {
+-  nsCOMPtr<nsIASN1Sequence> extensionSequence = new nsNSSASN1Sequence;
++  nsIASN1Sequence* extensionSequence = new nsNSSASN1Sequence;
+   if (extensionSequence == nsnull)
+     return NS_ERROR_OUT_OF_MEMORY;
+ 
+@@ -1859,18 +1859,18 @@ ProcessExtensions(CERTCertExtension **ex
+   extensionSequence->SetDisplayName(text);
+   PRInt32 i;
+   nsresult rv;
+-  nsCOMPtr<nsIASN1PrintableItem> newExtension;
+-  nsCOMPtr<nsIMutableArray> asn1Objects;
+-  extensionSequence->GetASN1Objects(getter_AddRefs(asn1Objects));
++  nsIASN1PrintableItem* newExtension;
++  nsIMutableArray* asn1Objects;
++  extensionSequence->GetASN1Objects(&asn1Objects);
+   for (i=0; extensions[i] != nsnull; i++) {
+     rv = ProcessSingleExtension(extensions[i], nssComponent,
+-                                getter_AddRefs(newExtension));
++                                &newExtension);
+     if (NS_FAILED(rv))
+       return rv;
+ 
+     asn1Objects->AppendElement(newExtension, PR_FALSE);
+   }
+-  parentSequence->GetASN1Objects(getter_AddRefs(asn1Objects));
++  parentSequence->GetASN1Objects(&asn1Objects);
+   asn1Objects->AppendElement(extensionSequence, PR_FALSE);
+   return NS_OK;
+ }
+@@ -1927,35 +1927,35 @@ nsNSSCertificate::CreateTBSCertificateAS
+   // This is the ASN1 structure we should be dealing with at this point.
+   // The code in this method will assert this is the structure we're dealing
+   // and then add more user friendly text for that field.
+-  nsCOMPtr<nsIASN1Sequence> sequence = new nsNSSASN1Sequence();
++  nsIASN1Sequence* sequence = new nsNSSASN1Sequence();
+   if (sequence == nsnull)
+     return NS_ERROR_OUT_OF_MEMORY;
+ 
+   nsString text;
+   nssComponent->GetPIPNSSBundleString("CertDumpCertificate", text);
+   sequence->SetDisplayName(text);
+-  nsCOMPtr<nsIASN1PrintableItem> printableItem;
++  nsIASN1PrintableItem* printableItem;
+   
+-  nsCOMPtr<nsIMutableArray> asn1Objects;
+-  sequence->GetASN1Objects(getter_AddRefs(asn1Objects));
++  nsIMutableArray* asn1Objects;
++  sequence->GetASN1Objects(&asn1Objects);
+ 
+   nsresult rv = ProcessVersion(&mCert->version, nssComponent,
+-                               getter_AddRefs(printableItem));
++                               &printableItem);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+   asn1Objects->AppendElement(printableItem, PR_FALSE);
+   
+   rv = ProcessSerialNumberDER(&mCert->serialNumber, nssComponent,
+-                              getter_AddRefs(printableItem));
++                              &printableItem);
+ 
+   if (NS_FAILED(rv))
+     return rv;
+   asn1Objects->AppendElement(printableItem, PR_FALSE);
+ 
+-  nsCOMPtr<nsIASN1Sequence> algID;
++  nsIASN1Sequence* algID;
+   rv = ProcessSECAlgorithmID(&mCert->signature,
+-                             nssComponent, getter_AddRefs(algID));
++                             nssComponent, &algID);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -1975,13 +1975,13 @@ nsNSSCertificate::CreateTBSCertificateAS
+   printableItem->SetDisplayName(text);
+   asn1Objects->AppendElement(printableItem, PR_FALSE);
+   
+-  nsCOMPtr<nsIASN1Sequence> validitySequence = new nsNSSASN1Sequence();
++  nsIASN1Sequence* validitySequence = new nsNSSASN1Sequence();
+   nssComponent->GetPIPNSSBundleString("CertDumpValidity", text);
+   validitySequence->SetDisplayName(text);
+   asn1Objects->AppendElement(validitySequence, PR_FALSE);
+   nssComponent->GetPIPNSSBundleString("CertDumpNotBefore", text);
+-  nsCOMPtr<nsIX509CertValidity> validityData;
+-  GetValidity(getter_AddRefs(validityData));
++  nsIX509CertValidity* validityData;
++  GetValidity(&validityData);
+   PRTime notBefore, notAfter;
+ 
+   validityData->GetNotBefore(&notBefore);
+@@ -2068,15 +2068,15 @@ nsNSSCertificate::CreateASN1Struct()
+   if (isAlreadyShutDown())
+     return NS_ERROR_NOT_AVAILABLE;
+ 
+-  nsCOMPtr<nsIASN1Sequence> sequence = new nsNSSASN1Sequence();
++  nsIASN1Sequence* sequence = new nsNSSASN1Sequence();
+ 
+   mASN1Structure = sequence; 
+   if (mASN1Structure == nsnull) {
+     return NS_ERROR_OUT_OF_MEMORY;
+   }
+ 
+-  nsCOMPtr<nsIMutableArray> asn1Objects;
+-  sequence->GetASN1Objects(getter_AddRefs(asn1Objects));
++  nsIMutableArray* asn1Objects;
++  sequence->GetASN1Objects(&asn1Objects);
+   nsXPIDLCString title;
+   GetWindowTitle(getter_Copies(title));
+   
+@@ -2084,27 +2084,27 @@ nsNSSCertificate::CreateASN1Struct()
+   // This sequence will be contain the tbsCertificate, signatureAlgorithm,
+   // and signatureValue.
+   nsresult rv;
+-  nsCOMPtr<nsINSSComponent> nssComponent(do_GetService(kNSSComponentCID, &rv));
++  nsINSSComponent* nssComponent(do_GetService(kNSSComponentCID, &rv));
+   if (NS_FAILED(rv))
+     return rv;
+ 
+-  rv = CreateTBSCertificateASN1Struct(getter_AddRefs(sequence),
++  rv = CreateTBSCertificateASN1Struct(&sequence,
+                                       nssComponent);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+   asn1Objects->AppendElement(sequence, PR_FALSE);
+-  nsCOMPtr<nsIASN1Sequence> algID;
++  nsIASN1Sequence* algID;
+ 
+   rv = ProcessSECAlgorithmID(&mCert->signatureWrap.signatureAlgorithm, 
+-                             nssComponent, getter_AddRefs(algID));
++                             nssComponent, &algID);
+   if (NS_FAILED(rv))
+     return rv;
+   nsString text;
+   nssComponent->GetPIPNSSBundleString("CertDumpSigAlg", text);
+   algID->SetDisplayName(text);
+   asn1Objects->AppendElement(algID, PR_FALSE);
+-  nsCOMPtr<nsIASN1PrintableItem>printableItem = new nsNSSASN1PrintableItem();
++  nsIASN1PrintableItem*printableItem = new nsNSSASN1PrintableItem();
+   nssComponent->GetPIPNSSBundleString("CertDumpCertSig", text);
+   printableItem->SetDisplayName(text);
+   // The signatureWrap is encoded as a bit string.
+@@ -2145,7 +2145,7 @@ getNSSCertNicknamesFromCertList(CERTCert
+ {
+   nsresult rv;
+ 
+-  nsCOMPtr<nsINSSComponent> nssComponent(do_GetService(kNSSComponentCID, &rv));
++  nsINSSComponent* nssComponent(do_GetService(kNSSComponentCID, &rv));
+   if (NS_FAILED(rv))
+     return nsnull;
+ 
+diff --git a/security/manager/ssl/src/nsNSSCertValidity.cpp b/security/manager/ssl/src/nsNSSCertValidity.cpp
+--- a/security/manager/ssl/src/nsNSSCertValidity.cpp
++++ b/security/manager/ssl/src/nsNSSCertValidity.cpp
+@@ -88,7 +88,7 @@ NS_IMETHODIMP nsX509CertValidity::GetNot
+     return NS_ERROR_FAILURE;
+ 
+   nsresult rv;
+-  nsCOMPtr<nsIDateTimeFormat> dateFormatter =
++  nsIDateTimeFormat* dateFormatter =
+      do_CreateInstance(NS_DATETIMEFORMAT_CONTRACTID, &rv);
+   if (NS_FAILED(rv)) return rv;
+ 
+@@ -107,7 +107,7 @@ NS_IMETHODIMP nsX509CertValidity::GetNot
+     return NS_ERROR_FAILURE;
+ 
+   nsresult rv;
+-  nsCOMPtr<nsIDateTimeFormat> dateFormatter =
++  nsIDateTimeFormat* dateFormatter =
+      do_CreateInstance(NS_DATETIMEFORMAT_CONTRACTID, &rv);
+   if (NS_FAILED(rv)) return rv;
+ 
+@@ -127,7 +127,7 @@ NS_IMETHODIMP nsX509CertValidity::GetNot
+     return NS_ERROR_FAILURE;
+ 
+   nsresult rv;
+-  nsCOMPtr<nsIDateTimeFormat> dateFormatter =
++  nsIDateTimeFormat* dateFormatter =
+      do_CreateInstance(NS_DATETIMEFORMAT_CONTRACTID, &rv);
+   if (NS_FAILED(rv)) return rv;
+ 
+@@ -159,7 +159,7 @@ NS_IMETHODIMP nsX509CertValidity::GetNot
+     return NS_ERROR_FAILURE;
+ 
+   nsresult rv;
+-  nsCOMPtr<nsIDateTimeFormat> dateFormatter =
++  nsIDateTimeFormat* dateFormatter =
+      do_CreateInstance(NS_DATETIMEFORMAT_CONTRACTID, &rv);
+   if (NS_FAILED(rv)) return rv;
+ 
+@@ -178,7 +178,7 @@ NS_IMETHODIMP nsX509CertValidity::GetNot
+     return NS_ERROR_FAILURE;
+ 
+   nsresult rv;
+-  nsCOMPtr<nsIDateTimeFormat> dateFormatter =
++  nsIDateTimeFormat* dateFormatter =
+      do_CreateInstance(NS_DATETIMEFORMAT_CONTRACTID, &rv);
+   if (NS_FAILED(rv)) return rv;
+ 
+@@ -197,7 +197,7 @@ NS_IMETHODIMP nsX509CertValidity::GetNot
+     return NS_ERROR_FAILURE;
+ 
+   nsresult rv;
+-  nsCOMPtr<nsIDateTimeFormat> dateFormatter =
++  nsIDateTimeFormat* dateFormatter =
+      do_CreateInstance(NS_DATETIMEFORMAT_CONTRACTID, &rv);
+   if (NS_FAILED(rv)) return rv;
+ 
+diff --git a/security/manager/ssl/src/nsNSSCertificate.cpp b/security/manager/ssl/src/nsNSSCertificate.cpp
+--- a/security/manager/ssl/src/nsNSSCertificate.cpp
++++ b/security/manager/ssl/src/nsNSSCertificate.cpp
+@@ -193,7 +193,7 @@ void nsNSSCertificate::destructorSafeDes
+ 
+   if (mPermDelete) {
+     if (mCertType == nsNSSCertificate::USER_CERT) {
+-      nsCOMPtr<nsIInterfaceRequestor> cxt = new PipUIContext();
++      nsIInterfaceRequestor* cxt = new PipUIContext();
+       PK11_DeleteTokenCertAndKey(mCert, cxt);
+     } else if (!PK11_IsReadOnly(mCert->slot)) {
+       // If the list of built-ins does contain a non-removable
+@@ -228,7 +228,7 @@ nsNSSCertificate::MarkForPermDeletion()
+     return NS_ERROR_NOT_AVAILABLE;
+ 
+   // make sure user is logged in to the token
+-  nsCOMPtr<nsIInterfaceRequestor> ctx = new PipUIContext();
++  nsIInterfaceRequestor* ctx = new PipUIContext();
+ 
+   if (PK11_NeedLogin(mCert->slot)
+       && !PK11_NeedUserInit(mCert->slot)
+@@ -332,18 +332,18 @@ nsNSSCertificate::FormatUIStrings(const 
+ {
+   nsresult rv = NS_OK;
+ 
+-  nsCOMPtr<nsINSSComponent> nssComponent(do_GetService(kNSSComponentCID, &rv));
++  nsINSSComponent* nssComponent(do_GetService(kNSSComponentCID, &rv));
+ 
+   if (NS_FAILED(rv) || !nssComponent) {
+     return NS_ERROR_FAILURE;
+   }
+   
+-  nsCOMPtr<nsIX509Cert> x509Proxy;
++  nsIX509Cert* x509Proxy;
+   NS_GetProxyForObject( NS_PROXY_TO_MAIN_THREAD,
+                         NS_GET_IID(nsIX509Cert),
+                         static_cast<nsIX509Cert*>(this),
+                         NS_PROXY_SYNC | NS_PROXY_ALWAYS,
+-                        getter_AddRefs(x509Proxy));
++                        (void**)&x509Proxy);
+ 
+   if (!x509Proxy) {
+     rv = NS_ERROR_OUT_OF_MEMORY;
+@@ -382,15 +382,15 @@ nsNSSCertificate::FormatUIStrings(const 
+ 
+ 
+     {
+-      nsCOMPtr<nsIX509CertValidity> validity;
+-      nsCOMPtr<nsIX509CertValidity> originalValidity;
+-      rv = x509Proxy->GetValidity(getter_AddRefs(originalValidity));
++      nsIX509CertValidity* validity;
++      nsIX509CertValidity* originalValidity;
++      rv = x509Proxy->GetValidity(&originalValidity);
+       if (NS_SUCCEEDED(rv) && originalValidity) {
+         NS_GetProxyForObject( NS_PROXY_TO_MAIN_THREAD,
+                               NS_GET_IID(nsIX509CertValidity),
+                               originalValidity,
+                               NS_PROXY_SYNC | NS_PROXY_ALWAYS,
+-                              getter_AddRefs(validity));
++                              (void**)&validity);
+       }
+ 
+       if (validity) {
+@@ -590,7 +590,7 @@ nsNSSCertificate::GetNickname(nsAString 
+     CopyUTF8toUTF16(mCert->nickname, aNickname);
+   } else {
+     nsresult rv;
+-    nsCOMPtr<nsINSSComponent> nssComponent(do_GetService(kNSSComponentCID, &rv));
++    nsINSSComponent* nssComponent(do_GetService(kNSSComponentCID, &rv));
+     if (NS_FAILED(rv) || !nssComponent) {
+       return NS_ERROR_FAILURE;
+     }
+@@ -610,7 +610,7 @@ nsNSSCertificate::GetEmailAddress(nsAStr
+     CopyUTF8toUTF16(mCert->emailAddr, aEmailAddress);
+   } else {
+     nsresult rv;
+-    nsCOMPtr<nsINSSComponent> nssComponent(do_GetService(kNSSComponentCID, &rv));
++    nsINSSComponent* nssComponent(do_GetService(kNSSComponentCID, &rv));
+     if (NS_FAILED(rv) || !nssComponent) {
+       return NS_ERROR_FAILURE;
+     }
+@@ -801,7 +801,7 @@ nsNSSCertificate::GetIssuer(nsIX509Cert 
+   CERTCertificate *issuer;
+   issuer = CERT_FindCertIssuer(mCert, PR_Now(), certUsageSSLClient);
+   if (issuer) {
+-    nsCOMPtr<nsIX509Cert> cert = new nsNSSCertificate(issuer);
++    nsIX509Cert* cert = new nsNSSCertificate(issuer);
+     *aIssuer = cert;
+     CERT_DestroyCertificate(issuer);
+   }
+@@ -847,7 +847,7 @@ nsNSSCertificate::GetChain(nsIArray **_r
+   if (!nssChain)
+     return NS_ERROR_FAILURE;
+   /* enumerate the chain for scripting purposes */
+-  nsCOMPtr<nsIMutableArray> array =
++  nsIMutableArray* array =
+     do_CreateInstance(NS_ARRAY_CONTRACTID, &rv);
+   if (NS_FAILED(rv)) { 
+     goto done; 
+@@ -857,7 +857,7 @@ nsNSSCertificate::GetChain(nsIArray **_r
+        !CERT_LIST_END(node, nssChain);
+        node = CERT_LIST_NEXT(node)) {
+     PR_LOG(gPIPNSSLog, PR_LOG_DEBUG, ("adding %s to chain\n", node->cert->nickname));
+-    nsCOMPtr<nsIX509Cert> cert = new nsNSSCertificate(node->cert);
++    nsIX509Cert* cert = new nsNSSCertificate(node->cert);
+     array->AppendElement(cert, PR_FALSE);
+   }
+   *_rvChain = array;
+@@ -985,7 +985,7 @@ nsNSSCertificate::GetTokenName(nsAString
+     } else {
+       nsresult rv;
+       nsAutoString tok;
+-      nsCOMPtr<nsINSSComponent> nssComponent(do_GetService(kNSSComponentCID, &rv));
++      nsINSSComponent* nssComponent(do_GetService(kNSSComponentCID, &rv));
+       if (NS_FAILED(rv)) return rv;
+       rv = nssComponent->GetPIPNSSBundleString("InternalToken", tok);
+       if (NS_SUCCEEDED(rv))
+@@ -1444,7 +1444,7 @@ nsNSSCertificate::Equals(nsIX509Cert *ot
+   NS_ENSURE_ARG(other);
+   NS_ENSURE_ARG(result);
+ 
+-  nsCOMPtr<nsIX509Cert2> other2 = do_QueryInterface(other);
++  nsIX509Cert2* other2 = do_QueryInterface(other);
+   if (!other2)
+     return NS_ERROR_FAILURE;
+  
+@@ -1535,7 +1535,7 @@ nsNSSCertList::AddCert(nsIX509Cert *aCer
+ {
+   /* This should be a query interface, but currently this his how the
+    * rest of PSM is working */
+-  nsCOMPtr<nsIX509Cert2> nssCert = do_QueryInterface(aCert);
++  nsIX509Cert2* nssCert = do_QueryInterface(aCert);
+   CERTCertificate *cert;
+ 
+   cert = nssCert->GetCert();
+@@ -1558,7 +1558,7 @@ nsNSSCertList::DeleteCert(nsIX509Cert *a
+ {
+   /* This should be a query interface, but currently this his how the
+    * rest of PSM is working */
+-  nsCOMPtr<nsIX509Cert2> nssCert = do_QueryInterface(aCert);
++  nsIX509Cert2* nssCert = do_QueryInterface(aCert);
+   CERTCertificate *cert = nssCert->GetCert();
+   CERTCertListNode *node;
+ 
+@@ -1613,7 +1613,7 @@ NS_IMETHODIMP
+ NS_IMETHODIMP
+ nsNSSCertList::GetEnumerator(nsISimpleEnumerator **_retval) 
+ {
+-  nsCOMPtr<nsISimpleEnumerator> enumerator = new nsNSSCertListEnumerator(mCertList);
++  nsISimpleEnumerator* enumerator = new nsNSSCertListEnumerator(mCertList);
+   if (!enumerator) { 
+     return NS_ERROR_OUT_OF_MEMORY;
+   }
+@@ -1658,7 +1658,7 @@ nsNSSCertListEnumerator::GetNext(nsISupp
+     return NS_ERROR_FAILURE;
+   }
+ 
+-  nsCOMPtr<nsIX509Cert> nssCert = new nsNSSCertificate(node->cert);
++  nsIX509Cert* nssCert = new nsNSSCertificate(node->cert);
+   if (!nssCert) { 
+     return NS_ERROR_OUT_OF_MEMORY;
+   }
+diff --git a/security/manager/ssl/src/nsNSSCertificateDB.cpp b/security/manager/ssl/src/nsNSSCertificateDB.cpp
+--- a/security/manager/ssl/src/nsNSSCertificateDB.cpp
++++ b/security/manager/ssl/src/nsNSSCertificateDB.cpp
+@@ -122,7 +122,7 @@ nsNSSCertificateDB::FindCertByNickname(n
+   }
+   if (cert) {
+     PR_LOG(gPIPNSSLog, PR_LOG_DEBUG, ("got it\n"));
+-    nsCOMPtr<nsIX509Cert> pCert = new nsNSSCertificate(cert);
++    nsIX509Cert* pCert = new nsNSSCertificate(cert);
+     CERT_DestroyCertificate(cert);
+     *_rvCert = pCert;
+     return NS_OK;
+@@ -294,18 +294,18 @@ nsNSSCertificateDB::handleCACertDownload
+   if (numCerts == 0)
+     return NS_OK; // Nothing to import, so nothing to do.
+ 
+-  nsCOMPtr<nsIX509Cert> certToShow;
+-  nsCOMPtr<nsISupports> isupports;
++  nsIX509Cert* certToShow;
++  nsISupports* isupports;
+   PRUint32 selCertIndex;
+   if (numCerts == 1) {
+     // There's only one cert, so let's show it.
+     selCertIndex = 0;
+     certToShow = do_QueryElementAt(x509Certs, selCertIndex);
+   } else {
+-    nsCOMPtr<nsIX509Cert> cert0;    // first cert
+-    nsCOMPtr<nsIX509Cert> cert1;    // second cert
+-    nsCOMPtr<nsIX509Cert> certn_2;  // second to last cert
+-    nsCOMPtr<nsIX509Cert> certn_1;  // last cert
++    nsIX509Cert* cert0;    // first cert
++    nsIX509Cert* cert1;    // second cert
++    nsIX509Cert* certn_2;  // second to last cert
++    nsIX509Cert* certn_1;  // last cert
+ 
+     cert0 = do_QueryElementAt(x509Certs, 0);
+     cert1 = do_QueryElementAt(x509Certs, 1);
+@@ -344,8 +344,8 @@ nsNSSCertificateDB::handleCACertDownload
+   if (!certToShow)
+     return NS_ERROR_FAILURE;
+ 
+-  nsCOMPtr<nsICertificateDialogs> dialogs;
+-  nsresult rv = ::getNSSDialogs(getter_AddRefs(dialogs), 
++  nsICertificateDialogs* dialogs;
++  nsresult rv = ::getNSSDialogs((void**)&dialogs, 
+                                 NS_GET_IID(nsICertificateDialogs),
+                                 NS_CERTIFICATEDIALOGS_CONTRACTID);
+                        
+@@ -477,7 +477,7 @@ nsNSSCertificateDB::ImportCertificates(P
+     PORT_FreeArena(arena, PR_FALSE);
+     return NS_ERROR_FAILURE;
+   }
+-  nsCOMPtr<nsIMutableArray> array =
++  nsIMutableArray* array =
+     do_CreateInstance(NS_ARRAY_CONTRACTID, &nsrv);
+   if (NS_FAILED(nsrv)) {
+     PORT_FreeArena(arena, PR_FALSE);
+@@ -485,7 +485,7 @@ nsNSSCertificateDB::ImportCertificates(P
+   }
+ 
+   // Now let's create some certs to work with
+-  nsCOMPtr<nsIX509Cert> x509Cert;
++  nsIX509Cert* x509Cert;
+   nsNSSCertificate *nssCert;
+   SECItem *currItem;
+   for (int i=0; i<certCollection->numcerts; i++) {
+@@ -612,7 +612,7 @@ nsNSSCertificateDB::ImportEmailCertifica
+     }
+ 
+     if (alert_and_skip) {    
+-      nsCOMPtr<nsIX509Cert> certToShow = new nsNSSCertificate(node->cert);
++      nsIX509Cert* certToShow = new nsNSSCertificate(node->cert);
+       DisplayCertificateAlert(ctx, "NotImportingUnverifiedCert", certToShow);
+       continue;
+     }
+@@ -803,7 +803,7 @@ nsNSSCertificateDB::ImportValidCACertsIn
+     }
+ 
+     if (alert_and_skip) {    
+-      nsCOMPtr<nsIX509Cert> certToShow = new nsNSSCertificate(node->cert);
++      nsIX509Cert* certToShow = new nsNSSCertificate(node->cert);
+       DisplayCertificateAlert(ctx, "NotImportingUnverifiedCert", certToShow);
+       continue;
+     }
+@@ -836,7 +836,7 @@ void nsNSSCertificateDB::DisplayCertific
+   nsPSMUITracker tracker;
+   if (!tracker.isUIForbidden()) {
+ 
+-    nsCOMPtr<nsIInterfaceRequestor> my_cxt = ctx;
++    nsIInterfaceRequestor* my_cxt = ctx;
+     if (!my_cxt)
+       my_cxt = new PipUIContext();
+ 
+@@ -844,7 +844,7 @@ void nsNSSCertificateDB::DisplayCertific
+     // as discussed in bug 310446, and should make use of certToShow.
+ 
+     nsresult rv;
+-    nsCOMPtr<nsINSSComponent> nssComponent(do_GetService(kNSSComponentCID, &rv));
++    nsINSSComponent* nssComponent(do_GetService(kNSSComponentCID, &rv));
+     if (NS_SUCCEEDED(rv)) {
+       nsAutoString tmpMessage;
+       nssComponent->GetPIPNSSBundleString(stringID, tmpMessage);
+@@ -852,25 +852,25 @@ void nsNSSCertificateDB::DisplayCertific
+       // The interface requestor object may not be safe, so proxy the call to get
+       // the nsIPrompt.
+ 
+-      nsCOMPtr<nsIInterfaceRequestor> proxiedCallbacks;
++      nsIInterfaceRequestor* proxiedCallbacks;
+       NS_GetProxyForObject(NS_PROXY_TO_MAIN_THREAD,
+                            NS_GET_IID(nsIInterfaceRequestor),
+                            my_cxt,
+                            NS_PROXY_SYNC,
+-                           getter_AddRefs(proxiedCallbacks));
++                           (void**)&proxiedCallbacks);
+     
+-      nsCOMPtr<nsIPrompt> prompt (do_GetInterface(proxiedCallbacks));
++      nsIPrompt* prompt (do_GetInterface(proxiedCallbacks));
+       if (!prompt)
+         return;
+     
+       // Finally, get a proxy for the nsIPrompt
+     
+-      nsCOMPtr<nsIPrompt> proxyPrompt;
++      nsIPrompt* proxyPrompt;
+       NS_GetProxyForObject(NS_PROXY_TO_MAIN_THREAD,
+                            NS_GET_IID(nsIPrompt),
+                            prompt,
+                            NS_PROXY_SYNC,
+-                           getter_AddRefs(proxyPrompt));
++                           (void**)&proxyPrompt);
+     
+       proxyPrompt->Alert(nsnull, tmpMessage.get());
+     }
+@@ -909,7 +909,7 @@ nsNSSCertificateDB::ImportUserCertificat
+ 
+   slot = PK11_KeyForCertExists(cert, NULL, ctx);
+   if ( slot == NULL ) {
+-    nsCOMPtr<nsIX509Cert> certToShow = new nsNSSCertificate(cert);
++    nsIX509Cert* certToShow = new nsNSSCertificate(cert);
+     DisplayCertificateAlert(ctx, "UserCertIgnoredNoPrivateKey", certToShow);
+     goto loser;
+   }
+@@ -934,7 +934,7 @@ nsNSSCertificateDB::ImportUserCertificat
+   PK11_FreeSlot(slot);
+ 
+   {
+-    nsCOMPtr<nsIX509Cert> certToShow = new nsNSSCertificate(cert);
++    nsIX509Cert* certToShow = new nsNSSCertificate(cert);
+     DisplayCertificateAlert(ctx, "UserCertImported", certToShow);
+   }
+   rv = NS_OK;
+@@ -962,7 +962,7 @@ nsNSSCertificateDB::DeleteCertificate(ns
+ nsNSSCertificateDB::DeleteCertificate(nsIX509Cert *aCert)
+ {
+   nsNSSShutDownPreventionLock locker;
+-  nsCOMPtr<nsIX509Cert2> nssCert = do_QueryInterface(aCert);
++  nsIX509Cert2* nssCert = do_QueryInterface(aCert);
+   CERTCertificate *cert = nssCert->GetCert();
+   if (!cert) return NS_ERROR_FAILURE;
+   CERTCertificateCleaner certCleaner(cert);
+@@ -1004,7 +1004,7 @@ nsNSSCertificateDB::SetCertTrust(nsIX509
+   nsNSSShutDownPreventionLock locker;
+   SECStatus srv;
+   nsNSSCertTrust trust;
+-  nsCOMPtr<nsIX509Cert2> pipCert = do_QueryInterface(cert);
++  nsIX509Cert2* pipCert = do_QueryInterface(cert);
+   if (!pipCert)
+     return NS_ERROR_FAILURE;
+   CERTCertificate *nsscert = pipCert->GetCert();
+@@ -1050,7 +1050,7 @@ nsNSSCertificateDB::IsCertTrusted(nsIX50
+ 
+   nsNSSShutDownPreventionLock locker;
+   SECStatus srv;
+-  nsCOMPtr<nsIX509Cert2> pipCert = do_QueryInterface(cert);
++  nsIX509Cert2* pipCert = do_QueryInterface(cert);
+   CERTCertificate *nsscert = pipCert->GetCert();
+   CERTCertTrust nsstrust;
+   srv = CERT_GetCertTrust(nsscert, &nsstrust);
+@@ -1137,7 +1137,7 @@ nsNSSCertificateDB::ImportCertsFromFile(
+   if (bytes_obtained != file_info.size)
+     rv = NS_ERROR_FAILURE;
+   else {
+-	  nsCOMPtr<nsIInterfaceRequestor> cxt = new PipUIContext();
++	  nsIInterfaceRequestor* cxt = new PipUIContext();
+ 
+     switch (aType) {
+       case nsIX509Cert::CA_CERT:
+@@ -1167,7 +1167,7 @@ nsNSSCertificateDB::ImportPKCS12File(nsI
+ {
+   NS_ENSURE_ARG(aFile);
+   nsPKCS12Blob blob;
+-  nsCOMPtr<nsIPK11Token> token = do_QueryInterface(aToken);
++  nsIPK11Token* token = do_QueryInterface(aToken);
+   if (token) {
+     blob.SetToken(token);
+   }
+@@ -1185,7 +1185,7 @@ nsNSSCertificateDB::ExportPKCS12File(nsI
+   NS_ENSURE_ARG(aFile);
+   nsPKCS12Blob blob;
+   if (count == 0) return NS_OK;
+-  nsCOMPtr<nsIPK11Token> localRef;
++  nsIPK11Token* localRef;
+   if (!aToken) {
+     PK11SlotInfo *keySlot = PK11_GetInternalKeySlot();
+     NS_ASSERTION(keySlot,"Failed to get the internal key slot");
+@@ -1230,14 +1230,14 @@ GetOCSPResponders (CERTCertificate *aCer
+   nickname = aCert->nickname;
+   nn = ToNewUnicode(NS_ConvertUTF8toUTF16(nickname));
+ 
+-  nsCOMPtr<nsIOCSPResponder> new_entry = new nsOCSPResponder(nn, url);
++  nsIOCSPResponder* new_entry = new nsOCSPResponder(nn, url);
+   nsMemory::Free(nn);
+   nsMemory::Free(url);
+ 
+   // Sort the items according to nickname //
+   rv = array->GetLength(&count);
+   for (i=0; i < count; ++i) {
+-    nsCOMPtr<nsIOCSPResponder> entry = do_QueryElementAt(array, i);
++    nsIOCSPResponder* entry = do_QueryElementAt(array, i);
+     if (nsOCSPResponder::CompareEntries(new_entry, entry) < 0) {
+       array->InsertElementAt(new_entry, i, PR_FALSE);
+       break;
+@@ -1261,7 +1261,7 @@ nsNSSCertificateDB::GetOCSPResponders(ns
+ {
+   nsNSSShutDownPreventionLock locker;
+   SECStatus sec_rv;
+-  nsCOMPtr<nsIMutableArray> respondersArray =
++  nsIMutableArray* respondersArray =
+     do_CreateInstance(NS_ARRAY_CONTRACTID);
+   if (!respondersArray) {
+     return NS_ERROR_OUT_OF_MEMORY;
+@@ -1354,7 +1354,7 @@ NS_IMETHODIMP
+ NS_IMETHODIMP 
+ nsNSSCertificateDB::GetIsOcspOn(PRBool *aOcspOn)
+ {
+-  nsCOMPtr<nsIPrefBranch> pref = do_GetService(NS_PREFSERVICE_CONTRACTID);
++  nsIPrefBranch* pref = do_GetService(NS_PREFSERVICE_CONTRACTID);
+ 
+   PRInt32 ocspEnabled;
+   pref->GetIntPref("security.OCSP.enabled", &ocspEnabled);
+@@ -1377,7 +1377,7 @@ nsNSSCertificateDB::FindEmailEncryptionC
+   nsNSSShutDownPreventionLock locker;
+   nsresult rv = NS_OK;
+   CERTCertificate *cert = 0;
+-  nsCOMPtr<nsIInterfaceRequestor> ctx = new PipUIContext();
++  nsIInterfaceRequestor* ctx = new PipUIContext();
+   nsNSSCertificate *nssCert = nsnull;
+   char *asciiname = NULL;
+   NS_ConvertUTF16toUTF8 aUtf8Nickname(aNickname);
+@@ -1416,7 +1416,7 @@ nsNSSCertificateDB::FindEmailSigningCert
+   nsNSSShutDownPreventionLock locker;
+   nsresult rv = NS_OK;
+   CERTCertificate *cert = 0;
+-  nsCOMPtr<nsIInterfaceRequestor> ctx = new PipUIContext();
++  nsIInterfaceRequestor* ctx = new PipUIContext();
+   nsNSSCertificate *nssCert = nsnull;
+   char *asciiname = NULL;
+   NS_ConvertUTF16toUTF8 aUtf8Nickname(aNickname);
+@@ -1554,7 +1554,7 @@ nsNSSCertificateDB::default_nickname(CER
+   nsAutoString tmpNickFmtWithNum;
+ 
+   CERTCertDBHandle *defaultcertdb = CERT_GetDefaultCertDB();
+-  nsCOMPtr<nsINSSComponent> nssComponent(do_GetService(kNSSComponentCID, &rv));
++  nsINSSComponent* nssComponent(do_GetService(kNSSComponentCID, &rv));
+   if (NS_FAILED(rv)) goto loser; 
+ 
+   username = CERT_GetCommonName(&cert->subject);
+@@ -1674,7 +1674,7 @@ NS_IMETHODIMP nsNSSCertificateDB::AddCer
+ NS_IMETHODIMP nsNSSCertificateDB::AddCertFromBase64(const char *aBase64, const char *aTrust, const char *aName)
+ {
+   NS_ENSURE_ARG_POINTER(aBase64);
+-  nsCOMPtr <nsIX509Cert> newCert;
++  nsIX509Cert* newCert;
+ 
+   nsNSSCertTrust trust;
+ 
+@@ -1683,7 +1683,7 @@ NS_IMETHODIMP nsNSSCertificateDB::AddCer
+   NS_ENSURE_SUCCESS(rv, rv); // if bad trust passed in, return error.
+ 
+ 
+-  rv = ConstructX509FromBase64(aBase64, getter_AddRefs(newCert));
++  rv = ConstructX509FromBase64(aBase64, &newCert);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+   SECItem der;
+@@ -1731,8 +1731,8 @@ nsNSSCertificateDB::GetCerts(nsIX509Cert
+ {
+   CERTCertList *certList;
+ 
+-  nsCOMPtr<nsIInterfaceRequestor> ctx = new PipUIContext();
+-  nsCOMPtr<nsIX509CertList> nssCertList;
++  nsIInterfaceRequestor* ctx = new PipUIContext();
++  nsIX509CertList* nssCertList;
+   certList = PK11_ListCerts(PK11CertListUnique, ctx);
+ 
+   // nsNSSCertList 1) adopts certList, and 2) handles the NULL case fine.
+diff --git a/security/manager/ssl/src/nsNSSComponent.cpp b/security/manager/ssl/src/nsNSSComponent.cpp
+--- a/security/manager/ssl/src/nsNSSComponent.cpp
++++ b/security/manager/ssl/src/nsNSSComponent.cpp
+@@ -225,8 +225,8 @@ public:
+     if (!mListener || mURLString.IsEmpty())
+       return NS_OK;
+ 
+-    nsCOMPtr<nsIURI> uri;
+-    nsresult rv = NS_NewURI(getter_AddRefs(uri), mURLString);
++    nsIURI* uri;
++    nsresult rv = NS_NewURI(&uri, mURLString);
+     if (NS_SUCCEEDED(rv)){
+       NS_OpenURI(mListener, nsnull, uri);
+     }
+@@ -267,7 +267,7 @@ nsTokenEventRunnable::Run()
+ nsTokenEventRunnable::Run()
+ { 
+   nsresult rv;
+-  nsCOMPtr<nsINSSComponent> nssComponent(do_GetService(kNSSComponentCID, &rv));
++  nsINSSComponent* nssComponent(do_GetService(kNSSComponentCID, &rv));
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -359,7 +359,7 @@ nsNSSComponent::PostEvent(const nsAStrin
+ nsNSSComponent::PostEvent(const nsAString &eventType, 
+                                                   const nsAString &tokenName)
+ {
+-  nsCOMPtr<nsIRunnable> runnable = 
++  nsIRunnable* runnable = 
+                                new nsTokenEventRunnable(eventType, tokenName);
+   if (!runnable) {
+     return NS_ERROR_OUT_OF_MEMORY;
+@@ -376,15 +376,15 @@ nsNSSComponent::DispatchEvent(const nsAS
+   // 'Dispatch' the event to all the windows. 'DispatchEventToWindow()' will
+   // first check to see if a given window has requested crypto events.
+   nsresult rv;
+-  nsCOMPtr<nsIWindowWatcher> windowWatcher =
++  nsIWindowWatcher* windowWatcher =
+                             do_GetService(NS_WINDOWWATCHER_CONTRACTID, &rv);
+ 
+   if (NS_FAILED(rv)) {
+     return rv;
+   }
+ 
+-  nsCOMPtr<nsISimpleEnumerator> enumerator;
+-  rv = windowWatcher->GetWindowEnumerator(getter_AddRefs(enumerator));
++  nsISimpleEnumerator* enumerator;
++  rv = windowWatcher->GetWindowEnumerator(&enumerator);
+   if (NS_FAILED(rv)) {
+     return rv;
+   }
+@@ -393,9 +393,9 @@ nsNSSComponent::DispatchEvent(const nsAS
+ 
+   while (NS_SUCCEEDED(enumerator->HasMoreElements(&hasMoreWindows))
+          && hasMoreWindows) {
+-    nsCOMPtr<nsISupports> supports;
+-    enumerator->GetNext(getter_AddRefs(supports));
+-    nsCOMPtr<nsIDOMWindow> domWin(do_QueryInterface(supports));
++    nsISupports* supports;
++    enumerator->GetNext(&supports);
++    nsIDOMWindow* domWin(do_QueryInterface(supports));
+     if (domWin) {
+       nsresult rv2 = DispatchEventToWindow(domWin, eventType, tokenName);
+       if (NS_FAILED(rv2)) {
+@@ -415,8 +415,8 @@ nsNSSComponent::DispatchEventToWindow(ns
+   // first walk the children and dispatch their events 
+   {
+     nsresult rv;
+-    nsCOMPtr<nsIDOMWindowCollection> frames;
+-    rv = domWin->GetFrames(getter_AddRefs(frames));
++    nsIDOMWindowCollection* frames;
++    rv = domWin->GetFrames(&frames);
+     if (NS_FAILED(rv)) {
+       return rv;
+     }
+@@ -425,8 +425,8 @@ nsNSSComponent::DispatchEventToWindow(ns
+     frames->GetLength(&length);
+     PRUint32 i;
+     for (i = 0; i < length; i++) {
+-      nsCOMPtr<nsIDOMWindow> childWin;
+-      frames->Item(i, getter_AddRefs(childWin));
++      nsIDOMWindow* childWin;
++      frames->Item(i, &childWin);
+       DispatchEventToWindow(childWin, eventType, tokenName);
+     }
+   }
+@@ -435,13 +435,13 @@ nsNSSComponent::DispatchEventToWindow(ns
+   // NOTE: it's not an error to say that we aren't going to dispatch
+   // the event.
+   {
+-    nsCOMPtr<nsIDOMWindowInternal> intWindow = do_QueryInterface(domWin);
++    nsIDOMWindowInternal* intWindow = do_QueryInterface(domWin);
+     if (!intWindow) {
+       return NS_OK; // nope, it's not an internal window
+     }
+ 
+-    nsCOMPtr<nsIDOMCrypto> crypto;
+-    intWindow->GetCrypto(getter_AddRefs(crypto));
++    nsIDOMCrypto* crypto;
++    intWindow->GetCrypto(&crypto);
+     if (!crypto) {
+       return NS_OK; // nope, it doesn't have a crypto property
+     }
+@@ -457,21 +457,21 @@ nsNSSComponent::DispatchEventToWindow(ns
+ 
+   nsresult rv;
+   // find the document
+-  nsCOMPtr<nsIDOMDocument> doc;
+-  rv = domWin->GetDocument(getter_AddRefs(doc));
++  nsIDOMDocument* doc;
++  rv = domWin->GetDocument(&doc);
+   if (doc == nsnull) {
+     return NS_FAILED(rv) ? rv : NS_ERROR_FAILURE;
+   }
+ 
+   // create the event
+-  nsCOMPtr<nsIDOMDocumentEvent> docEvent = do_QueryInterface(doc, &rv);
++  nsIDOMDocumentEvent* docEvent = do_QueryInterface(doc, &rv);
+   if (NS_FAILED(rv)) {
+     return rv;
+   }
+ 
+-  nsCOMPtr<nsIDOMEvent> event;
++  nsIDOMEvent* event;
+   rv = docEvent->CreateEvent(NS_LITERAL_STRING("Events"), 
+-                             getter_AddRefs(event));
++                             &event);
+   if (NS_FAILED(rv)) {
+     return rv;
+   }
+@@ -479,7 +479,7 @@ nsNSSComponent::DispatchEventToWindow(ns
+   event->InitEvent(eventType, false, true);
+ 
+   // create the Smart Card Event;
+-  nsCOMPtr<nsIDOMSmartCardEvent> smartCardEvent = 
++  nsIDOMSmartCardEvent* smartCardEvent = 
+                                           new nsSmartCardEvent(tokenName);
+   // init the smart card event, fail here if we can't complete the 
+   // initialization.
+@@ -493,7 +493,7 @@ nsNSSComponent::DispatchEventToWindow(ns
+   }
+ 
+   // Send it 
+-  nsCOMPtr<nsIDOMEventTarget> target = do_QueryInterface(doc, &rv);
++  nsIDOMEventTarget* target = do_QueryInterface(doc, &rv);
+   if (NS_FAILED(rv)) {
+     return rv;
+   }
+@@ -744,7 +744,7 @@ nsNSSComponent::InstallLoadableRoots()
+   rv = GetPIPNSSBundleString("RootCertModuleName", modName);
+   if (NS_FAILED(rv)) return;
+ 
+-  nsCOMPtr<nsIProperties> directoryService(do_GetService(NS_DIRECTORY_SERVICE_CONTRACTID));
++  nsIProperties* directoryService(do_GetService(NS_DIRECTORY_SERVICE_CONTRACTID));
+   if (!directoryService)
+     return;
+ 
+@@ -757,7 +757,7 @@ nsNSSComponent::InstallLoadableRoots()
+   };
+ 
+   for (size_t il = 0; il < sizeof(possible_ckbi_locations)/sizeof(const char*); ++il) {
+-    nsCOMPtr<nsILocalFile> mozFile;
++    nsILocalFile* mozFile;
+     char *fullLibraryPath = nsnull;
+ 
+     if (!possible_ckbi_locations[il])
+@@ -768,7 +768,7 @@ nsNSSComponent::InstallLoadableRoots()
+     {
+       directoryService->Get( possible_ckbi_locations[il],
+                              NS_GET_IID(nsILocalFile), 
+-                             getter_AddRefs(mozFile));
++                             (void**)&mozFile);
+   
+       if (!mozFile) {
+         continue;
+@@ -895,7 +895,7 @@ nsNSSComponent::InitializePIPNSSBundle()
+   // Called during init only, no mutex required.
+ 
+   nsresult rv;
+-  nsCOMPtr<nsIStringBundleService> bundleService(do_GetService(NS_STRINGBUNDLE_CONTRACTID, &rv));
++  nsIStringBundleService* bundleService(do_GetService(NS_STRINGBUNDLE_CONTRACTID, &rv));
+   if (NS_FAILED(rv) || !bundleService) 
+     return NS_ERROR_FAILURE;
+   
+@@ -919,7 +919,7 @@ nsNSSComponent::RegisterPSMContentListen
+ 
+   nsresult rv = NS_OK;
+   if (!mPSMContentListener) {
+-    nsCOMPtr<nsIURILoader> dispatcher(do_GetService(NS_URI_LOADER_CONTRACTID));
++    nsIURILoader* dispatcher(do_GetService(NS_URI_LOADER_CONTRACTID));
+     if (dispatcher) {
+       mPSMContentListener = do_CreateInstance(NS_PSMCONTENTLISTEN_CONTRACTID);
+       rv = dispatcher->RegisterContentListener(mPSMContentListener);
+@@ -1064,7 +1064,7 @@ nsNSSComponent::PostCRLImportEvent(const
+                                    nsIStreamListener *listener)
+ {
+   //Create the event
+-  nsCOMPtr<nsIRunnable> event = new CRLDownloadEvent(urlString, listener);
++  nsIRunnable* event = new CRLDownloadEvent(urlString, listener);
+   if (!event)
+     return NS_ERROR_OUT_OF_MEMORY;
+ 
+@@ -1077,7 +1077,7 @@ nsNSSComponent::DownloadCRLDirectly(nsAu
+ {
+   //This api is meant to support direct interactive update of crl from the crl manager
+   //or other such ui.
+-  nsCOMPtr<nsIStreamListener> listener =
++  nsIStreamListener* listener =
+       new PSMContentDownloader(PSMContentDownloader::PKCS7_CRL);
+   
+   NS_ConvertUTF16toUTF8 url8(url);
+@@ -1091,7 +1091,7 @@ nsresult nsNSSComponent::DownloadCrlSile
+   crlsScheduledForDownload->Put(&hashKey,(void *)nsnull);
+     
+   //Set up the download handler
+-  nsRefPtr<PSMContentDownloader> psmDownloader =
++  PSMContentDownloader* psmDownloader =
+       new PSMContentDownloader(PSMContentDownloader::PKCS7_CRL);
+   psmDownloader->setSilentDownload(PR_TRUE);
+   psmDownloader->setCrlAutodownloadKey(mCrlUpdateKey);
+@@ -1113,7 +1113,7 @@ nsresult nsNSSComponent::getParamsForNex
+   char *tempUrl;
+   nsresult rv;
+   
+-  nsCOMPtr<nsIPrefBranch> pref = do_GetService(NS_PREFSERVICE_CONTRACTID,&rv);
++  nsIPrefBranch* pref = do_GetService(NS_PREFSERVICE_CONTRACTID,&rv);
+   if(NS_FAILED(rv)){
+     return rv;
+   }
+@@ -1463,10 +1463,10 @@ nsNSSComponent::InitializeNSS(PRBool sho
+ 
+     nsresult rv;
+     nsCAutoString profileStr;
+-    nsCOMPtr<nsIFile> profilePath;
++    nsIFile* profilePath;
+ 
+     rv = NS_GetSpecialDirectory(NS_APP_USER_PROFILE_50_DIR,
+-                                getter_AddRefs(profilePath));
++                                &profilePath);
+     if (NS_FAILED(rv)) {
+       PR_LOG(gPIPNSSLog, PR_LOG_ERROR, ("Unable to get profile directory\n"));
+       ConfigureInternalPKCS11Token();
+@@ -1573,7 +1573,7 @@ nsNSSComponent::InitializeNSS(PRBool sho
+       PK11_SetPasswordFunc(PK11PasswordPrompt);
+ 
+       // Register an observer so we can inform NSS when these prefs change
+-      nsCOMPtr<nsIPrefBranch2> pbi = do_QueryInterface(mPrefBranch);
++      nsIPrefBranch2* pbi = do_QueryInterface(mPrefBranch);
+       pbi->AddObserver("security.", this, PR_FALSE);
+ 
+       PRBool enabled;
+@@ -1662,7 +1662,7 @@ nsNSSComponent::ShutdownNSS()
+     mHttpForNSS.unregisterHttpClient();
+ 
+     if (mPrefBranch) {
+-      nsCOMPtr<nsIPrefBranch2> pbi = do_QueryInterface(mPrefBranch);
++      nsIPrefBranch2* pbi = do_QueryInterface(mPrefBranch);
+       pbi->RemoveObserver("security.", this);
+     }
+ 
+@@ -1723,10 +1723,10 @@ nsNSSComponent::Init()
+   InitializeCRLUpdateTimer();
+   RegisterPSMContentListener();
+ 
+-  nsCOMPtr<nsIEntropyCollector> ec
++  nsIEntropyCollector* ec
+       = do_GetService(NS_ENTROPYCOLLECTOR_CONTRACTID);
+ 
+-  nsCOMPtr<nsIBufEntropyCollector> bec;
++  nsIBufEntropyCollector* bec;
+ 
+   if (ec) {
+     bec = do_QueryInterface(ec);
+@@ -1844,7 +1844,7 @@ nsNSSComponent::VerifySignature(const ch
+     // this way we don't have to worry about goto across variable
+     // declarations.  We have no loops in this code, so it's OK.
+     do {
+-      nsCOMPtr<nsIX509Cert> pCert = new nsNSSCertificate(cert);
++      nsIX509Cert* pCert = new nsNSSCertificate(cert);
+       if (!pCert) {
+         rv2 = NS_ERROR_OUT_OF_MEMORY;
+         break;
+@@ -1879,17 +1879,17 @@ nsNSSComponent::VerifySignature(const ch
+         break;
+       }
+     
+-      nsCOMPtr<nsIPrincipal> certPrincipal;
++      nsIPrincipal* certPrincipal;
+       rv2 = mScriptSecurityManager->
+         GetCertificatePrincipal(NS_ConvertUTF16toUTF8(fingerprint),
+                                 NS_ConvertUTF16toUTF8(subjectName),
+                                 NS_ConvertUTF16toUTF8(orgName),
+-                                pCert, nsnull, getter_AddRefs(certPrincipal));
++                                pCert, nsnull, &certPrincipal);
+       if (NS_FAILED(rv2) || !certPrincipal) {
+         break;
+       }
+       
+-      certPrincipal.swap(*aPrincipal);
++      swap(certPrincipal, *aPrincipal);
+     } while (0);
+   }
+ 
+@@ -1973,7 +1973,7 @@ nsNSSComponent::Observe(nsISupports *aSu
+     if (needsInit) {
+       if (NS_FAILED(InitializeNSS(PR_FALSE))) { // do not show a warning box on failure
+         PR_LOG(gPIPNSSLog, PR_LOG_ERROR, ("Unable to Initialize NSS after profile switch.\n"));
+-        nsCOMPtr<nsIProfileChangeStatus> status = do_QueryInterface(aSubject);
++        nsIProfileChangeStatus* status = do_QueryInterface(aSubject);
+         if (status) {
+           status->ChangeFailed();
+         }
+@@ -1991,18 +1991,18 @@ nsNSSComponent::Observe(nsISupports *aSu
+     if (mPSMContentListener) {
+       nsresult rv = NS_ERROR_FAILURE;
+ 
+-      nsCOMPtr<nsIURILoader> dispatcher(do_GetService(NS_URI_LOADER_CONTRACTID));
++      nsIURILoader* dispatcher(do_GetService(NS_URI_LOADER_CONTRACTID));
+       if (dispatcher) {
+         rv = dispatcher->UnRegisterContentListener(mPSMContentListener);
+       }
+       mPSMContentListener = nsnull;
+     }
+ 
+-    nsCOMPtr<nsIEntropyCollector> ec
++    nsIEntropyCollector* ec
+         = do_GetService(NS_ENTROPYCOLLECTOR_CONTRACTID);
+ 
+     if (ec) {
+-      nsCOMPtr<nsIBufEntropyCollector> bec
++      nsIBufEntropyCollector* bec
+         = do_QueryInterface(ec);
+       if (bec) {
+         bec->DontForward();
+@@ -2088,22 +2088,22 @@ void nsNSSComponent::ShowAlert(AlertIden
+   if (NS_FAILED(rv))
+     return;
+ 
+-  nsCOMPtr<nsIWindowWatcher> wwatch(do_GetService(NS_WINDOWWATCHER_CONTRACTID));
++  nsIWindowWatcher* wwatch(do_GetService(NS_WINDOWWATCHER_CONTRACTID));
+   if (!wwatch) {
+     PR_LOG(gPIPNSSLog, PR_LOG_DEBUG, ("can't get window watcher\n"));
+   }
+   else {
+-    nsCOMPtr<nsIPrompt> prompter;
+-    wwatch->GetNewPrompter(0, getter_AddRefs(prompter));
++    nsIPrompt* prompter;
++    wwatch->GetNewPrompter(0, &prompter);
+     if (!prompter) {
+       PR_LOG(gPIPNSSLog, PR_LOG_DEBUG, ("can't get window prompter\n"));
+     }
+     else {
+-      nsCOMPtr<nsIPrompt> proxyPrompt;
++      nsIPrompt* proxyPrompt;
+       NS_GetProxyForObject(NS_PROXY_TO_MAIN_THREAD,
+                            NS_GET_IID(nsIPrompt),
+                            prompter, NS_PROXY_SYNC,
+-                           getter_AddRefs(proxyPrompt));
++                           (void**)&proxyPrompt);
+       if (!proxyPrompt) {
+         PR_LOG(gPIPNSSLog, PR_LOG_DEBUG, ("can't get proxy for nsIPrompt\n"));
+       }
+@@ -2124,7 +2124,7 @@ nsNSSComponent::RegisterObservers()
+ {
+   // Happens once during init only, no mutex protection.
+ 
+-  nsCOMPtr<nsIObserverService> observerService(do_GetService("@mozilla.org/observer-service;1"));
++  nsIObserverService* observerService(do_GetService("@mozilla.org/observer-service;1"));
+   NS_ASSERTION(observerService, "could not get observer service");
+   if (observerService) {
+     mObserversRegistered = PR_TRUE;
+@@ -2234,7 +2234,7 @@ nsNSSComponent::GetErrorMessage(nsresult
+   if (!IS_SEC_ERROR(aNSPRCode) && !IS_SSL_ERROR(aNSPRCode))
+     return NS_ERROR_FAILURE;
+ 
+-  nsCOMPtr<nsIStringBundle> theBundle = mPIPNSSBundle;
++  nsIStringBundle* theBundle = mPIPNSSBundle;
+   const char *id_str = nsNSSErrors::getOverrideErrorStringName(aNSPRCode);
+ 
+   if (!id_str) {
+@@ -2260,7 +2260,7 @@ nsNSSComponent::DoProfileApproveChange(n
+ {
+   if (mShutdownObjectList->isUIActive()) {
+     ShowAlert(ai_crypto_ui_active);
+-    nsCOMPtr<nsIProfileChangeStatus> status = do_QueryInterface(aSubject);
++    nsIProfileChangeStatus* status = do_QueryInterface(aSubject);
+     if (status) {
+       status->VetoChange();
+     }
+@@ -2292,7 +2292,7 @@ nsNSSComponent::DoProfileChangeTeardown(
+   }
+ 
+   if (callVeto) {
+-    nsCOMPtr<nsIProfileChangeStatus> status = do_QueryInterface(aSubject);
++    nsIProfileChangeStatus* status = do_QueryInterface(aSubject);
+     if (status) {
+       status->VetoChange();
+     }
+@@ -2321,7 +2321,7 @@ nsNSSComponent::DoProfileBeforeChange(ns
+ 
+   if (needsCleanup) {
+     if (NS_FAILED(ShutdownNSS())) {
+-      nsCOMPtr<nsIProfileChangeStatus> status = do_QueryInterface(aSubject);
++      nsIProfileChangeStatus* status = do_QueryInterface(aSubject);
+       if (status) {
+         status->ChangeFailed();
+       }
+@@ -2503,16 +2503,16 @@ NS_IMETHODIMP PipUIContext::GetInterface
+   nsresult rv = NS_OK;
+ 
+   if (uuid.Equals(NS_GET_IID(nsIPrompt))) {
+-    nsCOMPtr<nsIPrompt> prompter;
+-    nsCOMPtr<nsIWindowWatcher> wwatch(do_GetService(NS_WINDOWWATCHER_CONTRACTID));
++    nsIPrompt* prompter;
++    nsIWindowWatcher* wwatch(do_GetService(NS_WINDOWWATCHER_CONTRACTID));
+     if (wwatch) {
+-      wwatch->GetNewPrompter(0, getter_AddRefs(prompter));
++      wwatch->GetNewPrompter(0, &prompter);
+       if (prompter) {
+-        nsCOMPtr<nsIPrompt> proxyPrompt;
++        nsIPrompt* proxyPrompt;
+         NS_GetProxyForObject(NS_PROXY_TO_MAIN_THREAD,
+                              NS_GET_IID(nsIPrompt),
+                              prompter, NS_PROXY_SYNC,
+-                             getter_AddRefs(proxyPrompt));
++                             (void**)&proxyPrompt);
+         if (!proxyPrompt) return NS_ERROR_FAILURE;
+         *result = proxyPrompt;
+       }
+@@ -2529,7 +2529,7 @@ getNSSDialogs(void **_result, REFNSIID a
+ {
+   nsresult rv;
+ 
+-  nsCOMPtr<nsISupports> svc = do_GetService(contract, &rv);
++  nsISupports* svc = do_GetService(contract, &rv);
+   if (NS_FAILED(rv)) 
+     return rv;
+ 
+@@ -2599,7 +2599,7 @@ PSMContentDownloader::OnStartRequest(nsI
+ {
+   nsresult rv;
+   PR_LOG(gPIPNSSLog, PR_LOG_DEBUG, ("CertDownloader::OnStartRequest\n"));
+-  nsCOMPtr<nsIChannel> channel(do_QueryInterface(request));
++  nsIChannel* channel(do_QueryInterface(request));
+   if (!channel) return NS_ERROR_FAILURE;
+ 
+   // Get the URI //
+@@ -2674,11 +2674,11 @@ PSMContentDownloader::OnStopRequest(nsIR
+ 
+   PR_LOG(gPIPNSSLog, PR_LOG_DEBUG, ("CertDownloader::OnStopRequest\n"));
+ 
+-  nsCOMPtr<nsIX509CertDB> certdb;
+-  nsCOMPtr<nsICRLManager> crlManager;
++  nsIX509CertDB* certdb;
++  nsICRLManager* crlManager;
+ 
+   nsresult rv;
+-  nsCOMPtr<nsIInterfaceRequestor> ctx = new PipUIContext();
++  nsIInterfaceRequestor* ctx = new PipUIContext();
+ 
+   switch (mType) {
+   case PSMContentDownloader::X509_CA_CERT:
+@@ -2717,7 +2717,7 @@ PSMContentDownloader::handleContentDownl
+ {
+   nsString tmpMessage;
+   nsresult rv;
+-  nsCOMPtr<nsINSSComponent> nssComponent(do_GetService(kNSSComponentCID, &rv));
++  nsINSSComponent* nssComponent(do_GetService(kNSSComponentCID, &rv));
+   if(NS_FAILED(rv)){
+     return rv;
+   }
+@@ -2738,7 +2738,7 @@ PSMContentDownloader::handleContentDownl
+       nsCString errMsg;
+       PRInt32 errCnt;
+ 
+-      nsCOMPtr<nsIPrefBranch> pref = do_GetService(NS_PREFSERVICE_CONTRACTID,&rv);
++      nsIPrefBranch* pref = do_GetService(NS_PREFSERVICE_CONTRACTID,&rv);
+       if(NS_FAILED(rv)){
+         return rv;
+       }
+@@ -2755,14 +2755,14 @@ PSMContentDownloader::handleContentDownl
+         pref->SetIntPref(updateErrCntPrefStr.get(),errCnt+1);
+       }
+       pref->SetCharPref(updateErrDetailPrefStr.get(),errMsg.get());
+-      nsCOMPtr<nsIPrefService> prefSvc(do_QueryInterface(pref));
++      nsIPrefService* prefSvc(do_QueryInterface(pref));
+       prefSvc->SavePrefFile(nsnull);
+     }else{
+       nsString message;
+-      nsCOMPtr<nsIWindowWatcher> wwatch(do_GetService(NS_WINDOWWATCHER_CONTRACTID));
+-      nsCOMPtr<nsIPrompt> prompter;
++      nsIWindowWatcher* wwatch(do_GetService(NS_WINDOWWATCHER_CONTRACTID));
++      nsIPrompt* prompter;
+       if (wwatch){
+-        wwatch->GetNewPrompter(0, getter_AddRefs(prompter));
++        wwatch->GetNewPrompter(0, &prompter);
+         nssComponent->GetPIPNSSBundleString("CrlImportFailure1x", message);
+         message.Append(NS_LITERAL_STRING("\n").get());
+         message.Append(tmpMessage);
+diff --git a/security/manager/ssl/src/nsNSSIOLayer.cpp b/security/manager/ssl/src/nsNSSIOLayer.cpp
+--- a/security/manager/ssl/src/nsNSSIOLayer.cpp
++++ b/security/manager/ssl/src/nsNSSIOLayer.cpp
+@@ -320,12 +320,12 @@ nsNSSSocketInfo::SetNotificationCallback
+     return NS_OK;
+   }
+ 
+-  nsCOMPtr<nsIInterfaceRequestor> proxiedCallbacks;
++  nsIInterfaceRequestor* proxiedCallbacks;
+   NS_GetProxyForObject(NS_PROXY_TO_MAIN_THREAD,
+                        NS_GET_IID(nsIInterfaceRequestor),
+                        static_cast<nsIInterfaceRequestor*>(aCallbacks),
+                        NS_PROXY_SYNC,
+-                       getter_AddRefs(proxiedCallbacks));
++                       (void**)&proxiedCallbacks);
+ 
+   mCallbacks = proxiedCallbacks;
+ 
+@@ -338,20 +338,20 @@ nsNSSSocketInfo::SetNotificationCallback
+   // with a socket close, and the socket transport might detach the callbacks 
+   // instance prior to our error reporting.
+ 
+-  nsCOMPtr<nsIDocShell> docshell(do_GetInterface(mCallbacks));
++  nsIDocShell* docshell(do_GetInterface(mCallbacks));
+   if (docshell)
+   {
+-    nsCOMPtr<nsIDocShell> proxiedDocShell;
++    nsIDocShell* proxiedDocShell;
+     NS_GetProxyForObject(NS_PROXY_TO_MAIN_THREAD,
+                          NS_GET_IID(nsIDocShell),
+-                         docshell.get(),
++                         docshell,
+                          NS_PROXY_SYNC,
+-                         getter_AddRefs(proxiedDocShell));
++                         (void**)&proxiedDocShell);
+     nsISecureBrowserUI* secureUI;
+     proxiedDocShell->GetSecurityUI(&secureUI);
+     if (secureUI)
+     {
+-      nsCOMPtr<nsIThread> mainThread(do_GetMainThread());
++      nsIThread* mainThread(do_GetMainThread());
+       NS_ProxyRelease(mainThread, secureUI, PR_FALSE);
+       mExternalErrorReporting = PR_TRUE;
+     }
+@@ -427,7 +427,7 @@ NS_IMETHODIMP nsNSSSocketInfo::GetInterf
+ {
+   nsresult rv;
+   if (!mCallbacks) {
+-    nsCOMPtr<nsIInterfaceRequestor> ir = new PipUIContext();
++    nsIInterfaceRequestor* ir = new PipUIContext();
+     if (!ir)
+       return NS_ERROR_OUT_OF_MEMORY;
+ 
+@@ -689,10 +689,10 @@ getInvalidCertErrorMessage(PRUint32 mult
+   {
+     PRTime now = PR_Now();
+     PRTime notAfter, notBefore, timeToUse;
+-    nsCOMPtr<nsIX509CertValidity> validity;
++    nsIX509CertValidity* validity;
+     const char *key;
+   
+-    rv = ix509->GetValidity(getter_AddRefs(validity));
++    rv = ix509->GetValidity(&validity);
+     if (NS_FAILED(rv))
+       return rv;
+   
+@@ -755,25 +755,25 @@ displayAlert(nsAFlatString &formattedStr
+   // The interface requestor object may not be safe, so proxy the call to get
+   // the nsIPrompt.
+ 
+-  nsCOMPtr<nsIInterfaceRequestor> proxiedCallbacks;
++  nsIInterfaceRequestor* proxiedCallbacks;
+   NS_GetProxyForObject(NS_PROXY_TO_MAIN_THREAD,
+                        NS_GET_IID(nsIInterfaceRequestor),
+                        static_cast<nsIInterfaceRequestor*>(infoObject),
+                        NS_PROXY_SYNC,
+-                       getter_AddRefs(proxiedCallbacks));
+-
+-  nsCOMPtr<nsIPrompt> prompt (do_GetInterface(proxiedCallbacks));
++                       (void**)&proxiedCallbacks);
++
++  nsIPrompt* prompt (do_GetInterface(proxiedCallbacks));
+   if (!prompt)
+     return NS_ERROR_NO_INTERFACE;
+ 
+   // Finally, get a proxy for the nsIPrompt
+ 
+-  nsCOMPtr<nsIPrompt> proxyPrompt;
++  nsIPrompt* proxyPrompt;
+   NS_GetProxyForObject(NS_PROXY_TO_MAIN_THREAD,
+                        NS_GET_IID(nsIPrompt),
+                        prompt,
+                        NS_PROXY_SYNC,
+-                       getter_AddRefs(proxyPrompt));
++                       (void**)&proxyPrompt);
+ 
+   proxyPrompt->Alert(nsnull, formattedString.get());
+   return NS_OK;
+@@ -791,7 +791,7 @@ nsHandleSSLError(nsNSSSocketInfo *socket
+ 
+   nsresult rv;
+   NS_DEFINE_CID(nssComponentCID, NS_NSSCOMPONENT_CID);
+-  nsCOMPtr<nsINSSComponent> nssComponent(do_GetService(nssComponentCID, &rv));
++  nsINSSComponent* nssComponent(do_GetService(nssComponentCID, &rv));
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -832,7 +832,7 @@ nsHandleInvalidCertError(nsNSSSocketInfo
+ {
+   nsresult rv;
+   NS_DEFINE_CID(nssComponentCID, NS_NSSCOMPONENT_CID);
+-  nsCOMPtr<nsINSSComponent> nssComponent(do_GetService(nssComponentCID, &rv));
++  nsINSSComponent* nssComponent(do_GetService(nssComponentCID, &rv));
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -1879,7 +1879,7 @@ nsresult nsGetUserCertChoice(SSM_UserCer
+ 
+ 	NS_ENSURE_ARG_POINTER(certChoice);
+ 
+-	nsCOMPtr<nsIPrefBranch> pref = do_GetService(NS_PREFSERVICE_CONTRACTID);
++	nsIPrefBranch* pref = do_GetService(NS_PREFSERVICE_CONTRACTID);
+ 
+ 	ret = pref->GetCharPref("security.default_personal_cert", &mode);
+ 	if (NS_FAILED(ret)) {
+@@ -2316,7 +2316,7 @@ nsNSSBadCertHandler(void *arg, PRFileDes
+   if (!nssCert)
+     return cancel_and_failure(infoObject);
+ 
+-  nsCOMPtr<nsIX509Cert> ix509 = static_cast<nsIX509Cert*>(nssCert.get());
++  nsIX509Cert* ix509 = static_cast<nsIX509Cert*>(nssCert);
+ 
+   SECStatus srv;
+   nsresult nsrv;
+@@ -2411,8 +2411,8 @@ nsNSSBadCertHandler(void *arg, PRFileDes
+     return SECFailure;
+   }
+ 
+-  nsCOMPtr<nsSSLStatus> status;
+-  infoObject->GetSSLStatus(getter_AddRefs(status));
++  nsSSLStatus* status;
++  infoObject->GetSSLStatus((class nsISupports**)&status);
+   if (!status) {
+     status = new nsSSLStatus();
+     infoObject->SetSSLStatus(status);
+@@ -2431,7 +2431,7 @@ nsNSSBadCertHandler(void *arg, PRFileDes
+ 
+   remaining_display_errors = collected_errors;
+ 
+-  nsCOMPtr<nsICertOverrideService> overrideService = 
++  nsICertOverrideService* overrideService = 
+     do_GetService(NS_CERTOVERRIDE_CONTRACTID);
+   // it is fine to continue without the nsICertOverrideService
+ 
+@@ -2465,10 +2465,10 @@ nsNSSBadCertHandler(void *arg, PRFileDes
+   nsresult rv;
+ 
+   // Try to get a nsIBadCertListener2 implementation from the socket consumer.
+-  nsCOMPtr<nsIInterfaceRequestor> callbacks;
+-  infoObject->GetNotificationCallbacks(getter_AddRefs(callbacks));
++  nsIInterfaceRequestor* callbacks;
++  infoObject->GetNotificationCallbacks(&callbacks);
+   if (callbacks) {
+-    nsCOMPtr<nsIBadCertListener2> bcl = do_GetInterface(callbacks);
++    nsIBadCertListener2* bcl = do_GetInterface(callbacks);
+     if (bcl) {
+       nsIBadCertListener2 *proxy_bcl = nsnull;
+       NS_GetProxyForObject(NS_PROXY_TO_MAIN_THREAD,
+diff --git a/security/manager/ssl/src/nsNSSModule.cpp b/security/manager/ssl/src/nsNSSModule.cpp
+--- a/security/manager/ssl/src/nsNSSModule.cpp
++++ b/security/manager/ssl/src/nsNSSModule.cpp
+@@ -91,7 +91,7 @@ static void EnsureNSSInitialized(PRBool 
+     return;
+   }
+   
+-  nsCOMPtr<nsISupports> nssComponent 
++  nsISupports* nssComponent 
+     = do_GetService(PSM_COMPONENT_CONTRACTID);
+ }
+ 
+@@ -201,7 +201,7 @@ static NS_METHOD RegisterPSMContentListe
+                       const char *componentType, const nsModuleComponentInfo *info)
+ {
+   nsresult rv;
+-  nsCOMPtr<nsICategoryManager> catman = 
++  nsICategoryManager* catman = 
+     do_GetService(NS_CATEGORYMANAGER_CONTRACTID, &rv);
+   if (NS_FAILED(rv)) return rv;
+ 
+diff --git a/security/manager/ssl/src/nsNTLMAuthModule.cpp b/security/manager/ssl/src/nsNTLMAuthModule.cpp
+--- a/security/manager/ssl/src/nsNTLMAuthModule.cpp
++++ b/security/manager/ssl/src/nsNTLMAuthModule.cpp
+@@ -131,7 +131,7 @@ static const char NTLM_TYPE3_MARKER[] = 
+ 
+ static PRBool SendLM()
+ {
+-  nsCOMPtr<nsIPrefBranch> prefs = do_GetService(NS_PREFSERVICE_CONTRACTID);
++  nsIPrefBranch* prefs = do_GetService(NS_PREFSERVICE_CONTRACTID);
+   if (!prefs)
+     return PR_FALSE;
+ 
+diff --git a/security/manager/ssl/src/nsPK11TokenDB.cpp b/security/manager/ssl/src/nsPK11TokenDB.cpp
+--- a/security/manager/ssl/src/nsPK11TokenDB.cpp
++++ b/security/manager/ssl/src/nsPK11TokenDB.cpp
+@@ -268,7 +268,7 @@ NS_IMETHODIMP nsPK11Token::LogoutAndDrop
+   if (NS_FAILED(rv))
+     return rv;
+ 
+-  nsCOMPtr<nsINSSComponent> nssComponent(do_GetService(kNSSComponentCID, &rv));
++  nsINSSComponent* nssComponent(do_GetService(kNSSComponentCID, &rv));
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -473,7 +473,7 @@ NS_IMETHODIMP nsPK11TokenDB::GetInternal
+   nsNSSShutDownPreventionLock locker;
+   nsresult rv = NS_OK;
+   PK11SlotInfo *slot = 0;
+-  nsCOMPtr<nsIPK11Token> token;
++  nsIPK11Token* token;
+ 
+   slot = PK11_GetInternalKeySlot();
+   if (!slot) { rv = NS_ERROR_FAILURE; goto done; }
+@@ -513,11 +513,11 @@ NS_IMETHODIMP nsPK11TokenDB::ListTokens(
+ {
+   nsNSSShutDownPreventionLock locker;
+   nsresult rv = NS_OK;
+-  nsCOMPtr<nsISupportsArray> array;
++  nsISupportsArray* array;
+   PK11SlotList *list = 0;
+   PK11SlotListElement *le;
+ 
+-  rv = NS_NewISupportsArray(getter_AddRefs(array));
++  rv = NS_NewISupportsArray(&array);
+   if (NS_FAILED(rv)) { goto done; }
+ 
+   /* List all tokens, creating PK11Token objects and putting them
+@@ -527,7 +527,7 @@ NS_IMETHODIMP nsPK11TokenDB::ListTokens(
+   if (!list) { rv = NS_ERROR_FAILURE; goto done; }
+ 
+   for (le = PK11_GetFirstSafe(list); le; le = PK11_GetNextSafe(list, le, PR_FALSE)) {
+-    nsCOMPtr<nsIPK11Token> token = new nsPK11Token(le->slot);
++    nsIPK11Token* token = new nsPK11Token(le->slot);
+ 
+     array->AppendElement(token);
+   }
+diff --git a/security/manager/ssl/src/nsPKCS11Slot.cpp b/security/manager/ssl/src/nsPKCS11Slot.cpp
+--- a/security/manager/ssl/src/nsPKCS11Slot.cpp
++++ b/security/manager/ssl/src/nsPKCS11Slot.cpp
+@@ -208,7 +208,7 @@ nsPKCS11Slot::GetToken(nsIPK11Token **_r
+   if (isAlreadyShutDown())
+     return NS_ERROR_NOT_AVAILABLE;
+ 
+-  nsCOMPtr<nsIPK11Token> token = new nsPK11Token(mSlot);
++  nsIPK11Token* token = new nsPK11Token(mSlot);
+   if (!token)
+     return NS_ERROR_OUT_OF_MEMORY;
+   *_retval = token;
+@@ -365,7 +365,7 @@ nsPKCS11Module::FindSlotByName(const PRU
+     }
+   } 
+   nsMemory::Free(asciiname);
+-  nsCOMPtr<nsIPKCS11Slot> slot = new nsPKCS11Slot(slotinfo);
++  nsIPKCS11Slot* slot = new nsPKCS11Slot(slotinfo);
+   PK11_FreeSlot(slotinfo);
+   if (!slot)
+     return NS_ERROR_OUT_OF_MEMORY;
+@@ -384,8 +384,8 @@ nsPKCS11Module::ListSlots(nsIEnumerator 
+   nsresult rv = NS_OK;
+   int i;
+   /* get isupports array */
+-  nsCOMPtr<nsISupportsArray> array;
+-  rv = NS_NewISupportsArray(getter_AddRefs(array));
++  nsISupportsArray* array;
++  rv = NS_NewISupportsArray(&array);
+   if (NS_FAILED(rv)) return rv;
+   /* applications which allow new slot creation (which Firefox now does
+    * since it uses the WaitForSlotEvent call) need to hold the
+@@ -395,7 +395,7 @@ nsPKCS11Module::ListSlots(nsIEnumerator 
+   SECMOD_GetReadLock(lock);
+   for (i=0; i<mModule->slotCount; i++) {
+     if (mModule->slots[i]) {
+-      nsCOMPtr<nsIPKCS11Slot> slot = new nsPKCS11Slot(mModule->slots[i]);
++      nsIPKCS11Slot* slot = new nsPKCS11Slot(mModule->slots[i]);
+       array->AppendElement(slot);
+     }
+   }
+@@ -421,7 +421,7 @@ nsPKCS11ModuleDB::GetInternal(nsIPKCS11M
+   nsNSSShutDownPreventionLock locker;
+   SECMODModule *nssMod = 
+     SECMOD_CreateModule(NULL,SECMOD_INT_NAME, NULL,SECMOD_INT_FLAGS);
+-  nsCOMPtr<nsIPKCS11Module> module = new nsPKCS11Module(nssMod);
++  nsIPKCS11Module* module = new nsPKCS11Module(nssMod);
+   SECMOD_DestroyModule(nssMod);
+   if (!module)
+     return NS_ERROR_OUT_OF_MEMORY;
+@@ -436,7 +436,7 @@ nsPKCS11ModuleDB::GetInternalFIPS(nsIPKC
+   nsNSSShutDownPreventionLock locker;
+   SECMODModule *nssMod = 
+     SECMOD_CreateModule(NULL, SECMOD_FIPS_NAME, NULL, SECMOD_FIPS_FLAGS);
+-  nsCOMPtr<nsIPKCS11Module> module = new nsPKCS11Module(nssMod);
++  nsIPKCS11Module* module = new nsPKCS11Module(nssMod);
+   SECMOD_DestroyModule(nssMod);
+   if (!module)
+     return NS_ERROR_OUT_OF_MEMORY;
+@@ -455,7 +455,7 @@ nsPKCS11ModuleDB::FindModuleByName(const
+     SECMOD_FindModule(const_cast<char *>(aUtf8Name.get()));
+   if (!mod)
+     return NS_ERROR_FAILURE;
+-  nsCOMPtr<nsIPKCS11Module> module = new nsPKCS11Module(mod);
++  nsIPKCS11Module* module = new nsPKCS11Module(mod);
+   SECMOD_DestroyModule(mod);
+   if (!module)
+     return NS_ERROR_OUT_OF_MEMORY;
+@@ -477,7 +477,7 @@ nsPKCS11ModuleDB::FindSlotByName(const P
+    PK11_FindSlotByName(const_cast<char*>(aUtf8Name.get()));
+   if (!slotinfo)
+     return NS_ERROR_FAILURE;
+-  nsCOMPtr<nsIPKCS11Slot> slot = new nsPKCS11Slot(slotinfo);
++  nsIPKCS11Slot* slot = new nsPKCS11Slot(slotinfo);
+   PK11_FreeSlot(slotinfo);
+   if (!slot)
+     return NS_ERROR_OUT_OF_MEMORY;
+@@ -492,8 +492,8 @@ nsPKCS11ModuleDB::ListModules(nsIEnumera
+   nsNSSShutDownPreventionLock locker;
+   nsresult rv = NS_OK;
+   /* get isupports array */
+-  nsCOMPtr<nsISupportsArray> array;
+-  rv = NS_NewISupportsArray(getter_AddRefs(array));
++  nsISupportsArray* array;
++  rv = NS_NewISupportsArray(&array);
+   if (NS_FAILED(rv)) return rv;
+   /* get the default list of modules */
+   SECMODModuleList *list = SECMOD_GetDefaultModuleList();
+@@ -501,14 +501,14 @@ nsPKCS11ModuleDB::ListModules(nsIEnumera
+   SECMODListLock *lock = SECMOD_GetDefaultModuleListLock();
+   SECMOD_GetReadLock(lock);
+   while (list) {
+-    nsCOMPtr<nsIPKCS11Module> module = new nsPKCS11Module(list->module);
++    nsIPKCS11Module* module = new nsPKCS11Module(list->module);
+     array->AppendElement(module);
+     list = list->next;
+   }
+   /* Get the modules in the database that didn't load */
+   list = SECMOD_GetDeadModuleList();
+   while (list) {
+-    nsCOMPtr<nsIPKCS11Module> module = new nsPKCS11Module(list->module);
++    nsIPKCS11Module* module = new nsPKCS11Module(list->module);
+     array->AppendElement(module);
+     list = list->next;
+   }
+diff --git a/security/manager/ssl/src/nsPKCS12Blob.cpp b/security/manager/ssl/src/nsPKCS12Blob.cpp
+--- a/security/manager/ssl/src/nsPKCS12Blob.cpp
++++ b/security/manager/ssl/src/nsPKCS12Blob.cpp
+@@ -355,7 +355,7 @@ nsPKCS12Blob::ExportToFile(nsILocalFile 
+   SECItem unicodePw;
+   nsAutoString filePath;
+   int i;
+-  nsCOMPtr<nsILocalFile> localFileRef;
++  nsILocalFile* localFileRef;
+   NS_ASSERTION(mToken, "Need to set the token before exporting");
+   // init slot
+ 
+@@ -527,8 +527,8 @@ nsPKCS12Blob::newPKCS12FilePassword(SECI
+ {
+   nsresult rv = NS_OK;
+   nsAutoString password;
+-  nsCOMPtr<nsICertificateDialogs> certDialogs;
+-  rv = ::getNSSDialogs(getter_AddRefs(certDialogs), 
++  nsICertificateDialogs* certDialogs;
++  rv = ::getNSSDialogs((void**)&certDialogs, 
+                        NS_GET_IID(nsICertificateDialogs),
+                        NS_CERTIFICATEDIALOGS_CONTRACTID);
+   if (NS_FAILED(rv)) return rv;
+@@ -556,8 +556,8 @@ nsPKCS12Blob::getPKCS12FilePassword(SECI
+ {
+   nsresult rv = NS_OK;
+   nsAutoString password;
+-  nsCOMPtr<nsICertificateDialogs> certDialogs;
+-  rv = ::getNSSDialogs(getter_AddRefs(certDialogs), 
++  nsICertificateDialogs* certDialogs;
++  rv = ::getNSSDialogs((void**)&certDialogs, 
+                        NS_GET_IID(nsICertificateDialogs),
+                        NS_CERTIFICATEDIALOGS_CONTRACTID);
+   if (NS_FAILED(rv)) return rv;
+@@ -588,8 +588,8 @@ nsPKCS12Blob::inputToDecoder(SEC_PKCS12D
+   PRUint32 amount;
+   char buf[PIP_PKCS12_BUFFER_SIZE];
+ 
+-  nsCOMPtr<nsIInputStream> fileStream;
+-  rv = NS_NewLocalFileInputStream(getter_AddRefs(fileStream), file);
++  nsIInputStream* fileStream;
++  rv = NS_NewLocalFileInputStream(&fileStream, file);
+   
+   if (NS_FAILED(rv)) {
+     return rv;
+@@ -747,7 +747,7 @@ nsPKCS12Blob::nickname_collision(SECItem
+   nsNSSShutDownPreventionLock locker;
+   *cancel = PR_FALSE;
+   nsresult rv;
+-  nsCOMPtr<nsINSSComponent> nssComponent(do_GetService(kNSSComponentCID, &rv));
++  nsINSSComponent* nssComponent(do_GetService(kNSSComponentCID, &rv));
+   if (NS_FAILED(rv)) return nsnull;
+   int count = 1;
+   nsCString nickname;
+@@ -841,17 +841,17 @@ nsPKCS12Blob::handleError(int myerr)
+   int prerr = PORT_GetError();
+   PR_LOG(gPIPNSSLog, PR_LOG_DEBUG, ("PKCS12: NSS/NSPR error(%d)", prerr));
+   PR_LOG(gPIPNSSLog, PR_LOG_DEBUG, ("PKCS12: I called(%d)", myerr));
+-  nsCOMPtr<nsINSSComponent> nssComponent(do_GetService(kNSSComponentCID, &rv));
++  nsINSSComponent* nssComponent(do_GetService(kNSSComponentCID, &rv));
+   if (NS_FAILED(rv)) return PR_FALSE;
+-  nsCOMPtr<nsIPrompt> errPrompt;
+-  nsCOMPtr<nsIWindowWatcher> wwatch(do_GetService(NS_WINDOWWATCHER_CONTRACTID));
++  nsIPrompt* errPrompt;
++  nsIWindowWatcher* wwatch(do_GetService(NS_WINDOWWATCHER_CONTRACTID));
+   if (wwatch) {
+-    wwatch->GetNewPrompter(0, getter_AddRefs(errPrompt));
++    wwatch->GetNewPrompter(0, &errPrompt);
+     if (errPrompt) {
+-      nsCOMPtr<nsIPrompt> proxyPrompt;
++      nsIPrompt* proxyPrompt;
+       NS_GetProxyForObject(NS_PROXY_TO_MAIN_THREAD,
+                            NS_GET_IID(nsIPrompt), errPrompt,
+-                           NS_PROXY_SYNC, getter_AddRefs(proxyPrompt));
++                           NS_PROXY_SYNC, (void**)&proxyPrompt);
+       if (!proxyPrompt) return PR_FALSE;
+     } else {
+       return PR_FALSE;
+diff --git a/security/manager/ssl/src/nsSDR.cpp b/security/manager/ssl/src/nsSDR.cpp
+--- a/security/manager/ssl/src/nsSDR.cpp
++++ b/security/manager/ssl/src/nsSDR.cpp
+@@ -95,16 +95,16 @@ NS_IMETHODIMP nsSDRContext::GetInterface
+ NS_IMETHODIMP nsSDRContext::GetInterface(const nsIID & uuid, void * *result)
+ {
+   if (uuid.Equals(NS_GET_IID(nsIPrompt))) {
+-    nsCOMPtr<nsIPrompt> prompter;
+-    nsCOMPtr<nsIWindowWatcher> wwatch(do_GetService(NS_WINDOWWATCHER_CONTRACTID));
++    nsIPrompt* prompter;
++    nsIWindowWatcher* wwatch(do_GetService(NS_WINDOWWATCHER_CONTRACTID));
+     if (wwatch) {
+-      wwatch->GetNewPrompter(0, getter_AddRefs(prompter));
++      wwatch->GetNewPrompter(0, &prompter);
+       if (prompter) {
+-        nsCOMPtr<nsIPrompt> proxyPrompt;
++        nsIPrompt* proxyPrompt;
+         NS_GetProxyForObject(NS_PROXY_TO_MAIN_THREAD,
+                              NS_GET_IID(nsIPrompt),
+                              prompter, NS_PROXY_SYNC,
+-                             getter_AddRefs(proxyPrompt));
++                             (void**)&proxyPrompt);
+         if (!proxyPrompt) return NS_ERROR_FAILURE;
+         *result = proxyPrompt;
+       }
+@@ -143,7 +143,7 @@ Encrypt(unsigned char * data, PRInt32 da
+   SECItem request;
+   SECItem reply;
+   SECStatus s;
+-  nsCOMPtr<nsIInterfaceRequestor> ctx = new nsSDRContext();
++  nsIInterfaceRequestor* ctx = new nsSDRContext();
+ 
+   slot = PK11_GetInternalKeySlot();
+   if (!slot) { rv = NS_ERROR_NOT_AVAILABLE; goto loser; }
+@@ -184,7 +184,7 @@ Decrypt(unsigned char * data, PRInt32 da
+   SECStatus s;
+   SECItem request;
+   SECItem reply;
+-  nsCOMPtr<nsIInterfaceRequestor> ctx = new nsSDRContext();
++  nsIInterfaceRequestor* ctx = new nsSDRContext();
+ 
+   *result = 0;
+   *_retval = 0;
+@@ -296,14 +296,14 @@ ChangePassword()
+   PK11_FreeSlot(slot);
+ 
+   /* Get the set password dialog handler imlementation */
+-  nsCOMPtr<nsITokenPasswordDialogs> dialogs;
+-
+-  rv = getNSSDialogs(getter_AddRefs(dialogs),
++  nsITokenPasswordDialogs* dialogs;
++
++  rv = getNSSDialogs((void**)&dialogs,
+            NS_GET_IID(nsITokenPasswordDialogs),
+            NS_TOKENPASSWORDSDIALOG_CONTRACTID);
+   if (NS_FAILED(rv)) return rv;
+ 
+-  nsCOMPtr<nsIInterfaceRequestor> ctx = new nsSDRContext();
++  nsIInterfaceRequestor* ctx = new nsSDRContext();
+   PRBool canceled;
+ 
+   {
+@@ -328,7 +328,7 @@ Logout()
+ Logout()
+ {
+   nsresult rv;
+-  nsCOMPtr<nsINSSComponent> nssComponent(do_GetService(kNSSComponentCID, &rv));
++  nsINSSComponent* nssComponent(do_GetService(kNSSComponentCID, &rv));
+   if (NS_FAILED(rv))
+     return rv;
+ 
+@@ -345,7 +345,7 @@ LogoutAndTeardown()
+ LogoutAndTeardown()
+ {
+   nsresult rv;
+-  nsCOMPtr<nsINSSComponent> nssComponent(do_GetService(kNSSComponentCID, &rv));
++  nsINSSComponent* nssComponent(do_GetService(kNSSComponentCID, &rv));
+   if (NS_FAILED(rv))
+     return rv;
+ 
+diff --git a/security/manager/ssl/src/nsSSLThread.cpp b/security/manager/ssl/src/nsSSLThread.cpp
+--- a/security/manager/ssl/src/nsSSLThread.cpp
++++ b/security/manager/ssl/src/nsSSLThread.cpp
+@@ -378,7 +378,7 @@ PRStatus nsSSLThread::requestClose(nsNSS
+     return PR_FAILURE;
+ 
+   PRBool close_later = PR_FALSE;
+-  nsCOMPtr<nsIRequest> requestToCancel;
++  nsIRequest* requestToCancel;
+ 
+   {
+     nsAutoLock threadLock(ssl_thread_singleton->mMutex);
+@@ -394,7 +394,7 @@ PRStatus nsSSLThread::requestClose(nsNSS
+       
+       if (ssl_thread_singleton->mPendingHTTPRequest)
+       {
+-        requestToCancel.swap(ssl_thread_singleton->mPendingHTTPRequest);
++        swap(requestToCancel, ssl_thread_singleton->mPendingHTTPRequest);
+       }
+       
+       close_later = PR_TRUE;
+diff --git a/security/manager/ssl/src/nsSmartCardMonitor.cpp b/security/manager/ssl/src/nsSmartCardMonitor.cpp
+--- a/security/manager/ssl/src/nsSmartCardMonitor.cpp
++++ b/security/manager/ssl/src/nsSmartCardMonitor.cpp
+@@ -266,7 +266,7 @@ SmartCardMonitoringThread::SendEvent(con
+                                      const char *tokenName)
+ {
+   nsresult rv;
+-  nsCOMPtr<nsINSSComponent> 
++  nsINSSComponent* 
+                     nssComponent(do_GetService(kNSSComponentCID, &rv));
+   if (NS_FAILED(rv))
+     return rv;
+diff --git a/security/manager/ssl/src/nsUsageArrayHelper.cpp b/security/manager/ssl/src/nsUsageArrayHelper.cpp
+--- a/security/manager/ssl/src/nsUsageArrayHelper.cpp
++++ b/security/manager/ssl/src/nsUsageArrayHelper.cpp
+@@ -165,7 +165,7 @@ nsUsageArrayHelper::GetUsagesArray(const
+   if (outArraySize < max_returned_out_array_size)
+     return NS_ERROR_FAILURE;
+ 
+-  nsCOMPtr<nsINSSComponent> nssComponent;
++  nsINSSComponent* nssComponent;
+ 
+   if (ignoreOcsp) {
+     nsresult rv;
--- a/automatic-garburator.patch
+++ b/automatic-garburator.patch
@@ -134347,39 +134347,16 @@ diff --git a/netwerk/test/TestProtocols.
  
    nsCAutoString value;
  
 -  nsCOMPtr<nsIChannel> channel = do_QueryInterface(request);
 +  nsIChannel* channel = do_QueryInterface(request);
    if (channel) {
      nsresult status;
      channel->GetStatus(&status);
-@@ -401,17 +401,17 @@ InputTestConsumer::OnStartRequest(nsIReq
-         LOG(("\tContent-Length: Unknown\n"));
-     }
- 
--    nsCOMPtr<nsISupports> owner;
--    channel->GetOwner(getter_AddRefs(owner));
-+    nsISupports* owner;
-+    channel->GetOwner(&owner);
-     LOG(("\tChannel Owner: %x\n", owner.get()));
-   }
- 
--  nsCOMPtr<nsIPropertyBag2> props = do_QueryInterface(request);
-+  nsIPropertyBag2* props = do_QueryInterface(request);
-   if (props) {
--      nsCOMPtr<nsIURI> foo;
-+      nsIURI* foo;
-       props->GetPropertyAsInterface(NS_LITERAL_STRING("test.foo"),
-                                     NS_GET_IID(nsIURI),
--                                    getter_AddRefs(foo));
-+                                    (void**)&foo);
-       if (foo) {
-           nsCAutoString spec;
-           foo->GetSpec(spec);
 @@ -419,7 +419,7 @@ InputTestConsumer::OnStartRequest(nsIReq
        }
    }
  
 -  nsCOMPtr<nsIPropertyBag2> propbag = do_QueryInterface(request);
 +  nsIPropertyBag2* propbag = do_QueryInterface(request);
    if (propbag) {
        PRInt64 len;
@@ -134666,27 +134643,16 @@ diff --git a/netwerk/test/TestStreamChan
 +        nsILocalFile* file;
 +        rv = NS_NewNativeLocalFile(nsDependentCString(fileName), PR_FALSE, &file);
          if (NS_FAILED(rv)) return rv;
  
          rv = RunTest(file);
 diff --git a/netwerk/test/TestStreamLoader.cpp b/netwerk/test/TestStreamLoader.cpp
 --- a/netwerk/test/TestStreamLoader.cpp
 +++ b/netwerk/test/TestStreamLoader.cpp
-@@ -30,8 +30,8 @@ MyStreamLoaderObserver::OnStreamComplete
- {
-   LOG(("OnStreamComplete [status=%x resultLen=%u]\n", status, resultLen));
- 
--  nsCOMPtr<nsIRequest> request;
--  loader->GetRequest(getter_AddRefs(request));
-+  nsIRequest* request;
-+  loader->GetRequest(&request);
-   LOG(("  request=%p\n", request.get()));
- 
-   QuitPumpingEvents();
 @@ -57,22 +57,22 @@ int main(int argc, char **argv)
      return -1;
  
    {
 -    nsCOMPtr<nsIURI> uri;
 -    rv = NS_NewURI(getter_AddRefs(uri), nsDependentCString(argv[1]));
 +    nsIURI* uri;
 +    rv = NS_NewURI(&uri, nsDependentCString(argv[1]));
@@ -145326,17 +145292,17 @@ diff --git a/uriloader/exthandler/nsExte
      if (channel)
 @@ -613,7 +613,7 @@ NS_IMETHODIMP nsExternalHelperAppService
    } 
    else {
      GetFromTypeAndExtension(aMimeContentType, fileExtension,
 -                            getter_AddRefs(mimeInfo));
 +                            &mimeInfo);
    } 
-   LOG(("Type/Ext lookup found 0x%p\n", mimeInfo.get()));
+   LOG(("Type/Ext lookup found 0x%p\n", mimeInfo));
  
 @@ -696,14 +696,14 @@ NS_IMETHODIMP nsExternalHelperAppService
  NS_IMETHODIMP nsExternalHelperAppService::ExternalProtocolHandlerExists(const char * aProtocolScheme,
                                                                          PRBool * aHandlerExists)
  {
 -  nsCOMPtr<nsIHandlerInfo> handlerInfo;
 +  nsIHandlerInfo* handlerInfo;
    nsresult rv = GetProtocolHandlerInfo(
@@ -146561,17 +146527,17 @@ diff --git a/uriloader/prefetch/nsOfflin
  
 -        nsCOMPtr<nsIDOMDocument> doc;
 -        window->GetDocument(getter_AddRefs(doc));
 +        nsIDOMDocument* doc;
 +        window->GetDocument(&doc);
          if (!doc) return NS_OK;
  
          LOG(("nsOfflineCacheUpdateService::OnStateChange [%p, doc=%p]",
-              this, doc.get()));
+              this, doc));
  
 -        nsRefPtr<nsOfflineCacheUpdate> update;
 -        if (mDocUpdates.Get(doc, getter_AddRefs(update))) {
 +        nsOfflineCacheUpdate* update;
 +        if (mDocUpdates.Get(doc, &update)) {
              Schedule(update);
              mDocUpdates.Remove(doc);
          }
@@ -150352,34 +150318,25 @@ diff --git a/xpcom/components/nsComponen
 -                                    getter_AddRefs(module));
 +                                    &module);
          }
  
          if (NS_FAILED(rv))
 diff --git a/xpcom/components/nsNativeComponentLoader.cpp b/xpcom/components/nsNativeComponentLoader.cpp
 --- a/xpcom/components/nsNativeComponentLoader.cpp
 +++ b/xpcom/components/nsNativeComponentLoader.cpp
-@@ -115,7 +115,7 @@ nsNativeModuleLoader::LoadModule(nsILoca
+@@ -117,7 +117,7 @@ nsNativeModuleLoader::LoadModule(nsILoca
          LowerCaseEqualsLiteral(MOZ_DLL_SUFFIX))
          return NS_ERROR_INVALID_ARG;
  
 -    nsCOMPtr<nsIHashable> hashedFile(do_QueryInterface(aFile));
 +    nsIHashable* hashedFile(do_QueryInterface(aFile));
      if (!hashedFile) {
          NS_ERROR("nsIFile is not nsIHashable");
          return NS_NOINTERFACE;
-@@ -225,7 +225,7 @@ nsNativeModuleLoader::UnloaderFunc(nsIHa
-                                    NativeLoadData& aLoadData, void*)
- {
-     if (PR_LOG_TEST(nsNativeModuleLoaderLog, PR_LOG_DEBUG)) {
--        nsCOMPtr<nsIFile> file(do_QueryInterface(aHashedFile));
-+        nsIFile* file(do_QueryInterface(aHashedFile));
- 
-         nsCAutoString filePath;
-         file->GetNativePath(filePath);
 diff --git a/xpcom/ds/nsArray.cpp b/xpcom/ds/nsArray.cpp
 --- a/xpcom/ds/nsArray.cpp
 +++ b/xpcom/ds/nsArray.cpp
 @@ -112,7 +112,7 @@ nsArray::AppendElement(nsISupports* aEle
  {
      PRBool result;
      if (aWeak) {
 -        nsCOMPtr<nsISupports> elementRef =
@@ -152545,17 +152502,17 @@ diff --git a/xpcom/proxy/tests/proxytest
 @@ -155,18 +155,18 @@ NS_IMETHODIMP nsTestXPCFoo2::Test(PRInt3
  {
      LOG(("TEST: calling back to caller!\n"));
  
 -    nsCOMPtr<nsIProxyObjectManager> manager =
 +    nsIProxyObjectManager* manager =
              do_GetService(NS_XPCOMPROXY_CONTRACTID);
  
-     LOG(("TEST: ProxyObjectManager: %p \n", (void *) manager.get()));
+     LOG(("TEST: ProxyObjectManager: %p \n", (void *) manager));
      
      PR_ASSERT(manager);
  
 -    nsCOMPtr<nsIThread> thread;
 -    GetThreadFromPRThread((PRThread *) p1, getter_AddRefs(thread));
 +    nsIThread* thread;
 +    GetThreadFromPRThread((PRThread *) p1, &thread);
      NS_ENSURE_STATE(thread);
@@ -152568,17 +152525,17 @@ diff --git a/xpcom/proxy/tests/proxytest
 @@ -271,7 +271,7 @@ void TestCase_TwoClassesOneInterface(voi
  
  void TestCase_NestedLoop(nsIThread *thread, PRInt32 index)
  {
 -    nsCOMPtr<nsIProxyObjectManager> manager =
 +    nsIProxyObjectManager* manager =
              do_GetService(NS_XPCOMPROXY_CONTRACTID);
  
-     LOG(("TEST: ProxyObjectManager: %p\n", (void *) manager.get()));
+     LOG(("TEST: ProxyObjectManager: %p\n", (void *) manager));
 @@ -370,8 +370,8 @@ public:
      {
          //TestCase_TwoClassesOneInterface(arg);
          //TestCase_nsISupports(arg);
 -        nsCOMPtr<nsIThread> thread;
 -        GetThreadFromPRThread(mEventLoopThread, getter_AddRefs(thread));
 +        nsIThread* thread;
 +        GetThreadFromPRThread(mEventLoopThread, &thread);
@@ -153271,237 +153228,16 @@ diff --git a/xpcom/tests/TestArray.cpp b
  {
    PRInt32 index;
    for (index = 0; index < aCount; index++) {
 -    nsCOMPtr<IFoo> foo = new Foo(index);
 +    IFoo* foo = new Foo(index);
      aArray->AppendElement(foo);
    }
  }
-diff --git a/xpcom/tests/TestAutoPtr.cpp b/xpcom/tests/TestAutoPtr.cpp
---- a/xpcom/tests/TestAutoPtr.cpp
-+++ b/xpcom/tests/TestAutoPtr.cpp
-@@ -210,13 +210,13 @@ int main()
- 
-     {
-         printf("Should create and AddRef one |TestRefObject|:\n");
--        nsRefPtr<TestRefObject> pobj( new TestRefObject() );
--        printf("Should Release and destroy one |TestRefObject|:\n");
--    }
--
--    {
--        printf("Should create and AddRef one |TestRefObject|:\n");
--        nsRefPtr<TestRefObject> pobj( new TestRefObject() );
-+        TestRefObject* pobj( new TestRefObject() );
-+        printf("Should Release and destroy one |TestRefObject|:\n");
-+    }
-+
-+    {
-+        printf("Should create and AddRef one |TestRefObject|:\n");
-+        TestRefObject* pobj( new TestRefObject() );
-         printf("Should create and AddRef one |TestRefObject| and then Release and destroy one:\n");
-         pobj = new TestRefObject();
-         printf("Should Release and destroy one |TestRefObject|:\n");
-@@ -224,51 +224,51 @@ int main()
- 
-     {
-         printf("Should create and AddRef one |TestRefObject|:\n");
--        nsRefPtr<TestRefObject> p1( new TestRefObject() );
-+        TestRefObject* p1( new TestRefObject() );
-         printf("Should AddRef one |TestRefObject|:\n");
--        nsRefPtr<TestRefObject> p2( p1 );
-+        TestRefObject* p2( p1 );
-         printf("Should Release twice and destroy one |TestRefObject|:\n");
-     }
- 
-     printf("\nTesting equality (with all const-ness combinations):\n");
- 
-     {
--        nsRefPtr<TestRefObject> p1( new TestRefObject() );
--        nsRefPtr<TestRefObject> p2( p1 );
-+        TestRefObject* p1( new TestRefObject() );
-+        TestRefObject* p2( p1 );
-         printf("equality %s.\n",
-                ((p1 == p2) && !(p1 != p2)) ? "OK" : "broken");
-     }
- 
-     {
--        const nsRefPtr<TestRefObject> p1( new TestRefObject() );
--        nsRefPtr<TestRefObject> p2( p1 );
-+        const TestRefObject* p1( new TestRefObject() );
-+        TestRefObject* p2( p1 );
-         printf("equality %s.\n",
-                ((p1 == p2) && !(p1 != p2)) ? "OK" : "broken");
-     }
- 
-     {
--        nsRefPtr<TestRefObject> p1( new TestRefObject() );
--        const nsRefPtr<TestRefObject> p2( p1 );
-+        TestRefObject* p1( new TestRefObject() );
-+        const TestRefObject* p2( p1 );
-         printf("equality %s.\n",
-                ((p1 == p2) && !(p1 != p2)) ? "OK" : "broken");
-     }
- 
-     {
--        const nsRefPtr<TestRefObject> p1( new TestRefObject() );
--        const nsRefPtr<TestRefObject> p2( p1 );
-+        const TestRefObject* p1( new TestRefObject() );
-+        const TestRefObject* p2( p1 );
-         printf("equality %s.\n",
-                ((p1 == p2) && !(p1 != p2)) ? "OK" : "broken");
-     }
- 
-     {
--        nsRefPtr<TestRefObject> p1( new TestRefObject() );
-+        TestRefObject* p1( new TestRefObject() );
-         TestRefObject * p2 = p1;
-         printf("equality %s.\n",
-                ((p1 == p2) && !(p1 != p2) && (p2 == p1) && !(p2 != p1)) ? "OK" : "broken");
-     }
- 
-     {
--        const nsRefPtr<TestRefObject> p1( new TestRefObject() );
-+        const TestRefObject* p1( new TestRefObject() );
-         TestRefObject * p2 = p1;
-         printf("equality %s.\n",
-                ((p1 == p2) && !(p1 != p2) && (p2 == p1) && !(p2 != p1)) ? "OK" : "broken");
-@@ -291,28 +291,28 @@ int main()
- #endif /* Things that MSVC++ 6.0 can't be coaxed to accept */
- 
-     {
--        nsRefPtr<TestRefObject> p1( new TestRefObject() );
-+        TestRefObject* p1( new TestRefObject() );
-         const TestRefObject * p2 = p1;
-         printf("equality %s.\n",
-                ((p1 == p2) && !(p1 != p2) && (p2 == p1) && !(p2 != p1)) ? "OK" : "broken");
-     }
- 
-     {
--        const nsRefPtr<TestRefObject> p1( new TestRefObject() );
-+        const TestRefObject* p1( new TestRefObject() );
-         const TestRefObject * p2 = p1;
-         printf("equality %s.\n",
-                ((p1 == p2) && !(p1 != p2) && (p2 == p1) && !(p2 != p1)) ? "OK" : "broken");
-     }
- 
-     {
--        nsRefPtr<TestRefObject> p1( new TestRefObject() );
-+        TestRefObject* p1( new TestRefObject() );
-         const TestRefObject * const p2 = p1;
-         printf("equality %s.\n",
-                ((p1 == p2) && !(p1 != p2) && (p2 == p1) && !(p2 != p1)) ? "OK" : "broken");
-     }
- 
-     {
--        const nsRefPtr<TestRefObject> p1( new TestRefObject() );
-+        const TestRefObject* p1( new TestRefObject() );
-         const TestRefObject * const p2 = p1;
-         printf("equality %s.\n",
-                ((p1 == p2) && !(p1 != p2) && (p2 == p1) && !(p2 != p1)) ? "OK" : "broken");
-@@ -328,9 +328,9 @@ int main()
-     }
- 
-     {
--        nsRefPtr<TestRefObject> ptr;
--        printf("Should create and AddRef one |TestRefObject|:\n");
--        CreateTestRefObject(getter_AddRefs(ptr));
-+        TestRefObject* ptr;
-+        printf("Should create and AddRef one |TestRefObject|:\n");
-+        CreateTestRefObject(&ptr);
-         printf("Should Release and destroy one |TestRefObject|:\n");
-     }
- 
-@@ -359,9 +359,9 @@ int main()
-     }
- 
-     {
--        nsRefPtr<TestRefObject> p1 = new TestRefObject();
-+        TestRefObject* p1 = new TestRefObject();
-         // nsCOMPtr requires a |get| for something like this as well
--        nsRefPtr<TestRefObjectBaseB> p2 = p1.get();
-+        TestRefObjectBaseB* p2 = p1;
-         printf("equality %s.\n",
-                ((static_cast<void*>(p1) != static_cast<void*>(p2)) &&
-                 (p1 == p2) && !(p1 != p2) && (p2 == p1) && !(p2 != p1))
-@@ -369,7 +369,7 @@ int main()
-     }
- 
-     {
--        nsRefPtr<TestRefObject> p1 = new TestRefObject();
-+        TestRefObject* p1 = new TestRefObject();
-         TestRefObjectBaseB *p2 = p1;
-         printf("equality %s.\n",
-                ((static_cast<void*>(p1) != static_cast<void*>(p2)) &&
-@@ -379,7 +379,7 @@ int main()
- 
-     {
-         TestRefObject *p1 = new TestRefObject();
--        nsRefPtr<TestRefObjectBaseB> p2 = p1;
-+        TestRefObjectBaseB* p2 = p1;
-         printf("equality %s.\n",
-                ((static_cast<void*>(p1) != static_cast<void*>(p2)) &&
-                 (p1 == p2) && !(p1 != p2) && (p2 == p1) && !(p2 != p1))
-@@ -406,9 +406,9 @@ int main()
- 
-     {
-         printf("Should create one |TestRefObject|:\n");
--        nsRefPtr<TestRefObject> pobj( new TestRefObject() );
-+        TestRefObject* pobj( new TestRefObject() );
-         printf("Should do nothing:\n");
--        nsRefPtr<TestRefObject> pobj2( pobj.forget() );
-+        TestRefObject* pobj2( pobj );
-         printf("Should destroy one |TestRefObject|:\n");
-     }
- 
-@@ -429,7 +429,7 @@ int main()
- 
-     {
-         printf("Should create and AddRef one |TestRefObject|:\n");
--        nsRefPtr<TestRefObject> pobj = new TestRefObject();
-+        TestRefObject* pobj = new TestRefObject();
-         printf("Should Release and destroy one |TestRefObject|:\n");
-     }
- 
-@@ -461,7 +461,7 @@ int main()
- 
-     {
-         printf("Should create and AddRef one |TestRefObject|:\n");
--        nsRefPtr<TestRefObject> pobj = new TestRefObject();
-+        TestRefObject* pobj = new TestRefObject();
-         printf("Should do something with one |TestRefObject|:\n");
-         DoSomethingWithTestRefObject(pobj);
-         printf("Should do something with one |TestRefObject|:\n");
-@@ -495,7 +495,7 @@ int main()
- 
-     {
-         printf("Should create and AddRef one |TestRefObject|:\n");
--        nsRefPtr<TestRefObject> pobj = new TestRefObject();
-+        TestRefObject* pobj = new TestRefObject();
-         printf("Should do something with one |TestRefObject|:\n");
-         DoSomethingWithTestRefObjectBaseB(pobj);
-         printf("Should do something with one |TestRefObject|:\n");
-@@ -529,7 +529,7 @@ int main()
- 
-     {
-         printf("Should create and AddRef one |TestRefObject|:\n");
--        const nsRefPtr<TestRefObject> pobj = new TestRefObject();
-+        const TestRefObject* pobj = new TestRefObject();
-         printf("Should do something with one |TestRefObject|:\n");
-         DoSomethingWithTestRefObject(pobj);
-         printf("Should do something with one |TestRefObject|:\n");
-@@ -563,7 +563,7 @@ int main()
- 
-     {
-         printf("Should create and AddRef one |TestRefObject|:\n");
--        const nsRefPtr<TestRefObject> pobj = new TestRefObject();
-+        const TestRefObject* pobj = new TestRefObject();
-         printf("Should do something with one |TestRefObject|:\n");
-         DoSomethingWithTestRefObjectBaseB(pobj);
-         printf("Should do something with one |TestRefObject|:\n");
 diff --git a/xpcom/tests/TestCOMPtr.cpp b/xpcom/tests/TestCOMPtr.cpp
 --- a/xpcom/tests/TestCOMPtr.cpp
 +++ b/xpcom/tests/TestCOMPtr.cpp
 @@ -86,8 +86,8 @@ typedef unsigned long NS_RESULT;
                void  AnIFooPtrPtrContext( IFoo** );
                void	AnISupportsPtrPtrContext( nsISupports** );
                void  AVoidPtrPtrContext( void** );
 -              void  set_a_IFoo( nsCOMPtr<IFoo>* result );
@@ -153766,68 +153502,68 @@ diff --git a/xpcom/tests/TestFactory.cpp
 -    nsCOMPtr<nsIComponentRegistrar> registrar = do_QueryInterface(servMan);
 +    nsIComponentRegistrar* registrar = do_QueryInterface(servMan);
      NS_ASSERTION(registrar, "Null nsIComponentRegistrar");
      if (registrar)
        registrar->RegisterFactory(kTestFactoryCID,
 diff --git a/xpcom/tests/TestHashtables.cpp b/xpcom/tests/TestHashtables.cpp
 --- a/xpcom/tests/TestHashtables.cpp
 +++ b/xpcom/tests/TestHashtables.cpp
-@@ -377,7 +377,7 @@ PLDHashOperator
+@@ -376,7 +376,7 @@ PLDHashOperator
  PLDHashOperator
  nsIEnum2Read(nsISupports* aKey, PRUint32 aData, void* userArg) {
    nsCAutoString str;
 -  nsCOMPtr<IFoo> foo = do_QueryInterface(aKey);
 +  IFoo* foo = do_QueryInterface(aKey);
    foo->GetString(str);
  
  
-@@ -388,7 +388,7 @@ PLDHashOperator
+@@ -387,7 +387,7 @@ PLDHashOperator
  PLDHashOperator
  nsIEnum2(nsISupports* aKey, PRUint32& aData, void* userArg) {
    nsCAutoString str;
 -  nsCOMPtr<IFoo> foo = do_QueryInterface(aKey);
 +  IFoo* foo = do_QueryInterface(aKey);
    foo->GetString(str);
  
    printf("  enumerated \"%s\" = %u\n", str.get(), aData);
-@@ -596,8 +596,8 @@ main(void) {
+@@ -595,8 +595,8 @@ main(void) {
  
    for (i = 0; i < ENTITY_COUNT; ++i) {
      printf("  Putting entry %u...", gEntities[i].mUnicode);
 -    nsCOMPtr<IFoo> foo;
 -    CreateIFoo(getter_AddRefs(foo));
 +    IFoo* foo;
 +    CreateIFoo(&foo);
      foo->SetString(nsDependentCString(gEntities[i].mStr));
      
      
-@@ -670,8 +670,8 @@ main(void) {
+@@ -669,8 +669,8 @@ main(void) {
  
    for (i = 0; i < ENTITY_COUNT; ++i) {
      printf("  Putting entry %u...", gEntities[i].mUnicode);
 -    nsCOMPtr<IFoo> foo;
 -    CreateIFoo(getter_AddRefs(foo));
 +    IFoo* foo;
 +    CreateIFoo(&foo);
      foo->SetString(nsDependentCString(gEntities[i].mStr));
      
      if (!UniToEntClass2.Put(gEntities[i].mUnicode, foo)) {
-@@ -686,8 +686,8 @@ main(void) {
+@@ -685,8 +685,8 @@ main(void) {
    for (i = 0; i < ENTITY_COUNT; ++i) {
      printf("  Getting entry %s...", gEntities[i].mStr);
      
 -    nsCOMPtr<IFoo> myEnt;
 -    if (!UniToEntClass2.Get(gEntities[i].mUnicode, getter_AddRefs(myEnt))) {
 +    IFoo* myEnt;
 +    if (!UniToEntClass2.Get(gEntities[i].mUnicode, &myEnt)) {
        printf("FAILED\n");
        exit (30);
      }
-@@ -698,8 +698,8 @@ main(void) {
+@@ -697,8 +697,8 @@ main(void) {
    }
  
    printf("Testing non-existent entries...");
 -  nsCOMPtr<IFoo> myEnt;
 -  if (UniToEntClass2.Get(9462, getter_AddRefs(myEnt))) {
 +  IFoo* myEnt;
 +  if (UniToEntClass2.Get(9462, &myEnt)) {
      printf("FOUND! BAD!\n");
--- a/automatic-remove-addrefs.patch
+++ b/automatic-remove-addrefs.patch
@@ -7424,18 +7424,18 @@ diff --git a/docshell/base/nsDocShell.cp
          NS_ENSURE_SUCCESS((*aRootTreeItem)->GetParent(getter_AddRefs(parent)),
                            NS_ERROR_FAILURE);
      }
 -    NS_ADDREF(*aRootTreeItem);
      return NS_OK;
  }
  
 @@ -1829,7 +1818,6 @@ nsDocShell::GetSameTypeRootTreeItem(nsID
-                           GetSameTypeParent(getter_AddRefs(parent)),
-                           NS_ERROR_FAILURE);
+             GetSameTypeParent(getter_AddRefs(parent));
+         NS_ENSURE_SUCCESS(res, NS_ERROR_FAILURE);
      }
 -    NS_ADDREF(*aRootTreeItem);
      return NS_OK;
  }
  
 @@ -2032,7 +2020,7 @@ nsDocShell::FindItemWithName(const PRUni
      // First we check our name.
      if (mName.Equals(aName) && ItemIsActive(this) &&
@@ -13898,57 +13898,57 @@ diff --git a/js/src/xpconnect/tests/comp
  xpcTestInOut :: xpcTestInOut() {
 -    NS_ADDREF_THIS();
  }
  
  NS_IMETHODIMP xpcTestInOut :: EchoLong(PRInt32 li, PRInt32 *lo){ 
 diff --git a/js/src/xpconnect/tests/components/xpctest_multiple.cpp b/js/src/xpconnect/tests/components/xpctest_multiple.cpp
 --- a/js/src/xpconnect/tests/components/xpctest_multiple.cpp
 +++ b/js/src/xpconnect/tests/components/xpctest_multiple.cpp
-@@ -61,7 +61,6 @@ NS_IMPL_ISUPPORTS1(xpcTestParentOne, nsI
+@@ -56,7 +56,6 @@ NS_IMPL_ISUPPORTS1(xpcTestParentOne, nsI
  
  xpcTestParentOne :: xpcTestParentOne() 
  {
 -    NS_ADDREF_THIS();
  }
  
  NS_IMETHODIMP xpcTestParentOne :: GetParentOneAttribute(char * *_retval) 
-@@ -124,7 +123,6 @@ NS_IMPL_ISUPPORTS1(xpcTestParentTwo, nsI
+@@ -119,7 +118,6 @@ NS_IMPL_ISUPPORTS1(xpcTestParentTwo, nsI
  
  xpcTestParentTwo :: xpcTestParentTwo()
  {
 -    NS_ADDREF_THIS();
  }
  
  NS_IMETHODIMP                                                 
-@@ -194,7 +192,6 @@ NS_IMPL_ISUPPORTS3_CI(xpcTestChild2,nsIX
+@@ -189,7 +187,6 @@ NS_IMPL_ISUPPORTS3_CI(xpcTestChild2,nsIX
  
  xpcTestChild2 :: xpcTestChild2() 
  {
 -    NS_ADDREF_THIS();
  }
  
  NS_IMETHODIMP 
-@@ -315,7 +312,6 @@ NS_IMPL_ISUPPORTS2(xpcTestChild3,nsIXPCT
+@@ -310,7 +307,6 @@ NS_IMPL_ISUPPORTS2(xpcTestChild3,nsIXPCT
  
  xpcTestChild3 :: xpcTestChild3() 
  {
 -    NS_ADDREF_THIS();
  
  }
  
-@@ -412,7 +408,6 @@ NS_IMPL_ISUPPORTS3(xpcTestChild4,nsIXPCT
+@@ -407,7 +403,6 @@ NS_IMPL_ISUPPORTS3(xpcTestChild4,nsIXPCT
  
  xpcTestChild4 :: xpcTestChild4() 
  {
 -    NS_ADDREF_THIS();
  }
  
  NS_IMETHODIMP 
-@@ -482,7 +477,6 @@ NS_IMPL_ISUPPORTS3(xpcTestChild5,nsIXPCT
+@@ -477,7 +472,6 @@ NS_IMPL_ISUPPORTS3(xpcTestChild5,nsIXPCT
  
  xpcTestChild5 :: xpcTestChild5() 
  {
 -    NS_ADDREF_THIS();
  }
  
  NS_IMETHODIMP 
 diff --git a/js/src/xpconnect/tests/components/xpctest_noisy.cpp b/js/src/xpconnect/tests/components/xpctest_noisy.cpp
@@ -19071,17 +19071,17 @@ diff --git a/netwerk/cookie/src/nsCookie
 @@ -354,7 +353,6 @@ nsCookieService::GetSingleton()
    // See bug 209571.
    gCookieService = new nsCookieService();
    if (gCookieService) {
 -    NS_ADDREF(gCookieService);
      if (NS_FAILED(gCookieService->Init())) {
        NS_RELEASE(gCookieService);
      }
-@@ -2163,7 +2161,6 @@ nsCookieService::AddCookieToList(nsCooki
+@@ -2165,7 +2163,6 @@ nsCookieService::AddCookieToList(nsCooki
      return PR_FALSE;
    }
  
 -  NS_ADDREF(aCookie);
  
    aCookie->Next() = entry->Head();
    entry->Head() = aCookie;
 diff --git a/netwerk/dns/src/nsDNSService2.cpp b/netwerk/dns/src/nsDNSService2.cpp
@@ -21637,50 +21637,50 @@ diff --git a/storage/src/mozStorageConne
  {
      if (!mDBConn) return NS_ERROR_NOT_INITIALIZED;
  
 -    NS_IF_ADDREF(*aFile = mDatabaseFile);
 +    *aFile = mDatabaseFile;
  
      return NS_OK;
  }
-@@ -285,7 +285,6 @@ mozStorageConnection::CreateStatement(co
+@@ -286,7 +286,6 @@ mozStorageConnection::CreateStatement(co
      mozStorageStatement *statement = new mozStorageStatement();
      if (!statement)
        return NS_ERROR_OUT_OF_MEMORY;
 -    NS_ADDREF(statement);
  
      nsresult rv = statement->Initialize (this, aSQLStatement);
      if (NS_FAILED(rv)) {
-@@ -656,7 +655,6 @@ mozStorageConnection::CreateFunction(con
+@@ -657,7 +656,6 @@ mozStorageConnection::CreateFunction(con
  
      if (mFunctions.Put (aFunctionName, aFunction)) {
          // We hold function object -- add ref to it
 -        NS_ADDREF(aFunction);
          return NS_OK;
      }
      return NS_ERROR_OUT_OF_MEMORY;
-@@ -739,7 +737,6 @@ mozStorageConnection::CreateAggregateFun
+@@ -740,7 +738,6 @@ mozStorageConnection::CreateAggregateFun
  
      if (mFunctions.Put (aFunctionName, aFunction)) {
          // We hold function object -- add ref to it
 -        NS_ADDREF(aFunction);
          return NS_OK;
      }
      return NS_ERROR_OUT_OF_MEMORY;
-@@ -790,7 +787,7 @@ mozStorageConnection::SetProgressHandler
+@@ -791,7 +788,7 @@ mozStorageConnection::SetProgressHandler
      if (!mDBConn) return NS_ERROR_NOT_INITIALIZED;
  
      // Return previous one
 -    NS_IF_ADDREF(*aOldHandler = mProgressHandler);
 +    *aOldHandler = mProgressHandler;
  
      if (!aHandler || aGranularity <= 0) {
        aHandler     = nsnull;
-@@ -808,7 +805,7 @@ mozStorageConnection::RemoveProgressHand
+@@ -809,7 +806,7 @@ mozStorageConnection::RemoveProgressHand
      if (!mDBConn) return NS_ERROR_NOT_INITIALIZED;
  
      // Return previous one
 -    NS_IF_ADDREF(*aOldHandler = mProgressHandler);
 +    *aOldHandler = mProgressHandler;
  
      mProgressHandler = nsnull;
      sqlite3_progress_handler (mDBConn, 0, NULL, NULL);
@@ -21896,118 +21896,118 @@ diff --git a/toolkit/components/download
    }
  
    gDownloadManagerService = new nsDownloadManager();
    if (gDownloadManagerService) {
 -    NS_ADDREF(gDownloadManagerService);
      if (NS_FAILED(gDownloadManagerService->Init()))
        NS_RELEASE(gDownloadManagerService);
    }
-@@ -834,7 +832,7 @@ nsDownloadManager::GetDownloadFromDB(PRU
+@@ -841,7 +839,7 @@ nsDownloadManager::GetDownloadFromDB(PRU
    dl->SetProgressBytes(currBytes, maxBytes);
  
    // Addrefing and returning
 -  NS_ADDREF(*retVal = dl);
 +  *retVal = dl;
    return NS_OK;
  }
  
-@@ -941,7 +939,7 @@ nsDownloadManager::GetDefaultDownloadsDi
+@@ -948,7 +946,7 @@ nsDownloadManager::GetDefaultDownloadsDi
    NS_ENSURE_SUCCESS(rv, rv);
  #endif
  
 -  NS_ADDREF(*aResult = downloadDir);
 +  *aResult = downloadDir;
  
    return NS_OK;
  }
-@@ -985,7 +983,7 @@ nsDownloadManager::GetUserDownloadsDirec
+@@ -992,7 +990,7 @@ nsDownloadManager::GetUserDownloadsDirec
                               NS_GET_IID(nsILocalFile),
                               getter_AddRefs(downloadDir));
          NS_ENSURE_SUCCESS(rv, rv);
 -        NS_ADDREF(*aResult = downloadDir);
 +        *aResult = downloadDir;
          return NS_OK;
        }
        break;
-@@ -1010,12 +1008,12 @@ nsDownloadManager::GetUserDownloadsDirec
+@@ -1017,12 +1015,12 @@ nsDownloadManager::GetUserDownloadsDirec
          if (customDirectory) {
            customDirectory->Exists(&bRes);
            if (bRes) {
 -            NS_ADDREF(*aResult = customDirectory);
 +            *aResult = customDirectory;
              return NS_OK;
            }
            rv = customDirectory->Create(nsIFile::DIRECTORY_TYPE, 0755);
            NS_ENSURE_SUCCESS(rv, rv);
 -          NS_ADDREF(*aResult = customDirectory);
 +          *aResult = customDirectory;
            return NS_OK;
          }
          rv = GetDefaultDownloadsDirectory(aResult); // refup
-@@ -1100,7 +1098,7 @@ nsDownloadManager::AddDownload(DownloadT
+@@ -1107,7 +1105,7 @@ nsDownloadManager::AddDownload(DownloadT
    (void)dl->SetState(nsIDownloadManager::DOWNLOAD_QUEUED);
    NS_ENSURE_SUCCESS(rv, rv);
  
 -  NS_ADDREF(*aDownload = dl);
 +  *aDownload = dl;
  
    return NS_OK;
  }
-@@ -1118,7 +1116,7 @@ nsDownloadManager::GetDownload(PRUint32 
+@@ -1125,7 +1123,7 @@ nsDownloadManager::GetDownload(PRUint32 
      itm = dl.get();
    }
  
 -  NS_ADDREF(*aDownloadItem = itm);
 +  *aDownloadItem = itm;
  
    return NS_OK;
  }
-@@ -1341,7 +1339,7 @@ NS_IMETHODIMP
+@@ -1351,7 +1349,7 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  nsDownloadManager::GetDBConnection(mozIStorageConnection **aDBConn)
  {
 -  NS_ADDREF(*aDBConn = mDBConn);
 +  *aDBConn = mDBConn;
  
    return NS_OK;
  }
-@@ -1936,7 +1934,6 @@ nsDownload::GetCancelable(nsICancelable 
+@@ -1946,7 +1944,6 @@ nsDownload::GetCancelable(nsICancelable 
  nsDownload::GetCancelable(nsICancelable **aCancelable)
  {
    *aCancelable = mCancelable;
 -  NS_IF_ADDREF(*aCancelable);
    return NS_OK;
  }
  
-@@ -1944,7 +1941,6 @@ nsDownload::GetTarget(nsIURI **aTarget)
+@@ -1954,7 +1951,6 @@ nsDownload::GetTarget(nsIURI **aTarget)
  nsDownload::GetTarget(nsIURI **aTarget)
  {
    *aTarget = mTarget;
 -  NS_IF_ADDREF(*aTarget);
    return NS_OK;
  }
  
-@@ -1952,7 +1948,6 @@ nsDownload::GetSource(nsIURI **aSource)
+@@ -1962,7 +1958,6 @@ nsDownload::GetSource(nsIURI **aSource)
  nsDownload::GetSource(nsIURI **aSource)
  {
    *aSource = mSource;
 -  NS_IF_ADDREF(*aSource);
    return NS_OK;
  }
  
-@@ -1988,7 +1983,6 @@ nsDownload::GetMIMEInfo(nsIMIMEInfo **aM
+@@ -1998,7 +1993,6 @@ nsDownload::GetMIMEInfo(nsIMIMEInfo **aM
  nsDownload::GetMIMEInfo(nsIMIMEInfo **aMIMEInfo)
  {
    *aMIMEInfo = mMIMEInfo;
 -  NS_IF_ADDREF(*aMIMEInfo);
    return NS_OK;
  }
  
-@@ -2024,7 +2018,7 @@ NS_IMETHODIMP
+@@ -2034,7 +2028,7 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  nsDownload::GetReferrer(nsIURI **referrer)
  {
 -  NS_IF_ADDREF(*referrer = mReferrer);
 +  *referrer = mReferrer;
    return NS_OK;
  }
  
@@ -22233,66 +22233,66 @@ diff --git a/toolkit/components/places/s
  
 -  NS_ADDREF(*aNode);
    return NS_OK;
  }
  
 diff --git a/toolkit/components/places/src/nsNavHistory.cpp b/toolkit/components/places/src/nsNavHistory.cpp
 --- a/toolkit/components/places/src/nsNavHistory.cpp
 +++ b/toolkit/components/places/src/nsNavHistory.cpp
-@@ -1991,7 +1991,6 @@ NS_IMETHODIMP nsNavHistory::GetNewQuery(
+@@ -1993,7 +1993,6 @@ NS_IMETHODIMP nsNavHistory::GetNewQuery(
    *_retval = new nsNavHistoryQuery();
    if (! *_retval)
      return NS_ERROR_OUT_OF_MEMORY;
 -  NS_ADDREF(*_retval);
    return NS_OK;
  }
  
-@@ -2001,7 +2000,6 @@ NS_IMETHODIMP nsNavHistory::GetNewQueryO
+@@ -2003,7 +2002,6 @@ NS_IMETHODIMP nsNavHistory::GetNewQueryO
  {
    *_retval = new nsNavHistoryQueryOptions();
    NS_ENSURE_TRUE(*_retval, NS_ERROR_OUT_OF_MEMORY);
 -  NS_ADDREF(*_retval);
    return NS_OK;
  }
  
-@@ -2077,7 +2075,7 @@ nsNavHistory::ExecuteQueries(nsINavHisto
+@@ -2079,7 +2077,7 @@ nsNavHistory::ExecuteQueries(nsINavHisto
                                              getter_AddRefs(result));
    NS_ENSURE_SUCCESS(rv, rv);
  
 -  NS_ADDREF(*_retval = result);
 +  *_retval = result;
    return NS_OK;
  }
  
-@@ -4632,7 +4630,6 @@ nsNavHistory::RowToResult(mozIStorageVal
+@@ -4636,7 +4634,6 @@ nsNavHistory::RowToResult(mozIStorageVal
        (*aResult)->mDateAdded = aRow->AsInt64(kGetInfoIndex_ItemDateAdded);
        (*aResult)->mLastModified = aRow->AsInt64(kGetInfoIndex_ItemLastModified);
      }
 -    NS_ADDREF(*aResult);
      return NS_OK;
    }
    // now we know the result type is some kind of visit (regular or full)
-@@ -4645,7 +4642,6 @@ nsNavHistory::RowToResult(mozIStorageVal
+@@ -4649,7 +4646,6 @@ nsNavHistory::RowToResult(mozIStorageVal
                                                 favicon, session);
      if (! *aResult)
        return NS_ERROR_OUT_OF_MEMORY;
 -    NS_ADDREF(*aResult);
      return NS_OK;
    }
  
-@@ -4704,7 +4700,6 @@ nsNavHistory::QueryRowToResult(PRInt64 i
+@@ -4708,7 +4704,6 @@ nsNavHistory::QueryRowToResult(PRInt64 i
      *aNode = new nsNavHistoryQueryResultNode(aURI, aTitle, aFavicon);
      if (! *aNode)
        return NS_ERROR_OUT_OF_MEMORY;
 -    NS_ADDREF(*aNode);
    } else {
      PRInt64 folderId = GetSimpleBookmarksQueryFolder(queries, options);
      if (folderId) {
-@@ -4722,7 +4717,6 @@ nsNavHistory::QueryRowToResult(PRInt64 i
+@@ -4726,7 +4721,6 @@ nsNavHistory::QueryRowToResult(PRInt64 i
        if (! *aNode)
          return NS_ERROR_OUT_OF_MEMORY;
        (*aNode)->mItemId = itemId;
 -      NS_ADDREF(*aNode);
      }
    }
    return NS_OK;
 diff --git a/toolkit/components/places/src/nsNavHistoryQuery.cpp b/toolkit/components/places/src/nsNavHistoryQuery.cpp
@@ -24388,41 +24388,20 @@ diff --git a/xpcom/components/nsComponen
  
 @@ -3677,6 +3669,5 @@ NS_GetComponentRegistrar(nsIComponentReg
  
      *result = static_cast<nsIComponentRegistrar*>
                           (nsComponentManagerImpl::gComponentManager);
 -    NS_IF_ADDREF(*result);
      return NS_OK;
  }
-diff --git a/xpcom/components/nsNativeComponentLoader.cpp b/xpcom/components/nsNativeComponentLoader.cpp
---- a/xpcom/components/nsNativeComponentLoader.cpp
-+++ b/xpcom/components/nsNativeComponentLoader.cpp
-@@ -125,7 +125,7 @@ nsNativeModuleLoader::LoadModule(nsILoca
- 
-     if (mLibraries.Get(hashedFile, &data)) {
-         NS_ASSERTION(data.module, "Corrupt mLibraries hash");
--        NS_ADDREF(*aResult = data.module);
-+        *aResult = data.module;
- 
-         LOG(PR_LOG_DEBUG,
-             ("nsNativeModuleLoader::LoadModule(\"%s\") - found in cache",
-@@ -189,7 +189,7 @@ nsNativeModuleLoader::LoadModule(nsILoca
-                  filePath.get()));
- 
-             if (mLibraries.Put(hashedFile, data)) {
--                NS_ADDREF(*aResult = data.module);
-+                *aResult = data.module;
-                 return NS_OK;
-             }
-         }
 diff --git a/xpcom/components/nsStaticComponentLoader.cpp b/xpcom/components/nsStaticComponentLoader.cpp
 --- a/xpcom/components/nsStaticComponentLoader.cpp
 +++ b/xpcom/components/nsStaticComponentLoader.cpp
-@@ -164,6 +164,6 @@ nsStaticModuleLoader::GetModuleFor(const
+@@ -175,6 +175,6 @@ nsStaticModuleLoader::GetModuleFor(const
              return rv;
      }
  
 -    NS_ADDREF(*aResult = info->module);
 +    *aResult = info->module;
      return NS_OK;
  }
 diff --git a/xpcom/ds/nsAtomTable.cpp b/xpcom/ds/nsAtomTable.cpp
@@ -25916,17 +25895,17 @@ diff --git a/xpcom/tests/TestCOMPtr.cpp 
  
 -		NS_IF_ADDREF(rawPtr);
  		*aResult = rawPtr;
  
  		return status;
 diff --git a/xpcom/tests/TestHashtables.cpp b/xpcom/tests/TestHashtables.cpp
 --- a/xpcom/tests/TestHashtables.cpp
 +++ b/xpcom/tests/TestHashtables.cpp
-@@ -322,7 +322,6 @@ IFoo::QueryInterface( const nsIID& aIID,
+@@ -321,7 +321,6 @@ IFoo::QueryInterface( const nsIID& aIID,
            status = NS_ERROR_NO_INTERFACE;
        }
  
 -    NS_IF_ADDREF(rawPtr);
      *aResult = rawPtr;
  
      return status;
 diff --git a/xpcom/tests/TestPipes.cpp b/xpcom/tests/TestPipes.cpp
@@ -26183,17 +26162,17 @@ diff --git a/xpfe/appshell/src/nsAppShel
    mWindowMediator->AddEnumerator(this);
 -  NS_ADDREF(mWindowMediator);
  }
  
  nsAppShellWindowEnumerator::~nsAppShellWindowEnumerator() {
 diff --git a/xpfe/appshell/src/nsChromeTreeOwner.cpp b/xpfe/appshell/src/nsChromeTreeOwner.cpp
 --- a/xpfe/appshell/src/nsChromeTreeOwner.cpp
 +++ b/xpfe/appshell/src/nsChromeTreeOwner.cpp
-@@ -493,7 +493,6 @@ NS_IMETHODIMP nsChromeTreeOwner::GetMain
+@@ -494,7 +494,6 @@ NS_IMETHODIMP nsChromeTreeOwner::GetMain
     NS_ENSURE_STATE(mXULWindow);
  
     *aMainWidget = mXULWindow->mWindow;
 -   NS_IF_ADDREF(*aMainWidget);
  
     return NS_OK;
  }
 diff --git a/xpfe/appshell/src/nsContentTreeOwner.cpp b/xpfe/appshell/src/nsContentTreeOwner.cpp
@@ -26203,17 +26182,17 @@ diff --git a/xpfe/appshell/src/nsContent
           nsCOMPtr<nsIDocShellTreeItem> item =
             do_QueryReferent(mXULWindow->mTargetableShells[i]);
           if (SameCOMIdentity(item, aRequestor)) {
 -           NS_ADDREF(*aFoundItem = aRequestor);
 +           *aFoundItem = aRequestor;
             return NS_OK;
           }
         }
-@@ -672,7 +672,6 @@ NS_IMETHODIMP nsContentTreeOwner::GetMai
+@@ -673,7 +673,6 @@ NS_IMETHODIMP nsContentTreeOwner::GetMai
     NS_ENSURE_STATE(mXULWindow);
  
     *aMainWidget = mXULWindow->mWindow;
 -   NS_IF_ADDREF(*aMainWidget);
  
     return NS_OK;
  }
 diff --git a/xpfe/appshell/src/nsWebShellWindow.cpp b/xpfe/appshell/src/nsWebShellWindow.cpp
new file mode 100644
--- /dev/null
+++ b/compmgr-loadertype
@@ -0,0 +1,33 @@
+diff --git a/xpcom/components/nsComponentManager.cpp b/xpcom/components/nsComponentManager.cpp
+--- a/xpcom/components/nsComponentManager.cpp
++++ b/xpcom/components/nsComponentManager.cpp
+@@ -1161,7 +1161,7 @@ struct PersistentWriterArgs
+ struct PersistentWriterArgs
+ {
+     PRFileDesc *mFD;
+-    nsTArray<nsLoaderdata> *mLoaderData;
++    nsTArray<nsLoaderdata, GCAllocator> *mLoaderData;
+ };
+ 
+ PR_STATIC_CALLBACK(PLDHashOperator)
+@@ -1196,7 +1196,7 @@ ClassIDWriter(PLDHashTable *table,
+ {
+     nsFactoryEntry *factoryEntry = ((nsFactoryTableEntry*)hdr)->mFactoryEntry;
+     PRFileDesc* fd = ((PersistentWriterArgs*)arg)->mFD;
+-    nsTArray<nsLoaderdata> *loaderData = ((PersistentWriterArgs*)arg)->mLoaderData;
++    nsTArray<nsLoaderdata, GCAllocator> *loaderData = ((PersistentWriterArgs*)arg)->mLoaderData;
+ 
+     // for now, we only save out the top most parent.
+     while (factoryEntry->mParent)
+diff --git a/xpcom/components/nsComponentManager.h b/xpcom/components/nsComponentManager.h
+--- a/xpcom/components/nsComponentManager.h
++++ b/xpcom/components/nsComponentManager.h
+@@ -252,7 +252,7 @@ public:
+     #define NS_SHUTDOWN_COMPLETE 2
+     PRUint32 mShuttingDown;
+ 
+-    nsTArray<nsLoaderdata> mLoaderData;
++    nsTArray<nsLoaderdata, GCAllocator> mLoaderData;
+ 
+     nsDataHashtable<nsHashableHashKey, PRInt64, GCAllocator> mAutoRegEntries;
+ 
deleted file mode 100644
--- a/fix-allocator.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/xpcom/glue/nsAllocator.cpp b/xpcom/glue/nsAllocator.cpp
---- a/xpcom/glue/nsAllocator.cpp
-+++ b/xpcom/glue/nsAllocator.cpp
-@@ -59,7 +59,7 @@ void*
- void*
- GCAllocTable(PLDHashTable *table, PRUint32 nbytes)
- {
--    NS_GetGC()->Alloc(nbytes, MMgc::GC::kContainsPointers);
-+    return NS_GetGC()->Alloc(nbytes, MMgc::GC::kContainsPointers);
- }
- 
- void
--- a/fix-garburator.patch
+++ b/fix-garburator.patch
@@ -35,33 +35,41 @@ diff --git a/modules/plugin/base/public/
 +    if (NS_SUCCEEDED(rv = NS_NewNativeLocalFile(nsDependentCString(data), PR_FALSE, &file)) &&
 +        NS_SUCCEEDED(rv = NS_NewLocalFileInputStream(&fileStream,
                                       file,
                                       PR_RDONLY,
                                       0600,
 diff --git a/netwerk/test/TestProtocols.cpp b/netwerk/test/TestProtocols.cpp
 --- a/netwerk/test/TestProtocols.cpp
 +++ b/netwerk/test/TestProtocols.cpp
-@@ -403,7 +403,7 @@ InputTestConsumer::OnStartRequest(nsIReq
+@@ -401,9 +401,9 @@ InputTestConsumer::OnStartRequest(nsIReq
+         LOG(("\tContent-Length: Unknown\n"));
+     }
  
-     nsISupports* owner;
-     channel->GetOwner(&owner);
+-    nsCOMPtr<nsISupports> owner;
+-    channel->GetOwner(getter_AddRefs(owner));
 -    LOG(("\tChannel Owner: %x\n", owner.get()));
++    nsISupports* owner;
++    channel->GetOwner(&owner);
 +    LOG(("\tChannel Owner: %x\n", owner));
    }
  
-   nsIPropertyBag2* props = do_QueryInterface(request);
+   nsCOMPtr<nsIPropertyBag2> props = do_QueryInterface(request);
 diff --git a/netwerk/test/TestStreamLoader.cpp b/netwerk/test/TestStreamLoader.cpp
 --- a/netwerk/test/TestStreamLoader.cpp
 +++ b/netwerk/test/TestStreamLoader.cpp
-@@ -32,7 +32,7 @@ MyStreamLoaderObserver::OnStreamComplete
+@@ -30,9 +30,9 @@ MyStreamLoaderObserver::OnStreamComplete
+ {
+   LOG(("OnStreamComplete [status=%x resultLen=%u]\n", status, resultLen));
  
-   nsIRequest* request;
-   loader->GetRequest(&request);
+-  nsCOMPtr<nsIRequest> request;
+-  loader->GetRequest(getter_AddRefs(request));
 -  LOG(("  request=%p\n", request.get()));
++  nsIRequest* request;
++  loader->GetRequest(&request);
 +  LOG(("  request=%p\n", request));
  
    QuitPumpingEvents();
    return NS_OK;
 diff --git a/uriloader/base/nsURILoader.cpp b/uriloader/base/nsURILoader.cpp
 --- a/uriloader/base/nsURILoader.cpp
 +++ b/uriloader/base/nsURILoader.cpp
 @@ -477,7 +477,7 @@ nsresult nsDocumentOpenInfo::DispatchCon
@@ -82,72 +90,72 @@ diff --git a/uriloader/base/nsURILoader.
    
    // Make sure nextLink starts with the contentListener that said it wanted the
    // results of this decode.
 diff --git a/uriloader/exthandler/nsExternalHelperAppService.cpp b/uriloader/exthandler/nsExternalHelperAppService.cpp
 --- a/uriloader/exthandler/nsExternalHelperAppService.cpp
 +++ b/uriloader/exthandler/nsExternalHelperAppService.cpp
 @@ -615,7 +615,7 @@ NS_IMETHODIMP nsExternalHelperAppService
      GetFromTypeAndExtension(aMimeContentType, fileExtension,
-                             &mimeInfo);
+                             getter_AddRefs(mimeInfo));
    } 
 -  LOG(("Type/Ext lookup found 0x%p\n", mimeInfo.get()));
 +  LOG(("Type/Ext lookup found 0x%p\n", mimeInfo));
  
    // No mimeinfo -> we can't continue. probably OOM.
    if (!mimeInfo)
 diff --git a/uriloader/prefetch/nsOfflineCacheUpdate.cpp b/uriloader/prefetch/nsOfflineCacheUpdate.cpp
 --- a/uriloader/prefetch/nsOfflineCacheUpdate.cpp
 +++ b/uriloader/prefetch/nsOfflineCacheUpdate.cpp
-@@ -1096,7 +1096,7 @@ nsOfflineCacheUpdateService::OnStateChan
+@@ -1099,7 +1099,7 @@ nsOfflineCacheUpdateService::OnStateChan
          if (!doc) return NS_OK;
  
          LOG(("nsOfflineCacheUpdateService::OnStateChange [%p, doc=%p]",
 -             this, doc.get()));
 +             this, doc));
  
-         nsOfflineCacheUpdate* update;
-         if (mDocUpdates.Get(doc, &update)) {
+         nsRefPtr<nsOfflineCacheUpdate> update;
+         if (mDocUpdates.Get(doc, getter_AddRefs(update))) {
 diff --git a/xpcom/io/nsIFastLoadService.idl b/xpcom/io/nsIFastLoadService.idl
 --- a/xpcom/io/nsIFastLoadService.idl
 +++ b/xpcom/io/nsIFastLoadService.idl
 @@ -149,7 +149,7 @@ inline nsresult
  inline nsresult
  NS_AddFastLoadDependency(nsIFile* aFile)
  {
 -    nsCOMPtr<nsIFastLoadService> fastLoadService(do_GetFastLoadService());
 +    nsIFastLoadService* fastLoadService(do_GetFastLoadService());
      if (fastLoadService) {
          nsresult rv = fastLoadService->AddDependency(aFile);
          if (NS_FAILED(rv) && rv != NS_ERROR_NOT_AVAILABLE)
 diff --git a/xpcom/proxy/src/nsProxyEventObject.cpp b/xpcom/proxy/src/nsProxyEventObject.cpp
 --- a/xpcom/proxy/src/nsProxyEventObject.cpp
 +++ b/xpcom/proxy/src/nsProxyEventObject.cpp
-@@ -225,6 +225,6 @@ nsProxyEventObject::CallMethod(PRUint16 
+@@ -226,6 +226,6 @@ nsProxyEventObject::CallMethod(PRUint16 
  
      threadInt->PopEventQueue();
  
 -    PROXY_LOG(("PROXY(%p): PostAndWait exit [%p %x]\n", this, proxyInfo.get(), rv));
 +    PROXY_LOG(("PROXY(%p): PostAndWait exit [%p %x]\n", this, proxyInfo, rv));
      return rv;
  }
 diff --git a/xpcom/proxy/tests/proxytests.cpp b/xpcom/proxy/tests/proxytests.cpp
 --- a/xpcom/proxy/tests/proxytests.cpp
 +++ b/xpcom/proxy/tests/proxytests.cpp
-@@ -158,7 +158,7 @@ NS_IMETHODIMP nsTestXPCFoo2::Test(PRInt3
-     nsIProxyObjectManager* manager =
+@@ -160,7 +160,7 @@ NS_IMETHODIMP nsTestXPCFoo2::Test(PRInt3
+     nsCOMPtr<nsIProxyObjectManager> manager =
              do_GetService(NS_XPCOMPROXY_CONTRACTID);
  
 -    LOG(("TEST: ProxyObjectManager: %p \n", (void *) manager.get()));
 +    LOG(("TEST: ProxyObjectManager: %p \n", (void *) manager));
      
      PR_ASSERT(manager);
  
-@@ -274,7 +274,7 @@ void TestCase_NestedLoop(nsIThread *thre
-     nsIProxyObjectManager* manager =
+@@ -276,7 +276,7 @@ void TestCase_NestedLoop(nsIThread *thre
+     nsCOMPtr<nsIProxyObjectManager> manager =
              do_GetService(NS_XPCOMPROXY_CONTRACTID);
  
 -    LOG(("TEST: ProxyObjectManager: %p\n", (void *) manager.get()));
 +    LOG(("TEST: ProxyObjectManager: %p\n", (void *) manager));
      
      PR_ASSERT(manager);
  
 diff --git a/xpcom/tests/Makefile.in b/xpcom/tests/Makefile.in
@@ -373,75 +381,75 @@ deleted file mode 100644
 -        nsAutoArrayPtr<TestObject> pobj( new TestObject[3] );
 -        printf("Should create 5 |TestObject|s and then destroy 3:\n");
 -        pobj = new TestObject[5];
 -        printf("Should destroy 5 |TestObject|s:\n");
 -    }
 -
 -    {
 -        printf("Should create and AddRef one |TestRefObject|:\n");
--        TestRefObject* pobj( new TestRefObject() );
+-        nsRefPtr<TestRefObject> pobj( new TestRefObject() );
 -        printf("Should Release and destroy one |TestRefObject|:\n");
 -    }
 -
 -    {
 -        printf("Should create and AddRef one |TestRefObject|:\n");
--        TestRefObject* pobj( new TestRefObject() );
+-        nsRefPtr<TestRefObject> pobj( new TestRefObject() );
 -        printf("Should create and AddRef one |TestRefObject| and then Release and destroy one:\n");
 -        pobj = new TestRefObject();
 -        printf("Should Release and destroy one |TestRefObject|:\n");
 -    }
 -
 -    {
 -        printf("Should create and AddRef one |TestRefObject|:\n");
--        TestRefObject* p1( new TestRefObject() );
+-        nsRefPtr<TestRefObject> p1( new TestRefObject() );
 -        printf("Should AddRef one |TestRefObject|:\n");
--        TestRefObject* p2( p1 );
+-        nsRefPtr<TestRefObject> p2( p1 );
 -        printf("Should Release twice and destroy one |TestRefObject|:\n");
 -    }
 -
 -    printf("\nTesting equality (with all const-ness combinations):\n");
 -
 -    {
--        TestRefObject* p1( new TestRefObject() );
--        TestRefObject* p2( p1 );
+-        nsRefPtr<TestRefObject> p1( new TestRefObject() );
+-        nsRefPtr<TestRefObject> p2( p1 );
 -        printf("equality %s.\n",
 -               ((p1 == p2) && !(p1 != p2)) ? "OK" : "broken");
 -    }
 -
 -    {
--        const TestRefObject* p1( new TestRefObject() );
--        TestRefObject* p2( p1 );
+-        const nsRefPtr<TestRefObject> p1( new TestRefObject() );
+-        nsRefPtr<TestRefObject> p2( p1 );
 -        printf("equality %s.\n",
 -               ((p1 == p2) && !(p1 != p2)) ? "OK" : "broken");
 -    }
 -
 -    {
--        TestRefObject* p1( new TestRefObject() );
--        const TestRefObject* p2( p1 );
+-        nsRefPtr<TestRefObject> p1( new TestRefObject() );
+-        const nsRefPtr<TestRefObject> p2( p1 );
 -        printf("equality %s.\n",
 -               ((p1 == p2) && !(p1 != p2)) ? "OK" : "broken");
 -    }
 -
 -    {
--        const TestRefObject* p1( new TestRefObject() );
--        const TestRefObject* p2( p1 );
+-        const nsRefPtr<TestRefObject> p1( new TestRefObject() );
+-        const nsRefPtr<TestRefObject> p2( p1 );
 -        printf("equality %s.\n",
 -               ((p1 == p2) && !(p1 != p2)) ? "OK" : "broken");
 -    }
 -
 -    {
--        TestRefObject* p1( new TestRefObject() );
+-        nsRefPtr<TestRefObject> p1( new TestRefObject() );
 -        TestRefObject * p2 = p1;
 -        printf("equality %s.\n",
 -               ((p1 == p2) && !(p1 != p2) && (p2 == p1) && !(p2 != p1)) ? "OK" : "broken");
 -    }
 -
 -    {
--        const TestRefObject* p1( new TestRefObject() );
+-        const nsRefPtr<TestRefObject> p1( new TestRefObject() );
 -        TestRefObject * p2 = p1;
 -        printf("equality %s.\n",
 -               ((p1 == p2) && !(p1 != p2) && (p2 == p1) && !(p2 != p1)) ? "OK" : "broken");
 -    }
 -
 -#if 0 /* MSVC++ 6.0 can't be coaxed to accept this */
 -    {
 -        nsRefPtr<TestRefObject> p1( new TestRefObject() );
@@ -454,56 +462,56 @@ deleted file mode 100644
 -        const nsRefPtr<TestRefObject> p1( new TestRefObject() );
 -        TestRefObject * const p2 = p1;
 -        printf("equality %s.\n",
 -               ((p1 == p2) && !(p1 != p2) && (p2 == p1) && !(p2 != p1)) ? "OK" : "broken");
 -    }
 -#endif /* Things that MSVC++ 6.0 can't be coaxed to accept */
 -
 -    {
--        TestRefObject* p1( new TestRefObject() );
+-        nsRefPtr<TestRefObject> p1( new TestRefObject() );
 -        const TestRefObject * p2 = p1;
 -        printf("equality %s.\n",
 -               ((p1 == p2) && !(p1 != p2) && (p2 == p1) && !(p2 != p1)) ? "OK" : "broken");
 -    }
 -
 -    {
--        const TestRefObject* p1( new TestRefObject() );
+-        const nsRefPtr<TestRefObject> p1( new TestRefObject() );
 -        const TestRefObject * p2 = p1;
 -        printf("equality %s.\n",
 -               ((p1 == p2) && !(p1 != p2) && (p2 == p1) && !(p2 != p1)) ? "OK" : "broken");
 -    }
 -
 -    {
--        TestRefObject* p1( new TestRefObject() );
+-        nsRefPtr<TestRefObject> p1( new TestRefObject() );
 -        const TestRefObject * const p2 = p1;
 -        printf("equality %s.\n",
 -               ((p1 == p2) && !(p1 != p2) && (p2 == p1) && !(p2 != p1)) ? "OK" : "broken");
 -    }
 -
 -    {
--        const TestRefObject* p1( new TestRefObject() );
+-        const nsRefPtr<TestRefObject> p1( new TestRefObject() );
 -        const TestRefObject * const p2 = p1;
 -        printf("equality %s.\n",
 -               ((p1 == p2) && !(p1 != p2) && (p2 == p1) && !(p2 != p1)) ? "OK" : "broken");
 -    }
 -
 -    printf("\nTesting getter_Transfers and getter_AddRefs.\n");
 -
 -    {
 -        nsAutoPtr<TestObject> ptr;
 -        printf("Should create one |TestObject|:\n");
 -        CreateTestObject(getter_Transfers(ptr));
 -        printf("Should destroy one |TestObject|:\n");
 -    }
 -
 -    {
--        TestRefObject* ptr;
+-        nsRefPtr<TestRefObject> ptr;
 -        printf("Should create and AddRef one |TestRefObject|:\n");
--        CreateTestRefObject(&ptr);
+-        CreateTestRefObject(getter_AddRefs(ptr));
 -        printf("Should Release and destroy one |TestRefObject|:\n");
 -    }
 -
 -    printf("\nTesting casts and equality tests.\n");
 -
 -    if ((void*)(TestObject*)0x1000 ==
 -        (void*)(TestObjectBaseB*)(TestObject*)0x1000)
 -        printf("\n\nAll these tests are meaningless!\n\n\n");
@@ -522,37 +530,37 @@ deleted file mode 100644
 -        nsAutoPtr<TestObjectBaseB> p2(p1);
 -        printf("equality %s.\n",
 -               ((static_cast<void*>(p1) != static_cast<void*>(p2)) &&
 -                (p1 == p2) && !(p1 != p2) && (p2 == p1) && !(p2 != p1))
 -               ? "OK" : "broken");
 -    }
 -
 -    {
--        TestRefObject* p1 = new TestRefObject();
+-        nsRefPtr<TestRefObject> p1 = new TestRefObject();
 -        // nsCOMPtr requires a |get| for something like this as well
--        TestRefObjectBaseB* p2 = p1;
+-        nsRefPtr<TestRefObjectBaseB> p2 = p1.get();
 -        printf("equality %s.\n",
 -               ((static_cast<void*>(p1) != static_cast<void*>(p2)) &&
 -                (p1 == p2) && !(p1 != p2) && (p2 == p1) && !(p2 != p1))
 -               ? "OK" : "broken");
 -    }
 -
 -    {
--        TestRefObject* p1 = new TestRefObject();
+-        nsRefPtr<TestRefObject> p1 = new TestRefObject();
 -        TestRefObjectBaseB *p2 = p1;
 -        printf("equality %s.\n",
 -               ((static_cast<void*>(p1) != static_cast<void*>(p2)) &&
 -                (p1 == p2) && !(p1 != p2) && (p2 == p1) && !(p2 != p1))
 -               ? "OK" : "broken");
 -    }
 -
 -    {
 -        TestRefObject *p1 = new TestRefObject();
--        TestRefObjectBaseB* p2 = p1;
+-        nsRefPtr<TestRefObjectBaseB> p2 = p1;
 -        printf("equality %s.\n",
 -               ((static_cast<void*>(p1) != static_cast<void*>(p2)) &&
 -                (p1 == p2) && !(p1 != p2) && (p2 == p1) && !(p2 != p1))
 -               ? "OK" : "broken");
 -    }
 -
 -    printf("\nTesting |forget()|.\n");
 -
@@ -569,19 +577,19 @@ deleted file mode 100644
 -        nsAutoArrayPtr<TestObject> pobj( new TestObject[3] );
 -        printf("Should do nothing:\n");
 -        nsAutoArrayPtr<TestObject> pobj2( pobj.forget() );
 -        printf("Should destroy 3 |TestObject|s:\n");
 -    }
 -
 -    {
 -        printf("Should create one |TestRefObject|:\n");
--        TestRefObject* pobj( new TestRefObject() );
+-        nsRefPtr<TestRefObject> pobj( new TestRefObject() );
 -        printf("Should do nothing:\n");
--        TestRefObject* pobj2( pobj );
+-        nsRefPtr<TestRefObject> pobj2( pobj.forget() );
 -        printf("Should destroy one |TestRefObject|:\n");
 -    }
 -
 -
 -    printf("\nTesting construction.\n");
 -
 -    {
 -        printf("Should create one |TestObject|:\n");
@@ -592,17 +600,17 @@ deleted file mode 100644
 -    {
 -        printf("Should create 3 |TestObject|s:\n");
 -        nsAutoArrayPtr<TestObject> pobj(new TestObject[3]);
 -        printf("Should destroy 3 |TestObject|s:\n");
 -    }
 -
 -    {
 -        printf("Should create and AddRef one |TestRefObject|:\n");
--        TestRefObject* pobj = new TestRefObject();
+-        nsRefPtr<TestRefObject> pobj = new TestRefObject();
 -        printf("Should Release and destroy one |TestRefObject|:\n");
 -    }
 -
 -    printf("\nTesting calling of functions (including array access and casts).\n");
 -
 -    {
 -        printf("Should create one |TestObject|:\n");
 -        nsAutoPtr<TestObject> pobj(new TestObject());
@@ -624,17 +632,17 @@ deleted file mode 100644
 -        DoSomethingWithTestObject(pobj + 2);
 -        printf("Should do something with one |TestObject|:\n");
 -        DoSomethingWithConstTestObject(pobj + 1);
 -        printf("Should destroy 3 |TestObject|s:\n");
 -    }
 -
 -    {
 -        printf("Should create and AddRef one |TestRefObject|:\n");
--        TestRefObject* pobj = new TestRefObject();
+-        nsRefPtr<TestRefObject> pobj = new TestRefObject();
 -        printf("Should do something with one |TestRefObject|:\n");
 -        DoSomethingWithTestRefObject(pobj);
 -        printf("Should do something with one |TestRefObject|:\n");
 -        DoSomethingWithConstTestRefObject(pobj);
 -        printf("Should Release and destroy one |TestRefObject|:\n");
 -    }
 -
 -    {
@@ -658,17 +666,17 @@ deleted file mode 100644
 -        DoSomethingWithTestObjectBaseB(pobj + 2);
 -        printf("Should do something with one |TestObject|:\n");
 -        DoSomethingWithConstTestObjectBaseB(pobj + 1);
 -        printf("Should destroy 3 |TestObject|s:\n");
 -    }
 -
 -    {
 -        printf("Should create and AddRef one |TestRefObject|:\n");
--        TestRefObject* pobj = new TestRefObject();
+-        nsRefPtr<TestRefObject> pobj = new TestRefObject();
 -        printf("Should do something with one |TestRefObject|:\n");
 -        DoSomethingWithTestRefObjectBaseB(pobj);
 -        printf("Should do something with one |TestRefObject|:\n");
 -        DoSomethingWithConstTestRefObjectBaseB(pobj);
 -        printf("Should Release and destroy one |TestRefObject|:\n");
 -    }
 -
 -    {
@@ -692,17 +700,17 @@ deleted file mode 100644
 -        DoSomethingWithTestObject(pobj + 2);
 -        printf("Should do something with one |TestObject|:\n");
 -        DoSomethingWithConstTestObject(pobj + 1);
 -        printf("Should destroy 3 |TestObject|s:\n");
 -    }
 -
 -    {
 -        printf("Should create and AddRef one |TestRefObject|:\n");
--        const TestRefObject* pobj = new TestRefObject();
+-        const nsRefPtr<TestRefObject> pobj = new TestRefObject();
 -        printf("Should do something with one |TestRefObject|:\n");
 -        DoSomethingWithTestRefObject(pobj);
 -        printf("Should do something with one |TestRefObject|:\n");
 -        DoSomethingWithConstTestRefObject(pobj);
 -        printf("Should Release and destroy one |TestRefObject|:\n");
 -    }
 -
 -    {
@@ -726,30 +734,30 @@ deleted file mode 100644
 -        DoSomethingWithTestObjectBaseB(pobj + 2);
 -        printf("Should do something with one |TestObject|:\n");
 -        DoSomethingWithConstTestObjectBaseB(pobj + 1);
 -        printf("Should destroy 3 |TestObject|s:\n");
 -    }
 -
 -    {
 -        printf("Should create and AddRef one |TestRefObject|:\n");
--        const TestRefObject* pobj = new TestRefObject();
+-        const nsRefPtr<TestRefObject> pobj = new TestRefObject();
 -        printf("Should do something with one |TestRefObject|:\n");
 -        DoSomethingWithTestRefObjectBaseB(pobj);
 -        printf("Should do something with one |TestRefObject|:\n");
 -        DoSomethingWithConstTestRefObjectBaseB(pobj);
 -        printf("Should Release and destroy one |TestRefObject|:\n");
 -    }
 -
 -    return 0;
 -}
 diff --git a/xpcom/threads/nsThread.cpp b/xpcom/threads/nsThread.cpp
 --- a/xpcom/threads/nsThread.cpp
 +++ b/xpcom/threads/nsThread.cpp
-@@ -482,7 +482,7 @@ nsThread::ProcessNextEvent(PRBool mayWai
+@@ -483,7 +483,7 @@ nsThread::ProcessNextEvent(PRBool mayWai
    nsresult rv = NS_OK;
  
    if (event) {
 -    LOG(("THRD(%p) running [%p]\n", this, event.get()));
 +    LOG(("THRD(%p) running [%p]\n", this, event));
      ++mRunningEvent;
      event->Run();
      --mRunningEvent;
--- a/gc-hashtables.patch
+++ b/gc-hashtables.patch
@@ -1,83 +1,476 @@
+* * *
+* * *
+
 diff --git a/js/src/xpconnect/src/nsXPConnect.cpp b/js/src/xpconnect/src/nsXPConnect.cpp
 --- a/js/src/xpconnect/src/nsXPConnect.cpp
 +++ b/js/src/xpconnect/src/nsXPConnect.cpp
 @@ -113,7 +113,7 @@ nsXPConnect::nsXPConnect()
  }
  
  #ifndef XPCONNECT_STANDALONE
 -typedef nsBaseHashtable<nsVoidPtrHashKey, nsISupports*, nsISupports*> ScopeSet;
 +typedef nsBaseHashtable<nsVoidPtrHashKey, nsISupports*, nsISupports*, CAllocator> ScopeSet;
  #endif
  
  static const PLDHashTableOps RefCountOps =
+diff --git a/xpcom/components/nsCategoryManager.h b/xpcom/components/nsCategoryManager.h
+--- a/xpcom/components/nsCategoryManager.h
++++ b/xpcom/components/nsCategoryManager.h
+@@ -63,8 +63,8 @@ class CategoryLeaf : public nsDepCharHas
+ class CategoryLeaf : public nsDepCharHashKey
+ {
+ public:
+-  CategoryLeaf(const char* aKey)
+-    : nsDepCharHashKey(aKey),
++  CategoryLeaf(const char* aKey, const void *entryStore)
++    : nsDepCharHashKey(aKey, entryStore),
+       pValue(nsnull),
+       nonpValue(nsnull) { }
+   const char* pValue;
+diff --git a/xpcom/components/nsComponentManager.cpp b/xpcom/components/nsComponentManager.cpp
+--- a/xpcom/components/nsComponentManager.cpp
++++ b/xpcom/components/nsComponentManager.cpp
+@@ -313,8 +313,8 @@ factory_ClearEntry(PLDHashTable *aTable,
+ }
+ 
+ static const PLDHashTableOps factory_DHashTableOps = {
+-    PL_DHashAllocTable,
+-    PL_DHashFreeTable,
++    GCAllocTable,
++    GCFreeTable,
+     factory_HashKey,
+     factory_MatchEntry,
+     PL_DHashMoveEntryStub,
+@@ -340,8 +340,8 @@ contractID_ClearEntry(PLDHashTable *aTab
+ }
+ 
+ static const PLDHashTableOps contractID_DHashTableOps = {
+-    PL_DHashAllocTable,
+-    PL_DHashFreeTable,
++    GCAllocTable,
++    GCFreeTable,
+     PL_DHashStringKey,
+     PL_DHashMatchStringKey,
+     PL_DHashMoveEntryStub,
+@@ -1022,7 +1022,7 @@ nsComponentManagerImpl::ReadPersistentRe
+         }
+ 
+         nsFactoryEntry *entry =
+-            new (mem) nsFactoryEntry(aClass, loadertype, values[4]);
++            new nsFactoryEntry(aClass, loadertype, values[4]);
+ 
+         if (!entry->mLocationKey) {
+             rv = NS_ERROR_OUT_OF_MEMORY;
+@@ -1974,7 +1974,7 @@ nsComponentManagerImpl::RegisterService(
+         PL_ARENA_ALLOCATE(mem, &mArena, sizeof(nsFactoryEntry));
+         if (!mem)
+             return NS_ERROR_OUT_OF_MEMORY;
+-        entry = new (mem) nsFactoryEntry(aClass, (nsIFactory*) nsnull);
++        entry = new nsFactoryEntry(aClass, (nsIFactory*) nsnull);
+ 
+         nsFactoryTableEntry* factoryTableEntry =
+             static_cast<nsFactoryTableEntry*>
+@@ -2035,7 +2035,7 @@ nsComponentManagerImpl::RegisterService(
+         PL_ARENA_ALLOCATE(mem, &mArena, sizeof(nsFactoryEntry));
+         if (!mem)
+             return NS_ERROR_OUT_OF_MEMORY;
+-        entry = new (mem) nsFactoryEntry(kEmptyCID, (nsIFactory*) nsnull);
++        entry = new nsFactoryEntry(kEmptyCID, (nsIFactory*) nsnull);
+ 
+         nsContractIDTableEntry* contractIDTableEntry =
+             static_cast<nsContractIDTableEntry*>
+@@ -2490,7 +2490,7 @@ nsComponentManagerImpl::RegisterFactory(
+     if (!mem)
+         return NS_ERROR_OUT_OF_MEMORY;
+ 
+-    entry = new (mem) nsFactoryEntry(aClass, aFactory, entry);
++    entry = new nsFactoryEntry(aClass, aFactory, entry);
+ 
+     factoryTableEntry->mFactoryEntry = entry;
+ 
+@@ -2651,9 +2651,9 @@ nsComponentManagerImpl::RegisterComponen
+             return NS_ERROR_OUT_OF_MEMORY;
+ 
+         mRegistryDirty = PR_TRUE;
+-        entry = new (mem) nsFactoryEntry(aClass,
+-                                         typeIndex,
+-                                         aRegistryName);
++        entry = new nsFactoryEntry(aClass,
++                                   typeIndex,
++                                   aRegistryName);
+         if (!entry->mLocationKey)
+             return NS_ERROR_OUT_OF_MEMORY;
+ 
+diff --git a/xpcom/components/nsComponentManager.h b/xpcom/components/nsComponentManager.h
+--- a/xpcom/components/nsComponentManager.h
++++ b/xpcom/components/nsComponentManager.h
+@@ -253,7 +253,7 @@ public:
+ 
+     nsTArray<nsLoaderdata> mLoaderData;
+ 
+-    nsDataHashtable<nsHashableHashKey, PRInt64> mAutoRegEntries;
++    nsDataHashtable<nsHashableHashKey, PRInt64, GCAllocator> mAutoRegEntries;
+ 
+     PRBool              mRegistryDirty;
+     nsCOMPtr<nsCategoryManager>  mCategoryManager;
+@@ -291,7 +291,7 @@ private:
+  *		These are strictly session specific and in memory only.
+  */
+ 
+-struct nsFactoryEntry {
++struct nsFactoryEntry : public XPCOMGCObject {
+     nsFactoryEntry(const nsCID    &aClass,
+                    LoaderType      aLoaderType,
+                    const char     *aLocationKey,
+diff --git a/xpcom/components/nsNativeComponentLoader.cpp b/xpcom/components/nsNativeComponentLoader.cpp
+--- a/xpcom/components/nsNativeComponentLoader.cpp
++++ b/xpcom/components/nsNativeComponentLoader.cpp
+@@ -82,6 +82,8 @@
+ #define IMPLEMENT_BREAK_AFTER_LOAD
+ #endif
+ 
++using namespace MMgc;
++
+ static PRLogModuleInfo *nsNativeModuleLoaderLog =
+     PR_NewLogModule("nsNativeModuleLoader");
+ 
+@@ -121,11 +123,10 @@ nsNativeModuleLoader::LoadModule(nsILoca
+         return NS_NOINTERFACE;
+     }
+ 
+-    NativeLoadData data;
+-
+-    if (mLibraries.Get(hashedFile, &data)) {
+-        NS_ASSERTION(data.module, "Corrupt mLibraries hash");
+-        NS_ADDREF(*aResult = data.module);
++    NativeLoadData *data = mLibraries.GetEntry(hashedFile);
++    if (data) {
++        NS_ASSERTION(data->module, "Corrupt mLibraries hash");
++        *aResult = data->module;
+ 
+         LOG(PR_LOG_DEBUG,
+             ("nsNativeModuleLoader::LoadModule(\"%s\") - found in cache",
+@@ -135,7 +136,8 @@ nsNativeModuleLoader::LoadModule(nsILoca
+ 
+     // We haven't loaded this module before
+ 
+-    rv = aFile->Load(&data.library);
++    PRLibrary *library;
++    rv = aFile->Load(&library);
+ 
+     if (NS_FAILED(rv)) {
+         char errorMsg[1024] = "<unknown; can't get error from NSPR>";
+@@ -177,19 +179,24 @@ nsNativeModuleLoader::LoadModule(nsILoca
+ #endif
+ 
+     nsGetModuleProc proc = (nsGetModuleProc)
+-        PR_FindFunctionSymbol(data.library, NS_GET_MODULE_SYMBOL);
++        PR_FindFunctionSymbol(library, NS_GET_MODULE_SYMBOL);
+ 
+     if (proc) {
++        nsIModule* module;
+         rv = proc(nsComponentManagerImpl::gComponentManager,
+                   aFile,
+-                  getter_AddRefs(data.module));
++                  &module);
+         if (NS_SUCCEEDED(rv)) {
+             LOG(PR_LOG_DEBUG,
+                 ("nsNativeModuleLoader::LoadModule(\"%s\") - Success",
+                  filePath.get()));
+ 
+-            if (mLibraries.Put(hashedFile, data)) {
+-                NS_ADDREF(*aResult = data.module);
++            data = mLibraries.PutEntry(hashedFile);
++            if (data) {
++                *aResult = module;
++                data->library = library;
++                WB(NS_GetGC(), mLibraries.GetEntryStore(),
++                   &data->module, module);
+                 return NS_OK;
+             }
+         }
+@@ -206,26 +213,16 @@ nsNativeModuleLoader::LoadModule(nsILoca
+     }
+ 
+     // at some point we failed, clean up
+-    data.module = nsnull;
+-    PR_UnloadLibrary(data.library);
++    PR_UnloadLibrary(library);
+ 
+     return NS_ERROR_FAILURE;
+ }
+ 
+ PLDHashOperator
+-nsNativeModuleLoader::ReleaserFunc(nsIHashable* aHashedFile,
+-                                   NativeLoadData& aLoadData, void*)
+-{
+-    aLoadData.module = nsnull;
+-    return PL_DHASH_NEXT;
+-}
+-
+-PLDHashOperator
+-nsNativeModuleLoader::UnloaderFunc(nsIHashable* aHashedFile,
+-                                   NativeLoadData& aLoadData, void*)
++nsNativeModuleLoader::UnloaderFunc(NativeLoadData *aLoadData, void*)
+ {
+     if (PR_LOG_TEST(nsNativeModuleLoaderLog, PR_LOG_DEBUG)) {
+-        nsCOMPtr<nsIFile> file(do_QueryInterface(aHashedFile));
++        nsIFile* file(do_QueryInterface(aLoadData->GetKey()));
+ 
+         nsCAutoString filePath;
+         file->GetNativePath(filePath);
+@@ -241,7 +238,7 @@ nsNativeModuleLoader::UnloaderFunc(nsIHa
+ #if 0
+     // XXXbsmedberg: do this as soon as the static-destructor crash(es)
+     // are fixed
+-    PRStatus ret = PR_UnloadLibrary(aLoadData.library);
++    PRStatus ret = PR_UnloadLibrary(aLoadData->library);
+     NS_ASSERTION(ret == PR_SUCCESS, "Failed to unload library");
+ #endif
+ 
+@@ -255,6 +252,5 @@ void
+ void
+ nsNativeModuleLoader::UnloadLibraries()
+ {
+-    mLibraries.Enumerate(ReleaserFunc, nsnull);
+-    mLibraries.Enumerate(UnloaderFunc, nsnull);
+-}
++    mLibraries.EnumerateEntries(UnloaderFunc, nsnull);
++}
+diff --git a/xpcom/components/nsNativeComponentLoader.h b/xpcom/components/nsNativeComponentLoader.h
+--- a/xpcom/components/nsNativeComponentLoader.h
++++ b/xpcom/components/nsNativeComponentLoader.h
+@@ -60,21 +60,24 @@ class nsNativeModuleLoader : public nsIM
+     void UnloadLibraries();
+ 
+  private:
+-    struct NativeLoadData
++    struct NativeLoadData : public nsHashableHashKey
+     {
+-        NativeLoadData() : library(nsnull) { }
++        typedef nsHashableHashKey::KeyType KeyType;
++        typedef nsHashableHashKey::KeyTypePointer KeyTypePointer;
+ 
+-        nsCOMPtr<nsIModule>  module;
++        NativeLoadData(const nsIHashable* aHashable, const void *entryStore)
++            : nsHashableHashKey(aHashable, entryStore)
++            , module(NULL)
++            , library(NULL) { }
++
++        nsIModule*           module;
+         PRLibrary           *library;
+     };
+ 
+     static PLDHashOperator
+-    ReleaserFunc(nsIHashable* aHashedFile, NativeLoadData &aLoadData, void*);
++    UnloaderFunc(NativeLoadData *data, void*);
+ 
+-    static PLDHashOperator
+-    UnloaderFunc(nsIHashable* aHashedFile, NativeLoadData &aLoadData, void*);
+-
+-    nsDataHashtable<nsHashableHashKey, NativeLoadData> mLibraries;
++    nsTHashtable<NativeLoadData, GCAllocator> mLibraries;
+ };
+ 
+ #endif /* nsNativeModuleLoader_h__ */
+diff --git a/xpcom/components/nsStaticComponentLoader.cpp b/xpcom/components/nsStaticComponentLoader.cpp
+--- a/xpcom/components/nsStaticComponentLoader.cpp
++++ b/xpcom/components/nsStaticComponentLoader.cpp
+@@ -52,11 +52,15 @@ static PRLogModuleInfo *sLog = PR_NewLog
+ #endif
+ #define LOG(args) PR_LOG(sLog, PR_LOG_DEBUG, args)
+ 
++using namespace MMgc;
++
+ extern const char staticComponentType[];
+ 
+ struct StaticModuleInfo : public PLDHashEntryHdr {
++    StaticModuleInfo() : module(NULL), next(NULL) { }
++
+     nsStaticModuleInfo  info;
+-    nsCOMPtr<nsIModule> module;
++    nsIModule* module;
+ 
+     // We want to autoregister the components in the order they come to us
+     // in the static component list, so we keep a linked list.
+@@ -80,8 +84,8 @@ info_InitEntry(PLDHashTable *table, PLDH
+ }
+ 
+ /* static */ PLDHashTableOps nsStaticModuleLoader::sInfoHashOps = {
+-    PL_DHashAllocTable,
+-    PL_DHashFreeTable,
++    GCAllocTable,
++    GCFreeTable,
+     PL_DHashStringKey,
+     PL_DHashMatchStringKey,
+     PL_DHashMoveEntryStub,
+@@ -131,9 +135,12 @@ nsStaticModuleLoader::EnumerateModules(S
+ {
+     for (StaticModuleInfo *c = mFirst; c; c = c->next) {
+         if (!c->module) {
++            nsIModule* module;
+             nsresult rv = c->info.
+                 getModule(nsComponentManagerImpl::gComponentManager, nsnull,
+-                          getter_AddRefs(c->module));
++                          &module);
++            WB(NS_GetGC(), mInfoHash.entryStore, &c->module, module);
++            
+             LOG(("nSCL: EnumerateModules(): %lx\n", rv));
+             if (NS_FAILED(rv))
+                 continue;
+@@ -156,9 +163,13 @@ nsStaticModuleLoader::GetModuleFor(const
+         return NS_ERROR_FACTORY_NOT_REGISTERED;
+ 
+     if (!info->module) {
++        nsIModule* module;
+         rv = info->info.
+             getModule(nsComponentManagerImpl::gComponentManager, nsnull,
+-                      getter_AddRefs(info->module));
++                      &module);
++ 
++        WB(NS_GetGC(), mInfoHash.entryStore, &info->module, module);
++
+         LOG(("nSCL: GetModuleForFor(\"%s\"): %lx\n", aLocation, rv));
+         if (NS_FAILED(rv))
+             return rv;
+diff --git a/xpcom/ds/nsObserverList.h b/xpcom/ds/nsObserverList.h
+--- a/xpcom/ds/nsObserverList.h
++++ b/xpcom/ds/nsObserverList.h
+@@ -74,7 +74,8 @@ class nsObserverList : public nsCharPtrH
+ class nsObserverList : public nsCharPtrHashKey
+ {
+ public:
+-  nsObserverList(const char *key) : nsCharPtrHashKey(key)
++  nsObserverList(const char *key, const void *entryStore)
++    : nsCharPtrHashKey(key, entryStore)
+   { MOZ_COUNT_CTOR(nsObserverList); }
+ 
+   ~nsObserverList() { MOZ_COUNT_DTOR(nsObserverList); }
+diff --git a/xpcom/glue/nsAllocator.cpp b/xpcom/glue/nsAllocator.cpp
+--- a/xpcom/glue/nsAllocator.cpp
++++ b/xpcom/glue/nsAllocator.cpp
+@@ -55,3 +55,15 @@ GCAllocator::Realloc(void *object, size_
+     memcpy(newobject, object, oldsize);
+     return newobject;
+ }
++
++void*
++GCAllocTable(PLDHashTable *table, PRUint32 nbytes)
++{
++    return NS_GetGC()->Alloc(nbytes, MMgc::GC::kContainsPointers);
++}
++
++void
++GCFreeTable(PLDHashTable *table, void *ptr)
++{
++    NS_GetGC()->Free(ptr);
++}
+diff --git a/xpcom/glue/nsAllocator.h b/xpcom/glue/nsAllocator.h
+--- a/xpcom/glue/nsAllocator.h
++++ b/xpcom/glue/nsAllocator.h
+@@ -47,6 +47,8 @@
+ #include "nsXPCOM.h"
+ #include "MMgc.h"
+ 
++struct PLDHashTable;
++
+ /**
+  * The following classes are all static and follow the same pattern:
+  *
+@@ -85,7 +87,7 @@ public:
+ public:
+     static void* Alloc(size_t size)
+     {
+-        return NS_GetGC()->Alloc(size);
++        return NS_GetGC()->Alloc(size, MMgc::GC::kContainsPointers);
+     }
+ 
+     NS_COM_GLUE static void* Realloc(void *object, size_t oldsize, size_t newsize);
+@@ -98,4 +100,10 @@ public:
+     }
+ };
+ 
++NS_COM_GLUE void*
++GCAllocTable(PLDHashTable *table, PRUint32 nbytes);
++
++NS_COM_GLUE void
++GCFreeTable(PLDHashTable *table, void *ptr);
++
+ #endif // nsAllocator_h__
 diff --git a/xpcom/glue/nsBaseHashtable.h b/xpcom/glue/nsBaseHashtable.h
 --- a/xpcom/glue/nsBaseHashtable.h
 +++ b/xpcom/glue/nsBaseHashtable.h
 @@ -42,7 +42,7 @@
  #include "prlock.h"
  #include "nsDebug.h"
  
 -template<class KeyClass,class DataType,class UserDataType>
 +template<class KeyClass,class DataType,class UserDataType,class Allocator>
  class nsBaseHashtable; // forward declaration
  
  /**
-@@ -55,9 +55,7 @@ class nsBaseHashtableET : public KeyClas
+@@ -55,14 +55,11 @@ class nsBaseHashtableET : public KeyClas
  {
  public:
    DataType mData;
 -  friend class nsTHashtable< nsBaseHashtableET<KeyClass,DataType> >;
 -
 -private:
 +
    typedef typename KeyClass::KeyType KeyType;
    typedef typename KeyClass::KeyTypePointer KeyTypePointer;
    
-@@ -78,9 +76,9 @@ private:
+-  nsBaseHashtableET(KeyTypePointer aKey);
+-  nsBaseHashtableET(nsBaseHashtableET<KeyClass,DataType>& toCopy);
++  nsBaseHashtableET(KeyTypePointer aKey, const void *entryStore);
+   ~nsBaseHashtableET();
+ };
+ 
+@@ -78,9 +75,9 @@ private:
   *   DataType must implicitly cast to UserDataType
   * @param UserDataType the user sees, for example PRUint32 or nsISupports*
   */
 -template<class KeyClass,class DataType,class UserDataType>
 +template<class KeyClass,class DataType,class UserDataType,class Allocator=CAllocator>
  class nsBaseHashtable :
 -  protected nsTHashtable< nsBaseHashtableET<KeyClass,DataType> >
 +  protected nsTHashtable< nsBaseHashtableET<KeyClass,DataType>, Allocator >
  {
  public:
    typedef typename KeyClass::KeyType KeyType;
-@@ -96,7 +94,7 @@ public:
+@@ -96,7 +93,7 @@ public:
     * @return    PR_TRUE if the object was initialized properly.
     */
    PRBool Init(PRUint32 initSize = PL_DHASH_MIN_SIZE)
 -  { return nsTHashtable<EntryType>::Init(initSize); }
 +  { return nsTHashtable<EntryType, Allocator>::Init(initSize); }
  
    /**
     * Check whether the table has been initialized.
-@@ -110,7 +108,7 @@ public:
+@@ -110,7 +107,7 @@ public:
     * @return    number of entries
     */
    PRUint32 Count() const
 -  { return nsTHashtable<EntryType>::Count(); }
 +  { return nsTHashtable<EntryType, Allocator>::Count(); }
  
    /**
     * retrieve the value for a key.
-@@ -224,7 +222,7 @@ public:
+@@ -224,7 +221,7 @@ public:
    /**
     * reset the hashtable, removing all entries
     */
 -  void Clear() { nsTHashtable<EntryType>::Clear(); }
 +  void Clear() { nsTHashtable<EntryType, Allocator>::Clear(); }
  
  protected:
    /**
-@@ -255,42 +253,6 @@ protected:
+@@ -255,56 +252,13 @@ protected:
                                      void              *arg);
  };
  
 -/**
 - * This class is a thread-safe version of nsBaseHashtable.
 - */
 -template<class KeyClass,class DataType,class UserDataType>
 -class nsBaseHashtableMT :
@@ -110,41 +503,57 @@ diff --git a/xpcom/glue/nsBaseHashtable.
 -protected:
 -  PRLock* mLock;
 -};
 -  
 -
  //
  // nsBaseHashtableET definitions
  //
-@@ -316,9 +278,9 @@ nsBaseHashtableET<KeyClass,DataType>::~n
+ 
+ template<class KeyClass,class DataType>
+-nsBaseHashtableET<KeyClass,DataType>::nsBaseHashtableET(KeyTypePointer aKey) :
+-  KeyClass(aKey)
+-{ }
+-
+-template<class KeyClass,class DataType>
+-nsBaseHashtableET<KeyClass,DataType>::nsBaseHashtableET
+-  (nsBaseHashtableET<KeyClass,DataType>& toCopy) :
+-  KeyClass(toCopy),
+-  mData(toCopy.mData)
++nsBaseHashtableET<KeyClass,DataType>::nsBaseHashtableET(KeyTypePointer aKey, const void *entryStore) :
++  KeyClass(aKey, entryStore)
+ { }
+ 
+ template<class KeyClass,class DataType>
+@@ -316,9 +270,9 @@ nsBaseHashtableET<KeyClass,DataType>::~n
  // nsBaseHashtable definitions
  //
  
 -template<class KeyClass,class DataType,class UserDataType>
 +template<class KeyClass,class DataType,class UserDataType,class Allocator>
  PLDHashOperator
 -nsBaseHashtable<KeyClass,DataType,UserDataType>::s_EnumReadStub
 +nsBaseHashtable<KeyClass,DataType,UserDataType,Allocator>::s_EnumReadStub
    (PLDHashTable *table, PLDHashEntryHdr *hdr, PRUint32 number, void* arg)
  {
    EntryType* ent = static_cast<EntryType*>(hdr);
-@@ -335,9 +297,9 @@ nsBaseHashtable<KeyClass,DataType,UserDa
+@@ -335,9 +289,9 @@ nsBaseHashtable<KeyClass,DataType,UserDa
    return PL_DHASH_NEXT;
  }
  
 -template<class KeyClass,class DataType,class UserDataType>
 +template<class KeyClass,class DataType,class UserDataType,class Allocator>
  PLDHashOperator
 -nsBaseHashtable<KeyClass,DataType,UserDataType>::s_EnumStub
 +nsBaseHashtable<KeyClass,DataType,UserDataType,Allocator>::s_EnumStub
    (PLDHashTable *table, PLDHashEntryHdr *hdr, PRUint32 number, void* arg)
  {
    EntryType* ent = static_cast<EntryType*>(hdr);
-@@ -346,110 +308,4 @@ nsBaseHashtable<KeyClass,DataType,UserDa
+@@ -346,110 +300,4 @@ nsBaseHashtable<KeyClass,DataType,UserDa
    return (eargs->func)(ent->GetKey(), ent->mData, eargs->userArg);
  }
  
 -
 -//
 -// nsBaseHashtableMT  definitions
 -//
 -
@@ -360,16 +769,156 @@ diff --git a/xpcom/glue/nsDataHashtable.
 -
 -template<class KeyClass,class DataType>
 -class nsDataHashtableMT :
 -  public nsBaseHashtableMT<KeyClass,DataType,DataType>
 +  public nsBaseHashtable<KeyClass,DataType,DataType,Allocator>
  { };
  
  #endif // nsDataHashtable_h__
+diff --git a/xpcom/glue/nsHashKeys.h b/xpcom/glue/nsHashKeys.h
+--- a/xpcom/glue/nsHashKeys.h
++++ b/xpcom/glue/nsHashKeys.h
+@@ -85,8 +85,7 @@ public:
+   typedef const nsAString& KeyType;
+   typedef const nsAString* KeyTypePointer;
+ 
+-  nsStringHashKey(KeyTypePointer aStr) : mStr(*aStr) { }
+-  nsStringHashKey(const nsStringHashKey& toCopy) : mStr(toCopy.mStr) { }
++  nsStringHashKey(KeyTypePointer aStr, const void *entryStore) : mStr(*aStr) { }
+   ~nsStringHashKey() { }
+ 
+   KeyType GetKey() const { return mStr; }
+@@ -117,8 +116,8 @@ public:
+   typedef const nsACString& KeyType;
+   typedef const nsACString* KeyTypePointer;
+   
+-  nsCStringHashKey(const nsACString* aStr) : mStr(*aStr) { }
+-  nsCStringHashKey(const nsCStringHashKey& toCopy) : mStr(toCopy.mStr) { }
++  nsCStringHashKey(const nsACString* aStr, const void *entryStore)
++    : mStr(*aStr) { }
+   ~nsCStringHashKey() { }
+ 
+   KeyType GetKey() const { return mStr; }
+@@ -147,8 +146,8 @@ public:
+   typedef const PRUint32& KeyType;
+   typedef const PRUint32* KeyTypePointer;
+   
+-  nsUint32HashKey(KeyTypePointer aKey) : mValue(*aKey) { }
+-  nsUint32HashKey(const nsUint32HashKey& toCopy) : mValue(toCopy.mValue) { }
++  nsUint32HashKey(KeyTypePointer aKey, const void *entryStore)
++    : mValue(*aKey) { }
+   ~nsUint32HashKey() { }
+ 
+   KeyType GetKey() const { return mValue; }
+@@ -173,10 +172,8 @@ public:
+   typedef nsISupports* KeyType;
+   typedef const nsISupports* KeyTypePointer;
+ 
+-  nsISupportsHashKey(const nsISupports* key) :
++  nsISupportsHashKey(const nsISupports* key, const void *entryStore) :
+     mSupports(const_cast<nsISupports*>(key)) { }
+-  nsISupportsHashKey(const nsISupportsHashKey& toCopy) :
+-    mSupports(toCopy.mSupports) { }
+   ~nsISupportsHashKey() { }
+ 
+   KeyType GetKey() const { return mSupports; }
+@@ -205,10 +202,8 @@ public:
+   typedef const void* KeyType;
+   typedef const void* KeyTypePointer;
+ 
+-  nsVoidPtrHashKey(const void* key) :
++  nsVoidPtrHashKey(const void* key, const void *entryStore) :
+     mKey(key) { }
+-  nsVoidPtrHashKey(const nsVoidPtrHashKey& toCopy) :
+-    mKey(toCopy.mKey) { }
+   ~nsVoidPtrHashKey() { }
+ 
+   KeyType GetKey() const { return mKey; }
+@@ -240,10 +235,8 @@ public:
+   typedef const void* KeyType;
+   typedef const void* KeyTypePointer;
+ 
+-  nsClearingVoidPtrHashKey(const void* key) :
++  nsClearingVoidPtrHashKey(const void* key, const void *entryStore) :
+     mKey(key) { }
+-  nsClearingVoidPtrHashKey(const nsClearingVoidPtrHashKey& toCopy) :
+-    mKey(toCopy.mKey) { }
+   ~nsClearingVoidPtrHashKey() { mKey = NULL; }
+ 
+   KeyType GetKey() const { return mKey; }
+@@ -272,8 +265,7 @@ public:
+   typedef const nsID& KeyType;
+   typedef const nsID* KeyTypePointer;
+   
+-  nsIDHashKey(const nsID* inID) : mID(*inID) { }
+-  nsIDHashKey(const nsIDHashKey& toCopy) : mID(toCopy.mID) { }
++  nsIDHashKey(const nsID* inID, const void *entryStore) : mID(*inID) { }
+   ~nsIDHashKey() { }
+ 
+   KeyType GetKey() const { return mID; }
+@@ -304,8 +296,7 @@ public:
+   typedef const char* KeyType;
+   typedef const char* KeyTypePointer;
+ 
+-  nsDepCharHashKey(const char* aKey) { mKey = aKey; }
+-  nsDepCharHashKey(const nsDepCharHashKey& toCopy) { mKey = toCopy.mKey; }
++  nsDepCharHashKey(const char* aKey, const void *entryStore) { mKey = aKey; }
+   ~nsDepCharHashKey() { }
+ 
+   const char* GetKey() const { return mKey; }
+@@ -333,8 +324,8 @@ public:
+   typedef const char* KeyType;
+   typedef const char* KeyTypePointer;
+ 
+-  nsCharPtrHashKey(const char* aKey) : mKey(strdup(aKey)) { }
+-  nsCharPtrHashKey(const nsCharPtrHashKey& toCopy) : mKey(strdup(toCopy.mKey)) { }
++  nsCharPtrHashKey(const char* aKey, const void *entryStore)
++    : mKey(strdup(aKey)) { }
+   ~nsCharPtrHashKey() { if (mKey) free(const_cast<char *>(mKey)); }
+ 
+   const char* GetKey() const { return mKey; }
+@@ -363,8 +354,8 @@ public:
+   typedef const PRUnichar* KeyType;
+   typedef const PRUnichar* KeyTypePointer;
+ 
+-  nsUnicharPtrHashKey(const PRUnichar* aKey) : mKey(NS_strdup(aKey)) { }
+-  nsUnicharPtrHashKey(const nsUnicharPtrHashKey& toCopy) : mKey(NS_strdup(toCopy.mKey)) { }
++  nsUnicharPtrHashKey(const PRUnichar* aKey, const void *entryStore)
++    : mKey(NS_strdup(aKey)) { }
+   ~nsUnicharPtrHashKey() { if (mKey) NS_Free(const_cast<PRUnichar *>(mKey)); }
+ 
+   const PRUnichar* GetKey() const { return mKey; }
+@@ -391,11 +382,12 @@ public:
+     typedef nsIHashable* KeyType;
+     typedef const nsIHashable* KeyTypePointer;
+ 
+-    nsHashableHashKey(const nsIHashable* aKey) :
+-        mKey(const_cast<nsIHashable*>(aKey)) { }
+-    nsHashableHashKey(const nsHashableHashKey& toCopy) :
+-        mKey(toCopy.mKey) { }
+-    ~nsHashableHashKey() { }
++    nsHashableHashKey(const nsIHashable* aKey, const void *entryStore) {
++        WB(NS_GetGC(), entryStore, &mKey, aKey);
++    }
++    ~nsHashableHashKey() {
++      mKey = NULL;
++    }
+ 
+     nsIHashable* GetKey() const { return mKey; }
+ 
+@@ -421,7 +413,7 @@ public:
+     enum { ALLOW_MEMMOVE = PR_TRUE };
+ 
+ private:
+-    nsCOMPtr<nsIHashable> mKey;
++    nsIHashable* mKey;
+ };
+ 
+ #endif // nsTHashKeys_h__
 diff --git a/xpcom/glue/nsInterfaceHashtable.h b/xpcom/glue/nsInterfaceHashtable.h
 --- a/xpcom/glue/nsInterfaceHashtable.h
 +++ b/xpcom/glue/nsInterfaceHashtable.h
 @@ -50,9 +50,9 @@
   * @param Interface the interface-type being wrapped
   * @see nsDataHashtable, nsClassHashtable
   */
 -template<class KeyClass,class Interface>
@@ -675,30 +1224,40 @@ diff --git a/xpcom/glue/nsTHashtable.h b
   * @author "Benjamin Smedberg <bsmedberg@covad.net>"
   */
  
 -template<class EntryType>
 +template<class EntryType, class Allocator=CAllocator>
  class nsTHashtable
  {
  public:
-@@ -248,6 +249,12 @@ protected:
+@@ -245,8 +246,22 @@ public:
+     PL_DHashTableEnumerate(&mTable, PL_DHashStubEnumRemove, nsnull);
+   }
+ 
++  /**
++   * Get a pointer to the entry store, for passing to WB()
++   */
++  const void* GetEntryStore() const
++  {
++    return mTable.entryStore;
++  }
++
  protected:
    PLDHashTable mTable;
- 
++
 +  static void* PR_CALLBACK s_AllocTable(PLDHashTable *table,
 +                                        PRUint32      nbytes);
 +
 +  static void PR_CALLBACK s_FreeTable(PLDHashTable *table,
 +                                      void         *ptr);
-+
+ 
    static const void* PR_CALLBACK s_GetKey(PLDHashTable    *table,
                                            PLDHashEntryHdr *entry);
- 
-@@ -288,33 +295,33 @@ protected:
+@@ -288,33 +303,33 @@ protected:
                                                  void            *arg);
  private:
    // copy constructor, not implemented
 -  nsTHashtable(nsTHashtable<EntryType>& toCopy);
 +  nsTHashtable(nsTHashtable<EntryType, Allocator>& toCopy);
  
    // assignment operator, not implemented
 -  nsTHashtable<EntryType>& operator= (nsTHashtable<EntryType>& toEqual);
@@ -730,28 +1289,28 @@ diff --git a/xpcom/glue/nsTHashtable.h b
 -template<class EntryType>
 +template<class EntryType, class Allocator>
  PRBool
 -nsTHashtable<EntryType>::Init(PRUint32 initSize)
 +nsTHashtable<EntryType, Allocator>::Init(PRUint32 initSize)
  {
    if (mTable.entrySize)
    {
-@@ -324,8 +331,8 @@ nsTHashtable<EntryType>::Init(PRUint32 i
+@@ -324,8 +339,8 @@ nsTHashtable<EntryType>::Init(PRUint32 i
  
    static PLDHashTableOps sOps = 
    {
 -    ::PL_DHashAllocTable,
 -    ::PL_DHashFreeTable,
 +    s_AllocTable,
 +    s_FreeTable,
      s_HashKey,
      s_MatchEntry,
      ::PL_DHashMoveEntryStub,
-@@ -351,29 +358,45 @@ nsTHashtable<EntryType>::Init(PRUint32 i
+@@ -351,29 +366,45 @@ nsTHashtable<EntryType>::Init(PRUint32 i
  
  // static definitions
  
 -template<class EntryType>
 +template<class EntryType, class Allocator>
 +void*
 +nsTHashtable<EntryType, Allocator>::s_AllocTable(PLDHashTable *,
 +                                                 PRUint32 nbytes)
@@ -798,17 +1357,17 @@ diff --git a/xpcom/glue/nsTHashtable.h b
 -                                     const PLDHashEntryHdr *from,
 -                                     PLDHashEntryHdr       *to)
 +nsTHashtable<EntryType, Allocator>::s_CopyEntry(PLDHashTable          *table,
 +                                                const PLDHashEntryHdr *from,
 +                                                PLDHashEntryHdr       *to)
  {
    EntryType* fromEntry =
      const_cast<EntryType*>(reinterpret_cast<const EntryType*>(from));
-@@ -383,30 +406,30 @@ nsTHashtable<EntryType>::s_CopyEntry(PLD
+@@ -383,30 +414,31 @@ nsTHashtable<EntryType>::s_CopyEntry(PLD
    fromEntry->~EntryType();
  }
  
 -template<class EntryType>
 +template<class EntryType, class Allocator>
  void
 -nsTHashtable<EntryType>::s_ClearEntry(PLDHashTable    *table,
 -                                      PLDHashEntryHdr *entry)
@@ -819,21 +1378,24 @@ diff --git a/xpcom/glue/nsTHashtable.h b
  }
  
 -template<class EntryType>
 +template<class EntryType, class Allocator>
  PRBool
 -nsTHashtable<EntryType>::s_InitEntry(PLDHashTable    *table,
 -                                     PLDHashEntryHdr *entry,
 -                                     const void      *key)
+-{
+-  new(entry) EntryType(reinterpret_cast<KeyTypePointer>(key));
 +nsTHashtable<EntryType, Allocator>::s_InitEntry(PLDHashTable    *table,
 +                                                PLDHashEntryHdr *entry,
 +                                                const void      *key)
- {
-   new(entry) EntryType(reinterpret_cast<KeyTypePointer>(key));
++{
++  new(entry) EntryType(reinterpret_cast<KeyTypePointer>(key),
++                       table->entryStore);
    return PR_TRUE;
  }
  
 -template<class EntryType>
 +template<class EntryType, class Allocator>
  PLDHashOperator
 -nsTHashtable<EntryType>::s_EnumStub(PLDHashTable    *table,
 -                                    PLDHashEntryHdr *entry,
@@ -844,17 +1406,27 @@ diff --git a/xpcom/glue/nsTHashtable.h b
 +                                               PRUint32         number,
 +                                               void            *arg)
  {
    // dereferences the function-pointer to the user's enumeration function
    return (* reinterpret_cast<s_EnumArgs*>(arg)->userFunc)(
 diff --git a/xpcom/tests/TestHashtables.cpp b/xpcom/tests/TestHashtables.cpp
 --- a/xpcom/tests/TestHashtables.cpp
 +++ b/xpcom/tests/TestHashtables.cpp
-@@ -510,71 +510,6 @@ main(void) {
+@@ -99,8 +99,7 @@ public:
+   typedef const char* KeyType;
+   typedef const char* KeyTypePointer;
+ 
+-  EntityToUnicodeEntry(const char* aKey) { mNode = nsnull; }
+-  EntityToUnicodeEntry(const EntityToUnicodeEntry& aEntry) { mNode = aEntry.mNode; }
++  EntityToUnicodeEntry(const char* aKey, const void *entryStore) { mNode = nsnull; }
+   ~EntityToUnicodeEntry() { };
+ 
+   PRBool KeyEquals(const char* aEntity) const { return !strcmp(mNode->mStr, aEntity); }
+@@ -510,71 +509,6 @@ main(void) {
    printf("OK\n");
  
    //
 -  // now check a thread-safe data-hashtable
 -  //
 -
 -  nsDataHashtableMT<nsUint32HashKey,const char*> UniToEntityL;
 -
@@ -916,17 +1488,17 @@ diff --git a/xpcom/tests/TestHashtables.
 -  }
 -
 -  printf("OK\n");
 -
 -  //
    // now check a class-hashtable
    //
  
-@@ -636,74 +571,6 @@ main(void) {
+@@ -636,74 +570,6 @@ main(void) {
  
    printf("Checking count...");
    count = EntToUniClass.Enumerate(nsCEnum, nsnull);
 -  if (count) {
 -    printf("  Clear did not remove all entries.\n");
 -    exit (21);
 -  }
 -
@@ -991,17 +1563,17 @@ diff --git a/xpcom/tests/TestHashtables.
 -  EntToUniClassL.Clear();
 -  printf("  Clearing OK\n");
 -
 -  printf("Checking count...");
 -  count = EntToUniClassL.Enumerate(nsCEnum, nsnull);
    if (count) {
      printf("  Clear did not remove all entries.\n");
      exit (21);
-@@ -861,78 +728,5 @@ main(void) {
+@@ -861,78 +727,5 @@ main(void) {
  
    printf("OK\n");
  
 -  //
 -  // now check a thread-safe interface hashtable
 -  //
 -
 -  nsInterfaceHashtableMT<nsUint32HashKey,IFoo> UniToEntClass2L;
new file mode 100644
--- /dev/null
+++ b/hashentry-fixups.patch
@@ -0,0 +1,664 @@
+diff --git a/caps/include/nsScriptSecurityManager.h b/caps/include/nsScriptSecurityManager.h
+--- a/caps/include/nsScriptSecurityManager.h
++++ b/caps/include/nsScriptSecurityManager.h
+@@ -96,15 +96,10 @@ public:
+     typedef const nsIPrincipal* KeyType;
+     typedef const nsIPrincipal* KeyTypePointer;
+ 
+-    PrincipalKey(const nsIPrincipal* key)
++    PrincipalKey(const nsIPrincipal* key, const void *entryStore)
+       : mKey(const_cast<nsIPrincipal*>(key))
+     {
+     }
+-
+-    PrincipalKey(const PrincipalKey& toCopy)
+-      : mKey(toCopy.mKey)
+-    {
+-    } 
+ 
+     ~PrincipalKey()
+     {
+@@ -134,8 +129,6 @@ public:
+         const_cast<nsIPrincipal*>(aKey)->GetHashValue(&hash);
+         return PLDHashNumber(hash);
+     }
+-
+-    enum { ALLOW_MEMMOVE = PR_TRUE };
+ 
+ private:
+     nsCOMPtr<nsIPrincipal> mKey;
+diff --git a/chrome/src/nsChromeRegistry.h b/chrome/src/nsChromeRegistry.h
+--- a/chrome/src/nsChromeRegistry.h
++++ b/chrome/src/nsChromeRegistry.h
+@@ -213,9 +213,8 @@ public:
+     typedef nsURIHashKey::KeyType        KeyType;
+     typedef nsURIHashKey::KeyTypePointer KeyTypePointer;
+ 
+-    OverlayListEntry(KeyTypePointer aKey) : nsURIHashKey(aKey) { }
+-    OverlayListEntry(OverlayListEntry& toCopy) : nsURIHashKey(toCopy),
+-                                                 mArray(toCopy.mArray) { }
++    OverlayListEntry(KeyTypePointer aKey, const void *entryStore)
++      : nsURIHashKey(aKey, entryStore) { }
+     ~OverlayListEntry() { }
+ 
+     void AddURI(nsIURI* aURI);
+diff --git a/content/base/src/nsDOMAttributeMap.h b/content/base/src/nsDOMAttributeMap.h
+--- a/content/base/src/nsDOMAttributeMap.h
++++ b/content/base/src/nsDOMAttributeMap.h
+@@ -87,8 +87,7 @@ public:
+   typedef const nsAttrKey& KeyType;
+   typedef const nsAttrKey* KeyTypePointer;
+ 
+-  nsAttrHashKey(KeyTypePointer aKey) : mKey(*aKey) {}
+-  nsAttrHashKey(const nsAttrHashKey& aCopy) : mKey(aCopy.mKey) {}
++  nsAttrHashKey(KeyTypePointer aKey, const void *entryStore) : mKey(*aKey) {}
+   ~nsAttrHashKey() {}
+ 
+   KeyType GetKey() const { return mKey; }
+@@ -108,7 +107,6 @@ public:
+              (aKey->mNamespaceID << 4) ^
+              NS_PTR_TO_INT32(aKey->mLocalName);
+     }
+-  enum { ALLOW_MEMMOVE = PR_TRUE };
+ 
+ private:
+   nsAttrKey mKey;
+diff --git a/content/base/src/nsDocument.h b/content/base/src/nsDocument.h
+--- a/content/base/src/nsDocument.h
++++ b/content/base/src/nsDocument.h
+@@ -144,17 +144,9 @@ class nsUint32ToContentHashEntry : publi
+     typedef const PRUint32& KeyType;
+     typedef const PRUint32* KeyTypePointer;
+ 
+-    nsUint32ToContentHashEntry(const KeyTypePointer key) :
++    nsUint32ToContentHashEntry(const KeyTypePointer key,
++                               const void *entryStore) :
+       mValue(*key), mValOrHash(nsnull) { }
+-    nsUint32ToContentHashEntry(const nsUint32ToContentHashEntry& toCopy) :
+-      mValue(toCopy.mValue), mValOrHash(toCopy.mValOrHash)
+-    {
+-      // Pathetic attempt to not die: clear out the other mValOrHash so we're
+-      // effectively stealing it. If toCopy is destroyed right after this,
+-      // we'll be OK.
+-      const_cast<nsUint32ToContentHashEntry&>(toCopy).mValOrHash = nsnull;
+-      NS_ERROR("Copying not supported. Fasten your seat belt.");
+-    }
+     ~nsUint32ToContentHashEntry() { Destroy(); }
+ 
+     KeyType GetKey() const { return mValue; }
+@@ -163,7 +155,6 @@ class nsUint32ToContentHashEntry : publi
+ 
+     static KeyTypePointer KeyToPointer(KeyType aKey) { return &aKey; }
+     static PLDHashNumber HashKey(KeyTypePointer aKey) { return *aKey; }
+-    enum { ALLOW_MEMMOVE = PR_TRUE };
+ 
+     // Content set methods
+     nsresult PutContent(nsIContent* aContent);
+diff --git a/content/base/src/nsNameSpaceManager.cpp b/content/base/src/nsNameSpaceManager.cpp
+--- a/content/base/src/nsNameSpaceManager.cpp
++++ b/content/base/src/nsNameSpaceManager.cpp
+@@ -81,10 +81,7 @@ public:
+   typedef const nsAString* KeyType;
+   typedef const nsAString* KeyTypePointer;
+ 
+-  nsNameSpaceKey(KeyTypePointer aKey) : mKey(aKey)
+-  {
+-  }
+-  nsNameSpaceKey(const nsNameSpaceKey& toCopy) : mKey(toCopy.mKey)
++  nsNameSpaceKey(KeyTypePointer aKey, const void *entryStore) : mKey(aKey)
+   {
+   }
+ 
+@@ -104,10 +101,6 @@ public:
+   static PLDHashNumber HashKey(KeyTypePointer aKey) {
+     return HashString(*aKey);
+   }
+-
+-  enum { 
+-    ALLOW_MEMMOVE = PR_TRUE
+-  };
+ 
+ private:
+   const nsAString* mKey;
+diff --git a/content/html/content/src/nsHTMLFormElement.cpp b/content/html/content/src/nsHTMLFormElement.cpp
+--- a/content/html/content/src/nsHTMLFormElement.cpp
++++ b/content/html/content/src/nsHTMLFormElement.cpp
+@@ -101,8 +101,8 @@ public:
+ public:
+   typedef const nsAString& KeyType;
+   typedef const nsAString* KeyTypePointer;
+-  nsStringCaseInsensitiveHashKey(KeyTypePointer aStr) : mStr(*aStr) { } //take it easy just deal HashKey 
+-  nsStringCaseInsensitiveHashKey(const nsStringCaseInsensitiveHashKey& toCopy) : mStr(toCopy.mStr) { }
++  nsStringCaseInsensitiveHashKey(KeyTypePointer aStr, const void *entryStore)
++    : mStr(*aStr) { } //take it easy just deal HashKey 
+   ~nsStringCaseInsensitiveHashKey() { }
+ 
+   KeyType GetKey() const { return mStr; }
+@@ -118,7 +118,6 @@ public:
+       ToLowerCase(tmKey);
+       return HashString(tmKey);
+   }
+-  enum { ALLOW_MEMMOVE = PR_TRUE };
+ 
+ private:
+   const nsString mStr;
+diff --git a/content/xslt/src/xslt/txExecutionState.h b/content/xslt/src/xslt/txExecutionState.h
+--- a/content/xslt/src/xslt/txExecutionState.h
++++ b/content/xslt/src/xslt/txExecutionState.h
+@@ -60,7 +60,8 @@ class txLoadedDocumentEntry : public nsS
+ class txLoadedDocumentEntry : public nsStringHashKey
+ {
+ public:
+-    txLoadedDocumentEntry(KeyTypePointer aStr) : nsStringHashKey(aStr)
++    txLoadedDocumentEntry(KeyTypePointer aStr, const void *entryStore)
++        : nsStringHashKey(aStr, entryStore)
+     {
+     }
+     txLoadedDocumentEntry(const txLoadedDocumentEntry& aToCopy)
+diff --git a/db/morkreader/nsMorkReader.h b/db/morkreader/nsMorkReader.h
+--- a/db/morkreader/nsMorkReader.h
++++ b/db/morkreader/nsMorkReader.h
+@@ -79,8 +79,7 @@ class nsMorkReader
+     typedef const nsCSubstring& KeyType;
+     typedef const nsCSubstring* KeyTypePointer;
+ 
+-    IDKey(KeyTypePointer aStr) : mStr(*aStr) { }
+-    IDKey(const IDKey& toCopy) : mStr(toCopy.mStr) { }
++    IDKey(KeyTypePointer aStr, const void *entryStore) : mStr(*aStr) { }
+     ~IDKey() { }
+ 
+     KeyType GetKey() const { return mStr; }
+@@ -94,7 +93,6 @@ class nsMorkReader
+     {
+       return HashString(*aKey);
+     }
+-    enum { ALLOW_MEMMOVE = PR_FALSE };
+ 
+   private:
+     const IDString mStr;
+diff --git a/dom/src/storage/nsDOMStorage.cpp b/dom/src/storage/nsDOMStorage.cpp
+--- a/dom/src/storage/nsDOMStorage.cpp
++++ b/dom/src/storage/nsDOMStorage.cpp
+@@ -111,18 +111,9 @@ GetQuota(const nsAString &domain)
+   return ((PRInt32)nsContentUtils::GetIntPref(kDefaultQuota, DEFAULT_QUOTA) * 1024);
+ }
+ 
+-nsSessionStorageEntry::nsSessionStorageEntry(KeyTypePointer aStr)
+-  : nsStringHashKey(aStr), mItem(nsnull)
+-{
+-}
+-
+-nsSessionStorageEntry::nsSessionStorageEntry(const nsSessionStorageEntry& aToCopy)
+-  : nsStringHashKey(aToCopy), mItem(nsnull)
+-{
+-  NS_ERROR("We're horked.");
+-}
+-
+-nsSessionStorageEntry::~nsSessionStorageEntry()
++nsSessionStorageEntry::nsSessionStorageEntry(KeyTypePointer aStr,
++                                             const void *entryStore)
++  : nsStringHashKey(aStr, entryStore), mItem(nsnull)
+ {
+ }
+ 
+@@ -239,18 +230,9 @@ nsDOMStorageDB* nsDOMStorage::gStorageDB
+ nsDOMStorageDB* nsDOMStorage::gStorageDB = nsnull;
+ #endif
+ 
+-nsDOMStorageEntry::nsDOMStorageEntry(KeyTypePointer aStr)
+-  : nsVoidPtrHashKey(aStr), mStorage(nsnull)
+-{
+-}
+-
+-nsDOMStorageEntry::nsDOMStorageEntry(const nsDOMStorageEntry& aToCopy)
+-  : nsVoidPtrHashKey(aToCopy), mStorage(nsnull)
+-{
+-  NS_ERROR("DOMStorage horked.");
+-}
+-
+-nsDOMStorageEntry::~nsDOMStorageEntry()
++nsDOMStorageEntry::nsDOMStorageEntry(KeyTypePointer aStr,
++                                     const void *entryStore)
++  : nsVoidPtrHashKey(aStr, entryStore), mStorage(nsnull)
+ {
+ }
+ 
+diff --git a/dom/src/storage/nsDOMStorage.h b/dom/src/storage/nsDOMStorage.h
+--- a/dom/src/storage/nsDOMStorage.h
++++ b/dom/src/storage/nsDOMStorage.h
+@@ -64,9 +64,8 @@ class nsDOMStorageEntry : public nsVoidP
+ class nsDOMStorageEntry : public nsVoidPtrHashKey
+ {
+ public:
+-  nsDOMStorageEntry(KeyTypePointer aStr);
+-  nsDOMStorageEntry(const nsDOMStorageEntry& aToCopy);
+-  ~nsDOMStorageEntry();
++  nsDOMStorageEntry(KeyTypePointer aStr, const void *entryStore);
++  ~nsDOMStorageEntry() { }
+ 
+   // weak reference so that it can be deleted when no longer used
+   nsDOMStorage* mStorage;
+@@ -75,9 +74,8 @@ class nsSessionStorageEntry : public nsS
+ class nsSessionStorageEntry : public nsStringHashKey
+ {
+ public:
+-  nsSessionStorageEntry(KeyTypePointer aStr);
+-  nsSessionStorageEntry(const nsSessionStorageEntry& aToCopy);
+-  ~nsSessionStorageEntry();
++  nsSessionStorageEntry(KeyTypePointer aStr, const void *entryStore);
++  ~nsSessionStorageEntry() { }
+ 
+   nsRefPtr<nsDOMStorageItem> mItem;
+ };
+diff --git a/extensions/cookie/nsPermissionManager.cpp b/extensions/cookie/nsPermissionManager.cpp
+--- a/extensions/cookie/nsPermissionManager.cpp
++++ b/extensions/cookie/nsPermissionManager.cpp
+@@ -69,7 +69,7 @@ ArenaStrDup(const char* str, PLArenaPool
+   return static_cast<char*>(mem);
+ }
+ 
+-nsHostEntry::nsHostEntry(const char* aHost)
++nsHostEntry::nsHostEntry(const char* aHost, const void*)
+ {
+   mHost = ArenaStrDup(aHost, gHostArena);
+   mPermissions[0] = mPermissions[1] = 0;
+diff --git a/extensions/cookie/nsPermissionManager.h b/extensions/cookie/nsPermissionManager.h
+--- a/extensions/cookie/nsPermissionManager.h
++++ b/extensions/cookie/nsPermissionManager.h
+@@ -71,7 +71,7 @@ public:
+   typedef const char* KeyType;
+   typedef const char* KeyTypePointer;
+ 
+-  nsHostEntry(const char* aHost);
++  nsHostEntry(const char* aHost, const void *entryStore);
+   nsHostEntry(const nsHostEntry& toCopy);
+ 
+   ~nsHostEntry()
+diff --git a/extensions/spellcheck/src/mozPersonalDictionary.h b/extensions/spellcheck/src/mozPersonalDictionary.h
+--- a/extensions/spellcheck/src/mozPersonalDictionary.h
++++ b/extensions/spellcheck/src/mozPersonalDictionary.h
+@@ -61,11 +61,8 @@ public:
+   typedef const PRUnichar* KeyType;
+   typedef const PRUnichar* KeyTypePointer;
+ 
+-  nsUniCharEntry(const PRUnichar* aKey) : mKey(nsCRT::strdup(aKey)) {}
+-  nsUniCharEntry(const nsUniCharEntry& toCopy)
+-  { 
+-    NS_NOTREACHED("ALLOW_MEMMOVE is set, so copy ctor shouldn't be called");
+-  }
++  nsUniCharEntry(const PRUnichar* aKey, const void *entryStore)
++    : mKey(nsCRT::strdup(aKey)) {}
+ 
+   ~nsUniCharEntry()
+   { 
+@@ -78,8 +75,6 @@ public:
+   static KeyTypePointer KeyToPointer(KeyType aKey) { return aKey; }
+ 
+   static PLDHashNumber HashKey(KeyTypePointer aKey) { return nsCRT::HashCode(aKey); }
+-
+-  enum { ALLOW_MEMMOVE = PR_TRUE };
+ 
+ private:
+   PRUnichar *mKey;
+diff --git a/gfx/thebes/public/gfxFont.h b/gfx/thebes/public/gfxFont.h
+--- a/gfx/thebes/public/gfxFont.h
++++ b/gfx/thebes/public/gfxFont.h
+@@ -212,8 +212,8 @@ protected:
+ 
+         // When constructing a new entry in the hashtable, we'll leave this
+         // blank. The caller of Put() will fill this in.
+-        HashEntry(KeyTypePointer aStr) : mFont(nsnull) { }
+-        HashEntry(const HashEntry& toCopy) : mFont(toCopy.mFont) { }
++        HashEntry(KeyTypePointer aStr, const void *entryStore)
++            : mFont(nsnull) { }
+         ~HashEntry() { }
+ 
+         PRBool KeyEquals(const KeyTypePointer aKey) const;
+@@ -285,10 +285,8 @@ private:
+     public:
+         // When constructing a new entry in the hashtable, we'll leave this
+         // blank. The caller of Put() will fill this in.
+-        HashEntry(KeyTypePointer aPtr) : nsUint32HashKey(aPtr) {}
+-        HashEntry(const HashEntry& toCopy) : nsUint32HashKey(toCopy) {
+-          x = toCopy.x; y = toCopy.y; width = toCopy.width; height = toCopy.height;
+-        }
++        HashEntry(KeyTypePointer aPtr, const void *entryStore)
++            : nsUint32HashKey(aPtr, entryStore) {}
+ 
+         float x, y, width, height;
+     };
+diff --git a/gfx/thebes/src/gfxTextRunWordCache.cpp b/gfx/thebes/src/gfxTextRunWordCache.cpp
+--- a/gfx/thebes/src/gfxTextRunWordCache.cpp
++++ b/gfx/thebes/src/gfxTextRunWordCache.cpp
+@@ -116,15 +116,15 @@ protected:
+ 
+         // When constructing a new entry in the hashtable, the caller of Put()
+         // will fill us in.
+-        CacheHashEntry(KeyTypePointer aKey) : mTextRun(nsnull), mWordOffset(0),
+-            mHashedByFont(PR_FALSE) { }
+-        CacheHashEntry(const CacheHashEntry& toCopy) { NS_ERROR("Should not be called"); }
++        CacheHashEntry(KeyTypePointer aKey, const void *entryStore)
++            : mTextRun(nsnull)
++            , mWordOffset(0)
++            , mHashedByFont(PR_FALSE) { }
+         ~CacheHashEntry() { }
+ 
+         PRBool KeyEquals(const KeyTypePointer aKey) const;
+         static KeyTypePointer KeyToPointer(KeyType aKey) { return &aKey; }
+         static PLDHashNumber HashKey(const KeyTypePointer aKey);
+-        enum { ALLOW_MEMMOVE = PR_TRUE };
+ 
+         gfxTextRun *mTextRun;
+         // The offset of the start of the word in the textrun. The length of
+diff --git a/layout/base/nsBidiPresUtils.h b/layout/base/nsBidiPresUtils.h
+--- a/layout/base/nsBidiPresUtils.h
++++ b/layout/base/nsBidiPresUtils.h
+@@ -58,7 +58,8 @@
+  */
+ struct nsFrameContinuationState : public nsVoidPtrHashKey
+ {
+-  nsFrameContinuationState(const void *aFrame) : nsVoidPtrHashKey(aFrame) {}
++  nsFrameContinuationState(const void *aFrame, const void *entryStore) :
++    nsVoidPtrHashKey(aFrame, entryStore) {}
+ 
+   /**
+    * The first visual frame in the continuation chain containing this frame, or
+diff --git a/layout/style/nsCSSLoader.h b/layout/style/nsCSSLoader.h
+--- a/layout/style/nsCSSLoader.h
++++ b/layout/style/nsCSSLoader.h
+@@ -226,18 +226,14 @@ public:
+   typedef nsURIAndPrincipalHashKey* KeyType;
+   typedef const nsURIAndPrincipalHashKey* KeyTypePointer;
+ 
+-  nsURIAndPrincipalHashKey(const nsURIAndPrincipalHashKey* aKey)
+-    : nsURIHashKey(aKey->mKey), mPrincipal(aKey->mPrincipal)
++  nsURIAndPrincipalHashKey(const nsURIAndPrincipalHashKey* aKey,
++                           const void *entryStore)
++    : nsURIHashKey(aKey->mKey, entryStore), mPrincipal(aKey->mPrincipal)
+   {
+     MOZ_COUNT_CTOR(nsURIAndPrincipalHashKey);
+   }
+   nsURIAndPrincipalHashKey(nsIURI* aURI, nsIPrincipal* aPrincipal)
+-    : nsURIHashKey(aURI), mPrincipal(aPrincipal)
+-  {
+-    MOZ_COUNT_CTOR(nsURIAndPrincipalHashKey);
+-  }
+-  nsURIAndPrincipalHashKey(const nsURIAndPrincipalHashKey& toCopy)
+-    : nsURIHashKey(toCopy), mPrincipal(toCopy.mPrincipal)
++    : nsURIHashKey(aURI, NULL), mPrincipal(aPrincipal)
+   {
+     MOZ_COUNT_CTOR(nsURIAndPrincipalHashKey);
+   }
+@@ -272,8 +268,6 @@ public:
+     return nsURIHashKey::HashKey(aKey->mKey);
+   }
+      
+-  enum { ALLOW_MEMMOVE = PR_TRUE };
+- 
+ protected:
+   nsCOMPtr<nsIPrincipal> mPrincipal;
+ };
+diff --git a/netwerk/base/public/nsURIHashKey.h b/netwerk/base/public/nsURIHashKey.h
+--- a/netwerk/base/public/nsURIHashKey.h
++++ b/netwerk/base/public/nsURIHashKey.h
+@@ -52,10 +52,8 @@ public:
+     typedef nsIURI* KeyType;
+     typedef const nsIURI* KeyTypePointer;
+ 
+-    nsURIHashKey(const nsIURI* aKey) :
++    nsURIHashKey(const nsIURI* aKey, const void *entryStore) :
+         mKey(const_cast<nsIURI*>(aKey)) { MOZ_COUNT_CTOR(nsURIHashKey); }
+-    nsURIHashKey(const nsURIHashKey& toCopy) :
+-        mKey(toCopy.mKey) { MOZ_COUNT_CTOR(nsURIHashKey); }
+     ~nsURIHashKey() { MOZ_COUNT_DTOR(nsURIHashKey); }
+ 
+     nsIURI* GetKey() const { return mKey; }
+diff --git a/netwerk/cookie/src/nsCookieService.h b/netwerk/cookie/src/nsCookieService.h
+--- a/netwerk/cookie/src/nsCookieService.h
++++ b/netwerk/cookie/src/nsCookieService.h
+@@ -72,16 +72,9 @@ class nsCookieEntry : public PLDHashEntr
+     typedef const char* KeyTypePointer;
+ 
+     // do nothing with aHost - we require mHead to be set before we're live!
+-    nsCookieEntry(KeyTypePointer aHost)
++    nsCookieEntry(KeyTypePointer aHost, const void *entryStore)
+      : mHead(nsnull)
+     {
+-    }
+-
+-    nsCookieEntry(const nsCookieEntry& toCopy)
+-    {
+-      // if we end up here, things will break. nsTHashtable shouldn't
+-      // allow this, since we set ALLOW_MEMMOVE to true.
+-      NS_NOTREACHED("nsCookieEntry copy constructor is forbidden!");
+     }
+ 
+     ~nsCookieEntry()
+@@ -119,8 +112,6 @@ class nsCookieEntry : public PLDHashEntr
+       // pass nsnull
+       return PL_DHashStringKey(nsnull, aKey);
+     }
+-
+-    enum { ALLOW_MEMMOVE = PR_TRUE };
+ 
+     // get methods
+     inline const nsDependentCString Host() const { return mHead->Host(); }
+diff --git a/netwerk/dns/src/nsEffectiveTLDService.cpp b/netwerk/dns/src/nsEffectiveTLDService.cpp
+--- a/netwerk/dns/src/nsEffectiveTLDService.cpp
++++ b/netwerk/dns/src/nsEffectiveTLDService.cpp
+@@ -80,7 +80,7 @@ ArenaStrDup(const char* str, PLArenaPool
+   return static_cast<char*>(mem);
+ }
+ 
+-nsDomainEntry::nsDomainEntry(const char *aDomain)
++nsDomainEntry::nsDomainEntry(const char *aDomain, const void *entryStore)
+  : mDomain(ArenaStrDup(aDomain, gArena))
+  , mIsNormal(PR_FALSE)
+  , mIsException(PR_FALSE)
+diff --git a/netwerk/dns/src/nsEffectiveTLDService.h b/netwerk/dns/src/nsEffectiveTLDService.h
+--- a/netwerk/dns/src/nsEffectiveTLDService.h
++++ b/netwerk/dns/src/nsEffectiveTLDService.h
+@@ -53,14 +53,7 @@ public:
+   typedef const char* KeyType;
+   typedef const char* KeyTypePointer;
+ 
+-  nsDomainEntry(const char* aDomain);
+-
+-  nsDomainEntry(const nsDomainEntry& toCopy)
+-  {
+-    // if we end up here, things will break. nsTHashtable shouldn't
+-    // allow this, since we set ALLOW_MEMMOVE to true.
+-    NS_NOTREACHED("nsDomainEntry copy constructor is forbidden!");
+-  }
++  nsDomainEntry(const char* aDomain, const void *entryStore);
+ 
+   ~nsDomainEntry()
+   {
+@@ -87,8 +80,6 @@ public:
+     // pass nsnull
+     return PL_DHashStringKey(nsnull, aKey);
+   }
+-
+-  enum { ALLOW_MEMMOVE = PR_TRUE };
+ 
+   PRPackedBool& IsNormal()    { return mIsNormal; }
+   PRPackedBool& IsException() { return mIsException; }
+diff --git a/security/manager/ssl/src/nsCertOverrideService.h b/security/manager/ssl/src/nsCertOverrideService.h
+--- a/security/manager/ssl/src/nsCertOverrideService.h
++++ b/security/manager/ssl/src/nsCertOverrideService.h
+@@ -95,13 +95,9 @@ class nsCertOverrideEntry : public PLDHa
+     typedef const char* KeyTypePointer;
+ 
+     // do nothing with aHost - we require mHead to be set before we're live!
+-    nsCertOverrideEntry(KeyTypePointer aHostWithPortUTF8)
++    nsCertOverrideEntry(KeyTypePointer aHostWithPortUTF8,
++                        const void *entryStore)
+     {
+-    }
+-
+-    nsCertOverrideEntry(const nsCertOverrideEntry& toCopy)
+-    {
+-      mSettings = toCopy.mSettings;
+     }
+ 
+     ~nsCertOverrideEntry()
+@@ -134,8 +130,6 @@ class nsCertOverrideEntry : public PLDHa
+       // pass nsnull
+       return PL_DHashStringKey(nsnull, aKey);
+     }
+-
+-    enum { ALLOW_MEMMOVE = PR_FALSE };
+ 
+     // get methods
+     inline const nsCString &HostWithPort() const { return mSettings.mHostWithPortUTF8; }
+diff --git a/toolkit/components/places/src/nsNavHistoryResult.h b/toolkit/components/places/src/nsNavHistoryResult.h
+--- a/toolkit/components/places/src/nsNavHistoryResult.h
++++ b/toolkit/components/places/src/nsNavHistoryResult.h
+@@ -74,8 +74,8 @@ public:
+   typedef const PRInt64& KeyType;
+   typedef const PRInt64* KeyTypePointer;
+ 
+-  nsTrimInt64HashKey(KeyTypePointer aKey) : mValue(*aKey) { }
+-  nsTrimInt64HashKey(const nsTrimInt64HashKey& toCopy) : mValue(toCopy.mValue) { }
++  nsTrimInt64HashKey(KeyTypePointer aKey, const void *entryStore)
++    : mValue(*aKey) { }
+   ~nsTrimInt64HashKey() { }
+ 
+   KeyType GetKey() const { return mValue; }
+@@ -84,7 +84,6 @@ public:
+   static KeyTypePointer KeyToPointer(KeyType aKey) { return &aKey; }
+   static PLDHashNumber HashKey(KeyTypePointer aKey)
+     { return static_cast<PRUint32>((*aKey) & PR_UINT32_MAX); }
+-  enum { ALLOW_MEMMOVE = PR_TRUE };
+ 
+ private:
+   const PRInt64 mValue;
+diff --git a/xpcom/glue/nsHashKeys.h b/xpcom/glue/nsHashKeys.h
+--- a/xpcom/glue/nsHashKeys.h
++++ b/xpcom/glue/nsHashKeys.h
+@@ -99,7 +99,6 @@ public:
+   {
+     return HashString(*aKey);
+   }
+-  enum { ALLOW_MEMMOVE = PR_TRUE };
+ 
+ private:
+   const nsString mStr;
+@@ -129,7 +128,6 @@ public:
+   {
+     return HashString(*aKey);
+   }
+-  enum { ALLOW_MEMMOVE = PR_TRUE };
+ 
+ private:
+   const nsCString mStr;
+@@ -155,7 +153,6 @@ public:
+ 
+   static KeyTypePointer KeyToPointer(KeyType aKey) { return &aKey; }
+   static PLDHashNumber HashKey(KeyTypePointer aKey) { return *aKey; }
+-  enum { ALLOW_MEMMOVE = PR_TRUE };
+ 
+ private:
+   const PRUint32 mValue;
+@@ -185,7 +182,6 @@ public:
+   {
+     return NS_PTR_TO_INT32(aKey) >>2;
+   }
+-  enum { ALLOW_MEMMOVE = PR_TRUE };
+ 
+ private:
+   nsCOMPtr<nsISupports> mSupports;
+@@ -215,7 +211,6 @@ public:
+   {
+     return NS_PTR_TO_INT32(aKey) >>2;
+   }
+-  enum { ALLOW_MEMMOVE = PR_TRUE };
+ 
+ private:
+   const void* mKey;
+@@ -248,7 +243,6 @@ public:
+   {
+     return NS_PTR_TO_INT32(aKey) >>2;
+   }
+-  enum { ALLOW_MEMMOVE = PR_TRUE };
+ 
+ private:
+   const void* mKey;
+@@ -274,7 +268,6 @@ public:
+ 
+   static KeyTypePointer KeyToPointer(KeyType aKey) { return &aKey; }
+   static PLDHashNumber HashKey(KeyTypePointer aKey);
+-  enum { ALLOW_MEMMOVE = PR_TRUE };
+ 
+ private:
+   const nsID mID;
+@@ -307,7 +300,6 @@ public:
+ 
+   static const char* KeyToPointer(const char* aKey) { return aKey; }
+   static PLDHashNumber HashKey(const char* aKey) { return HashString(aKey); }
+-  enum { ALLOW_MEMMOVE = PR_TRUE };
+ 
+ private:
+   const char* mKey;
+@@ -337,8 +329,6 @@ public:
+   static KeyTypePointer KeyToPointer(KeyType aKey) { return aKey; }
+   static PLDHashNumber HashKey(KeyTypePointer aKey) { return HashString(aKey); }
+ 
+-  enum { ALLOW_MEMMOVE = PR_TRUE };
+-
+ private:
+   const char* mKey;
+ };
+@@ -366,8 +356,6 @@ public:
+ 
+   static KeyTypePointer KeyToPointer(KeyType aKey) { return aKey; }
+   static PLDHashNumber HashKey(KeyTypePointer aKey) { return HashString(aKey); }
+-
+-  enum { ALLOW_MEMMOVE = PR_TRUE };
+ 
+ private:
+   const PRUnichar* mKey;
+@@ -410,8 +398,6 @@ public:
+         return code;
+     }
+     
+-    enum { ALLOW_MEMMOVE = PR_TRUE };
+-
+ private:
+     nsIHashable* mKey;
+ };
+diff --git a/xpcom/glue/nsTHashtable.h b/xpcom/glue/nsTHashtable.h
+--- a/xpcom/glue/nsTHashtable.h
++++ b/xpcom/glue/nsTHashtable.h
+@@ -91,10 +91,6 @@ PL_DHashStubEnumRemove(PLDHashTable    *
+  *
+  *     // HashKey(): calculate the hash number
+  *     static PLDHashNumber HashKey(KeyTypePointer aKey);
+- *
+- *     // ALLOW_MEMMOVE can we move this class with memmove(), or do we have
+- *     // to use the copy constructor?
+- *     enum { ALLOW_MEMMOVE = PR_(TRUE or FALSE) };
+  *   }</pre>
+  *
+  * @see nsInterfaceHashtable
+@@ -337,7 +333,7 @@ nsTHashtable<EntryType, Allocator>::Init
+     return PR_TRUE;
+   }
+ 
+-  static PLDHashTableOps sOps = 
++  static const PLDHashTableOps sOps = 
+   {
+     s_AllocTable,
+     s_FreeTable,
+@@ -349,11 +345,6 @@ nsTHashtable<EntryType, Allocator>::Init
+     s_InitEntry
+   };
+ 
+-  if (!EntryType::ALLOW_MEMMOVE)
+-  {
+-    sOps.moveEntry = s_CopyEntry;
+-  }
+-  
+   if (!PL_DHashTableInit(&mTable, &sOps, nsnull, sizeof(EntryType), initSize))
+   {
+     // if failed, reset "flag"
new file mode 100644
--- /dev/null
+++ b/jscomponentloader-gc
@@ -0,0 +1,123 @@
+diff --git a/js/src/xpconnect/loader/mozJSComponentLoader.cpp b/js/src/xpconnect/loader/mozJSComponentLoader.cpp
+--- a/js/src/xpconnect/loader/mozJSComponentLoader.cpp
++++ b/js/src/xpconnect/loader/mozJSComponentLoader.cpp
+@@ -595,7 +595,7 @@ mozJSComponentLoader::LoadModule(nsILoca
+     if (!entry)
+         return NS_ERROR_OUT_OF_MEMORY;
+ 
+-    rv = GlobalForLocation(aComponentFile, &entry->global, &entry->location);
++    rv = GlobalForLocation(aComponentFile, &entry->global);
+     if (NS_FAILED(rv)) {
+ #ifdef DEBUG_shaver
+         fprintf(stderr, "GlobalForLocation failed!\n");
+@@ -763,21 +763,23 @@ class FastLoadStateHolder
+     void pop();
+ 
+  private:
+-    nsCOMPtr<nsIFastLoadService> mService;
+-    nsCOMPtr<nsIFastLoadFileIO> mIO;
+-    nsCOMPtr<nsIObjectInputStream> mInputStream;
+-    nsCOMPtr<nsIObjectOutputStream> mOutputStream;
++    nsIFastLoadService* mService;
++    nsIFastLoadFileIO* mIO;
++    nsIObjectInputStream* mInputStream;
++    nsIObjectOutputStream* mOutputStream;
+ };
+ 
+ FastLoadStateHolder::FastLoadStateHolder(nsIFastLoadService *service)
+ {
++    ASSERT_StackObject(this);
++
+     if (!service)
+         return;
+ 
+     mService = service;
+-    service->GetFileIO(getter_AddRefs(mIO));
+-    service->GetInputStream(getter_AddRefs(mInputStream));
+-    service->GetOutputStream(getter_AddRefs(mOutputStream));
++    service->GetFileIO(&mIO);
++    service->GetInputStream(&mInputStream);
++    service->GetOutputStream(&mOutputStream);
+ }
+ 
+ void
+@@ -1017,8 +1019,7 @@ mozJSComponentLoader::WriteScript(nsIFas
+ 
+ nsresult
+ mozJSComponentLoader::GlobalForLocation(nsILocalFile *aComponent,
+-                                        JSObject **aGlobal,
+-                                        char **aLocation)
++                                        JSObject **aGlobal)
+ {
+     nsresult rv;
+ 
+@@ -1269,13 +1270,7 @@ mozJSComponentLoader::GlobalForLocation(
+     /* Freed when we remove from the table. */
+     nsCAutoString path;
+     aComponent->GetNativePath(path);
+-    *aLocation = ToNewCString(path);
+-    if (!*aLocation) {
+-        *aGlobal = nsnull;
+-        return NS_ERROR_OUT_OF_MEMORY;
+-    }
+-
+-    JS_AddNamedRoot(cx, aGlobal, *aLocation);
++
+     return NS_OK;
+ }
+ 
+@@ -1439,8 +1434,7 @@ mozJSComponentLoader::ImportInto(const n
+         if (!newEntry || !mInProgressImports.Put(lfhash, newEntry))
+             return NS_ERROR_OUT_OF_MEMORY;
+ 
+-        rv = GlobalForLocation(componentFile, &newEntry->global,
+-                               &newEntry->location);
++        rv = GlobalForLocation(componentFile, &newEntry->global);
+ 
+         mInProgressImports.Remove(lfhash);
+ 
+diff --git a/js/src/xpconnect/loader/mozJSComponentLoader.h b/js/src/xpconnect/loader/mozJSComponentLoader.h
+--- a/js/src/xpconnect/loader/mozJSComponentLoader.h
++++ b/js/src/xpconnect/loader/mozJSComponentLoader.h
+@@ -109,8 +109,7 @@ class mozJSComponentLoader : public XPCO
+     void UnloadModules();
+ 
+     nsresult GlobalForLocation(nsILocalFile *aComponent,
+-                               JSObject **aGlobal,
+-                               char **location);
++                               JSObject **aGlobal);
+ 
+     nsresult StartFastLoad(nsIFastLoadService *flSvc);
+     nsresult ReadScript(nsIFastLoadService *flSvc, const char *nativePath,
+@@ -136,30 +135,15 @@ class mozJSComponentLoader : public XPCO
+     JSRuntime *mRuntime;
+     JSContext *mContext;
+ 
+-    class ModuleEntry
++    class ModuleEntry : public XPCOMGCObject
+     {
+     public:
+         ModuleEntry() {
+             global = nsnull;
+-            location = nsnull;
+-        }
+-
+-        ~ModuleEntry() {
+-            module = nsnull;
+-
+-            if (global) {
+-                JSAutoRequest ar(sSelf->mContext);
+-                JS_ClearScope(sSelf->mContext, global);
+-                JS_RemoveRoot(sSelf->mContext, &global);
+-            }
+-
+-            if (location)
+-                NS_Free(location);
+         }
+ 
+         nsCOMPtr<nsIModule>  module;
+         JSObject            *global;
+-        char                *location;
+     };
+ 
+     friend class ModuleEntry;
new file mode 100644
--- /dev/null
+++ b/layout-suck
@@ -0,0 +1,21 @@
+diff --git a/layout/mathml/base/src/nsMathMLChar.cpp b/layout/mathml/base/src/nsMathMLChar.cpp
+--- a/layout/mathml/base/src/nsMathMLChar.cpp
++++ b/layout/mathml/base/src/nsMathMLChar.cpp
+@@ -132,7 +132,7 @@ enum {eExtension_base, eExtension_varian
+ #define NS_TABLE_STATE_READY        1
+ 
+ // Hook to resolve common assignments to the PUA
+-static nsCOMPtr<nsIPersistentProperties> gPUAProperties; 
++static nsIPersistentProperties* gPUAProperties; 
+ 
+ // helper to check if a font is installed
+ static PRBool
+@@ -1235,7 +1235,7 @@ InitGlobals(nsPresContext* aPresContext)
+ 
+   // Load the "mathfontPUA.properties" file
+   value.AssignLiteral("PUA");
+-  rv = LoadProperties(value, *getter_AddRefs(gPUAProperties));
++  rv = LoadProperties(value, gPUAProperties);
+   if (NS_FAILED(rv)) return rv;
+ 
+   // Get the default list of mathfonts to be used for stretchy characters
deleted file mode 100644
--- a/more-hashtables.patch
+++ /dev/null
@@ -1,250 +0,0 @@
-diff --git a/xpcom/components/nsCategoryManager.h b/xpcom/components/nsCategoryManager.h
---- a/xpcom/components/nsCategoryManager.h
-+++ b/xpcom/components/nsCategoryManager.h
-@@ -63,8 +63,8 @@ class CategoryLeaf : public nsDepCharHas
- class CategoryLeaf : public nsDepCharHashKey
- {
- public:
--  CategoryLeaf(const char* aKey)
--    : nsDepCharHashKey(aKey),
-+  CategoryLeaf(const char* aKey, const void *entryStore)
-+    : nsDepCharHashKey(aKey, entryStore),
-       pValue(nsnull),
-       nonpValue(nsnull) { }
-   const char* pValue;
-diff --git a/xpcom/components/nsComponentManager.h b/xpcom/components/nsComponentManager.h
---- a/xpcom/components/nsComponentManager.h
-+++ b/xpcom/components/nsComponentManager.h
-@@ -254,7 +254,7 @@ public:
- 
-     nsTArray<nsLoaderdata> mLoaderData;
- 
--    nsDataHashtable<nsHashableHashKey, PRInt64> mAutoRegEntries;
-+    nsDataHashtable<nsHashableHashKey, PRInt64, GCAllocator> mAutoRegEntries;
- 
-     PRBool              mRegistryDirty;
-     nsCOMPtr<nsCategoryManager>  mCategoryManager;
-diff --git a/xpcom/components/nsNativeComponentLoader.h b/xpcom/components/nsNativeComponentLoader.h
---- a/xpcom/components/nsNativeComponentLoader.h
-+++ b/xpcom/components/nsNativeComponentLoader.h
-@@ -65,8 +65,8 @@ class nsNativeModuleLoader : public nsIM
-         typedef nsHashableHashKey::KeyType KeyType;
-         typedef nsHashableHashKey::KeyTypePointer KeyTypePointer;
- 
--        NativeLoadData(const nsIHashable* aHashable)
--            : nsHashableHashKey(aHashable)
-+        NativeLoadData(const nsIHashable* aHashable, const void *entryStore)
-+            : nsHashableHashKey(aHashable, entryStore)
-             , module(NULL)
-             , library(NULL) { }
- 
-diff --git a/xpcom/ds/nsObserverList.h b/xpcom/ds/nsObserverList.h
---- a/xpcom/ds/nsObserverList.h
-+++ b/xpcom/ds/nsObserverList.h
-@@ -74,7 +74,8 @@ class nsObserverList : public nsCharPtrH
- class nsObserverList : public nsCharPtrHashKey
- {
- public:
--  nsObserverList(const char *key) : nsCharPtrHashKey(key)
-+  nsObserverList(const char *key, const void *entryStore)
-+    : nsCharPtrHashKey(key, entryStore)
-   { MOZ_COUNT_CTOR(nsObserverList); }
- 
-   ~nsObserverList() { MOZ_COUNT_DTOR(nsObserverList); }
-diff --git a/xpcom/glue/nsBaseHashtable.h b/xpcom/glue/nsBaseHashtable.h
---- a/xpcom/glue/nsBaseHashtable.h
-+++ b/xpcom/glue/nsBaseHashtable.h
-@@ -59,8 +59,7 @@ public:
-   typedef typename KeyClass::KeyType KeyType;
-   typedef typename KeyClass::KeyTypePointer KeyTypePointer;
-   
--  nsBaseHashtableET(KeyTypePointer aKey);
--  nsBaseHashtableET(nsBaseHashtableET<KeyClass,DataType>& toCopy);
-+  nsBaseHashtableET(KeyTypePointer aKey, const void *entryStore);
-   ~nsBaseHashtableET();
- };
- 
-@@ -258,15 +257,8 @@ protected:
- //
- 
- template<class KeyClass,class DataType>
--nsBaseHashtableET<KeyClass,DataType>::nsBaseHashtableET(KeyTypePointer aKey) :
--  KeyClass(aKey)
--{ }
--
--template<class KeyClass,class DataType>
--nsBaseHashtableET<KeyClass,DataType>::nsBaseHashtableET
--  (nsBaseHashtableET<KeyClass,DataType>& toCopy) :
--  KeyClass(toCopy),
--  mData(toCopy.mData)
-+nsBaseHashtableET<KeyClass,DataType>::nsBaseHashtableET(KeyTypePointer aKey, const void *entryStore) :
-+  KeyClass(aKey, entryStore)
- { }
- 
- template<class KeyClass,class DataType>
-diff --git a/xpcom/glue/nsHashKeys.h b/xpcom/glue/nsHashKeys.h
---- a/xpcom/glue/nsHashKeys.h
-+++ b/xpcom/glue/nsHashKeys.h
-@@ -85,8 +85,7 @@ public:
-   typedef const nsAString& KeyType;
-   typedef const nsAString* KeyTypePointer;
- 
--  nsStringHashKey(KeyTypePointer aStr) : mStr(*aStr) { }
--  nsStringHashKey(const nsStringHashKey& toCopy) : mStr(toCopy.mStr) { }
-+  nsStringHashKey(KeyTypePointer aStr, const void *entryStore) : mStr(*aStr) { }
-   ~nsStringHashKey() { }
- 
-   KeyType GetKey() const { return mStr; }
-@@ -117,8 +116,8 @@ public:
-   typedef const nsACString& KeyType;
-   typedef const nsACString* KeyTypePointer;
-   
--  nsCStringHashKey(const nsACString* aStr) : mStr(*aStr) { }
--  nsCStringHashKey(const nsCStringHashKey& toCopy) : mStr(toCopy.mStr) { }
-+  nsCStringHashKey(const nsACString* aStr, const void *entryStore)
-+    : mStr(*aStr) { }
-   ~nsCStringHashKey() { }
- 
-   KeyType GetKey() const { return mStr; }
-@@ -147,8 +146,8 @@ public:
-   typedef const PRUint32& KeyType;
-   typedef const PRUint32* KeyTypePointer;
-   
--  nsUint32HashKey(KeyTypePointer aKey) : mValue(*aKey) { }
--  nsUint32HashKey(const nsUint32HashKey& toCopy) : mValue(toCopy.mValue) { }
-+  nsUint32HashKey(KeyTypePointer aKey, const void *entryStore)
-+    : mValue(*aKey) { }
-   ~nsUint32HashKey() { }
- 
-   KeyType GetKey() const { return mValue; }
-@@ -173,10 +172,8 @@ public:
-   typedef nsISupports* KeyType;
-   typedef const nsISupports* KeyTypePointer;
- 
--  nsISupportsHashKey(const nsISupports* key) :
-+  nsISupportsHashKey(const nsISupports* key, const void *entryStore) :
-     mSupports(const_cast<nsISupports*>(key)) { }
--  nsISupportsHashKey(const nsISupportsHashKey& toCopy) :
--    mSupports(toCopy.mSupports) { }
-   ~nsISupportsHashKey() { }
- 
-   KeyType GetKey() const { return mSupports; }
-@@ -205,10 +202,8 @@ public:
-   typedef const void* KeyType;
-   typedef const void* KeyTypePointer;
- 
--  nsVoidPtrHashKey(const void* key) :
-+  nsVoidPtrHashKey(const void* key, const void *entryStore) :
-     mKey(key) { }
--  nsVoidPtrHashKey(const nsVoidPtrHashKey& toCopy) :
--    mKey(toCopy.mKey) { }
-   ~nsVoidPtrHashKey() { }
- 
-   KeyType GetKey() const { return mKey; }
-@@ -240,10 +235,8 @@ public:
-   typedef const void* KeyType;
-   typedef const void* KeyTypePointer;
- 
--  nsClearingVoidPtrHashKey(const void* key) :
-+  nsClearingVoidPtrHashKey(const void* key, const void *entryStore) :
-     mKey(key) { }
--  nsClearingVoidPtrHashKey(const nsClearingVoidPtrHashKey& toCopy) :
--    mKey(toCopy.mKey) { }
-   ~nsClearingVoidPtrHashKey() { mKey = NULL; }
- 
-   KeyType GetKey() const { return mKey; }
-@@ -272,8 +265,7 @@ public:
-   typedef const nsID& KeyType;
-   typedef const nsID* KeyTypePointer;
-   
--  nsIDHashKey(const nsID* inID) : mID(*inID) { }
--  nsIDHashKey(const nsIDHashKey& toCopy) : mID(toCopy.mID) { }
-+  nsIDHashKey(const nsID* inID, const void *entryStore) : mID(*inID) { }
-   ~nsIDHashKey() { }
- 
-   KeyType GetKey() const { return mID; }
-@@ -304,8 +296,7 @@ public:
-   typedef const char* KeyType;
-   typedef const char* KeyTypePointer;
- 
--  nsDepCharHashKey(const char* aKey) { mKey = aKey; }
--  nsDepCharHashKey(const nsDepCharHashKey& toCopy) { mKey = toCopy.mKey; }
-+  nsDepCharHashKey(const char* aKey, const void *entryStore) { mKey = aKey; }
-   ~nsDepCharHashKey() { }
- 
-   const char* GetKey() const { return mKey; }
-@@ -333,8 +324,8 @@ public:
-   typedef const char* KeyType;
-   typedef const char* KeyTypePointer;
- 
--  nsCharPtrHashKey(const char* aKey) : mKey(strdup(aKey)) { }
--  nsCharPtrHashKey(const nsCharPtrHashKey& toCopy) : mKey(strdup(toCopy.mKey)) { }
-+  nsCharPtrHashKey(const char* aKey, const void *entryStore)
-+    : mKey(strdup(aKey)) { }
-   ~nsCharPtrHashKey() { if (mKey) free(const_cast<char *>(mKey)); }
- 
-   const char* GetKey() const { return mKey; }
-@@ -363,8 +354,8 @@ public:
-   typedef const PRUnichar* KeyType;
-   typedef const PRUnichar* KeyTypePointer;
- 
--  nsUnicharPtrHashKey(const PRUnichar* aKey) : mKey(NS_strdup(aKey)) { }
--  nsUnicharPtrHashKey(const nsUnicharPtrHashKey& toCopy) : mKey(NS_strdup(toCopy.mKey)) { }
-+  nsUnicharPtrHashKey(const PRUnichar* aKey, const void *entryStore)
-+    : mKey(NS_strdup(aKey)) { }
-   ~nsUnicharPtrHashKey() { if (mKey) NS_Free(const_cast<PRUnichar *>(mKey)); }
- 
-   const PRUnichar* GetKey() const { return mKey; }
-@@ -391,11 +382,12 @@ public:
-     typedef nsIHashable* KeyType;
-     typedef const nsIHashable* KeyTypePointer;
- 
--    nsHashableHashKey(const nsIHashable* aKey) :
--        mKey(const_cast<nsIHashable*>(aKey)) { }
--    nsHashableHashKey(const nsHashableHashKey& toCopy) :
--        mKey(toCopy.mKey) { }
--    ~nsHashableHashKey() { }
-+    nsHashableHashKey(const nsIHashable* aKey, const void *entryStore) {
-+        WB(NS_GetGC(), entryStore, &mKey, aKey);
-+    }
-+    ~nsHashableHashKey() {
-+      mKey = NULL;
-+    }
- 
-     nsIHashable* GetKey() const { return mKey; }
- 
-@@ -421,7 +413,7 @@ public:
-     enum { ALLOW_MEMMOVE = PR_TRUE };
- 
- private:
--    nsCOMPtr<nsIHashable> mKey;
-+    nsIHashable* mKey;
- };
- 
- #endif // nsTHashKeys_h__
-diff --git a/xpcom/glue/nsTHashtable.h b/xpcom/glue/nsTHashtable.h
---- a/xpcom/glue/nsTHashtable.h
-+++ b/xpcom/glue/nsTHashtable.h
-@@ -428,7 +428,8 @@ nsTHashtable<EntryType, Allocator>::s_In
-                                                 PLDHashEntryHdr *entry,
-                                                 const void      *key)
- {
--  new(entry) EntryType(reinterpret_cast<KeyTypePointer>(key));
-+  new(entry) EntryType(reinterpret_cast<KeyTypePointer>(key),
-+                       table->entryStore);
-   return PR_TRUE;
- }
- 
-diff --git a/xpcom/tests/TestHashtables.cpp b/xpcom/tests/TestHashtables.cpp
---- a/xpcom/tests/TestHashtables.cpp
-+++ b/xpcom/tests/TestHashtables.cpp
-@@ -99,8 +99,7 @@ public:
-   typedef const char* KeyType;
-   typedef const char* KeyTypePointer;
- 
--  EntityToUnicodeEntry(const char* aKey) { mNode = nsnull; }
--  EntityToUnicodeEntry(const EntityToUnicodeEntry& aEntry) { mNode = aEntry.mNode; }
-+  EntityToUnicodeEntry(const char* aKey, const void *entryStore) { mNode = nsnull; }
-   ~EntityToUnicodeEntry() { };
- 
-   PRBool KeyEquals(const char* aEntity) const { return !strcmp(mNode->mStr, aEntity); }
new file mode 100644
--- /dev/null
+++ b/necko-gc
@@ -0,0 +1,32 @@
+diff --git a/netwerk/base/src/nsStandardURL.cpp b/netwerk/base/src/nsStandardURL.cpp
+--- a/netwerk/base/src/nsStandardURL.cpp
++++ b/netwerk/base/src/nsStandardURL.cpp
+@@ -167,6 +167,7 @@ nsSegmentEncoder::nsSegmentEncoder(const
+ nsSegmentEncoder::nsSegmentEncoder(const char *charset)
+     : mCharset(charset)
+ {
++    ASSERT_StackObject(this);
+ }
+ 
+ PRInt32 nsStandardURL::
+@@ -248,7 +249,7 @@ nsSegmentEncoder::InitUnicodeEncoder()
+         }
+     }
+ 
+-    rv = gCharsetMgr->GetUnicodeEncoder(mCharset, getter_AddRefs(mEncoder));
++    rv = gCharsetMgr->GetUnicodeEncoder(mCharset, &mEncoder);
+     if (NS_FAILED(rv)) {
+         NS_ERROR("failed to get unicode encoder");
+         mEncoder = 0; // just in case
+diff --git a/netwerk/base/src/nsStandardURL.h b/netwerk/base/src/nsStandardURL.h
+--- a/netwerk/base/src/nsStandardURL.h
++++ b/netwerk/base/src/nsStandardURL.h
+@@ -141,7 +141,7 @@ public: /* internal -- HPUX compiler can
+         
+         const char* mCharset;  // Caller should keep this alive for
+                                // the life of the segment encoder
+-        nsCOMPtr<nsIUnicodeEncoder> mEncoder;
++        nsIUnicodeEncoder* mEncoder;
+     };
+     friend class nsSegmentEncoder;
+ 
new file mode 100644
--- /dev/null
+++ b/observerlist-gc
@@ -0,0 +1,24 @@
+diff --git a/xpcom/ds/nsObserverList.cpp b/xpcom/ds/nsObserverList.cpp
+--- a/xpcom/ds/nsObserverList.cpp
++++ b/xpcom/ds/nsObserverList.cpp
+@@ -54,7 +54,7 @@ nsObserverList::AddObserver(nsIObserver*
+         return NS_OK;
+     }
+         
+-    nsCOMPtr<nsIWeakReference> weak = do_GetWeakReference(anObserver);
++    nsIWeakReference* weak = do_GetWeakReference(anObserver);
+     if (!weak)
+         return NS_NOINTERFACE;
+ 
+diff --git a/xpcom/ds/nsObserverList.h b/xpcom/ds/nsObserverList.h
+--- a/xpcom/ds/nsObserverList.h
++++ b/xpcom/ds/nsObserverList.h
+@@ -93,7 +93,7 @@ public:
+   void FillObserverArray(nsCOMArray<nsIObserver> &aArray);
+ 
+ private:
+-  nsTArray<ObserverRef> mObservers;
++  nsTArray<ObserverRef, GCAllocator> mObservers;
+ };
+ 
+ class nsObserverEnumerator : public XPCOMGCFinalizedObject, public nsISimpleEnumerator
--- a/series
+++ b/series
@@ -16,19 +16,29 @@ gcobject-rdf.patch
 gcobject-tiertoolkit.patch
 layout-bases.patch
 gcobject-fixup.patch
 dirservice-atomroots.patch
 proxy-fixup.patch
 windows-warning.patch
 comarray.patch
 gc-hashtables.patch
+xpti-workingset.patch
 unbraced-if-fixes.patch
+more-gcobjects.patch
+fix-garburator.patch
+xpcomproxy-gcalloc.patch
 automatic-remove-addrefs.patch
 automatic-gcobject.patch
 automatic-garburator.patch
-fix-garburator.patch
-more-gcobjects.patch
-compmgr-gcalloc.patch
-xpti-workingset.patch
-more-hashtables.patch
-fix-allocator.patch
-xpcomproxy-gcalloc.patch
+automatic-garburator-psm.patch
+hashentry-fixups.patch
+uconverter-suck
+xpinstall-suck
+layout-suck
+widget-suck
+TArray-allocator
+compmgr-loadertype
+TArray-extra
+xpconnect-allocations
+observerlist-gc
+jscomponentloader-gc
+necko-gc
new file mode 100644
--- /dev/null
+++ b/uconverter-suck
@@ -0,0 +1,54 @@
+diff --git a/intl/uconv/public/nsEncoderDecoderUtils.h b/intl/uconv/public/nsEncoderDecoderUtils.h
+--- a/intl/uconv/public/nsEncoderDecoderUtils.h
++++ b/intl/uconv/public/nsEncoderDecoderUtils.h
+@@ -73,7 +73,7 @@ nsUConverterRegSelf(nsIComponentManager 
+                     const nsModuleComponentInfo *info)                  \
+ {                                                                       \
+   nsresult rv;                                                          \
+-  nsCOMPtr<nsICategoryManager> catman =                                 \
++  nsICategoryManager* catman =                                          \
+     do_GetService(NS_CATEGORYMANAGER_CONTRACTID, &rv);                  \
+   if (NS_FAILED(rv)) return rv;                                         \
+                                                                         \
+@@ -105,7 +105,7 @@ nsUConverterUnregSelf(nsIComponentManage
+                       const nsModuleComponentInfo *info)                    \
+ { \
+   nsresult rv;                                                          \
+-  nsCOMPtr<nsICategoryManager> catman =                                 \
++  nsICategoryManager* catman =                                          \
+   do_GetService(NS_CATEGORYMANAGER_CONTRACTID, &rv);                    \
+   if (NS_FAILED(rv)) return rv;                                         \
+                                                                         \
+diff --git a/intl/uconv/ucvko/nsUnicodeToJamoTTF.cpp b/intl/uconv/ucvko/nsUnicodeToJamoTTF.cpp
+--- a/intl/uconv/ucvko/nsUnicodeToJamoTTF.cpp
++++ b/intl/uconv/ucvko/nsUnicodeToJamoTTF.cpp
+@@ -134,7 +134,7 @@ typedef struct {
+ #define UP_TBASE 0xE404  // 0xE400 = Tfill, 0xE404 = Kiyeok
+ 
+ // EUC-KR decoder for FillInfo.
+-static nsCOMPtr<nsIUnicodeDecoder> gDecoder = 0;
++static nsIUnicodeDecoder* gDecoder = 0;
+   
+ static inline void FillInfoRange     (PRUint32* aInfo, PRUint32 aStart, 
+                                       PRUint32 aEnd);
+@@ -750,17 +750,17 @@ nsresult GetDecoder(nsIUnicodeDecoder** 
+   nsresult rv; 
+ 
+   if (gDecoder) {
+-    *aDecoder = gDecoder.get();
++    *aDecoder = gDecoder;
+     return NS_OK;
+   }
+ 
+   nsICharsetConverterManager* charsetConverterManager;
+   charsetConverterManager = do_GetService(NS_CHARSETCONVERTERMANAGER_CONTRACTID, &rv);
+   NS_ENSURE_SUCCESS(rv,rv);
+-  rv = charsetConverterManager->GetUnicodeDecoderRaw("EUC-KR", getter_AddRefs(gDecoder));
++  rv = charsetConverterManager->GetUnicodeDecoderRaw("EUC-KR", &gDecoder);
+   NS_ENSURE_SUCCESS(rv,rv);
+ 
+-  *aDecoder = gDecoder.get();
++  *aDecoder = gDecoder;
+   return NS_OK;
+ }
+ 
new file mode 100644
--- /dev/null
+++ b/widget-suck
@@ -0,0 +1,14 @@
+diff --git a/widget/src/gtk2/nsWindow.cpp b/widget/src/gtk2/nsWindow.cpp
+--- a/widget/src/gtk2/nsWindow.cpp
++++ b/widget/src/gtk2/nsWindow.cpp
+@@ -242,8 +242,8 @@ static PRBool            gRaiseWindows  
+ static PRBool            gRaiseWindows         = PR_TRUE;
+ static nsWindow         *gPluginFocusWindow    = NULL;
+ 
+-nsCOMPtr  <nsIRollupListener> gRollupListener;
+-nsWeakPtr                     gRollupWindow;
++static nsIRollupListener* gRollupListener;
++static nsIWeakReference*  gRollupWindow;
+ 
+ #define NS_WINDOW_TITLE_MAX_LENGTH 4095
+ 
new file mode 100644
--- /dev/null
+++ b/xpconnect-allocations
@@ -0,0 +1,143 @@
+diff --git a/js/src/xpconnect/src/xpcprivate.h b/js/src/xpconnect/src/xpcprivate.h
+--- a/js/src/xpconnect/src/xpcprivate.h
++++ b/js/src/xpconnect/src/xpcprivate.h
+@@ -857,7 +857,7 @@ private:
+ //
+ // Note that most accessors are inlined.
+ 
+-class XPCCallContext : public XPCOMGCFinalizedObject, public nsIXPCNativeCallContext
++class XPCCallContext : public nsIXPCNativeCallContext
+ {
+ public:
+     NS_DECL_ISUPPORTS
+@@ -1075,7 +1075,7 @@ xpc_TraceForValidWrapper(JSTracer *trc, 
+ /***************************************************************************/
+ // XPCWrappedNativeScope is one-to-one with a JS global object.
+ 
+-class XPCWrappedNativeScope
++class XPCWrappedNativeScope : XPCOMGCFinalizedObject
+ {
+ public:
+ 
+@@ -1292,7 +1292,7 @@ private:
+ 
+ // Tight. No virtual methods.
+ 
+-class XPCNativeInterface
++class XPCNativeInterface : XPCOMGCObject
+ {
+ public:
+     static XPCNativeInterface* GetNewOrUsed(XPCCallContext& ccx,
+@@ -1346,12 +1346,21 @@ protected:
+     XPCNativeInterface(nsIInterfaceInfo* aInfo, jsval aName)
+         : mInfo(aInfo), mName(aName), mMemberCount(0)
+                           {MOZ_COUNT_CTOR(XPCNativeInterface);}
+-    ~XPCNativeInterface() {MOZ_COUNT_DTOR(XPCNativeInterface);}
+-
+-    void* operator new(size_t, void* p) CPP_THROW_NEW {return p;}
+ 
+     XPCNativeInterface(const XPCNativeInterface& r); // not implemented
+     XPCNativeInterface& operator= (const XPCNativeInterface& r); // not implemented
++
++    static void* operator new(size_t size, size_t memberCount)
++    {
++        if (memberCount > 1)
++            size += (memberCount - 1) * sizeof(XPCNativeMember);
++        return XPCOMGCObject::operator new(size);
++    }
++
++    static void operator delete(void *obj)
++    {
++        MMgc::GCObject::operator delete(obj);
++    }
+ 
+ private:
+     nsCOMPtr<nsIInterfaceInfo> mInfo;
+@@ -1614,7 +1623,7 @@ private:
+ // XPCNativeScriptableInfo is used to hold the nsIXPCScriptable state for a
+ // given class or instance.
+ 
+-class XPCNativeScriptableInfo
++class XPCNativeScriptableInfo : XPCOMGCObject
+ {
+ public:
+     static XPCNativeScriptableInfo*
+@@ -1644,10 +1653,8 @@ protected:
+ protected:
+     XPCNativeScriptableInfo(nsIXPCScriptable* scriptable = nsnull,
+                             XPCNativeScriptableShared* shared = nsnull)
+-        : mCallback(scriptable), mShared(shared)
+-                               {MOZ_COUNT_CTOR(XPCNativeScriptableInfo);}
+-public:
+-    ~XPCNativeScriptableInfo() {MOZ_COUNT_DTOR(XPCNativeScriptableInfo);}
++        : mCallback(scriptable), mShared(shared) {}
++
+ private:
+ 
+     // disable copy ctor and assignment
+@@ -1688,7 +1695,7 @@ public:
+     SetFlags(const XPCNativeScriptableFlags& flags)  {mFlags = flags;}
+ 
+ private:
+-    nsCOMPtr<nsIXPCScriptable>  mCallback;
++    nsIXPCScriptable*           mCallback;
+     XPCNativeScriptableFlags    mFlags;
+ };
+ 
+@@ -1696,7 +1703,7 @@ private:
+ // XPCWrappedNativeProto hold the additional (potentially shared) wrapper data
+ // for XPCWrappedNative whose native objects expose nsIClassInfo.
+ 
+-class XPCWrappedNativeProto
++class XPCWrappedNativeProto : XPCOMGCObject
+ {
+ public:
+     static XPCWrappedNativeProto*
+diff --git a/js/src/xpconnect/src/xpcwrappednativeinfo.cpp b/js/src/xpconnect/src/xpcwrappednativeinfo.cpp
+--- a/js/src/xpconnect/src/xpcwrappednativeinfo.cpp
++++ b/js/src/xpconnect/src/xpcwrappednativeinfo.cpp
+@@ -471,14 +471,7 @@ XPCNativeInterface::NewInstance(XPCCallC
+ 
+     if(!failed)
+     {
+-        // Use placement new to create an object with the right amount of space
+-        // to hold the members array
+-        int size = sizeof(XPCNativeInterface);
+-        if(realTotalCount > 1)
+-            size += (realTotalCount - 1) * sizeof(XPCNativeMember);
+-        void* place = new char[size];
+-        if(place)
+-            obj = new(place) XPCNativeInterface(aInfo, interfaceName);
++        obj = new(realTotalCount) XPCNativeInterface(aInfo, interfaceName);
+ 
+         if(obj)
+         {
+@@ -501,8 +494,7 @@ XPCNativeInterface::DestroyInstance(JSCo
+ XPCNativeInterface::DestroyInstance(JSContext* cx, XPCJSRuntime* rt,
+                                     XPCNativeInterface* inst)
+ {
+-    inst->~XPCNativeInterface();
+-    delete [] (char*) inst;
++    delete inst;
+ }
+ 
+ const char*
+diff --git a/xpcom/glue/nsGenericFactory.h b/xpcom/glue/nsGenericFactory.h
+--- a/xpcom/glue/nsGenericFactory.h
++++ b/xpcom/glue/nsGenericFactory.h
+@@ -92,14 +92,13 @@ public:
+ 
+     NS_DECL_NSIMODULE
+ 
+-    struct FactoryNode
++    struct FactoryNode : XPCOMGCObject
+     {
+         FactoryNode(nsIGenericFactory* fact, FactoryNode* next) 
+         { 
+             mFactory = fact; 
+             mNext    = next;
+         }
+-        ~FactoryNode(){}
+ 
+         nsCOMPtr<nsIGenericFactory> mFactory;
+         FactoryNode* mNext;
new file mode 100644
--- /dev/null
+++ b/xpinstall-suck
@@ -0,0 +1,33 @@
+diff --git a/xpinstall/src/nsSoftwareUpdate.cpp b/xpinstall/src/nsSoftwareUpdate.cpp
+--- a/xpinstall/src/nsSoftwareUpdate.cpp
++++ b/xpinstall/src/nsSoftwareUpdate.cpp
+@@ -88,7 +88,7 @@ extern "C" void PR_CALLBACK RunChromeIns
+ ////////////////////////////////////////////////////////////////////////////////
+ 
+ nsSoftwareUpdate* nsSoftwareUpdate::mInstance = nsnull;
+-nsCOMPtr<nsIFile> nsSoftwareUpdate::mProgramDir = nsnull;
++nsIFile*          nsSoftwareUpdate::mProgramDir = nsnull;
+ char*             nsSoftwareUpdate::mLogName = nsnull;
+ PRBool            nsSoftwareUpdate::mNeedCleanup = PR_FALSE;
+ 
+@@ -427,7 +427,7 @@ nsSoftwareUpdate::StubInitialize(nsIFile
+         return NS_ERROR_NULL_POINTER;
+ 
+     // fix GetFolder return path
+-    nsresult rv = aDir->Clone(getter_AddRefs(mProgramDir));
++    nsresult rv = aDir->Clone(&mProgramDir);
+ 
+     // make sure registry updates go to the right place
+     nsCAutoString tempPath;
+diff --git a/xpinstall/src/nsSoftwareUpdate.h b/xpinstall/src/nsSoftwareUpdate.h
+--- a/xpinstall/src/nsSoftwareUpdate.h
++++ b/xpinstall/src/nsSoftwareUpdate.h
+@@ -78,7 +78,7 @@ class nsSoftwareUpdate: public XPCOMGCFi
+ 
+     private:
+         static   nsSoftwareUpdate*  mInstance;
+-        static   nsCOMPtr<nsIFile>  mProgramDir;
++        static   nsIFile*           mProgramDir;
+         static   char*              mLogName;
+ 
+         nsresult RunNextInstall();