Merging is hard, let's all go eat lasanga.
authorBenjamin Smedberg <benjamin@smedbergs.us>
Mon, 23 Jun 2008 11:20:56 -0400
changeset 135 e92f95c91dcae06c2ec6a583339c7f8886842ea1
parent 134 92f35840b6478895e714257685554ca6e0da4850
child 136 d8f75cb1dd7f07f049ffbff7588cac30c375b9a0
push id20
push userbsmedberg@mozilla.com
push dateMon, 23 Jun 2008 15:21:10 +0000
Merging is hard, let's all go eat lasanga.
manual-nsDocument-comptr
nsIFrame-Cursor-stackclass
nsSelectionState-autohelpers-stackclass
series
static-check-gc-attributes
deleted file mode 100644
--- a/manual-nsDocument-comptr
+++ /dev/null
@@ -1,1625 +0,0 @@
-diff --git a/content/base/src/nsDocument.cpp b/content/base/src/nsDocument.cpp
---- a/content/base/src/nsDocument.cpp
-+++ b/content/base/src/nsDocument.cpp
-@@ -368,7 +368,7 @@ nsDOMStyleSheetList::GetLength(PRUint32*
-       PRInt32 i;
-       for (i = 0; i < mLength; i++) {
-         nsIStyleSheet *sheet = mDocument->GetStyleSheetAt(i);
--        nsCOMPtr<nsIDOMStyleSheet> domss(do_QueryInterface(sheet));
-+        nsIDOMStyleSheet* domss(do_QueryInterface(sheet));
-         NS_ASSERTION(domss, "All \"normal\" sheets implement nsIDOMStyleSheet");
-       }
- #endif
-@@ -410,7 +410,7 @@ nsDOMStyleSheetList::StyleSheetAdded(nsI
-                                      PRBool aDocumentSheet)
- {
-   if (aDocumentSheet && -1 != mLength) {
--    nsCOMPtr<nsIDOMStyleSheet> domss(do_QueryInterface(aStyleSheet));
-+    nsIDOMStyleSheet* domss(do_QueryInterface(aStyleSheet));
-     if (domss) {
-       mLength++;
-     }
-@@ -423,7 +423,7 @@ nsDOMStyleSheetList::StyleSheetRemoved(n
-                                        PRBool aDocumentSheet)
- {
-   if (aDocumentSheet && -1 != mLength) {
--    nsCOMPtr<nsIDOMStyleSheet> domss(do_QueryInterface(aStyleSheet));
-+    nsIDOMStyleSheet* domss(do_QueryInterface(aStyleSheet));
-     if (domss) {
-       mLength--;
-     }
-@@ -503,7 +503,7 @@ nsOnloadBlocker::SetLoadFlags(nsLoadFlag
- // If we ever have an nsIDocumentObserver notification for stylesheet title
- // changes, we could make this inherit from nsDOMStringList instead of
- // reimplementing nsIDOMDOMStringList.
--class nsDOMStyleSheetSetList : public nsIDOMDOMStringList
-+class nsDOMStyleSheetSetList : public XPCOMGCFinalizedObject, public nsIDOMDOMStringList
-                           
- {
- public:
-@@ -608,7 +608,8 @@ nsDOMStyleSheetSetList::GetSets(nsString
- // =
- // ==================================================================
- 
--class nsDOMImplementation : public nsIDOMDOMImplementation,
-+class nsDOMImplementation : public XPCOMGCFinalizedObject,
-+                            public nsIDOMDOMImplementation,
-                             public nsIPrivateDOMImplementation
- {
- public:
-@@ -643,7 +644,6 @@ NS_NewDOMImplementation(nsIDOMDOMImpleme
-     return NS_ERROR_OUT_OF_MEMORY;
-   }
- 
--  NS_ADDREF(*aInstancePtrResult);
- 
-   return NS_OK;
- }
-@@ -697,7 +697,7 @@ nsDOMImplementation::CreateDocumentType(
-   nsresult rv = nsContentUtils::CheckQName(aQualifiedName);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
--  nsCOMPtr<nsIAtom> name = do_GetAtom(aQualifiedName);
-+  nsIAtom* name = do_GetAtom(aQualifiedName);
-   NS_ENSURE_TRUE(name, NS_ERROR_OUT_OF_MEMORY);
-     
-   return NS_NewDOMDocumentType(aReturn, nsnull, mPrincipal, name, nsnull,
-@@ -735,14 +735,14 @@ nsDOMImplementation::CreateDocument(cons
-   }
- 
-   if (aDoctype) {
--    nsCOMPtr<nsIDOMDocument> owner;
--    aDoctype->GetOwnerDocument(getter_AddRefs(owner));
-+    nsIDOMDocument* owner = nsnull;
-+    aDoctype->GetOwnerDocument(&owner);
-     if (owner) {
-       return NS_ERROR_DOM_WRONG_DOCUMENT_ERR;
-     }
-   }
- 
--  nsCOMPtr<nsIScriptGlobalObject> scriptHandlingObject =
-+  nsIScriptGlobalObject* scriptHandlingObject =
-     do_QueryReferent(mScriptObject);
- 
-   return nsContentUtils::CreateDocument(aNamespaceURI, aQualifiedName, aDoctype,
-@@ -979,7 +979,6 @@ nsDocument::Init()
-   mNodeInfoManager = new nsNodeInfoManager();
-   NS_ENSURE_TRUE(mNodeInfoManager, NS_ERROR_OUT_OF_MEMORY);
- 
--  NS_ADDREF(mNodeInfoManager);
- 
-   nsresult  rv = mNodeInfoManager->Init(this);
-   NS_ENSURE_SUCCESS(rv, rv);
-@@ -1010,19 +1009,19 @@ void
- void
- nsDocument::Reset(nsIChannel* aChannel, nsILoadGroup* aLoadGroup)
- {
--  nsCOMPtr<nsIURI> uri;
--  nsCOMPtr<nsIPrincipal> principal;
-+  nsIURI* uri = nsnull;
-+  nsIPrincipal* principal = nsnull;
-   if (aChannel) {
-     // Note: this code is duplicated in nsXULDocument::StartDocumentLoad and
-     // nsScriptSecurityManager::GetChannelPrincipal.    
-     // Note: this should match nsDocShell::OnLoadingSite
--    NS_GetFinalChannelURI(aChannel, getter_AddRefs(uri));
-+    NS_GetFinalChannelURI(aChannel, &uri);
- 
-     nsIScriptSecurityManager *securityManager =
-       nsContentUtils::GetSecurityManager();
-     if (securityManager) {
-       securityManager->GetChannelPrincipal(aChannel,
--                                           getter_AddRefs(principal));
-+                                           &principal);
-     }
-   }
- 
-@@ -1068,7 +1067,7 @@ nsDocument::ResetToURI(nsIURI *aURI, nsI
-   { // Scope for update
-     MOZ_AUTO_DOC_UPDATE(this, UPDATE_CONTENT_MODEL, PR_TRUE);    
-     for (PRInt32 i = PRInt32(count) - 1; i >= 0; i--) {
--      nsCOMPtr<nsIContent> content = mChildren.ChildAt(i);
-+      nsIContent* content = mChildren.ChildAt(i);
- 
-       // XXXbz this is backwards from how ContentRemoved normally works.  That
-       // is, usually it's dispatched after the content has been removed from
-@@ -1119,10 +1118,10 @@ nsDocument::ResetToURI(nsIURI *aURI, nsI
-     nsIScriptSecurityManager *securityManager =
-       nsContentUtils::GetSecurityManager();
-     if (securityManager) {
--      nsCOMPtr<nsIPrincipal> principal;
-+      nsIPrincipal* principal = nsnull;
-       nsresult rv =
-         securityManager->GetCodebasePrincipal(mDocumentURI,
--                                              getter_AddRefs(principal));
-+                                              &principal);
-       if (NS_SUCCEEDED(rv)) {
-         SetPrincipal(principal);
-       }
-@@ -1161,7 +1160,7 @@ nsDocument::ResetStylesheetsToURI(nsIURI
-     sheet->GetApplicable(applicable);
-     if (applicable) {
-       nsPresShellIterator iter(this);
--      nsCOMPtr<nsIPresShell> shell;
-+      nsIPresShell* shell = nsnull;
-       while ((shell = iter.GetNextShell())) {
-         shell->StyleSet()->RemoveStyleSheet(nsStyleSet::eAgentSheet, sheet);
-       }
-@@ -1183,7 +1182,7 @@ nsDocument::ResetStylesheetsToURI(nsIURI
-   if (mAttrStyleSheet) {
-     // Remove this sheet from all style sets
-     nsPresShellIterator iter(this);
--    nsCOMPtr<nsIPresShell> shell;
-+    nsIPresShell* shell = nsnull;
-     while ((shell = iter.GetNextShell())) {
-       shell->StyleSet()->RemoveStyleSheet(attrSheetType, mAttrStyleSheet);
-     }
-@@ -1200,7 +1199,7 @@ nsDocument::ResetStylesheetsToURI(nsIURI
-   if (mStyleAttrStyleSheet) {
-     // Remove this sheet from all style sets
-     nsPresShellIterator iter(this);
--    nsCOMPtr<nsIPresShell> shell;
-+    nsIPresShell* shell = nsnull;
-     while ((shell = iter.GetNextShell())) {
-       shell->StyleSet()->
-         RemoveStyleSheet(nsStyleSet::eStyleAttrSheet, mStyleAttrStyleSheet);
-@@ -1218,7 +1217,7 @@ nsDocument::ResetStylesheetsToURI(nsIURI
- 
-   // Now set up our style sets
-   nsPresShellIterator iter(this);
--  nsCOMPtr<nsIPresShell> shell;
-+  nsIPresShell* shell = nsnull;
-   while ((shell = iter.GetNextShell())) {
-     FillStyleSet(shell->StyleSet());
-   }
-@@ -1281,8 +1280,8 @@ nsDocument::StartDocumentLoad(const char
- {
- #ifdef PR_LOGGING
-   if (gDocumentLeakPRLog && PR_LOG_TEST(gDocumentLeakPRLog, PR_LOG_DEBUG)) {
--    nsCOMPtr<nsIURI> uri;
--    aChannel->GetURI(getter_AddRefs(uri));
-+    nsIURI* uri = nsnull;
-+    aChannel->GetURI(&uri);
-     nsCAutoString spec;
-     if (uri)
-       uri->GetSpec(spec);
-@@ -1408,17 +1407,17 @@ nsDocument::HasFocus(PRBool* aResult)
-   }
- 
-   // Is there a focused DOMWindow?
--  nsCOMPtr<nsIDOMWindowInternal> focusedWindow;
--  rv = focusController->GetFocusedWindow(getter_AddRefs(focusedWindow));
-+  nsIDOMWindowInternal* focusedWindow = nsnull;
-+  rv = focusController->GetFocusedWindow(&focusedWindow);
-   NS_ENSURE_SUCCESS(rv, rv);
-   if (!focusedWindow) {
-     return NS_ERROR_FAILURE;
-   }
- 
-   // Are we an ancestor of the focused DOMWindow?
--  nsCOMPtr<nsIDOMDocument> domDocument;
--  focusedWindow->GetDocument(getter_AddRefs(domDocument));
--  nsCOMPtr<nsIDocument> document = do_QueryInterface(domDocument);
-+  nsIDOMDocument* domDocument = nsnull;
-+  focusedWindow->GetDocument(&domDocument);
-+  nsIDocument* document = do_QueryInterface(domDocument);
- 
-   for (nsIDocument* currentDoc = document; currentDoc;
-        currentDoc = currentDoc->GetParentDocument()) {
-@@ -1455,21 +1454,21 @@ nsDocument::GetActiveElement(nsIDOMEleme
-     return NS_ERROR_FAILURE;
-   }
- 
--  nsCOMPtr<nsIDOMElement> focusedElement;
--  focusController->GetFocusedElement(getter_AddRefs(focusedElement));
--  nsCOMPtr<nsIContent> content = do_QueryInterface(focusedElement);
-+  nsIDOMElement* focusedElement = nsnull;
-+  focusController->GetFocusedElement(&focusedElement);
-+  nsIContent* content = do_QueryInterface(focusedElement);
-   if (content) {
-     // Found a focused element.  See if it's in this document.
-     nsIDocument* currentDoc = content->GetCurrentDoc();
-     if (currentDoc == this) {
--      focusedElement.swap(*aElement);
-+      swap(focusedElement, *aElement);
-       return NS_OK;
-     }
- 
-     // Not in this document.  If it's in a child document, return the iframe in
-     // this document that's an ancestor of the child.
-     if (currentDoc) {
--      *aElement = CheckAncestryAndGetFrame(currentDoc).get();
-+      *aElement = CheckAncestryAndGetFrame(currentDoc);
-       if (*aElement) {
-         return NS_OK;
-       }
-@@ -1479,18 +1478,18 @@ nsDocument::GetActiveElement(nsIDOMEleme
-   // Couldn't find a focused element.  Check if something like an IFRAME is
-   // focused, which will give us a focused window rather than a focused
-   // element.
--  nsCOMPtr<nsIDOMWindowInternal> focusedWindow;
--  focusController->GetFocusedWindow(getter_AddRefs(focusedWindow));
-+  nsIDOMWindowInternal* focusedWindow = nsnull;
-+  focusController->GetFocusedWindow(&focusedWindow);
-   if (focusedWindow) {
-     // Found a focused window.  See if it's in a child of this document.  (If
-     // the window's document is this, then we should just fall through to
-     // returning the BODY below).
--    nsCOMPtr<nsIDOMDocument> domDocument;
--    focusedWindow->GetDocument(getter_AddRefs(domDocument));
--    nsCOMPtr<nsIDocument> document = do_QueryInterface(domDocument);
-+    nsIDOMDocument* domDocument = nsnull;
-+    focusedWindow->GetDocument(&domDocument);
-+    nsIDocument* document = do_QueryInterface(domDocument);
- 
-     if (document && (document != this)) {
--      *aElement = CheckAncestryAndGetFrame(document).get();
-+      *aElement = CheckAncestryAndGetFrame(document);
-       if (*aElement) {
-         return NS_OK;
-       }
-@@ -1498,14 +1497,13 @@ nsDocument::GetActiveElement(nsIDOMEleme
-   }
- 
-   // No focused element anywhere in this document.  Try to get the BODY.
--  nsCOMPtr<nsIDOMHTMLDocument> htmlDoc =
-+  nsIDOMHTMLDocument* htmlDoc =
-     do_QueryInterface(static_cast<nsIDocument*>(this));
-   if (htmlDoc) {
--    nsCOMPtr<nsIDOMHTMLElement> bodyElement;
--    htmlDoc->GetBody(getter_AddRefs(bodyElement));
-+    nsIDOMHTMLElement* bodyElement = nsnull;
-+    htmlDoc->GetBody(&bodyElement);
-     if (bodyElement) {
-       *aElement = bodyElement;
--      NS_ADDREF(*aElement);
-     }
-     // Because of IE compatibility, return null when html document doesn't have
-     // a body.
-@@ -1551,7 +1549,7 @@ nsDocument::ElementFromPoint(PRInt32 aX,
-   // If the content is in a subdocument, try to get the element from |this| doc
-   nsIDocument *currentDoc = ptContent->GetCurrentDoc();
-   if (currentDoc && (currentDoc != this)) {
--    *aReturn = CheckAncestryAndGetFrame(currentDoc).get();
-+    *aReturn = CheckAncestryAndGetFrame(currentDoc);
-     return NS_OK;
-   }
- 
-@@ -1613,7 +1611,6 @@ nsDocument::GetElementsByClassNameHelper
-   }
- 
-   *aReturn = elements;
--  NS_ADDREF(*aReturn);
- 
-   return NS_OK;
- }
-@@ -1689,7 +1686,7 @@ nsDocument::SetDocumentCharacterSet(cons
-     mCharacterSet = aCharSetID;
- 
- #ifdef DEBUG
--    nsCOMPtr<nsICharsetAlias> calias(do_GetService(NS_CHARSETALIAS_CONTRACTID));
-+    nsICharsetAlias* calias(do_GetService(NS_CHARSETALIAS_CONTRACTID));
-     if (calias) {
-       nsCAutoString canonicalName;
-       calias->GetPreferred(aCharSetID, canonicalName);
-@@ -1792,8 +1789,8 @@ nsDocument::SetHeaderData(nsIAtom* aHead
-     if (root) {
-       // Get the script-type ID for this value.
-       nsresult rv;
--      nsCOMPtr<nsIScriptRuntime> runtime;
--      rv = NS_GetScriptRuntime(aData, getter_AddRefs(runtime));
-+      nsIScriptRuntime* runtime = nsnull;
-+      rv = NS_GetScriptRuntime(aData, &runtime);
-       if (NS_FAILED(rv) || runtime == nsnull) {
-         NS_WARNING("The script-type is unknown");
-       } else {
-@@ -1818,7 +1815,7 @@ nsDocument::SetHeaderData(nsIAtom* aHead
-   if (aHeaderField == nsGkAtoms::refresh) {
-     // We get into this code before we have a script global yet, so get to
-     // our container via mDocumentContainer.
--    nsCOMPtr<nsIRefreshURI> refresher = do_QueryReferent(mDocumentContainer);
-+    nsIRefreshURI* refresher = do_QueryReferent(mDocumentContainer);
-     if (refresher) {
-       // Note: using mDocumentURI instead of mBaseURI here, for consistency
-       // (used to just use the current URI of our webnavigation, but that
-@@ -1844,7 +1841,7 @@ nsDocument::TryChannelCharset(nsIChannel
-     nsCAutoString charsetVal;
-     nsresult rv = aChannel->GetContentCharset(charsetVal);
-     if (NS_SUCCEEDED(rv)) {
--      nsCOMPtr<nsICharsetAlias> calias(do_GetService(NS_CHARSETALIAS_CONTRACTID));
-+      nsICharsetAlias* calias(do_GetService(NS_CHARSETALIAS_CONTRACTID));
-       if (calias) {
-         nsCAutoString preferred;
-         rv = calias->GetPreferred(charsetVal,
-@@ -1884,8 +1881,8 @@ nsDocument::doCreateShell(nsPresContext*
- 
-   FillStyleSet(aStyleSet);
-   
--  nsCOMPtr<nsIPresShell> shell;
--  nsresult rv = NS_NewPresShell(getter_AddRefs(shell));
-+  nsIPresShell* shell = nsnull;
-+  nsresult rv = NS_NewPresShell(&shell);
-   if (NS_FAILED(rv)) {
-     return rv;
-   }
-@@ -1896,7 +1893,7 @@ nsDocument::doCreateShell(nsPresContext*
-   // Note: we don't hold a ref to the shell (it holds a ref to us)
-   NS_ENSURE_TRUE(mPresShells.AppendElementUnlessExists(shell),
-                  NS_ERROR_OUT_OF_MEMORY);
--  shell.swap(*aInstancePtrResult);
-+  *aInstancePtrResult = shell;
- 
-   return NS_OK;
- }
-@@ -1935,7 +1932,6 @@ SubDocInitEntry(PLDHashTable *table, PLD
- 
-   e->mKey = const_cast<nsIContent *>
-                       (static_cast<const nsIContent *>(key));
--  NS_ADDREF(e->mKey);
- 
-   e->mSubDocument = nsnull;
-   return PR_TRUE;
-@@ -2000,7 +1996,6 @@ nsDocument::SetSubDocumentFor(nsIContent
-     }
- 
-     entry->mSubDocument = aSubDoc;
--    NS_ADDREF(entry->mSubDocument);
- 
-     aSubDoc->SetParentDocument(this);
-   }
-@@ -2126,7 +2121,7 @@ nsresult
- nsresult
- nsDocument::RemoveChildAt(PRUint32 aIndex, PRBool aNotify)
- {
--  nsCOMPtr<nsIContent> oldKid = GetChildAt(aIndex);
-+  nsIContent* oldKid = GetChildAt(aIndex);
-   if (!oldKid) {
-     return NS_OK;
-   }
-@@ -2165,7 +2160,7 @@ nsDocument::AddStyleSheetToStyleSets(nsI
- nsDocument::AddStyleSheetToStyleSets(nsIStyleSheet* aSheet)
- {
-   nsPresShellIterator iter(this);
--  nsCOMPtr<nsIPresShell> shell;
-+  nsIPresShell* shell = nsnull;
-   while ((shell = iter.GetNextShell())) {
-     shell->StyleSet()->AddDocStyleSheet(aSheet, this);
-   }
-@@ -2192,7 +2187,7 @@ nsDocument::RemoveStyleSheetFromStyleSet
- nsDocument::RemoveStyleSheetFromStyleSets(nsIStyleSheet* aSheet)
- {
-   nsPresShellIterator iter(this);
--  nsCOMPtr<nsIPresShell> shell;
-+  nsIPresShell* shell = nsnull;
-   while ((shell = iter.GetNextShell())) {
-     shell->StyleSet()->RemoveStyleSheet(nsStyleSet::eDocSheet, aSheet);
-   }
-@@ -2202,7 +2197,7 @@ nsDocument::RemoveStyleSheet(nsIStyleShe
- nsDocument::RemoveStyleSheet(nsIStyleSheet* aSheet)
- {
-   NS_PRECONDITION(aSheet, "null arg");
--  nsCOMPtr<nsIStyleSheet> sheet = aSheet; // hold ref so it won't die too soon
-+  nsIStyleSheet* sheet = aSheet; // hold ref so it won't die too soon
- 
-   if (!mStyleSheets.RemoveObject(aSheet)) {
-     NS_NOTREACHED("stylesheet not found");
-@@ -2233,7 +2228,7 @@ nsDocument::UpdateStyleSheets(nsCOMArray
-                   "The lists must be the same length!");
-   PRInt32 count = aOldSheets.Count();
- 
--  nsCOMPtr<nsIStyleSheet> oldSheet;
-+  nsIStyleSheet* oldSheet = nsnull;
-   PRInt32 i;
-   for (i = 0; i < count; ++i) {
-     oldSheet = aOldSheets[i];
-@@ -2331,7 +2326,7 @@ nsDocument::AddCatalogStyleSheet(nsIStyl
-   if (applicable) {
-     // This is like |AddStyleSheetToStyleSets|, but for an agent sheet.
-     nsPresShellIterator iter(this);
--    nsCOMPtr<nsIPresShell> shell;
-+    nsIPresShell* shell = nsnull;
-     while ((shell = iter.GetNextShell())) {
-       shell->StyleSet()->AppendStyleSheet(nsStyleSet::eAgentSheet, aSheet);
-     }
-@@ -2351,8 +2346,8 @@ nsDocument::EnsureCatalogStyleSheet(cons
-       nsIStyleSheet* sheet = GetCatalogStyleSheetAt(i);
-       NS_ASSERTION(sheet, "unexpected null stylesheet in the document");
-       if (sheet) {
--        nsCOMPtr<nsIURI> uri;
--        sheet->GetSheetURI(getter_AddRefs(uri));
-+        nsIURI* uri = nsnull;
-+        sheet->GetSheetURI(&uri);
-         nsCAutoString uriStr;
-         uri->GetSpec(uriStr);
-         if (uriStr.Equals(aStyleSheetURI))
-@@ -2360,11 +2355,11 @@ nsDocument::EnsureCatalogStyleSheet(cons
-       }
-     }
- 
--    nsCOMPtr<nsIURI> uri;
--    NS_NewURI(getter_AddRefs(uri), aStyleSheetURI);
-+    nsIURI* uri = nsnull;
-+    NS_NewURI(&uri, aStyleSheetURI);
-     if (uri) {
--      nsCOMPtr<nsICSSStyleSheet> sheet;
--      cssLoader->LoadSheetSync(uri, PR_TRUE, getter_AddRefs(sheet));
-+      nsICSSStyleSheet* sheet = nsnull;
-+      cssLoader->LoadSheetSync(uri, PR_TRUE, &sheet);
-       if (sheet) {
-         BeginUpdate(UPDATE_STYLE);
-         AddCatalogStyleSheet(sheet);
-@@ -2385,10 +2380,10 @@ nsDocument::GetScriptGlobalObject() cons
-    // object as soon as nsDocumentViewer::Close has called
-    // RemovedFromDocShell on us.
-    if (mRemovedFromDocShell) {
--     nsCOMPtr<nsIInterfaceRequestor> requestor =
-+     nsIInterfaceRequestor* requestor =
-        do_QueryReferent(mDocumentContainer);
-      if (requestor) {
--       nsCOMPtr<nsIScriptGlobalObject> globalObject = do_GetInterface(requestor);
-+       nsIScriptGlobalObject* globalObject = do_GetInterface(requestor);
-        return globalObject;
-      }
-    }
-@@ -2399,7 +2394,7 @@ nsIScriptGlobalObject*
- nsIScriptGlobalObject*
- nsDocument::GetScopeObject()
- {
--  nsCOMPtr<nsIScriptGlobalObject> scope(do_QueryReferent(mScopeObject));
-+  nsIScriptGlobalObject* scope(do_QueryReferent(mScopeObject));
-   return scope;
- }
- 
-@@ -2408,7 +2403,7 @@ nsDocument::SetScriptGlobalObject(nsIScr
- {
- #ifdef DEBUG
-   {
--    nsCOMPtr<nsPIDOMWindow> win(do_QueryInterface(aScriptGlobalObject));
-+    nsPIDOMWindow* win(do_QueryInterface(aScriptGlobalObject));
- 
-     NS_ASSERTION(!win || win->IsInnerWindow(),
-                  "Script global object must be an inner window!");
-@@ -2422,7 +2417,7 @@ nsDocument::SetScriptGlobalObject(nsIScr
- 
-     // Also make sure to remove our onload blocker now if we haven't done it yet
-     if (mOnloadBlockCount != 0) {
--      nsCOMPtr<nsILoadGroup> loadGroup = GetDocumentLoadGroup();
-+      nsILoadGroup* loadGroup = GetDocumentLoadGroup();
-       if (loadGroup) {
-         loadGroup->RemoveRequest(mOnloadBlocker, nsnull, NS_OK);
-       }
-@@ -2440,7 +2435,7 @@ nsDocument::SetScriptGlobalObject(nsIScr
- 
-   // Remember the pointer to our window (or lack there of), to avoid
-   // having to QI every time it's asked for.
--  nsCOMPtr<nsPIDOMWindow> window = do_QueryInterface(mScriptGlobalObject);
-+  nsPIDOMWindow* window = do_QueryInterface(mScriptGlobalObject);
-   mWindow = window;
- }
- 
-@@ -2452,9 +2447,9 @@ nsDocument::GetScriptHandlingObject(PRBo
-     return mScriptGlobalObject;
-   }
- 
--  nsCOMPtr<nsIScriptGlobalObject> scriptHandlingObject =
-+  nsIScriptGlobalObject* scriptHandlingObject =
-     do_QueryReferent(mScriptObject);
--  nsCOMPtr<nsPIDOMWindow> win = do_QueryInterface(scriptHandlingObject);
-+  nsPIDOMWindow* win = do_QueryInterface(scriptHandlingObject);
-   if (win) {
-     NS_ASSERTION(win->IsInnerWindow(), "Should have inner window here!");
-     nsPIDOMWindow* outer = win->GetOuterWindow();
-@@ -2471,7 +2466,7 @@ nsDocument::SetScriptHandlingObject(nsIS
-   NS_ASSERTION(!mScriptGlobalObject ||
-                mScriptGlobalObject == aScriptObject,
-                "Wrong script object!");
--  nsCOMPtr<nsPIDOMWindow> win = do_QueryInterface(aScriptObject);
-+  nsPIDOMWindow* win = do_QueryInterface(aScriptObject);
-   NS_ASSERTION(!win || win->IsInnerWindow(), "Should have inner window here!");
-   mScriptObject = do_GetWeakReference(aScriptObject);
-   if (aScriptObject) {
-@@ -2486,7 +2481,7 @@ nsDocument::GetWindow()
-     return mWindow->GetOuterWindow();
-   }
- 
--  nsCOMPtr<nsPIDOMWindow> win(do_QueryInterface(GetScriptGlobalObject()));
-+  nsPIDOMWindow* win(do_QueryInterface(GetScriptGlobalObject()));
- 
-   if (!win) {
-     return nsnull;
-@@ -2498,7 +2493,7 @@ nsPIDOMWindow *
- nsPIDOMWindow *
- nsDocument::GetInnerWindow()
- {
--  nsCOMPtr<nsPIDOMWindow> win(do_QueryInterface(GetScriptGlobalObject()));
-+  nsPIDOMWindow* win(do_QueryInterface(GetScriptGlobalObject()));
- 
-   return win;
- }
-@@ -2623,7 +2618,7 @@ nsDocument::DispatchContentLoadedEvents(
-   // target_frame is the [i]frame element that will be used as the
-   // target for the event. It's the [i]frame whose content is done
-   // loading.
--  nsCOMPtr<nsIDOMEventTarget> target_frame;
-+  nsIDOMEventTarget* target_frame = nsnull;
- 
-   if (mParentDocument) {
-     target_frame =
-@@ -2631,16 +2626,16 @@ nsDocument::DispatchContentLoadedEvents(
-   }
- 
-   if (target_frame) {
--    nsCOMPtr<nsIDocument> parent = mParentDocument;
-+    nsIDocument* parent = mParentDocument;
-     do {
--      nsCOMPtr<nsIDOMDocumentEvent> document_event =
-+      nsIDOMDocumentEvent* document_event =
-         do_QueryInterface(parent);
- 
--      nsCOMPtr<nsIDOMEvent> event;
--      nsCOMPtr<nsIPrivateDOMEvent> privateEvent;
-+      nsIDOMEvent* event = nsnull;
-+      nsIPrivateDOMEvent* privateEvent = nsnull;
-       if (document_event) {
-         document_event->CreateEvent(NS_LITERAL_STRING("Events"),
--                                    getter_AddRefs(event));
-+                                    &event);
- 
-         privateEvent = do_QueryInterface(event);
-       }
-@@ -2665,7 +2660,7 @@ nsDocument::DispatchContentLoadedEvents(
- 
-           nsIPresShell *shell = parent->GetPrimaryShell();
-           if (shell) {
--            nsCOMPtr<nsPresContext> context = shell->GetPresContext();
-+            nsPresContext* context = shell->GetPresContext();
- 
-             if (context) {
-               nsEventDispatcher::Dispatch(parent, context, innerEvent, event,
-@@ -2695,7 +2690,7 @@ nsDocument::EndLoad()
-   
-   NS_DOCUMENT_NOTIFY_OBSERVERS(EndLoad, (this));
- 
--  nsRefPtr<nsIRunnable> ev =
-+  nsIRunnable* ev =
-     new nsRunnableMethod<nsDocument>(this,
-                                      &nsDocument::DispatchContentLoadedEvents);
-   NS_DispatchToCurrentThread(ev);
-@@ -2770,8 +2765,8 @@ nsDocument::GetImplementation(nsIDOMDOMI
- {
-   // For now, create a new implementation every time. This shouldn't
-   // be a high bandwidth operation
--  nsCOMPtr<nsIURI> uri;
--  NS_NewURI(getter_AddRefs(uri), "about:blank");
-+  nsIURI* uri = nsnull;
-+  NS_NewURI(&uri, "about:blank");
-   NS_ENSURE_TRUE(uri, NS_ERROR_OUT_OF_MEMORY);
-   PRBool hasHadScriptObject = PR_TRUE;
-   nsIScriptGlobalObject* scriptObject =
-@@ -2783,7 +2778,6 @@ nsDocument::GetImplementation(nsIDOMDOMI
-     return NS_ERROR_OUT_OF_MEMORY;
-   }
- 
--  NS_ADDREF(*aImplementation);
- 
-   return NS_OK;
- }
-@@ -2817,11 +2811,11 @@ nsDocument::CreateElement(const nsAStrin
-                "case sensitive. Fix caller, or fix "
-                "nsDocument::CreateElement()!");
- 
--  nsCOMPtr<nsIAtom> name = do_GetAtom(aTagName);
--
--  nsCOMPtr<nsIContent> content;
-+  nsIAtom* name = do_GetAtom(aTagName);
-+
-+  nsIContent* content = nsnull;
-   rv = CreateElem(name, nsnull, GetDefaultNamespaceID(), PR_TRUE,
--                  getter_AddRefs(content));
-+                  &content);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
-   return CallQueryInterface(content, aReturn);
-@@ -2834,15 +2828,15 @@ nsDocument::CreateElementNS(const nsAStr
- {
-   *aReturn = nsnull;
- 
--  nsCOMPtr<nsINodeInfo> nodeInfo;
-+  nsINodeInfo* nodeInfo = nsnull;
-   nsresult rv = nsContentUtils::GetNodeInfoFromQName(aNamespaceURI,
-                                                      aQualifiedName,
-                                                      mNodeInfoManager,
--                                                     getter_AddRefs(nodeInfo));
--  NS_ENSURE_SUCCESS(rv, rv);
--
--  nsCOMPtr<nsIContent> content;
--  NS_NewElement(getter_AddRefs(content), nodeInfo->NamespaceID(), nodeInfo,
-+                                                     &nodeInfo);
-+  NS_ENSURE_SUCCESS(rv, rv);
-+
-+  nsIContent* content = nsnull;
-+  NS_NewElement(&content, nodeInfo->NamespaceID(), nodeInfo,
-                 PR_FALSE);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
-@@ -2854,8 +2848,8 @@ nsDocument::CreateTextNode(const nsAStri
- {
-   *aReturn = nsnull;
- 
--  nsCOMPtr<nsIContent> text;
--  nsresult rv = NS_NewTextNode(getter_AddRefs(text), mNodeInfoManager);
-+  nsIContent* text = nsnull;
-+  nsresult rv = NS_NewTextNode(&text, mNodeInfoManager);
- 
-   if (NS_SUCCEEDED(rv)) {
-     // Don't notify; this node is still being created.
-@@ -2884,8 +2878,8 @@ nsDocument::CreateComment(const nsAStrin
-     return NS_ERROR_DOM_INVALID_CHARACTER_ERR;
-   }
- 
--  nsCOMPtr<nsIContent> comment;
--  nsresult rv = NS_NewCommentNode(getter_AddRefs(comment), mNodeInfoManager);
-+  nsIContent* comment = nsnull;
-+  nsresult rv = NS_NewCommentNode(&comment, mNodeInfoManager);
- 
-   if (NS_SUCCEEDED(rv)) {
-     // Don't notify; this node is still being created.
-@@ -2907,8 +2901,8 @@ nsDocument::CreateCDATASection(const nsA
-   if (FindInReadable(NS_LITERAL_STRING("]]>"), aData))
-     return NS_ERROR_DOM_INVALID_CHARACTER_ERR;
- 
--  nsCOMPtr<nsIContent> content;
--  nsresult rv = NS_NewXMLCDATASection(getter_AddRefs(content),
-+  nsIContent* content = nsnull;
-+  nsresult rv = NS_NewXMLCDATASection(&content,
-                                       mNodeInfoManager);
- 
-   if (NS_SUCCEEDED(rv)) {
-@@ -2935,8 +2929,8 @@ nsDocument::CreateProcessingInstruction(
-     return NS_ERROR_DOM_INVALID_CHARACTER_ERR;
-   }
- 
--  nsCOMPtr<nsIContent> content;
--  rv = NS_NewXMLProcessingInstruction(getter_AddRefs(content),
-+  nsIContent* content = nsnull;
-+  rv = NS_NewXMLProcessingInstruction(&content,
-                                       mNodeInfoManager, aTarget, aData);
-   if (NS_FAILED(rv)) {
-     return rv;
-@@ -2958,9 +2952,9 @@ nsDocument::CreateAttribute(const nsAStr
-   nsAutoString value;
-   nsDOMAttribute* attribute;
- 
--  nsCOMPtr<nsINodeInfo> nodeInfo;
-+  nsINodeInfo* nodeInfo = nsnull;
-   rv = mNodeInfoManager->GetNodeInfo(aName, nsnull, kNameSpaceID_None,
--                                     getter_AddRefs(nodeInfo));
-+                                     &nodeInfo);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
-   attribute = new nsDOMAttribute(nsnull, nodeInfo, value);
-@@ -2977,11 +2971,11 @@ nsDocument::CreateAttributeNS(const nsAS
-   NS_ENSURE_ARG_POINTER(aResult);
-   *aResult = nsnull;
- 
--  nsCOMPtr<nsINodeInfo> nodeInfo;
-+  nsINodeInfo* nodeInfo = nsnull;
-   nsresult rv = nsContentUtils::GetNodeInfoFromQName(aNamespaceURI,
-                                                      aQualifiedName,
-                                                      mNodeInfoManager,
--                                                     getter_AddRefs(nodeInfo));
-+                                                     &nodeInfo);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
-   nsAutoString value;
-@@ -3005,10 +2999,10 @@ nsDocument::GetElementsByTagName(const n
- nsDocument::GetElementsByTagName(const nsAString& aTagname,
-                                  nsIDOMNodeList** aReturn)
- {
--  nsCOMPtr<nsIAtom> nameAtom = do_GetAtom(aTagname);
-+  nsIAtom* nameAtom = do_GetAtom(aTagname);
-   NS_ENSURE_TRUE(nameAtom, NS_ERROR_OUT_OF_MEMORY);
- 
--  nsContentList *list = NS_GetContentList(this, nameAtom, kNameSpaceID_Unknown).get();
-+  nsContentList *list = NS_GetContentList(this, nameAtom, kNameSpaceID_Unknown);
-   NS_ENSURE_TRUE(list, NS_ERROR_OUT_OF_MEMORY);
- 
-   // transfer ref to aReturn
-@@ -3030,10 +3024,10 @@ nsDocument::GetElementsByTagNameNS(const
-     NS_ENSURE_SUCCESS(rv, rv);
-   }
- 
--  nsCOMPtr<nsIAtom> nameAtom = do_GetAtom(aLocalName);
-+  nsIAtom* nameAtom = do_GetAtom(aLocalName);
-   NS_ENSURE_TRUE(nameAtom, NS_ERROR_OUT_OF_MEMORY);
- 
--  nsContentList *list = NS_GetContentList(this, nameAtom, nameSpaceId).get();
-+  nsContentList *list = NS_GetContentList(this, nameAtom, nameSpaceId);
-   NS_ENSURE_TRUE(list, NS_ERROR_OUT_OF_MEMORY);
- 
-   // transfer ref to aReturn
-@@ -3101,7 +3095,6 @@ nsDocument::GetStyleSheets(nsIDOMStyleSh
-   }
- 
-   *aStyleSheets = mDOMStyleSheets;
--  NS_ADDREF(*aStyleSheets);
- 
-   return NS_OK;
- }
-@@ -3118,7 +3111,7 @@ nsDocument::GetSelectedStyleSheetSet(nsA
-     nsIStyleSheet* sheet = GetStyleSheetAt(index);
-     NS_ASSERTION(sheet, "Null sheet in sheet list!");
- 
--    nsCOMPtr<nsIDOMStyleSheet> domSheet = do_QueryInterface(sheet);
-+    nsIDOMStyleSheet* domSheet = do_QueryInterface(sheet);
-     NS_ASSERTION(domSheet, "Sheet must QI to nsIDOMStyleSheet");
-     PRBool disabled;
-     domSheet->GetDisabled(&disabled);
-@@ -3179,7 +3172,7 @@ nsDocument::GetStyleSheetSets(nsIDOMDOMS
-     }
-   }
- 
--  NS_ADDREF(*aList = mStyleSheetSetList);
-+  *aList = mStyleSheetSetList;
-   return NS_OK;
- }
- 
-@@ -3251,13 +3244,13 @@ nsDocument::ImportNode(nsIDOMNode* aImpo
-     case nsIDOMNode::CDATA_SECTION_NODE:
-     case nsIDOMNode::COMMENT_NODE:
-     {
--      nsCOMPtr<nsINode> imported = do_QueryInterface(aImportedNode);
-+      nsINode* imported = do_QueryInterface(aImportedNode);
-       NS_ENSURE_TRUE(imported, NS_ERROR_FAILURE);
- 
--      nsCOMPtr<nsIDOMNode> newNode;
-+      nsIDOMNode* newNode = nsnull;
-       nsCOMArray<nsINode> nodesWithProperties;
-       rv = nsNodeUtils::Clone(imported, aDeep, mNodeInfoManager,
--                              nodesWithProperties, getter_AddRefs(newNode));
-+                              nodesWithProperties, &newNode);
-       NS_ENSURE_SUCCESS(rv, rv);
- 
-       nsIDocument *ownerDoc = imported->GetOwnerDoc();
-@@ -3268,7 +3261,7 @@ nsDocument::ImportNode(nsIDOMNode* aImpo
-         NS_ENSURE_SUCCESS(rv, rv);
-       }
- 
--      newNode.swap(*aResult);
-+      swap(newNode, *aResult);
- 
-       return NS_OK;
-     }
-@@ -3297,19 +3290,19 @@ nsDocument::AddBinding(nsIDOMElement* aC
-     return rv;
-   }
- 
--  nsCOMPtr<nsIContent> content(do_QueryInterface(aContent));
--
--  nsCOMPtr<nsIURI> uri;
--  rv = NS_NewURI(getter_AddRefs(uri), aURI);
-+  nsIContent* content(do_QueryInterface(aContent));
-+
-+  nsIURI* uri = nsnull;
-+  rv = NS_NewURI(&uri, aURI);
-   if (NS_FAILED(rv)) {
-     return rv;
-   }
- 
-   // Figure out the right principal to use
--  nsCOMPtr<nsIPrincipal> subject;
-+  nsIPrincipal* subject = nsnull;
-   nsIScriptSecurityManager* secMan = nsContentUtils::GetSecurityManager();
-   if (secMan) {
--    rv = secMan->GetSubjectPrincipal(getter_AddRefs(subject));
-+    rv = secMan->GetSubjectPrincipal(&subject);
-     NS_ENSURE_SUCCESS(rv, rv);
-   }
- 
-@@ -3332,30 +3325,30 @@ nsDocument::RemoveBinding(nsIDOMElement*
-     return rv;
-   }
- 
--  nsCOMPtr<nsIURI> uri;
--  rv = NS_NewURI(getter_AddRefs(uri), aURI);
--  if (NS_FAILED(rv)) {
--    return rv;
--  }
--
--  nsCOMPtr<nsIContent> content(do_QueryInterface(aContent));
-+  nsIURI* uri = nsnull;
-+  rv = NS_NewURI(&uri, aURI);
-+  if (NS_FAILED(rv)) {
-+    return rv;
-+  }
-+
-+  nsIContent* content(do_QueryInterface(aContent));
-   return BindingManager()->RemoveLayeredBinding(content, uri);
- }
- 
- NS_IMETHODIMP
- nsDocument::LoadBindingDocument(const nsAString& aURI)
- {
--  nsCOMPtr<nsIURI> uri;
--  nsresult rv = NS_NewURI(getter_AddRefs(uri), aURI,
-+  nsIURI* uri = nsnull;
-+  nsresult rv = NS_NewURI(&uri, aURI,
-                           mCharacterSet.get(),
-                           static_cast<nsIDocument *>(this)->GetBaseURI());
-   NS_ENSURE_SUCCESS(rv, rv);
- 
-   // Figure out the right principal to use
--  nsCOMPtr<nsIPrincipal> subject;
-+  nsIPrincipal* subject = nsnull;
-   nsIScriptSecurityManager* secMan = nsContentUtils::GetSecurityManager();
-   if (secMan) {
--    rv = secMan->GetSubjectPrincipal(getter_AddRefs(subject));
-+    rv = secMan->GetSubjectPrincipal(&subject);
-     NS_ENSURE_SUCCESS(rv, rv);
-   }
- 
-@@ -3374,12 +3367,12 @@ nsDocument::GetBindingParent(nsIDOMNode*
- nsDocument::GetBindingParent(nsIDOMNode* aNode, nsIDOMElement** aResult)
- {
-   *aResult = nsnull;
--  nsCOMPtr<nsIContent> content(do_QueryInterface(aNode));
-+  nsIContent* content(do_QueryInterface(aNode));
-   if (!content)
-     return NS_ERROR_FAILURE;
- 
--  nsCOMPtr<nsIDOMElement> elt(do_QueryInterface(content->GetBindingParent()));
--  NS_IF_ADDREF(*aResult = elt);
-+  nsIDOMElement* elt(do_QueryInterface(content->GetBindingParent()));
-+  *aResult = elt;
-   return NS_OK;
- }
- 
-@@ -3417,13 +3410,13 @@ nsDocument::GetAnonymousElementByAttribu
- {
-   *aResult = nsnull;
- 
--  nsCOMPtr<nsIDOMNodeList> nodeList;
--  GetAnonymousNodes(aElement, getter_AddRefs(nodeList));
-+  nsIDOMNodeList* nodeList = nsnull;
-+  GetAnonymousNodes(aElement, &nodeList);
- 
-   if (!nodeList)
-     return NS_OK;
- 
--  nsCOMPtr<nsIAtom> attribute = do_GetAtom(aAttrName);
-+  nsIAtom* attribute = do_GetAtom(aAttrName);
- 
-   PRUint32 length;
-   nodeList->GetLength(&length);
-@@ -3431,10 +3424,10 @@ nsDocument::GetAnonymousElementByAttribu
-   PRBool universalMatch = aAttrValue.EqualsLiteral("*");
- 
-   for (PRUint32 i = 0; i < length; ++i) {
--    nsCOMPtr<nsIDOMNode> current;
--    nodeList->Item(i, getter_AddRefs(current));
--
--    nsCOMPtr<nsIContent> content(do_QueryInterface(current));
-+    nsIDOMNode* current = nsnull;
-+    nodeList->Item(i, &current);
-+
-+    nsIContent* content(do_QueryInterface(current));
- 
-     GetElementByAttribute(content, attribute, aAttrValue, universalMatch,
-                           aResult);
-@@ -3452,7 +3445,7 @@ nsDocument::GetAnonymousNodes(nsIDOMElem
- {
-   *aResult = nsnull;
- 
--  nsCOMPtr<nsIContent> content(do_QueryInterface(aElement));
-+  nsIContent* content(do_QueryInterface(aElement));
-   return BindingManager()->GetAnonymousNodesFor(content, aResult);
- }
- 
-@@ -3521,7 +3514,7 @@ nsDocument::GetLocation(nsIDOMLocation *
-   NS_ENSURE_ARG_POINTER(_retval);
-   *_retval = nsnull;
- 
--  nsCOMPtr<nsIDOMWindowInternal> w(do_QueryInterface(mScriptGlobalObject));
-+  nsIDOMWindowInternal* w(do_QueryInterface(mScriptGlobalObject));
- 
-   if (!w) {
-     return NS_OK;
-@@ -3545,13 +3538,13 @@ nsDocument::SetTitle(const nsAString& aT
- nsDocument::SetTitle(const nsAString& aTitle)
- {
-   nsPresShellIterator iter(this);
--  nsCOMPtr<nsIPresShell> shell;
-+  nsIPresShell* shell = nsnull;
-   while ((shell = iter.GetNextShell())) {
--    nsCOMPtr<nsISupports> container = shell->GetPresContext()->GetContainer();
-+    nsISupports* container = shell->GetPresContext()->GetContainer();
-     if (!container)
-       continue;
- 
--    nsCOMPtr<nsIBaseWindow> docShellWin = do_QueryInterface(container);
-+    nsIBaseWindow* docShellWin = do_QueryInterface(container);
-     if (!docShellWin)
-       continue;
- 
-@@ -3572,7 +3565,7 @@ NS_IMETHODIMP
- NS_IMETHODIMP
- nsDocument::GetBoxObjectFor(nsIDOMElement* aElement, nsIBoxObject** aResult)
- {
--  nsCOMPtr<nsIContent> content(do_QueryInterface(aElement));
-+  nsIContent* content(do_QueryInterface(aElement));
-   NS_ENSURE_TRUE(content, NS_ERROR_UNEXPECTED);
- 
-   nsIDocument* doc = content->GetOwnerDoc();
-@@ -3601,13 +3594,12 @@ nsDocument::GetBoxObjectFor(nsIDOMElemen
-     // Want to use Get(content, aResult); but it's the wrong type
-     *aResult = mBoxObjectTable->GetWeak(content);
-     if (*aResult) {
--      NS_ADDREF(*aResult);
-       return NS_OK;
-     }
-   }
- 
-   PRInt32 namespaceID;
--  nsCOMPtr<nsIAtom> tag = BindingManager()->ResolveTag(content, &namespaceID);
-+  nsIAtom* tag = BindingManager()->ResolveTag(content, &namespaceID);
- 
-   nsCAutoString contractID("@mozilla.org/layout/xul-boxobject");
-   if (namespaceID == kNameSpaceID_XUL) {
-@@ -3631,18 +3623,17 @@ nsDocument::GetBoxObjectFor(nsIDOMElemen
-   }
-   contractID += ";1";
- 
--  nsCOMPtr<nsPIBoxObject> boxObject(do_CreateInstance(contractID.get()));
-+  nsPIBoxObject* boxObject(do_CreateInstance(contractID.get()));
-   if (!boxObject)
-     return NS_ERROR_FAILURE;
- 
-   boxObject->Init(content);
- 
-   if (mBoxObjectTable) {
--    mBoxObjectTable->Put(content, boxObject.get());
-+    mBoxObjectTable->Put(content, boxObject);
-   }
- 
-   *aResult = boxObject;
--  NS_ADDREF(*aResult);
- 
-   return NS_OK;
- }
-@@ -3688,7 +3679,7 @@ nsDocument::InitializeFrameLoader(nsFram
-     return NS_ERROR_FAILURE;
-   }
-   if (mUpdateNestLevel == 0 && !mDelayFrameLoaderInitialization) {
--    nsRefPtr<nsFrameLoader> loader = aLoader;
-+    nsFrameLoader* loader = aLoader;
-     return loader->ReallyStartLoading();
-   } else {
-     mInitializableFrameLoaders.AppendElement(aLoader);
-@@ -3704,7 +3695,7 @@ nsDocument::FinalizeFrameLoader(nsFrameL
-     return NS_ERROR_FAILURE;
-   }
-   if (mUpdateNestLevel == 0) {
--    nsRefPtr<nsFrameLoader> loader = aLoader;
-+    nsFrameLoader* loader = aLoader;
-     loader->Finalize();
-   } else {
-     mFinalizableFrameLoaders.AppendElement(aLoader);
-@@ -3721,7 +3712,7 @@ nsDocument::InitializeFinalizeFrameLoade
-   // loading a frame may cause some other frameloader to be removed from the
-   // array. But be careful to keep the loader alive when starting the load!
-   while (mInitializableFrameLoaders.Length()) {
--    nsRefPtr<nsFrameLoader> loader = mInitializableFrameLoaders[0];
-+    nsFrameLoader* loader = mInitializableFrameLoaders[0];
-     mInitializableFrameLoaders.RemoveElementAt(0);
-     NS_ASSERTION(loader, "null frameloader in the array?");
-     loader->ReallyStartLoading();
-@@ -3878,10 +3869,9 @@ nsDocument::GetChildNodes(nsIDOMNodeList
-   if (!slots->mChildNodes) {
-     slots->mChildNodes = new nsChildContentList(this);
-     NS_ENSURE_TRUE(slots->mChildNodes, NS_ERROR_OUT_OF_MEMORY);
--    NS_ADDREF(slots->mChildNodes);
--  }
--
--  NS_ADDREF(*aChildNodes = slots->mChildNodes);
-+  }
-+
-+  *aChildNodes = slots->mChildNodes;
- 
-   return NS_OK;
- }
-@@ -4027,7 +4017,7 @@ nsDocument::Normalize()
- {
-   PRInt32 count = mChildren.ChildCount();
-   for (PRInt32 i = 0; i < count; ++i) {
--    nsCOMPtr<nsIDOMNode> node(do_QueryInterface(mChildren.ChildAt(i)));
-+    nsIDOMNode* node(do_QueryInterface(mChildren.ChildAt(i)));
- 
-     if (node) {
-       node->Normalize();
-@@ -4083,7 +4073,7 @@ nsDocument::CompareDocumentPosition(nsID
-   // current document being null and such so it's easier this way.
-   // It's hardly a case to optimize anyway.
- 
--  nsCOMPtr<nsINode> other = do_QueryInterface(aOther);
-+  nsINode* other = do_QueryInterface(aOther);
-   NS_ENSURE_TRUE(other, NS_ERROR_DOM_NOT_SUPPORTED_ERR);
- 
-   *aReturn = nsContentUtils::ComparePosition(other, this);
-@@ -4112,7 +4102,7 @@ nsDocument::IsEqualNode(nsIDOMNode* aOth
-   *aReturn = PR_FALSE;
- 
-   // Node type check by QI.  We also reuse this later.
--  nsCOMPtr<nsIDocument> aOtherDoc = do_QueryInterface(aOther);
-+  nsIDocument* aOtherDoc = do_QueryInterface(aOther);
-   if (!aOtherDoc) {
-     return NS_OK;
-   }
-@@ -4178,7 +4168,7 @@ nsDocument::LookupPrefix(const nsAString
- nsDocument::LookupPrefix(const nsAString& aNamespaceURI,
-                          nsAString& aPrefix)
- {
--  nsCOMPtr<nsIDOM3Node> root(do_QueryInterface(GetRootContent()));
-+  nsIDOM3Node* root(do_QueryInterface(GetRootContent()));
-   if (root) {
-     return root->LookupPrefix(aNamespaceURI, aPrefix);
-   }
-@@ -4301,7 +4291,7 @@ BlastFunc(nsAttrHashKey::KeyType aKey, n
- 
-   *attr = do_QueryInterface(aData);
- 
--  NS_ASSERTION(attr->get(),
-+  NS_ASSERTION(attr,
-                "non-nsIAttribute somehow made it into the hashmap?!");
- 
-   return PL_DHASH_STOP;
-@@ -4315,7 +4305,7 @@ BlastSubtreeToPieces(nsINode *aNode)
-     nsGenericElement *element = static_cast<nsGenericElement*>(aNode);
-     const nsDOMAttributeMap *map = element->GetAttributeMap();
-     if (map) {
--      nsCOMPtr<nsIAttribute> attr;
-+      nsIAttribute* attr = nsnull;
-       while (map->Enumerate(BlastFunc, &attr) > 0) {
-         BlastSubtreeToPieces(attr);
- 
-@@ -4350,27 +4340,27 @@ nsDocument::AdoptNode(nsIDOMNode *aAdopt
-   nsresult rv = nsContentUtils::CheckSameOrigin(this, aAdoptedNode);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
--  nsCOMPtr<nsINode> adoptedNode;
-+  nsINode* adoptedNode = nsnull;
-   PRUint16 nodeType;
-   aAdoptedNode->GetNodeType(&nodeType);
-   switch (nodeType) {
-     case nsIDOMNode::ATTRIBUTE_NODE:
-     {
-       // Remove from ownerElement.
--      nsCOMPtr<nsIDOMAttr> adoptedAttr = do_QueryInterface(aAdoptedNode, &rv);
--      NS_ENSURE_SUCCESS(rv, rv);
--
--      nsCOMPtr<nsIDOMElement> ownerElement;
--      rv = adoptedAttr->GetOwnerElement(getter_AddRefs(ownerElement));
-+      nsIDOMAttr* adoptedAttr = do_QueryInterface(aAdoptedNode, &rv);
-+      NS_ENSURE_SUCCESS(rv, rv);
-+
-+      nsIDOMElement* ownerElement = nsnull;
-+      rv = adoptedAttr->GetOwnerElement(&ownerElement);
-       NS_ENSURE_SUCCESS(rv, rv);
- 
-       if (ownerElement) {
--        nsCOMPtr<nsIDOMAttr> newAttr;
-+        nsIDOMAttr* newAttr = nsnull;
-         rv = ownerElement->RemoveAttributeNode(adoptedAttr,
--                                               getter_AddRefs(newAttr));
-+                                               &newAttr);
-         NS_ENSURE_SUCCESS(rv, rv);
- 
--        newAttr.swap(adoptedAttr);
-+        swap(newAttr, adoptedAttr);
-       }
- 
-       adoptedNode = do_QueryInterface(adoptedAttr, &rv);
-@@ -4395,7 +4385,7 @@ nsDocument::AdoptNode(nsIDOMNode *aAdopt
-       do {
-         nsPIDOMWindow *win = doc->GetWindow();
-         if (win) {
--          nsCOMPtr<nsINode> node =
-+          nsINode* node =
-             do_QueryInterface(win->GetFrameElementInternal());
-           if (node &&
-               nsContentUtils::ContentIsDescendantOf(node, adoptedNode)) {
-@@ -4405,13 +4395,13 @@ nsDocument::AdoptNode(nsIDOMNode *aAdopt
-       } while ((doc = doc->GetParentDocument()));
- 
-       // Remove from parent.
--      nsCOMPtr<nsIDOMNode> parent;
--      aAdoptedNode->GetParentNode(getter_AddRefs(parent));
-+      nsIDOMNode* parent = nsnull;
-+      aAdoptedNode->GetParentNode(&parent);
-       NS_ENSURE_SUCCESS(rv, rv);
- 
-       if (parent) {
--        nsCOMPtr<nsIDOMNode> newChild;
--        rv = parent->RemoveChild(aAdoptedNode, getter_AddRefs(newChild));
-+        nsIDOMNode* newChild = nsnull;
-+        rv = parent->RemoveChild(aAdoptedNode, &newChild);
-         NS_ENSURE_SUCCESS(rv, rv);
-       }
- 
-@@ -4534,7 +4524,6 @@ nsDocument::GetListenerManager(PRBool aC
- {
-   if (mListenerManager) {
-     *aInstancePtrResult = mListenerManager;
--    NS_ADDREF(*aInstancePtrResult);
- 
-     return NS_OK;
-   }
-@@ -4549,7 +4538,6 @@ nsDocument::GetListenerManager(PRBool aC
-   mListenerManager->SetListenerTarget(static_cast<nsIDocument *>(this));
- 
-   *aInstancePtrResult = mListenerManager;
--  NS_ADDREF(*aInstancePtrResult);
- 
-   return NS_OK;
- }
-@@ -4557,8 +4545,8 @@ nsresult
- nsresult
- nsDocument::GetSystemEventGroup(nsIDOMEventGroup **aGroup)
- {
--  nsCOMPtr<nsIEventListenerManager> manager;
--  if (NS_SUCCEEDED(GetListenerManager(PR_TRUE, getter_AddRefs(manager))) &&
-+  nsIEventListenerManager* manager = nsnull;
-+  if (NS_SUCCEEDED(GetListenerManager(PR_TRUE, &manager)) &&
-       manager) {
-     return manager->GetSystemEventGroupLM(aGroup);
-   }
-@@ -4602,9 +4590,9 @@ nsDocument::AddEventListenerByIID(nsIDOM
- nsDocument::AddEventListenerByIID(nsIDOMEventListener *aListener,
-                                   const nsIID& aIID)
- {
--  nsCOMPtr<nsIEventListenerManager> manager;
--
--  GetListenerManager(PR_TRUE, getter_AddRefs(manager));
-+  nsIEventListenerManager* manager = nsnull;
-+
-+  GetListenerManager(PR_TRUE, &manager);
-   if (manager) {
-     manager->AddEventListenerByIID(aListener, aIID, NS_EVENT_FLAG_BUBBLE);
-     return NS_OK;
-@@ -4648,7 +4636,7 @@ nsDocument::DispatchEvent(nsIDOMEvent* a
- {
-   // Obtain a presentation context
-   nsIPresShell *shell = GetPrimaryShell();
--  nsCOMPtr<nsPresContext> context;
-+  nsPresContext* context = nsnull;
-   if (shell) {
-      context = shell->GetPresContext();
-   }
-@@ -4668,9 +4656,9 @@ nsDocument::AddGroupedEventListener(cons
-                                     PRBool aUseCapture,
-                                     nsIDOMEventGroup *aEvtGrp)
- {
--  nsCOMPtr<nsIEventListenerManager> manager;
--
--  nsresult rv = GetListenerManager(PR_TRUE, getter_AddRefs(manager));
-+  nsIEventListenerManager* manager = nsnull;
-+
-+  nsresult rv = GetListenerManager(PR_TRUE, &manager);
-   if (NS_SUCCEEDED(rv) && manager) {
-     PRInt32 flags = aUseCapture ? NS_EVENT_FLAG_CAPTURE : NS_EVENT_FLAG_BUBBLE;
- 
-@@ -4715,8 +4703,8 @@ nsDocument::AddEventListener(const nsASt
-                              nsIDOMEventListener *aListener,
-                              PRBool aUseCapture, PRBool aWantsUntrusted)
- {
--  nsCOMPtr<nsIEventListenerManager> manager;
--  nsresult rv = GetListenerManager(PR_TRUE, getter_AddRefs(manager));
-+  nsIEventListenerManager* manager = nsnull;
-+  nsresult rv = GetListenerManager(PR_TRUE, &manager);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
-   PRInt32 flags = aUseCapture ? NS_EVENT_FLAG_CAPTURE : NS_EVENT_FLAG_BUBBLE;
-@@ -4754,11 +4742,10 @@ nsDocument::CreateEventGroup(nsIDOMEvent
- nsDocument::CreateEventGroup(nsIDOMEventGroup **aInstancePtrResult)
- {
-   nsresult rv;
--  nsCOMPtr<nsIDOMEventGroup> group(do_CreateInstance(kDOMEventGroupCID, &rv));
-+  nsIDOMEventGroup* group(do_CreateInstance(kDOMEventGroupCID, &rv));
-   NS_ENSURE_SUCCESS(rv, rv);
- 
-   *aInstancePtrResult = group;
--  NS_ADDREF(*aInstancePtrResult);
- 
-   return NS_OK;
- }
-@@ -4766,7 +4753,7 @@ void
- void
- nsDocument::FlushPendingNotifications(mozFlushType aType)
- {
--  nsCOMPtr<nsIContentSink> sink;
-+  nsIContentSink* sink = nsnull;
-   if (mParser) {
-     sink = mParser->GetContentSink();
-   } else {
-@@ -4797,7 +4784,7 @@ nsDocument::FlushPendingNotifications(mo
-   }
- 
-   nsPresShellIterator iter(this);
--  nsCOMPtr<nsIPresShell> shell;
-+  nsIPresShell* shell = nsnull;
-   while ((shell = iter.GetNextShell())) {
-     shell->FlushPendingNotifications(aType);
-   }
-@@ -4907,7 +4894,7 @@ PRBool
- PRBool
- nsDocument::IsScriptEnabled()
- {
--  nsCOMPtr<nsIScriptSecurityManager> sm(do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID));
-+  nsIScriptSecurityManager* sm(do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID));
-   NS_ENSURE_TRUE(sm, PR_TRUE);
- 
-   nsIScriptGlobalObject* globalObject = GetScriptGlobalObject();
-@@ -4966,7 +4953,6 @@ nsDocument::GetCurrentRadioButton(const 
-   GetRadioGroup(aName, &radioGroup);
-   if (radioGroup) {
-     *aRadio = radioGroup->mSelectedRadioButton;
--    NS_IF_ADDREF(*aRadio);
-   }
- 
-   return NS_OK;
-@@ -4989,7 +4975,7 @@ nsDocument::GetPositionInGroup(nsIDOMHTM
-   nsresult rv = GetRadioGroup(name, &radioGroup);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
--  nsCOMPtr<nsIFormControl> radioControl(do_QueryInterface(aRadio));
-+  nsIFormControl* radioControl(do_QueryInterface(aRadio));
-   NS_ASSERTION(radioControl, "Radio button should implement nsIFormControl");
-   *aPositionIndex = radioGroup->mRadioButtons.IndexOf(radioControl);
-   NS_ASSERTION(*aPositionIndex >= 0, "Radio button not found in its own group");
-@@ -5018,7 +5004,7 @@ nsDocument::GetNextRadioButton(const nsA
- 
-   // Return the radio button relative to the focused radio button.
-   // If no radio is focused, get the radio relative to the selected one.
--  nsCOMPtr<nsIDOMHTMLInputElement> currentRadio;
-+  nsIDOMHTMLInputElement* currentRadio = nsnull;
-   if (aFocusedRadio) {
-     currentRadio = aFocusedRadio;
-   }
-@@ -5028,7 +5014,7 @@ nsDocument::GetNextRadioButton(const nsA
-       return NS_ERROR_FAILURE;
-     }
-   }
--  nsCOMPtr<nsIFormControl> radioControl(do_QueryInterface(currentRadio));
-+  nsIFormControl* radioControl(do_QueryInterface(currentRadio));
-   PRInt32 index = radioGroup->mRadioButtons.IndexOf(radioControl);
-   if (index < 0) {
-     return NS_ERROR_FAILURE;
-@@ -5036,7 +5022,7 @@ nsDocument::GetNextRadioButton(const nsA
- 
-   PRInt32 numRadios = radioGroup->mRadioButtons.Count();
-   PRBool disabled;
--  nsCOMPtr<nsIDOMHTMLInputElement> radio;
-+  nsIDOMHTMLInputElement* radio = nsnull;
-   do {
-     if (aPrevious) {
-       if (--index < 0) {
-@@ -5051,7 +5037,7 @@ nsDocument::GetNextRadioButton(const nsA
-     radio->GetDisabled(&disabled);
-   } while (disabled && radio != currentRadio);
- 
--  NS_IF_ADDREF(*aRadioOut = radio);
-+  *aRadioOut = radio;
-   return NS_OK;
- }
- 
-@@ -5106,7 +5092,7 @@ void
- void
- nsDocument::RetrieveRelevantHeaders(nsIChannel *aChannel)
- {
--  nsCOMPtr<nsIHttpChannel> httpChannel = do_QueryInterface(aChannel);
-+  nsIHttpChannel* httpChannel = do_QueryInterface(aChannel);
-   PRTime modDate = LL_ZERO;
-   nsresult rv;
- 
-@@ -5148,16 +5134,16 @@ nsDocument::RetrieveRelevantHeaders(nsIC
-       rv =
-         httpChannel->GetResponseHeader(nsDependentCString(*name), headerVal);
-       if (NS_SUCCEEDED(rv) && !headerVal.IsEmpty()) {
--        nsCOMPtr<nsIAtom> key = do_GetAtom(*name);
-+        nsIAtom* key = do_GetAtom(*name);
-         SetHeaderData(key, NS_ConvertASCIItoUTF16(headerVal));
-       }
-       ++name;
-     }
-   } else {
--    nsCOMPtr<nsIFileChannel> fileChannel = do_QueryInterface(aChannel);
-+    nsIFileChannel* fileChannel = do_QueryInterface(aChannel);
-     if (fileChannel) {
--      nsCOMPtr<nsIFile> file;
--      fileChannel->GetFile(getter_AddRefs(file));
-+      nsIFile* file = nsnull;
-+      fileChannel->GetFile(&file);
-       if (file) {
-         PRTime msecs;
-         rv = file->GetLastModifiedTime(&msecs);
-@@ -5169,7 +5155,7 @@ nsDocument::RetrieveRelevantHeaders(nsIC
-         }
-       }
-     } else {
--      nsCOMPtr<nsIMultiPartChannel> partChannel = do_QueryInterface(aChannel);
-+      nsIMultiPartChannel* partChannel = do_QueryInterface(aChannel);
-       if (partChannel) {
-         nsCAutoString contentDisp;
-         rv = partChannel->GetContentDisposition(contentDisp);
-@@ -5232,9 +5218,9 @@ nsDocument::CreateElem(nsIAtom *aName, n
-   PRInt32 elementType = aDocumentDefaultType ? mDefaultElementType :
-                                                aNamespaceID;
- 
--  nsCOMPtr<nsINodeInfo> nodeInfo;
-+  nsINodeInfo* nodeInfo = nsnull;
-   rv = mNodeInfoManager->GetNodeInfo(aName, aPrefix, aNamespaceID,
--                                     getter_AddRefs(nodeInfo));
-+                                     &nodeInfo);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
-   return NS_NewElement(aResult, elementType, nodeInfo, PR_FALSE);
-@@ -5246,7 +5232,7 @@ nsDocument::IsSafeToFlush() const
-   PRBool isSafeToFlush = PR_TRUE;
-   nsPresShellIterator iter(const_cast<nsIDocument*>
-                                      (static_cast<const nsIDocument*>(this)));
--  nsCOMPtr<nsIPresShell> shell;
-+  nsIPresShell* shell = nsnull;
-   while ((shell = iter.GetNextShell()) && isSafeToFlush) {
-     shell->IsSafeToFlush(isSafeToFlush);
-   }
-@@ -5265,24 +5251,24 @@ nsDocument::Sanitize()
-   // First locate all input elements, regardless of whether they are
-   // in a form, and reset the password and autocomplete=off elements.
- 
--  nsCOMPtr<nsIDOMNodeList> nodes;
-+  nsIDOMNodeList* nodes = nsnull;
-   nsresult rv = GetElementsByTagName(NS_LITERAL_STRING("input"),
--                                     getter_AddRefs(nodes));
-+                                     &nodes);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
-   PRUint32 length = 0;
-   if (nodes)
-     nodes->GetLength(&length);
- 
--  nsCOMPtr<nsIDOMNode> item;
-+  nsIDOMNode* item = nsnull;
-   nsAutoString value;
-   PRUint32 i;
- 
-   for (i = 0; i < length; ++i) {
--    nodes->Item(i, getter_AddRefs(item));
-+    nodes->Item(i, &item);
-     NS_ASSERTION(item, "null item in node list!");
- 
--    nsCOMPtr<nsIDOMHTMLInputElement> input = do_QueryInterface(item);
-+    nsIDOMHTMLInputElement* input = do_QueryInterface(item);
-     if (!input)
-       continue;
- 
-@@ -5298,13 +5284,13 @@ nsDocument::Sanitize()
-     }
- 
-     if (resetValue) {
--      nsCOMPtr<nsIFormControl> fc = do_QueryInterface(input);
-+      nsIFormControl* fc = do_QueryInterface(input);
-       fc->Reset();
-     }
-   }
- 
-   // Now locate all _form_ elements that have autocomplete=off and reset them
--  rv = GetElementsByTagName(NS_LITERAL_STRING("form"), getter_AddRefs(nodes));
-+  rv = GetElementsByTagName(NS_LITERAL_STRING("form"), &nodes);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
-   length = 0;
-@@ -5312,10 +5298,10 @@ nsDocument::Sanitize()
-     nodes->GetLength(&length);
- 
-   for (i = 0; i < length; ++i) {
--    nodes->Item(i, getter_AddRefs(item));
-+    nodes->Item(i, &item);
-     NS_ASSERTION(item, "null item in nodelist");
- 
--    nsCOMPtr<nsIDOMHTMLFormElement> form = do_QueryInterface(item);
-+    nsIDOMHTMLFormElement* form = do_QueryInterface(item);
-     if (!form)
-       continue;
- 
-@@ -5382,27 +5368,27 @@ nsDocument::CanSavePresentation(nsIReque
- nsDocument::CanSavePresentation(nsIRequest *aNewRequest)
- {
-   // Check our event listener manager for unload/beforeunload listeners.
--  nsCOMPtr<nsPIDOMEventTarget> piTarget = do_QueryInterface(mScriptGlobalObject);
-+  nsPIDOMEventTarget* piTarget = do_QueryInterface(mScriptGlobalObject);
-   if (piTarget) {
--    nsCOMPtr<nsIEventListenerManager> manager;
--    piTarget->GetListenerManager(PR_FALSE, getter_AddRefs(manager));
-+    nsIEventListenerManager* manager = nsnull;
-+    piTarget->GetListenerManager(PR_FALSE, &manager);
-     if (manager && manager->HasUnloadListeners()) {
-       return PR_FALSE;
-     }
-   }
- 
--  nsCOMPtr<nsILoadGroup> loadGroup = GetDocumentLoadGroup();
-+  nsILoadGroup* loadGroup = GetDocumentLoadGroup();
-   if (loadGroup) {
--    nsCOMPtr<nsISimpleEnumerator> requests;
--    loadGroup->GetRequests(getter_AddRefs(requests));
-+    nsISimpleEnumerator* requests = nsnull;
-+    loadGroup->GetRequests(&requests);
- 
-     PRBool hasMore = PR_FALSE;
- 
-     while (NS_SUCCEEDED(requests->HasMoreElements(&hasMore)) && hasMore) {
--      nsCOMPtr<nsISupports> elem;
--      requests->GetNext(getter_AddRefs(elem));
--
--      nsCOMPtr<nsIRequest> request = do_QueryInterface(elem);
-+      nsISupports* elem = nsnull;
-+      requests->GetNext(&elem);
-+
-+      nsIRequest* request = do_QueryInterface(elem);
-       if (request && request != aNewRequest) {
- #ifdef DEBUG_PAGE_CACHE
-         nsCAutoString requestName, docSpec;
-@@ -5468,14 +5454,14 @@ nsDocument::RemovedFromDocShell()
-   }
- }
- 
--already_AddRefed<nsILayoutHistoryState>
-+nsILayoutHistoryState*
- nsDocument::GetLayoutHistoryState() const
- {
-   nsILayoutHistoryState* state = nsnull;
-   if (!mScriptGlobalObject) {
--    NS_IF_ADDREF(state = mLayoutHistoryState);
--  } else {
--    nsCOMPtr<nsIDocShell> docShell(do_QueryReferent(mDocumentContainer));
-+    state = mLayoutHistoryState;
-+  } else {
-+    nsIDocShell* docShell(do_QueryReferent(mDocumentContainer));
-     if (docShell) {
-       docShell->GetLayoutHistoryState(&state);
-     }
-@@ -5490,7 +5476,7 @@ nsDocument::BlockOnload()
-   // If mScriptGlobalObject is null, we shouldn't be messing with the loadgroup
-   // -- it's not ours.
-   if (mOnloadBlockCount == 0 && mScriptGlobalObject) {
--    nsCOMPtr<nsILoadGroup> loadGroup = GetDocumentLoadGroup();
-+    nsILoadGroup* loadGroup = GetDocumentLoadGroup();
-     if (loadGroup) {
-       loadGroup->AddRequest(mOnloadBlocker, nsnull);
-     }
-@@ -5535,7 +5521,7 @@ void
- void
- nsDocument::PostUnblockOnloadEvent()
- {
--  nsCOMPtr<nsIRunnable> evt = new nsUnblockOnloadEvent(this);
-+  nsIRunnable* evt = new nsUnblockOnloadEvent(this);
-   nsresult rv = NS_DispatchToCurrentThread(evt);
-   if (NS_SUCCEEDED(rv)) {
-     // Stabilize block count so we don't post more events while this one is up
-@@ -5563,7 +5549,7 @@ nsDocument::DoUnblockOnload()
-   // If mScriptGlobalObject is null, we shouldn't be messing with the loadgroup
-   // -- it's not ours.
-   if (mScriptGlobalObject) {
--    nsCOMPtr<nsILoadGroup> loadGroup = GetDocumentLoadGroup();
-+    nsILoadGroup* loadGroup = GetDocumentLoadGroup();
-     if (loadGroup) {
-       loadGroup->RemoveRequest(mOnloadBlocker, nsnull, NS_OK);
-     }
-@@ -5572,7 +5558,7 @@ nsDocument::DoUnblockOnload()
- 
- /* See if document is a child of this.  If so, return the frame element in this
-  * document that holds currentDoc (or an ancestor). */
--already_AddRefed<nsIDOMElement>
-+nsIDOMElement*
- nsDocument::CheckAncestryAndGetFrame(nsIDocument* aDocument) const
- {
-   nsIDocument* parentDoc;
-@@ -5597,14 +5583,13 @@ nsDocument::CheckAncestryAndGetFrame(nsI
-   }
- 
-   // Sanity check result
--  nsCOMPtr<nsIDOMDocument> domDocument;
--  frameElement->GetOwnerDocument(getter_AddRefs(domDocument));
-+  nsIDOMDocument* domDocument = nsnull;
-+  frameElement->GetOwnerDocument(&domDocument);
-   if (domDocument != this) {
-     NS_ERROR("Child documents should live in windows the parent owns");
-     return nsnull;
-   }
- 
--  NS_ADDREF(frameElement);
-   return frameElement;
- }
- 
-@@ -5628,14 +5613,14 @@ nsDocument::OnPageShow(PRBool aPersisted
-   nsIContent* root = GetRootContent();
-   if (aPersisted && root) {
-     // Send out notifications that our <link> elements are attached.
--    nsRefPtr<nsContentList> links = NS_GetContentList(root,
-+    nsContentList* links = NS_GetContentList(root,
-                                                       nsGkAtoms::link,
-                                                       kNameSpaceID_Unknown);
- 
-     if (links) {
-       PRUint32 linkCount = links->Length(PR_TRUE);
-       for (PRUint32 i = 0; i < linkCount; ++i) {
--        nsCOMPtr<nsILink> link = do_QueryInterface(links->Item(i, PR_FALSE));
-+        nsILink* link = do_QueryInterface(links->Item(i, PR_FALSE));
-         if (link) {
-           link->LinkAdded();
-         }
-@@ -5654,14 +5639,14 @@ nsDocument::OnPageHide(PRBool aPersisted
-   // but only if this is not a full unload.
-   nsIContent* root = GetRootContent();
-   if (aPersisted && root) {
--    nsRefPtr<nsContentList> links = NS_GetContentList(root,
-+    nsContentList* links = NS_GetContentList(root,
-                                                       nsGkAtoms::link,
-                                                       kNameSpaceID_Unknown);
- 
-     if (links) {
-       PRUint32 linkCount = links->Length(PR_TRUE);
-       for (PRUint32 i = 0; i < linkCount; ++i) {
--        nsCOMPtr<nsILink> link = do_QueryInterface(links->Item(i, PR_FALSE));
-+        nsILink* link = do_QueryInterface(links->Item(i, PR_FALSE));
-         if (link) {
-           link->LinkRemoved();
-         }
-@@ -5703,7 +5688,7 @@ nsDocument::MutationEventDispatched(nsIN
-       return;
-     }
- 
--    nsCOMPtr<nsPIDOMWindow> window;
-+    nsPIDOMWindow* window = nsnull;
-     window = do_QueryInterface(GetScriptGlobalObject());
-     if (window &&
-         !window->HasMutationListeners(NS_EVENT_BITS_MUTATION_SUBTREEMODIFIED)) {
-@@ -5714,7 +5699,7 @@ nsDocument::MutationEventDispatched(nsIN
-     nsCOMArray<nsINode> realTargets;
-     for (PRInt32 i = 0; i < count; ++i) {
-       nsINode* possibleTarget = mSubtreeModifiedTargets[i];
--      nsCOMPtr<nsIContent> content = do_QueryInterface(possibleTarget);
-+      nsIContent* content = do_QueryInterface(possibleTarget);
-       if (content && content->IsInNativeAnonymousSubtree()) {
-         continue;
-       }
-@@ -5771,8 +5756,8 @@ nsDocument::ForgetLink(nsIContent* aCont
-   if (mLinkMap.Count() == 0)
-     return;
- 
--  nsCOMPtr<nsIURI> uri;
--  if (!aContent->IsLink(getter_AddRefs(uri)))
-+  nsIURI* uri = nsnull;
-+  if (!aContent->IsLink(&uri))
-     return;
-   PRUint32 hash = GetURIHash(uri);
-   nsUint32ToContentHashEntry* entry = mLinkMap.GetEntry(hash);
-@@ -5795,8 +5780,8 @@ public:
-   
-   virtual void Visit(nsIContent* aContent) {
-     // Ensure that the URIs really match before we try to do anything
--    nsCOMPtr<nsIURI> uri;
--    if (!aContent->IsLink(getter_AddRefs(uri))) {
-+    nsIURI* uri = nsnull;
-+    if (!aContent->IsLink(&uri)) {
-       NS_ERROR("Should have found a URI for content in the link map");
-       return;
-     }
-@@ -5809,7 +5794,7 @@ public:
- 
-     // Throw away the cached link state so it gets refetched by the style
-     // system      
--    nsCOMPtr<nsILink> link = do_QueryInterface(aContent);
-+    nsILink* link = do_QueryInterface(aContent);
-     if (link) {
-       link->SetLinkState(eLinkState_Unknown);
-     }
new file mode 100644
--- /dev/null
+++ b/nsIFrame-Cursor-stackclass
@@ -0,0 +1,14 @@
+diff --git a/layout/generic/nsIFrame.h b/layout/generic/nsIFrame.h
+--- a/layout/generic/nsIFrame.h
++++ b/layout/generic/nsIFrame.h
+@@ -978,7 +978,9 @@ public:
+    * loaded image that should be preferred. If it is not possible to use it, or
+    * if it is null, mCursor should be used.
+    */
+-  struct Cursor {
++  struct
++    NS_STACK_CLASS
++  Cursor {
+     nsCOMPtr<imgIContainer> mContainer;
+     PRInt32                 mCursor;
+     PRBool                  mHaveHotspot;
--- a/nsSelectionState-autohelpers-stackclass
+++ b/nsSelectionState-autohelpers-stackclass
@@ -1,52 +1,37 @@
+* * *
+
 diff --git a/editor/libeditor/base/nsSelectionState.cpp b/editor/libeditor/base/nsSelectionState.cpp
 --- a/editor/libeditor/base/nsSelectionState.cpp
 +++ b/editor/libeditor/base/nsSelectionState.cpp
-@@ -92,8 +92,8 @@ nsSelectionState::SaveSelection(nsISelec
-   {
+@@ -117,7 +117,7 @@ nsSelectionState::RestoreSelection(nsISe
      item = (nsRangeStore*)mArray.ElementAt(i);
      if (!item) return NS_ERROR_UNEXPECTED;
--    nsCOMPtr<nsIDOMRange> range;
--    res = aSel->GetRangeAt(i, getter_AddRefs(range));
-+    nsIDOMRange* range = nsnull;
-+    res = aSel->GetRangeAt(i, &range);
-     item->StoreRange(range);
-   }
-   
-@@ -116,8 +116,8 @@ nsSelectionState::RestoreSelection(nsISe
-   {
-     item = (nsRangeStore*)mArray.ElementAt(i);
-     if (!item) return NS_ERROR_UNEXPECTED;
--    nsCOMPtr<nsIDOMRange> range;
+     nsCOMPtr<nsIDOMRange> range;
 -    item->GetRange(address_of(range));
-+    nsIDOMRange* range = nsnull;
 +    item->GetRange(&range);
      if (!range) return NS_ERROR_UNEXPECTED;
     
      res = aSel->AddRange(range);
-@@ -134,8 +134,8 @@ nsSelectionState::IsCollapsed()
-   nsRangeStore *item;
+@@ -135,7 +135,7 @@ nsSelectionState::IsCollapsed()
    item = (nsRangeStore*)mArray.ElementAt(0);
    if (!item) return PR_FALSE;
--  nsCOMPtr<nsIDOMRange> range;
+   nsCOMPtr<nsIDOMRange> range;
 -  item->GetRange(address_of(range));
-+  nsIDOMRange* range = nsnull;
 +  item->GetRange(&range);
    if (!range) return PR_FALSE;
    PRBool bIsCollapsed;
    range->GetCollapsed(&bIsCollapsed);
-@@ -158,9 +158,9 @@ nsSelectionState::IsEqual(nsSelectionSta
-     itsItem = (nsRangeStore*)(aSelState->mArray.ElementAt(i));
+@@ -159,8 +159,8 @@ nsSelectionState::IsEqual(nsSelectionSta
      if (!myItem || !itsItem) return PR_FALSE;
      
--    nsCOMPtr<nsIDOMRange> myRange, itsRange;
+     nsCOMPtr<nsIDOMRange> myRange, itsRange;
 -    myItem->GetRange(address_of(myRange));
 -    itsItem->GetRange(address_of(itsRange));
-+    nsIDOMRange* myRange = nsnull, *itsRange = nsnull;
 +    myItem->GetRange(&myRange);
 +    itsItem->GetRange(&itsRange);
      if (!myRange || !itsRange) return PR_FALSE;
    
      PRInt16 compResult;
 @@ -273,9 +273,9 @@ nsRangeUpdater::SelAdjCreateNode(nsIDOMN
      item = (nsRangeStore*)mArray.ElementAt(i);
      if (!item) return NS_ERROR_NULL_POINTER;
@@ -54,22 +39,18 @@ diff --git a/editor/libeditor/base/nsSel
 -    if ((item->startNode.get() == aParent) && (item->startOffset > aPosition))
 +    if ((item->startNode == aParent) && (item->startOffset > aPosition))
        item->startOffset++;
 -    if ((item->endNode.get() == aParent) && (item->endOffset > aPosition))
 +    if ((item->endNode == aParent) && (item->endOffset > aPosition))
        item->endOffset++;
    }
    return NS_OK;
-@@ -296,10 +296,10 @@ nsRangeUpdater::SelAdjDeleteNode(nsIDOMN
-   PRInt32 i, count = mArray.Count();
-   if (!count) return NS_OK;
- 
--  nsCOMPtr<nsIDOMNode> parent;
-+  nsIDOMNode* parent = nsnull;
+@@ -299,7 +299,7 @@ nsRangeUpdater::SelAdjDeleteNode(nsIDOMN
+   nsCOMPtr<nsIDOMNode> parent;
    PRInt32 offset = 0;
    
 -  nsresult res = nsEditor::GetNodeLocation(aNode, address_of(parent), &offset);
 +  nsresult res = nsEditor::GetNodeLocation(aNode, &parent, &offset);
    NS_ENSURE_SUCCESS(res, res);
    
    // check for range endpoints that are after aNode and in the same parent
 @@ -309,9 +309,9 @@ nsRangeUpdater::SelAdjDeleteNode(nsIDOMN
@@ -79,31 +60,19 @@ diff --git a/editor/libeditor/base/nsSel
 -    if ((item->startNode.get() == parent) && (item->startOffset > offset))
 +    if ((item->startNode == parent) && (item->startOffset > offset))
        item->startOffset--;
 -    if ((item->endNode.get() == parent) && (item->endOffset > offset))
 +    if ((item->endNode == parent) && (item->endOffset > offset))
        item->endOffset--;
        
      // check for range endpoints that are in aNode
-@@ -327,7 +327,7 @@ nsRangeUpdater::SelAdjDeleteNode(nsIDOMN
-     }
+@@ -356,7 +356,7 @@ nsRangeUpdater::SelAdjSplitNode(nsIDOMNo
  
-     // check for range endpoints that are in descendants of aNode
--    nsCOMPtr<nsIDOMNode> oldStart;
-+    nsIDOMNode* oldStart = nsnull;
-     if (nsEditorUtils::IsDescendantOf(item->startNode, aNode))
-     {
-       oldStart = item->startNode;  // save for efficiency hack below.
-@@ -354,9 +354,9 @@ nsRangeUpdater::SelAdjSplitNode(nsIDOMNo
-   PRInt32 i, count = mArray.Count();
-   if (!count) return NS_OK;
- 
--  nsCOMPtr<nsIDOMNode> parent;
-+  nsIDOMNode* parent = nsnull;
+   nsCOMPtr<nsIDOMNode> parent;
    PRInt32 offset;
 -  nsresult result = nsEditor::GetNodeLocation(aOldRightNode, address_of(parent), &offset);
 +  nsresult result = nsEditor::GetNodeLocation(aOldRightNode, &parent, &offset);
    if (NS_FAILED(result)) return result;
    
    // first part is same as inserting aNewLeftnode
 @@ -371,7 +371,7 @@ nsRangeUpdater::SelAdjSplitNode(nsIDOMNo
      item = (nsRangeStore*)mArray.ElementAt(i);
@@ -185,25 +154,16 @@ diff --git a/editor/libeditor/base/nsSel
 -    if ((item->startNode.get() == node) && (item->startOffset > aOffset))
 +    if ((item->startNode == node) && (item->startOffset > aOffset))
        item->startOffset += len;
 -    if ((item->endNode.get() == node) && (item->endOffset > aOffset))
 +    if ((item->endNode == node) && (item->endOffset > aOffset))
        item->endOffset += len;
    }
    return NS_OK;
-@@ -506,7 +506,7 @@ nsRangeUpdater::SelAdjDeleteText(nsIDOMC
-   PRInt32 i, count = mArray.Count();
-   if (!count) return NS_OK;
-   nsRangeStore *item;
--  nsCOMPtr<nsIDOMNode> node(do_QueryInterface(aTextNode));
-+  nsIDOMNode* node(do_QueryInterface(aTextNode));
-   if (!node) return NS_ERROR_NULL_POINTER;
-   
-   for (i=0; i<count; i++)
 @@ -514,12 +514,12 @@ nsRangeUpdater::SelAdjDeleteText(nsIDOMC
      item = (nsRangeStore*)mArray.ElementAt(i);
      if (!item) return NS_ERROR_NULL_POINTER;
      
 -    if ((item->startNode.get() == node) && (item->startOffset > aOffset))
 +    if ((item->startNode == node) && (item->startOffset > aOffset))
      {
        item->startOffset -= aLength;
@@ -266,52 +226,44 @@ diff --git a/editor/libeditor/base/nsSel
 -    if ((item->startNode.get() == aNewParent) && (item->startOffset > aNewOffset))
 +    if ((item->startNode == aNewParent) && (item->startOffset > aNewOffset))
        item->startOffset++;
 -    if ((item->endNode.get() == aNewParent) && (item->endOffset > aNewOffset))
 +    if ((item->endNode == aNewParent) && (item->endOffset > aNewOffset))
        item->endOffset++;
    }
    return NS_OK;
-@@ -689,14 +689,14 @@ nsresult nsRangeStore::StoreRange(nsIDOM
+@@ -689,8 +689,8 @@ nsresult nsRangeStore::StoreRange(nsIDOM
  nsresult nsRangeStore::StoreRange(nsIDOMRange *aRange)
  {
    if (!aRange) return NS_ERROR_NULL_POINTER;
 -  aRange->GetStartContainer(getter_AddRefs(startNode));
 -  aRange->GetEndContainer(getter_AddRefs(endNode));
 +  aRange->GetStartContainer(&startNode);
 +  aRange->GetEndContainer(&endNode);
    aRange->GetStartOffset(&startOffset);
    aRange->GetEndOffset(&endOffset);
    return NS_OK;
- }
- 
--nsresult nsRangeStore::GetRange(nsCOMPtr<nsIDOMRange> *outRange)
-+nsresult nsRangeStore::GetRange(nsIDOMRange* *outRange)
- {
-   if (!outRange) return NS_ERROR_NULL_POINTER;
-   nsresult res;
 diff --git a/editor/libeditor/base/nsSelectionState.h b/editor/libeditor/base/nsSelectionState.h
 --- a/editor/libeditor/base/nsSelectionState.h
 +++ b/editor/libeditor/base/nsSelectionState.h
 @@ -53,16 +53,20 @@ class nsISelection;
   */
  
  // first a helper struct for saving/setting ranges
 -struct nsRangeStore 
 +struct
 +  NS_GC_TYPE
 +  NS_OKONSTACK
 +nsRangeStore 
  {
    nsRangeStore();
    ~nsRangeStore();
    nsresult StoreRange(nsIDOMRange *aRange);
--  nsresult GetRange(nsCOMPtr<nsIDOMRange> *outRange);
-+  nsresult GetRange(nsIDOMRange* *outRange);
+   nsresult GetRange(nsCOMPtr<nsIDOMRange> *outRange);
          
 -  nsCOMPtr<nsIDOMNode> startNode;
 +  // XXXwrite barriers
 +  nsIDOMNode* startNode;
    PRInt32              startOffset;
 -  nsCOMPtr<nsIDOMNode> endNode;
 +  nsIDOMNode* endNode;
    PRInt32              endOffset;
--- a/series
+++ b/series
@@ -154,17 +154,16 @@ nsCxPusher-stackclass
 nsPSPrinterList-stackclass
 FORWARD_TO_INNER_CREATE-stackcomptr
 nsTimeout-GCObject-okonstack
 nsScriptObjectHolder-stackclass
 nsPSPrinterList-manual-rewrite
 nsPrinterFeatures-stackclass
 nsPrintDialogWidgetGTK-is-stackclass
 nsTransferableFactory-stackclass
-manual-nsDocument-comptr
 nsMutationEvent-okonstack
 nsHandlerData-stackclass
 RangeSubtreeIterator-stackclass
 nsCanvasRenderingContext2D_ContextState-stackclass
 nsSafeOptionListMutation-stackclass
 nsFocusSuppressor-stackclass
 nsFocusScrollSuppressor-stackclass
 nsSortState-okonstack
@@ -175,8 +174,9 @@ SVGVals-okonstack
 nsSVGValueAutoNotifier-stackclass
 nsQueryContentEventHandler-stackclass
 nsdispatchingCallback-stackclass
 nsAutoPlaceHolderBatch-stackclass
 StCaretHider-stackclass
 nsSelectionState-autohelpers-stackclass
 nsEditorUtils-helpers-stackclass
 nsWSRunObject-stackclass
+nsIFrame-Cursor-stackclass
--- a/static-check-gc-attributes
+++ b/static-check-gc-attributes
@@ -18,44 +18,16 @@ diff --git a/config/config.mk b/config/c
    $(NULL)
  
  TREEHYDRA_MODULES = \
    $(topsrcdir)/xpcom/analysis/outparams.js \
 +  $(topsrcdir)/xpcom/analysis/gc.js \
    $(NULL)
  
  DEHYDRA_ARGS = \
-diff --git a/layout/base/nsPresShell.cpp b/layout/base/nsPresShell.cpp
---- a/layout/base/nsPresShell.cpp
-+++ b/layout/base/nsPresShell.cpp
-@@ -1254,7 +1254,7 @@ public:
-     }
-   }
- 
--  nsRefPtr<PresShell> mPresShell;
-+  PresShell* mPresShell;
- };
- 
- #ifdef PR_LOGGING
-diff --git a/layout/generic/nsIFrame.h b/layout/generic/nsIFrame.h
---- a/layout/generic/nsIFrame.h
-+++ b/layout/generic/nsIFrame.h
-@@ -978,8 +978,10 @@ public:
-    * loaded image that should be preferred. If it is not possible to use it, or
-    * if it is null, mCursor should be used.
-    */
--  struct Cursor {
--    nsCOMPtr<imgIContainer> mContainer;
-+  struct
-+    NS_STACK_CLASS
-+  Cursor {
-+    imgIContainer* mContainer;
-     PRInt32                 mCursor;
-     PRBool                  mHaveHotspot;
-     float                   mHotspotX, mHotspotY;
 diff --git a/xpcom/analysis/final.js b/xpcom/analysis/final.js
 new file mode 100644
 --- /dev/null
 +++ b/xpcom/analysis/final.js
 @@ -0,0 +1,16 @@
 +function process_type(c)
 +{
 +  if ((c.kind == 'class' || c.kind == 'struct') && !c.isIncomplete) {