Merge last PGO-green changeset of mozilla-inbound to mozilla-central
authorEd Morley <bmo@edmorley.co.uk>
Fri, 10 Feb 2012 12:14:39 +0000
changeset 86719 417f1756b45249f5eed3d7525512a283286b6f33
parent 86718 d73f5d77a645a56885a7a8c53da59ec454f61480 (current diff)
parent 86690 363fa033d483cbbe12dacb3c59baee237815fa5b (diff)
child 86731 157ec7365fb9d179d631e0a17232d2d9bcf6dd00
push id102
push userMs2ger@gmail.com
push dateFri, 10 Feb 2012 20:38:19 +0000
milestone13.0a1
Merge last PGO-green changeset of mozilla-inbound to mozilla-central
browser/themes/winstripe/mainwindow-dropdown-arrow-aero.png
browser/themes/winstripe/mainwindow-dropdown-arrow-inverted.png
browser/themes/winstripe/mainwindow-dropdown-arrow.png
dom/base/nsGlobalWindow.cpp
dom/plugins/base/nsPluginInstanceOwner.cpp
hal/Hal.cpp
hal/Hal.h
hal/sandbox/SandboxHal.cpp
js/src/jsgcchunk.cpp
js/src/jsgcchunk.h
js/xpconnect/src/XPCQuickStubs.cpp
--- a/accessible/public/nsIAccessibilityService.h
+++ b/accessible/public/nsIAccessibilityService.h
@@ -66,18 +66,18 @@ public:
 
   /**
    * Return an accessible object for a DOM node in the given pres shell.
    *
    * @param  aNode      [in] the DOM node to get an accessible for
    * @param  aPresShell [in] the presentation shell which contains layout info
    *                         for the DOM node
    */
-  virtual nsAccessible* GetAccessibleInShell(nsINode* aNode,
-                                             nsIPresShell* aPresShell) = 0;
+  virtual nsAccessible* GetAccessible(nsINode* aNode,
+                                      nsIPresShell* aPresShell) = 0;
 
   /**
    * Return root document accessible that is or contains a document accessible
    * for the given presshell.
    *
    * @param aPresShell  [in] the presshell
    * @param aCanCreate  [in] points whether the root document accessible
    *                        should be returned from the cache or can be created
--- a/accessible/src/atk/AtkSocketAccessible.cpp
+++ b/accessible/src/atk/AtkSocketAccessible.cpp
@@ -157,19 +157,19 @@ mai_atk_socket_get_extents(AtkComponent*
   if (!MAI_IS_ATK_SOCKET(aComponent))
     return;
 
   getExtentsHelper(MAI_ATK_SOCKET(aComponent)->accWrap,
                    aX, aY, aWidth, aHeight, aCoordType);
 }
 
 AtkSocketAccessible::AtkSocketAccessible(nsIContent* aContent,
-                                         nsIWeakReference* aShell,
+                                         nsDocAccessible* aDoc,
                                          const nsCString& aPlugId) :
-  nsAccessibleWrap(aContent, aShell)
+  nsAccessibleWrap(aContent, aDoc)
 {
   mAtkObject = mai_atk_socket_new(this);
   if (!mAtkObject)
     return;
 
   // Embeds the children of an AtkPlug, specified by plugId, as the children of
   // this socket.
   // Using G_TYPE macros instead of ATK_SOCKET macros to avoid undefined
--- a/accessible/src/atk/AtkSocketAccessible.h
+++ b/accessible/src/atk/AtkSocketAccessible.h
@@ -67,17 +67,17 @@ public:
   static const char* sATKSocketGetTypeSymbol;
 
   /*
    * True if the current Atk version supports AtkSocket and it was correctly
    * loaded.
    */
   static bool gCanEmbed;
 
-  AtkSocketAccessible(nsIContent* aContent, nsIWeakReference* aShell,
+  AtkSocketAccessible(nsIContent* aContent, nsDocAccessible* aDoc,
                       const nsCString& aPlugId);
 
   // nsAccessNode
   virtual void Shutdown();
 
   // nsIAccessible
   NS_IMETHODIMP GetNativeInterface(void** aOutAccessible);
 };
--- a/accessible/src/atk/nsAccessNodeWrap.cpp
+++ b/accessible/src/atk/nsAccessNodeWrap.cpp
@@ -50,18 +50,18 @@
 // nsAccessNodeWrap
 ////////////////////////////////////////////////////////////////////////////////
 
 //-----------------------------------------------------
 // construction 
 //-----------------------------------------------------
 
 nsAccessNodeWrap::
-    nsAccessNodeWrap(nsIContent *aContent, nsIWeakReference *aShell) :
-    nsAccessNode(aContent, aShell)
+  nsAccessNodeWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsAccessNode(aContent, aDoc)
 {
 }
 
 //-----------------------------------------------------
 // destruction
 //-----------------------------------------------------
 nsAccessNodeWrap::~nsAccessNodeWrap()
 {
--- a/accessible/src/atk/nsAccessNodeWrap.h
+++ b/accessible/src/atk/nsAccessNodeWrap.h
@@ -44,17 +44,16 @@
 #ifndef _nsAccessNodeWrap_H_
 #define _nsAccessNodeWrap_H_
 
 #include "nsAccessNode.h"
 
 class nsAccessNodeWrap :  public nsAccessNode
 {
 public: // construction, destruction
-    nsAccessNodeWrap(nsIContent *aContent, nsIWeakReference *aShell);
-    virtual ~nsAccessNodeWrap();
+  nsAccessNodeWrap(nsIContent* aContent, nsDocAccessible* aDoc);
+  virtual ~nsAccessNodeWrap();
 
-    static void InitAccessibility();
-    static void ShutdownAccessibility();
-
+  static void InitAccessibility();
+  static void ShutdownAccessibility();
 };
 
 #endif
--- a/accessible/src/atk/nsAccessibleWrap.cpp
+++ b/accessible/src/atk/nsAccessibleWrap.cpp
@@ -276,18 +276,18 @@ mai_atk_object_get_type(void)
 }
 
 #ifdef MAI_LOGGING
 PRInt32 nsAccessibleWrap::mAccWrapCreated = 0;
 PRInt32 nsAccessibleWrap::mAccWrapDeleted = 0;
 #endif
 
 nsAccessibleWrap::
-    nsAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell) :
-    nsAccessible(aContent, aShell), mAtkObject(nsnull)
+  nsAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsAccessible(aContent, aDoc), mAtkObject(nsnull)
 {
 #ifdef MAI_LOGGING
     ++mAccWrapCreated;
 #endif
     MAI_LOG_DEBUG(("==nsAccessibleWrap creating: this=%p,total=%d left=%d\n",
                    (void*)this, mAccWrapCreated,
                   (mAccWrapCreated-mAccWrapDeleted)));
 }
@@ -357,17 +357,17 @@ void nsAccessibleWrap::SetMaiHyperlink(M
     }
 }
 
 NS_IMETHODIMP nsAccessibleWrap::GetNativeInterface(void **aOutAccessible)
 {
     *aOutAccessible = nsnull;
 
     if (!mAtkObject) {
-        if (!mWeakShell || !nsAccUtils::IsEmbeddedObject(this)) {
+        if (IsDefunct() || !nsAccUtils::IsEmbeddedObject(this)) {
             // We don't create ATK objects for node which has been shutdown, or
             // nsIAccessible plain text leaves
             return NS_ERROR_FAILURE;
         }
 
         GType type = GetMaiAtkType(CreateMaiInterfaces());
         NS_ENSURE_TRUE(type, NS_ERROR_FAILURE);
         mAtkObject =
--- a/accessible/src/atk/nsAccessibleWrap.h
+++ b/accessible/src/atk/nsAccessibleWrap.h
@@ -79,17 +79,17 @@ class MaiHyperlink;
 
 /**
  * nsAccessibleWrap, and its descendents in atk directory provide the
  * implementation of AtkObject.
  */
 class nsAccessibleWrap: public nsAccessible
 {
 public:
-    nsAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell);
+  nsAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc);
     virtual ~nsAccessibleWrap();
     void ShutdownAtkObject();
 
     // nsAccessNode
     virtual void Shutdown();
 
 #ifdef MAI_LOGGING
     virtual void DumpnsAccessibleWrapInfo(int aDepth) {}
--- a/accessible/src/atk/nsDocAccessibleWrap.cpp
+++ b/accessible/src/atk/nsDocAccessibleWrap.cpp
@@ -42,18 +42,18 @@
 #include "nsMai.h"
 #include "nsDocAccessibleWrap.h"
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsDocAccessibleWrap
 ////////////////////////////////////////////////////////////////////////////////
 
 nsDocAccessibleWrap::
-    nsDocAccessibleWrap(nsIDocument *aDocument, nsIContent *aRootContent,
-                        nsIWeakReference *aShell) :
-    nsDocAccessible(aDocument, aRootContent, aShell), mActivated(false)
+  nsDocAccessibleWrap(nsIDocument* aDocument, nsIContent* aRootContent,
+                      nsIPresShell* aPresShell) :
+  nsDocAccessible(aDocument, aRootContent, aPresShell), mActivated(false)
 {
 }
 
 nsDocAccessibleWrap::~nsDocAccessibleWrap()
 {
 }
 
--- a/accessible/src/atk/nsDocAccessibleWrap.h
+++ b/accessible/src/atk/nsDocAccessibleWrap.h
@@ -45,16 +45,16 @@
 #ifndef _nsDocAccessibleWrap_H_
 #define _nsDocAccessibleWrap_H_
 
 #include "nsDocAccessible.h"
 
 class nsDocAccessibleWrap: public nsDocAccessible
 {
 public:
-  nsDocAccessibleWrap(nsIDocument *aDocument, nsIContent *aRootContent,
-                      nsIWeakReference *aShell);
+  nsDocAccessibleWrap(nsIDocument* aDocument, nsIContent* aRootContent,
+                      nsIPresShell* aPresShell);
   virtual ~nsDocAccessibleWrap();
 
   bool mActivated;
 };
 
 #endif
--- a/accessible/src/base/AccEvent.cpp
+++ b/accessible/src/base/AccEvent.cpp
@@ -134,17 +134,17 @@ NS_IMPL_CYCLE_COLLECTION_ROOT_NATIVE(Acc
 NS_IMPL_CYCLE_COLLECTION_UNROOT_NATIVE(AccEvent, Release)
 
 ////////////////////////////////////////////////////////////////////////////////
 // AccEvent protected methods
 
 nsAccessible*
 AccEvent::GetAccessibleForNode() const
 {
-  return mNode ? GetAccService()->GetAccessible(mNode) : nsnull;
+  return mNode ? GetAccService()->GetAccessible(mNode, nsnull) : nsnull;
 }
 
 void
 AccEvent::CaptureIsFromUserInput(EIsFromUserInput aIsFromUserInput)
 {
   nsINode *targetNode = GetNode();
 
 #ifdef DEBUG
--- a/accessible/src/base/AccIterator.cpp
+++ b/accessible/src/base/AccIterator.cpp
@@ -339,17 +339,17 @@ IDRefsIterator::GetElem(const nsDependen
 
   return mDocument->GetElementById(aID);
 }
 
 nsAccessible*
 IDRefsIterator::Next()
 {
   nsIContent* nextElm = NextElem();
-  return nextElm ? GetAccService()->GetAccessible(nextElm) : nsnull;
+  return nextElm ? GetAccService()->GetAccessible(nextElm, nsnull) : nsnull;
 }
 
 nsAccessible*
 SingleAccIterator::Next()
 {
   nsRefPtr<nsAccessible> nextAcc;
   mAcc.swap(nextAcc);
   return (nextAcc && !nextAcc->IsDefunct()) ? nextAcc : nsnull;
--- a/accessible/src/base/FocusManager.cpp
+++ b/accessible/src/base/FocusManager.cpp
@@ -58,18 +58,21 @@ FocusManager::~FocusManager()
 
 nsAccessible*
 FocusManager::FocusedAccessible() const
 {
   if (mActiveItem)
     return mActiveItem;
 
   nsINode* focusedNode = FocusedDOMNode();
-  if (focusedNode)
-    return GetAccService()->GetAccessibleOrContainer(focusedNode, nsnull);
+  if (focusedNode) {
+    nsDocAccessible* doc = 
+      GetAccService()->GetDocAccessible(focusedNode->OwnerDoc());
+    return doc ? doc->GetAccessibleOrContainer(focusedNode) : nsnull;
+  }
 
   return nsnull;
 }
 
 bool
 FocusManager::IsFocused(const nsAccessible* aAccessible) const
 {
   if (mActiveItem)
@@ -79,18 +82,20 @@ FocusManager::IsFocused(const nsAccessib
   if (focusedNode) {
     // XXX: Before getting an accessible for node having a DOM focus make sure
     // they belong to the same document because it can trigger unwanted document
     // accessible creation for temporary about:blank document. Without this
     // peculiarity we would end up with plain implementation based on
     // FocusedAccessible() method call. Make sure this issue is fixed in
     // bug 638465.
     if (focusedNode->OwnerDoc() == aAccessible->GetNode()->OwnerDoc()) {
+      nsDocAccessible* doc = 
+        GetAccService()->GetDocAccessible(focusedNode->OwnerDoc());
       return aAccessible ==
-        GetAccService()->GetAccessibleOrContainer(focusedNode, nsnull);
+	(doc ? doc->GetAccessibleOrContainer(focusedNode) : nsnull);
     }
   }
   return false;
 }
 
 bool
 FocusManager::IsFocusWithin(const nsAccessible* aContainer) const
 {
@@ -204,17 +209,17 @@ FocusManager::ActiveItemChanged(nsAccess
   }
   mActiveItem = aItem;
 
   // If active item is changed then fire accessible focus event on it, otherwise
   // if there's no an active item then fire focus event to accessible having
   // DOM focus.
   nsAccessible* target = FocusedAccessible();
   if (target)
-    DispatchFocusEvent(target->GetDocAccessible(), target);
+    DispatchFocusEvent(target->Document(), target);
 }
 
 void
 FocusManager::ForceFocusEvent()
 {
   nsINode* focusedNode = FocusedDOMNode();
   if (focusedNode) {
     nsDocAccessible* document =
@@ -246,21 +251,21 @@ FocusManager::ProcessDOMFocus(nsINode* a
 {
   A11YDEBUG_FOCUS_NOTIFICATION_DOMTARGET("Process DOM focus",
                                          "Notification target", aTarget)
 
   nsDocAccessible* document =
     GetAccService()->GetDocAccessible(aTarget->OwnerDoc());
 
   nsAccessible* target = document->GetAccessibleOrContainer(aTarget);
-  if (target) {
+  if (target && document) {
     // Check if still focused. Otherwise we can end up with storing the active
     // item for control that isn't focused anymore.
     nsAccessible* DOMFocus =
-      GetAccService()->GetAccessibleOrContainer(FocusedDOMNode(), nsnull);
+      document->GetAccessibleOrContainer(FocusedDOMNode());
     if (target != DOMFocus)
       return;
 
     nsAccessible* activeItem = target->CurrentItem();
     if (activeItem) {
       mActiveItem = activeItem;
       target = activeItem;
     }
@@ -280,17 +285,18 @@ FocusManager::ProcessFocusEvent(AccEvent
 
   // Emit focus event if event target is the active item. Otherwise then check
   // if it's still focused and then update active item and emit focus event.
   nsAccessible* target = aEvent->GetAccessible();
   if (target != mActiveItem) {
     // Check if still focused. Otherwise we can end up with storing the active
     // item for control that isn't focused anymore.
     nsAccessible* DOMFocus =
-      GetAccService()->GetAccessibleOrContainer(FocusedDOMNode(), nsnull);
+      GetAccService()->GetAccessibleOrContainer(FocusedDOMNode(),
+	                                        aEvent->GetDocAccessible());
     if (target != DOMFocus)
       return;
 
     nsAccessible* activeItem = target->CurrentItem();
     if (activeItem) {
       mActiveItem = activeItem;
       target = activeItem;
     }
@@ -336,17 +342,17 @@ FocusManager::ProcessFocusEvent(AccEvent
 
   nsRefPtr<AccEvent> focusEvent =
     new AccEvent(nsIAccessibleEvent::EVENT_FOCUS, target, fromUserInputFlag);
   nsEventShell::FireEvent(focusEvent);
 
   // Fire scrolling_start event when the document receives the focus if it has
   // an anchor jump. If an accessible within the document receive the focus
   // then null out the anchor jump because it no longer applies.
-  nsDocAccessible* targetDocument = target->GetDocAccessible();
+  nsDocAccessible* targetDocument = target->Document();
   nsAccessible* anchorJump = targetDocument->AnchorJump();
   if (anchorJump) {
     if (target == targetDocument) {
       // XXX: bug 625699, note in some cases the node could go away before we
       // we receive focus event, for example if the node is removed from DOM.
       nsEventShell::FireEvent(nsIAccessibleEvent::EVENT_SCROLLING_START,
                               anchorJump, fromUserInputFlag);
     }
--- a/accessible/src/base/NotificationController.cpp
+++ b/accessible/src/base/NotificationController.cpp
@@ -666,17 +666,17 @@ NotificationController::CoalesceTextChan
   aTailEvent->mTextChangeEvent.swap(aThisEvent->mTextChangeEvent);
 }
 
 void
 NotificationController::CreateTextChangeEventFor(AccMutationEvent* aEvent)
 {
   nsAccessible* container =
     GetAccService()->GetContainerAccessible(aEvent->mNode,
-                                            aEvent->mAccessible->GetWeakShell());
+                                            aEvent->GetDocAccessible());
   if (!container)
     return;
 
   nsHyperTextAccessible* textAccessible = container->AsHyperText();
   if (!textAccessible)
     return;
 
   // Don't fire event for the first html:br in an editor.
--- a/accessible/src/base/Relation.h
+++ b/accessible/src/base/Relation.h
@@ -118,17 +118,17 @@ public:
 
   /**
    * Append the one accessible for this content node to the set of related
    * accessibles.
    */
   inline void AppendTarget(nsIContent* aContent)
   {
     if (aContent)
-      AppendTarget(GetAccService()->GetAccessible(aContent));
+      AppendTarget(GetAccService()->GetAccessible(aContent, nsnull));
   }
 
   /**
    * compute and return the next related accessible.
    */
   inline nsAccessible* Next()
   {
     nsAccessible* target = nsnull;
--- a/accessible/src/base/nsARIAGridAccessible.cpp
+++ b/accessible/src/base/nsARIAGridAccessible.cpp
@@ -52,18 +52,18 @@ using namespace mozilla::a11y;
 // nsARIAGridAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // Constructor
 
 nsARIAGridAccessible::
-  nsARIAGridAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsAccessibleWrap(aContent, aShell)
+  nsARIAGridAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsAccessibleWrap(aContent, aDoc)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsISupports
 
 NS_IMPL_ISUPPORTS_INHERITED1(nsARIAGridAccessible,
                              nsAccessible,
@@ -927,18 +927,18 @@ nsARIAGridAccessible::GetSelectedColumns
 // nsARIAGridCellAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // Constructor
 
 nsARIAGridCellAccessible::
-  nsARIAGridCellAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsHyperTextAccessibleWrap(aContent, aShell)
+  nsARIAGridCellAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsHyperTextAccessibleWrap(aContent, aDoc)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsISupports
 
 NS_IMPL_ISUPPORTS_INHERITED1(nsARIAGridCellAccessible,
                              nsHyperTextAccessible,
--- a/accessible/src/base/nsARIAGridAccessible.h
+++ b/accessible/src/base/nsARIAGridAccessible.h
@@ -45,17 +45,17 @@
 
 /**
  * Accessible for ARIA grid and treegrid.
  */
 class nsARIAGridAccessible : public nsAccessibleWrap,
                              public nsIAccessibleTable
 {
 public:
-  nsARIAGridAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsARIAGridAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessibleTable
   NS_DECL_NSIACCESSIBLETABLE
 
 protected:
@@ -105,17 +105,17 @@ protected:
 
 /**
  * Accessible for ARIA gridcell and rowheader/columnheader.
  */
 class nsARIAGridCellAccessible : public nsHyperTextAccessibleWrap,
                                  public nsIAccessibleTableCell
 {
 public:
-  nsARIAGridCellAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsARIAGridCellAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessibleTableCell
   NS_DECL_NSIACCESSIBLETABLECELL
 
   // nsAccessible
--- a/accessible/src/base/nsAccDocManager.cpp
+++ b/accessible/src/base/nsAccDocManager.cpp
@@ -376,32 +376,28 @@ nsAccDocManager::CreateDocOrRootAccessib
     return nsnull;
 
   bool isRootDoc = nsCoreUtils::IsRootDocument(aDocument);
 
   nsDocAccessible* parentDocAcc = nsnull;
   if (!isRootDoc) {
     // XXXaaronl: ideally we would traverse the presshell chain. Since there's
     // no easy way to do that, we cheat and use the document hierarchy.
-    // GetAccessible() is bad because it doesn't support our concept of multiple
-    // presshells per doc. It should be changed to use
-    // GetAccessibleInWeakShell().
     parentDocAcc = GetDocAccessible(aDocument->GetParentDocument());
     NS_ASSERTION(parentDocAcc,
                  "Can't create an accessible for the document!");
     if (!parentDocAcc)
       return nsnull;
   }
 
   // We only create root accessibles for the true root, otherwise create a
   // doc accessible.
-  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(presShell));
   nsRefPtr<nsDocAccessible> docAcc = isRootDoc ?
-    new nsRootAccessibleWrap(aDocument, rootElm, weakShell) :
-    new nsDocAccessibleWrap(aDocument, rootElm, weakShell);
+    new nsRootAccessibleWrap(aDocument, rootElm, presShell) :
+    new nsDocAccessibleWrap(aDocument, rootElm, presShell);
 
   // Cache the document accessible into document cache.
   if (!docAcc || !mDocAccessibleCache.Put(aDocument, docAcc))
     return nsnull;
 
   // Initialize the document accessible.
   if (!docAcc->Init()) {
     docAcc->Shutdown();
--- a/accessible/src/base/nsAccTreeWalker.cpp
+++ b/accessible/src/base/nsAccTreeWalker.cpp
@@ -36,19 +36,19 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsAccTreeWalker.h"
 
 #include "nsAccessible.h"
 #include "nsAccessibilityService.h"
+#include "nsDocAccessible.h"
 
 #include "nsINodeList.h"
-#include "nsIPresShell.h"
 
 ////////////////////////////////////////////////////////////////////////////////
 // WalkState
 ////////////////////////////////////////////////////////////////////////////////
 
 struct WalkState
 {
   WalkState(nsIContent *aContent) :
@@ -60,19 +60,19 @@ struct WalkState
   WalkState *prevState;
 };
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccTreeWalker
 ////////////////////////////////////////////////////////////////////////////////
 
 nsAccTreeWalker::
-  nsAccTreeWalker(nsIWeakReference* aShell, nsIContent* aContent,
+  nsAccTreeWalker(nsDocAccessible* aDoc, nsIContent* aContent,
                   bool aWalkAnonContent, bool aWalkCache) :
-  mWeakShell(aShell), mWalkCache(aWalkCache), mState(nsnull)
+  mDoc(aDoc), mWalkCache(aWalkCache), mState(nsnull)
 {
   NS_ASSERTION(aContent, "No node for the accessible tree walker!");
 
   if (aContent)
     mState = new WalkState(aContent);
 
   mChildFilter = aWalkAnonContent ? nsIContent::eAllChildren :
                                   nsIContent::eAllButXBL;
@@ -98,31 +98,27 @@ nsAccessible*
 nsAccTreeWalker::NextChildInternal(bool aNoWalkUp)
 {
   if (!mState || !mState->content)
     return nsnull;
 
   if (!mState->childList)
     mState->childList = mState->content->GetChildren(mChildFilter);
 
-  nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
-
   PRUint32 length = 0;
   if (mState->childList)
     mState->childList->GetLength(&length);
 
   while (mState->childIdx < length) {
     nsIContent* childNode = mState->childList->GetNodeAt(mState->childIdx);
     mState->childIdx++;
 
     bool isSubtreeHidden = false;
-    nsAccessible* accessible = mWalkCache ?
-      GetAccService()->GetAccessibleInWeakShell(childNode, mWeakShell) :
-      GetAccService()->GetOrCreateAccessible(childNode, presShell, mWeakShell,
-                                             &isSubtreeHidden);
+    nsAccessible* accessible = mWalkCache ? mDoc->GetAccessible(childNode) :
+      GetAccService()->GetOrCreateAccessible(childNode, mDoc, &isSubtreeHidden);
 
     if (accessible)
       return accessible;
 
     // Walk down into subtree to find accessibles.
     if (!isSubtreeHidden) {
       if (!PushState(childNode))
         break;
--- a/accessible/src/base/nsAccTreeWalker.h
+++ b/accessible/src/base/nsAccTreeWalker.h
@@ -37,28 +37,28 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef _nsAccTreeWalker_H_
 #define _nsAccTreeWalker_H_
 
 #include "nsAutoPtr.h"
 #include "nsIContent.h"
-#include "nsIWeakReference.h"
 
 class nsAccessible;
+class nsDocAccessible;
 struct WalkState;
 
 /**
  * This class is used to walk the DOM tree to create accessible tree.
  */
 class nsAccTreeWalker
 {
 public:
-  nsAccTreeWalker(nsIWeakReference *aShell, nsIContent *aNode, 
+  nsAccTreeWalker(nsDocAccessible* aDoc, nsIContent* aNode, 
                   bool aWalkAnonymousContent, bool aWalkCache = false);
   virtual ~nsAccTreeWalker();
 
   /**
    * Return the next child accessible.
    *
    * @note Returned accessible is bound to the document, if the accessible is
    *       rejected during tree creation then the caller should be unbind it
@@ -88,15 +88,15 @@ private:
    */
   bool PushState(nsIContent *aNode);
 
   /**
    * Pop state from stack.
    */
   void PopState();
 
-  nsCOMPtr<nsIWeakReference> mWeakShell;
+  nsDocAccessible* mDoc;
   PRInt32 mChildFilter;
   bool mWalkCache;
   WalkState* mState;
 };
 
 #endif 
--- a/accessible/src/base/nsAccUtils.cpp
+++ b/accessible/src/base/nsAccUtils.cpp
@@ -158,17 +158,17 @@ nsAccUtils::GetPositionAndSizeForXULSele
   *aPosInSet = indexOf;
 
   for (PRUint32 index = 0; index < itemsCount; index++) {
     nsCOMPtr<nsIDOMXULSelectControlItemElement> currItem;
     control->GetItemAtIndex(index, getter_AddRefs(currItem));
     nsCOMPtr<nsINode> currNode(do_QueryInterface(currItem));
 
     nsAccessible* itemAcc = currNode ?
-      GetAccService()->GetAccessible(currNode) : nsnull;
+      GetAccService()->GetAccessible(currNode, nsnull) : nsnull;
 
     if (!itemAcc || itemAcc->State() & states::INVISIBLE) {
       (*aSetSize)--;
       if (index < static_cast<PRUint32>(indexOf))
         (*aPosInSet)--;
     }
   }
 
@@ -200,17 +200,17 @@ nsAccUtils::GetPositionAndSizeForXULCont
   // Calculate set size and position in the set.
   *aSetSize = 0, *aPosInSet = 0;
   for (PRInt32 index = indexOf; index >= 0; index--) {
     nsCOMPtr<nsIDOMXULElement> item;
     container->GetItemAtIndex(index, getter_AddRefs(item));
     nsCOMPtr<nsINode> itemNode(do_QueryInterface(item));
 
     nsAccessible* itemAcc = itemNode ?
-      GetAccService()->GetAccessible(itemNode) : nsnull;
+      GetAccService()->GetAccessible(itemNode, nsnull) : nsnull;
 
     if (itemAcc) {
       PRUint32 itemRole = Role(itemAcc);
       if (itemRole == nsIAccessibleRole::ROLE_SEPARATOR)
         break; // We reached the beginning of our group.
 
       if (!(itemAcc->State() & states::INVISIBLE)) {
         (*aSetSize)++;
@@ -221,17 +221,17 @@ nsAccUtils::GetPositionAndSizeForXULCont
 
   for (PRInt32 index = indexOf + 1; index < static_cast<PRInt32>(itemsCount);
        index++) {
     nsCOMPtr<nsIDOMXULElement> item;
     container->GetItemAtIndex(index, getter_AddRefs(item));
     nsCOMPtr<nsINode> itemNode(do_QueryInterface(item));
 
     nsAccessible* itemAcc =
-      itemNode ? GetAccService()->GetAccessible(itemNode) : nsnull;
+      itemNode ? GetAccService()->GetAccessible(itemNode, nsnull) : nsnull;
 
     if (itemAcc) {
       PRUint32 itemRole = Role(itemAcc);
       if (itemRole == nsIAccessibleRole::ROLE_SEPARATOR)
         break; // We reached the end of our group.
 
       if (!(itemAcc->State() & states::INVISIBLE))
         (*aSetSize)++;
@@ -348,21 +348,21 @@ nsAccUtils::GetARIAToken(dom::Element* a
   PRInt32 idx = aElement->FindAttrValueIn(kNameSpaceID_None,
                                           aAttr, tokens, eCaseMatters);
   if (idx >= 0)
     return *(tokens[idx]);
 
   return nsnull;
 }
 
-nsAccessible *
+nsAccessible*
 nsAccUtils::GetAncestorWithRole(nsAccessible *aDescendant, PRUint32 aRole)
 {
-  nsAccessible *document = aDescendant->GetDocAccessible();
-  nsAccessible *parent = aDescendant;
+  nsAccessible* document = aDescendant->Document();
+  nsAccessible* parent = aDescendant;
   while ((parent = parent->Parent())) {
     PRUint32 testRole = parent->Role();
     if (testRole == aRole)
       return parent;
 
     if (parent == document)
       break;
   }
@@ -384,17 +384,17 @@ nsAccUtils::GetSelectableContainer(nsAcc
       return nsnull;
   }
   return parent;
 }
 
 nsAccessible*
 nsAccUtils::GetMultiSelectableContainer(nsINode* aNode)
 {
-  nsAccessible* accessible = GetAccService()->GetAccessible(aNode);
+  nsAccessible* accessible = GetAccService()->GetAccessible(aNode, nsnull);
   if (accessible) {
     nsAccessible* container = GetSelectableContainer(accessible,
                                                      accessible->State());
     if (container && container->State() & states::MULTISELECTABLE)
       return container;
   }
 
   return nsnull;
@@ -420,21 +420,22 @@ nsAccUtils::GetTextAccessibleFromSelecti
     return nsnull;
 
   PRInt32 focusOffset = 0;
   aSelection->GetFocusOffset(&focusOffset);
 
   nsCOMPtr<nsINode> focusNode(do_QueryInterface(focusDOMNode));
   nsCOMPtr<nsINode> resultNode =
     nsCoreUtils::GetDOMNodeFromDOMPoint(focusNode, focusOffset);
-  nsCOMPtr<nsIWeakReference> weakShell(nsCoreUtils::GetWeakShellFor(resultNode));
 
   // Get text accessible containing the result node.
-  nsAccessible* accessible =
-    GetAccService()->GetAccessibleOrContainer(resultNode, weakShell);
+  nsDocAccessible* doc = 
+    GetAccService()->GetDocAccessible(resultNode->OwnerDoc());
+  nsAccessible* accessible = doc ? 
+    doc->GetAccessibleOrContainer(resultNode) : nsnull;
   if (!accessible) {
     NS_NOTREACHED("No nsIAccessibleText for selection change event!");
     return nsnull;
   }
 
   do {
     nsHyperTextAccessible* textAcc = accessible->AsHyperText();
     if (textAcc)
@@ -520,19 +521,18 @@ nsIntPoint
 nsAccUtils::GetScreenCoordsForWindow(nsAccessNode *aAccessNode)
 {
   return nsCoreUtils::GetScreenCoordsForWindow(aAccessNode->GetNode());
 }
 
 nsIntPoint
 nsAccUtils::GetScreenCoordsForParent(nsAccessNode *aAccessNode)
 {
-  nsAccessible *parent =
-    GetAccService()->GetContainerAccessible(aAccessNode->GetNode(),
-                                            aAccessNode->GetWeakShell());
+  nsDocAccessible* document = aAccessNode->Document();
+  nsAccessible* parent = document->GetContainerAccessible(aAccessNode->GetNode());
   if (!parent)
     return nsIntPoint(0, 0);
 
   nsIFrame *parentFrame = parent->GetFrame();
   if (!parentFrame)
     return nsIntPoint(0, 0);
 
   nsIntRect parentRect = parentFrame->GetScreenRectExternal();
--- a/accessible/src/base/nsAccUtils.h
+++ b/accessible/src/base/nsAccUtils.h
@@ -151,21 +151,20 @@ public:
   /**
    * Return atomic value of ARIA attribute of boolean or NMTOKEN type.
    */
   static nsIAtom* GetARIAToken(mozilla::dom::Element* aElement, nsIAtom* aAttr);
 
   /**
    * Return document accessible for the given presshell.
    */
-  static nsDocAccessible *GetDocAccessibleFor(nsIWeakReference *aWeakShell)
+  static nsDocAccessible* GetDocAccessibleFor(const nsIPresShell* aPresShell)
   {
-    nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(aWeakShell));
-    return presShell ?
-      GetAccService()->GetDocAccessible(presShell->GetDocument()) : nsnull;
+    return aPresShell ?
+      GetAccService()->GetDocAccessible(aPresShell->GetDocument()) : nsnull;
   }
 
   /**
    * Return document accessible for the given DOM node.
    */
   static nsDocAccessible *GetDocAccessibleFor(nsINode *aNode)
   {
     nsIPresShell *presShell = nsCoreUtils::GetPresShellFor(aNode);
--- a/accessible/src/base/nsAccessNode.cpp
+++ b/accessible/src/base/nsAccessNode.cpp
@@ -84,35 +84,35 @@ NS_INTERFACE_MAP_END
  
 NS_IMPL_CYCLE_COLLECTING_ADDREF(nsAccessNode)
 NS_IMPL_CYCLE_COLLECTING_RELEASE_WITH_DESTROY(nsAccessNode, LastRelease())
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessNode construction/desctruction
 
 nsAccessNode::
-  nsAccessNode(nsIContent *aContent, nsIWeakReference *aShell) :
-  mContent(aContent), mWeakShell(aShell)
+  nsAccessNode(nsIContent* aContent, nsDocAccessible* aDoc) :
+  mContent(aContent), mDoc(aDoc)
 {
 #ifdef DEBUG_A11Y
   mIsInitialized = false;
 #endif
 }
 
 nsAccessNode::~nsAccessNode()
 {
-  NS_ASSERTION(!mWeakShell, "LastRelease was never called!?!");
+  NS_ASSERTION(!mDoc, "LastRelease was never called!?!");
 }
 
 void nsAccessNode::LastRelease()
 {
   // First cleanup if needed...
-  if (mWeakShell) {
+  if (mDoc) {
     Shutdown();
-    NS_ASSERTION(!mWeakShell, "A Shutdown() impl forgot to call its parent's Shutdown?");
+    NS_ASSERTION(!mDoc, "A Shutdown() impl forgot to call its parent's Shutdown?");
   }
   // ... then die.
   delete this;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessNode public
 
@@ -128,17 +128,17 @@ nsAccessNode::Init()
   return true;
 }
 
 
 void
 nsAccessNode::Shutdown()
 {
   mContent = nsnull;
-  mWeakShell = nsnull;
+  mDoc = nsnull;
 }
 
 nsApplicationAccessible*
 nsAccessNode::GetApplicationAccessible()
 {
   NS_ASSERTION(!nsAccessibilityService::IsShutdown(),
                "Accessibility wasn't initialized!");
 
@@ -210,41 +210,25 @@ void nsAccessNode::ShutdownXPAccessibili
   if (gApplicationAccessible) {
     gApplicationAccessible->Shutdown();
     NS_RELEASE(gApplicationAccessible);
   }
 
   NotifyA11yInitOrShutdown(false);
 }
 
-already_AddRefed<nsIPresShell>
-nsAccessNode::GetPresShell()
-{
-  nsIPresShell* presShell = nsnull;
-  if (mWeakShell)
-    CallQueryReferent(mWeakShell.get(), &presShell);
-
-  return presShell;
-}
-
 // nsAccessNode protected
 nsPresContext* nsAccessNode::GetPresContext()
 {
-  nsCOMPtr<nsIPresShell> presShell(GetPresShell());
-  if (!presShell) {
+  if (IsDefunct())
     return nsnull;
-  }
-  return presShell->GetPresContext();
-}
 
-nsDocAccessible *
-nsAccessNode::GetDocAccessible() const
-{
-  return mContent ?
-    GetAccService()->GetDocAccessible(mContent->OwnerDoc()) : nsnull;
+  nsIPresShell* presShell(mDoc->PresShell());
+
+  return presShell ? presShell->GetPresContext() : nsnull;
 }
 
 nsRootAccessible*
 nsAccessNode::RootAccessible() const
 {
   nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem =
     nsCoreUtils::GetDocShellTreeItemFor(mContent);
   NS_ASSERTION(docShellTreeItem, "No docshell tree item for mContent");
@@ -276,17 +260,17 @@ nsAccessNode::IsPrimaryForNode() const
 
 ////////////////////////////////////////////////////////////////////////////////
 void
 nsAccessNode::ScrollTo(PRUint32 aScrollType)
 {
   if (IsDefunct())
     return;
 
-  nsCOMPtr<nsIPresShell> shell(GetPresShell());
+  nsIPresShell* shell = mDoc->PresShell();
   if (!shell)
     return;
 
   nsIFrame *frame = GetFrame();
   if (!frame)
     return;
 
   nsIContent* content = frame->GetContent();
@@ -300,19 +284,17 @@ nsAccessNode::ScrollTo(PRUint32 aScrollT
 }
 
 // nsAccessNode public
 already_AddRefed<nsINode>
 nsAccessNode::GetCurrentFocus()
 {
   // XXX: consider to use nsFocusManager directly, it allows us to avoid
   // unnecessary query interface calls.
-  nsCOMPtr<nsIPresShell> shell = GetPresShell();
-  NS_ENSURE_TRUE(shell, nsnull);
-  nsIDocument *doc = shell->GetDocument();
+  nsIDocument* doc = GetDocumentNode();
   NS_ENSURE_TRUE(doc, nsnull);
 
   nsIDOMWindow* win = doc->GetWindow();
 
   nsCOMPtr<nsIDOMWindow> focusedWindow;
   nsCOMPtr<nsIDOMElement> focusedElement;
   nsCOMPtr<nsIFocusManager> fm = do_GetService(FOCUSMANAGER_CONTRACTID);
   if (fm)
--- a/accessible/src/base/nsAccessNode.h
+++ b/accessible/src/base/nsAccessNode.h
@@ -66,34 +66,34 @@ class nsIDocShellTreeItem;
 
 #define ACCESSIBLE_BUNDLE_URL "chrome://global-platform/locale/accessible.properties"
 #define PLATFORM_KEYS_BUNDLE_URL "chrome://global-platform/locale/platformKeys.properties"
 
 class nsAccessNode: public nsISupports
 {
 public:
 
-  nsAccessNode(nsIContent *aContent, nsIWeakReference *aShell);
+  nsAccessNode(nsIContent* aContent, nsDocAccessible* aDoc);
   virtual ~nsAccessNode();
 
     NS_DECL_CYCLE_COLLECTING_ISUPPORTS
     NS_DECL_CYCLE_COLLECTION_CLASS(nsAccessNode)
 
     static void InitXPAccessibility();
     static void ShutdownXPAccessibility();
 
   /**
    * Return an application accessible.
    */
   static nsApplicationAccessible* GetApplicationAccessible();
 
   /**
    * Return the document accessible for this access node.
    */
-  nsDocAccessible *GetDocAccessible() const;
+  nsDocAccessible* Document() const { return mDoc; }
 
   /**
    * Return the root document accessible for this accessnode.
    */
   nsRootAccessible* RootAccessible() const;
 
   /**
    * Return focused node within accessible window.
@@ -143,26 +143,16 @@ public:
     return node && node->IsElement();
   }
   bool IsDocumentNode() const
   {
     return GetNode() && GetNode()->IsNodeOfType(nsINode::eDOCUMENT);
   }
 
   /**
-   * Return the corresponding press shell for this accessible.
-   */
-  already_AddRefed<nsIPresShell> GetPresShell();
-
-  /**
-   * Return presentation shell for the accessible.
-   */
-  nsIWeakReference* GetWeakShell() const { return mWeakShell; }
-
-  /**
    * Return the unique identifier of the accessible.
    */
   void* UniqueID() { return static_cast<void*>(this); }
 
   /**
    * Return true if the accessible is primary accessible for the given DOM node.
    *
    * Accessible hierarchy may be complex for single DOM node, in this case
@@ -184,17 +174,17 @@ public:
   void ScrollTo(PRUint32 aType);
 
 protected:
     nsPresContext* GetPresContext();
 
     void LastRelease();
 
   nsCOMPtr<nsIContent> mContent;
-  nsCOMPtr<nsIWeakReference> mWeakShell;
+  nsDocAccessible* mDoc;
 
     /**
      * Notify global nsIObserver's that a11y is getting init'd or shutdown
      */
     static void NotifyA11yInitOrShutdown(bool aIsInit);
 
     // Static data, we do our own refcounting for our static data
     static nsIStringBundle *gStringBundle;
--- a/accessible/src/base/nsAccessibilityService.cpp
+++ b/accessible/src/base/nsAccessibilityService.cpp
@@ -200,154 +200,168 @@ nsAccessibilityService::GetRootDocumentA
       }
 
       return aCanCreate ?
         GetDocAccessible(documentNode) : GetDocAccessibleFromCache(documentNode);
     }
   }
   return nsnull;
 }
-
+ 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateOuterDocAccessible(nsIContent* aContent,
                                                  nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
-  nsAccessible* accessible = new nsOuterDocAccessible(aContent, weakShell);
-  NS_IF_ADDREF(accessible);
+  nsAccessible* accessible = 
+    new nsOuterDocAccessible(aContent, 
+                             nsAccUtils::GetDocAccessibleFor(aPresShell));
+  NS_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTML4ButtonAccessible(nsIContent* aContent,
                                                     nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
-  nsAccessible* accessible = new nsHTML4ButtonAccessible(aContent, weakShell);
-  NS_IF_ADDREF(accessible);
+  nsAccessible* accessible = 
+    new nsHTML4ButtonAccessible(aContent, 
+                                nsAccUtils::GetDocAccessibleFor(aPresShell));
+  NS_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLButtonAccessible(nsIContent* aContent,
                                                    nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
-  nsAccessible* accessible = new nsHTMLButtonAccessible(aContent, weakShell);
-  NS_IF_ADDREF(accessible);
+  nsAccessible* accessible = 
+    new nsHTMLButtonAccessible(aContent, 
+                               nsAccUtils::GetDocAccessibleFor(aPresShell));
+  NS_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLLIAccessible(nsIContent* aContent,
                                                nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
-  nsAccessible* accessible = new nsHTMLLIAccessible(aContent, weakShell);
-  NS_IF_ADDREF(accessible);
+  nsAccessible* accessible = 
+    new nsHTMLLIAccessible(aContent, 
+                           nsAccUtils::GetDocAccessibleFor(aPresShell));
+  NS_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHyperTextAccessible(nsIContent* aContent,
                                                   nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
-  nsAccessible* accessible = new nsHyperTextAccessibleWrap(aContent, weakShell);
-  NS_IF_ADDREF(accessible);
+  nsAccessible* accessible = 
+    new nsHyperTextAccessibleWrap(aContent, 
+                                  nsAccUtils::GetDocAccessibleFor(aPresShell));
+  NS_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLCheckboxAccessible(nsIContent* aContent,
                                                      nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
-  nsAccessible* accessible = new nsHTMLCheckboxAccessible(aContent, weakShell);
-  NS_IF_ADDREF(accessible);
+  nsAccessible* accessible = 
+    new nsHTMLCheckboxAccessible(aContent, 
+                                 nsAccUtils::GetDocAccessibleFor(aPresShell));
+  NS_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLComboboxAccessible(nsIContent* aContent,
                                                      nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
-  nsAccessible* accessible = new nsHTMLComboboxAccessible(aContent, weakShell);
-  NS_IF_ADDREF(accessible);
+  nsAccessible* accessible = 
+    new nsHTMLComboboxAccessible(aContent, 
+                                 nsAccUtils::GetDocAccessibleFor(aPresShell));
+  NS_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLCanvasAccessible(nsIContent* aContent,
                                                    nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
-  nsAccessible* accessible = new nsHTMLCanvasAccessible(aContent, weakShell);
-  NS_IF_ADDREF(accessible);
+  nsAccessible* accessible = 
+    new nsHTMLCanvasAccessible(aContent, 
+                               nsAccUtils::GetDocAccessibleFor(aPresShell));
+  NS_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLFileInputAccessible(nsIContent* aContent,
                                                       nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
-  nsAccessible* accessible = new nsHTMLFileInputAccessible(aContent, weakShell);
-  NS_IF_ADDREF(accessible);
+  nsAccessible* accessible = 
+    new nsHTMLFileInputAccessible(aContent, 
+                                  nsAccUtils::GetDocAccessibleFor(aPresShell));
+  NS_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLImageAccessible(nsIContent* aContent,
                                                   nsIPresShell* aPresShell)
 {
   nsAutoString mapElmName;
   aContent->GetAttr(kNameSpaceID_None, nsGkAtoms::usemap, mapElmName);
   nsCOMPtr<nsIDOMHTMLMapElement> mapElm;
   if (nsIDocument* document = aContent->GetCurrentDoc()) {
     mapElm = do_QueryInterface(document->FindImageMap(mapElmName));
   }
 
-  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
   nsAccessible* accessible = mapElm ?
-    new nsHTMLImageMapAccessible(aContent, weakShell, mapElm) :
-    new nsHTMLImageAccessibleWrap(aContent, weakShell);
-  NS_IF_ADDREF(accessible);
+    new nsHTMLImageMapAccessible(aContent, 
+                                 nsAccUtils::GetDocAccessibleFor(aPresShell), 
+                                 mapElm) :
+    new nsHTMLImageAccessibleWrap(aContent, 
+                                  nsAccUtils::GetDocAccessibleFor(aPresShell));
+  NS_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLGroupboxAccessible(nsIContent* aContent,
                                                      nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
-  nsAccessible* accessible = new nsHTMLGroupboxAccessible(aContent, weakShell);
-  NS_IF_ADDREF(accessible);
+  nsAccessible* accessible = 
+    new nsHTMLGroupboxAccessible(aContent, 
+                                 nsAccUtils::GetDocAccessibleFor(aPresShell));
+  NS_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLListboxAccessible(nsIContent* aContent,
                                                     nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
-  nsAccessible* accessible = new nsHTMLSelectListAccessible(aContent, weakShell);
-  NS_IF_ADDREF(accessible);
+  nsAccessible* accessible = 
+    new nsHTMLSelectListAccessible(aContent, 
+                                   nsAccUtils::GetDocAccessibleFor(aPresShell));
+  NS_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLMediaAccessible(nsIContent* aContent,
                                                   nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
-  nsAccessible* accessible = new nsEnumRoleAccessible(aContent, weakShell,
-                                                      roles::GROUPING);
-  NS_IF_ADDREF(accessible);
+  nsAccessible* accessible = 
+    new nsEnumRoleAccessible(aContent, 
+                             nsAccUtils::GetDocAccessibleFor(aPresShell),
+                             roles::GROUPING);
+  NS_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLObjectFrameAccessible(nsObjectFrame* aFrame,
                                                         nsIContent* aContent,
                                                         nsIPresShell* aPresShell)
 {
@@ -357,17 +371,16 @@ nsAccessibilityService::CreateHTMLObject
   // 2) web content that uses a plugin, which means we will have to go to
   //    the plugin to get the accessible content;
   // 3) an image or imagemap, where the image frame points back to the object
   //    element DOMNode.
 
   if (aFrame->GetRect().IsEmpty())
     return nsnull;
 
-  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
 
   // 1) for object elements containing either HTML or TXT documents
   nsCOMPtr<nsIDOMHTMLObjectElement> obj(do_QueryInterface(aContent));
   if (obj) {
     nsCOMPtr<nsIDOMDocument> domDoc;
     obj->GetContentDocument(getter_AddRefs(domDoc));
     if (domDoc)
       return CreateOuterDocAccessible(aContent, aPresShell);
@@ -378,134 +391,145 @@ nsAccessibilityService::CreateHTMLObject
   nsRefPtr<nsNPAPIPluginInstance> pluginInstance;
   if (NS_SUCCEEDED(aFrame->GetPluginInstance(getter_AddRefs(pluginInstance))) &&
       pluginInstance) {
 #ifdef XP_WIN
     // Note: pluginPort will be null if windowless.
     HWND pluginPort = nsnull;
     aFrame->GetPluginPort(&pluginPort);
 
-    nsAccessible* accessible = new nsHTMLWin32ObjectOwnerAccessible(aContent,
-                                                                    weakShell,
-                                                                    pluginPort);
-    NS_IF_ADDREF(accessible);
+    nsAccessible* accessible = 
+      new nsHTMLWin32ObjectOwnerAccessible(aContent,
+                                           nsAccUtils::GetDocAccessibleFor(aPresShell),
+                                           pluginPort);
+    NS_ADDREF(accessible);
     return accessible;
 
 #elif MOZ_ACCESSIBILITY_ATK
     if (!AtkSocketAccessible::gCanEmbed)
       return nsnull;
 
     nsCString plugId;
     nsresult rv = pluginInstance->GetValueFromPlugin(
       NPPVpluginNativeAccessibleAtkPlugId, &plugId);
     if (NS_SUCCEEDED(rv) && !plugId.IsEmpty()) {
       AtkSocketAccessible* socketAccessible =
-        new AtkSocketAccessible(aContent, weakShell, plugId);
+        new AtkSocketAccessible(aContent, 
+                                nsAccUtils::GetDocAccessibleFor(aPresShell), 
+                                plugId);
 
-      NS_IF_ADDREF(socketAccessible);
+      NS_ADDREF(socketAccessible);
       return socketAccessible;
     }
 #endif
   }
 #endif
 
   // 3) for images and imagemaps, or anything else with a child frame
   // we have the object frame, get the image frame
   nsIFrame* frame = aFrame->GetFirstPrincipalChild();
   return frame ? frame->CreateAccessible() : nsnull;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLRadioButtonAccessible(nsIContent* aContent,
                                                         nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
-  nsAccessible* accessible = new nsHTMLRadioButtonAccessible(aContent, weakShell);
-  NS_IF_ADDREF(accessible);
+  nsAccessible* accessible = 
+    new nsHTMLRadioButtonAccessible(aContent, 
+                                    nsAccUtils::GetDocAccessibleFor(aPresShell));
+  NS_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLTableAccessible(nsIContent* aContent,
                                                   nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
-  nsAccessible* accessible = new nsHTMLTableAccessibleWrap(aContent, weakShell);
-  NS_IF_ADDREF(accessible);
+  nsAccessible* accessible = 
+    new nsHTMLTableAccessibleWrap(aContent, 
+                                  nsAccUtils::GetDocAccessibleFor(aPresShell));
+  NS_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLTableCellAccessible(nsIContent* aContent,
                                                       nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
-  nsAccessible* accessible = new nsHTMLTableCellAccessibleWrap(aContent,
-                                                               weakShell);
-  NS_IF_ADDREF(accessible);
+  nsAccessible* accessible = 
+    new nsHTMLTableCellAccessibleWrap(aContent,
+                                      nsAccUtils::GetDocAccessibleFor(aPresShell));
+  NS_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLTextAccessible(nsIContent* aContent,
                                                  nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
-  nsAccessible* accessible = new nsHTMLTextAccessible(aContent, weakShell);
-  NS_IF_ADDREF(accessible);
+  nsAccessible* accessible = 
+    new nsHTMLTextAccessible(aContent, 
+                             nsAccUtils::GetDocAccessibleFor(aPresShell));
+  NS_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLTextFieldAccessible(nsIContent* aContent,
                                                       nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
-  nsAccessible* accessible = new nsHTMLTextFieldAccessible(aContent, weakShell);
-  NS_IF_ADDREF(accessible);
+  nsAccessible* accessible = 
+    new nsHTMLTextFieldAccessible(aContent, 
+                                  nsAccUtils::GetDocAccessibleFor(aPresShell));
+  NS_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLLabelAccessible(nsIContent* aContent,
                                                   nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
-  nsAccessible* accessible = new nsHTMLLabelAccessible(aContent, weakShell);
-  NS_IF_ADDREF(accessible);
+  nsAccessible* accessible = 
+    new nsHTMLLabelAccessible(aContent, 
+                              nsAccUtils::GetDocAccessibleFor(aPresShell));
+  NS_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLHRAccessible(nsIContent* aContent,
                                                nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
-  nsAccessible* accessible = new nsHTMLHRAccessible(aContent, weakShell);
-  NS_IF_ADDREF(accessible);
+  nsAccessible* accessible = 
+    new nsHTMLHRAccessible(aContent, 
+                           nsAccUtils::GetDocAccessibleFor(aPresShell));
+  NS_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLBRAccessible(nsIContent* aContent,
                                                nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
-  nsAccessible* accessible = new nsHTMLBRAccessible(aContent, weakShell);
-  NS_IF_ADDREF(accessible);
+  nsAccessible* accessible = 
+    new nsHTMLBRAccessible(aContent, 
+                           nsAccUtils::GetDocAccessibleFor(aPresShell));
+  NS_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLCaptionAccessible(nsIContent* aContent,
                                                     nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
-  nsAccessible* accessible = new nsHTMLCaptionAccessible(aContent, weakShell);
-  NS_IF_ADDREF(accessible);
+  nsAccessible* accessible = 
+    new nsHTMLCaptionAccessible(aContent, 
+                                nsAccUtils::GetDocAccessibleFor(aPresShell));
+  NS_ADDREF(accessible);
   return accessible;
 }
 
 void
 nsAccessibilityService::ContentRangeInserted(nsIPresShell* aPresShell,
                                              nsIContent* aContainer,
                                              nsIContent* aStartChild,
                                              nsIContent* aEndChild)
@@ -666,17 +690,17 @@ nsAccessibilityService::GetAccessibleFor
   *aAccessible = nsnull;
   if (!aNode)
     return NS_OK;
 
   nsCOMPtr<nsINode> node(do_QueryInterface(aNode));
   if (!node)
     return NS_ERROR_INVALID_ARG;
 
-  NS_IF_ADDREF(*aAccessible = GetAccessible(node));
+  NS_IF_ADDREF(*aAccessible = GetAccessible(node, nsnull));
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsAccessibilityService::GetStringRole(PRUint32 aRole, nsAString& aString)
 {
   if ( aRole >= ArrayLength(kRoleNames)) {
     aString.AssignLiteral("unknown");
@@ -877,50 +901,38 @@ nsAccessibilityService::CreateAccessible
   NS_ENSURE_TRUE(accessibleRoot, NS_ERROR_INVALID_ARG);
 
   nsAccessiblePivot* pivot = new nsAccessiblePivot(accessibleRoot);
   NS_ADDREF(*aPivot = pivot);
 
   return NS_OK;
 }
 
-// nsIAccesibilityService
-nsAccessible*
-nsAccessibilityService::GetAccessibleInShell(nsINode* aNode,
-                                             nsIPresShell* aPresShell)
-{
-  if (!aNode || !aPresShell)
-    return nsnull;
-
-  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
-  return GetAccessibleInWeakShell(aNode, weakShell);
-}
-
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessibilityService public
 
 nsAccessible*
-nsAccessibilityService::GetAccessible(nsINode* aNode)
+nsAccessibilityService::GetAccessible(nsINode* aNode, nsIPresShell* aPresShell)
 {
   NS_PRECONDITION(aNode, "Getting an accessible for null node! Crash.");
 
+  // XXX handle the presshell
   nsDocAccessible* document = GetDocAccessible(aNode->OwnerDoc());
   return document ? document->GetAccessible(aNode) : nsnull;
 }
 
 nsAccessible*
-nsAccessibilityService::GetAccessibleOrContainer(nsINode* aNode,
-                                                 nsIWeakReference* aWeakShell)
+nsAccessibilityService::GetAccessibleOrContainer(nsINode* aNode, nsDocAccessible* aDoc)
 {
   if (!aNode)
     return nsnull;
 
-  // XXX: weak shell is ignored until multiple shell documents are supported.
-  nsDocAccessible* document = GetDocAccessible(aNode->OwnerDoc());
-  return document ? document->GetAccessibleOrContainer(aNode) : nsnull;
+  NS_PRECONDITION(aDoc, "Must pass a document accessible.");
+
+  return aDoc ? aDoc->GetAccessibleOrContainer(aNode) : nsnull;
 }
 
 static bool HasRelatedContent(nsIContent *aContent)
 {
   nsAutoString id;
   if (!aContent || !nsCoreUtils::GetID(aContent, id) || id.IsEmpty()) {
     return false;
   }
@@ -928,28 +940,27 @@ static bool HasRelatedContent(nsIContent
   // If the given ID is referred by relation attribute then create an accessible
   // for it. Take care of HTML elements only for now.
   return aContent->IsHTML() &&
     nsAccUtils::GetDocAccessibleFor(aContent)->IsDependentID(id);
 }
 
 nsAccessible*
 nsAccessibilityService::GetOrCreateAccessible(nsINode* aNode,
-                                              nsIPresShell* aPresShell,
-                                              nsIWeakReference* aWeakShell,
+                                              nsDocAccessible* aDoc,
                                               bool* aIsSubtreeHidden)
 {
-  if (!aPresShell || !aWeakShell || !aNode || gIsShutdown)
+  if (!aDoc || !aNode || gIsShutdown)
     return nsnull;
 
   if (aIsSubtreeHidden)
     *aIsSubtreeHidden = false;
 
   // Check to see if we already have an accessible for this node in the cache.
-  nsAccessible* cachedAccessible = GetAccessibleInWeakShell(aNode, aWeakShell);
+  nsAccessible* cachedAccessible = aDoc->GetAccessible(aNode);
   if (cachedAccessible)
     return cachedAccessible;
 
   // No cache entry, so we must create the accessible.
 
   if (aNode->IsNodeOfType(nsINode::eDOCUMENT)) {
     // If it's document node then ask accessible document loader for
     // document accessible, otherwise return null.
@@ -958,18 +969,18 @@ nsAccessibilityService::GetOrCreateAcces
   }
 
   // We have a content node.
   if (!aNode->IsInDoc()) {
     NS_WARNING("Creating accessible for node with no document");
     return nsnull;
   }
 
-  if (aNode->OwnerDoc() != aPresShell->GetDocument()) {
-    NS_ERROR("Creating accessible for wrong pres shell");
+  if (aNode->OwnerDoc() != aDoc->GetDocumentNode()) {
+    NS_ERROR("Creating accessible for wrong document");
     return nsnull;
   }
 
   nsCOMPtr<nsIContent> content(do_QueryInterface(aNode));
   if (!content)
     return nsnull;
 
   // Frames can be deallocated when we flush layout, or when we call into code
@@ -1052,17 +1063,17 @@ nsAccessibilityService::GetOrCreateAcces
     if (nsLayoutUtils::GetAllInFlowRectsUnion(weakFrame,
                                               weakFrame->GetParent()).IsEmpty()) {
       if (aIsSubtreeHidden)
         *aIsSubtreeHidden = true;
 
       return nsnull;
     }
 
-    newAcc = new nsHyperTextAccessibleWrap(content, aWeakShell);
+    newAcc = new nsHyperTextAccessibleWrap(content, docAcc);
     if (docAcc->BindToDocument(newAcc, nsAccUtils::GetRoleMapEntry(aNode)))
       return newAcc;
     return nsnull;
   }
 
   nsRoleMapEntry *roleMapEntry = nsAccUtils::GetRoleMapEntry(aNode);
   if (roleMapEntry && !nsCRT::strcmp(roleMapEntry->roleString, "presentation")) {
     // Ignore presentation role if element is focusable (focus event shouldn't
@@ -1090,18 +1101,17 @@ nsAccessibilityService::GetOrCreateAcces
       // accessibles
       nsIContent *tableContent = content;
       while ((tableContent = tableContent->GetParent()) != nsnull) {
         nsIFrame *tableFrame = tableContent->GetPrimaryFrame();
         if (!tableFrame)
           continue;
 
         if (tableFrame->GetType() == nsGkAtoms::tableOuterFrame) {
-          nsAccessible *tableAccessible =
-            GetAccessibleInWeakShell(tableContent, aWeakShell);
+          nsAccessible* tableAccessible = aDoc->GetAccessible(tableContent);
 
           if (tableAccessible) {
             if (!roleMapEntry) {
               roles::Role role = tableAccessible->Role();
               // No ARIA role and not in table: override role. For example,
               // <table role="label"><td>content</td></table>
               if (role != roles::TABLE && role != roles::TREE_TABLE)
                 roleMapEntry = &nsARIAMap::gEmptyRoleMap;
@@ -1146,45 +1156,45 @@ nsAccessibilityService::GetOrCreateAcces
     if (roleMapEntry) {
       // Create ARIA grid/treegrid accessibles if node is not of a child or
       // valid child of HTML table and is not a HTML table.
       if ((!partOfHTMLTable || !tryTagNameOrFrame) &&
           frameType != nsGkAtoms::tableOuterFrame) {
 
         if (roleMapEntry->role == roles::TABLE ||
             roleMapEntry->role == roles::TREE_TABLE) {
-          newAcc = new nsARIAGridAccessibleWrap(content, aWeakShell);
+          newAcc = new nsARIAGridAccessibleWrap(content, docAcc);
 
         } else if (roleMapEntry->role == roles::GRID_CELL ||
             roleMapEntry->role == roles::ROWHEADER ||
             roleMapEntry->role == roles::COLUMNHEADER) {
-          newAcc = new nsARIAGridCellAccessibleWrap(content, aWeakShell);
+          newAcc = new nsARIAGridCellAccessibleWrap(content, docAcc);
         }
       }
     }
 
     if (!newAcc && tryTagNameOrFrame) {
       // Prefer to use markup (mostly tag name, perhaps attributes) to
       // decide if and what kind of accessible to create.
       // The method creates accessibles for table related content too therefore
       // we do not call it if accessibles for table related content are
       // prevented above.
       newAcc = CreateHTMLAccessibleByMarkup(weakFrame.GetFrame(), content,
-                                            aWeakShell);
+                                            docAcc);
 
       if (!newAcc) {
         // Do not create accessible object subtrees for non-rendered table
         // captions. This could not be done in
         // nsTableCaptionFrame::GetAccessible() because the descendants of
         // the table caption would still be created. By setting
         // *aIsSubtreeHidden = true we ensure that no descendant accessibles
         // are created.
         nsIFrame* f = weakFrame.GetFrame();
         if (!f) {
-          f = aPresShell->GetRealPrimaryFrameFor(content);
+          f = aDoc->PresShell()->GetRealPrimaryFrameFor(content);
         }
         if (f->GetType() == nsGkAtoms::tableCaptionFrame &&
            f->GetRect().IsEmpty()) {
           // XXX This is not the ideal place for this code, but right now there
           // is no better place:
           if (aIsSubtreeHidden)
             *aIsSubtreeHidden = true;
 
@@ -1195,55 +1205,55 @@ nsAccessibilityService::GetOrCreateAcces
         newAcc = f->CreateAccessible();
       }
     }
   }
 
   if (!newAcc) {
     // Elements may implement nsIAccessibleProvider via XBL. This allows them to
     // say what kind of accessible to create.
-    newAcc = CreateAccessibleByType(content, aWeakShell);
+    newAcc = CreateAccessibleByType(content, docAcc);
   }
 
   if (!newAcc) {
     // Create generic accessibles for SVG and MathML nodes.
     if (content->IsSVG(nsGkAtoms::svg)) {
-      newAcc = new nsEnumRoleAccessible(content, aWeakShell,
+      newAcc = new nsEnumRoleAccessible(content, docAcc,
                                         roles::DIAGRAM);
     }
     else if (content->IsMathML(nsGkAtoms::math)) {
-      newAcc = new nsEnumRoleAccessible(content, aWeakShell,
+      newAcc = new nsEnumRoleAccessible(content, docAcc,
                                         roles::EQUATION);
     }
   }
 
   if (!newAcc) {
     newAcc = CreateAccessibleForDeckChild(weakFrame.GetFrame(), content,
-                                          aWeakShell);
+                                          docAcc);
   }
 
   // If no accessible, see if we need to create a generic accessible because
   // of some property that makes this object interesting
   // We don't do this for <body>, <html>, <window>, <dialog> etc. which 
   // correspond to the doc accessible and will be created in any case
   if (!newAcc && content->Tag() != nsGkAtoms::body && content->GetParent() && 
       ((weakFrame.GetFrame() && weakFrame.GetFrame()->IsFocusable()) ||
        (isHTML && nsCoreUtils::HasClickListener(content)) ||
        HasUniversalAriaProperty(content) || roleMapEntry ||
        HasRelatedContent(content) || nsCoreUtils::IsXLink(content))) {
     // This content is focusable or has an interesting dynamic content accessibility property.
     // If it's interesting we need it in the accessibility hierarchy so that events or
     // other accessibles can point to it, or so that it can hold a state, etc.
     if (isHTML) {
       // Interesting HTML container which may have selectable text and/or embedded objects
-      newAcc = new nsHyperTextAccessibleWrap(content, aWeakShell);
+      newAcc = new nsHyperTextAccessibleWrap(content, docAcc);
     }
     else {  // XUL, SVG, MathML etc.
       // Interesting generic non-HTML container
-      newAcc = new nsAccessibleWrap(content, aWeakShell);
+      newAcc = new nsAccessibleWrap(content, docAcc);
     }
   }
 
   return docAcc->BindToDocument(newAcc, roleMapEntry) ? newAcc : nsnull;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessibilityService private
@@ -1314,415 +1324,413 @@ nsAccessibilityService::HasUniversalAria
          aContent->HasAttr(kNameSpaceID_None, nsGkAtoms::aria_labelledby) ||
          nsAccUtils::HasDefinedARIAToken(aContent, nsGkAtoms::aria_live) ||
          nsAccUtils::HasDefinedARIAToken(aContent, nsGkAtoms::aria_owns) ||
          nsAccUtils::HasDefinedARIAToken(aContent, nsGkAtoms::aria_relevant);
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateAccessibleByType(nsIContent* aContent,
-                                               nsIWeakReference* aWeakShell)
+                                               nsDocAccessible* aDoc)
 {
   nsCOMPtr<nsIAccessibleProvider> accessibleProvider(do_QueryInterface(aContent));
   if (!accessibleProvider)
     return nsnull;
 
   PRInt32 type;
   nsresult rv = accessibleProvider->GetAccessibleType(&type);
   if (NS_FAILED(rv))
     return nsnull;
 
   if (type == nsIAccessibleProvider::OuterDoc) {
-    nsAccessible* accessible = new nsOuterDocAccessible(aContent, aWeakShell);
+    nsAccessible* accessible = new nsOuterDocAccessible(aContent, aDoc);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
   nsAccessible* accessible = nsnull;
   switch (type)
   {
 #ifdef MOZ_XUL
     case nsIAccessibleProvider::NoAccessible:
       return nsnull;
 
     // XUL controls
     case nsIAccessibleProvider::XULAlert:
-      accessible = new nsXULAlertAccessible(aContent, aWeakShell);
+      accessible = new nsXULAlertAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULButton:
-      accessible = new nsXULButtonAccessible(aContent, aWeakShell);
+      accessible = new nsXULButtonAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULCheckbox:
-      accessible = new nsXULCheckboxAccessible(aContent, aWeakShell);
+      accessible = new nsXULCheckboxAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULColorPicker:
-      accessible = new nsXULColorPickerAccessible(aContent, aWeakShell);
+      accessible = new nsXULColorPickerAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULColorPickerTile:
-      accessible = new nsXULColorPickerTileAccessible(aContent, aWeakShell);
+      accessible = new nsXULColorPickerTileAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULCombobox:
-      accessible = new nsXULComboboxAccessible(aContent, aWeakShell);
+      accessible = new nsXULComboboxAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULDropmarker:
-      accessible = new nsXULDropmarkerAccessible(aContent, aWeakShell);
+      accessible = new nsXULDropmarkerAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULGroupbox:
-      accessible = new nsXULGroupboxAccessible(aContent, aWeakShell);
+      accessible = new nsXULGroupboxAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULImage:
     {
       // Don't include nameless images in accessible tree.
       if (!aContent->HasAttr(kNameSpaceID_None,
                              nsGkAtoms::tooltiptext))
         return nsnull;
 
-      accessible = new nsHTMLImageAccessibleWrap(aContent, aWeakShell);
+      accessible = new nsHTMLImageAccessibleWrap(aContent, aDoc);
       break;
 
     }
     case nsIAccessibleProvider::XULLink:
-      accessible = new nsXULLinkAccessible(aContent, aWeakShell);
+      accessible = new nsXULLinkAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULListbox:
-      accessible = new nsXULListboxAccessibleWrap(aContent, aWeakShell);
+      accessible = new nsXULListboxAccessibleWrap(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULListCell:
-      accessible = new nsXULListCellAccessibleWrap(aContent, aWeakShell);
+      accessible = new nsXULListCellAccessibleWrap(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULListHead:
-      accessible = new nsXULColumnsAccessible(aContent, aWeakShell);
+      accessible = new nsXULColumnsAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULListHeader:
-      accessible = new nsXULColumnItemAccessible(aContent, aWeakShell);
+      accessible = new nsXULColumnItemAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULListitem:
-      accessible = new nsXULListitemAccessible(aContent, aWeakShell);
+      accessible = new nsXULListitemAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULMenubar:
-      accessible = new nsXULMenubarAccessible(aContent, aWeakShell);
+      accessible = new nsXULMenubarAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULMenuitem:
-      accessible = new nsXULMenuitemAccessibleWrap(aContent, aWeakShell);
+      accessible = new nsXULMenuitemAccessibleWrap(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULMenupopup:
     {
 #ifdef MOZ_ACCESSIBILITY_ATK
       // ATK considers this node to be redundant when within menubars, and it makes menu
       // navigation with assistive technologies more difficult
       // XXX In the future we will should this for consistency across the nsIAccessible
       // implementations on each platform for a consistent scripting environment, but
       // then strip out redundant accessibles in the nsAccessibleWrap class for each platform.
       nsIContent *parent = aContent->GetParent();
       if (parent && parent->NodeInfo()->Equals(nsGkAtoms::menu,
                                                kNameSpaceID_XUL))
         return nsnull;
 #endif
-      accessible = new nsXULMenupopupAccessible(aContent, aWeakShell);
+      accessible = new nsXULMenupopupAccessible(aContent, aDoc);
       break;
 
     }
     case nsIAccessibleProvider::XULMenuSeparator:
-      accessible = new nsXULMenuSeparatorAccessible(aContent, aWeakShell);
+      accessible = new nsXULMenuSeparatorAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULPane:
-      accessible = new nsEnumRoleAccessible(aContent, aWeakShell,
+      accessible = new nsEnumRoleAccessible(aContent, aDoc,
                                             roles::PANE);
       break;
 
     case nsIAccessibleProvider::XULProgressMeter:
-      accessible = new XULProgressMeterAccessible(aContent, aWeakShell);
+      accessible = new XULProgressMeterAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULStatusBar:
-      accessible = new nsXULStatusBarAccessible(aContent, aWeakShell);
+      accessible = new nsXULStatusBarAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULScale:
-      accessible = new nsXULSliderAccessible(aContent, aWeakShell);
+      accessible = new nsXULSliderAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULRadioButton:
-      accessible = new nsXULRadioButtonAccessible(aContent, aWeakShell);
+      accessible = new nsXULRadioButtonAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULRadioGroup:
-      accessible = new nsXULRadioGroupAccessible(aContent, aWeakShell);
+      accessible = new nsXULRadioGroupAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULTab:
-      accessible = new nsXULTabAccessible(aContent, aWeakShell);
+      accessible = new nsXULTabAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULTabs:
-      accessible = new nsXULTabsAccessible(aContent, aWeakShell);
+      accessible = new nsXULTabsAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULTabpanels:
-      accessible = new nsXULTabpanelsAccessible(aContent, aWeakShell);
+      accessible = new nsXULTabpanelsAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULText:
-      accessible = new nsXULTextAccessible(aContent, aWeakShell);
+      accessible = new nsXULTextAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULTextBox:
-      accessible = new nsXULTextFieldAccessible(aContent, aWeakShell);
+      accessible = new nsXULTextFieldAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULThumb:
-      accessible = new nsXULThumbAccessible(aContent, aWeakShell);
+      accessible = new nsXULThumbAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULTree:
-      return CreateAccessibleForXULTree(aContent, aWeakShell);
+      return CreateAccessibleForXULTree(aContent, aDoc);
 
     case nsIAccessibleProvider::XULTreeColumns:
-      accessible = new nsXULTreeColumnsAccessible(aContent, aWeakShell);
+      accessible = new nsXULTreeColumnsAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULTreeColumnItem:
-      accessible = new nsXULColumnItemAccessible(aContent, aWeakShell);
+      accessible = new nsXULColumnItemAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULToolbar:
-      accessible = new nsXULToolbarAccessible(aContent, aWeakShell);
+      accessible = new nsXULToolbarAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULToolbarSeparator:
-      accessible = new nsXULToolbarSeparatorAccessible(aContent, aWeakShell);
+      accessible = new nsXULToolbarSeparatorAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULTooltip:
-      accessible = new nsXULTooltipAccessible(aContent, aWeakShell);
+      accessible = new nsXULTooltipAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULToolbarButton:
-      accessible = new nsXULToolbarButtonAccessible(aContent, aWeakShell);
+      accessible = new nsXULToolbarButtonAccessible(aContent, aDoc);
       break;
 
 #endif // MOZ_XUL
 
     // XForms elements
     case nsIAccessibleProvider::XFormsContainer:
-      accessible = new nsXFormsContainerAccessible(aContent, aWeakShell);
+      accessible = new nsXFormsContainerAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XFormsLabel:
-      accessible = new nsXFormsLabelAccessible(aContent, aWeakShell);
+      accessible = new nsXFormsLabelAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XFormsOutput:
-      accessible = new nsXFormsOutputAccessible(aContent, aWeakShell);
+      accessible = new nsXFormsOutputAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XFormsTrigger:
-      accessible = new nsXFormsTriggerAccessible(aContent, aWeakShell);
+      accessible = new nsXFormsTriggerAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XFormsInput:
-      accessible = new nsXFormsInputAccessible(aContent, aWeakShell);
+      accessible = new nsXFormsInputAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XFormsInputBoolean:
-      accessible = new nsXFormsInputBooleanAccessible(aContent, aWeakShell);
+      accessible = new nsXFormsInputBooleanAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XFormsInputDate:
-      accessible = new nsXFormsInputDateAccessible(aContent, aWeakShell);
+      accessible = new nsXFormsInputDateAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XFormsSecret:
-      accessible = new nsXFormsSecretAccessible(aContent, aWeakShell);
+      accessible = new nsXFormsSecretAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XFormsSliderRange:
-      accessible = new nsXFormsRangeAccessible(aContent, aWeakShell);
+      accessible = new nsXFormsRangeAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XFormsSelect:
-      accessible = new nsXFormsSelectAccessible(aContent, aWeakShell);
+      accessible = new nsXFormsSelectAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XFormsChoices:
-      accessible = new nsXFormsChoicesAccessible(aContent, aWeakShell);
+      accessible = new nsXFormsChoicesAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XFormsSelectFull:
-      accessible = new nsXFormsSelectFullAccessible(aContent, aWeakShell);
+      accessible = new nsXFormsSelectFullAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XFormsItemCheckgroup:
-      accessible = new nsXFormsItemCheckgroupAccessible(aContent, aWeakShell);
+      accessible = new nsXFormsItemCheckgroupAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XFormsItemRadiogroup:
-      accessible = new nsXFormsItemRadiogroupAccessible(aContent, aWeakShell);
+      accessible = new nsXFormsItemRadiogroupAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XFormsSelectCombobox:
-      accessible = new nsXFormsSelectComboboxAccessible(aContent, aWeakShell);
+      accessible = new nsXFormsSelectComboboxAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XFormsItemCombobox:
-      accessible = new nsXFormsItemComboboxAccessible(aContent, aWeakShell);
+      accessible = new nsXFormsItemComboboxAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XFormsDropmarkerWidget:
-      accessible = new nsXFormsDropmarkerWidgetAccessible(aContent, aWeakShell);
+      accessible = new nsXFormsDropmarkerWidgetAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XFormsCalendarWidget:
-      accessible = new nsXFormsCalendarWidgetAccessible(aContent, aWeakShell);
+      accessible = new nsXFormsCalendarWidgetAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XFormsComboboxPopupWidget:
-      accessible = new nsXFormsComboboxPopupWidgetAccessible(aContent, aWeakShell);
+      accessible = new nsXFormsComboboxPopupWidgetAccessible(aContent, aDoc);
       break;
 
     default:
       return nsnull;
   }
 
   NS_IF_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLAccessibleByMarkup(nsIFrame* aFrame,
                                                      nsIContent* aContent,
-                                                     nsIWeakReference* aWeakShell)
+                                                     nsDocAccessible* aDoc)
 {
   // This method assumes we're in an HTML namespace.
   nsIAtom* tag = aContent->Tag();
   if (tag == nsGkAtoms::figcaption) {
     nsAccessible* accessible =
-      new nsHTMLFigcaptionAccessible(aContent, aWeakShell);
+      new nsHTMLFigcaptionAccessible(aContent, aDoc);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
   if (tag == nsGkAtoms::figure) {
-    nsAccessible* accessible = new nsHTMLFigureAccessible(aContent, aWeakShell);
+    nsAccessible* accessible = new nsHTMLFigureAccessible(aContent, aDoc);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
   if (tag == nsGkAtoms::legend) {
-    nsAccessible* accessible = new nsHTMLLegendAccessible(aContent, aWeakShell);
+    nsAccessible* accessible = new nsHTMLLegendAccessible(aContent, aDoc);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
   if (tag == nsGkAtoms::option) {
-    nsAccessible* accessible = new nsHTMLSelectOptionAccessible(aContent,
-                                                                aWeakShell);
+    nsAccessible* accessible = new nsHTMLSelectOptionAccessible(aContent, aDoc);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
   if (tag == nsGkAtoms::optgroup) {
     nsAccessible* accessible = new nsHTMLSelectOptGroupAccessible(aContent,
-                                                                  aWeakShell);
+                                                                  aDoc);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
   if (tag == nsGkAtoms::ul || tag == nsGkAtoms::ol ||
       tag == nsGkAtoms::dl) {
-    nsAccessible* accessible = new nsHTMLListAccessible(aContent, aWeakShell);
+    nsAccessible* accessible = new nsHTMLListAccessible(aContent, aDoc);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
   if (tag == nsGkAtoms::a) {
     // Only some roles truly enjoy life as nsHTMLLinkAccessibles, for details
     // see closed bug 494807.
     nsRoleMapEntry *roleMapEntry = nsAccUtils::GetRoleMapEntry(aContent);
     if (roleMapEntry && roleMapEntry->role != roles::NOTHING &&
         roleMapEntry->role != roles::LINK) {
-      nsAccessible* accessible = new nsHyperTextAccessibleWrap(aContent,
-                                                               aWeakShell);
+      nsAccessible* accessible = new nsHyperTextAccessibleWrap(aContent, aDoc);
       NS_IF_ADDREF(accessible);
       return accessible;
     }
 
-    nsAccessible* accessible = new nsHTMLLinkAccessible(aContent, aWeakShell);
+    nsAccessible* accessible = new nsHTMLLinkAccessible(aContent, aDoc);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
   if (tag == nsGkAtoms::dt ||
       (tag == nsGkAtoms::li &&
        aFrame->GetType() != nsGkAtoms::blockFrame)) {
     // Normally for li, it is created by the list item frame (in nsBlockFrame)
     // which knows about the bullet frame; however, in this case the list item
     // must have been styled using display: foo
-    nsAccessible* accessible = new nsHTMLLIAccessible(aContent, aWeakShell);
+    nsAccessible* accessible = new nsHTMLLIAccessible(aContent, aDoc);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
   if (tag == nsGkAtoms::abbr ||
       tag == nsGkAtoms::acronym ||
       tag == nsGkAtoms::blockquote ||
       tag == nsGkAtoms::dd ||
       tag == nsGkAtoms::form ||
       tag == nsGkAtoms::h1 ||
       tag == nsGkAtoms::h2 ||
       tag == nsGkAtoms::h3 ||
       tag == nsGkAtoms::h4 ||
       tag == nsGkAtoms::h5 ||
       tag == nsGkAtoms::h6 ||
       tag == nsGkAtoms::q) {
-    nsAccessible* accessible = new nsHyperTextAccessibleWrap(aContent, aWeakShell);
+    nsAccessible* accessible = new nsHyperTextAccessibleWrap(aContent, aDoc);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
   if (tag == nsGkAtoms::tr) {
-    nsAccessible* accessible = new nsEnumRoleAccessible(aContent, aWeakShell,
+    nsAccessible* accessible = new nsEnumRoleAccessible(aContent, aDoc,
                                                         roles::ROW);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
   if (nsCoreUtils::IsHTMLTableHeader(aContent)) {
     nsAccessible* accessible = new nsHTMLTableHeaderCellAccessibleWrap(aContent,
-                                                                       aWeakShell);
+                                                                       aDoc);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
   if (tag == nsGkAtoms::output) {
-    nsAccessible* accessible = new nsHTMLOutputAccessible(aContent, aWeakShell);
+    nsAccessible* accessible = new nsHTMLOutputAccessible(aContent, aDoc);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
   if (tag == nsGkAtoms::progress) {
     nsAccessible* accessible =
-      new HTMLProgressMeterAccessible(aContent, aWeakShell);
+      new HTMLProgressMeterAccessible(aContent, aDoc);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
   return nsnull;
  }
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -1796,71 +1804,70 @@ NS_GetAccessibilityService(nsIAccessibil
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessibilityService private (DON'T put methods here)
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateAccessibleForDeckChild(nsIFrame* aFrame,
                                                      nsIContent* aContent,
-                                                     nsIWeakReference* aWeakShell)
+                                                     nsDocAccessible* aDoc)
 {
   if (aFrame->GetType() == nsGkAtoms::boxFrame ||
       aFrame->GetType() == nsGkAtoms::scrollFrame) {
 
     nsIFrame* parentFrame = aFrame->GetParent();
     if (parentFrame && parentFrame->GetType() == nsGkAtoms::deckFrame) {
       // If deck frame is for xul:tabpanels element then the given node has
       // tabpanel accessible.
       nsCOMPtr<nsIContent> parentContent = parentFrame->GetContent();
 #ifdef MOZ_XUL
       if (parentContent->NodeInfo()->Equals(nsGkAtoms::tabpanels,
                                             kNameSpaceID_XUL)) {
-        nsAccessible* accessible = new nsXULTabpanelAccessible(aContent,
-                                                               aWeakShell);
+        nsAccessible* accessible = new nsXULTabpanelAccessible(aContent, aDoc);
         NS_IF_ADDREF(accessible);
         return accessible;
       }
 #endif
-      nsAccessible* accessible = new nsEnumRoleAccessible(aContent, aWeakShell,
+      nsAccessible* accessible = new nsEnumRoleAccessible(aContent, aDoc,
                                                           roles::PROPERTYPAGE);
       NS_IF_ADDREF(accessible);
       return accessible;
     }
   }
 
   return nsnull;
 }
 
 #ifdef MOZ_XUL
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateAccessibleForXULTree(nsIContent* aContent,
-                                                   nsIWeakReference* aWeakShell)
+                                                   nsDocAccessible* aDoc)
 {
   nsCOMPtr<nsITreeBoxObject> treeBoxObj = nsCoreUtils::GetTreeBoxObject(aContent);
   if (!treeBoxObj)
     return nsnull;
 
   nsCOMPtr<nsITreeColumns> treeColumns;
   treeBoxObj->GetColumns(getter_AddRefs(treeColumns));
   if (!treeColumns)
     return nsnull;
 
   PRInt32 count = 0;
   treeColumns->GetCount(&count);
 
   // Outline of list accessible.
   if (count == 1) {
-    nsAccessible* accessible = new nsXULTreeAccessible(aContent, aWeakShell);
+    nsAccessible* accessible = new nsXULTreeAccessible(aContent, aDoc);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
   // Table or tree table accessible.
-  nsAccessible* accessible = new nsXULTreeGridAccessibleWrap(aContent, aWeakShell);
+  nsAccessible* accessible = new nsXULTreeGridAccessibleWrap(aContent, aDoc);
   NS_IF_ADDREF(accessible);
   return accessible;
 }
 #endif
 
 ////////////////////////////////////////////////////////////////////////////////
 // Services
 ////////////////////////////////////////////////////////////////////////////////
--- a/accessible/src/base/nsAccessibilityService.h
+++ b/accessible/src/base/nsAccessibilityService.h
@@ -82,18 +82,16 @@ class nsAccessibilityService : public ns
 public:
   virtual ~nsAccessibilityService();
 
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_NSIACCESSIBLERETRIEVAL
   NS_DECL_NSIOBSERVER
 
   // nsIAccessibilityService
-  virtual nsAccessible* GetAccessibleInShell(nsINode* aNode,
-                                             nsIPresShell* aPresShell);
   virtual nsAccessible* GetRootDocumentAccessible(nsIPresShell* aPresShell,
                                                   bool aCanCreate);
 
   virtual already_AddRefed<nsAccessible>
     CreateHTMLBRAccessible(nsIContent* aContent, nsIPresShell* aPresShell);
   virtual already_AddRefed<nsAccessible>
     CreateHTML4ButtonAccessible(nsIContent* aContent, nsIPresShell* aPresShell);
   virtual already_AddRefed<nsAccessible>
@@ -181,58 +179,45 @@ public:
    */
   static bool IsShutdown() { return gIsShutdown; }
 
   /**
    * Return an accessible for the given DOM node from the cache or create new
    * one.
    *
    * @param  aNode             [in] the given node
-   * @param  aPresShell        [in] the pres shell of the node
-   * @param  aWeakShell        [in] the weak shell for the pres shell
+   * @param  aDoc              [in] the doc accessible of the node  
    * @param  aIsSubtreeHidden  [out, optional] indicates whether the node's
    *                             frame and its subtree is hidden
    */
-  nsAccessible* GetOrCreateAccessible(nsINode* aNode, nsIPresShell* aPresShell,
-                                      nsIWeakReference* aWeakShell,
+  nsAccessible* GetOrCreateAccessible(nsINode* aNode, nsDocAccessible* aDoc,
                                       bool* aIsSubtreeHidden = nsnull);
 
   /**
-   * Return an accessible for the given DOM node.
+   * Return an accessible for the given DOM node and eventually a presentation
+   * shell.
    */
-  nsAccessible* GetAccessible(nsINode* aNode);
-
-  /**
-   * Return an accessible for a DOM node in the given presshell.
-   *
-   * @param aNode       [in] the given node
-   * @param aWeakShell  [in] the presentation shell for the given node
-   */
-  inline nsAccessible* GetAccessibleInWeakShell(nsINode* aNode,
-                                                nsIWeakReference* aWeakShell)
-  {
-    // XXX: weak shell is ignored until multiple shell documents are supported.
-    return GetAccessible(aNode);
-  }
+  nsAccessible* GetAccessible(nsINode* aNode, nsIPresShell* aPresShell);
 
   /**
    * Return an accessible for the given DOM node or container accessible if
    * the node is not accessible.
+   *
+   * @param aNode [in] the given node
+   * @param aDoc  [in] the document accessible. Can't be null.
    */
-  nsAccessible* GetAccessibleOrContainer(nsINode* aNode,
-                                         nsIWeakReference* aWeakShell);
+  nsAccessible* GetAccessibleOrContainer(nsINode* aNode, nsDocAccessible* aDoc);
 
   /**
    * Return a container accessible for the given DOM node.
    */
-  inline nsAccessible* GetContainerAccessible(nsINode* aNode,
-                                              nsIWeakReference* aWeakShell)
+  nsAccessible* GetContainerAccessible(nsINode* aNode, nsDocAccessible* aDoc)
   {
     return aNode ?
-      GetAccessibleOrContainer(aNode->GetNodeParent(), aWeakShell) : nsnull;
+      GetAccessibleOrContainer(aNode->GetNodeParent(), aDoc) : nsnull;
   }
 
 private:
   // nsAccessibilityService creation is controlled by friend
   // NS_GetAccessibilityService, keep constructors private.
   nsAccessibilityService();
   nsAccessibilityService(const nsAccessibilityService&);
   nsAccessibilityService& operator =(const nsAccessibilityService&);
@@ -248,38 +233,38 @@ private:
    */
   void Shutdown();
 
   /**
    * Create accessible for the element implementing nsIAccessibleProvider
    * interface.
    */
   already_AddRefed<nsAccessible>
-    CreateAccessibleByType(nsIContent* aContent, nsIWeakReference* aWeakShell);
+    CreateAccessibleByType(nsIContent* aContent, nsDocAccessible* aDoc);
 
   /**
    * Create accessible for HTML node by tag name.
    */
   already_AddRefed<nsAccessible>
     CreateHTMLAccessibleByMarkup(nsIFrame* aFrame, nsIContent* aContent,
-                                 nsIWeakReference* aWeakShell);
+                                 nsDocAccessible* aDoc);
 
   /**
    * Create accessible if parent is a deck frame.
    */
   already_AddRefed<nsAccessible>
     CreateAccessibleForDeckChild(nsIFrame* aFrame, nsIContent* aContent,
-                                 nsIWeakReference* aWeakShell);
+                                 nsDocAccessible* aDoc);
 
 #ifdef MOZ_XUL
   /**
    * Create accessible for XUL tree element.
    */
   already_AddRefed<nsAccessible>
-    CreateAccessibleForXULTree(nsIContent* aContent, nsIWeakReference* aWeakShell);
+    CreateAccessibleForXULTree(nsIContent* aContent, nsDocAccessible* aDoc);
 #endif
 
   /**
    * Reference for accessibility service instance.
    */
   static nsAccessibilityService* gAccessibilityService;
 
   /**
--- a/accessible/src/base/nsAccessible.cpp
+++ b/accessible/src/base/nsAccessible.cpp
@@ -188,18 +188,18 @@ nsresult nsAccessible::QueryInterface(RE
       return NS_OK;
     }
     return NS_ERROR_NO_INTERFACE;
   }
 
   return nsAccessNodeWrap::QueryInterface(aIID, aInstancePtr);
 }
 
-nsAccessible::nsAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsAccessNodeWrap(aContent, aShell),
+nsAccessible::nsAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsAccessNodeWrap(aContent, aDoc),
   mParent(nsnull), mIndexInParent(-1), mFlags(eChildrenUninitialized),
   mIndexOfEmbeddedChild(-1), mRoleMapEntry(nsnull)
 {
 #ifdef NS_DEBUG_X
    {
      nsCOMPtr<nsIPresShell> shell(do_QueryReferent(aShell));
      printf(">>> %p Created Acc - DOM: %p  PS: %p", 
             (void*)static_cast<nsIAccessible*>(this), (void*)aNode,
@@ -268,17 +268,17 @@ nsAccessible::GetComputedStyleCSSValue(c
   return CallQueryInterface(cssValue, aCSSValue);
 }
 
 NS_IMETHODIMP
 nsAccessible::GetDocument(nsIAccessibleDocument **aDocument)
 {
   NS_ENSURE_ARG_POINTER(aDocument);
 
-  NS_IF_ADDREF(*aDocument = GetDocAccessible());
+  NS_IF_ADDREF(*aDocument = Document());
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsAccessible::GetDOMNode(nsIDOMNode **aDOMNode)
 {
   NS_ENSURE_ARG_POINTER(aDOMNode);
   *aDOMNode = nsnull;
@@ -395,17 +395,17 @@ nsAccessible::Description(nsString& aDes
   nsTextEquivUtils::
     GetTextEquivFromIDRefs(this, nsGkAtoms::aria_describedby,
                            aDescription);
 
   if (aDescription.IsEmpty()) {
     bool isXUL = mContent->IsXUL();
     if (isXUL) {
       // Try XUL <description control="[id]">description text</description>
-      XULDescriptionIterator iter(GetDocAccessible(), mContent);
+      XULDescriptionIterator iter(Document(), mContent);
       nsAccessible* descr = nsnull;
       while ((descr = iter.Next()))
         nsTextEquivUtils::AppendTextEquivFromContent(this, descr->GetContent(),
                                                      &aDescription);
       }
 
       if (aDescription.IsEmpty()) {
         nsIAtom *descAtom = isXUL ? nsGkAtoms::tooltiptext :
@@ -441,22 +441,22 @@ nsAccessible::AccessKey() const
   PRUint32 key = nsCoreUtils::GetAccessKeyFor(mContent);
   if (!key && mContent->IsElement()) {
     nsAccessible* label = nsnull;
 
     // Copy access key from label node.
     if (mContent->IsHTML()) {
       // Unless it is labeled via an ancestor <label>, in which case that would
       // be redundant.
-      HTMLLabelIterator iter(GetDocAccessible(), this,
+      HTMLLabelIterator iter(Document(), this,
                              HTMLLabelIterator::eSkipAncestorLabel);
       label = iter.Next();
 
     } else if (mContent->IsXUL()) {
-      XULLabelIterator iter(GetDocAccessible(), mContent);
+      XULLabelIterator iter(Document(), mContent);
       label = iter.Next();
     }
 
     if (label)
       key = nsCoreUtils::GetAccessKeyFor(label->GetContent());
   }
 
   if (!key)
@@ -681,17 +681,17 @@ PRUint64
 nsAccessible::VisibilityState()
 {
   PRUint64 vstates = states::INVISIBLE | states::OFFSCREEN;
 
   nsIFrame* frame = GetFrame();
   if (!frame)
     return vstates;
 
-  const nsCOMPtr<nsIPresShell> shell(GetPresShell());
+  nsIPresShell* shell(mDoc->PresShell());
   if (!shell)
     return vstates;
 
   // We need to know if at least a kMinPixels around the object is visible,
   // otherwise it will be marked states::OFFSCREEN.
   const PRUint16 kMinPixels  = 12;
   const nsSize frameSize = frame->GetSize();
   const nsRectVisibility rectVisibility =
@@ -724,17 +724,17 @@ nsAccessible::VisibilityState()
   return vstates &= ~states::INVISIBLE;
 }
 
 PRUint64
 nsAccessible::NativeState()
 {
   PRUint64 state = 0;
 
-  nsDocAccessible* document = GetDocAccessible();
+  nsDocAccessible* document = Document();
   if (!document || !document->IsInDocument(this))
     state |= states::STALE;
 
   bool disabled = false;
   if (mContent->IsElement()) {
     nsEventStates elementState = mContent->AsElement()->State();
 
     if (elementState.HasState(NS_EVENT_STATE_INVALID))
@@ -826,17 +826,17 @@ nsAccessible::ChildAtPoint(PRInt32 aX, P
     return fallbackAnswer;
 
   // Search an accessible at the given point starting from accessible document
   // because containing block (see CSS2) for out of flow element (for example,
   // absolutely positioned element) may be different from its DOM parent and
   // therefore accessible for containing block may be different from accessible
   // for DOM parent but GetFrameForPoint() should be called for containing block
   // to get an out of flow element.
-  nsDocAccessible *accDocument = GetDocAccessible();
+  nsDocAccessible* accDocument = Document();
   NS_ENSURE_TRUE(accDocument, nsnull);
 
   nsIFrame *frame = accDocument->GetFrame();
   NS_ENSURE_TRUE(frame, nsnull);
 
   nsPresContext *presContext = frame->PresContext();
 
   nsIntRect screenRect = frame->GetScreenRectExternal();
@@ -848,17 +848,17 @@ nsAccessible::ChildAtPoint(PRInt32 aX, P
 
   nsIContent* content = nsnull;
   if (!foundFrame || !(content = foundFrame->GetContent()))
     return fallbackAnswer;
 
   // Get accessible for the node with the point or the first accessible in
   // the DOM parent chain.
   nsAccessible* accessible =
-   GetAccService()->GetAccessibleOrContainer(content, mWeakShell);
+    GetAccService()->GetAccessibleOrContainer(content, accDocument);
   if (!accessible)
     return fallbackAnswer;
 
   if (accessible == this) {
     // Manually walk through accessible children and see if the are within this
     // point. Skip offscreen or invisible accessibles. This takes care of cases
     // where layout won't walk into things for us, such as image map areas and
     // sub documents (XXX: subdocuments should be handled by methods of
@@ -1035,17 +1035,17 @@ nsAccessible::GetBounds(PRInt32* aX, PRI
   NS_ENSURE_ARG_POINTER(aWidth);
   *aWidth = 0;
   NS_ENSURE_ARG_POINTER(aHeight);
   *aHeight = 0;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  nsCOMPtr<nsIPresShell> presShell = GetPresShell();
+  nsIPresShell* presShell = mDoc->PresShell();
 
   // This routine will get the entire rectangle for all the frames in this node.
   // -------------------------------------------------------------------------
   //      Primary Frame for node
   //  Another frame, same node                <- Example
   //  Another frame, same node
 
   nsRect unionRectTwips;
@@ -1155,17 +1155,17 @@ nsAccessible::TakeFocus()
 }
 
 nsresult
 nsAccessible::GetHTMLName(nsAString& aLabel)
 {
   nsAutoString label;
 
   nsAccessible* labelAcc = nsnull;
-  HTMLLabelIterator iter(GetDocAccessible(), this);
+  HTMLLabelIterator iter(Document(), this);
   while ((labelAcc = iter.Next())) {
     nsresult rv = nsTextEquivUtils::
       AppendTextEquivFromContent(this, labelAcc->GetContent(), &label);
     NS_ENSURE_SUCCESS(rv, rv);
 
     label.CompressWhitespace();
   }
 
@@ -1217,17 +1217,17 @@ nsAccessible::GetXULName(nsAString& aLab
     }
   }
 
   // CASES #2 and #3 ------ label as a child or <label control="id" ... > </label>
   if (NS_FAILED(rv) || label.IsEmpty()) {
     label.Truncate();
 
     nsAccessible* labelAcc = nsnull;
-    XULLabelIterator iter(GetDocAccessible(), mContent);
+    XULLabelIterator iter(Document(), mContent);
     while ((labelAcc = iter.Next())) {
       nsCOMPtr<nsIDOMXULLabelElement> xulLabel =
         do_QueryInterface(labelAcc->GetContent());
       // Check if label's value attribute is used
       if (xulLabel && NS_SUCCEEDED(xulLabel->GetValue(label)) && label.IsEmpty()) {
         // If no value attribute, a non-empty label must contain
         // children that define its text -- possibly using HTML
         nsTextEquivUtils::
@@ -1738,17 +1738,17 @@ nsAccessible::GetValue(nsAString& aValue
     }
   }
 
   if (!aValue.IsEmpty())
     return NS_OK;
 
   // Check if it's a simple xlink.
   if (nsCoreUtils::IsXLink(mContent)) {
-    nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
+    nsIPresShell* presShell = mDoc->PresShell();
     if (presShell) {
       nsCOMPtr<nsIDOMNode> DOMNode(do_QueryInterface(mContent));
       return presShell->GetLinkLocation(DOMNode, aValue);
     }
   }
 
   return NS_OK;
 }
@@ -2053,66 +2053,66 @@ nsAccessible::GetRelationByType(PRUint32
 
 Relation
 nsAccessible::RelationByType(PRUint32 aType)
 {
   // Relationships are defined on the same content node that the role would be
   // defined on.
   switch (aType) {
     case nsIAccessibleRelation::RELATION_LABEL_FOR: {
-      Relation rel(new RelatedAccIterator(GetDocAccessible(), mContent,
+      Relation rel(new RelatedAccIterator(Document(), mContent,
                                           nsGkAtoms::aria_labelledby));
       if (mContent->Tag() == nsGkAtoms::label)
         rel.AppendIter(new IDRefsIterator(mContent, mContent->IsHTML() ?
                                           nsGkAtoms::_for :
                                           nsGkAtoms::control));
 
       return rel;
     }
     case nsIAccessibleRelation::RELATION_LABELLED_BY: {
       Relation rel(new IDRefsIterator(mContent,
                                       nsGkAtoms::aria_labelledby));
       if (mContent->IsHTML()) {
-        rel.AppendIter(new HTMLLabelIterator(GetDocAccessible(), this));
+        rel.AppendIter(new HTMLLabelIterator(Document(), this));
       } else if (mContent->IsXUL()) {
-        rel.AppendIter(new XULLabelIterator(GetDocAccessible(), mContent));
+        rel.AppendIter(new XULLabelIterator(Document(), mContent));
       }
 
       return rel;
     }
     case nsIAccessibleRelation::RELATION_DESCRIBED_BY: {
       Relation rel(new IDRefsIterator(mContent,
                                         nsGkAtoms::aria_describedby));
       if (mContent->IsXUL())
-        rel.AppendIter(new XULDescriptionIterator(GetDocAccessible(), mContent));
+        rel.AppendIter(new XULDescriptionIterator(Document(), mContent));
 
       return rel;
     }
     case nsIAccessibleRelation::RELATION_DESCRIPTION_FOR: {
-      Relation rel(new RelatedAccIterator(GetDocAccessible(), mContent,
-                                            nsGkAtoms::aria_describedby));
+      Relation rel(new RelatedAccIterator(Document(), mContent,
+                                          nsGkAtoms::aria_describedby));
 
       // This affectively adds an optional control attribute to xul:description,
       // which only affects accessibility, by allowing the description to be
       // tied to a control.
       if (mContent->Tag() == nsGkAtoms::description &&
           mContent->IsXUL())
         rel.AppendIter(new IDRefsIterator(mContent,
                                           nsGkAtoms::control));
 
       return rel;
     }
     case nsIAccessibleRelation::RELATION_NODE_CHILD_OF: {
-      Relation rel(new RelatedAccIterator(GetDocAccessible(), mContent,
-                                            nsGkAtoms::aria_owns));
+      Relation rel(new RelatedAccIterator(Document(), mContent,
+                                          nsGkAtoms::aria_owns));
       
       // This is an ARIA tree or treegrid that doesn't use owns, so we need to
       // get the parent the hard way.
       if (mRoleMapEntry && (mRoleMapEntry->role == roles::OUTLINEITEM || 
-	  mRoleMapEntry->role == roles::ROW)) {
+                            mRoleMapEntry->role == roles::ROW)) {
         AccGroupInfo* groupInfo = GetGroupInfo();
         if (!groupInfo)
           return rel;
 
         rel.AppendTarget(groupInfo->ConceptualParent());
       }
 
       // If accessible is in its own Window, or is the root of a document,
@@ -2129,29 +2129,29 @@ nsAccessible::RelationByType(PRUint32 aT
           if (scrollFrame || view->GetWidget() || !frame->GetParent())
             rel.AppendTarget(Parent());
         }
       }
 
       return rel;
     }
     case nsIAccessibleRelation::RELATION_CONTROLLED_BY:
-      return Relation(new RelatedAccIterator(GetDocAccessible(), mContent,
+      return Relation(new RelatedAccIterator(Document(), mContent,
                                              nsGkAtoms::aria_controls));
     case nsIAccessibleRelation::RELATION_CONTROLLER_FOR: {
       Relation rel(new IDRefsIterator(mContent,
                                       nsGkAtoms::aria_controls));
-      rel.AppendIter(new HTMLOutputIterator(GetDocAccessible(), mContent));
+      rel.AppendIter(new HTMLOutputIterator(Document(), mContent));
       return rel;
     }
     case nsIAccessibleRelation::RELATION_FLOWS_TO:
       return Relation(new IDRefsIterator(mContent,
                                          nsGkAtoms::aria_flowto));
     case nsIAccessibleRelation::RELATION_FLOWS_FROM:
-      return Relation(new RelatedAccIterator(GetDocAccessible(), mContent,
+      return Relation(new RelatedAccIterator(Document(), mContent,
                                              nsGkAtoms::aria_flowto));
     case nsIAccessibleRelation::RELATION_DEFAULT_BUTTON: {
       if (mContent->IsHTML()) {
         // HTML form controls implements nsIFormControl interface.
         nsCOMPtr<nsIFormControl> control(do_QueryInterface(mContent));
         if (control) {
           nsCOMPtr<nsIForm> form(do_QueryInterface(control->GetFormElement()));
           if (form) {
@@ -2268,17 +2268,17 @@ nsAccessible::DoCommand(nsIContent *aCon
 }
 
 void
 nsAccessible::DispatchClickEvent(nsIContent *aContent, PRUint32 aActionIndex)
 {
   if (IsDefunct())
     return;
 
-  nsCOMPtr<nsIPresShell> presShell = GetPresShell();
+  nsIPresShell* presShell = mDoc->PresShell();
 
   // Scroll into view.
   presShell->ScrollContentIntoView(aContent, NS_PRESSHELL_SCROLL_ANYWHERE,
                                    NS_PRESSHELL_SCROLL_ANYWHERE,
                                    nsIPresShell::SCROLL_OVERFLOW_HIDDEN);
 
   // Fire mouse down and mouse up events.
   bool res = nsCoreUtils::DispatchMouseEvent(NS_MOUSE_BUTTON_DOWN, presShell,
@@ -3028,17 +3028,17 @@ nsAccessible::CurrentItem()
   // checks whether pointed node is actually a DOM descendant of the element
   // with the aria-activedescendant attribute.
   nsAutoString id;
   if (mContent->GetAttr(kNameSpaceID_None,
                         nsGkAtoms::aria_activedescendant, id)) {
     nsIDocument* DOMDoc = mContent->OwnerDoc();
     dom::Element* activeDescendantElm = DOMDoc->GetElementById(id);
     if (activeDescendantElm) {
-      nsDocAccessible* document = GetDocAccessible();
+      nsDocAccessible* document = Document();
       if (document)
         return document->GetAccessible(activeDescendantElm);
     }
   }
   return nsnull;
 }
 
 void
@@ -3074,17 +3074,20 @@ nsAccessible::ContainerWidget() const
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessible protected methods
 
 void
 nsAccessible::CacheChildren()
 {
-  nsAccTreeWalker walker(mWeakShell, mContent, CanHaveAnonChildren());
+  nsDocAccessible* doc = Document();
+  NS_ENSURE_TRUE(doc,);
+
+  nsAccTreeWalker walker(doc, mContent, CanHaveAnonChildren());
 
   nsAccessible* child = nsnull;
   while ((child = walker.NextChild()) && AppendChild(child));
 }
 
 void
 nsAccessible::TestChildCache(nsAccessible* aCachedChild) const
 {
@@ -3147,18 +3150,17 @@ nsAccessible::GetSiblingAtOffset(PRInt32
     *aError = NS_ERROR_UNEXPECTED;
 
   return child;
 }
 
 nsAccessible *
 nsAccessible::GetFirstAvailableAccessible(nsINode *aStartNode) const
 {
-  nsAccessible* accessible =
-    GetAccService()->GetAccessibleInWeakShell(aStartNode, mWeakShell);
+  nsAccessible* accessible = mDoc->GetAccessible(aStartNode);
   if (accessible)
     return accessible;
 
   nsCOMPtr<nsIDOMDocument> domDoc = do_QueryInterface(aStartNode->OwnerDoc());
   NS_ENSURE_TRUE(domDoc, nsnull);
 
   nsCOMPtr<nsIDOMNode> currentNode = do_QueryInterface(aStartNode);
   nsCOMPtr<nsIDOMNode> rootNode = do_QueryInterface(GetNode());
@@ -3170,18 +3172,17 @@ nsAccessible::GetFirstAvailableAccessibl
 
   walker->SetCurrentNode(currentNode);
   while (true) {
     walker->NextNode(getter_AddRefs(currentNode));
     if (!currentNode)
       return nsnull;
 
     nsCOMPtr<nsINode> node(do_QueryInterface(currentNode));
-    nsAccessible* accessible =
-      GetAccService()->GetAccessibleInWeakShell(node, mWeakShell);
+    nsAccessible* accessible = mDoc->GetAccessible(node);
     if (accessible)
       return accessible;
   }
 
   return nsnull;
 }
 
 nsresult
--- a/accessible/src/base/nsAccessible.h
+++ b/accessible/src/base/nsAccessible.h
@@ -99,17 +99,17 @@ NS_ERROR_GENERATE_SUCCESS(NS_ERROR_MODUL
 
 class nsAccessible : public nsAccessNodeWrap, 
                      public nsIAccessible, 
                      public nsIAccessibleHyperLink,
                      public nsIAccessibleSelectable,
                      public nsIAccessibleValue
 {
 public:
-  nsAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
   virtual ~nsAccessible();
 
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(nsAccessible, nsAccessNode)
 
   NS_DECL_NSIACCESSIBLE
   NS_DECL_NSIACCESSIBLEHYPERLINK
   NS_DECL_NSIACCESSIBLESELECTABLE
--- a/accessible/src/base/nsBaseWidgetAccessible.cpp
+++ b/accessible/src/base/nsBaseWidgetAccessible.cpp
@@ -54,18 +54,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsLeafAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsLeafAccessible::
-  nsLeafAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsAccessibleWrap(aContent, aShell)
+  nsLeafAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsAccessibleWrap(aContent, aDoc)
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsLeafAccessible, nsAccessible)
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsLeafAccessible: nsAccessible public
 
@@ -87,18 +87,18 @@ nsLeafAccessible::CacheChildren()
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsLinkableAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsLinkableAccessible::
-  nsLinkableAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsAccessibleWrap(aContent, aShell),
+  nsLinkableAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsAccessibleWrap(aContent, aDoc),
   mActionAcc(nsnull),
   mIsLink(false),
   mIsOnclick(false)
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsLinkableAccessible, nsAccessibleWrap)
 
@@ -248,19 +248,19 @@ nsLinkableAccessible::BindToParent(nsAcc
   }
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsEnumRoleAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsEnumRoleAccessible::
-  nsEnumRoleAccessible(nsIContent *aNode, nsIWeakReference *aShell,
+  nsEnumRoleAccessible(nsIContent* aNode, nsDocAccessible* aDoc,
                        roles::Role aRole) :
-  nsAccessibleWrap(aNode, aShell), mRole(aRole)
+  nsAccessibleWrap(aNode, aDoc), mRole(aRole)
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsEnumRoleAccessible, nsAccessible)
 
 role
 nsEnumRoleAccessible::NativeRole()
 {
--- a/accessible/src/base/nsBaseWidgetAccessible.h
+++ b/accessible/src/base/nsBaseWidgetAccessible.h
@@ -51,17 +51,17 @@
 
 /** 
   * Leaf version of DOM Accessible -- has no children
   */
 class nsLeafAccessible : public nsAccessibleWrap
 {
 public:
 
-  nsLeafAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsLeafAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsAccessible
   virtual nsAccessible* ChildAtPoint(PRInt32 aX, PRInt32 aY,
                                      EWhichChildAtPoint aWhichChild);
 
@@ -77,17 +77,17 @@ protected:
  * report the state of the host link (traveled or not) and can activate (click)
  * the host accessible programmatically.
  */
 class nsLinkableAccessible : public nsAccessibleWrap
 {
 public:
   enum { eAction_Jump = 0 };
 
-  nsLinkableAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsLinkableAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 index);
   NS_IMETHOD GetValue(nsAString& _retval);
   NS_IMETHOD TakeFocus();
@@ -118,17 +118,17 @@ protected:
 };
 
 /**
  * A simple accessible that gets its enumerated role passed into constructor.
  */ 
 class nsEnumRoleAccessible : public nsAccessibleWrap
 {
 public:
-  nsEnumRoleAccessible(nsIContent *aContent, nsIWeakReference *aShell,
+  nsEnumRoleAccessible(nsIContent* aContent, nsDocAccessible* aDoc,
                        mozilla::a11y::role aRole);
   virtual ~nsEnumRoleAccessible() { }
 
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
 
--- a/accessible/src/base/nsCaretAccessible.cpp
+++ b/accessible/src/base/nsCaretAccessible.cpp
@@ -291,17 +291,17 @@ nsCaretAccessible::NormalSelectionChange
   }
 
   mLastCaretOffset = caretOffset;
   mLastTextAccessible = textAcc;
 
   nsRefPtr<AccEvent> event =
     new AccCaretMoveEvent(mLastTextAccessible->GetNode());
   if (event)
-    mLastTextAccessible->GetDocAccessible()->FireDelayedAccessibleEvent(event);
+    mLastTextAccessible->Document()->FireDelayedAccessibleEvent(event);
 }
 
 void
 nsCaretAccessible::SpellcheckSelectionChanged(nsISelection* aSelection)
 {
   // XXX: fire an event for accessible of focus node of the selection. If
   // spellchecking is enabled then we will fire the number of events for
   // the same accessible for newly appended range of the selection (for every
@@ -311,17 +311,17 @@ nsCaretAccessible::SpellcheckSelectionCh
   nsHyperTextAccessible* textAcc =
     nsAccUtils::GetTextAccessibleFromSelection(aSelection);
   if (!textAcc)
     return;
 
   nsRefPtr<AccEvent> event =
     new AccEvent(nsIAccessibleEvent::EVENT_TEXT_ATTRIBUTE_CHANGED, textAcc);
   if (event)
-    textAcc->GetDocAccessible()->FireDelayedAccessibleEvent(event);
+    textAcc->Document()->FireDelayedAccessibleEvent(event);
 }
 
 nsIntRect
 nsCaretAccessible::GetCaretRect(nsIWidget **aOutWidget)
 {
   nsIntRect caretRect;
   NS_ENSURE_TRUE(aOutWidget, caretRect);
   *aOutWidget = nsnull;
--- a/accessible/src/base/nsCoreUtils.h
+++ b/accessible/src/base/nsCoreUtils.h
@@ -251,22 +251,16 @@ public:
 
   /**
    * Return presShell for the document containing the given DOM node.
    */
   static nsIPresShell *GetPresShellFor(nsINode *aNode)
   {
     return aNode->OwnerDoc()->GetShell();
   }
-  static already_AddRefed<nsIWeakReference> GetWeakShellFor(nsINode *aNode)
-  {
-    nsCOMPtr<nsIWeakReference> weakShell =
-      do_GetWeakReference(GetPresShellFor(aNode));
-    return weakShell.forget();
-  }
 
   /**
    * Return document node for the given document shell tree item.
    */
   static already_AddRefed<nsIDOMNode>
     GetDOMNodeForContainer(nsIDocShellTreeItem *aContainer);
 
   /**
--- a/accessible/src/base/nsDocAccessible.cpp
+++ b/accessible/src/base/nsDocAccessible.cpp
@@ -97,22 +97,23 @@ static nsIAtom** kRelationAttrs[] =
 };
 
 static const PRUint32 kRelationAttrsLen = NS_ARRAY_LENGTH(kRelationAttrs);
 
 ////////////////////////////////////////////////////////////////////////////////
 // Constructor/desctructor
 
 nsDocAccessible::
-  nsDocAccessible(nsIDocument *aDocument, nsIContent *aRootContent,
-                  nsIWeakReference *aShell) :
-  nsHyperTextAccessibleWrap(aRootContent, aShell),
+  nsDocAccessible(nsIDocument* aDocument, nsIContent* aRootContent,
+                  nsIPresShell* aPresShell) :
+  nsHyperTextAccessibleWrap(aRootContent, this),
   mDocument(aDocument), mScrollPositionChangedTicks(0),
   mLoadState(eTreeConstructionPending), mLoadEventType(0),
-  mVirtualCursor(nsnull)
+  mVirtualCursor(nsnull),
+  mPresShell(aPresShell)
 {
   mFlags |= eDocAccessible;
 
   mDependentIDsHash.Init();
   // XXX aaronl should we use an algorithm for the initial cache size?
   mAccessibleCache.Init(kDefaultCacheSize);
   mNodeToAccessibleMap.Init(kDefaultCacheSize);
 
@@ -130,16 +131,17 @@ nsDocAccessible::
 
   // We provide a virtual cursor if this is a root doc or if it's a tab doc.
   mIsCursorable = (!(mDocument->GetParentDocument()) ||
                    nsCoreUtils::IsTabDocument(mDocument));
 }
 
 nsDocAccessible::~nsDocAccessible()
 {
+  NS_ASSERTION(!mPresShell, "LastRelease was never called!?!");
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsISupports
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(nsDocAccessible)
 
@@ -203,17 +205,16 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_
 
   *aInstancePtr = foundInterface;
   return status;
 }
 
 NS_IMPL_ADDREF_INHERITED(nsDocAccessible, nsHyperTextAccessible)
 NS_IMPL_RELEASE_INHERITED(nsDocAccessible, nsHyperTextAccessible)
 
-
 ////////////////////////////////////////////////////////////////////////////////
 // nsIAccessible
 
 NS_IMETHODIMP
 nsDocAccessible::GetName(nsAString& aName)
 {
   nsresult rv = NS_OK;
   aName.Truncate();
@@ -617,35 +618,34 @@ nsDocAccessible::GetAccessible(nsINode* 
 // nsAccessNode
 
 bool
 nsDocAccessible::Init()
 {
   NS_LOG_ACCDOCCREATE_FOR("document initialize", mDocument, this)
 
   // Initialize notification controller.
-  nsCOMPtr<nsIPresShell> shell(GetPresShell());
-  mNotificationController = new NotificationController(this, shell);
+  mNotificationController = new NotificationController(this, mPresShell);
   if (!mNotificationController)
     return false;
 
   // Mark the document accessible as loaded if its DOM document was loaded at
   // this point (this can happen because a11y is started late or DOM document
   // having no container was loaded.
   if (mDocument->GetReadyStateEnum() == nsIDocument::READYSTATE_COMPLETE)
     mLoadState |= eDOMLoaded;
 
   AddEventListeners();
   return true;
 }
 
 void
 nsDocAccessible::Shutdown()
 {
-  if (!mWeakShell) // already shutdown
+  if (!mPresShell) // already shutdown
     return;
 
   NS_LOG_ACCDOCDESTROY_FOR("document shutdown", mDocument, this)
 
   if (mNotificationController) {
     mNotificationController->Shutdown();
     mNotificationController = nsnull;
   }
@@ -653,17 +653,17 @@ nsDocAccessible::Shutdown()
   RemoveEventListeners();
 
   // Mark the document as shutdown before AT is notified about the document
   // removal from its container (valid for root documents on ATK).
   nsCOMPtr<nsIDocument> kungFuDeathGripDoc = mDocument;
   mDocument = nsnull;
 
   if (mParent) {
-    nsDocAccessible* parentDocument = mParent->GetDocAccessible();
+    nsDocAccessible* parentDocument = mParent->Document();
     if (parentDocument)
       parentDocument->RemoveChildDocument(this);
 
     mParent->RemoveChild(this);
   }
 
   // Walk the array backwards because child documents remove themselves from the
   // array as they are shutdown.
@@ -673,35 +673,33 @@ nsDocAccessible::Shutdown()
 
   mChildDocuments.Clear();
 
   if (mVirtualCursor) {
     mVirtualCursor->RemoveObserver(this);
     mVirtualCursor = nsnull;
   }
 
-  mWeakShell = nsnull;  // Avoid reentrancy
+  mPresShell = nsnull;  // Avoid reentrancy
 
   mDependentIDsHash.Clear();
   mNodeToAccessibleMap.Clear();
   ClearCache(mAccessibleCache);
 
   nsHyperTextAccessibleWrap::Shutdown();
 
   GetAccService()->NotifyOfDocumentShutdown(kungFuDeathGripDoc);
 }
 
 nsIFrame*
 nsDocAccessible::GetFrame() const
 {
-  nsCOMPtr<nsIPresShell> shell(do_QueryReferent(mWeakShell));
-
   nsIFrame* root = nsnull;
-  if (shell)
-    root = shell->GetRootFrame();
+  if (mPresShell)
+    root = mPresShell->GetRootFrame();
 
   return root;
 }
 
 bool
 nsDocAccessible::IsDefunct() const
 {
   return nsHyperTextAccessibleWrap::IsDefunct() || !mDocument;
@@ -749,18 +747,17 @@ void nsDocAccessible::GetBoundsRect(nsRe
 }
 
 // nsDocAccessible protected member
 nsresult nsDocAccessible::AddEventListeners()
 {
   // 1) Set up scroll position listener
   // 2) Check for editor and listen for changes to editor
 
-  nsCOMPtr<nsIPresShell> presShell(GetPresShell());
-  NS_ENSURE_TRUE(presShell, NS_ERROR_FAILURE);
+  NS_ENSURE_TRUE(mPresShell, NS_ERROR_FAILURE);
 
   nsCOMPtr<nsISupports> container = mDocument->GetContainer();
   nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem(do_QueryInterface(container));
   NS_ENSURE_TRUE(docShellTreeItem, NS_ERROR_FAILURE);
 
   // Make sure we're a content docshell
   // We don't want to listen to chrome progress
   PRInt32 itemType;
@@ -778,17 +775,17 @@ nsresult nsDocAccessible::AddEventListen
 
   nsCOMPtr<nsIDocShellTreeItem> rootTreeItem;
   docShellTreeItem->GetRootTreeItem(getter_AddRefs(rootTreeItem));
   if (rootTreeItem) {
     nsRootAccessible* rootAccessible = RootAccessible();
     NS_ENSURE_TRUE(rootAccessible, NS_ERROR_FAILURE);
     nsRefPtr<nsCaretAccessible> caretAccessible = rootAccessible->GetCaretAccessible();
     if (caretAccessible) {
-      caretAccessible->AddDocSelectionListener(presShell);
+      caretAccessible->AddDocSelectionListener(mPresShell);
     }
   }
 
   // add document observer
   mDocument->AddObserver(this);
   return NS_OK;
 }
 
@@ -824,21 +821,18 @@ nsresult nsDocAccessible::RemoveEventLis
     mScrollWatchTimer->Cancel();
     mScrollWatchTimer = nsnull;
     NS_RELEASE_THIS(); // Kung fu death grip
   }
 
   nsRootAccessible* rootAccessible = RootAccessible();
   if (rootAccessible) {
     nsRefPtr<nsCaretAccessible> caretAccessible = rootAccessible->GetCaretAccessible();
-    if (caretAccessible) {
-      // Don't use GetPresShell() which can call Shutdown() if it sees dead pres shell
-      nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
-      caretAccessible->RemoveDocSelectionListener(presShell);
-    }
+    if (caretAccessible)
+      caretAccessible->RemoveDocSelectionListener(mPresShell);
   }
 
   return NS_OK;
 }
 
 void nsDocAccessible::ScrollTimerCallback(nsITimer *aTimer, void *aClosure)
 {
   nsDocAccessible *docAcc = reinterpret_cast<nsDocAccessible*>(aClosure);
@@ -858,35 +852,33 @@ void nsDocAccessible::ScrollTimerCallbac
       NS_RELEASE(docAcc); // Release kung fu death grip
     }
   }
 }
 
 // nsDocAccessible protected member
 void nsDocAccessible::AddScrollListener()
 {
-  nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
-  if (!presShell)
+  if (!mPresShell)
     return;
 
-  nsIScrollableFrame* sf = presShell->GetRootScrollFrameAsScrollableExternal();
+  nsIScrollableFrame* sf = mPresShell->GetRootScrollFrameAsScrollableExternal();
   if (sf) {
     sf->AddScrollPositionListener(this);
     NS_LOG_ACCDOCCREATE_TEXT("add scroll listener")
   }
 }
 
 // nsDocAccessible protected member
 void nsDocAccessible::RemoveScrollListener()
 {
-  nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
-  if (!presShell)
+  if (!mPresShell)
     return;
  
-  nsIScrollableFrame* sf = presShell->GetRootScrollFrameAsScrollableExternal();
+  nsIScrollableFrame* sf = mPresShell->GetRootScrollFrameAsScrollableExternal();
   if (sf) {
     sf->RemoveScrollPositionListener(this);
   }
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsIScrollPositionListener
 
@@ -1328,21 +1320,20 @@ nsDocAccessible::HandleAccEvent(AccEvent
 #endif
 
 ////////////////////////////////////////////////////////////////////////////////
 // Public members
 
 void*
 nsDocAccessible::GetNativeWindow() const
 {
-  nsCOMPtr<nsIPresShell> shell(do_QueryReferent(mWeakShell));
-  if (!shell)
+  if (!mPresShell)
     return nsnull;
 
-  nsIViewManager* vm = shell->GetViewManager();
+  nsIViewManager* vm = mPresShell->GetViewManager();
   if (!vm)
     return nsnull;
 
   nsCOMPtr<nsIWidget> widget;
   vm->GetRootWidget(getter_AddRefs(widget));
   if (widget)
     return widget->GetNativeData(NS_NATIVE_WINDOW);
 
@@ -1519,17 +1510,17 @@ nsDocAccessible::ProcessInvalidationList
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessible protected
 
 void
 nsDocAccessible::CacheChildren()
 {
   // Search for accessible children starting from the document element since
   // some web pages tend to insert elements under it rather than document body.
-  nsAccTreeWalker walker(mWeakShell, mDocument->GetRootElement(),
+  nsAccTreeWalker walker(this, mDocument->GetRootElement(),
                          CanHaveAnonChildren());
 
   nsAccessible* child = nsnull;
   while ((child = walker.NextChild()) && AppendChild(child));
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // Protected members
@@ -1875,17 +1866,17 @@ nsDocAccessible::UpdateTree(nsAccessible
   PRUint32 updateFlags = eNoAccessible;
 
   // If child node is not accessible then look for its accessible children.
   nsAccessible* child = GetAccessible(aChildNode);
   if (child) {
     updateFlags |= UpdateTreeInternal(child, aIsInsert);
 
   } else {
-    nsAccTreeWalker walker(mWeakShell, aChildNode,
+    nsAccTreeWalker walker(this, aChildNode,
                            aContainer->CanHaveAnonChildren(), true);
 
     while ((child = walker.NextChild()))
       updateFlags |= UpdateTreeInternal(child, aIsInsert);
   }
 
   // Content insertion/removal is not cause of accessible tree change.
   if (updateFlags == eNoAccessible)
--- a/accessible/src/base/nsDocAccessible.h
+++ b/accessible/src/base/nsDocAccessible.h
@@ -92,17 +92,17 @@ class nsDocAccessible : public nsHyperTe
   NS_DECL_NSIACCESSIBLECURSORABLE
 
   NS_DECL_NSIACCESSIBLEPIVOTOBSERVER
 
 public:
   using nsAccessible::GetParent;
 
   nsDocAccessible(nsIDocument *aDocument, nsIContent *aRootContent,
-                  nsIWeakReference* aShell);
+                  nsIPresShell* aPresShell);
   virtual ~nsDocAccessible();
 
   // nsIAccessible
   NS_IMETHOD GetName(nsAString& aName);
   NS_IMETHOD GetAttributes(nsIPersistentProperties **aAttributes);
   NS_IMETHOD TakeFocus(void);
 
   // nsIScrollPositionListener
@@ -134,16 +134,21 @@ public:
 #endif
 
   // nsIAccessibleText
   NS_IMETHOD GetAssociatedEditor(nsIEditor **aEditor);
 
   // nsDocAccessible
 
   /**
+   * Return presentation shell for this document accessible.
+   */
+  nsIPresShell* PresShell() const { return mPresShell; }
+
+  /**
    * Return true if associated DOM document was loaded and isn't unloading.
    */
   bool IsContentLoaded() const
   {
     // eDOMLoaded flag check is used for error pages as workaround to make this
     // method return correct result since error pages do not receive 'pageshow'
     // event and as consequence nsIDocument::IsShowing() returns false.
     return mDocument && mDocument->IsVisible() &&
@@ -165,28 +170,29 @@ public:
     // document and all its subdocuments are ready
     eCompletelyLoaded = eReady | 1 << 2
   };
 
   /**
    * Return true if the document has given document state.
    */
   bool HasLoadState(LoadState aState) const
-    { return (mLoadState & aState) == aState; }
+    { return (mLoadState & static_cast<PRUint32>(aState)) == 
+        static_cast<PRUint32>(aState); }
 
   /**
    * Return a native window handler or pointer depending on platform.
    */
   virtual void* GetNativeWindow() const;
 
   /**
    * Return the parent document.
    */
   nsDocAccessible* ParentDocument() const
-    { return mParent ? mParent->GetDocAccessible() : nsnull; }
+    { return mParent ? mParent->Document() : nsnull; }
 
   /**
    * Return the child document count.
    */
   PRUint32 ChildDocumentCount() const
     { return mChildDocuments.Length(); }
 
   /**
@@ -372,16 +378,18 @@ public:
 
   /**
    * Recreate an accessible, results in hide/show events pair.
    */
   void RecreateAccessible(nsIContent* aContent);
 
 protected:
 
+  void LastRelease();
+
   // nsAccessible
   virtual void CacheChildren();
 
   // nsDocAccessible
     virtual void GetBoundsRect(nsRect& aRect, nsIFrame** aRelativeFrame);
     virtual nsresult AddEventListeners();
     virtual nsresult RemoveEventListeners();
 
@@ -648,16 +656,20 @@ protected:
    */
   nsTArray<nsIContent*> mInvalidationList;
 
   /**
    * Used to process notification from core and accessible events.
    */
   nsRefPtr<NotificationController> mNotificationController;
   friend class NotificationController;
+
+private:
+
+  nsIPresShell* mPresShell;
 };
 
 NS_DEFINE_STATIC_IID_ACCESSOR(nsDocAccessible,
                               NS_DOCACCESSIBLE_IMPL_CID)
 
 inline nsDocAccessible*
 nsAccessible::AsDoc()
 {
--- a/accessible/src/base/nsFormControlAccessible.cpp
+++ b/accessible/src/base/nsFormControlAccessible.cpp
@@ -196,18 +196,18 @@ ProgressMeterAccessible<Max>::SetCurrent
   return NS_ERROR_FAILURE; // Progress meters are readonly.
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsRadioButtonAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsRadioButtonAccessible::
-  nsRadioButtonAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsFormControlAccessible(aContent, aShell)
+  nsRadioButtonAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsFormControlAccessible(aContent, aDoc)
 {
 }
 
 PRUint8
 nsRadioButtonAccessible::ActionCount()
 {
   return 1;
 }
--- a/accessible/src/base/nsFormControlAccessible.h
+++ b/accessible/src/base/nsFormControlAccessible.h
@@ -45,18 +45,18 @@ typedef nsLeafAccessible nsFormControlAc
 
 /**
   * Generic class used for progress meters.
   */
 template<int Max>
 class ProgressMeterAccessible: public nsFormControlAccessible
 {
 public:
-  ProgressMeterAccessible(nsIContent* aContent, nsIWeakReference* aShell) :
-    nsFormControlAccessible(aContent, aShell)
+  ProgressMeterAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+    nsFormControlAccessible(aContent, aDoc)
   {
   }
 
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_NSIACCESSIBLEVALUE
 
   // nsIAccessible
   NS_IMETHOD GetValue(nsAString &aValue);
@@ -70,17 +70,17 @@ public:
 
 /**
   * Generic class used for radio buttons.
   */
 class nsRadioButtonAccessible : public nsFormControlAccessible
 {
 
 public:
-  nsRadioButtonAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsRadioButtonAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 aIndex);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
 
--- a/accessible/src/base/nsOuterDocAccessible.cpp
+++ b/accessible/src/base/nsOuterDocAccessible.cpp
@@ -45,18 +45,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsOuterDocAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsOuterDocAccessible::
-  nsOuterDocAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsAccessibleWrap(aContent, aShell)
+  nsOuterDocAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsAccessibleWrap(aContent, aDoc)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsISupports
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsOuterDocAccessible,
                              nsAccessible)
--- a/accessible/src/base/nsOuterDocAccessible.h
+++ b/accessible/src/base/nsOuterDocAccessible.h
@@ -48,17 +48,17 @@
  * opposed to the nsDocAccessibleWrap which is "inner". The outer node is
  * a something like tags listed above, whereas the inner node corresponds to
  * the inner document root.
  */
 
 class nsOuterDocAccessible : public nsAccessibleWrap
 {
 public:
-  nsOuterDocAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsOuterDocAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD GetActionDescription(PRUint8 aIndex, nsAString& aDescription);
   NS_IMETHOD DoAction(PRUint8 aIndex);
 
--- a/accessible/src/base/nsRootAccessible.cpp
+++ b/accessible/src/base/nsRootAccessible.cpp
@@ -103,19 +103,19 @@ NS_IMPL_QUERY_TAIL_INHERITING(nsDocAcces
 
 NS_IMPL_ADDREF_INHERITED(nsRootAccessible, nsDocAccessible) 
 NS_IMPL_RELEASE_INHERITED(nsRootAccessible, nsDocAccessible)
 
 ////////////////////////////////////////////////////////////////////////////////
 // Constructor/desctructor
 
 nsRootAccessible::
-  nsRootAccessible(nsIDocument *aDocument, nsIContent *aRootContent,
-                   nsIWeakReference *aShell) :
-  nsDocAccessibleWrap(aDocument, aRootContent, aShell)
+  nsRootAccessible(nsIDocument* aDocument, nsIContent* aRootContent,
+                   nsIPresShell* aPresShell) :
+  nsDocAccessibleWrap(aDocument, aRootContent, aPresShell)
 {
   mFlags |= eRootAccessible;
 }
 
 nsRootAccessible::~nsRootAccessible()
 {
 }
 
@@ -366,34 +366,30 @@ nsRootAccessible::ProcessDOMEvent(nsIDOM
   nsCOMPtr<nsIDOMNSEvent> DOMNSEvent(do_QueryInterface(aDOMEvent));
   nsCOMPtr<nsIDOMEventTarget> DOMEventTarget;
   DOMNSEvent->GetOriginalTarget(getter_AddRefs(DOMEventTarget));
   nsCOMPtr<nsINode> origTargetNode(do_QueryInterface(DOMEventTarget));
 
   nsAutoString eventType;
   aDOMEvent->GetType(eventType);
 
-  nsCOMPtr<nsIWeakReference> weakShell =
-    nsCoreUtils::GetWeakShellFor(origTargetNode);
-  if (!weakShell)
-    return;
-
   if (eventType.EqualsLiteral("popuphiding")) {
     HandlePopupHidingEvent(origTargetNode);
     return;
   }
 
-  nsAccessible* accessible =
-    GetAccService()->GetAccessibleOrContainer(origTargetNode, weakShell);
+  nsDocAccessible* targetDocument = GetAccService()->
+    GetDocAccessible(origTargetNode->OwnerDoc());
+  NS_ASSERTION(targetDocument, "No document while accessible is in document?!");
+
+  nsAccessible* accessible = 
+    targetDocument->GetAccessibleOrContainer(origTargetNode);
   if (!accessible)
     return;
 
-  nsDocAccessible* targetDocument = accessible->GetDocAccessible();
-  NS_ASSERTION(targetDocument, "No document while accessible is in document?!");
-
   nsINode* targetNode = accessible->GetNode();
 
 #ifdef MOZ_XUL
   nsRefPtr<nsXULTreeAccessible> treeAcc;
   if (targetNode->IsElement() &&
       targetNode->AsElement()->NodeInfo()->Equals(nsGkAtoms::tree,
                                                   kNameSpaceID_XUL)) {
     treeAcc = do_QueryObject(accessible);
@@ -563,17 +559,17 @@ nsRootAccessible::ProcessDOMEvent(nsIDOM
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessNode
 
 void
 nsRootAccessible::Shutdown()
 {
   // Called manually or by nsAccessNode::LastRelease()
-  if (!mWeakShell)
+  if (!PresShell())
     return;  // Already shutdown
 
   nsDocAccessibleWrap::Shutdown();
 }
 
 // nsIAccessible method
 Relation
 nsRootAccessible::RelationByType(PRUint32 aType)
--- a/accessible/src/base/nsRootAccessible.h
+++ b/accessible/src/base/nsRootAccessible.h
@@ -63,18 +63,18 @@ class Relation;
 const PRInt32 SCROLL_HASH_START_SIZE = 6;
 
 class nsRootAccessible : public nsDocAccessibleWrap,
                          public nsIDOMEventListener
 {
   NS_DECL_ISUPPORTS_INHERITED
 
 public:
-  nsRootAccessible(nsIDocument *aDocument, nsIContent *aRootContent,
-                   nsIWeakReference *aShell);
+  nsRootAccessible(nsIDocument* aDocument, nsIContent* aRootContent,
+                   nsIPresShell* aPresShell);
   virtual ~nsRootAccessible();
 
   // nsIAccessible
   NS_IMETHOD GetName(nsAString& aName);
 
   // nsIDOMEventListener
   NS_IMETHOD HandleEvent(nsIDOMEvent* aEvent);
 
--- a/accessible/src/base/nsTextAccessible.cpp
+++ b/accessible/src/base/nsTextAccessible.cpp
@@ -44,18 +44,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsTextAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsTextAccessible::
-  nsTextAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsLinkableAccessible(aContent, aShell)
+  nsTextAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsLinkableAccessible(aContent, aDoc)
 {
   mFlags |= eTextLeafAccessible;
 }
 
 role
 nsTextAccessible::NativeRole()
 {
   return roles::TEXT_LEAF;
--- a/accessible/src/base/nsTextAccessible.h
+++ b/accessible/src/base/nsTextAccessible.h
@@ -42,17 +42,17 @@
 #include "nsBaseWidgetAccessible.h"
 
 /**
  * Generic class used for text nodes.
  */
 class nsTextAccessible : public nsLinkableAccessible
 {
 public:
-  nsTextAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsTextAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual void AppendTextTo(nsAString& aText, PRUint32 aStartOffset = 0,
                             PRUint32 aLength = PR_UINT32_MAX);
 
   // nsTextAccessible
   void SetText(const nsAString& aText) { mText = aText; }
--- a/accessible/src/base/nsTextEquivUtils.cpp
+++ b/accessible/src/base/nsTextEquivUtils.cpp
@@ -113,35 +113,35 @@ nsTextEquivUtils::AppendTextEquivFromCon
                                              nsAString *aString)
 {
   // Prevent recursion which can cause infinite loops.
   if (gInitiatorAcc)
     return NS_OK;
 
   gInitiatorAcc = aInitiatorAcc;
 
-  nsCOMPtr<nsIWeakReference> shell = nsCoreUtils::GetWeakShellFor(aContent);
+  nsIPresShell* shell = nsCoreUtils::GetPresShellFor(aContent);
   if (!shell) {
     NS_ASSERTION(true, "There is no presshell!");
     gInitiatorAcc = nsnull;
     return NS_ERROR_UNEXPECTED;
   }
 
   // If the given content is not visible or isn't accessible then go down
   // through the DOM subtree otherwise go down through accessible subtree and
   // calculate the flat string.
   nsIFrame *frame = aContent->GetPrimaryFrame();
   bool isVisible = frame && frame->GetStyleVisibility()->IsVisible();
 
   nsresult rv = NS_ERROR_FAILURE;
   bool goThroughDOMSubtree = true;
 
   if (isVisible) {
-    nsAccessible *accessible =
-      GetAccService()->GetAccessibleInWeakShell(aContent, shell);
+    nsAccessible* accessible =
+      GetAccService()->GetAccessible(aContent, shell);
     if (accessible) {
       rv = AppendFromAccessible(accessible, aString);
       goThroughDOMSubtree = false;
     }
   }
 
   if (goThroughDOMSubtree)
     rv = AppendFromDOMNode(aContent, aString);
--- a/accessible/src/html/nsHTMLCanvasAccessible.cpp
+++ b/accessible/src/html/nsHTMLCanvasAccessible.cpp
@@ -37,18 +37,18 @@
 
 #include "nsHTMLCanvasAccessible.h"
 
 #include "Role.h"
 
 using namespace mozilla::a11y;
 
 nsHTMLCanvasAccessible::
-  nsHTMLCanvasAccessible(nsIContent* aContent, nsIWeakReference* aShell) :
-  nsHyperTextAccessible(aContent, aShell)
+  nsHTMLCanvasAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsHyperTextAccessible(aContent, aDoc)
 {
 }
 
 role
 nsHTMLCanvasAccessible::NativeRole()
 {
   return roles::CANVAS;
 }
--- a/accessible/src/html/nsHTMLCanvasAccessible.h
+++ b/accessible/src/html/nsHTMLCanvasAccessible.h
@@ -41,16 +41,16 @@
 #define _nsHTMLCanvasAccessible_H_
 
 /**
  * HTML canvas accessible (html:canvas).
  */
 class nsHTMLCanvasAccessible : public nsHyperTextAccessible
 {
 public:
-  nsHTMLCanvasAccessible(nsIContent* aContent, nsIWeakReference* aShell);
+  nsHTMLCanvasAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
   virtual ~nsHTMLCanvasAccessible() { }
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
 };
 
 #endif
--- a/accessible/src/html/nsHTMLFormControlAccessible.cpp
+++ b/accessible/src/html/nsHTMLFormControlAccessible.cpp
@@ -63,18 +63,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLCheckboxAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLCheckboxAccessible::
-  nsHTMLCheckboxAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsFormControlAccessible(aContent, aShell)
+  nsHTMLCheckboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsFormControlAccessible(aContent, aDoc)
 {
 }
 
 role
 nsHTMLCheckboxAccessible::NativeRole()
 {
   return roles::CHECKBUTTON;
 }
@@ -149,18 +149,18 @@ nsHTMLCheckboxAccessible::IsWidget() con
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLRadioButtonAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLRadioButtonAccessible::
-  nsHTMLRadioButtonAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsRadioButtonAccessible(aContent, aShell)
+  nsHTMLRadioButtonAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsRadioButtonAccessible(aContent, aDoc)
 {
 }
 
 PRUint64
 nsHTMLRadioButtonAccessible::NativeState()
 {
   PRUint64 state = nsAccessibleWrap::NativeState();
 
@@ -238,18 +238,18 @@ nsHTMLRadioButtonAccessible::GetPosition
   *aSetSize = count;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLButtonAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLButtonAccessible::
-  nsHTMLButtonAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsHyperTextAccessibleWrap(aContent, aShell)
+  nsHTMLButtonAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsHyperTextAccessibleWrap(aContent, aDoc)
 {
 }
 
 PRUint8
 nsHTMLButtonAccessible::ActionCount()
 {
   return 1;
 }
@@ -353,18 +353,18 @@ nsHTMLButtonAccessible::IsWidget() const
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTML4ButtonAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTML4ButtonAccessible::
-  nsHTML4ButtonAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsHyperTextAccessibleWrap(aContent, aShell)
+  nsHTML4ButtonAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsHyperTextAccessibleWrap(aContent, aDoc)
 {
 }
 
 PRUint8
 nsHTML4ButtonAccessible::ActionCount()
 {
   return 1;
 }
@@ -418,18 +418,18 @@ nsHTML4ButtonAccessible::IsWidget() cons
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLTextFieldAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLTextFieldAccessible::
-  nsHTMLTextFieldAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsHyperTextAccessibleWrap(aContent, aShell)
+  nsHTMLTextFieldAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsHyperTextAccessibleWrap(aContent, aDoc)
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED3(nsHTMLTextFieldAccessible, nsAccessible, nsHyperTextAccessible, nsIAccessibleText, nsIAccessibleEditableText)
 
 role
 nsHTMLTextFieldAccessible::NativeRole()
 {
@@ -650,18 +650,18 @@ nsHTMLTextFieldAccessible::ContainerWidg
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLGroupboxAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLFileInputAccessible::
-nsHTMLFileInputAccessible(nsIContent* aContent, nsIWeakReference* aShell) :
-  nsHyperTextAccessibleWrap(aContent, aShell)
+nsHTMLFileInputAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsHyperTextAccessibleWrap(aContent, aDoc)
 {
   mFlags |= eHTMLFileInputAccessible;
 }
 
 role
 nsHTMLFileInputAccessible::NativeRole()
 {
   // JAWS wants a text container, others don't mind. No specific role in
@@ -705,18 +705,18 @@ nsHTMLFileInputAccessible::HandleAccEven
   return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLGroupboxAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLGroupboxAccessible::
-  nsHTMLGroupboxAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsHyperTextAccessibleWrap(aContent, aShell)
+  nsHTMLGroupboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsHyperTextAccessibleWrap(aContent, aDoc)
 {
 }
 
 role
 nsHTMLGroupboxAccessible::NativeRole()
 {
   return roles::GROUPING;
 }
@@ -765,18 +765,18 @@ nsHTMLGroupboxAccessible::RelationByType
   return rel;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLLegendAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLLegendAccessible::
-  nsHTMLLegendAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsHyperTextAccessibleWrap(aContent, aShell)
+  nsHTMLLegendAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsHyperTextAccessibleWrap(aContent, aDoc)
 {
 }
 
 Relation
 nsHTMLLegendAccessible::RelationByType(PRUint32 aType)
 {
   Relation rel = nsHyperTextAccessibleWrap::RelationByType(aType);
   if (aType != nsIAccessibleRelation::RELATION_LABEL_FOR)
@@ -795,18 +795,18 @@ nsHTMLLegendAccessible::NativeRole()
   return roles::LABEL;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLFigureAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLFigureAccessible::
-  nsHTMLFigureAccessible(nsIContent* aContent, nsIWeakReference* aShell) :
-  nsHyperTextAccessibleWrap(aContent, aShell)
+  nsHTMLFigureAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsHyperTextAccessibleWrap(aContent, aDoc)
 {
 }
 
 nsresult
 nsHTMLFigureAccessible::GetAttributesInternal(nsIPersistentProperties* aAttributes)
 {
   nsresult rv = nsHyperTextAccessibleWrap::GetAttributesInternal(aAttributes);
   NS_ENSURE_SUCCESS(rv, rv);
@@ -865,18 +865,18 @@ nsHTMLFigureAccessible::Caption() const
   return nsnull;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLFigcaptionAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLFigcaptionAccessible::
-  nsHTMLFigcaptionAccessible(nsIContent* aContent, nsIWeakReference* aShell) :
-  nsHyperTextAccessibleWrap(aContent, aShell)
+  nsHTMLFigcaptionAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsHyperTextAccessibleWrap(aContent, aDoc)
 {
 }
 
 role
 nsHTMLFigcaptionAccessible::NativeRole()
 {
   return roles::CAPTION;
 }
--- a/accessible/src/html/nsHTMLFormControlAccessible.h
+++ b/accessible/src/html/nsHTMLFormControlAccessible.h
@@ -51,17 +51,17 @@ typedef ProgressMeterAccessible<1> HTMLP
  * Accessible for HTML input@type="checkbox".
  */
 class nsHTMLCheckboxAccessible : public nsFormControlAccessible
 {
 
 public:
   enum { eAction_Click = 0 };
 
-  nsHTMLCheckboxAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsHTMLCheckboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 index);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
@@ -76,17 +76,17 @@ public:
 
 /**
  * Accessible for HTML input@type="radio" element.
  */
 class nsHTMLRadioButtonAccessible : public nsRadioButtonAccessible
 {
 
 public:
-  nsHTMLRadioButtonAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsHTMLRadioButtonAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsAccessible
   virtual PRUint64 NativeState();
   virtual void GetPositionAndSizeInternal(PRInt32 *aPosInSet,
                                           PRInt32 *aSetSize);
 };
 
 
@@ -95,17 +95,17 @@ public:
  * elements.
  */
 class nsHTMLButtonAccessible : public nsHyperTextAccessibleWrap
 {
 
 public:
   enum { eAction_Click = 0 };
 
-  nsHTMLButtonAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsHTMLButtonAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 index);
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual mozilla::a11y::role NativeRole();
@@ -124,17 +124,17 @@ public:
  * Accessible for HTML button element.
  */
 class nsHTML4ButtonAccessible : public nsHyperTextAccessibleWrap
 {
 
 public:
   enum { eAction_Click = 0 };
 
-  nsHTML4ButtonAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsHTML4ButtonAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 index);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
@@ -151,17 +151,17 @@ public:
  * Accessible for HTML input@type="text" element.
  */
 class nsHTMLTextFieldAccessible : public nsHyperTextAccessibleWrap
 {
 
 public:
   enum { eAction_Click = 0 };
 
-  nsHTMLTextFieldAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsHTMLTextFieldAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessible
   NS_IMETHOD GetValue(nsAString& _retval); 
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 index);
 
@@ -185,30 +185,30 @@ public:
 
 
 /**
  * Accessible for input@type="file" element.
  */
 class nsHTMLFileInputAccessible : public nsHyperTextAccessibleWrap
 {
 public:
-  nsHTMLFileInputAccessible(nsIContent* aContent, nsIWeakReference* aShell);
+  nsHTMLFileInputAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual nsresult HandleAccEvent(AccEvent* aAccEvent);
 };
 
 /**
  * Accessible for HTML fieldset element.
  */
 class nsHTMLGroupboxAccessible : public nsHyperTextAccessibleWrap
 {
 public:
-  nsHTMLGroupboxAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsHTMLGroupboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual mozilla::a11y::role NativeRole();
   virtual Relation RelationByType(PRUint32 aType);
 
 protected:
   nsIContent* GetLegend();
@@ -216,30 +216,30 @@ protected:
 
 
 /**
  * Accessible for HTML legend element.
  */
 class nsHTMLLegendAccessible : public nsHyperTextAccessibleWrap
 {
 public:
-  nsHTMLLegendAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsHTMLLegendAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual Relation RelationByType(PRUint32 aType);
 };
 
 /**
  * Accessible for HTML5 figure element.
  */
 class nsHTMLFigureAccessible : public nsHyperTextAccessibleWrap
 {
 public:
-  nsHTMLFigureAccessible(nsIContent* aContent, nsIWeakReference* aShell);
+  nsHTMLFigureAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsAccessible
   virtual nsresult GetAttributesInternal(nsIPersistentProperties* aAttributes);
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual mozilla::a11y::role NativeRole();
   virtual Relation RelationByType(PRUint32 aType);
 
 protected:
@@ -248,16 +248,16 @@ protected:
 
 
 /**
  * Accessible for HTML5 figcaption element.
  */
 class nsHTMLFigcaptionAccessible : public nsHyperTextAccessibleWrap
 {
 public:
-  nsHTMLFigcaptionAccessible(nsIContent* aContent, nsIWeakReference* aShell);
+  nsHTMLFigcaptionAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual Relation RelationByType(PRUint32 aType);
 };
 
 #endif
--- a/accessible/src/html/nsHTMLImageAccessible.cpp
+++ b/accessible/src/html/nsHTMLImageAccessible.cpp
@@ -55,18 +55,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLImageAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLImageAccessible::
-  nsHTMLImageAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsLinkableAccessible(aContent, aShell)
+  nsHTMLImageAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsLinkableAccessible(aContent, aDoc)
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED1(nsHTMLImageAccessible, nsAccessible,
                              nsIAccessibleImage)
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessible public
--- a/accessible/src/html/nsHTMLImageAccessible.h
+++ b/accessible/src/html/nsHTMLImageAccessible.h
@@ -46,17 +46,17 @@
  * supports:
  * - gets name, role
  * - support basic state
  */
 class nsHTMLImageAccessible : public nsLinkableAccessible,
                               public nsIAccessibleImage
 {
 public:
-  nsHTMLImageAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsHTMLImageAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 index);
 
--- a/accessible/src/html/nsHTMLImageMapAccessible.cpp
+++ b/accessible/src/html/nsHTMLImageMapAccessible.cpp
@@ -52,19 +52,19 @@
 #include "nsImageMap.h"
 
 using namespace mozilla::a11y;
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLImageMapAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLImageMapAccessible::
-  nsHTMLImageMapAccessible(nsIContent *aContent, nsIWeakReference *aShell,
-                           nsIDOMHTMLMapElement *aMapElm) :
-  nsHTMLImageAccessibleWrap(aContent, aShell), mMapElement(aMapElm)
+  nsHTMLImageMapAccessible(nsIContent* aContent, nsDocAccessible* aDoc,
+                           nsIDOMHTMLMapElement* aMapElm) :
+  nsHTMLImageAccessibleWrap(aContent, aDoc), mMapElement(aMapElm)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLImageMapAccessible: nsISupports
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsHTMLImageMapAccessible, nsHTMLImageAccessible)
 
@@ -112,46 +112,46 @@ nsHTMLImageMapAccessible::CacheChildren(
   if (!mMapElement)
     return;
 
   nsCOMPtr<nsIDOMHTMLCollection> mapAreas;
   mMapElement->GetAreas(getter_AddRefs(mapAreas));
   if (!mapAreas)
     return;
 
-  nsDocAccessible* document = GetDocAccessible();
+  nsDocAccessible* document = Document();
 
   PRUint32 areaCount = 0;
   mapAreas->GetLength(&areaCount);
 
   for (PRUint32 areaIdx = 0; areaIdx < areaCount; areaIdx++) {
     nsCOMPtr<nsIDOMNode> areaNode;
     mapAreas->Item(areaIdx, getter_AddRefs(areaNode));
     if (!areaNode)
       return;
 
     nsCOMPtr<nsIContent> areaContent(do_QueryInterface(areaNode));
     nsRefPtr<nsAccessible> area =
-      new nsHTMLAreaAccessible(areaContent, mWeakShell);
+      new nsHTMLAreaAccessible(areaContent, mDoc);
 
     if (!document->BindToDocument(area, nsAccUtils::GetRoleMapEntry(areaContent)) ||
         !AppendChild(area)) {
       return;
     }
   }
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLAreaAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLAreaAccessible::
-  nsHTMLAreaAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsHTMLLinkAccessible(aContent, aShell)
+  nsHTMLAreaAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsHTMLLinkAccessible(aContent, aDoc)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLAreaAccessible: nsIAccessible
 
 nsresult
 nsHTMLAreaAccessible::GetNameInternal(nsAString & aName)
--- a/accessible/src/html/nsHTMLImageMapAccessible.h
+++ b/accessible/src/html/nsHTMLImageMapAccessible.h
@@ -46,18 +46,18 @@
 #include "nsIDOMHTMLMapElement.h"
 
 /**
  * Used for HTML image maps.
  */
 class nsHTMLImageMapAccessible : public nsHTMLImageAccessibleWrap
 {
 public:
-  nsHTMLImageMapAccessible(nsIContent *aContent, nsIWeakReference *aShell,
-                           nsIDOMHTMLMapElement *aMapElm);
+  nsHTMLImageMapAccessible(nsIContent* aContent, nsDocAccessible* aDoc,
+                           nsIDOMHTMLMapElement* aMapElm);
 
   // nsISupports and cycle collector
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
 
   // HyperLinkAccessible
@@ -78,17 +78,17 @@ private:
 
 /**
  * Accessible for image map areas - must be child of image.
  */
 class nsHTMLAreaAccessible : public nsHTMLLinkAccessible
 {
 public:
 
-  nsHTMLAreaAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsHTMLAreaAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsIAccessible
 
   NS_IMETHOD GetBounds(PRInt32 *x, PRInt32 *y, PRInt32 *width, PRInt32 *height);
 
   // nsAccessible
   virtual void Description(nsString& aDescription);
   virtual nsresult GetNameInternal(nsAString& aName);
--- a/accessible/src/html/nsHTMLLinkAccessible.cpp
+++ b/accessible/src/html/nsHTMLLinkAccessible.cpp
@@ -38,28 +38,29 @@
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsHTMLLinkAccessible.h"
 
 #include "nsCoreUtils.h"
 #include "Role.h"
 #include "States.h"
 
+#include "nsDocAccessible.h"
 #include "nsEventStates.h"
 #include "mozilla/dom/Element.h"
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLLinkAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLLinkAccessible::
-  nsHTMLLinkAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsHyperTextAccessibleWrap(aContent, aShell)
+  nsHTMLLinkAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsHyperTextAccessibleWrap(aContent, aDoc)
 {
 }
 
 // Expose nsIAccessibleHyperLink unconditionally
 NS_IMPL_ISUPPORTS_INHERITED1(nsHTMLLinkAccessible, nsHyperTextAccessibleWrap,
                              nsIAccessibleHyperLink)
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -111,17 +112,17 @@ nsHTMLLinkAccessible::GetValue(nsAString
   aValue.Truncate();
 
   nsresult rv = nsHyperTextAccessible::GetValue(aValue);
   NS_ENSURE_SUCCESS(rv, rv);
 
   if (!aValue.IsEmpty())
     return NS_OK;
   
-  nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
+  nsIPresShell* presShell(mDoc->PresShell());
   nsCOMPtr<nsIDOMNode> DOMNode(do_QueryInterface(mContent));
   return presShell->GetLinkLocation(DOMNode, aValue);
 }
 
 PRUint8
 nsHTMLLinkAccessible::ActionCount()
 {
   return IsLinked() ? 1 : nsHyperTextAccessible::ActionCount();
--- a/accessible/src/html/nsHTMLLinkAccessible.h
+++ b/accessible/src/html/nsHTMLLinkAccessible.h
@@ -40,17 +40,17 @@
 #ifndef _nsHTMLLinkAccessible_H_
 #define _nsHTMLLinkAccessible_H_
 
 #include "nsHyperTextAccessibleWrap.h"
 
 class nsHTMLLinkAccessible : public nsHyperTextAccessibleWrap
 {
 public:
-  nsHTMLLinkAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsHTMLLinkAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
  
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessible
   NS_IMETHOD GetValue(nsAString& aValue);
 
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 aIndex);
--- a/accessible/src/html/nsHTMLSelectAccessible.cpp
+++ b/accessible/src/html/nsHTMLSelectAccessible.cpp
@@ -60,18 +60,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLSelectListAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLSelectListAccessible::
-  nsHTMLSelectListAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsAccessibleWrap(aContent, aShell)
+  nsHTMLSelectListAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsAccessibleWrap(aContent, aDoc)
 {
   mFlags |= eListControlAccessible;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLSelectListAccessible: nsAccessible public
 
 PRUint64
@@ -139,17 +139,17 @@ nsHTMLSelectListAccessible::AreItemsOper
 
 nsAccessible*
 nsHTMLSelectListAccessible::CurrentItem()
 {
   nsIListControlFrame* listControlFrame = do_QueryFrame(GetFrame());
   if (listControlFrame) {
     nsCOMPtr<nsIContent> activeOptionNode = listControlFrame->GetCurrentOption();
     if (activeOptionNode) {
-      nsDocAccessible* document = GetDocAccessible();
+      nsDocAccessible* document = Document();
       if (document)
         return document->GetAccessible(activeOptionNode);
     }
   }
   return nsnull;
 }
 
 void
@@ -174,49 +174,47 @@ nsHTMLSelectListAccessible::CacheChildre
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLSelectListAccessible protected
 
 void
 nsHTMLSelectListAccessible::CacheOptSiblings(nsIContent *aParentContent)
 {
-  nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
   for (nsIContent* childContent = aParentContent->GetFirstChild(); childContent;
        childContent = childContent->GetNextSibling()) {
     if (!childContent->IsHTML()) {
       continue;
     }
 
     nsCOMPtr<nsIAtom> tag = childContent->Tag();
     if (tag == nsGkAtoms::option ||
         tag == nsGkAtoms::optgroup) {
 
       // Get an accessible for option or optgroup and cache it.
       nsRefPtr<nsAccessible> accessible =
-        GetAccService()->GetOrCreateAccessible(childContent, presShell,
-                                               mWeakShell);
+        GetAccService()->GetOrCreateAccessible(childContent, mDoc);
       if (accessible)
         AppendChild(accessible);
 
       // Deep down into optgroup element.
       if (tag == nsGkAtoms::optgroup)
         CacheOptSiblings(childContent);
     }
   }
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLSelectOptionAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLSelectOptionAccessible::
-  nsHTMLSelectOptionAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsHyperTextAccessibleWrap(aContent, aShell)
+  nsHTMLSelectOptionAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsHyperTextAccessibleWrap(aContent, aDoc)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLSelectOptionAccessible: nsAccessible public
 
 role
 nsHTMLSelectOptionAccessible::NativeRole()
@@ -434,34 +432,34 @@ nsHTMLSelectOptionAccessible::GetSelectS
   *aState = 0;
 
   nsIContent *content = mContent;
   while (content && content->Tag() != nsGkAtoms::select) {
     content = content->GetParent();
   }
 
   if (content) {
-    nsAccessible* selAcc = GetAccService()->GetAccessible(content);
+    nsAccessible* selAcc = GetAccService()->GetAccessible(content, nsnull);
     if (selAcc) {
       *aState = selAcc->State();
       return content;
     }
   }
   return nsnull; 
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLSelectOptGroupAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLSelectOptGroupAccessible::
-  nsHTMLSelectOptGroupAccessible(nsIContent *aContent,
-                                 nsIWeakReference *aShell) :
-  nsHTMLSelectOptionAccessible(aContent, aShell)
+  nsHTMLSelectOptGroupAccessible(nsIContent* aContent,
+                                 nsDocAccessible* aDoc) :
+  nsHTMLSelectOptionAccessible(aContent, aDoc)
 {
 }
 
 role
 nsHTMLSelectOptGroupAccessible::NativeRole()
 {
   return roles::HEADING;
 }
@@ -506,18 +504,18 @@ nsHTMLSelectOptGroupAccessible::CacheChi
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLComboboxAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLComboboxAccessible::
-  nsHTMLComboboxAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsAccessibleWrap(aContent, aShell)
+  nsHTMLComboboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsAccessibleWrap(aContent, aDoc)
 {
   mFlags |= eComboboxAccessible;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLComboboxAccessible: nsAccessible
 
 role
@@ -547,20 +545,20 @@ nsHTMLComboboxAccessible::CacheChildren(
     return;
 
   nsIFrame *listFrame = comboFrame->GetDropDown();
   if (!listFrame)
     return;
 
   if (!mListAccessible) {
     mListAccessible = 
-      new nsHTMLComboboxListAccessible(mParent, mContent, mWeakShell);
+      new nsHTMLComboboxListAccessible(mParent, mContent, mDoc);
 
     // Initialize and put into cache.
-    if (!GetDocAccessible()->BindToDocument(mListAccessible, nsnull))
+    if (!Document()->BindToDocument(mListAccessible, nsnull))
       return;
   }
 
   if (AppendChild(mListAccessible)) {
     // Cache combobox option accessibles so that we build complete accessible
     // tree for combobox.
     mListAccessible->EnsureChildren();
   }
@@ -713,34 +711,34 @@ nsHTMLComboboxAccessible::SelectedOption
   if (!comboboxFrame)
     return nsnull;
 
   nsIListControlFrame* listControlFrame =
     do_QueryFrame(comboboxFrame->GetDropDown());
   if (listControlFrame) {
     nsCOMPtr<nsIContent> activeOptionNode = listControlFrame->GetCurrentOption();
     if (activeOptionNode) {
-      nsDocAccessible* document = GetDocAccessible();
+      nsDocAccessible* document = Document();
       if (document)
         return document->GetAccessible(activeOptionNode);
     }
   }
 
   return nsnull;
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLComboboxListAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLComboboxListAccessible::
-  nsHTMLComboboxListAccessible(nsIAccessible *aParent, nsIContent *aContent,
-                               nsIWeakReference *aShell) :
-  nsHTMLSelectListAccessible(aContent, aShell)
+  nsHTMLComboboxListAccessible(nsIAccessible* aParent, nsIContent* aContent,
+                               nsDocAccessible* aDoc) :
+  nsHTMLSelectListAccessible(aContent, aDoc)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLComboboxAccessible: nsAccessNode
 
 nsIFrame*
 nsHTMLComboboxListAccessible::GetFrame() const
--- a/accessible/src/html/nsHTMLSelectAccessible.h
+++ b/accessible/src/html/nsHTMLSelectAccessible.h
@@ -63,17 +63,17 @@ class nsIMutableArray;
 
 /*
  * The list that contains all the options in the select.
  */
 class nsHTMLSelectListAccessible : public nsAccessibleWrap
 {
 public:
   
-  nsHTMLSelectListAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsHTMLSelectListAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
   virtual ~nsHTMLSelectListAccessible() {}
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 
   // SelectAccessible
   virtual bool IsSelect();
@@ -103,17 +103,17 @@ protected:
 /*
  * Options inside the select, contained within the list
  */
 class nsHTMLSelectOptionAccessible : public nsHyperTextAccessibleWrap
 {
 public:
   enum { eAction_Select = 0 };  
   
-  nsHTMLSelectOptionAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsHTMLSelectOptionAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
   virtual ~nsHTMLSelectOptionAccessible() {}
 
   // nsIAccessible
   NS_IMETHOD DoAction(PRUint8 index);
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD SetSelected(bool aSelect);
 
   // nsAccessible
@@ -147,17 +147,17 @@ private:
 
 /*
  * Opt Groups inside the select, contained within the list
  */
 class nsHTMLSelectOptGroupAccessible : public nsHTMLSelectOptionAccessible
 {
 public:
 
-  nsHTMLSelectOptGroupAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsHTMLSelectOptGroupAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
   virtual ~nsHTMLSelectOptGroupAccessible() {}
 
   // nsIAccessible
   NS_IMETHOD DoAction(PRUint8 index);  
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
@@ -180,17 +180,17 @@ class nsHTMLComboboxListAccessible;
 /*
  * A class the represents the HTML Combobox widget.
  */
 class nsHTMLComboboxAccessible : public nsAccessibleWrap
 {
 public:
   enum { eAction_Click = 0 };
 
-  nsHTMLComboboxAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsHTMLComboboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
   virtual ~nsHTMLComboboxAccessible() {}
 
   // nsIAccessible
   NS_IMETHOD GetValue(nsAString& _retval);
   NS_IMETHOD DoAction(PRUint8 index);
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
 
   // nsAccessNode
@@ -229,19 +229,19 @@ private:
  * A class that represents the window that lives to the right
  * of the drop down button inside the Select. This is the window
  * that is made visible when the button is pressed.
  */
 class nsHTMLComboboxListAccessible : public nsHTMLSelectListAccessible
 {
 public:
 
-  nsHTMLComboboxListAccessible(nsIAccessible *aParent, 
-                               nsIContent *aContent, 
-                               nsIWeakReference* aShell);
+  nsHTMLComboboxListAccessible(nsIAccessible* aParent, 
+                               nsIContent* aContent, 
+                               nsDocAccessible* aDoc);
   virtual ~nsHTMLComboboxListAccessible() {}
 
   // nsAccessNode
   virtual nsIFrame* GetFrame() const;
   virtual bool IsPrimaryForNode() const;
 
   // nsAccessible
   virtual PRUint64 NativeState();
--- a/accessible/src/html/nsHTMLTableAccessible.cpp
+++ b/accessible/src/html/nsHTMLTableAccessible.cpp
@@ -71,18 +71,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLTableCellAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLTableCellAccessible::
-  nsHTMLTableCellAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsHyperTextAccessibleWrap(aContent, aShell)
+  nsHTMLTableCellAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsHyperTextAccessibleWrap(aContent, aDoc)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLTableCellAccessible: nsISupports implementation
 
 NS_IMPL_ISUPPORTS_INHERITED1(nsHTMLTableCellAccessible,
                              nsHyperTextAccessible,
@@ -343,18 +343,17 @@ nsHTMLTableCellAccessible::GetHeaderCell
     NS_ENSURE_SUCCESS(rv, rv);
     roles::Role desiredRole = static_cast<roles::Role>(-1) ;
     if (aRowOrColumnHeaderCell == nsAccUtils::eRowHeaderCells)
       desiredRole = roles::ROWHEADER;
     else if (aRowOrColumnHeaderCell == nsAccUtils::eColumnHeaderCells)
       desiredRole = roles::COLUMNHEADER;
 
     do {
-      nsAccessible* headerCell =
-        GetAccService()->GetAccessibleInWeakShell(headerCellElm, mWeakShell);
+      nsAccessible* headerCell = mDoc->GetAccessible(headerCellElm);
 
       if (headerCell && headerCell->Role() == desiredRole)
         headerCells->AppendElement(static_cast<nsIAccessible*>(headerCell),
                                    false);
     } while ((headerCellElm = iter.NextElem()));
 
     NS_ADDREF(*aHeaderCells = headerCells);
     return NS_OK;
@@ -371,19 +370,19 @@ nsHTMLTableCellAccessible::GetHeaderCell
   return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLTableHeaderAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLTableHeaderCellAccessible::
-  nsHTMLTableHeaderCellAccessible(nsIContent *aContent,
-                                  nsIWeakReference *aShell) :
-  nsHTMLTableCellAccessible(aContent, aShell)
+  nsHTMLTableHeaderCellAccessible(nsIContent* aContent,
+                                  nsDocAccessible* aDoc) :
+  nsHTMLTableCellAccessible(aContent, aDoc)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLTableHeaderAccessible: nsAccessible implementation
 
 role
 nsHTMLTableHeaderCellAccessible::NativeRole()
@@ -431,18 +430,18 @@ nsHTMLTableHeaderCellAccessible::NativeR
   return roles::COLUMNHEADER;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLTableAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLTableAccessible::
-  nsHTMLTableAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsAccessibleWrap(aContent, aShell)
+  nsHTMLTableAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsAccessibleWrap(aContent, aDoc)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLTableAccessible: nsISupports implementation
 
 NS_IMPL_ISUPPORTS_INHERITED2(nsHTMLTableAccessible, nsAccessible,
                              nsHTMLTableAccessible, nsIAccessibleTable)
@@ -453,17 +452,17 @@ NS_IMPL_ISUPPORTS_INHERITED2(nsHTMLTable
 
 void
 nsHTMLTableAccessible::CacheChildren()
 {
   // Move caption accessible so that it's the first child. Check for the first
   // caption only, because nsAccessibilityService ensures we don't create
   // accessibles for the other captions, since only the first is actually
   // visible.
-  nsAccTreeWalker walker(mWeakShell, mContent, CanHaveAnonChildren());
+  nsAccTreeWalker walker(mDoc, mContent, CanHaveAnonChildren());
 
   nsAccessible* child = nsnull;
   while ((child = walker.NextChild())) {
     if (child->Role() == roles::CAPTION) {
       InsertChildAt(0, child);
       while ((child = walker.NextChild()) && AppendChild(child));
       break;
     }
@@ -713,18 +712,17 @@ nsHTMLTableAccessible::GetSelectedCells(
                                       startRowIndex, startColIndex,
                                       rowSpan, colSpan,
                                       actualRowSpan, actualColSpan,
                                       isSelected);
 
       if (NS_SUCCEEDED(rv) && startRowIndex == rowIndex &&
           startColIndex == columnIndex && isSelected) {
         nsCOMPtr<nsIContent> cellContent(do_QueryInterface(cellElement));
-        nsAccessible *cell =
-          GetAccService()->GetAccessibleInWeakShell(cellContent, mWeakShell);
+        nsAccessible *cell = mDoc->GetAccessible(cellContent);
         selCells->AppendElement(static_cast<nsIAccessible*>(cell), false);
       }
     }
   }
 
   NS_ADDREF(*aCells = selCells);
   return NS_OK;
 }
@@ -887,18 +885,17 @@ NS_IMETHODIMP
 nsHTMLTableAccessible::GetCellAt(PRInt32 aRow, PRInt32 aColumn,
                                  nsIAccessible **aTableCellAccessible)
 {
   nsCOMPtr<nsIDOMElement> cellElement;
   nsresult rv = GetCellAt(aRow, aColumn, *getter_AddRefs(cellElement));
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCOMPtr<nsIContent> cellContent(do_QueryInterface(cellElement));
-  nsAccessible *cell =
-    GetAccService()->GetAccessibleInWeakShell(cellContent, mWeakShell);
+  nsAccessible* cell = mDoc->GetAccessible(cellContent);
 
   if (!cell) {
     return NS_ERROR_INVALID_ARG;
   }
 
   if (cell != this) {
     // XXX bug 576838: crazy tables (like table6 in tables/test_table2.html) may
     // return itself as a cell what makes Orca hang.
@@ -1189,17 +1186,17 @@ nsHTMLTableAccessible::AddRowOrColumnToS
   PRInt32 count = 0;
   if (doSelectRow)
     rv = GetColumnCount(&count);
   else
     rv = GetRowCount(&count);
 
   NS_ENSURE_SUCCESS(rv, rv);
 
-  nsCOMPtr<nsIPresShell> presShell(GetPresShell());
+  nsIPresShell* presShell(mDoc->PresShell());
   nsRefPtr<nsFrameSelection> tableSelection =
     const_cast<nsFrameSelection*>(presShell->ConstFrameSelection());
 
   for (PRInt32 idx = 0; idx < count; idx++) {
     PRInt32 rowIdx = doSelectRow ? aIndex : idx;
     PRInt32 colIdx = doSelectRow ? idx : aIndex;
     rv = tableLayout->GetCellDataAt(rowIdx, colIdx,
                                     *getter_AddRefs(cellElm),
@@ -1221,17 +1218,17 @@ nsHTMLTableAccessible::AddRowOrColumnToS
 nsresult
 nsHTMLTableAccessible::RemoveRowsOrColumnsFromSelection(PRInt32 aIndex,
                                                         PRUint32 aTarget,
                                                         bool aIsOuter)
 {
   nsITableLayout *tableLayout = GetTableLayout();
   NS_ENSURE_STATE(tableLayout);
 
-  nsCOMPtr<nsIPresShell> presShell(GetPresShell());
+  nsIPresShell* presShell(mDoc->PresShell());
   nsRefPtr<nsFrameSelection> tableSelection =
     const_cast<nsFrameSelection*>(presShell->ConstFrameSelection());
 
   bool doUnselectRow = (aTarget == nsISelectionPrivate::TABLESELECTION_ROW);
   PRInt32 count = 0;
   nsresult rv = doUnselectRow ? GetColumnCount(&count) : GetRowCount(&count);
   NS_ENSURE_SUCCESS(rv, rv);
 
@@ -1380,17 +1377,17 @@ nsHTMLTableAccessible::IsProbablyForLayo
 #define RETURN_LAYOUT_ANSWER(isLayout, heuristic) { *aIsProbablyForLayout = isLayout; return NS_OK; }
 #endif
 
   *aIsProbablyForLayout = false;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  nsDocAccessible *docAccessible = GetDocAccessible();
+  nsDocAccessible* docAccessible = Document();
   if (docAccessible) {
     PRUint64 docState = docAccessible->State();
     if (docState & states::EDITABLE) {  // Need to see all elements while document is being edited
       RETURN_LAYOUT_ANSWER(false, "In editable document");
     }
   }
 
   // Check to see if an ARIA role overrides the role from native markup,
@@ -1534,17 +1531,17 @@ nsHTMLTableAccessible::IsProbablyForLayo
   if (styledWidth.EqualsLiteral("100%")) {
     RETURN_LAYOUT_ANSWER(true, "<=4 columns and 100% width");
   }
   if (styledWidth.Find(NS_LITERAL_STRING("px"))) { // Hardcoded in pixels
     nsIFrame *tableFrame = GetFrame();
     NS_ENSURE_TRUE(tableFrame , NS_ERROR_FAILURE);
     nsSize tableSize  = tableFrame->GetSize();
 
-    nsDocAccessible *docAccessible = GetDocAccessible();
+    nsDocAccessible* docAccessible = Document();
     NS_ENSURE_TRUE(docAccessible, NS_ERROR_FAILURE);
     nsIFrame *docFrame = docAccessible->GetFrame();
     NS_ENSURE_TRUE(docFrame , NS_ERROR_FAILURE);
 
     nsSize docSize = docFrame->GetSize();
     if (docSize.width > 0) {
       PRInt32 percentageOfDocWidth = (100 * tableSize.width) / docSize.width;
       if (percentageOfDocWidth > 95) {
--- a/accessible/src/html/nsHTMLTableAccessible.h
+++ b/accessible/src/html/nsHTMLTableAccessible.h
@@ -47,17 +47,17 @@ class nsITableCellLayout;
 
 /**
  * HTML table cell accessible (html:td).
  */
 class nsHTMLTableCellAccessible : public nsHyperTextAccessibleWrap,
                                   public nsIAccessibleTableCell
 {
 public:
-  nsHTMLTableCellAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsHTMLTableCellAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessibleTableCell
   NS_DECL_NSIACCESSIBLETABLECELL
 
   // nsAccessible
@@ -90,18 +90,18 @@ protected:
 
 
 /**
  * HTML table row/column header accessible (html:th or html:td@scope).
  */
 class nsHTMLTableHeaderCellAccessible : public nsHTMLTableCellAccessible
 {
 public:
-  nsHTMLTableHeaderCellAccessible(nsIContent *aContent,
-                                  nsIWeakReference *aShell);
+  nsHTMLTableHeaderCellAccessible(nsIContent* aContent,
+                                  nsDocAccessible* aDoc);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
 };
 
 
 /**
  * HTML table accessible (html:table).
@@ -119,17 +119,17 @@ public:
   0x47ac,                                               \
   { 0x88, 0xdc, 0x4a, 0x23, 0x51, 0x6a, 0xa2, 0x3d }    \
 }
 
 class nsHTMLTableAccessible : public nsAccessibleWrap,
                               public nsIAccessibleTable
 {
 public:
-  nsHTMLTableAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsHTMLTableAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_NSIACCESSIBLETABLE
   NS_DECLARE_STATIC_IID_ACCESSOR(NS_TABLEACCESSIBLE_IMPL_CID)
 
   // nsAccessible
   virtual void Description(nsString& aDescription);
   virtual nsresult GetNameInternal(nsAString& aName);
@@ -206,18 +206,19 @@ NS_DEFINE_STATIC_IID_ACCESSOR(nsHTMLTabl
 
 
 /**
  * HTML caption accessible (html:caption).
  */
 class nsHTMLCaptionAccessible : public nsHyperTextAccessibleWrap
 {
 public:
-  nsHTMLCaptionAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-    nsHyperTextAccessibleWrap(aContent, aShell) { }
+  nsHTMLCaptionAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+    nsHyperTextAccessibleWrap(aContent, aDoc) { }
+  virtual ~nsHTMLCaptionAccessible() { }
 
   // nsIAccessible
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual Relation RelationByType(PRUint32 aRelationType);
 };
 
--- a/accessible/src/html/nsHTMLTextAccessible.cpp
+++ b/accessible/src/html/nsHTMLTextAccessible.cpp
@@ -56,18 +56,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLTextAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLTextAccessible::
-  nsHTMLTextAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsTextAccessibleWrap(aContent, aShell)
+  nsHTMLTextAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsTextAccessibleWrap(aContent, aDoc)
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsHTMLTextAccessible, nsTextAccessible)
 
 NS_IMETHODIMP
 nsHTMLTextAccessible::GetName(nsAString& aName)
 {
@@ -88,17 +88,17 @@ nsHTMLTextAccessible::NativeRole()
   return nsTextAccessible::NativeRole();
 }
 
 PRUint64
 nsHTMLTextAccessible::NativeState()
 {
   PRUint64 state = nsTextAccessible::NativeState();
 
-  nsDocAccessible *docAccessible = GetDocAccessible();
+  nsDocAccessible* docAccessible = Document();
   if (docAccessible) {
      PRUint64 docState = docAccessible->State();
      if (0 == (docState & states::EDITABLE)) {
        state |= states::READONLY; // Links not focusable in editor
      }
   }
 
   return state;
@@ -117,35 +117,35 @@ nsHTMLTextAccessible::GetAttributesInter
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLHRAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLHRAccessible::
-  nsHTMLHRAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsLeafAccessible(aContent, aShell)
+  nsHTMLHRAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsLeafAccessible(aContent, aDoc)
 {
 }
 
 role
 nsHTMLHRAccessible::NativeRole()
 {
   return roles::SEPARATOR;
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLBRAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLBRAccessible::
-  nsHTMLBRAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsLeafAccessible(aContent, aShell)
+  nsHTMLBRAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsLeafAccessible(aContent, aDoc)
 {
 }
 
 role
 nsHTMLBRAccessible::NativeRole()
 {
   return roles::WHITESPACE;
 }
@@ -163,18 +163,18 @@ nsHTMLBRAccessible::GetNameInternal(nsAS
   return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLLabelAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLLabelAccessible::
-  nsHTMLLabelAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsHyperTextAccessibleWrap(aContent, aShell)
+  nsHTMLLabelAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsHyperTextAccessibleWrap(aContent, aDoc)
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsHTMLLabelAccessible, nsHyperTextAccessible)
 
 nsresult
 nsHTMLLabelAccessible::GetNameInternal(nsAString& aName)
 {
@@ -187,18 +187,18 @@ nsHTMLLabelAccessible::NativeRole()
   return roles::LABEL;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLOuputAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLOutputAccessible::
-  nsHTMLOutputAccessible(nsIContent* aContent, nsIWeakReference* aShell) :
-  nsHyperTextAccessibleWrap(aContent, aShell)
+  nsHTMLOutputAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsHyperTextAccessibleWrap(aContent, aDoc)
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsHTMLOutputAccessible, nsHyperTextAccessible)
 
 Relation
 nsHTMLOutputAccessible::RelationByType(PRUint32 aType)
 {
@@ -228,25 +228,25 @@ nsHTMLOutputAccessible::GetAttributesInt
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLLIAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLLIAccessible::
-  nsHTMLLIAccessible(nsIContent* aContent, nsIWeakReference* aShell) :
-  nsHyperTextAccessibleWrap(aContent, aShell), mBullet(nsnull)
+  nsHTMLLIAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsHyperTextAccessibleWrap(aContent, aDoc), mBullet(nsnull)
 {
   mFlags |= eHTMLListItemAccessible;
 
   nsBlockFrame* blockFrame = do_QueryFrame(GetFrame());
   if (blockFrame && blockFrame->HasBullet()) {
-    mBullet = new nsHTMLListBulletAccessible(mContent, mWeakShell);
-    if (!GetDocAccessible()->BindToDocument(mBullet, nsnull))
+    mBullet = new nsHTMLListBulletAccessible(mContent, mDoc);
+    if (!Document()->BindToDocument(mBullet, nsnull))
       mBullet = nsnull;
   }
 }
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsHTMLLIAccessible, nsHyperTextAccessible)
 
 void
 nsHTMLLIAccessible::Shutdown()
@@ -289,19 +289,19 @@ NS_IMETHODIMP nsHTMLLIAccessible::GetBou
 void
 nsHTMLLIAccessible::UpdateBullet(bool aHasBullet)
 {
   if (aHasBullet == !!mBullet) {
     NS_NOTREACHED("Bullet and accessible are in sync already!");
     return;
   }
 
-  nsDocAccessible* document = GetDocAccessible();
+  nsDocAccessible* document = Document();
   if (aHasBullet) {
-    mBullet = new nsHTMLListBulletAccessible(mContent, mWeakShell);
+    mBullet = new nsHTMLListBulletAccessible(mContent, mDoc);
     if (document->BindToDocument(mBullet, nsnull)) {
       InsertChildAt(0, mBullet);
     }
   } else {
     RemoveChild(mBullet);
     document->UnbindFromDocument(mBullet);
     mBullet = nsnull;
   }
@@ -323,18 +323,18 @@ nsHTMLLIAccessible::CacheChildren()
   nsAccessibleWrap::CacheChildren();
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLListBulletAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLListBulletAccessible::
-  nsHTMLListBulletAccessible(nsIContent* aContent, nsIWeakReference* aShell) :
-    nsLeafAccessible(aContent, aShell)
+  nsHTMLListBulletAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+    nsLeafAccessible(aContent, aDoc)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLListBulletAccessible: nsAccessNode
 
 bool
 nsHTMLListBulletAccessible::IsPrimaryForNode() const
@@ -395,18 +395,18 @@ nsHTMLListBulletAccessible::AppendTextTo
   aText.Append(Substring(bulletText, aStartOffset, aLength));
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLListAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLListAccessible::
-  nsHTMLListAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsHyperTextAccessibleWrap(aContent, aShell)
+  nsHTMLListAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsHyperTextAccessibleWrap(aContent, aDoc)
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsHTMLListAccessible, nsHyperTextAccessible)
 
 role
 nsHTMLListAccessible::NativeRole()
 {
--- a/accessible/src/html/nsHTMLTextAccessible.h
+++ b/accessible/src/html/nsHTMLTextAccessible.h
@@ -45,17 +45,17 @@
 #include "nsBaseWidgetAccessible.h"
 
 /**
  * Used for text nodes within HTML document.
  */
 class nsHTMLTextAccessible : public nsTextAccessibleWrap
 {
 public:
-  nsHTMLTextAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsHTMLTextAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessible
   NS_IMETHOD GetName(nsAString& aName);
 
   // nsAccessible
@@ -65,74 +65,74 @@ public:
 };
 
 /**
  * Used for HTML hr element.
  */
 class nsHTMLHRAccessible : public nsLeafAccessible
 {
 public:
-  nsHTMLHRAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsHTMLHRAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
 };
 
 /**
  * Used for HTML br element.
  */
 class nsHTMLBRAccessible : public nsLeafAccessible
 {
 public:
-  nsHTMLBRAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsHTMLBRAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 };
 
 /**
  * Used for HTML label element.
  */
 class nsHTMLLabelAccessible : public nsHyperTextAccessibleWrap
 {
 public:
-  nsHTMLLabelAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsHTMLLabelAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual mozilla::a11y::role NativeRole();
 };
 
 /**
  * Used for HTML output element.
  */
 class nsHTMLOutputAccessible : public nsHyperTextAccessibleWrap
 {
 public:
-  nsHTMLOutputAccessible(nsIContent* aContent, nsIWeakReference* aShell);
+  nsHTMLOutputAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual nsresult GetAttributesInternal(nsIPersistentProperties* aAttributes);
   virtual Relation RelationByType(PRUint32 aType);
 };
 
 /**
  * Used for bullet of HTML list item element (for example, HTML li).
  */
 class nsHTMLListBulletAccessible : public nsLeafAccessible
 {
 public:
-  nsHTMLListBulletAccessible(nsIContent* aContent, nsIWeakReference* aShell);
+  nsHTMLListBulletAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsIAccessible
   NS_IMETHOD GetName(nsAString& aName);
 
   // nsAccessNode
   virtual bool IsPrimaryForNode() const;
 
   // nsAccessible
@@ -143,33 +143,33 @@ public:
 };
 
 /**
  * Used for HTML list (like HTML ul).
  */
 class nsHTMLListAccessible : public nsHyperTextAccessibleWrap
 {
 public:
-  nsHTMLListAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsHTMLListAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 };
 
 /**
  * Used for HTML list item (e.g. HTML li).
  */
 class nsHTMLLIAccessible : public nsHyperTextAccessibleWrap
 {
 public:
-  nsHTMLLIAccessible(nsIContent* aContent, nsIWeakReference* aShell);
+  nsHTMLLIAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsAccessNode
   virtual void Shutdown();
 
   // nsIAccessible
--- a/accessible/src/html/nsHyperTextAccessible.cpp
+++ b/accessible/src/html/nsHyperTextAccessible.cpp
@@ -36,16 +36,17 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsHyperTextAccessible.h"
 
 #include "nsAccessibilityService.h"
 #include "nsAccUtils.h"
+#include "nsDocAccessible.h"
 #include "nsTextAttrs.h"
 #include "Role.h"
 #include "States.h"
 
 #include "nsIClipboard.h"
 #include "nsFocusManager.h"
 #include "nsIDOMCharacterData.h"
 #include "nsIDOMDocument.h"
@@ -66,18 +67,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHyperTextAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHyperTextAccessible::
-  nsHyperTextAccessible(nsIContent *aNode, nsIWeakReference *aShell) :
-  nsAccessibleWrap(aNode, aShell)
+  nsHyperTextAccessible(nsIContent* aNode, nsDocAccessible* aDoc) :
+  nsAccessibleWrap(aNode, aDoc)
 {
   mFlags |= eHyperTextAccessible;
 }
 
 NS_IMPL_ADDREF_INHERITED(nsHyperTextAccessible, nsAccessibleWrap)
 NS_IMPL_RELEASE_INHERITED(nsHyperTextAccessible, nsAccessibleWrap)
 
 nsresult nsHyperTextAccessible::QueryInterface(REFNSIID aIID, void** aInstancePtr)
@@ -204,17 +205,18 @@ nsIntRect nsHyperTextAccessible::GetBoun
   nsIFrame *frame;
   PRInt32 startContentOffsetInFrame;
   // Get the right frame continuation -- not really a child, but a sibling of
   // the primary frame passed in
   rv = aFrame->GetChildFrameContainingOffset(startContentOffset, false,
                                              &startContentOffsetInFrame, &frame);
   NS_ENSURE_SUCCESS(rv, screenRect);
 
-  nsCOMPtr<nsIPresShell> shell = GetPresShell();
+  NS_ENSURE_TRUE(mDoc, screenRect);
+  nsIPresShell* shell = mDoc->PresShell();
   NS_ENSURE_TRUE(shell, screenRect);
 
   nsPresContext *context = shell->GetPresContext();
 
   while (frame && startContentOffset < endContentOffset) {
     // Start with this frame's screen rect, which we will 
     // shrink based on the substring we care about within it.
     // We will then add that frame to the total screenRect we
@@ -877,17 +879,20 @@ nsresult nsHyperTextAccessible::GetTextH
                                               nsAString &aText)
 {
   aText.Truncate();
 
   NS_ENSURE_ARG_POINTER(aStartOffset);
   NS_ENSURE_ARG_POINTER(aEndOffset);
   *aStartOffset = *aEndOffset = 0;
 
-  nsCOMPtr<nsIPresShell> presShell = GetPresShell();
+  if (!mDoc)
+    return NS_ERROR_FAILURE;
+
+  nsIPresShell* presShell = mDoc->PresShell();
   if (!presShell) {
     return NS_ERROR_FAILURE;
   }
 
   if (aOffset == nsIAccessibleText::TEXT_OFFSET_END_OF_TEXT) {
     aOffset = CharacterCount();
   }
   if (aOffset == nsIAccessibleText::TEXT_OFFSET_CARET) {
@@ -1288,17 +1293,20 @@ NS_IMETHODIMP nsHyperTextAccessible::Get
  * Gets the offset of the character located at coordinates x and y. x and y are interpreted as being relative to
  * the screen or this widget's window depending on coords.
  */
 NS_IMETHODIMP
 nsHyperTextAccessible::GetOffsetAtPoint(PRInt32 aX, PRInt32 aY,
                                         PRUint32 aCoordType, PRInt32 *aOffset)
 {
   *aOffset = -1;
-  nsCOMPtr<nsIPresShell> shell = GetPresShell();
+  if (!mDoc)
+    return NS_ERROR_FAILURE;
+
+  nsIPresShell* shell = mDoc->PresShell();
   if (!shell) {
     return NS_ERROR_FAILURE;
   }
   nsIFrame *hyperFrame = GetFrame();
   if (!hyperFrame) {
     return NS_ERROR_FAILURE;
   }
   nsIntRect frameScreenRect = hyperFrame->GetScreenRectExternal();
@@ -1538,24 +1546,22 @@ nsHyperTextAccessible::GetAssociatedEdit
   }
 
   nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem =
     nsCoreUtils::GetDocShellTreeItemFor(mContent);
   nsCOMPtr<nsIEditingSession> editingSession(do_GetInterface(docShellTreeItem));
   if (!editingSession)
     return NS_OK; // No editing session interface
 
-  nsCOMPtr<nsIPresShell> shell = GetPresShell();
-  NS_ENSURE_TRUE(shell, NS_ERROR_FAILURE);
-
-  nsCOMPtr<nsIDocument> doc = shell->GetDocument();
-  NS_ENSURE_TRUE(doc, NS_ERROR_FAILURE);
+  NS_ENSURE_TRUE(mDoc, NS_ERROR_FAILURE);
+  nsIDocument* docNode = mDoc->GetDocumentNode();
+  NS_ENSURE_TRUE(docNode, NS_ERROR_FAILURE);
 
   nsCOMPtr<nsIEditor> editor;
-  return editingSession->GetEditorForWindow(doc->GetWindow(), aEditor);
+  return editingSession->GetEditorForWindow(docNode->GetWindow(), aEditor);
 }
 
 /**
   * =================== Caret & Selection ======================
   */
 
 nsresult
 nsHyperTextAccessible::SetSelectionRange(PRInt32 aStartPos, PRInt32 aEndPos)
@@ -1593,21 +1599,20 @@ nsHyperTextAccessible::SetSelectionRange
   // When selection is done, move the focus to the selection if accessible is
   // not focusable. That happens when selection is set within hypertext
   // accessible.
   if (isFocusable)
     return NS_OK;
 
   nsFocusManager* DOMFocusManager = nsFocusManager::GetFocusManager();
   if (DOMFocusManager) {
-    nsCOMPtr<nsIPresShell> shell = GetPresShell();
-    NS_ENSURE_TRUE(shell, NS_ERROR_FAILURE);
-    nsCOMPtr<nsIDocument> doc = shell->GetDocument();
-    NS_ENSURE_TRUE(doc, NS_ERROR_FAILURE);
-    nsCOMPtr<nsPIDOMWindow> window = doc->GetWindow();
+    NS_ENSURE_TRUE(mDoc, NS_ERROR_FAILURE);
+    nsIDocument* docNode = mDoc->GetDocumentNode();
+    NS_ENSURE_TRUE(docNode, NS_ERROR_FAILURE);
+    nsCOMPtr<nsPIDOMWindow> window = docNode->GetWindow();
     nsCOMPtr<nsIDOMElement> result;
     DOMFocusManager->MoveFocus(window, nsnull, nsIFocusManager::MOVEFOCUS_CARET,
                                nsIFocusManager::FLAG_BYMOVEFOCUS, getter_AddRefs(result));
   }
 
   return NS_OK;
 }
 
--- a/accessible/src/html/nsHyperTextAccessible.h
+++ b/accessible/src/html/nsHyperTextAccessible.h
@@ -71,17 +71,19 @@ const PRUnichar kForcedNewLineChar = '\n
   * Special Accessible that knows how contain both text and embedded objects
   */
 class nsHyperTextAccessible : public nsAccessibleWrap,
                               public nsIAccessibleText,
                               public nsIAccessibleHyperText,
                               public nsIAccessibleEditableText
 {
 public:
-  nsHyperTextAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsHyperTextAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  virtual ~nsHyperTextAccessible() { }
+
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_NSIACCESSIBLETEXT
   NS_DECL_NSIACCESSIBLEHYPERTEXT
   NS_DECL_NSIACCESSIBLEEDITABLETEXT
   NS_DECLARE_STATIC_IID_ACCESSOR(NS_HYPERTEXTACCESSIBLE_IMPL_CID)
 
   // nsAccessible
   virtual PRInt32 GetLevelInternal();
--- a/accessible/src/mac/mozAccessible.mm
+++ b/accessible/src/mac/mozAccessible.mm
@@ -608,17 +608,17 @@ GetNativeFromGeckoAccessible(nsIAccessib
 - (NSWindow*)window
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NIL;
 
   nsAccessibleWrap *accWrap = static_cast<nsAccessibleWrap*>(mGeckoAccessible);
 
   // Get a pointer to the native window (NSWindow) we reside in.
   NSWindow *nativeWindow = nil;
-  nsDocAccessible* docAcc = accWrap->GetDocAccessible();
+  nsDocAccessible* docAcc = accWrap->Document();
   if (docAcc)
     nativeWindow = static_cast<NSWindow*>(docAcc->GetNativeWindow());
 
   NSAssert1(nativeWindow, @"Could not get native window for %@", self);
   return nativeWindow;
 
   NS_OBJC_END_TRY_ABORT_BLOCK_NIL;
 }
--- a/accessible/src/mac/nsAccessNodeWrap.h
+++ b/accessible/src/mac/nsAccessNodeWrap.h
@@ -42,18 +42,18 @@
 
 #ifndef _nsAccessNodeWrap_H_
 #define _nsAccessNodeWrap_H_
 
 #include "nsAccessNode.h"
 
 class nsAccessNodeWrap :  public nsAccessNode
 {
-  public: // construction, destruction
-    nsAccessNodeWrap(nsIContent *aContent, nsIWeakReference *aShell);
-    virtual ~nsAccessNodeWrap();
+public:
+  nsAccessNodeWrap(nsIContent* aContent, nsDocAccessible* aDoc);
+  virtual ~nsAccessNodeWrap();
 
-    static void InitAccessibility();
-    static void ShutdownAccessibility();
+  static void InitAccessibility();
+  static void ShutdownAccessibility();
 };
 
 #endif
 
--- a/accessible/src/mac/nsAccessNodeWrap.mm
+++ b/accessible/src/mac/nsAccessNodeWrap.mm
@@ -47,18 +47,18 @@
  * Class nsAccessNodeWrap
  */
 
 //-----------------------------------------------------
 // construction 
 //-----------------------------------------------------
 
 nsAccessNodeWrap::
-  nsAccessNodeWrap(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsAccessNode(aContent, aShell)
+  nsAccessNodeWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsAccessNode(aContent, aDoc)
 {
 }
 
 //-----------------------------------------------------
 // destruction
 //-----------------------------------------------------
 nsAccessNodeWrap::~nsAccessNodeWrap()
 {
--- a/accessible/src/mac/nsAccessibleWrap.h
+++ b/accessible/src/mac/nsAccessibleWrap.h
@@ -57,17 +57,17 @@
 
 #if defined(__OBJC__)
 @class mozAccessible;
 #endif
 
 class nsAccessibleWrap : public nsAccessible
 {
 public: // construction, destruction
-  nsAccessibleWrap(nsIContent* aContent, nsIWeakReference* aShell);
+  nsAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc);
   virtual ~nsAccessibleWrap();
     
   /**
    * Get the native Obj-C object (mozAccessible).
    */
   NS_IMETHOD GetNativeInterface (void** aOutAccessible);
   
   /**
--- a/accessible/src/mac/nsAccessibleWrap.mm
+++ b/accessible/src/mac/nsAccessibleWrap.mm
@@ -46,18 +46,18 @@
 #import "mozAccessible.h"
 #import "mozActionElements.h"
 #import "mozHTMLAccessible.h"
 #import "mozTextAccessible.h"
 
 using namespace mozilla::a11y;
 
 nsAccessibleWrap::
-  nsAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsAccessible(aContent, aShell), mNativeObject(nil),
+  nsAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsAccessible(aContent, aDoc), mNativeObject(nil),  
   mNativeInited(false)
 {
 }
 
 nsAccessibleWrap::~nsAccessibleWrap()
 {
 }
 
--- a/accessible/src/mac/nsDocAccessibleWrap.h
+++ b/accessible/src/mac/nsDocAccessibleWrap.h
@@ -39,15 +39,15 @@
 #ifndef _nsDocAccessibleWrap_H_
 #define _nsDocAccessibleWrap_H_
 
 #include "nsDocAccessible.h"
 
 class nsDocAccessibleWrap: public nsDocAccessible
 {
 public:
-  nsDocAccessibleWrap(nsIDocument *aDocument, nsIContent *aRootContent,
-                      nsIWeakReference *aShell);
+  nsDocAccessibleWrap(nsIDocument* aDocument, nsIContent* aRootContent,
+                      nsIPresShell* aPresShell);
   virtual ~nsDocAccessibleWrap();
 
 };
 
 #endif
--- a/accessible/src/mac/nsDocAccessibleWrap.mm
+++ b/accessible/src/mac/nsDocAccessibleWrap.mm
@@ -35,18 +35,18 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsDocAccessibleWrap.h"
 
 #import "mozAccessible.h"
 
 nsDocAccessibleWrap::
-  nsDocAccessibleWrap(nsIDocument *aDocument, nsIContent *aRootContent,
-                      nsIWeakReference *aShell) :
-  nsDocAccessible(aDocument, aRootContent, aShell)
+  nsDocAccessibleWrap(nsIDocument* aDocument, nsIContent* aRootContent,
+                      nsIPresShell* aPresShell) :
+  nsDocAccessible(aDocument, aRootContent, aPresShell)
 {
 }
 
 nsDocAccessibleWrap::~nsDocAccessibleWrap()
 {
 }
 
--- a/accessible/src/mac/nsRootAccessibleWrap.h
+++ b/accessible/src/mac/nsRootAccessibleWrap.h
@@ -45,18 +45,18 @@
 
 #include "nsRootAccessible.h"
 
 struct objc_class;
 
 class nsRootAccessibleWrap : public nsRootAccessible
 {
 public:
-  nsRootAccessibleWrap(nsIDocument *aDocument, nsIContent *aRootContent,
-                       nsIWeakReference *aShell);
+  nsRootAccessibleWrap(nsIDocument* aDocument, nsIContent* aRootContent,
+                       nsIPresShell* aPresShell);
   virtual ~nsRootAccessibleWrap();
 
     Class GetNativeType ();
     
     // let's our native accessible get in touch with the
     // native cocoa view that is our accessible parent.
     void GetNativeWidget (void **aOutView);
 };
--- a/accessible/src/mac/nsRootAccessibleWrap.mm
+++ b/accessible/src/mac/nsRootAccessibleWrap.mm
@@ -41,19 +41,19 @@
 #include "mozDocAccessible.h"
 
 #include "nsCOMPtr.h"
 #include "nsObjCExceptions.h"
 #include "nsIWidget.h"
 #include "nsIViewManager.h"
 
 nsRootAccessibleWrap::
-  nsRootAccessibleWrap(nsIDocument *aDocument, nsIContent *aRootContent,
-                       nsIWeakReference *aShell) :
-  nsRootAccessible(aDocument, aRootContent, aShell)
+  nsRootAccessibleWrap(nsIDocument* aDocument, nsIContent* aRootContent,
+                       nsIPresShell* aPresShell) :
+  nsRootAccessible(aDocument, aRootContent, aPresShell)
 {
 }
 
 nsRootAccessibleWrap::~nsRootAccessibleWrap()
 {
 }
 
 Class
--- a/accessible/src/msaa/nsARIAGridAccessibleWrap.h
+++ b/accessible/src/msaa/nsARIAGridAccessibleWrap.h
@@ -48,36 +48,36 @@
 /**
  * IA2 wrapper class for nsARIAGridAccessible implementing IAccessibleTable and
  * IAccessibleTable2 interfaces.
  */
 class nsARIAGridAccessibleWrap : public nsARIAGridAccessible,
                                  public CAccessibleTable
 {
 public:
-  nsARIAGridAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell) :
-    nsARIAGridAccessible(aContent, aShell) {}
+  nsARIAGridAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
+    nsARIAGridAccessible(aContent, aDoc) {}
 
   // IUnknown
   DECL_IUNKNOWN_INHERITED
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 };
 
 /**
  * IA2 wrapper class for nsARIAGridCellAccessible implementing
  * IAccessibleTableCell interface.
  */
 class nsARIAGridCellAccessibleWrap : public nsARIAGridCellAccessible,
                                      public CAccessibleTableCell
 {
 public:
-  nsARIAGridCellAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell) :
-    nsARIAGridCellAccessible(aContent, aShell) {}
+  nsARIAGridCellAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
+    nsARIAGridCellAccessible(aContent, aDoc) {}
 
   // IUnknown
   DECL_IUNKNOWN_INHERITED
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 };
 
--- a/accessible/src/msaa/nsAccessNodeWrap.cpp
+++ b/accessible/src/msaa/nsAccessNodeWrap.cpp
@@ -65,18 +65,18 @@ using namespace mozilla::a11y;
 
 AccTextChangeEvent* nsAccessNodeWrap::gTextEvent = nsnull;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessNodeWrap
 ////////////////////////////////////////////////////////////////////////////////
 
 nsAccessNodeWrap::
-  nsAccessNodeWrap(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsAccessNode(aContent, aShell)
+  nsAccessNodeWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsAccessNode(aContent, aDoc)
 {
 }
 
 nsAccessNodeWrap::~nsAccessNodeWrap()
 {
 }
 
 //-----------------------------------------------------
@@ -407,32 +407,31 @@ ISimpleDOMNode*
 nsAccessNodeWrap::MakeAccessNode(nsINode *aNode)
 {
   if (!aNode)
     return NULL;
 
   nsAccessNodeWrap *newNode = NULL;
 
   ISimpleDOMNode *iNode = NULL;
-  nsAccessible *acc =
-    GetAccService()->GetAccessibleInWeakShell(aNode, mWeakShell);
+  nsAccessible* acc = mDoc->GetAccessible(aNode);
   if (acc) {
     IAccessible *msaaAccessible = nsnull;
     acc->GetNativeInterface((void**)&msaaAccessible); // addrefs
     msaaAccessible->QueryInterface(IID_ISimpleDOMNode, (void**)&iNode); // addrefs
     msaaAccessible->Release(); // Release IAccessible
   }
   else {
     nsCOMPtr<nsIContent> content(do_QueryInterface(aNode));
     if (!content) {
       NS_NOTREACHED("The node is a document which is not accessible!");
       return NULL;
     }
 
-    newNode = new nsAccessNodeWrap(content, mWeakShell);
+    newNode = new nsAccessNodeWrap(content, mDoc);
     if (!newNode)
       return NULL;
 
     newNode->Init();
     iNode = static_cast<ISimpleDOMNode*>(newNode);
     iNode->AddRef();
   }
 
--- a/accessible/src/msaa/nsAccessNodeWrap.h
+++ b/accessible/src/msaa/nsAccessNodeWrap.h
@@ -78,17 +78,17 @@ class nsAccessNodeWrap :  public nsAcces
   public:
     NS_DECL_ISUPPORTS_INHERITED
     NS_DECL_NSIWINACCESSNODE
 
   public: // IServiceProvider
     STDMETHODIMP QueryService(REFGUID guidService, REFIID riid, void** ppv);
 
 public: // construction, destruction
-  nsAccessNodeWrap(nsIContent *aContent, nsIWeakReference *aShell);
+  nsAccessNodeWrap(nsIContent* aContent, nsDocAccessible* aDoc);
   virtual ~nsAccessNodeWrap();
 
     // IUnknown
     STDMETHODIMP QueryInterface(REFIID, void**);
 
   public:
 
     virtual /* [id][propget] */ HRESULT STDMETHODCALLTYPE get_nodeInfo( 
--- a/accessible/src/msaa/nsAccessibleWrap.cpp
+++ b/accessible/src/msaa/nsAccessibleWrap.cpp
@@ -92,18 +92,18 @@ static const PRInt32 kIEnumVariantDiscon
 ////////////////////////////////////////////////////////////////////////////////
 
 ITypeInfo* nsAccessibleWrap::gTypeInfo = NULL;
 
 //-----------------------------------------------------
 // construction
 //-----------------------------------------------------
 nsAccessibleWrap::
-  nsAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsAccessible(aContent, aShell), mEnumVARIANTPosition(0)
+  nsAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsAccessible(aContent, aDoc), mEnumVARIANTPosition(0)
 {
 }
 
 //-----------------------------------------------------
 // destruction
 //-----------------------------------------------------
 nsAccessibleWrap::~nsAccessibleWrap()
 {
@@ -1511,17 +1511,17 @@ nsAccessibleWrap::FirePlatformEvent(AccE
   NS_ASSERTION(winLastEntry == kEVENT_LAST_ENTRY,
                "MSAA event map skewed");
 
   PRUint32 winEvent = gWinEventMap[eventType];
   if (!winEvent)
     return NS_OK;
 
   // Means we're not active.
-  NS_ENSURE_TRUE(mWeakShell, NS_ERROR_FAILURE);
+  NS_ENSURE_TRUE(!IsDefunct(), NS_ERROR_FAILURE);
 
   nsAccessible *accessible = aEvent->GetAccessible();
   if (!accessible)
     return NS_OK;
 
   if (eventType == nsIAccessibleEvent::EVENT_TEXT_CARET_MOVED ||
       eventType == nsIAccessibleEvent::EVENT_FOCUS) {
     UpdateSystemCaret();
@@ -1582,44 +1582,46 @@ PRInt32 nsAccessibleWrap::GetChildIDFor(
   // XXX: bug 606080
   return aAccessible ? - NS_PTR_TO_INT32(aAccessible->UniqueID()) : 0;
 }
 
 HWND
 nsAccessibleWrap::GetHWNDFor(nsAccessible *aAccessible)
 {
   if (aAccessible) {
+    nsDocAccessible* document = aAccessible->Document();
+    if(!document)
+      return nsnull;
+
     // Popup lives in own windows, use its HWND until the popup window is
     // hidden to make old JAWS versions work with collapsed comboboxes (see
     // discussion in bug 379678).
     nsIFrame* frame = aAccessible->GetFrame();
     if (frame) {
       nsIWidget* widget = frame->GetNearestWidget();
       if (widget) {
         bool isVisible = false;
         widget->IsVisible(isVisible);
         if (isVisible) {
-          nsCOMPtr<nsIPresShell> shell(aAccessible->GetPresShell());
+          nsCOMPtr<nsIPresShell> shell(document->PresShell());
           nsIViewManager* vm = shell->GetViewManager();
           if (vm) {
             nsCOMPtr<nsIWidget> rootWidget;
             vm->GetRootWidget(getter_AddRefs(rootWidget));
             // Make sure the accessible belongs to popup. If not then use
             // document HWND (which might be different from root widget in the
             // case of window emulation).
             if (rootWidget != widget)
               return static_cast<HWND>(widget->GetNativeData(NS_NATIVE_WINDOW));
           }
         }
       }
     }
 
-    nsDocAccessible* document = aAccessible->GetDocAccessible();
-    if (document)
-      return static_cast<HWND>(document->GetNativeWindow());
+    return static_cast<HWND>(document->GetNativeWindow());
   }
   return nsnull;
 }
 
 HRESULT
 nsAccessibleWrap::ConvertToIA2Attributes(nsIPersistentProperties *aAttributes,
                                          BSTR *aIA2Attributes)
 {
@@ -1737,17 +1739,17 @@ nsAccessibleWrap::GetXPAccessibleFor(con
     void* uniqueID = reinterpret_cast<void*>(-aVarChild.lVal);
 
     // Document.
     if (IsDoc())
       return AsDoc()->GetAccessibleByUniqueIDInSubtree(uniqueID);
 
     // ARIA document.
     if (ARIARole() == roles::DOCUMENT) {
-      nsDocAccessible* document = GetDocAccessible();
+      nsDocAccessible* document = Document();
       nsAccessible* child =
         document->GetAccessibleByUniqueIDInSubtree(uniqueID);
 
       // Check whether the accessible for the given ID is a child of ARIA
       // document.
       nsAccessible* parent = child ? child->Parent() : nsnull;
       while (parent && parent != document) {
         if (parent == this)
--- a/accessible/src/msaa/nsAccessibleWrap.h
+++ b/accessible/src/msaa/nsAccessibleWrap.h
@@ -99,17 +99,17 @@ Class::QueryInterface(REFIID iid, void**
 class nsAccessibleWrap : public nsAccessible,
                          public CAccessibleComponent,
                          public CAccessibleHyperlink,
                          public CAccessibleValue,
                          public IAccessible2,
                          public IEnumVARIANT
 {
 public: // construction, destruction
-  nsAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell);
+  nsAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc);
   virtual ~nsAccessibleWrap();
 
     // nsISupports
     NS_DECL_ISUPPORTS_INHERITED
 
   public: // IUnknown methods - see iunknown.h for documentation
     STDMETHODIMP QueryInterface(REFIID, void**);
 
--- a/accessible/src/msaa/nsDocAccessibleWrap.cpp
+++ b/accessible/src/msaa/nsDocAccessibleWrap.cpp
@@ -63,19 +63,19 @@ using namespace mozilla::a11y;
  * see http://lxr.mozilla.org/seamonkey/source/accessible/accessible-docs.html
  */
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsDocAccessibleWrap
 ////////////////////////////////////////////////////////////////////////////////
 
 nsDocAccessibleWrap::
-  nsDocAccessibleWrap(nsIDocument *aDocument, nsIContent *aRootContent,
-                      nsIWeakReference *aShell) :
-  nsDocAccessible(aDocument, aRootContent, aShell), mHWND(NULL)
+  nsDocAccessibleWrap(nsIDocument* aDocument, nsIContent* aRootContent,
+                      nsIPresShell* aPresShell) :
+  nsDocAccessible(aDocument, aRootContent, aPresShell), mHWND(NULL)
 {
 }
 
 nsDocAccessibleWrap::~nsDocAccessibleWrap()
 {
 }
 
 //-----------------------------------------------------
--- a/accessible/src/msaa/nsDocAccessibleWrap.h
+++ b/accessible/src/msaa/nsDocAccessibleWrap.h
@@ -48,18 +48,18 @@
 #include "nsAccUtils.h"
 #include "nsDocAccessible.h"
 #include "nsIDocShellTreeItem.h"
 
 class nsDocAccessibleWrap: public nsDocAccessible,
                            public ISimpleDOMDocument
 {
 public:
-  nsDocAccessibleWrap(nsIDocument *aDocument, nsIContent *aRootContent,
-                      nsIWeakReference *aShell);
+  nsDocAccessibleWrap(nsIDocument* aDocument, nsIContent* aRootContent,
+                      nsIPresShell* aPresShell);
   virtual ~nsDocAccessibleWrap();
 
     // IUnknown
     STDMETHODIMP_(ULONG) AddRef();
     STDMETHODIMP_(ULONG) Release();
     STDMETHODIMP      QueryInterface(REFIID, void**);
 
     // ISimpleDOMDocument
--- a/accessible/src/msaa/nsHTMLImageAccessibleWrap.h
+++ b/accessible/src/msaa/nsHTMLImageAccessibleWrap.h
@@ -43,18 +43,18 @@
 
 #include "nsHTMLImageAccessible.h"
 #include "CAccessibleImage.h"
 
 class nsHTMLImageAccessibleWrap : public nsHTMLImageAccessible,
                                   public CAccessibleImage
 {
 public:
-  nsHTMLImageAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell) :
-    nsHTMLImageAccessible(aContent, aShell) {}
+  nsHTMLImageAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
+    nsHTMLImageAccessible(aContent, aDoc) {}
 
   // IUnknown
   DECL_IUNKNOWN_INHERITED
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 };
 
--- a/accessible/src/msaa/nsHTMLTableAccessibleWrap.h
+++ b/accessible/src/msaa/nsHTMLTableAccessibleWrap.h
@@ -49,18 +49,18 @@
 /**
  * IA2 wrapper class for nsHTMLTableAccessible implementing IAccessibleTable
  * and IAccessibleTable2 interfaces.
  */
 class nsHTMLTableAccessibleWrap : public nsHTMLTableAccessible,
                                   public CAccessibleTable
 {
 public:
-  nsHTMLTableAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell) :
-    nsHTMLTableAccessible(aContent, aShell) {}
+  nsHTMLTableAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
+    nsHTMLTableAccessible(aContent, aDoc) {}
 
   // IUnknown
   DECL_IUNKNOWN_INHERITED
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 };
 
@@ -68,18 +68,18 @@ public:
 /**
  * IA2 wrapper class for nsHTMLTableCellAccessible implementing
  * IAccessibleTableCell interface.
  */
 class nsHTMLTableCellAccessibleWrap : public nsHTMLTableCellAccessible,
                                       public CAccessibleTableCell
 {
 public:
-  nsHTMLTableCellAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell) :
-    nsHTMLTableCellAccessible(aContent, aShell) {}
+  nsHTMLTableCellAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
+    nsHTMLTableCellAccessible(aContent, aDoc) {}
 
   // IUnknown
   DECL_IUNKNOWN_INHERITED
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 };
 
@@ -87,19 +87,19 @@ public:
 /**
  * IA2 wrapper class for nsHTMLTableHeaderCellAccessible implementing
  * IAccessibleTableCell interface.
  */
 class nsHTMLTableHeaderCellAccessibleWrap : public nsHTMLTableHeaderCellAccessible,
                                             public CAccessibleTableCell
 {
 public:
-  nsHTMLTableHeaderCellAccessibleWrap(nsIContent *aContent,
-                                      nsIWeakReference *aShell) :
-    nsHTMLTableHeaderCellAccessible(aContent, aShell) {}
+  nsHTMLTableHeaderCellAccessibleWrap(nsIContent* aContent,
+                                      nsDocAccessible* aDoc) :
+    nsHTMLTableHeaderCellAccessible(aContent, aDoc) {}
 
   // IUnknown
   DECL_IUNKNOWN_INHERITED
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 };
 
--- a/accessible/src/msaa/nsHTMLWin32ObjectAccessible.cpp
+++ b/accessible/src/msaa/nsHTMLWin32ObjectAccessible.cpp
@@ -43,19 +43,19 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLWin32ObjectOwnerAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLWin32ObjectOwnerAccessible::
-  nsHTMLWin32ObjectOwnerAccessible(nsIContent *aContent,
-                                   nsIWeakReference *aShell, void *aHwnd) :
-  nsAccessibleWrap(aContent, aShell), mHwnd(aHwnd)
+  nsHTMLWin32ObjectOwnerAccessible(nsIContent* aContent,
+                                   nsDocAccessible* aDoc, void* aHwnd) :
+  nsAccessibleWrap(aContent, aDoc), mHwnd(aHwnd)
 {
   // Our only child is a nsHTMLWin32ObjectAccessible object.
   mNativeAccessible = new nsHTMLWin32ObjectAccessible(mHwnd);
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLWin32ObjectOwnerAccessible: nsAccessNode implementation
 
--- a/accessible/src/msaa/nsHTMLWin32ObjectAccessible.h
+++ b/accessible/src/msaa/nsHTMLWin32ObjectAccessible.h
@@ -48,18 +48,18 @@ class nsHTMLWin32ObjectOwnerAccessible :
 {
 public:
   // This will own the nsHTMLWin32ObjectAccessible. We create this where the
   // <object> or <embed> exists in the tree, so that get_accNextSibling() etc.
   // will still point to Gecko accessible sibling content. This is necessary
   // because the native plugin accessible doesn't know where it exists in the
   // Mozilla tree, and returns null for previous and next sibling. This would
   // have the effect of cutting off all content after the plugin.
-  nsHTMLWin32ObjectOwnerAccessible(nsIContent *aContent,
-                                   nsIWeakReference *aShell, void *aHwnd);
+  nsHTMLWin32ObjectOwnerAccessible(nsIContent* aContent,
+                                   nsDocAccessible* aDoc, void* aHwnd);
   virtual ~nsHTMLWin32ObjectOwnerAccessible() {}
 
   // nsAccessNode
   virtual void Shutdown();
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
--- a/accessible/src/msaa/nsHyperTextAccessibleWrap.h
+++ b/accessible/src/msaa/nsHyperTextAccessibleWrap.h
@@ -46,18 +46,18 @@
 #include "CAccessibleEditableText.h"
 #include "CAccessibleHyperText.h"
 
 class nsHyperTextAccessibleWrap : public nsHyperTextAccessible,
                                   public CAccessibleHypertext,
                                   public CAccessibleEditableText
 {
 public:
-  nsHyperTextAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell) :
-    nsHyperTextAccessible(aContent, aShell) {}
+  nsHyperTextAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
+    nsHyperTextAccessible(aContent, aDoc) {}
 
   // IUnknown
   DECL_IUNKNOWN_INHERITED
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsAccessible
--- a/accessible/src/msaa/nsRootAccessibleWrap.cpp
+++ b/accessible/src/msaa/nsRootAccessibleWrap.cpp
@@ -46,18 +46,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // Constructor/desctructor
 
 nsRootAccessibleWrap::
   nsRootAccessibleWrap(nsIDocument* aDocument, nsIContent* aRootContent,
-                       nsIWeakReference* aShell) :
-  nsRootAccessible(aDocument, aRootContent, aShell)
+                       nsIPresShell* aPresShell) :
+  nsRootAccessible(aDocument, aRootContent, aPresShell)
 {
 }
 
 nsRootAccessibleWrap::~nsRootAccessibleWrap()
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
--- a/accessible/src/msaa/nsRootAccessibleWrap.h
+++ b/accessible/src/msaa/nsRootAccessibleWrap.h
@@ -41,16 +41,16 @@
 #define _nsRootAccessibleWrap_H_
 
 #include "nsRootAccessible.h"
 
 class nsRootAccessibleWrap : public nsRootAccessible
 {
 public:
   nsRootAccessibleWrap(nsIDocument* aDocument, nsIContent* aRootContent,
-                       nsIWeakReference* aShell);
+                       nsIPresShell* aPresShell);
   virtual ~nsRootAccessibleWrap();
 
   // nsRootAccessible
   virtual void DocumentActivated(nsDocAccessible* aDocument);
 };
 
 #endif
--- a/accessible/src/msaa/nsTextAccessibleWrap.cpp
+++ b/accessible/src/msaa/nsTextAccessibleWrap.cpp
@@ -51,18 +51,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsTextAccessibleWrap Accessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsTextAccessibleWrap::
-  nsTextAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsTextAccessible(aContent, aShell)
+  nsTextAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsTextAccessible(aContent, aDoc)
 {
 }
 
 STDMETHODIMP_(ULONG) nsTextAccessibleWrap::AddRef()
 {
   return nsAccessNode::AddRef();
 }
 
@@ -124,17 +124,17 @@ STDMETHODIMP nsTextAccessibleWrap::get_c
 __try {
   *aX = *aY = *aWidth = *aHeight = 0;
   nscoord x, y, width, height, docX, docY, docWidth, docHeight;
   HRESULT rv = get_unclippedSubstringBounds(aStartIndex, aEndIndex, &x, &y, &width, &height);
   if (FAILED(rv)) {
     return rv;
   }
 
-  nsDocAccessible *docAccessible = GetDocAccessible();
+  nsDocAccessible* docAccessible = Document();
   NS_ASSERTION(docAccessible,
                "There must always be a doc accessible, but there isn't. Crash!");
 
   docAccessible->GetBounds(&docX, &docY, &docWidth, &docHeight);
 
   nsIntRect unclippedRect(x, y, width, height);
   nsIntRect docRect(docX, docY, docWidth, docHeight);
   nsIntRect clippedRect;
--- a/accessible/src/msaa/nsTextAccessibleWrap.h
+++ b/accessible/src/msaa/nsTextAccessibleWrap.h
@@ -45,17 +45,17 @@
 
 class nsIFrame;
 class nsRenderingContext;
 
 class nsTextAccessibleWrap : public nsTextAccessible, 
                              public ISimpleDOMText
 {
 public:
-  nsTextAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell);
+  nsTextAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc);
   virtual ~nsTextAccessibleWrap() {}
 
     // IUnknown methods - see iunknown.h for documentation
     STDMETHODIMP_(ULONG) AddRef();
     STDMETHODIMP_(ULONG) Release();
     STDMETHODIMP QueryInterface(REFIID, void**);
 
     virtual /* [propget] */ HRESULT STDMETHODCALLTYPE get_domText( 
--- a/accessible/src/msaa/nsXULListboxAccessibleWrap.cpp
+++ b/accessible/src/msaa/nsXULListboxAccessibleWrap.cpp
@@ -38,18 +38,18 @@
 
 #include "nsXULListboxAccessibleWrap.h"
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULListboxAccessibleWrap
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULListboxAccessibleWrap::
-  nsXULListboxAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsXULListboxAccessible(aContent, aShell)
+  nsXULListboxAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsXULListboxAccessible(aContent, aDoc)
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsXULListboxAccessibleWrap,
                              nsXULListboxAccessible)
 
 IMPL_IUNKNOWN_QUERY_HEAD(nsXULListboxAccessibleWrap)
 IMPL_IUNKNOWN_QUERY_ENTRY_COND(CAccessibleTable, IsMulticolumn());
@@ -57,18 +57,18 @@ IMPL_IUNKNOWN_QUERY_ENTRY(nsAccessibleWr
 IMPL_IUNKNOWN_QUERY_TAIL
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULListCellAccessibleWrap
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULListCellAccessibleWrap::
-  nsXULListCellAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsXULListCellAccessible(aContent, aShell)
+  nsXULListCellAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsXULListCellAccessible(aContent, aDoc)
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsXULListCellAccessibleWrap,
                              nsXULListCellAccessible)
 
 IMPL_IUNKNOWN_INHERITED1(nsXULListCellAccessibleWrap,
                          nsHyperTextAccessibleWrap,
--- a/accessible/src/msaa/nsXULListboxAccessibleWrap.h
+++ b/accessible/src/msaa/nsXULListboxAccessibleWrap.h
@@ -47,34 +47,34 @@
 /**
  * IA2 wrapper class for nsXULListboxAccessible class implementing
  * IAccessibleTable and IAccessibleTable2 interfaces.
  */
 class nsXULListboxAccessibleWrap : public nsXULListboxAccessible,
                                    public CAccessibleTable
 {
 public:
-  nsXULListboxAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULListboxAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // IUnknown
   DECL_IUNKNOWN_INHERITED
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 };
 
 /**
  * IA2 wrapper class for nsXULListCellAccessible class, implements
  * IAccessibleTableCell interface.
  */
 class nsXULListCellAccessibleWrap : public nsXULListCellAccessible,
                                     public CAccessibleTableCell
 {
 public:
-  nsXULListCellAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULListCellAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // IUnknown
   DECL_IUNKNOWN_INHERITED
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 };
 
--- a/accessible/src/msaa/nsXULMenuAccessibleWrap.cpp
+++ b/accessible/src/msaa/nsXULMenuAccessibleWrap.cpp
@@ -38,18 +38,18 @@
 #include "nsXULMenuAccessibleWrap.h"
 #include "nsINameSpaceManager.h"
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULMenuAccessibleWrap
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULMenuitemAccessibleWrap::
-  nsXULMenuitemAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsXULMenuitemAccessible(aContent, aShell)
+  nsXULMenuitemAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsXULMenuitemAccessible(aContent, aDoc)
 {
 }
 
 NS_IMETHODIMP
 nsXULMenuitemAccessibleWrap::GetName(nsAString& aName)
 {
   // XXX This should be done in get_accName() so that nsIAccessible::GetName()]
   // provides the same results on all platforms
--- a/accessible/src/msaa/nsXULMenuAccessibleWrap.h
+++ b/accessible/src/msaa/nsXULMenuAccessibleWrap.h
@@ -38,16 +38,16 @@
 #ifndef __nsXULMenuAccessibleWrap_h__
 #define __nsXULMenuAccessibleWrap_h__
 
 #include "nsXULMenuAccessible.h"
 
 class nsXULMenuitemAccessibleWrap : public nsXULMenuitemAccessible
 {
 public:
-  nsXULMenuitemAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULMenuitemAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc);
   virtual ~nsXULMenuitemAccessibleWrap() {}
 
   // nsIAccessible
   NS_IMETHOD GetName(nsAString& aName);
 };
 
 #endif
--- a/accessible/src/msaa/nsXULTreeGridAccessibleWrap.cpp
+++ b/accessible/src/msaa/nsXULTreeGridAccessibleWrap.cpp
@@ -39,41 +39,41 @@
 
 #include "nsXULTreeGridAccessibleWrap.h"
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeGridAccessibleWrap
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULTreeGridAccessibleWrap::
-  nsXULTreeGridAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsXULTreeGridAccessible(aContent, aShell)
+  nsXULTreeGridAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsXULTreeGridAccessible(aContent, aDoc)
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsXULTreeGridAccessibleWrap,
                              nsXULTreeGridAccessible)
 
 IMPL_IUNKNOWN_INHERITED1(nsXULTreeGridAccessibleWrap,
                          nsAccessibleWrap,
                          CAccessibleTable)
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeGridCellAccessibleWrap
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULTreeGridCellAccessibleWrap::
-  nsXULTreeGridCellAccessibleWrap(nsIContent *aContent,
-                                  nsIWeakReference *aShell,
-                                  nsXULTreeGridRowAccessible *aRowAcc,
-                                  nsITreeBoxObject *aTree,
-                                  nsITreeView *aTreeView,
+  nsXULTreeGridCellAccessibleWrap(nsIContent* aContent,
+                                  nsDocAccessible* aDoc,
+                                  nsXULTreeGridRowAccessible* aRowAcc,
+                                  nsITreeBoxObject* aTree,
+                                  nsITreeView* aTreeView,
                                   PRInt32 aRow, nsITreeColumn* aColumn) :
-  nsXULTreeGridCellAccessible(aContent, aShell, aRowAcc, aTree, aTreeView,
+  nsXULTreeGridCellAccessible(aContent, aDoc, aRowAcc, aTree, aTreeView,
                               aRow, aColumn)
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsXULTreeGridCellAccessibleWrap,
                              nsXULTreeGridCellAccessible)
 
 IMPL_IUNKNOWN_INHERITED1(nsXULTreeGridCellAccessibleWrap,
--- a/accessible/src/msaa/nsXULTreeGridAccessibleWrap.h
+++ b/accessible/src/msaa/nsXULTreeGridAccessibleWrap.h
@@ -48,38 +48,38 @@
 /**
  * IA2 wrapper class for nsXULTreeGridAccessible class implementing
  * IAccessibleTable and IAccessibleTable2 interfaces.
  */
 class nsXULTreeGridAccessibleWrap : public nsXULTreeGridAccessible,
                                     public CAccessibleTable
 {
 public:
-  nsXULTreeGridAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULTreeGridAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // IUnknown
   DECL_IUNKNOWN_INHERITED
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 };
 
 /**
  * IA2 wrapper class for nsXULTreeGridCellAccessible class, implements
  * IAccessibleTableCell interface.
  */
 class nsXULTreeGridCellAccessibleWrap : public nsXULTreeGridCellAccessible,
                                         public CAccessibleTableCell
 {
 public:
-  nsXULTreeGridCellAccessibleWrap(nsIContent *aContent,
-                                  nsIWeakReference *aShell,
-                                  nsXULTreeGridRowAccessible *aRowAcc,
-                                  nsITreeBoxObject *aTree,
-                                  nsITreeView *aTreeView,
+  nsXULTreeGridCellAccessibleWrap(nsIContent* aContent,
+                                  nsDocAccessible* aDoc,
+                                  nsXULTreeGridRowAccessible* aRowAcc,
+                                  nsITreeBoxObject* aTree,
+                                  nsITreeView* aTreeView,
                                   PRInt32 aRow, nsITreeColumn* aColumn);
 
   // IUnknown
   DECL_IUNKNOWN_INHERITED
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 };
--- a/accessible/src/other/nsAccessNodeWrap.cpp
+++ b/accessible/src/other/nsAccessNodeWrap.cpp
@@ -47,18 +47,18 @@
 // Class nsAccessNodeWrap
 ////////////////////////////////////////////////////////////////////////////////
 
 //-----------------------------------------------------
 // construction 
 //-----------------------------------------------------
 
 nsAccessNodeWrap::
-  nsAccessNodeWrap(nsIContent *aContent, nsIWeakReference* aShell) :
-  nsAccessNode(aContent, aShell)
+  nsAccessNodeWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsAccessNode(aContent, aDoc)
 {
 }
 
 //-----------------------------------------------------
 // destruction
 //-----------------------------------------------------
 nsAccessNodeWrap::~nsAccessNodeWrap()
 {
--- a/accessible/src/other/nsAccessNodeWrap.h
+++ b/accessible/src/other/nsAccessNodeWrap.h
@@ -43,17 +43,17 @@
 #ifndef _nsAccessNodeWrap_H_
 #define _nsAccessNodeWrap_H_
 
 #include "nsAccessNode.h"
 
 class nsAccessNodeWrap :  public nsAccessNode
 {
 public: // construction, destruction
-  nsAccessNodeWrap(nsIContent *aContent, nsIWeakReference* aShell);
+  nsAccessNodeWrap(nsIContent* aContent, nsDocAccessible* aDoc);
   virtual ~nsAccessNodeWrap();
 
     static void InitAccessibility();
     static void ShutdownAccessibility();
 };
 
 #endif
 
--- a/accessible/src/other/nsAccessibleWrap.cpp
+++ b/accessible/src/other/nsAccessibleWrap.cpp
@@ -37,18 +37,18 @@
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsAccessibleWrap.h"
 
 //-----------------------------------------------------
 // construction 
 //-----------------------------------------------------
 nsAccessibleWrap::
-  nsAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsAccessible(aContent, aShell)
+  nsAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsAccessible(aContent, aDoc)
 {
 }
 
 //-----------------------------------------------------
 // destruction
 //-----------------------------------------------------
 nsAccessibleWrap::~nsAccessibleWrap()
 {
--- a/accessible/src/other/nsAccessibleWrap.h
+++ b/accessible/src/other/nsAccessibleWrap.h
@@ -44,17 +44,17 @@
 #define _nsAccessibleWrap_H_
 
 #include "nsCOMPtr.h"
 #include "nsAccessible.h"
 
 class nsAccessibleWrap : public nsAccessible
 {
 public: // construction, destruction
-  nsAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell);
+  nsAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc);
   virtual ~nsAccessibleWrap();
 
   protected:
     virtual nsresult FirePlatformEvent(AccEvent* aEvent)
     {
       return NS_OK;
     }
 };
--- a/accessible/src/other/nsRootAccessibleWrap.cpp
+++ b/accessible/src/other/nsRootAccessibleWrap.cpp
@@ -41,18 +41,18 @@
 #include "nsIServiceManager.h"
 #include "nsIAccessibilityService.h"
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsRootAccessibleWrap
 ////////////////////////////////////////////////////////////////////////////////
 
 nsRootAccessibleWrap::
-  nsRootAccessibleWrap(nsIDocument *aDocument, nsIContent *aRootContent,
-                       nsIWeakReference *aShell) :
-  nsRootAccessible(aDocument, aRootContent, aShell)
+  nsRootAccessibleWrap(nsIDocument* aDocument, nsIContent* aRootContent,
+                       nsIPresShell* aPresShell) :
+  nsRootAccessible(aDocument, aRootContent, aPresShell)
 {
 }
 
 nsRootAccessibleWrap::~nsRootAccessibleWrap()
 {
 }
 
--- a/accessible/src/other/nsRootAccessibleWrap.h
+++ b/accessible/src/other/nsRootAccessibleWrap.h
@@ -43,15 +43,15 @@
 #ifndef _nsRootAccessibleWrap_H_
 #define _nsRootAccessibleWrap_H_
 
 #include "nsRootAccessible.h"
 
 class nsRootAccessibleWrap: public nsRootAccessible
 {
 public:
-  nsRootAccessibleWrap(nsIDocument *aDocument, nsIContent *aRootContent,
-                       nsIWeakReference *aShell);
+  nsRootAccessibleWrap(nsIDocument* aDocument, nsIContent* aRootContent,
+                       nsIPresShell* aPresShell);
   virtual ~nsRootAccessibleWrap();
 };
 
 
 #endif
--- a/accessible/src/xforms/nsXFormsAccessible.cpp
+++ b/accessible/src/xforms/nsXFormsAccessible.cpp
@@ -35,16 +35,17 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsXFormsAccessible.h"
 
 #include "nsAccessibilityService.h"
 #include "nsAccUtils.h"
+#include "nsDocAccessible.h"
 #include "nsTextEquivUtils.h"
 #include "Role.h"
 #include "States.h"
 #include "Statistics.h"
 
 #include "nscore.h"
 #include "nsServiceManagerUtils.h"
 #include "nsIDOMElement.h"
@@ -74,18 +75,18 @@ nsXFormsAccessibleBase::nsXFormsAccessib
   statistics::XFormsAccessibleUsed();
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsAccessible::
-nsXFormsAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsHyperTextAccessibleWrap(aContent, aShell)
+  nsXFormsAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsHyperTextAccessibleWrap(aContent, aDoc)
 {
 }
 
 nsresult
 nsXFormsAccessible::GetBoundChildElementValue(const nsAString& aTagName,
                                               nsAString& aValue)
 {
   NS_ENSURE_TRUE(sXFormsService, NS_ERROR_FAILURE);
@@ -120,30 +121,28 @@ nsXFormsAccessible::CacheSelectChildren(
     container = do_QueryInterface(mContent);
 
   nsCOMPtr<nsIDOMNodeList> children;
   sXFormsService->GetSelectChildrenFor(container, getter_AddRefs(children));
 
   if (!children)
     return;
 
-  nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
-
   PRUint32 length = 0;
   children->GetLength(&length);
 
   for (PRUint32 index = 0; index < length; index++) {
     nsCOMPtr<nsIDOMNode> DOMChild;
     children->Item(index, getter_AddRefs(DOMChild));
     if (!DOMChild)
       continue;
 
     nsCOMPtr<nsIContent> child(do_QueryInterface(DOMChild));
     nsAccessible* accessible =
-      GetAccService()->GetOrCreateAccessible(child, presShell, mWeakShell);
+      GetAccService()->GetOrCreateAccessible(child, mDoc);
     if (!accessible)
       continue;
 
     AppendChild(accessible);
   }
 }
 
 // nsIAccessible
@@ -221,18 +220,18 @@ nsXFormsAccessible::CanHaveAnonChildren(
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsContainerAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsContainerAccessible::
-  nsXFormsContainerAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsXFormsAccessible(aContent, aShell)
+  nsXFormsContainerAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsXFormsAccessible(aContent, aDoc)
 {
 }
 
 role
 nsXFormsContainerAccessible::NativeRole()
 {
   return roles::GROUPING;
 }
@@ -244,18 +243,18 @@ nsXFormsContainerAccessible::CanHaveAnon
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsEditableAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsEditableAccessible::
-  nsXFormsEditableAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsXFormsAccessible(aContent, aShell)
+  nsXFormsEditableAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsXFormsAccessible(aContent, aDoc)
 {
 }
 
 PRUint64
 nsXFormsEditableAccessible::NativeState()
 {
   PRUint64 state = nsXFormsAccessible::NativeState();
 
@@ -294,18 +293,18 @@ nsXFormsEditableAccessible::GetAssociate
   return sXFormsService->GetEditor(DOMNode, aEditor);
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsSelectableAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsSelectableAccessible::
-  nsXFormsSelectableAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsXFormsEditableAccessible(aContent, aShell), mIsSelect1Element(nsnull)
+  nsXFormsSelectableAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsXFormsEditableAccessible(aContent, aDoc), mIsSelect1Element(nsnull)
 {
   mIsSelect1Element =
     mContent->NodeInfo()->Equals(nsGkAtoms::select1);
 }
 
 bool
 nsXFormsSelectableAccessible::IsSelect()
 {
@@ -322,47 +321,46 @@ nsXFormsSelectableAccessible::SelectedIt
 
   nsresult rv;
   nsCOMPtr<nsIDOMNode> DOMNode(do_QueryInterface(mContent));
 
   if (mIsSelect1Element) {
     nsCOMPtr<nsIDOMNode> itemDOMNode;
     rv = sXFormsService->GetSelectedItemForSelect1(DOMNode,
                                                    getter_AddRefs(itemDOMNode));
-    if (NS_FAILED(rv) || !itemDOMNode)
+    if (NS_FAILED(rv) || !itemDOMNode || !mDoc)
       return nsnull;
 
     nsCOMPtr<nsINode> itemNode(do_QueryInterface(itemDOMNode));
-    nsIAccessible* item = GetAccService()->GetAccessibleInWeakShell(itemNode,
-                                                                    mWeakShell);
+    nsIAccessible* item = mDoc->GetAccessible(itemNode);
     if (item)
       selectedItems->AppendElement(item, false);
 
     nsIMutableArray* items = nsnull;
     selectedItems.forget(&items);
     return items;
   }
 
   nsCOMPtr<nsIDOMNodeList> itemNodeList;
   rv = sXFormsService->GetSelectedItemsForSelect(DOMNode,
                                                  getter_AddRefs(itemNodeList));
-  if (NS_FAILED(rv) || !itemNodeList)
+  if (NS_FAILED(rv) || !itemNodeList || !mDoc)
     return nsnull;
 
   PRUint32 length = 0;
   itemNodeList->GetLength(&length);
+
   for (PRUint32 index = 0; index < length; index++) {
     nsCOMPtr<nsIDOMNode> itemDOMNode;
     itemNodeList->Item(index, getter_AddRefs(itemDOMNode));
     if (!itemDOMNode)
       return nsnull;
 
     nsCOMPtr<nsINode> itemNode(do_QueryInterface(itemDOMNode));
-    nsIAccessible* item = GetAccService()->GetAccessibleInWeakShell(itemNode,
-                                                                    mWeakShell);
+    nsIAccessible* item = mDoc->GetAccessible(itemNode);
     if (item)
       selectedItems->AppendElement(item, false);
   }
 
   nsIMutableArray* items = nsnull;
   selectedItems.forget(&items);
   return items;
 }
@@ -427,43 +425,46 @@ nsXFormsSelectableAccessible::RemoveItem
 
   sXFormsService->RemoveItemFromSelectionForSelect(DOMNode, itemDOMNode);
   return true;
 }
 
 nsAccessible*
 nsXFormsSelectableAccessible::GetSelectedItem(PRUint32 aIndex)
 {
+  if (!mDoc)
+    return nsnull;
+
   nsresult rv;
   nsCOMPtr<nsIDOMNode> DOMNode(do_QueryInterface(mContent));
   if (mIsSelect1Element) {
     if (aIndex != 0)
       return nsnull;
 
     nsCOMPtr<nsIDOMNode> itemDOMNode;
     rv = sXFormsService->GetSelectedItemForSelect1(DOMNode,
                                                    getter_AddRefs(itemDOMNode));
     if (NS_SUCCEEDED(rv) && itemDOMNode) {
       nsCOMPtr<nsINode> itemNode(do_QueryInterface(itemDOMNode));
-      return GetAccService()->GetAccessibleInWeakShell(itemNode, mWeakShell);
+      return mDoc->GetAccessible(itemNode);
     }
     return nsnull;
   }
 
   nsCOMPtr<nsIDOMNodeList> itemNodeList;
   rv = sXFormsService->GetSelectedItemsForSelect(DOMNode,
                                                  getter_AddRefs(itemNodeList));
   if (NS_FAILED(rv) || !itemNodeList)
     return nsnull;
 
   nsCOMPtr<nsIDOMNode> itemDOMNode;
   itemNodeList->Item(aIndex, getter_AddRefs(itemDOMNode));
 
   nsCOMPtr<nsINode> itemNode(do_QueryInterface(itemDOMNode));
-  return GetAccService()->GetAccessibleInWeakShell(itemNode, mWeakShell);
+  return mDoc->GetAccessible(itemNode);
 }
 
 bool
 nsXFormsSelectableAccessible::IsItemSelected(PRUint32 aIndex)
 {
   nsCOMPtr<nsIDOMNode> itemDOMNode(do_QueryInterface(GetItemByIndex(&aIndex)));
   if (!itemDOMNode)
     return false;
@@ -531,19 +532,19 @@ nsXFormsSelectableAccessible::GetItemByI
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsSelectableItemAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsSelectableItemAccessible::
-  nsXFormsSelectableItemAccessible(nsIContent *aContent,
-                                   nsIWeakReference *aShell) :
-  nsXFormsAccessible(aContent, aShell)
+  nsXFormsSelectableItemAccessible(nsIContent* aContent,
+                                   nsDocAccessible* aDoc) :
+  nsXFormsAccessible(aContent, aDoc)
 {
 }
 
 NS_IMETHODIMP
 nsXFormsSelectableItemAccessible::GetValue(nsAString& aValue)
 {
   nsCOMPtr<nsIDOMNode> DOMNode(do_QueryInterface(mContent));
   return sXFormsService->GetValue(DOMNode, aValue);
--- a/accessible/src/xforms/nsXFormsAccessible.h
+++ b/accessible/src/xforms/nsXFormsAccessible.h
@@ -65,17 +65,17 @@ protected:
  * Every XForms element that is bindable to XForms model or is able to contain
  * XForms hint and XForms label elements should have accessible object. This
  * class is base class for accessible objects for these XForms elements.
  */
 class nsXFormsAccessible : public nsHyperTextAccessibleWrap,
                            public nsXFormsAccessibleBase
 {
 public:
-  nsXFormsAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXFormsAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsIAccessible
 
   // Returns value of instance node that xforms element is bound to.
   NS_IMETHOD GetValue(nsAString& aValue);
 
   // nsAccessible
   // Returns value of child xforms 'hint' element.
@@ -119,17 +119,17 @@ protected:
  * to choose month. It has an entryfield, a drop-down button and a drop-down
  * list, all of which need to be accessible. Another example would be
  * an XForms upload element since it is constructed from textfield and
  * 'pick up file' and 'clear file' buttons.
  */
 class nsXFormsContainerAccessible : public nsXFormsAccessible
 {
 public:
-  nsXFormsContainerAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXFormsContainerAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
 
   // Allows accessible nodes in anonymous content of xforms element by
   // always returning true value.
   virtual bool CanHaveAnonChildren();
 };
@@ -137,34 +137,34 @@ public:
 
 /**
  * The class is base for accessible objects for XForms elements that have
  * editable area.
  */
 class nsXFormsEditableAccessible : public nsXFormsAccessible
 {
 public:
-  nsXFormsEditableAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXFormsEditableAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsIAccessibleEditableText
   NS_IMETHOD GetAssociatedEditor(nsIEditor **aEditor);
 
   // nsAccessible
   virtual PRUint64 NativeState();
 };
 
 
 /**
  * The class is base for accessible objects for XForms select and XForms
  * select1 elements.
  */
 class nsXFormsSelectableAccessible : public nsXFormsEditableAccessible
 {
 public:
-  nsXFormsSelectableAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXFormsSelectableAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // SelectAccessible
   virtual bool IsSelect();
   virtual already_AddRefed<nsIArray> SelectedItems();
   virtual PRUint32 SelectedItemCount();
   virtual nsAccessible* GetSelectedItem(PRUint32 aIndex);
   virtual bool IsItemSelected(PRUint32 aIndex);
   virtual bool AddItemToSelection(PRUint32 aIndex);
@@ -181,18 +181,18 @@ protected:
 
 
 /**
  * The class is base for accessible objects for XForms item elements.
  */
 class nsXFormsSelectableItemAccessible : public nsXFormsAccessible
 {
 public:
-  nsXFormsSelectableItemAccessible(nsIContent *aContent,
-                                   nsIWeakReference *aShell);
+  nsXFormsSelectableItemAccessible(nsIContent* aContent,
+                                   nsDocAccessible* aDoc);
 
   NS_IMETHOD GetValue(nsAString& aValue);
   NS_IMETHOD DoAction(PRUint8 aIndex);
 
   // ActionAccessible
   virtual PRUint8 ActionCount();
 
 protected:
--- a/accessible/src/xforms/nsXFormsFormControlsAccessible.cpp
+++ b/accessible/src/xforms/nsXFormsFormControlsAccessible.cpp
@@ -44,18 +44,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsLabelAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsLabelAccessible::
-  nsXFormsLabelAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsXFormsAccessible(aContent, aShell)
+  nsXFormsLabelAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsXFormsAccessible(aContent, aDoc)
 {
 }
 
 role
 nsXFormsLabelAccessible::NativeRole()
 {
   return roles::LABEL;
 }
@@ -76,35 +76,35 @@ nsXFormsLabelAccessible::Description(nsS
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsOutputAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsOutputAccessible::
-  nsXFormsOutputAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsXFormsAccessible(aContent, aShell)
+  nsXFormsOutputAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsXFormsAccessible(aContent, aDoc)
 {
 }
 
 role
 nsXFormsOutputAccessible::NativeRole()
 {
   return roles::STATICTEXT;
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsTriggerAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsTriggerAccessible::
-  nsXFormsTriggerAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsXFormsAccessible(aContent, aShell)
+  nsXFormsTriggerAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsXFormsAccessible(aContent, aDoc)
 {
 }
 
 role
 nsXFormsTriggerAccessible::NativeRole()
 {
   return roles::PUSHBUTTON;
 }
@@ -143,18 +143,18 @@ nsXFormsTriggerAccessible::DoAction(PRUi
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsInputAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsInputAccessible::
-  nsXFormsInputAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsXFormsEditableAccessible(aContent, aShell)
+  nsXFormsInputAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsXFormsEditableAccessible(aContent, aDoc)
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED3(nsXFormsInputAccessible, nsAccessible, nsHyperTextAccessible, nsIAccessibleText, nsIAccessibleEditableText)
 
 role
 nsXFormsInputAccessible::NativeRole()
 {
@@ -188,18 +188,18 @@ nsXFormsInputAccessible::DoAction(PRUint
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsInputBooleanAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsInputBooleanAccessible::
-  nsXFormsInputBooleanAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsXFormsAccessible(aContent, aShell)
+  nsXFormsInputBooleanAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsXFormsAccessible(aContent, aDoc)
 {
 }
 
 role
 nsXFormsInputBooleanAccessible::NativeRole()
 {
   return roles::CHECKBUTTON;
 }
@@ -256,35 +256,35 @@ nsXFormsInputBooleanAccessible::DoAction
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsInputDateAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsInputDateAccessible::
-  nsXFormsInputDateAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsXFormsContainerAccessible(aContent, aShell)
+  nsXFormsInputDateAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsXFormsContainerAccessible(aContent, aDoc)
 {
 }
 
 role
 nsXFormsInputDateAccessible::NativeRole()
 {
   return roles::DROPLIST;
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsSecretAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsSecretAccessible::
-  nsXFormsSecretAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsXFormsInputAccessible(aContent, aShell)
+  nsXFormsSecretAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsXFormsInputAccessible(aContent, aDoc)
 {
 }
 
 role
 nsXFormsSecretAccessible::NativeRole()
 {
   return roles::PASSWORD_TEXT;
 }
@@ -302,18 +302,18 @@ nsXFormsSecretAccessible::GetValue(nsASt
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsRangeAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsRangeAccessible::
-  nsXFormsRangeAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsXFormsAccessible(aContent, aShell)
+  nsXFormsRangeAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsXFormsAccessible(aContent, aDoc)
 {
 }
 
 role
 nsXFormsRangeAccessible::NativeRole()
 {
   return roles::SLIDER;
 }
@@ -395,18 +395,18 @@ nsXFormsRangeAccessible::GetCurrentValue
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsSelectAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsSelectAccessible::
-  nsXFormsSelectAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsXFormsContainerAccessible(aContent, aShell)
+  nsXFormsSelectAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsXFormsContainerAccessible(aContent, aDoc)
 {
 }
 
 PRUint64
 nsXFormsSelectAccessible::NativeState()
 {
   PRUint64 state = nsXFormsContainerAccessible::NativeState();
 
@@ -422,18 +422,18 @@ nsXFormsSelectAccessible::NativeState()
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsChoicesAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsChoicesAccessible::
-  nsXFormsChoicesAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsXFormsAccessible(aContent, aShell)
+  nsXFormsChoicesAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsXFormsAccessible(aContent, aDoc)
 {
 }
 
 role
 nsXFormsChoicesAccessible::NativeRole()
 {
   return roles::GROUPING;
 }
@@ -452,18 +452,18 @@ nsXFormsChoicesAccessible::CacheChildren
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsSelectFullAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsSelectFullAccessible::
-  nsXFormsSelectFullAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsXFormsSelectableAccessible(aContent, aShell)
+  nsXFormsSelectFullAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsXFormsSelectableAccessible(aContent, aDoc)
 {
 }
 
 role
 nsXFormsSelectFullAccessible::NativeRole()
 {
   return roles::GROUPING;
 }
@@ -475,18 +475,18 @@ nsXFormsSelectFullAccessible::CacheChild
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsItemCheckgroupAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsItemCheckgroupAccessible::
-  nsXFormsItemCheckgroupAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsXFormsSelectableItemAccessible(aContent, aShell)
+  nsXFormsItemCheckgroupAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsXFormsSelectableItemAccessible(aContent, aDoc)
 {
 }
 
 role
 nsXFormsItemCheckgroupAccessible::NativeRole()
 {
   return roles::CHECKBUTTON;
 }
@@ -517,18 +517,18 @@ nsXFormsItemCheckgroupAccessible::GetAct
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsItemRadiogroupAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsItemRadiogroupAccessible::
-  nsXFormsItemRadiogroupAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsXFormsSelectableItemAccessible(aContent, aShell)
+  nsXFormsItemRadiogroupAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsXFormsSelectableItemAccessible(aContent, aDoc)
 {
 }
 
 role
 nsXFormsItemRadiogroupAccessible::NativeRole()
 {
   return roles::RADIOBUTTON;
 }
@@ -555,18 +555,18 @@ nsXFormsItemRadiogroupAccessible::GetAct
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsSelectComboboxAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsSelectComboboxAccessible::
-  nsXFormsSelectComboboxAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsXFormsSelectableAccessible(aContent, aShell)
+  nsXFormsSelectComboboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsXFormsSelectableAccessible(aContent, aDoc)
 {
 }
 
 role
 nsXFormsSelectComboboxAccessible::NativeRole()
 {
   return roles::COMBOBOX;
 }
@@ -596,18 +596,18 @@ nsXFormsSelectComboboxAccessible::CanHav
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsItemComboboxAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsItemComboboxAccessible::
-  nsXFormsItemComboboxAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsXFormsSelectableItemAccessible(aContent, aShell)
+  nsXFormsItemComboboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsXFormsSelectableItemAccessible(aContent, aDoc)
 {
 }
 
 role
 nsXFormsItemComboboxAccessible::NativeRole()
 {
   return roles::LISTITEM;
 }
--- a/accessible/src/xforms/nsXFormsFormControlsAccessible.h
+++ b/accessible/src/xforms/nsXFormsFormControlsAccessible.h
@@ -43,45 +43,45 @@
 
 /**
  * Accessible object for xforms:label.
  */
 
 class nsXFormsLabelAccessible : public nsXFormsAccessible
 {
 public:
-  nsXFormsLabelAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXFormsLabelAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsAccessible
   virtual void Description(nsString& aDescription);
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual mozilla::a11y::role NativeRole();
 };
 
 /**
  * Accessible object for xforms:output.
  */
 
 class nsXFormsOutputAccessible : public nsXFormsAccessible
 {
 public:
-  nsXFormsOutputAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXFormsOutputAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
 };
 
 /**
  * Accessible object for xforms:trigger and xforms:submit.
  */
 
 class nsXFormsTriggerAccessible : public nsXFormsAccessible
 {
 public:
-  nsXFormsTriggerAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXFormsTriggerAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsIAccessible
   NS_IMETHOD GetValue(nsAString& aValue);
 
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 aIndex);
 
   // nsAccessible
@@ -93,17 +93,17 @@ public:
 
 /**
  * Accessible object for xforms:input and xforms:textarea.
  */
 
 class nsXFormsInputAccessible : public nsXFormsEditableAccessible
 {
 public:
-  nsXFormsInputAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXFormsInputAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 aIndex);
 
   // nsAccessible
@@ -115,17 +115,17 @@ public:
 
 /**
  * Accessible object for xforms:input[type="xsd:boolean"].
  */
 
 class nsXFormsInputBooleanAccessible : public nsXFormsAccessible
 {
 public:
-  nsXFormsInputBooleanAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXFormsInputBooleanAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 aIndex);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
@@ -136,30 +136,30 @@ public:
 
 /**
  * Accessible object for xforms:input[type="xsd:date"].
  */
 
 class nsXFormsInputDateAccessible : public nsXFormsContainerAccessible
 {
 public:
-  nsXFormsInputDateAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXFormsInputDateAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
 };
 
 /**
  * Accessible object for xforms:secret.
  */
 
 class nsXFormsSecretAccessible : public nsXFormsInputAccessible
 {
 public:
-  nsXFormsSecretAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXFormsSecretAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsIAccessible
   NS_IMETHOD GetValue(nsAString& aValue);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 };
@@ -167,17 +167,17 @@ public:
 
 /**
  * Accessible object for xforms:range.
  */
 
 class nsXFormsRangeAccessible : public nsXFormsAccessible
 {
 public:
-  nsXFormsRangeAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXFormsRangeAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsIAccessibleValue
   NS_IMETHOD GetMaximumValue(double *aMaximumValue);
   NS_IMETHOD GetMinimumValue(double *aMinimumValue);
   NS_IMETHOD GetMinimumIncrement(double *aMinimumIncrement);
   NS_IMETHOD GetCurrentValue(double *aCurrentValue);
 
   // nsAccessible
@@ -189,31 +189,31 @@ public:
 /**
  * Accessible object for xforms:select and xforms:select1 that are implemented
  * using host document's native widget.
  */
 
 class nsXFormsSelectAccessible : public nsXFormsContainerAccessible
 {
 public:
-  nsXFormsSelectAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXFormsSelectAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsAccessible
   virtual PRUint64 NativeState();
 };
 
 
 /**
  * Accessible object for xforms:choices.
  */
 
 class nsXFormsChoicesAccessible : public nsXFormsAccessible
 {
 public:
-  nsXFormsChoicesAccessible(nsIContent* aContent, nsIWeakReference *aShell);
+  nsXFormsChoicesAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsIAccessible
   NS_IMETHOD GetValue(nsAString& aValue);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
 
 protected:
@@ -225,17 +225,17 @@ protected:
 /**
  * Accessible object for xforms:select/xforms:select1 of full appearance that
  * may be represented by group of checkboxes or radiogroup.
  */
 
 class nsXFormsSelectFullAccessible : public nsXFormsSelectableAccessible
 {
 public:
-  nsXFormsSelectFullAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXFormsSelectFullAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
 
 protected:
   // nsAccessible
   virtual void CacheChildren();
 };
@@ -245,18 +245,18 @@ protected:
  * Accessible object for a xforms:item when it is represented by a checkbox.
  * This occurs when the item is contained in a xforms:select with full
  * appearance. Such a xforms:select is represented by a checkgroup.
  */
 
 class nsXFormsItemCheckgroupAccessible : public nsXFormsSelectableItemAccessible
 {
 public:
-  nsXFormsItemCheckgroupAccessible(nsIContent *aContent,
-                                   nsIWeakReference *aShell);
+  nsXFormsItemCheckgroupAccessible(nsIContent* aContent,
+                                   nsDocAccessible* aDoc);
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 };
@@ -266,18 +266,18 @@ public:
  * Accessible object for a xforms:item when it is represented by a radiobutton.
  * This occurs when the item is contained in a xforms:select1 with full
  * appearance. Such a xforms:select1 is represented as a radiogroup.
  */
 
 class nsXFormsItemRadiogroupAccessible : public nsXFormsSelectableItemAccessible
 {
 public:
-  nsXFormsItemRadiogroupAccessible(nsIContent *aContent,
-                                   nsIWeakReference *aShell);
+  nsXFormsItemRadiogroupAccessible(nsIContent* aContent,
+                                   nsDocAccessible* aDoc);
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 };
@@ -286,18 +286,18 @@ public:
 /**
  * Accessible object for xforms:select1 of minimal appearance that is
  * represented by combobox.
  */
 
 class nsXFormsSelectComboboxAccessible : public nsXFormsSelectableAccessible
 {
 public:
-  nsXFormsSelectComboboxAccessible(nsIContent *aContent,
-                                   nsIWeakReference *aShell);
+  nsXFormsSelectComboboxAccessible(nsIContent* aContent,
+                                   nsDocAccessible* aDoc);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
   virtual bool CanHaveAnonChildren();
 };
 
 
@@ -305,18 +305,18 @@ public:
  * Accessible object for xforms:item element when it is represented by a
  * listitem. This occurs when the item is contained in a xforms:select with
  * minimal appearance. Such a xforms:select is represented by a combobox.
  */
 
 class nsXFormsItemComboboxAccessible : public nsXFormsSelectableItemAccessible
 {
 public:
-  nsXFormsItemComboboxAccessible(nsIContent *aContent,
-                                 nsIWeakReference *aShell);
+  nsXFormsItemComboboxAccessible(nsIContent* aContent,
+                                 nsDocAccessible* aDoc);
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 };
--- a/accessible/src/xforms/nsXFormsWidgetsAccessible.cpp
+++ b/accessible/src/xforms/nsXFormsWidgetsAccessible.cpp
@@ -43,19 +43,19 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsDropmarkerWidgetAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsDropmarkerWidgetAccessible::
-  nsXFormsDropmarkerWidgetAccessible(nsIContent *aContent,
-                                     nsIWeakReference *aShell) :
-  nsLeafAccessible(aContent, aShell)
+  nsXFormsDropmarkerWidgetAccessible(nsIContent* aContent,
+                                     nsDocAccessible* aDoc) :
+  nsLeafAccessible(aContent, aDoc)
 {
 }
 
 role
 nsXFormsDropmarkerWidgetAccessible::NativeRole()
 {
   return roles::PUSHBUTTON;
 }
@@ -108,36 +108,36 @@ nsXFormsDropmarkerWidgetAccessible::DoAc
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsCalendarWidgetAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsCalendarWidgetAccessible::
-nsXFormsCalendarWidgetAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsAccessibleWrap(aContent, aShell)
+  nsXFormsCalendarWidgetAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsAccessibleWrap(aContent, aDoc)
 {
 }
 
 role
 nsXFormsCalendarWidgetAccessible::NativeRole()
 {
   return roles::CALENDAR;
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsComboboxPopupWidgetAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsComboboxPopupWidgetAccessible::
-  nsXFormsComboboxPopupWidgetAccessible(nsIContent *aContent,
-                                        nsIWeakReference *aShell) :
-  nsXFormsAccessible(aContent, aShell)
+  nsXFormsComboboxPopupWidgetAccessible(nsIContent* aContent,
+                                        nsDocAccessible* aDoc) :
+  nsXFormsAccessible(aContent, aDoc)
 {
 }
 
 role
 nsXFormsComboboxPopupWidgetAccessible::NativeRole()
 {
   return roles::LIST;
 }
--- a/accessible/src/xforms/nsXFormsWidgetsAccessible.h
+++ b/accessible/src/xforms/nsXFormsWidgetsAccessible.h
@@ -46,18 +46,18 @@
  * Accessible object for dropmarker widget that is used inside xforms elements
  * of combobox representation. For example, these are xforms:select1,
  * xforms:input[type="xsd:date"].
  */
 class nsXFormsDropmarkerWidgetAccessible : public nsLeafAccessible,
                                            public nsXFormsAccessibleBase
 {
 public:
-  nsXFormsDropmarkerWidgetAccessible(nsIContent *aContent,
-                                     nsIWeakReference *aShell);
+  nsXFormsDropmarkerWidgetAccessible(nsIContent* aContent,
+                                     nsDocAccessible* aDoc);
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 aIndex);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
@@ -68,33 +68,33 @@ public:
 
 
 /**
  * Accessible object for calendar widget. It is used by xforms:input[xsd:date].
  */
 class nsXFormsCalendarWidgetAccessible : public nsAccessibleWrap
 {
 public:
-  nsXFormsCalendarWidgetAccessible(nsIContent *aContent,
-                                   nsIWeakReference *aShell);
+  nsXFormsCalendarWidgetAccessible(nsIContent* aContent,
+                                   nsDocAccessible* aDoc);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
 };
 
 
 /**
  * Accessible object for popup menu of minimal xforms select1 element that is
  * represented by combobox.
  */
 class nsXFormsComboboxPopupWidgetAccessible : public nsXFormsAccessible
 {
 public:
-  nsXFormsComboboxPopupWidgetAccessible(nsIContent *aContent,
-                                        nsIWeakReference *aShell);
+  nsXFormsComboboxPopupWidgetAccessible(nsIContent* aContent,
+                                        nsDocAccessible* aDoc);
 
   // nsIAccessible
   NS_IMETHOD GetValue(nsAString& aValue);
 
   // nsAccessible
   virtual void Description(nsString& aDescription);
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual mozilla::a11y::role NativeRole();
--- a/accessible/src/xul/XULSelectControlAccessible.cpp
+++ b/accessible/src/xul/XULSelectControlAccessible.cpp
@@ -56,18 +56,18 @@
 using namespace mozilla;
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // XULSelectControlAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 XULSelectControlAccessible::
-  XULSelectControlAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsAccessibleWrap(aContent, aShell)
+  XULSelectControlAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsAccessibleWrap(aContent, aDoc)
 {
   mSelectControl = do_QueryInterface(aContent);
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // XULSelectControlAccessible: nsAccessNode
 
 void
@@ -87,47 +87,45 @@ XULSelectControlAccessible::IsSelect()
 }
 
 // Interface methods
 already_AddRefed<nsIArray>
 XULSelectControlAccessible::SelectedItems()
 {
   nsCOMPtr<nsIMutableArray> selectedItems =
     do_CreateInstance(NS_ARRAY_CONTRACTID);
-  if (!selectedItems)
+  if (!selectedItems || !mDoc)
     return nsnull;
 
   // For XUL multi-select control
   nsCOMPtr<nsIDOMXULMultiSelectControlElement> xulMultiSelect =
     do_QueryInterface(mSelectControl);
   if (xulMultiSelect) {
     PRInt32 length = 0;
     xulMultiSelect->GetSelectedCount(&length);
     for (PRInt32 index = 0; index < length; index++) {
       nsCOMPtr<nsIDOMXULSelectControlItemElement> itemElm;
       xulMultiSelect->GetSelectedItem(index, getter_AddRefs(itemElm));
       nsCOMPtr<nsINode> itemNode(do_QueryInterface(itemElm));
-      nsAccessible* item =
-        GetAccService()->GetAccessibleInWeakShell(itemNode, mWeakShell);
+      nsAccessible* item = mDoc->GetAccessible(itemNode);
       if (item)
         selectedItems->AppendElement(static_cast<nsIAccessible*>(item),
                                      false);
     }
   } else {  // Single select?
       nsCOMPtr<nsIDOMXULSelectControlItemElement> itemElm;
       mSelectControl->GetSelectedItem(getter_AddRefs(itemElm));
       nsCOMPtr<nsINode> itemNode(do_QueryInterface(itemElm));
       if(itemNode) {
-        nsAccessible* item =
-          GetAccService()->GetAccessibleInWeakShell(itemNode, mWeakShell);
+        nsAccessible* item = mDoc->GetAccessible(itemNode);
         if (item)
           selectedItems->AppendElement(static_cast<nsIAccessible*>(item),
                                      false);
       }
-    }
+  }
 
   nsIMutableArray* items = nsnull;
   selectedItems.forget(&items);
   return items;
 }
 
 nsAccessible*
 XULSelectControlAccessible::GetSelectedItem(PRUint32 aIndex)
@@ -137,18 +135,17 @@ XULSelectControlAccessible::GetSelectedI
 
   nsCOMPtr<nsIDOMXULSelectControlItemElement> itemElm;
   if (multiSelectControl)
     multiSelectControl->GetSelectedItem(aIndex, getter_AddRefs(itemElm));
   else if (aIndex == 0)
     mSelectControl->GetSelectedItem(getter_AddRefs(itemElm));
 
   nsCOMPtr<nsINode> itemNode(do_QueryInterface(itemElm));
-  return itemNode ?
-    GetAccService()->GetAccessibleInWeakShell(itemNode, mWeakShell) : nsnull;
+  return itemNode && mDoc ? mDoc->GetAccessible(itemNode) : nsnull;
 }
 
 PRUint32
 XULSelectControlAccessible::SelectedItemCount()
 {
   // For XUL multi-select control
   nsCOMPtr<nsIDOMXULMultiSelectControlElement> multiSelectControl =
     do_QueryInterface(mSelectControl);
@@ -279,17 +276,17 @@ XULSelectControlAccessible::CurrentItem(
   else
     mSelectControl->GetSelectedItem(getter_AddRefs(currentItemElm));
 
   nsCOMPtr<nsINode> DOMNode;
   if (currentItemElm)
     DOMNode = do_QueryInterface(currentItemElm);
 
   if (DOMNode) {
-    nsDocAccessible* document = GetDocAccessible();
+    nsDocAccessible* document = Document();
     if (document)
       return document->GetAccessible(DOMNode);
   }
 
   return nsnull;
 }
 
 void
--- a/accessible/src/xul/XULSelectControlAccessible.h
+++ b/accessible/src/xul/XULSelectControlAccessible.h
@@ -44,17 +44,17 @@
 #include "nsIDOMXULSelectCntrlEl.h"
 
 /**
  * The basic implementation of accessible selection for XUL select controls.
  */
 class XULSelectControlAccessible : public nsAccessibleWrap
 {
 public:
-  XULSelectControlAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  XULSelectControlAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
   virtual ~XULSelectControlAccessible() {}
 
   // nsAccessNode
   virtual void Shutdown();
 
   // SelectAccessible
   virtual bool IsSelect();
   virtual already_AddRefed<nsIArray> SelectedItems();
--- a/accessible/src/xul/nsXULAlertAccessible.cpp
+++ b/accessible/src/xul/nsXULAlertAccessible.cpp
@@ -42,18 +42,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULAlertAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULAlertAccessible::
-  nsXULAlertAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsAccessibleWrap(aContent, aShell)
+  nsXULAlertAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsAccessibleWrap(aContent, aDoc)
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsXULAlertAccessible, nsAccessible)
 
 role
 nsXULAlertAccessible::NativeRole()
 {
--- a/accessible/src/xul/nsXULAlertAccessible.h
+++ b/accessible/src/xul/nsXULAlertAccessible.h
@@ -42,17 +42,17 @@
 
 /**
  * Accessible for supporting XUL alerts.
  */
 
 class nsXULAlertAccessible : public nsAccessibleWrap
 {
 public:
-  nsXULAlertAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULAlertAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessible
   NS_IMETHOD GetName(nsAString& aName);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
--- a/accessible/src/xul/nsXULColorPickerAccessible.cpp
+++ b/accessible/src/xul/nsXULColorPickerAccessible.cpp
@@ -50,18 +50,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULColorPickerTileAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULColorPickerTileAccessible::
-  nsXULColorPickerTileAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsAccessibleWrap(aContent, aShell)
+  nsXULColorPickerTileAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsAccessibleWrap(aContent, aDoc)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULColorPickerTileAccessible: nsIAccessible
 
 NS_IMETHODIMP
 nsXULColorPickerTileAccessible::GetValue(nsAString& aValue)
@@ -112,18 +112,18 @@ nsXULColorPickerTileAccessible::Containe
   return nsnull;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULColorPickerAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULColorPickerAccessible::
-  nsXULColorPickerAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsXULColorPickerTileAccessible(aContent, aShell)
+  nsXULColorPickerAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsXULColorPickerTileAccessible(aContent, aDoc)
 {
   mFlags |= eMenuButtonAccessible;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULColorPickerAccessible: nsAccessible
 
 PRUint64
@@ -172,24 +172,26 @@ nsXULColorPickerAccessible::AreItemsOper
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULColorPickerAccessible: protected nsAccessible
 
 void
 nsXULColorPickerAccessible::CacheChildren()
 {
-  nsAccTreeWalker walker(mWeakShell, mContent, true);
+  NS_ENSURE_TRUE(mDoc,);
+
+  nsAccTreeWalker walker(mDoc, mContent, true);
 
   nsAccessible* child = nsnull;
   while ((child = walker.NextChild())) {
     PRUint32 role = child->Role();
 
     // Get an accessible for menupopup or panel elements.
     if (role == roles::ALERT) {
       AppendChild(child);
       return;
     }
 
     // Unbind rejected accessibles from the document.
-    GetDocAccessible()->UnbindFromDocument(child);
+    Document()->UnbindFromDocument(child);
   }
 }
--- a/accessible/src/xul/nsXULColorPickerAccessible.h
+++ b/accessible/src/xul/nsXULColorPickerAccessible.h
@@ -42,18 +42,18 @@
 #include "nsAccessibleWrap.h"
 
 /**
  * Used for color button in colorpicker palette.
  */
 class nsXULColorPickerTileAccessible : public nsAccessibleWrap
 {
 public:
-  nsXULColorPickerTileAccessible(nsIContent *aContent,
-                                 nsIWeakReference *aShell);
+  nsXULColorPickerTileAccessible(nsIContent* aContent,
+                                 nsDocAccessible* aDoc);
 
   // nsIAccessible
   NS_IMETHOD GetValue(nsAString& _retval);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 
@@ -63,17 +63,17 @@ public:
 
 
 /**
  * Used for colorpicker button (xul:colorpicker@type="button").
  */
 class nsXULColorPickerAccessible : public nsXULColorPickerTileAccessible
 {
 public:
-  nsXULColorPickerAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULColorPickerAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 
   // Widgets
   virtual bool IsWidget() const;
   virtual bool IsActiveWidget() const;
--- a/accessible/src/xul/nsXULComboboxAccessible.cpp
+++ b/accessible/src/xul/nsXULComboboxAccessible.cpp
@@ -36,33 +36,34 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsXULComboboxAccessible.h"
 
 #include "nsAccessibilityService.h"
+#include "nsDocAccessible.h"
 #include "nsCoreUtils.h"
 #include "Role.h"
 #include "States.h"
 
 #include "nsIAutoCompleteInput.h"
 #include "nsIDOMXULMenuListElement.h"
 #include "nsIDOMXULSelectCntrlItemEl.h"
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULComboboxAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULComboboxAccessible::
-  nsXULComboboxAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsAccessibleWrap(aContent, aShell)
+  nsXULComboboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsAccessibleWrap(aContent, aDoc)
 {
   if (mContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::type,
                             nsGkAtoms::autocomplete, eIgnoreCase))
     mFlags |= eAutoCompleteAccessible;
   else
     mFlags |= eComboboxAccessible;
 }
 
@@ -126,19 +127,18 @@ nsXULComboboxAccessible::Description(nsS
   nsCOMPtr<nsIDOMXULMenuListElement> menuListElm(do_QueryInterface(mContent));
   if (!menuListElm)
     return;
 
   nsCOMPtr<nsIDOMXULSelectControlItemElement> focusedOptionItem;
   menuListElm->GetSelectedItem(getter_AddRefs(focusedOptionItem));
   nsCOMPtr<nsIContent> focusedOptionContent =
     do_QueryInterface(focusedOptionItem);
-  if (focusedOptionContent) {
-    nsAccessible* focusedOptionAcc = GetAccService()->
-      GetAccessibleInWeakShell(focusedOptionContent, mWeakShell);
+  if (focusedOptionContent && mDoc) {
+    nsAccessible* focusedOptionAcc = mDoc->GetAccessible(focusedOptionContent);
     if (focusedOptionAcc)
       focusedOptionAcc->Description(aDescription);
   }
 }
 
 bool
 nsXULComboboxAccessible::CanHaveAnonChildren()
 {
--- a/accessible/src/xul/nsXULComboboxAccessible.h
+++ b/accessible/src/xul/nsXULComboboxAccessible.h
@@ -45,17 +45,17 @@
 /**
  * Used for XUL comboboxes like xul:menulist and autocomplete textbox.
  */
 class nsXULComboboxAccessible : public nsAccessibleWrap
 {
 public:
   enum { eAction_Click = 0 };
 
-  nsXULComboboxAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULComboboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsIAccessible
   NS_IMETHOD GetValue(nsAString& aValue);
   NS_IMETHOD DoAction(PRUint8 aIndex);
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
 
   // nsAccessible
   virtual void Description(nsString& aDescription);
--- a/accessible/src/xul/nsXULFormControlAccessible.cpp
+++ b/accessible/src/xul/nsXULFormControlAccessible.cpp
@@ -66,18 +66,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULButtonAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULButtonAccessible::
-  nsXULButtonAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsAccessibleWrap(aContent, aShell)
+  nsXULButtonAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsAccessibleWrap(aContent, aDoc)
 {
   if (ContainsMenu())
     mFlags |= eMenuButtonAccessible;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULButtonAccessible: nsISupports
 
@@ -221,23 +221,24 @@ nsXULButtonAccessible::CacheChildren()
                                        nsGkAtoms::menu,
                                        eCaseMatters);
 
   bool isMenuButton = isMenu ?
     false :
     mContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::type,
                           nsGkAtoms::menuButton, eCaseMatters);
 
+  NS_ENSURE_TRUE(mDoc,);
   if (!isMenu && !isMenuButton)
     return;
 
   nsAccessible* menupopup = nsnull;
   nsAccessible* button = nsnull;
 
-  nsAccTreeWalker walker(mWeakShell, mContent, true);
+  nsAccTreeWalker walker(mDoc, mContent, true);
 
   nsAccessible* child = nsnull;
   while ((child = walker.NextChild())) {
     roles::Role role = child->Role();
 
     if (role == roles::MENUPOPUP) {
       // Get an accessible for menupopup or panel elements.
       menupopup = child;
@@ -245,17 +246,17 @@ nsXULButtonAccessible::CacheChildren()
     } else if (isMenuButton && role == roles::PUSHBUTTON) {
       // Button type="menu-button" contains a real button. Get an accessible
       // for it. Ignore dropmarker button which is placed as a last child.
       button = child;
       break;
 
     } else {
       // Unbind rejected accessible from document.
-      GetDocAccessible()->UnbindFromDocument(child);
+      Document()->UnbindFromDocument(child);
     }
   }
 
   if (!menupopup)
     return;
 
   AppendChild(menupopup);
   if (button)
@@ -276,18 +277,18 @@ nsXULButtonAccessible::ContainsMenu()
                                    strings, eCaseMatters) >= 0;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULDropmarkerAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULDropmarkerAccessible::
-  nsXULDropmarkerAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsFormControlAccessible(aContent, aShell)
+  nsXULDropmarkerAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsFormControlAccessible(aContent, aDoc)
 {
 }
 
 PRUint8
 nsXULDropmarkerAccessible::ActionCount()
 {
   return 1;
 }
@@ -357,18 +358,18 @@ nsXULDropmarkerAccessible::NativeState()
   return DropmarkerOpen(false) ? states::PRESSED : 0;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULCheckboxAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULCheckboxAccessible::
-  nsXULCheckboxAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsFormControlAccessible(aContent, aShell)
+  nsXULCheckboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsFormControlAccessible(aContent, aDoc)
 {
 }
 
 role
 nsXULCheckboxAccessible::NativeRole()
 {
   return roles::CHECKBUTTON;
 }
@@ -437,18 +438,18 @@ nsXULCheckboxAccessible::NativeState()
   return state;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULGroupboxAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULGroupboxAccessible::
-  nsXULGroupboxAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsAccessibleWrap(aContent, aShell)
+  nsXULGroupboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsAccessibleWrap(aContent, aDoc)
 {
 }
 
 role
 nsXULGroupboxAccessible::NativeRole()
 {
   return roles::GROUPING;
 }
@@ -494,18 +495,18 @@ nsXULGroupboxAccessible::RelationByType(
   return rel;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULRadioButtonAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULRadioButtonAccessible::
-  nsXULRadioButtonAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsRadioButtonAccessible(aContent, aShell)
+  nsXULRadioButtonAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsRadioButtonAccessible(aContent, aDoc)
 {
 }
 
 PRUint64
 nsXULRadioButtonAccessible::NativeState()
 {
   PRUint64 state = nsFormControlAccessible::NativeState();
   state |= states::CHECKABLE;
@@ -553,18 +554,18 @@ nsXULRadioButtonAccessible::ContainerWid
   *   The Radio Group proxies for the Radio Buttons themselves. The Group gets
   *   focus whereas the Buttons do not. So we only have an accessible object for
   *   this for the purpose of getting the proper RadioButton. Need this here to 
   *   avoid circular reference problems when navigating the accessible tree and
   *   for getting to the radiobuttons.
   */
 
 nsXULRadioGroupAccessible::
-  nsXULRadioGroupAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  XULSelectControlAccessible(aContent, aShell)
+  nsXULRadioGroupAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  XULSelectControlAccessible(aContent, aDoc)
 { 
 }
 
 role
 nsXULRadioGroupAccessible::NativeRole()
 {
   return roles::GROUPING;
 }
@@ -600,35 +601,35 @@ nsXULRadioGroupAccessible::AreItemsOpera
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULStatusBarAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULStatusBarAccessible::
-  nsXULStatusBarAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsAccessibleWrap(aContent, aShell)
+  nsXULStatusBarAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsAccessibleWrap(aContent, aDoc)
 {
 }
 
 role
 nsXULStatusBarAccessible::NativeRole()
 {
   return roles::STATUSBAR;
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULToolbarButtonAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULToolbarButtonAccessible::
-  nsXULToolbarButtonAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsXULButtonAccessible(aContent, aShell)
+  nsXULToolbarButtonAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsXULButtonAccessible(aContent, aDoc)
 {
 }
 
 void
 nsXULToolbarButtonAccessible::GetPositionAndSizeInternal(PRInt32 *aPosInSet,
                                                          PRInt32 *aSetSize)
 {
   PRInt32 setSize = 0;
@@ -668,18 +669,18 @@ nsXULToolbarButtonAccessible::IsSeparato
                      (content->Tag() == nsGkAtoms::toolbarspring)); }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULToolbarAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULToolbarAccessible::
-  nsXULToolbarAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsAccessibleWrap(aContent, aShell)
+  nsXULToolbarAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsAccessibleWrap(aContent, aDoc)
 {
 }
 
 role
 nsXULToolbarAccessible::NativeRole()
 {
   return roles::TOOLBAR;
 }
@@ -697,19 +698,19 @@ nsXULToolbarAccessible::GetNameInternal(
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULToolbarAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULToolbarSeparatorAccessible::
-  nsXULToolbarSeparatorAccessible(nsIContent *aContent,
-                                  nsIWeakReference *aShell) :
-  nsLeafAccessible(aContent, aShell)
+  nsXULToolbarSeparatorAccessible(nsIContent* aContent,
+                                  nsDocAccessible* aDoc) :
+  nsLeafAccessible(aContent, aDoc)
 {
 }
 
 role
 nsXULToolbarSeparatorAccessible::NativeRole()
 {
   return roles::SEPARATOR;
 }
@@ -720,18 +721,18 @@ nsXULToolbarSeparatorAccessible::NativeS
   return 0;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTextFieldAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULTextFieldAccessible::
- nsXULTextFieldAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
- nsHyperTextAccessibleWrap(aContent, aShell)
+ nsXULTextFieldAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+ nsHyperTextAccessibleWrap(aContent, aDoc)
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED3(nsXULTextFieldAccessible, nsAccessible, nsHyperTextAccessible, nsIAccessibleText, nsIAccessibleEditableText)
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTextFieldAccessible: nsIAccessible
 
@@ -771,17 +772,17 @@ nsXULTextFieldAccessible::NativeState()
   PRUint64 state = nsHyperTextAccessibleWrap::NativeState();
 
   nsCOMPtr<nsIContent> inputField(GetInputField());
   NS_ENSURE_TRUE(inputField, state);
 
   // Create a temporary accessible from the HTML text field to get
   // the accessible state from. Doesn't add to cache into document cache.
   nsRefPtr<nsHTMLTextFieldAccessible> tempAccessible =
-    new nsHTMLTextFieldAccessible(inputField, mWeakShell);
+    new nsHTMLTextFieldAccessible(inputField, mDoc);
   if (!tempAccessible)
     return state;
 
   state |= tempAccessible->NativeState();
 
   nsCOMPtr<nsIDOMXULMenuListElement> menuList(do_QueryInterface(mContent));
   if (menuList) {
     // <xul:menulist droppable="false">
@@ -860,23 +861,24 @@ NS_IMETHODIMP nsXULTextFieldAccessible::
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTextFieldAccessible: nsAccessible protected
 
 void
 nsXULTextFieldAccessible::CacheChildren()
 {
+  NS_ENSURE_TRUE(mDoc,);
   // Create child accessibles for native anonymous content of underlying HTML
   // input element.
   nsCOMPtr<nsIContent> inputContent(GetInputField());
   if (!inputContent)
     return;
 
-  nsAccTreeWalker walker(mWeakShell, inputContent, false);
+  nsAccTreeWalker walker(mDoc, inputContent, false);
 
   nsAccessible* child = nsnull;
   while ((child = walker.NextChild()) && AppendChild(child));
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTextFieldAccessible: nsHyperTextAccessible protected
 
--- a/accessible/src/xul/nsXULFormControlAccessible.h
+++ b/accessible/src/xul/nsXULFormControlAccessible.h
@@ -56,17 +56,17 @@ typedef ProgressMeterAccessible<100> XUL
  *
  * @note  Don't inherit from nsFormControlAccessible - it doesn't allow children
  *         and a button can have a dropmarker child.
  */
 class nsXULButtonAccessible : public nsAccessibleWrap
 {
 public:
   enum { eAction_Click = 0 };
-  nsXULButtonAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULButtonAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 index);
 
@@ -95,17 +95,17 @@ protected:
 
 /**
  * Used for XUL checkbox element.
  */
 class nsXULCheckboxAccessible : public nsFormControlAccessible
 {
 public:
   enum { eAction_Click = 0 };
-  nsXULCheckboxAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULCheckboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 index);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
@@ -116,17 +116,17 @@ public:
 
 /**
  * Used for XUL dropmarker element.
  */
 class nsXULDropmarkerAccessible : public nsFormControlAccessible
 {
 public:
   enum { eAction_Click = 0 };
-  nsXULDropmarkerAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULDropmarkerAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 index);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
@@ -139,49 +139,49 @@ private:
 };
 
 /**
  * Used for XUL groupbox element.
  */
 class nsXULGroupboxAccessible : public nsAccessibleWrap
 {
 public:
-  nsXULGroupboxAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULGroupboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual Relation RelationByType(PRUint32 aRelationType);
 };
 
 /**
  * Used for XUL radio element (radio button).
  */
 class nsXULRadioButtonAccessible : public nsRadioButtonAccessible
 {
 
 public:
-  nsXULRadioButtonAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULRadioButtonAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsAccessible
   virtual void GetPositionAndSizeInternal(PRInt32 *aPosInSet,
                                           PRInt32 *aSetSize);
   virtual PRUint64 NativeState();
 
   // Widgets
   virtual nsAccessible* ContainerWidget() const;
 };
 
 /**
  * Used for XUL radiogroup element.
  */
 class nsXULRadioGroupAccessible : public XULSelectControlAccessible
 {
 public:
-  nsXULRadioGroupAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULRadioGroupAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 
   // Widgets
   virtual bool IsWidget() const;
   virtual bool IsActiveWidget() const;
@@ -189,74 +189,74 @@ public:
 };
 
 /**
  * Used for XUL statusbar element.
  */
 class nsXULStatusBarAccessible : public nsAccessibleWrap
 {
 public:
-  nsXULStatusBarAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULStatusBarAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
 };
 
 /**
  * Used for XUL toolbarbutton element.
  */
 class nsXULToolbarButtonAccessible : public nsXULButtonAccessible
 {
 public:
-  nsXULToolbarButtonAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULToolbarButtonAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsAccessible
   virtual void GetPositionAndSizeInternal(PRInt32 *aPosInSet,
                                           PRInt32 *aSetSize);
 
   // nsXULToolbarButtonAccessible
   static bool IsSeparator(nsAccessible *aAccessible);
 };
 
 /**
  * Used for XUL toolbar element.
  */
 class nsXULToolbarAccessible : public nsAccessibleWrap
 {
 public:
-  nsXULToolbarAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULToolbarAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual nsresult GetNameInternal(nsAString& aName);
 };
 
 /**
  * Used for XUL toolbarseparator element.
  */
 class nsXULToolbarSeparatorAccessible : public nsLeafAccessible
 {
 public:
   nsXULToolbarSeparatorAccessible(nsIContent* aContent,
-                                  nsIWeakReference *aShell);
+                                  nsDocAccessible* aDoc);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 };
 
 /**
  * Used for XUL textbox element.
  */
 class nsXULTextFieldAccessible : public nsHyperTextAccessibleWrap
 {
 public:
   enum { eAction_Click = 0 };
 
-  nsXULTextFieldAccessible(nsIContent* aContent, nsIWeakReference *aShell);
+  nsXULTextFieldAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessible
   NS_IMETHOD GetValue(nsAString& aValue);
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 index);
 
--- a/accessible/src/xul/nsXULListboxAccessible.cpp
+++ b/accessible/src/xul/nsXULListboxAccessible.cpp
@@ -37,16 +37,17 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsXULListboxAccessible.h"
 
 #include "nsAccessibilityService.h"
 #include "nsAccUtils.h"
+#include "nsDocAccessible.h"
 #include "Role.h"
 #include "States.h"
 
 #include "nsComponentManagerUtils.h"
 #include "nsIAutoCompleteInput.h"
 #include "nsIAutoCompletePopup.h"
 #include "nsIDOMXULMenuListElement.h"
 #include "nsIDOMXULMultSelectCntrlEl.h"
@@ -56,18 +57,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULColumnsAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULColumnsAccessible::
-  nsXULColumnsAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsAccessibleWrap(aContent, aShell)
+  nsXULColumnsAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsAccessibleWrap(aContent, aDoc)
 {
 }
 
 role
 nsXULColumnsAccessible::NativeRole()
 {
   return roles::LIST;
 }
@@ -79,18 +80,18 @@ nsXULColumnsAccessible::NativeState()
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULColumnItemAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULColumnItemAccessible::
-  nsXULColumnItemAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsLeafAccessible(aContent, aShell)
+  nsXULColumnItemAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsLeafAccessible(aContent, aDoc)
 {
 }
 
 role
 nsXULColumnItemAccessible::NativeRole()
 {
   return roles::COLUMNHEADER;
 }
@@ -127,18 +128,18 @@ nsXULColumnItemAccessible::DoAction(PRUi
   return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULListboxAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULListboxAccessible::
-  nsXULListboxAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  XULSelectControlAccessible(aContent, aShell)
+  nsXULListboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  XULSelectControlAccessible(aContent, aDoc)
 {
   nsIContent* parentContent = mContent->GetParent();
   if (parentContent) {
     nsCOMPtr<nsIAutoCompletePopup> autoCompletePopupElm =
       do_QueryInterface(parentContent);
     if (autoCompletePopupElm)
       mFlags |= eAutoCompletePopupAccessible;
   }
@@ -311,19 +312,18 @@ nsXULListboxAccessible::GetCellAt(PRInt3
   nsCOMPtr<nsIDOMXULSelectControlElement> control =
     do_QueryInterface(mContent);
 
   nsCOMPtr<nsIDOMXULSelectControlItemElement> item;
   control->GetItemAtIndex(aRow, getter_AddRefs(item));
   NS_ENSURE_TRUE(item, NS_ERROR_INVALID_ARG);
 
   nsCOMPtr<nsIContent> itemContent(do_QueryInterface(item));
-
-  nsAccessible *row =
-    GetAccService()->GetAccessibleInWeakShell(itemContent, mWeakShell);
+  NS_ENSURE_TRUE(mDoc, NS_ERROR_FAILURE);
+  nsAccessible *row = mDoc->GetAccessible(itemContent);
   NS_ENSURE_STATE(row);
 
   nsresult rv = row->GetChildAt(aColumn, aAccessibleCell);
   NS_ENSURE_SUCCESS(rv, NS_ERROR_INVALID_ARG);
 
   return NS_OK;
 }
 
@@ -596,23 +596,23 @@ nsXULListboxAccessible::GetSelectedCells
   control->GetSelectedItems(getter_AddRefs(selectedItems));
   if (!selectedItems)
     return NS_OK;
 
   PRUint32 selectedItemsCount = 0;
   rv = selectedItems->GetLength(&selectedItemsCount);
   NS_ENSURE_SUCCESS(rv, rv);
 
+  NS_ENSURE_TRUE(mDoc, NS_ERROR_FAILURE);
   PRUint32 index = 0;
   for (; index < selectedItemsCount; index++) {
     nsCOMPtr<nsIDOMNode> itemNode;
     selectedItems->Item(index, getter_AddRefs(itemNode));
     nsCOMPtr<nsIContent> itemContent(do_QueryInterface(itemNode));
-    nsAccessible *item =
-      GetAccService()->GetAccessibleInWeakShell(itemContent, mWeakShell);
+    nsAccessible *item = mDoc->GetAccessible(itemContent);
 
     if (item) {
       PRInt32 cellCount = item->GetChildCount();
       for (PRInt32 cellIdx = 0; cellIdx < cellCount; cellIdx++) {
         nsAccessible *cell = mChildren[cellIdx];
         if (cell->Role() == roles::CELL)
           selCells->AppendElement(static_cast<nsIAccessible*>(cell), false);
       }
@@ -881,32 +881,33 @@ nsXULListboxAccessible::ContainerWidget(
     nsCOMPtr<nsIDOMXULMenuListElement> menuListElm =
       do_QueryInterface(mContent->GetParent());
     if (menuListElm) {
       nsCOMPtr<nsIDOMNode> inputElm;
       menuListElm->GetInputField(getter_AddRefs(inputElm));
       if (inputElm) {
         nsCOMPtr<nsINode> inputNode = do_QueryInterface(inputElm);
         if (inputNode) {
-          nsAccessible* input = GetAccService()->GetAccessible(inputNode);
+          nsAccessible* input = 
+            GetAccService()->GetAccessible(inputNode, nsnull);
           return input ? input->ContainerWidget() : nsnull;
         }
       }
     }
   }
   return nsnull;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULListitemAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULListitemAccessible::
-  nsXULListitemAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsXULMenuitemAccessible(aContent, aShell)
+  nsXULListitemAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsXULMenuitemAccessible(aContent, aDoc)
 {
   mIsCheckbox = mContent->AttrValueIs(kNameSpaceID_None,
                                       nsGkAtoms::type,
                                       nsGkAtoms::checkbox,
                                       eCaseMatters);
 }
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsXULListitemAccessible, nsAccessible)
@@ -924,17 +925,17 @@ nsXULListitemAccessible::GetListAccessib
 
   nsCOMPtr<nsIDOMXULSelectControlElement> list;
   listItem->GetControl(getter_AddRefs(list));
 
   nsCOMPtr<nsIContent> listContent(do_QueryInterface(list));
   if (!listContent)
     return nsnull;
 
-  return GetAccService()->GetAccessibleInWeakShell(listContent, mWeakShell);
+  return mDoc->GetAccessible(listContent);
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULListitemAccessible nsAccessible
 
 void
 nsXULListitemAccessible::Description(nsString& aDesc)
 {
@@ -1048,18 +1049,18 @@ nsXULListitemAccessible::ContainerWidget
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULListCellAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULListCellAccessible::
-  nsXULListCellAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsHyperTextAccessibleWrap(aContent, aShell)
+  nsXULListCellAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsHyperTextAccessibleWrap(aContent, aDoc)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsISupports
 
 NS_IMPL_ISUPPORTS_INHERITED1(nsXULListCellAccessible,
                              nsHyperTextAccessible,
--- a/accessible/src/xul/nsXULListboxAccessible.h
+++ b/accessible/src/xul/nsXULListboxAccessible.h
@@ -51,31 +51,31 @@ class nsIWeakReference;
 
 /**
  * nsXULColumnsAccessible are accessible for list and tree columns elements
  * (xul:treecols and xul:listcols).
  */
 class nsXULColumnsAccessible : public nsAccessibleWrap
 {
 public:
-  nsXULColumnsAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULColumnsAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 };
 
 /**
  * nsXULColumnAccessible are accessibles for list and tree column elements
  * (xul:listcol and xul:treecol).
  */
 class nsXULColumnItemAccessible : public nsLeafAccessible
 {
 public:
-  nsXULColumnItemAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULColumnItemAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 aIndex);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
@@ -88,17 +88,17 @@ public:
 
 /*
  * A class the represents the XUL Listbox widget.
  */
 class nsXULListboxAccessible : public XULSelectControlAccessible,
                                public nsIAccessibleTable
 {
 public:
-  nsXULListboxAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULListboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
   virtual ~nsXULListboxAccessible() {}
 
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_NSIACCESSIBLETABLE
 
   // nsIAccessible
   NS_IMETHOD GetValue(nsAString& aValue);
 
@@ -122,17 +122,17 @@ protected:
   */
 class nsXULListitemAccessible : public nsXULMenuitemAccessible
 {
 public:
   enum { eAction_Click = 0 };
 
   NS_DECL_ISUPPORTS_INHERITED
   
-  nsXULListitemAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULListitemAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
   virtual ~nsXULListitemAccessible() {}
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 index, nsAString& aName);
   // Don't use XUL menuitems's description attribute
 
   // nsAccessible
   virtual void Description(nsString& aDesc);
@@ -158,17 +158,17 @@ private:
 
 /**
  * Class represents xul:listcell.
  */
 class nsXULListCellAccessible : public nsHyperTextAccessibleWrap,
                                 public nsIAccessibleTableCell
 {
 public:
-  nsXULListCellAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULListCellAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessibleTableCell
   NS_DECL_NSIACCESSIBLETABLECELL
 
   // nsAccessible
--- a/accessible/src/xul/nsXULMenuAccessible.cpp
+++ b/accessible/src/xul/nsXULMenuAccessible.cpp
@@ -66,18 +66,18 @@
 using namespace mozilla;
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULMenuitemAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULMenuitemAccessible::
-  nsXULMenuitemAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsAccessibleWrap(aContent, aShell)
+  nsXULMenuitemAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsAccessibleWrap(aContent, aDoc)
 {
 }
 
 PRUint64
 nsXULMenuitemAccessible::NativeState()
 {
   PRUint64 state = nsAccessible::NativeState();
 
@@ -403,18 +403,18 @@ nsXULMenuitemAccessible::ContainerWidget
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULMenuSeparatorAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULMenuSeparatorAccessible::
-  nsXULMenuSeparatorAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsXULMenuitemAccessible(aContent, aShell)
+  nsXULMenuSeparatorAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsXULMenuitemAccessible(aContent, aDoc)
 {
 }
 
 PRUint64
 nsXULMenuSeparatorAccessible::NativeState()
 {
   // Isn't focusable, but can be offscreen/invisible -- only copy those states
   return nsXULMenuitemAccessible::NativeState() &
@@ -449,18 +449,18 @@ nsXULMenuSeparatorAccessible::ActionCoun
   return 0;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULMenupopupAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULMenupopupAccessible::
-  nsXULMenupopupAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  XULSelectControlAccessible(aContent, aShell)
+  nsXULMenupopupAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  XULSelectControlAccessible(aContent, aDoc)
 {
   nsMenuPopupFrame* menuPopupFrame = do_QueryFrame(GetFrame());
   if (menuPopupFrame && menuPopupFrame->IsMenu())
     mFlags |= eMenuPopupAccessible;
 
   // May be the anonymous <menupopup> inside <menulist> (a combobox)
   mSelectControl = do_QueryInterface(mContent->GetParent());
 }
@@ -551,17 +551,17 @@ nsXULMenupopupAccessible::AreItemsOperab
 {
   nsMenuPopupFrame* menuPopupFrame = do_QueryFrame(GetFrame());
   return menuPopupFrame && menuPopupFrame->IsOpen();
 }
 
 nsAccessible*
 nsXULMenupopupAccessible::ContainerWidget() const
 {
-  nsDocAccessible* document = GetDocAccessible();
+  nsDocAccessible* document = Document();
 
   nsMenuPopupFrame* menuPopupFrame = do_QueryFrame(GetFrame());
   while (menuPopupFrame) {
     nsAccessible* menuPopup =
       document->GetAccessible(menuPopupFrame->GetContent());
     if (!menuPopup) // shouldn't be a real case
       return nsnull;
 
@@ -589,18 +589,18 @@ nsXULMenupopupAccessible::ContainerWidge
   return nsnull;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULMenubarAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULMenubarAccessible::
-  nsXULMenubarAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsAccessibleWrap(aContent, aShell)
+  nsXULMenubarAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsAccessibleWrap(aContent, aDoc)
 {
 }
 
 PRUint64
 nsXULMenubarAccessible::NativeState()
 {
   PRUint64 state = nsAccessible::NativeState();
 
@@ -642,17 +642,17 @@ nsXULMenubarAccessible::AreItemsOperable
 nsAccessible*
 nsXULMenubarAccessible::CurrentItem()
 {
   nsMenuBarFrame* menuBarFrame = do_QueryFrame(GetFrame());
   if (menuBarFrame) {
     nsMenuFrame* menuFrame = menuBarFrame->GetCurrentMenuItem();
     if (menuFrame) {
       nsIContent* menuItemNode = menuFrame->GetContent();
-      return GetAccService()->GetAccessible(menuItemNode);
+      return GetAccService()->GetAccessible(menuItemNode, nsnull);
     }
   }
   return nsnull;
 }
 
 void
 nsXULMenubarAccessible::SetCurrentItem(nsAccessible* aItem)
 {
--- a/accessible/src/xul/nsXULMenuAccessible.h
+++ b/accessible/src/xul/nsXULMenuAccessible.h
@@ -46,17 +46,17 @@
 /**
  * Used for XUL menu, menuitem elements.
  */
 class nsXULMenuitemAccessible : public nsAccessibleWrap
 {
 public:
   enum { eAction_Click = 0 };
 
-  nsXULMenuitemAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULMenuitemAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsIAccessible
   NS_IMETHOD DoAction(PRUint8 index);
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
 
   // nsAccessible
   virtual void Description(nsString& aDescription);
   virtual nsresult GetNameInternal(nsAString& aName);
@@ -80,17 +80,17 @@ public:
 };
 
 /**
  * Used for XUL menuseparator element.
  */
 class nsXULMenuSeparatorAccessible : public nsXULMenuitemAccessible
 {
 public:
-  nsXULMenuSeparatorAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULMenuSeparatorAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsIAccessible
   NS_IMETHOD DoAction(PRUint8 index);
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual mozilla::a11y::role NativeRole();
@@ -102,17 +102,17 @@ public:
 
 
 /**
  * Used for XUL menupopup and panel.
  */
 class nsXULMenupopupAccessible : public XULSelectControlAccessible
 {
 public:
-  nsXULMenupopupAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULMenupopupAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 
   // Widgets
   virtual bool IsWidget() const;
@@ -123,17 +123,17 @@ public:
 };
 
 /**
  * Used for XUL menubar element.
  */
 class nsXULMenubarAccessible : public nsAccessibleWrap
 {
 public:
-  nsXULMenubarAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULMenubarAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 
   // Widget
   virtual bool IsActiveWidget() const;
--- a/accessible/src/xul/nsXULSliderAccessible.cpp
+++ b/accessible/src/xul/nsXULSliderAccessible.cpp
@@ -48,18 +48,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULSliderAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULSliderAccessible::
-  nsXULSliderAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsAccessibleWrap(aContent, aShell)
+  nsXULSliderAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsAccessibleWrap(aContent, aDoc)
 {
 }
 
 // nsISupports
 
 NS_IMPL_ISUPPORTS_INHERITED1(nsXULSliderAccessible,
                              nsAccessibleWrap,
                              nsIAccessibleValue)
@@ -284,18 +284,18 @@ nsXULSliderAccessible::SetSliderAttr(nsI
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULThumbAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULThumbAccessible::
-  nsXULThumbAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsAccessibleWrap(aContent, aShell)
+  nsXULThumbAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsAccessibleWrap(aContent, aDoc)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULThumbAccessible: nsAccessible
 
 role
 nsXULThumbAccessible::NativeRole()
--- a/accessible/src/xul/nsXULSliderAccessible.h
+++ b/accessible/src/xul/nsXULSliderAccessible.h
@@ -44,17 +44,17 @@
 #include "nsIDOMElement.h"
 
 /**
  * Used for XUL slider and scale elements.
  */
 class nsXULSliderAccessible : public nsAccessibleWrap
 {
 public:
-  nsXULSliderAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULSliderAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessible
   NS_IMETHOD GetValue(nsAString& aValue);
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 aIndex);
@@ -85,16 +85,16 @@ private:
 
 
 /**
  * Used for slider's thumb element.
  */
 class nsXULThumbAccessible : public nsAccessibleWrap
 {
 public:
-  nsXULThumbAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULThumbAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
 };
 
 #endif
 
--- a/accessible/src/xul/nsXULTabAccessible.cpp
+++ b/accessible/src/xul/nsXULTabAccessible.cpp
@@ -54,18 +54,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTabAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULTabAccessible::
-  nsXULTabAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsAccessibleWrap(aContent, aShell)
+  nsXULTabAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsAccessibleWrap(aContent, aDoc)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTabAccessible: nsIAccessible
 
 PRUint8
 nsXULTabAccessible::ActionCount()
@@ -173,18 +173,18 @@ nsXULTabAccessible::GetPositionAndSizeIn
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTabsAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULTabsAccessible::
-  nsXULTabsAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  XULSelectControlAccessible(aContent, aShell)
+  nsXULTabsAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  XULSelectControlAccessible(aContent, aDoc)
 {
 }
 
 role
 nsXULTabsAccessible::NativeRole()
 {
   return roles::PAGETABLIST;
 }
@@ -209,35 +209,35 @@ nsXULTabsAccessible::GetNameInternal(nsA
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTabpanelsAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULTabpanelsAccessible::
-  nsXULTabpanelsAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsAccessibleWrap(aContent, aShell)
+  nsXULTabpanelsAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsAccessibleWrap(aContent, aDoc)
 {
 }
 
 role
 nsXULTabpanelsAccessible::NativeRole()
 {
   return roles::PANE;
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTabpanelAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULTabpanelAccessible::
-  nsXULTabpanelAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsAccessibleWrap(aContent, aShell)
+  nsXULTabpanelAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsAccessibleWrap(aContent, aDoc)
 {
 }
 
 role
 nsXULTabpanelAccessible::NativeRole()
 {
   return roles::PROPERTYPAGE;
 }
--- a/accessible/src/xul/nsXULTabAccessible.h
+++ b/accessible/src/xul/nsXULTabAccessible.h
@@ -47,17 +47,17 @@
 /**
  * An individual tab, xul:tab element.
  */
 class nsXULTabAccessible : public nsAccessibleWrap
 {
 public:
   enum { eAction_Switch = 0 };
 
-  nsXULTabAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULTabAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 index);
 
   // nsAccessible
   virtual void GetPositionAndSizeInternal(PRInt32 *aPosInSet,
                                           PRInt32 *aSetSize);
@@ -71,17 +71,17 @@ public:
 
 
 /**
  * A container of tab objects, xul:tabs element.
  */
 class nsXULTabsAccessible : public XULSelectControlAccessible
 {
 public:
-  nsXULTabsAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULTabsAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsIAccessible
   NS_IMETHOD GetValue(nsAString& _retval);
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual mozilla::a11y::role NativeRole();
 
@@ -91,17 +91,17 @@ public:
 
 
 /** 
  * A container of tab panels, xul:tabpanels element.
  */
 class nsXULTabpanelsAccessible : public nsAccessibleWrap
 {
 public:
-  nsXULTabpanelsAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULTabpanelsAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
 };
 
 
 /**
  * A tabpanel object, child elements of xul:tabpanels element. Note,the object
@@ -111,17 +111,17 @@ public:
  *
  * XXX: we need to move the class logic into generic class since
  * for example we do not create instance of this class for XUL textbox used as
  * a tabpanel.
  */
 class nsXULTabpanelAccessible : public nsAccessibleWrap
 {
 public:
-  nsXULTabpanelAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULTabpanelAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual Relation RelationByType(PRUint32 aType);
 };
 
 #endif
 
--- a/accessible/src/xul/nsXULTextAccessible.cpp
+++ b/accessible/src/xul/nsXULTextAccessible.cpp
@@ -56,18 +56,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTextAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULTextAccessible::
-  nsXULTextAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsHyperTextAccessibleWrap(aContent, aShell)
+  nsXULTextAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsHyperTextAccessibleWrap(aContent, aDoc)
 {
 }
 
 nsresult
 nsXULTextAccessible::GetNameInternal(nsAString& aName)
 {
   // if the value attr doesn't exist, the screen reader must get the accessible text
   // from the accessible text interface or from the children
@@ -107,18 +107,18 @@ nsXULTextAccessible::RelationByType(PRUi
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTooltipAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULTooltipAccessible::
-  nsXULTooltipAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsLeafAccessible(aContent, aShell)
+  nsXULTooltipAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsLeafAccessible(aContent, aDoc)
 {
 }
 
 PRUint64
 nsXULTooltipAccessible::NativeState()
 {
   PRUint64 states = nsLeafAccessible::NativeState();
 
@@ -134,18 +134,18 @@ nsXULTooltipAccessible::NativeRole()
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULLinkAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULLinkAccessible::
-  nsXULLinkAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsHyperTextAccessibleWrap(aContent, aShell)
+  nsXULLinkAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsHyperTextAccessibleWrap(aContent, aDoc)
 {
 }
 
 // Expose nsIAccessibleHyperLink unconditionally
 NS_IMPL_ISUPPORTS_INHERITED1(nsXULLinkAccessible, nsHyperTextAccessibleWrap,
                              nsIAccessibleHyperLink)
 
 ////////////////////////////////////////////////////////////////////////////////
--- a/accessible/src/xul/nsXULTextAccessible.h
+++ b/accessible/src/xul/nsXULTextAccessible.h
@@ -44,44 +44,44 @@
 #include "nsHyperTextAccessibleWrap.h"
 
 /**
  * Used for XUL description and label elements.
  */
 class nsXULTextAccessible : public nsHyperTextAccessibleWrap
 {
 public:
-  nsXULTextAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULTextAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
   virtual Relation RelationByType(PRUint32 aRelationType);
 };
 
 /**
  * Used for XUL tooltip element.
  */
 class nsXULTooltipAccessible : public nsLeafAccessible
 {
 
 public:
-  nsXULTooltipAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULTooltipAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 };
 
 class nsXULLinkAccessible : public nsHyperTextAccessibleWrap
 {
 
 public:
-  nsXULLinkAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULLinkAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessible
   NS_IMETHOD GetValue(nsAString& aValue);
 
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 aIndex);
--- a/accessible/src/xul/nsXULTreeAccessible.cpp
+++ b/accessible/src/xul/nsXULTreeAccessible.cpp
@@ -60,18 +60,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULTreeAccessible::
-  nsXULTreeAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsAccessibleWrap(aContent, aShell)
+  nsXULTreeAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsAccessibleWrap(aContent, aDoc)
 {
   mTree = nsCoreUtils::GetTreeBoxObject(aContent);
   if (mTree)
     mTree->GetView(getter_AddRefs(mTreeView));
 
   NS_ASSERTION(mTree && mTreeView, "Can't get mTree or mTreeView!\n");
 
   nsIContent* parentContent = mContent->GetParent();
@@ -511,17 +511,18 @@ nsXULTreeAccessible::ContainerWidget() c
     nsCOMPtr<nsIDOMXULMenuListElement> menuListElm =
       do_QueryInterface(mContent->GetParent());
     if (menuListElm) {
       nsCOMPtr<nsIDOMNode> inputElm;
       menuListElm->GetInputField(getter_AddRefs(inputElm));
       if (inputElm) {
         nsCOMPtr<nsINode> inputNode = do_QueryInterface(inputElm);
         if (inputNode) {
-          nsAccessible* input = GetAccService()->GetAccessible(inputNode);
+          nsAccessible* input = 
+            GetAccService()->GetAccessible(inputNode, nsnull);
           return input ? input->ContainerWidget() : nsnull;
         }
       }
     }
   }
   return nsnull;
 }
 
@@ -542,17 +543,17 @@ nsXULTreeAccessible::GetTreeItemAccessib
   void *key = reinterpret_cast<void*>(aRow);
   nsAccessible* cachedTreeItem = mAccessibleCache.GetWeak(key);
   if (cachedTreeItem)
     return cachedTreeItem;
 
   nsRefPtr<nsAccessible> treeItem = CreateTreeItemAccessible(aRow);
   if (treeItem) {
     if (mAccessibleCache.Put(key, treeItem)) {
-      if (GetDocAccessible()->BindToDocument(treeItem, nsnull))
+      if (Document()->BindToDocument(treeItem, nsnull))
         return treeItem;
 
       mAccessibleCache.Remove(key);
     }
   }
 
   return nsnull;
 }
@@ -562,17 +563,17 @@ nsXULTreeAccessible::InvalidateCache(PRI
 {
   if (IsDefunct())
     return;
 
   // Do not invalidate the cache if rows have been inserted.
   if (aCount > 0)
     return;
 
-  nsDocAccessible* document = GetDocAccessible();
+  nsDocAccessible* document = Document();
 
   // Fire destroy event for removed tree items and delete them from caches.
   for (PRInt32 rowIdx = aRow; rowIdx < aRow - aCount; rowIdx++) {
 
     void* key = reinterpret_cast<void*>(rowIdx);
     nsAccessible* treeItem = mAccessibleCache.GetWeak(key);
 
     if (treeItem) {
@@ -666,45 +667,45 @@ nsXULTreeAccessible::TreeViewChanged()
 
   // Fire reorder event on tree accessible on accessible tree (do not fire
   // show/hide events on tree items because it can be expensive to fire them for
   // each tree item.
   nsRefPtr<AccEvent> reorderEvent =
     new AccEvent(nsIAccessibleEvent::EVENT_REORDER, this, eAutoDetect,
                  AccEvent::eCoalesceFromSameSubtree);
   if (reorderEvent)
-    GetDocAccessible()->FireDelayedAccessibleEvent(reorderEvent);
+    Document()->FireDelayedAccessibleEvent(reorderEvent);
 
   // Clear cache.
   ClearCache(mAccessibleCache);
   mTree->GetView(getter_AddRefs(mTreeView));
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeAccessible: protected implementation
 
 already_AddRefed<nsAccessible>
 nsXULTreeAccessible::CreateTreeItemAccessible(PRInt32 aRow)
 {
   nsRefPtr<nsAccessible> accessible =
-    new nsXULTreeItemAccessible(mContent, mWeakShell, this, mTree, mTreeView,
+    new nsXULTreeItemAccessible(mContent, mDoc, this, mTree, mTreeView,
                                 aRow);
 
   return accessible.forget();
 }
                              
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeItemAccessibleBase
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULTreeItemAccessibleBase::
-  nsXULTreeItemAccessibleBase(nsIContent *aContent, nsIWeakReference *aShell,
-                              nsAccessible *aParent, nsITreeBoxObject *aTree,
-                              nsITreeView *aTreeView, PRInt32 aRow) :
-  nsAccessibleWrap(aContent, aShell),
+  nsXULTreeItemAccessibleBase(nsIContent* aContent, nsDocAccessible* aDoc,
+                              nsAccessible* aParent, nsITreeBoxObject* aTree,
+                              nsITreeView* aTreeView, PRInt32 aRow) :
+  nsAccessibleWrap(aContent, aDoc),
   mTree(aTree), mTreeView(aTreeView), mRow(aRow)
 {
   mParent = aParent;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeItemAccessibleBase: nsISupports implementation
 
@@ -1108,20 +1109,20 @@ nsXULTreeItemAccessibleBase::GetCellName
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeItemAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULTreeItemAccessible::
-  nsXULTreeItemAccessible(nsIContent *aContent, nsIWeakReference *aShell,
-                          nsAccessible *aParent, nsITreeBoxObject *aTree,
-                          nsITreeView *aTreeView, PRInt32 aRow) :
-  nsXULTreeItemAccessibleBase(aContent, aShell, aParent, aTree, aTreeView, aRow)
+  nsXULTreeItemAccessible(nsIContent* aContent, nsDocAccessible* aDoc,
+                          nsAccessible* aParent, nsITreeBoxObject* aTree,
+                          nsITreeView* aTreeView, PRInt32 aRow) :
+  nsXULTreeItemAccessibleBase(aContent, aDoc, aParent, aTree, aTreeView, aRow)
 {
   mColumn = nsCoreUtils::GetFirstSensibleColumn(mTree);
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeItemAccessible: nsISupports implementation
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(nsXULTreeItemAccessible)
@@ -1226,18 +1227,18 @@ nsXULTreeItemAccessible::CacheChildren()
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 //  nsXULTreeColumnsAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULTreeColumnsAccessible::
-  nsXULTreeColumnsAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsXULColumnsAccessible(aContent, aShell)
+  nsXULTreeColumnsAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsXULColumnsAccessible(aContent, aDoc)
 {
 }
 
 nsAccessible*
 nsXULTreeColumnsAccessible::GetSiblingAtOffset(PRInt32 aOffset,
                                                nsresult* aError) const
 {
   if (aOffset < 0)
--- a/accessible/src/xul/nsXULTreeAccessible.h
+++ b/accessible/src/xul/nsXULTreeAccessible.h
@@ -62,17 +62,17 @@ const PRUint32 kDefaultTreeCacheSize = 2
 }
 
 class nsXULTreeAccessible : public nsAccessibleWrap
 {
 public:
   using nsAccessible::GetChildCount;
   using nsAccessible::GetChildAt;
 
-  nsXULTreeAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULTreeAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsISupports and cycle collection
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(nsXULTreeAccessible,
                                            nsAccessible)
 
   // nsIAccessible
   NS_IMETHOD GetValue(nsAString& aValue);
@@ -175,19 +175,19 @@ NS_DEFINE_STATIC_IID_ACCESSOR(nsXULTreeA
   { 0x94, 0x0b, 0xb1, 0xe6, 0xb0, 0x83, 0x1d, 0xfc }  \
 }
 
 class nsXULTreeItemAccessibleBase : public nsAccessibleWrap
 {
 public:
   using nsAccessible::GetParent;
 
-  nsXULTreeItemAccessibleBase(nsIContent *aContent, nsIWeakReference *aShell,
-                              nsAccessible *aParent, nsITreeBoxObject *aTree,
-                              nsITreeView *aTreeView, PRInt32 aRow);
+  nsXULTreeItemAccessibleBase(nsIContent* aContent, nsDocAccessible* aDoc,
+                              nsAccessible* aParent, nsITreeBoxObject* aTree,
+                              nsITreeView* aTreeView, PRInt32 aRow);
 
   // nsISupports and cycle collection
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(nsXULTreeItemAccessibleBase,
                                            nsAccessibleWrap)
 
   // nsIAccessible
   NS_IMETHOD GetBounds(PRInt32 *aX, PRInt32 *aY,
@@ -270,19 +270,19 @@ NS_DEFINE_STATIC_IID_ACCESSOR(nsXULTreeI
 
 
 /**
  * Accessible class for items for XUL tree.
  */
 class nsXULTreeItemAccessible : public nsXULTreeItemAccessibleBase
 {
 public:
-  nsXULTreeItemAccessible(nsIContent *aContent, nsIWeakReference *aShell,
-                          nsAccessible *aParent, nsITreeBoxObject *aTree,
-                          nsITreeView *aTreeView, PRInt32 aRow);
+  nsXULTreeItemAccessible(nsIContent* aContent, nsDocAccessible* aDoc,
+                          nsAccessible* aParent, nsITreeBoxObject* aTree,
+                          nsITreeView* aTreeView, PRInt32 aRow);
 
   // nsISupports and cycle collection
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(nsXULTreeItemAccessible,
                                            nsXULTreeItemAccessibleBase)
 
   NS_IMETHOD GetName(nsAString& aName);
 
@@ -309,17 +309,17 @@ protected:
 
 
 /**
  * Accessible class for columns element of XUL tree.
  */
 class nsXULTreeColumnsAccessible : public nsXULColumnsAccessible
 {
 public:
-  nsXULTreeColumnsAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULTreeColumnsAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
 protected:
 
   // nsAccessible
   virtual nsAccessible* GetSiblingAtOffset(PRInt32 aOffset,
                                            nsresult *aError = nsnull) const;
 };
 
--- a/accessible/src/xul/nsXULTreeGridAccessible.cpp
+++ b/accessible/src/xul/nsXULTreeGridAccessible.cpp
@@ -52,18 +52,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeGridAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULTreeGridAccessible::
-  nsXULTreeGridAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
-  nsXULTreeAccessible(aContent, aShell)
+  nsXULTreeGridAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+  nsXULTreeAccessible(aContent, aDoc)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeGridAccessible: nsISupports implementation
 
 NS_IMPL_ISUPPORTS_INHERITED1(nsXULTreeGridAccessible,
                              nsXULTreeAccessible,
@@ -600,32 +600,32 @@ nsXULTreeGridAccessible::NativeRole()
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeGridAccessible: nsXULTreeAccessible implementation
 
 already_AddRefed<nsAccessible>
 nsXULTreeGridAccessible::CreateTreeItemAccessible(PRInt32 aRow)
 {
   nsRefPtr<nsAccessible> accessible =
-    new nsXULTreeGridRowAccessible(mContent, mWeakShell, this, mTree,
+    new nsXULTreeGridRowAccessible(mContent, mDoc, this, mTree,
                                    mTreeView, aRow);
 
   return accessible.forget();
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeGridRowAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULTreeGridRowAccessible::
-  nsXULTreeGridRowAccessible(nsIContent *aContent, nsIWeakReference *aShell,
-                             nsAccessible *aTreeAcc, nsITreeBoxObject* aTree,
-                             nsITreeView *aTreeView, PRInt32 aRow) :
-  nsXULTreeItemAccessibleBase(aContent, aShell, aTreeAcc, aTree, aTreeView, aRow)
+  nsXULTreeGridRowAccessible(nsIContent* aContent, nsDocAccessible* aDoc,
+                             nsAccessible* aTreeAcc, nsITreeBoxObject* aTree,
+                             nsITreeView* aTreeView, PRInt32 aRow) :
+  nsXULTreeItemAccessibleBase(aContent, aDoc, aTreeAcc, aTree, aTreeView, aRow)
 {
   mAccessibleCache.Init(kDefaultTreeCacheSize);
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeGridRowAccessible: nsISupports and cycle collection implementation
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(nsXULTreeGridRowAccessible)
@@ -756,21 +756,21 @@ nsXULTreeGridRowAccessible::GetCellAcces
   NS_PRECONDITION(aColumn, "No tree column!");
 
   void* key = static_cast<void*>(aColumn);
   nsAccessible* cachedCell = mAccessibleCache.GetWeak(key);
   if (cachedCell)
     return cachedCell;
 
   nsRefPtr<nsAccessible> cell =
-    new nsXULTreeGridCellAccessibleWrap(mContent, mWeakShell, this, mTree,
+    new nsXULTreeGridCellAccessibleWrap(mContent, mDoc, this, mTree,
                                         mTreeView, mRow, aColumn);
   if (cell) {
     if (mAccessibleCache.Put(key, cell)) {
-      if (GetDocAccessible()->BindToDocument(cell, nsnull))
+      if (Document()->BindToDocument(cell, nsnull))
         return cell;
 
       mAccessibleCache.Remove(key);
     }
   }
 
   return nsnull;
 }
@@ -806,21 +806,21 @@ nsXULTreeGridRowAccessible::CacheChildre
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeGridCellAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULTreeGridCellAccessible::
-nsXULTreeGridCellAccessible(nsIContent *aContent, nsIWeakReference *aShell,
-                            nsXULTreeGridRowAccessible *aRowAcc,
-                            nsITreeBoxObject *aTree, nsITreeView *aTreeView,
-                            PRInt32 aRow, nsITreeColumn* aColumn) :
-  nsLeafAccessible(aContent, aShell), mTree(aTree),
+  nsXULTreeGridCellAccessible(nsIContent* aContent, nsDocAccessible* aDoc,
+                              nsXULTreeGridRowAccessible* aRowAcc,
+                              nsITreeBoxObject* aTree, nsITreeView* aTreeView,
+                              PRInt32 aRow, nsITreeColumn* aColumn) :
+  nsLeafAccessible(aContent, aDoc), mTree(aTree),
   mTreeView(aTreeView), mRow(aRow), mColumn(aColumn)
 {
   mParent = aRowAcc;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeGridCellAccessible: nsISupports implementation
 
@@ -1060,30 +1060,29 @@ nsXULTreeGridCellAccessible::GetRowExten
 }
 
 NS_IMETHODIMP
 nsXULTreeGridCellAccessible::GetColumnHeaderCells(nsIArray **aHeaderCells)
 {
   NS_ENSURE_ARG_POINTER(aHeaderCells);
   *aHeaderCells = nsnull;
 
-  if (IsDefunct())
+  if (IsDefunct() || !mDoc)
     return NS_ERROR_FAILURE;
 
   nsresult rv = NS_OK;
   nsCOMPtr<nsIMutableArray> headerCells =
     do_CreateInstance(NS_ARRAY_CONTRACTID, &rv);
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCOMPtr<nsIDOMElement> columnElm;
   mColumn->GetElement(getter_AddRefs(columnElm));
 
   nsCOMPtr<nsIContent> columnContent(do_QueryInterface(columnElm));
-  nsAccessible *headerCell =
-    GetAccService()->GetAccessibleInWeakShell(columnContent, mWeakShell);
+  nsAccessible *headerCell = mDoc->GetAccessible(columnContent);
 
   if (headerCell)
     headerCells->AppendElement(static_cast<nsIAccessible*>(headerCell),
                                false);
 
   NS_ADDREF(*aHeaderCells = headerCells);
   return NS_OK;
 }
--- a/accessible/src/xul/nsXULTreeGridAccessible.h
+++ b/accessible/src/xul/nsXULTreeGridAccessible.h
@@ -45,17 +45,17 @@
 
 /**
  * Represents accessible for XUL tree in the case when it has multiple columns.
  */
 class nsXULTreeGridAccessible : public nsXULTreeAccessible,
                                 public nsIAccessibleTable
 {
 public:
-  nsXULTreeGridAccessible(nsIContent *aContent, nsIWeakReference *aShell);
+  nsXULTreeGridAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessibleTable
   NS_DECL_NSIACCESSIBLETABLE
 
   // nsAccessible
@@ -73,19 +73,19 @@ protected:
  * multiple columns.
  */
 class nsXULTreeGridRowAccessible : public nsXULTreeItemAccessibleBase
 {
 public:
   using nsAccessible::GetChildCount;
   using nsAccessible::GetChildAt;
 
-  nsXULTreeGridRowAccessible(nsIContent *aContent, nsIWeakReference *aShell,
-                             nsAccessible *aParent, nsITreeBoxObject *aTree,
-                             nsITreeView *aTreeView, PRInt32 aRow);
+  nsXULTreeGridRowAccessible(nsIContent* aContent, nsDocAccessible* aDoc,
+                             nsAccessible* aParent, nsITreeBoxObject* aTree,
+                             nsITreeView* aTreeView, PRInt32 aRow);
 
   // nsISupports and cycle collection
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(nsXULTreeGridRowAccessible,
                                            nsXULTreeItemAccessibleBase)
 
   // nsAccessNode
   virtual void Shutdown();
@@ -127,19 +127,19 @@ protected:
 }
 
 class nsXULTreeGridCellAccessible : public nsLeafAccessible,
                                     public nsIAccessibleTableCell
 {
 public:
   using nsAccessible::GetParent;
 
-  nsXULTreeGridCellAccessible(nsIContent *aContent, nsIWeakReference *aShell,
-                              nsXULTreeGridRowAccessible *aRowAcc,
-                              nsITreeBoxObject *aTree, nsITreeView *aTreeView,
+  nsXULTreeGridCellAccessible(nsIContent* aContent, nsDocAccessible* aDoc,
+                              nsXULTreeGridRowAccessible* aRowAcc,
+                              nsITreeBoxObject* aTree, nsITreeView* aTreeView,
                               PRInt32 aRow, nsITreeColumn* aColumn);
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(nsXULTreeGridCellAccessible,
                                            nsLeafAccessible)
 
   // nsIAccessible
--- a/browser/locales/en-US/updater/updater.ini
+++ b/browser/locales/en-US/updater/updater.ini
@@ -1,8 +1,6 @@
 ; This file is in the UTF-8 encoding
 ; All strings must be less than 600 chars.
 [Strings]
 TitleText=%MOZ_APP_DISPLAYNAME% Update
 InfoText=%MOZ_APP_DISPLAYNAME% is installing your updates and will start in a few moments…
-
-[MaintenanceServiceStrings]
-ServiceDescription=The Mozilla Maintenance Service ensures that you have the latest and most secure version of Mozilla Firefox on your computer. Keeping Firefox up to date is very important for your online security, and Mozilla strongly recommends that you keep this service enabled.
+MozillaMaintenanceDescription=The Mozilla Maintenance Service ensures that you have the latest and most secure version of Mozilla Firefox on your computer. Keeping Firefox up to date is very important for your online security, and Mozilla strongly recommends that you keep this service enabled.
--- a/browser/themes/winstripe/browser.css
+++ b/browser/themes/winstripe/browser.css
@@ -711,32 +711,44 @@ menuitem.bookmark-item {
   border: none !important;
   box-shadow: none !important;
 }
 
 @navbarLargeIcons@ .toolbarbutton-1 {
   margin: 1px 3px;
 }
 
-@navbarLargeIcons@ .toolbarbutton-1 > .toolbarbutton-menubutton-dropmarker {
-  -moz-border-start-style: none;
-}
-
 @navbarLargeIcons@ .toolbarbutton-1 > .toolbarbutton-menubutton-button:-moz-locale-dir(ltr),
 @navbarLargeIcons@ .toolbarbutton-1 > .toolbarbutton-menubutton-dropmarker:-moz-locale-dir(rtl) {
   border-top-right-radius: 0;
   border-bottom-right-radius: 0;
 }
 
 @navbarLargeIcons@ .toolbarbutton-1 > .toolbarbutton-menubutton-button:-moz-locale-dir(rtl),
 @navbarLargeIcons@ .toolbarbutton-1 > .toolbarbutton-menubutton-dropmarker:-moz-locale-dir(ltr) {
   border-top-left-radius: 0;
   border-bottom-left-radius: 0;
 }
 
+@navbarLargeIcons@ .toolbarbutton-1 > .toolbarbutton-menu-dropmarker,
+@navbarLargeIcons@ .toolbarbutton-1 > .toolbarbutton-menubutton-dropmarker {
+  list-style-image: url("chrome://browser/skin/toolbarbutton-dropdown-arrow.png");
+}
+
+@navbarLargeIcons@ .toolbarbutton-1 > .toolbarbutton-menubutton-dropmarker {
+  -moz-border-start: none;
+  padding-left: 2px;
+  padding-right: 2px;
+}
+
+@navbarLargeIcons@ .toolbarbutton-1 > .toolbarbutton-menu-dropmarker {
+  margin-top: 0;
+  -moz-margin-start: 2px;
+}
+
 @navbarLargeIcons@ .toolbarbutton-1[disabled="true"] {
   opacity: .4;
 }
 
 @navbarLargeIcons@ .toolbarbutton-1[disabled="true"] > .toolbarbutton-menubutton-button > .toolbarbutton-icon,
 @navbarLargeIcons@ .toolbarbutton-1[disabled="true"] > .toolbarbutton-icon {
   opacity: 1;
 }
@@ -2047,30 +2059,30 @@ richlistitem[type~="action"][actiontype=
 }
 
 #alltabs-button {
   list-style-image: url("chrome://browser/skin/tabbrowser/alltabs.png");
   -moz-image-region: rect(0, 14px, 16px, 0);
 }
 
 #alltabs-button[type="menu"] {
-  list-style-image: url("chrome://browser/skin/mainwindow-dropdown-arrow.png");
-  -moz-image-region: rect(0, 13px, 11px, 0);
+  list-style-image: url("chrome://browser/skin/toolbarbutton-dropdown-arrow.png");
+  -moz-image-region: auto;
 }
 
 %ifdef WINSTRIPE_AERO
 #TabsToolbar > #alltabs-button[type="menu"]:-moz-system-metric(windows-compositor):not(:-moz-lwtheme),
 #TabsToolbar > toolbarpaletteitem > #alltabs-button[type="menu"]:-moz-system-metric(windows-compositor):not(:-moz-lwtheme),
 %endif
 #alltabs-button[type="menu"]:-moz-lwtheme-brighttext {
-  list-style-image: url(chrome://browser/skin/mainwindow-dropdown-arrow-inverted.png);
+  list-style-image: url("chrome://browser/skin/toolbarbutton-dropdown-arrow-inverted.png");
 }
 
 #alltabs-button[type="menu"] > .toolbarbutton-icon {
-  margin: 3px 0;
+  margin: 0 2px;
 }
 
 #alltabs-button[type="menu"] > .toolbarbutton-menu-dropmarker {
   display: none;
 }
 
 /* All tabs menupopup */
 .alltabs-item > .menu-iconic-left > .menu-iconic-icon {
--- a/browser/themes/winstripe/jar.mn
+++ b/browser/themes/winstripe/jar.mn
@@ -19,30 +19,31 @@ browser.jar:
         skin/classic/browser/fullscreen-video.css
         skin/classic/browser/Geolocation-16.png
         skin/classic/browser/Geolocation-64.png
         skin/classic/browser/Info.png                                (Info.png)
         skin/classic/browser/identity.png                            (identity.png)
         skin/classic/browser/keyhole-forward-mask.svg
         skin/classic/browser/KUI-background.png
         skin/classic/browser/KUI-close.png
-        skin/classic/browser/mainwindow-dropdown-arrow.png
-        skin/classic/browser/mainwindow-dropdown-arrow-inverted.png
         skin/classic/browser/pageInfo.css
         skin/classic/browser/pageInfo.png                            (pageInfo.png)
         skin/classic/browser/page-livemarks.png                      (feeds/feedIcon16.png)
         skin/classic/browser/livemark-item.png                       (livemark-item.png)
         skin/classic/browser/livemark-folder.png                     (livemark-folder.png)
         skin/classic/browser/Privacy-16.png
         skin/classic/browser/Privacy-48.png
         skin/classic/browser/reload-stop-go.png
         skin/classic/browser/Secure24.png                            (Secure24.png)
         skin/classic/browser/Toolbar.png                             (Toolbar.png)
         skin/classic/browser/Toolbar-inverted.png
+        skin/classic/browser/toolbarbutton-dropdown-arrow.png
+        skin/classic/browser/toolbarbutton-dropdown-arrow-inverted.png
 *       skin/classic/browser/searchbar.css                           (searchbar.css)
+        skin/classic/browser/searchbar-dropdown-arrow.png
         skin/classic/browser/section_collapsed.png
         skin/classic/browser/section_collapsed-rtl.png
         skin/classic/browser/section_expanded.png
         skin/classic/browser/setDesktopBackground.css
         skin/classic/browser/menu-back.png                           (menu-back.png)
         skin/classic/browser/menu-forward.png                        (menu-forward.png)
         skin/classic/browser/monitor.png
         skin/classic/browser/monitor_16-10.png
@@ -184,30 +185,31 @@ browser.jar:
         skin/classic/aero/browser/fullscreen-video.css
         skin/classic/aero/browser/Geolocation-16.png
         skin/classic/aero/browser/Geolocation-64.png
         skin/classic/aero/browser/Info.png                           (Info-aero.png)
         skin/classic/aero/browser/identity.png                       (identity-aero.png)
         skin/classic/aero/browser/keyhole-forward-mask.svg
         skin/classic/aero/browser/KUI-background.png
         skin/classic/aero/browser/KUI-close.png
-        skin/classic/aero/browser/mainwindow-dropdown-arrow.png      (mainwindow-dropdown-arrow-aero.png)
-        skin/classic/aero/browser/mainwindow-dropdown-arrow-inverted.png
         skin/classic/aero/browser/pageInfo.css
         skin/classic/aero/browser/pageInfo.png                       (pageInfo-aero.png)
         skin/classic/aero/browser/page-livemarks.png                 (feeds/feedIcon16-aero.png)
         skin/classic/aero/browser/livemark-item.png                  (livemark-item-aero.png)
         skin/classic/aero/browser/livemark-folder.png                (livemark-folder-aero.png)
         skin/classic/aero/browser/Privacy-16.png                     (Privacy-16-aero.png)
         skin/classic/aero/browser/Privacy-48.png                     (Privacy-48-aero.png)
         skin/classic/aero/browser/reload-stop-go.png
         skin/classic/aero/browser/Secure24.png                       (Secure24-aero.png)
         skin/classic/aero/browser/Toolbar.png
         skin/classic/aero/browser/Toolbar-inverted.png
+        skin/classic/aero/browser/toolbarbutton-dropdown-arrow.png
+        skin/classic/aero/browser/toolbarbutton-dropdown-arrow-inverted.png
 *       skin/classic/aero/browser/searchbar.css                      (searchbar.css)
+        skin/classic/aero/browser/searchbar-dropdown-arrow.png       (searchbar-dropdown-arrow-aero.png)
         skin/classic/aero/browser/section_collapsed.png
         skin/classic/aero/browser/section_collapsed-rtl.png
         skin/classic/aero/browser/section_expanded.png
         skin/classic/aero/browser/setDesktopBackground.css
         skin/classic/aero/browser/menu-back.png                      (menu-back-aero.png)
         skin/classic/aero/browser/menu-forward.png                   (menu-forward-aero.png)
         skin/classic/aero/browser/monitor.png
         skin/classic/aero/browser/monitor_16-10.png
deleted file mode 100644
index ed1791641307105edbe69325356ffc00396dc87b..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391
GIT binary patch
literal 0
Hc$@<O00001
old mode 100755
new mode 100644
rename from browser/themes/winstripe/mainwindow-dropdown-arrow-aero.png
rename to browser/themes/winstripe/searchbar-dropdown-arrow-aero.png
old mode 100755
new mode 100644
rename from browser/themes/winstripe/mainwindow-dropdown-arrow.png
rename to browser/themes/winstripe/searchbar-dropdown-arrow.png
--- a/browser/themes/winstripe/searchbar.css
+++ b/browser/themes/winstripe/searchbar.css
@@ -34,17 +34,17 @@
 
 .searchbar-engine-button > .button-box {
   -moz-appearance: none;
   padding: 0;
   border: 0;
 }
 
 .searchbar-dropmarker-image {
-  list-style-image: url(mainwindow-dropdown-arrow.png);
+  list-style-image: url("chrome://browser/skin/searchbar-dropdown-arrow.png");
   -moz-image-region: rect(0, 13px, 11px, 0);
 }
 
 .searchbar-engine-button[open="true"] > .searchbar-dropmarker-image {
   -moz-image-region: rect(0, 26px, 11px, 13px);
 }
 
 
new file mode 100644
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..f3261f1da05abdf5fdabdfa17083243deb74b78d
GIT binary patch
literal 221
zc%17D@N?(olHy`uVBq!ia0vp^oIuRZ!3HF6%}!4MQjEnx?oJHr&dIz4a@dl*-CY>|
zgW!U_%O``>7kES#Gca%qgD@k*tT_@O14=x7UD@w2aq<fD?o2z91Qd$(ba4!kxLkVH
zkgGXBfaQX?&YH>IPfM;X`;@eM!`20H50@JzxGbMjX~4hdW6^xxwpFukyROPQ#$bEw
zOiZ7Gv3Sq#b%%w6UDmAKDkiACZ14NJ{q-NX<~)4PCzDvu7JpdGd79g?*n>ce7(8A5
KT-G@yGywn~Buftf
new file mode 100644
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..a7abe739634da367dd3af96dacbe8c4c1327f071
GIT binary patch
literal 287
zc%17D@N?(olHy`uVBq!ia0vp^oIuRZ!3HF6%}!4MQjEnx?oJHr&dIz4a@dl*-CY>|
zgW!U_%O``>7kES#Gca%qgD@k*tT_@O14=x7UD@w2aq<dEaWpHd1BK>$x;TbNTrNGe
zmg`UgL+iux$G6qhn(H5IxV?4OTC>PFqnUeT^beetVC#0=z~NS?VVog#`#|zcrA6%b
z3LX@yd}TcS|0!FBMc?){CVyw8duyNgJmpW7ou_L?!`u*`>gI=w?q!AdZWM`hE9#u=
zTr`K-TD+q%V}E4pwa{B%Z%2GDw9mP2tiY6{viFq-m)ql$zCi(XDjz%VeGvZRRKx6P
a!zgv7?)`BlUuU3G89ZJ6T-G@yGywp8IB1*z
--- a/caps/src/nsSecurityManagerFactory.cpp
+++ b/caps/src/nsSecurityManagerFactory.cpp
@@ -332,17 +332,17 @@ nsSecurityNameSet::InitializeNameSet(nsI
 
     /*
      * Find Object.prototype's class by walking up the global object's
      * prototype chain.
      */
     JSObject *obj = global;
     JSObject *proto;
     JSAutoRequest ar(cx);
-    while ((proto = JS_GetPrototype(cx, obj)) != nsnull)
+    while ((proto = JS_GetPrototype(obj)) != nsnull)
         obj = proto;
     JSClass *objectClass = JS_GetClass(obj);
 
     jsval v;
     if (!JS_GetProperty(cx, global, "netscape", &v))
         return NS_ERROR_FAILURE;
     JSObject *securityObj;
     if (JSVAL_IS_OBJECT(v)) {
--- a/content/xbl/src/nsXBLBinding.cpp
+++ b/content/xbl/src/nsXBLBinding.cpp
@@ -103,17 +103,17 @@
 /***********************************************************************/
 //
 // The JS class for XBLBinding
 //
 static void
 XBLFinalize(JSContext *cx, JSObject *obj)
 {
   nsXBLDocumentInfo* docInfo =
-    static_cast<nsXBLDocumentInfo*>(::JS_GetPrivate(cx, obj));
+    static_cast<nsXBLDocumentInfo*>(::JS_GetPrivate(obj));
   NS_RELEASE(docInfo);
   
   nsXBLJSClass* c = static_cast<nsXBLJSClass*>(::JS_GetClass(obj));
   c->Drop();
 }
 
 static JSBool
 XBLResolve(JSContext *cx, JSObject *obj, jsid id, uintN flags,
@@ -130,18 +130,17 @@ XBLResolve(JSContext *cx, JSObject *obj,
   *objp = NULL;
 
   if (!JSID_IS_STRING(id)) {
     return JS_TRUE;
   }
 
   nsDependentJSString fieldName(id);
 
-  jsval slotVal;
-  ::JS_GetReservedSlot(cx, obj, 0, &slotVal);
+  jsval slotVal = ::JS_GetReservedSlot(obj, 0);
   NS_ASSERTION(!JSVAL_IS_VOID(slotVal), "How did that happen?");
     
   nsXBLPrototypeBinding* protoBinding =
     static_cast<nsXBLPrototypeBinding*>(JSVAL_TO_PRIVATE(slotVal));
   NS_ASSERTION(protoBinding, "Must have prototype binding!");
 
   nsXBLProtoImplField* field = protoBinding->FindField(fieldName);
   if (!field) {
@@ -156,17 +155,17 @@ XBLResolve(JSContext *cx, JSObject *obj,
   
   if (~nodeClass->flags &
       (JSCLASS_HAS_PRIVATE | JSCLASS_PRIVATE_IS_NSISUPPORTS)) {
     nsDOMClassInfo::ThrowJSException(cx, NS_ERROR_UNEXPECTED);
     return JS_FALSE;
   }
 
   nsCOMPtr<nsIXPConnectWrappedNative> xpcWrapper =
-    do_QueryInterface(static_cast<nsISupports*>(::JS_GetPrivate(cx, origObj)));
+    do_QueryInterface(static_cast<nsISupports*>(::JS_GetPrivate(origObj)));
   if (!xpcWrapper) {
     // Looks like whatever |origObj| is it's not our nsIContent.  It might well
     // be the proto our binding installed, however, where the private is the
     // nsXBLDocumentInfo, so just baul out quietly.  Do NOT throw an exception
     // here.
     // We could make this stricter by checking the class maybe, but whatever
     return JS_TRUE;
   }
@@ -1083,53 +1082,49 @@ nsXBLBinding::ChangeDocument(nsIDocument
               JSObject* proto;
               JSAutoRequest ar(cx);
               JSAutoEnterCompartment ac;
               if (!ac.enter(cx, scriptObject)) {
                 return;
               }
 
               for ( ; true; base = proto) { // Will break out on null proto
-                proto = ::JS_GetPrototype(cx, base);
+                proto = ::JS_GetPrototype(base);
                 if (!proto) {
                   break;
                 }
 
                 JSClass* clazz = ::JS_GetClass(proto);
                 if (!clazz ||
                     (~clazz->flags &
                      (JSCLASS_HAS_PRIVATE | JSCLASS_PRIVATE_IS_NSISUPPORTS)) ||
                     JSCLASS_RESERVED_SLOTS(clazz) != 1 ||
                     clazz->resolve != (JSResolveOp)XBLResolve ||
                     clazz->finalize != XBLFinalize) {
                   // Clearly not the right class
                   continue;
                 }
 
                 nsRefPtr<nsXBLDocumentInfo> docInfo =
-                  static_cast<nsXBLDocumentInfo*>(::JS_GetPrivate(cx, proto));
+                  static_cast<nsXBLDocumentInfo*>(::JS_GetPrivate(proto));
                 if (!docInfo) {
                   // Not the proto we seek
                   continue;
                 }
 
-                jsval protoBinding;
-                if (!::JS_GetReservedSlot(cx, proto, 0, &protoBinding)) {
-                  NS_ERROR("Really shouldn't happen");
-                  continue;
-                }
+                jsval protoBinding = ::JS_GetReservedSlot(proto, 0);
 
                 if (JSVAL_TO_PRIVATE(protoBinding) != mPrototypeBinding) {
                   // Not the right binding
                   continue;
                 }
 
                 // Alright!  This is the right prototype.  Pull it out of the
                 // proto chain.
-                JSObject* grandProto = ::JS_GetPrototype(cx, proto);
+                JSObject* grandProto = ::JS_GetPrototype(proto);
                 ::JS_SetPrototype(cx, base, grandProto);
                 break;
               }
 
               mPrototypeBinding->UndefineFields(cx, scriptObject);
 
               // Don't remove the reference from the document to the
               // wrapper here since it'll be removed by the element
@@ -1219,17 +1214,17 @@ nsXBLBinding::DoInitJSClass(JSContext *c
 
   JSAutoEnterCompartment ac;
   if (!ac.enter(cx, global)) {
     return NS_ERROR_FAILURE;
   }
 
   if (obj) {
     // Retrieve the current prototype of obj.
-    parent_proto = ::JS_GetPrototype(cx, obj);
+    parent_proto = ::JS_GetPrototype(obj);
     if (parent_proto) {
       // We need to create a unique classname based on aClassName and
       // parent_proto.  Append a space (an invalid URI character) to ensure that
       // we don't have accidental collisions with the case when parent_proto is
       // null and aClassName ends in some bizarre numbers (yeah, it's unlikely).
       jsid parent_proto_id;
       if (!::JS_GetObjectId(cx, parent_proto, &parent_proto_id)) {
         // Probably OOM
@@ -1322,26 +1317,20 @@ nsXBLBinding::DoInitJSClass(JSContext *c
 
     // Keep this proto binding alive while we're alive.  Do this first so that
     // we can guarantee that in XBLFinalize this will be non-null.
     // Note that we can't just store aProtoBinding in the private and
     // addref/release the nsXBLDocumentInfo through it, because cycle
     // collection doesn't seem to work right if the private is not an
     // nsISupports.
     nsXBLDocumentInfo* docInfo = aProtoBinding->XBLDocumentInfo();
-    ::JS_SetPrivate(cx, proto, docInfo);
+    ::JS_SetPrivate(proto, docInfo);
     NS_ADDREF(docInfo);
 
-    if (!::JS_SetReservedSlot(cx, proto, 0, PRIVATE_TO_JSVAL(aProtoBinding))) {
-      (nsXBLService::gClassTable)->Remove(&key);
-
-      // |c| will get dropped when |proto| is finalized
-
-      return NS_ERROR_OUT_OF_MEMORY;
-    }
+    ::JS_SetReservedSlot(proto, 0, PRIVATE_TO_JSVAL(aProtoBinding));
 
     *aClassObject = proto;
   }
   else {
     proto = JSVAL_TO_OBJECT(val);
   }
 
   if (obj) {
--- a/content/xbl/src/nsXBLDocumentInfo.cpp
+++ b/content/xbl/src/nsXBLDocumentInfo.cpp
@@ -117,17 +117,17 @@ nsXBLDocGlobalObject::doCheckAccess(JSCo
   if (!ssm) {
     ::JS_ReportError(cx, "Unable to verify access to a global object property.");
     return JS_FALSE;
   }
 
   // Make sure to actually operate on our object, and not some object further
   // down on the proto chain.
   while (JS_GetClass(obj) != &nsXBLDocGlobalObject::gSharedGlobalClass) {
-    obj = ::JS_GetPrototype(cx, obj);
+    obj = ::JS_GetPrototype(obj);
     if (!obj) {
       ::JS_ReportError(cx, "Invalid access to a global object property.");
       return JS_FALSE;
     }
   }
 
   nsresult rv = ssm->CheckPropertyAccess(cx, obj, JS_GetClass(obj)->name,
                                          id, accessType);
@@ -163,17 +163,17 @@ nsXBLDocGlobalObject_checkAccess(JSConte
 
   return nsXBLDocGlobalObject::
     doCheckAccess(cx, obj, id, translated);
 }
 
 static void
 nsXBLDocGlobalObject_finalize(JSContext *cx, JSObject *obj)
 {
-  nsISupports *nativeThis = (nsISupports*)JS_GetPrivate(cx, obj);
+  nsISupports *nativeThis = (nsISupports*)JS_GetPrivate(obj);
 
   nsCOMPtr<nsIScriptGlobalObject> sgo(do_QueryInterface(nativeThis));
 
   if (sgo)
     sgo->OnFinalize(obj);
 
   // The addref was part of JSObject construction
   NS_RELEASE(nativeThis);
@@ -329,17 +329,17 @@ nsXBLDocGlobalObject::EnsureScriptEnviro
   rv = xpc_CreateGlobalObject(cx, &gSharedGlobalClass, principal, nsnull,
                               false, &mJSObject, &compartment);
   NS_ENSURE_SUCCESS(rv, NS_OK);
 
   ::JS_SetGlobalObject(cx, mJSObject);
 
   // Add an owning reference from JS back to us. This'll be
   // released when the JSObject is finalized.
-  ::JS_SetPrivate(cx, mJSObject, this);
+  ::JS_SetPrivate(mJSObject, this);
   NS_ADDREF(this);
   return NS_OK;
 }
 
 nsIScriptContext *
 nsXBLDocGlobalObject::GetContext()
 {
   // This whole fragile mess is predicated on the fact that
--- a/content/xul/document/src/nsXULPrototypeDocument.cpp
+++ b/content/xul/document/src/nsXULPrototypeDocument.cpp
@@ -114,17 +114,17 @@ protected:
 nsIPrincipal* nsXULPrototypeDocument::gSystemPrincipal;
 nsXULPDGlobalObject* nsXULPrototypeDocument::gSystemGlobal;
 PRUint32 nsXULPrototypeDocument::gRefCnt;
 
 
 void
 nsXULPDGlobalObject_finalize(JSContext *cx, JSObject *obj)
 {
-    nsISupports *nativeThis = (nsISupports*)JS_GetPrivate(cx, obj);
+    nsISupports *nativeThis = (nsISupports*)JS_GetPrivate(obj);
 
     nsCOMPtr<nsIScriptGlobalObject> sgo(do_QueryInterface(nativeThis));
 
     if (sgo) {
         sgo->OnFinalize(obj);
     }
 
     // The addref was part of JSObject construction
@@ -742,17 +742,17 @@ nsXULPDGlobalObject::EnsureScriptEnviron
     rv = xpc_CreateGlobalObject(cx, &gSharedGlobalClass, principal, nsnull,
                                 false, &newGlob, &compartment);
     NS_ENSURE_SUCCESS(rv, NS_OK);
 
     ::JS_SetGlobalObject(cx, newGlob);
 
     // Add an owning reference from JS back to us. This'll be
     // released when the JSObject is finalized.
-    ::JS_SetPrivate(cx, newGlob, this);
+    ::JS_SetPrivate(newGlob, this);
     NS_ADDREF(this);
   }
 
   NS_ENSURE_SUCCESS(rv, NS_OK);
   rv = SetScriptContext(lang_id, ctxNew);
   NS_ENSURE_SUCCESS(rv, NS_OK);
   return NS_OK;
 }
--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@@ -4891,18 +4891,18 @@ nsDOMClassInfo::PostCreatePrototype(JSCo
   // sObjectClass, so compute it here. We assume that nobody has had a
   // chance to monkey around with proto's prototype chain before this.
   if (!sObjectClass) {
     FindObjectClass(proto);
     NS_ASSERTION(sObjectClass && !strcmp(sObjectClass->name, "Object"),
                  "Incorrect object class!");
   }
 
-  NS_ASSERTION(::JS_GetPrototype(cx, proto) &&
-               JS_GetClass(::JS_GetPrototype(cx, proto)) == sObjectClass,
+  NS_ASSERTION(::JS_GetPrototype(proto) &&
+               JS_GetClass(::JS_GetPrototype(proto)) == sObjectClass,
                "Hmm, somebody did something evil?");
 
 #ifdef DEBUG
   if (mData->mHasClassInterface && mData->mProtoChainInterface &&
       mData->mProtoChainInterface != &NS_GET_IID(nsISupports)) {
     nsCOMPtr<nsIInterfaceInfoManager>
       iim(do_GetService(NS_INTERFACEINFOMANAGER_SERVICE_CONTRACTID));
 
@@ -5199,20 +5199,20 @@ nsWindowSH::SecurityCheckOnAddDelProp(JS
 JSBool
 nsWindowSH::SecurityCheckOnSetProp(JSContext *cx, JSObject *obj, jsid id, JSBool strict,
                                    jsval *vp)
 {
   return SecurityCheckOnAddDelProp(cx, obj, id, vp);
 }
 
 static nsHTMLDocument*
-GetDocument(JSContext *cx, JSObject *obj)
+GetDocument(JSObject *obj)
 {
   return static_cast<nsHTMLDocument*>(
-    static_cast<nsIHTMLDocument*>(::JS_GetPrivate(cx, obj)));
+    static_cast<nsIHTMLDocument*>(::JS_GetPrivate(obj)));
 }
 
 // static
 JSBool
 nsWindowSH::GlobalScopePolluterNewResolve(JSContext *cx, JSObject *obj,
                                           jsid id, uintN flags,
                                           JSObject **objp)
 {
@@ -5221,27 +5221,27 @@ nsWindowSH::GlobalScopePolluterNewResolv
       !JSID_IS_STRING(id)) {
     // Nothing to do here if we're either assigning or declaring,
     // resolving a class name, doing a qualified resolve, or
     // resolving a number.
 
     return JS_TRUE;
   }
 
-  nsHTMLDocument *document = GetDocument(cx, obj);
+  nsHTMLDocument *document = GetDocument(obj);
 
   if (!document ||
       document->GetCompatibilityMode() != eCompatibility_NavQuirks) {
     // If we don't have a document, or if the document is not in
     // quirks mode, return early.
 
     return JS_TRUE;
   }
 
-  JSObject *proto = ::JS_GetPrototype(cx, obj);
+  JSObject *proto = ::JS_GetPrototype(obj);
   JSBool hasProp;
 
   if (!proto || !::JS_HasPropertyById(cx, proto, id, &hasProp) ||
       hasProp) {
     // No prototype, or the property exists on the prototype. Do
     // nothing.
 
     return JS_TRUE;
@@ -5281,27 +5281,27 @@ nsWindowSH::GlobalScopePolluterNewResolv
 // static
 void
 nsWindowSH::InvalidateGlobalScopePolluter(JSContext *cx, JSObject *obj)
 {
   JSObject *proto;
 
   JSAutoRequest ar(cx);
 
-  while ((proto = ::JS_GetPrototype(cx, obj))) {
+  while ((proto = ::JS_GetPrototype(obj))) {
     if (JS_GetClass(proto) == &sGlobalScopePolluterClass) {
-      nsIHTMLDocument *doc = (nsIHTMLDocument *)::JS_GetPrivate(cx, proto);
+      nsIHTMLDocument *doc = (nsIHTMLDocument *)::JS_GetPrivate(proto);
 
       NS_IF_RELEASE(doc);
 
-      ::JS_SetPrivate(cx, proto, nsnull);
+      ::JS_SetPrivate(proto, nsnull);
 
       // Pull the global scope polluter out of the prototype chain so
       // that it can be freed.
-      ::JS_SplicePrototype(cx, obj, ::JS_GetPrototype(cx, proto));
+      ::JS_SplicePrototype(cx, obj, ::JS_GetPrototype(proto));
 
       break;
     }
 
     obj = proto;
   }
 }
 
@@ -5323,34 +5323,32 @@ nsWindowSH::InstallGlobalScopePolluter(J
     return NS_ERROR_OUT_OF_MEMORY;
   }
 
   JSObject *o = obj, *proto;
 
   // Find the place in the prototype chain where we want this global
   // scope polluter (right before Object.prototype).
 
-  while ((proto = ::JS_GetPrototype(cx, o))) {
+  while ((proto = ::JS_GetPrototype(o))) {
     if (JS_GetClass(proto) == sObjectClass) {
       // Set the global scope polluters prototype to Object.prototype
       ::JS_SplicePrototype(cx, gsp, proto);
 
       break;
     }
 
     o = proto;
   }
 
   // And then set the prototype of the object whose prototype was
   // Object.prototype to be the global scope polluter.
   ::JS_SplicePrototype(cx, o, gsp);
 
-  if (!::JS_SetPrivate(cx, gsp, doc)) {
-    return NS_ERROR_UNEXPECTED;
-  }
+  ::JS_SetPrivate(gsp, doc);
 
   // The global scope polluter will release doc on destruction (or
   // invalidation).
   NS_ADDREF(doc);
 
   return NS_OK;
 }
 
@@ -5923,18 +5921,18 @@ nsDOMConstructor::HasInstance(nsIXPConne
     jsval val;
     if (!JS_GetProperty(cx, obj, "prototype", &val)) {
       return NS_ERROR_UNEXPECTED;
     }
 
     JS_ASSERT(!JSVAL_IS_PRIMITIVE(val));
     JSObject *dot_prototype = JSVAL_TO_OBJECT(val);
 
-    JSObject *proto = JS_GetPrototype(cx, dom_obj);
-    for ( ; proto; proto = JS_GetPrototype(cx, proto)) {
+    JSObject *proto = JS_GetPrototype(dom_obj);
+    for ( ; proto; proto = JS_GetPrototype(proto)) {
       if (proto == dot_prototype) {
         *bp = true;
         break;
       }
     }
 
     return NS_OK;
   }
@@ -6295,17 +6293,17 @@ ResolvePrototype(nsIXPConnect *aXPConnec
     }
 
     if (dot_prototype) {
       JSAutoEnterCompartment ac;
       if (!ac.enter(cx, dot_prototype)) {
         return NS_ERROR_UNEXPECTED;
       }
 
-      JSObject *xpc_proto_proto = ::JS_GetPrototype(cx, dot_prototype);
+      JSObject *xpc_proto_proto = ::JS_GetPrototype(dot_prototype);
 
       if (proto &&
           (!xpc_proto_proto ||
            JS_GetClass(xpc_proto_proto) == sObjectClass)) {
         if (!JS_WrapObject(cx, &proto) ||
             !JS_SetPrototype(cx, dot_prototype, proto)) {
           return NS_ERROR_UNEXPECTED;
         }
@@ -8145,17 +8143,17 @@ nsNamedArraySH::NewResolve(nsIXPConnectW
 
       JSAutoEnterCompartment ac;
 
       if (!ac.enter(cx, realObj)) {
         *_retval = false;
         return NS_ERROR_FAILURE;
       }
 
-      JSObject *proto = ::JS_GetPrototype(cx, realObj);
+      JSObject *proto = ::JS_GetPrototype(realObj);
 
       if (proto) {
         JSBool hasProp;
         if (!::JS_HasPropertyById(cx, proto, id, &hasProp)) {
           *_retval = false;
           return NS_ERROR_FAILURE;
         }
 
@@ -8722,22 +8720,19 @@ nsHTMLDocumentSH::GetDocumentAllNodeList
                                          nsContentList **nodeList)
 {
   // The document.all object is a mix of the node list returned by
   // document.getElementsByTagName("*") and a map of elements in the
   // document exposed by their id and/or name. To make access to the
   // node list part (i.e. access to elements by index) not walk the
   // document each time, we create a nsContentList and hold on to it
   // in a reserved slot (0) on the document.all JSObject.
-  jsval collection;
   nsresult rv = NS_OK;
 
-  if (!JS_GetReservedSlot(cx, obj, 0, &collection)) {
-    return JS_FALSE;
-  }
+  jsval collection = JS_GetReservedSlot(obj, 0);
 
   if (!JSVAL_IS_PRIMITIVE(collection)) {
     // We already have a node list in our reserved slot, use it.
     JSObject *obj = JSVAL_TO_OBJECT(collection);
     if (mozilla::dom::binding::HTMLCollection::objIsWrapper(obj)) {
       nsIHTMLCollection *native =
         mozilla::dom::binding::HTMLCollection::getNative(obj);
       NS_ADDREF(*nodeList = static_cast<nsContentList*>(native));
@@ -8763,19 +8758,17 @@ nsHTMLDocumentSH::GetDocumentAllNodeList
     nsCOMPtr<nsIXPConnectJSObjectHolder> holder;
     rv |= WrapNative(cx, JS_GetGlobalForScopeChain(cx),
                      static_cast<nsINodeList*>(list), list, false,
                      &collection, getter_AddRefs(holder));
 
     list.forget(nodeList);
 
     // ... and store it in our reserved slot.
-    if (!JS_SetReservedSlot(cx, obj, 0, collection)) {
-      return JS_FALSE;
-    }
+    JS_SetReservedSlot(obj, 0, collection);
   }
 
   if (NS_FAILED(rv)) {
     nsDOMClassInfo::ThrowJSException(cx, NS_ERROR_FAILURE);
 
     return JS_FALSE;
   }
 
@@ -8799,17 +8792,17 @@ nsHTMLDocumentSH::DocumentAllGetProperty
 
     if (!obj) {
       NS_ERROR("The JS engine lies!");
 
       return JS_TRUE;
     }
   }
 
-  nsHTMLDocument *doc = GetDocument(cx, obj);
+  nsHTMLDocument *doc = GetDocument(obj);
   nsISupports *result;
   nsWrapperCache *cache;
   nsresult rv = NS_OK;
 
   if (JSID_IS_STRING(id)) {
     if (id == sLength_id) {
       // Map document.all.length to the length of the collection
       // document.getElementsByTagName("*"), and make sure <div
@@ -8904,27 +8897,25 @@ nsHTMLDocumentSH::DocumentAllNewResolve(
   if (id == sLength_id) {
     // document.all.length. Any jsval other than undefined would do
     // here, all we need is to get into the code below that defines
     // this propery on obj, the rest happens in
     // DocumentAllGetProperty().
 
     v = JSVAL_ONE;
   } else if (id == sTags_id) {
-    nsHTMLDocument *doc = GetDocument(cx, obj);
+    nsHTMLDocument *doc = GetDocument(obj);
 
     JSObject *tags = ::JS_NewObject(cx, &sHTMLDocumentAllTagsClass, nsnull,
                                     ::JS_GetGlobalForObject(cx, obj));
     if (!tags) {
       return JS_FALSE;
     }
 
-    if (!::JS_SetPrivate(cx, tags, doc)) {
-      return JS_FALSE;
-    }
+    ::JS_SetPrivate(tags, doc);
 
     // The "tags" JSObject now also owns doc.
     NS_ADDREF(doc);
 
     v = OBJECT_TO_JSVAL(tags);
   } else {
     if (!DocumentAllGetProperty(cx, obj, id, &v)) {
       return JS_FALSE;
@@ -8942,17 +8933,17 @@ nsHTMLDocumentSH::DocumentAllNewResolve(
 }
 
 // Finalize hook used by document related JS objects, but also by
 // sGlobalScopePolluterClass!
 
 void
 nsHTMLDocumentSH::ReleaseDocument(JSContext *cx, JSObject *obj)
 {
-  nsIHTMLDocument *doc = (nsIHTMLDocument *)::JS_GetPrivate(cx, obj);
+  nsIHTMLDocument *doc = (nsIHTMLDocument *)::JS_GetPrivate(obj);
 
   NS_IF_RELEASE(doc);
 }
 
 JSBool
 nsHTMLDocumentSH::CallToGetPropMapper(JSContext *cx, uintN argc, jsval *vp)
 {
   // Handle document.all("foo") style access to document.all.
@@ -8990,20 +8981,20 @@ nsHTMLDocumentSH::CallToGetPropMapper(JS
     return JS_FALSE;
   }
 
   return ::JS_GetUCProperty(cx, self, chars, length, vp);
 }
 
 
 static inline JSObject *
-GetDocumentAllHelper(JSContext *cx, JSObject *obj)
+GetDocumentAllHelper(JSObject *obj)
 {
   while (obj && JS_GetClass(obj) != &sHTMLDocumentAllHelperClass) {
-    obj = ::JS_GetPrototype(cx, obj);
+    obj = ::JS_GetPrototype(obj);
   }
 
   return obj;
 }
 
 static inline void *
 FlagsToPrivate(PRUint32 flags)
 {
@@ -9021,27 +9012,27 @@ PrivateToFlags(void *priv)
 JSBool
 nsHTMLDocumentSH::DocumentAllHelperGetProperty(JSContext *cx, JSObject *obj,
                                                jsid id, jsval *vp)
 {
   if (id != nsDOMClassInfo::sAll_id) {
     return JS_TRUE;
   }
 
-  JSObject *helper = GetDocumentAllHelper(cx, obj);
+  JSObject *helper = GetDocumentAllHelper(obj);
 
   if (!helper) {
     NS_ERROR("Uh, how'd we get here?");
 
     // Let scripts continue, if we somehow did get here...
 
     return JS_TRUE;
   }
 
-  PRUint32 flags = PrivateToFlags(::JS_GetPrivate(cx, helper));
+  PRUint32 flags = PrivateToFlags(::JS_GetPrivate(helper));
 
   if (flags & JSRESOLVE_DETECTING || !(flags & JSRESOLVE_QUALIFIED)) {
     // document.all is either being detected, e.g. if (document.all),
     // or it was not being resolved with a qualified name. Claim that
     // document.all is undefined.
 
     *vp = JSVAL_VOID;
   } else {
@@ -9061,19 +9052,17 @@ nsHTMLDocumentSH::DocumentAllHelperGetPr
 
       JSObject *all = ::JS_NewObject(cx, &sHTMLDocumentAllClass, nsnull,
                                      ::JS_GetGlobalForObject(cx, obj));
       if (!all) {
         return JS_FALSE;
       }
 
       // Let the JSObject take over ownership of doc.
-      if (!::JS_SetPrivate(cx, all, doc)) {
-        return JS_FALSE;
-      }
+      ::JS_SetPrivate(all, doc);
 
       doc.forget();
 
       *vp = OBJECT_TO_JSVAL(all);
     }
   }
 
   return JS_TRUE;
@@ -9081,17 +9070,17 @@ nsHTMLDocumentSH::DocumentAllHelperGetPr
 
 JSBool
 nsHTMLDocumentSH::DocumentAllHelperNewResolve(JSContext *cx, JSObject *obj,
                                               jsid id, uintN flags,
                                               JSObject **objp)
 {
   if (id == nsDOMClassInfo::sAll_id) {
     // document.all is resolved for the first time. Define it.
-    JSObject *helper = GetDocumentAllHelper(cx, obj);
+    JSObject *helper = GetDocumentAllHelper(obj);
 
     if (helper) {
       if (!::JS_DefineProperty(cx, helper, "all", JSVAL_VOID, nsnull, nsnull,
                                JSPROP_ENUMERATE)) {
         return JS_FALSE;
       }
 
       *objp = helper;
@@ -9103,19 +9092,19 @@ nsHTMLDocumentSH::DocumentAllHelperNewRe
 
 
 JSBool
 nsHTMLDocumentSH::DocumentAllTagsNewResolve(JSContext *cx, JSObject *obj,
                                             jsid id, uintN flags,
                                             JSObject **objp)
 {
   if (JSID_IS_STRING(id)) {
-    nsDocument *doc = GetDocument(cx, obj);
-
-    JSObject *proto = ::JS_GetPrototype(cx, obj);
+    nsDocument *doc = GetDocument(obj);
+
+    JSObject *proto = ::JS_GetPrototype(obj);
     if (NS_UNLIKELY(!proto)) {
       return JS_TRUE;
     }
 
     JSBool found;
     if (!::JS_HasPropertyById(cx, proto, id, &found)) {
       return JS_FALSE;
     }
@@ -9183,54 +9172,53 @@ nsHTMLDocumentSH::NewResolve(nsIXPConnec
       }
     }
 
     if (id == sAll_id && !sDisableDocumentAllSupport &&
         !ObjectIsNativeWrapper(cx, obj)) {
       nsIDocument *doc = static_cast<nsIDocument*>(wrapper->Native());
 
       if (doc->GetCompatibilityMode() == eCompatibility_NavQuirks) {
-        JSObject *helper =
-          GetDocumentAllHelper(cx, ::JS_GetPrototype(cx, obj));
-
-        JSObject *proto = ::JS_GetPrototype(cx, helper ? helper : obj);
+        JSObject *helper = GetDocumentAllHelper(::JS_GetPrototype(obj));
+
+        JSObject *proto = ::JS_GetPrototype(helper ? helper : obj);
 
         // Check if the property all is defined on obj's (or helper's
         // if obj doesn't exist) prototype, if it is, don't expose our
         // document.all helper.
 
         JSBool hasAll = JS_FALSE;
         if (proto && !JS_HasProperty(cx, proto, "all", &hasAll)) {
           return NS_ERROR_UNEXPECTED;
         }
 
         if (hasAll && helper) {
           // Our helper's prototype now has an "all" property, remove
           // the helper out of the prototype chain to prevent
           // shadowing of the now defined "all" property.
           JSObject *tmp = obj, *tmpProto;
 
-          while ((tmpProto = ::JS_GetPrototype(cx, tmp)) != helper) {
+          while ((tmpProto = ::JS_GetPrototype(tmp)) != helper) {
             tmp = tmpProto;
           }
 
           ::JS_SetPrototype(cx, tmp, proto);
         }
 
         // If we don't already have a helper, and we're resolving
         // document.all qualified, and we're *not* detecting
         // document.all, e.g. if (document.all), and "all" isn't
         // already defined on our prototype, create a helper.
         if (!helper && flags & JSRESOLVE_QUALIFIED &&
             !(flags & JSRESOLVE_DETECTING) && !hasAll) {
           // Print a warning so developers can stop using document.all
           PrintWarningOnConsole(cx, "DocumentAllUsed");
 
           helper = ::JS_NewObject(cx, &sHTMLDocumentAllHelperClass,
-                                  ::JS_GetPrototype(cx, obj),
+                                  ::JS_GetPrototype(obj),
                                   ::JS_GetGlobalForObject(cx, obj));
 
           if (!helper) {
             return NS_ERROR_OUT_OF_MEMORY;
           }
 
           // Insert the helper into our prototype chain. helper's prototype
           // is already obj's current prototype.
@@ -9238,20 +9226,18 @@ nsHTMLDocumentSH::NewResolve(nsIXPConnec
             nsDOMClassInfo::ThrowJSException(cx, NS_ERROR_UNEXPECTED);
 
             return NS_ERROR_UNEXPECTED;
           }
         }
 
         // If we have (or just created) a helper, pass the resolve flags
         // to the helper as its private data.
-        if (helper && !::JS_SetPrivate(cx, helper, FlagsToPrivate(flags))) {
-          nsDOMClassInfo::ThrowJSException(cx, NS_ERROR_UNEXPECTED);
-
-          return NS_ERROR_UNEXPECTED;
+        if (helper) {
+          ::JS_SetPrivate(helper, FlagsToPrivate(flags));
         }
       }
 
       return NS_OK;
     }
   }
 
   return nsDocumentSH::NewResolve(wrapper, cx, obj, id, flags, objp, _retval);
@@ -9786,17 +9772,17 @@ nsHTMLPluginObjElementSH::PostCreate(nsI
 
 NS_IMETHODIMP
 nsHTMLPluginObjElementSH::GetProperty(nsIXPConnectWrappedNative *wrapper,
                                       JSContext *cx, JSObject *obj, jsid id,
                                       jsval *vp, bool *_retval)
 {
   JSAutoRequest ar(cx);
 
-  JSObject *pi_obj = ::JS_GetPrototype(cx, obj);
+  JSObject *pi_obj = ::JS_GetPrototype(obj);
   if (NS_UNLIKELY(!pi_obj)) {
     return NS_OK;
   }
 
   JSBool found = false;
 
   if (!ObjectIsNativeWrapper(cx, obj)) {
     *_retval = ::JS_HasPropertyById(cx, pi_obj, id, &found);
@@ -9815,17 +9801,17 @@ nsHTMLPluginObjElementSH::GetProperty(ns
 
 NS_IMETHODIMP
 nsHTMLPluginObjElementSH::SetProperty(nsIXPConnectWrappedNative *wrapper,
                                       JSContext *cx, JSObject *obj, jsid id,
                                       jsval *vp, bool *_retval)
 {
   JSAutoRequest ar(cx);
 
-  JSObject *pi_obj = ::JS_GetPrototype(cx, obj);
+  JSObject *pi_obj = ::JS_GetPrototype(obj);
   if (NS_UNLIKELY(!pi_obj)) {
     return NS_OK;
   }
 
   JSBool found = false;
 
   if (!ObjectIsNativeWrapper(cx, obj)) {
     *_retval = ::JS_HasPropertyById(cx, pi_obj, id, &found);
@@ -9894,17 +9880,17 @@ nsHTMLPluginObjElementSH::GetPluginJSObj
   JSAutoEnterCompartment ac;
   if (!ac.enter(cx, obj)) {
     return NS_ERROR_UNEXPECTED;
   }
 
   if (plugin_inst) {
     plugin_inst->GetJSObject(cx, plugin_obj);
     if (*plugin_obj) {
-      *plugin_proto = ::JS_GetPrototype(cx, *plugin_obj);
+      *plugin_proto = ::JS_GetPrototype(*plugin_obj);
     }
   }
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsHTMLPluginObjElementSH::NewResolve(nsIXPConnectWrappedNative *wrapper,
@@ -10293,17 +10279,17 @@ nsStorageSH::NewResolve(nsIXPConnectWrap
   JSAutoEnterCompartment ac;
   if (!ac.enter(cx, realObj)) {
     *_retval = false;
     return NS_ERROR_FAILURE;
   }
 
   // First check to see if the property is defined on our prototype.
 
-  JSObject *proto = ::JS_GetPrototype(cx, realObj);
+  JSObject *proto = ::JS_GetPrototype(realObj);
   JSBool hasProp;
 
   if (proto &&
       (::JS_HasPropertyById(cx, proto, id, &hasProp) &&
        hasProp)) {
     // We found the property we're resolving on the prototype,
     // nothing left to do here then.
 
@@ -10479,17 +10465,17 @@ nsStorage2SH::NewResolve(nsIXPConnectWra
   // First check to see if the property is defined on our prototype,
   // after converting id to a string if it's an integer.
 
   JSString *jsstr = IdToString(cx, id);
   if (!jsstr) {
     return JS_FALSE;
   }
 
-  JSObject *proto = ::JS_GetPrototype(cx, realObj);
+  JSObject *proto = ::JS_GetPrototype(realObj);
   JSBool hasProp;
 
   if (proto &&
       (::JS_HasPropertyById(cx, proto, id, &hasProp) &&
        hasProp)) {
     // We found the property we're resolving on the prototype,
     // nothing left to do here then.
 
--- a/dom/base/nsDOMWindowUtils.cpp
+++ b/dom/base/nsDOMWindowUtils.cpp
@@ -1601,17 +1601,17 @@ nsDOMWindowUtils::GetParent(const JS::Va
     return NS_ERROR_DOM_SECURITY_ERR;
   }
 
   // First argument must be an object.
   if (JSVAL_IS_PRIMITIVE(aObject)) {
     return NS_ERROR_XPC_BAD_CONVERT_JS;
   }
 
-  JSObject* parent = JS_GetParent(aCx, JSVAL_TO_OBJECT(aObject));
+  JSObject* parent = JS_GetParent(JSVAL_TO_OBJECT(aObject));
   *aParent = OBJECT_TO_JSVAL(parent);
 
   // Outerize if necessary.
   if (parent) {
     if (JSObjectOp outerize = js::GetObjectClass(parent)->ext.outerObject) {
       *aParent = OBJECT_TO_JSVAL(outerize(aCx, parent));
     }
   }
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -1859,17 +1859,17 @@ static JSDHashOperator
 ReparentWaiverWrappers(JSDHashTable *table, JSDHashEntryHdr *hdr,
                        uint32 number, void *arg)
 {
     ReparentWaiverClosure *closure = static_cast<ReparentWaiverClosure*>(arg);
     JSObject *value = static_cast<JSObject2JSObjectMap::Entry *>(hdr)->value;
 
     // We reparent wrappers that have as their parent an inner window whose
     // outer has the new inner window as its current inner.
-    JSObject *parent = JS_GetParent(closure->mCx, value);
+    JSObject *parent = JS_GetParent(value);
     JSObject *outer = JS_ObjectToOuterObject(closure->mCx, parent);
     if (outer) {
       JSObject *inner = JS_ObjectToInnerObject(closure->mCx, outer);
       if (inner == closure->mNewInner && inner != parent)
         JS_SetParent(closure->mCx, value, closure->mNewInner);
     } else {
       JS_ClearPendingException(closure->mCx);
     }
@@ -9964,17 +9964,17 @@ nsGlobalWindow::SaveWindowState(nsISuppo
 
   nsCOMPtr<nsIClassInfo> ci =
     do_QueryInterface((nsIScriptGlobalObject *)this);
   nsCOMPtr<nsIXPConnectJSObjectHolder> proto;
   nsresult rv = xpc->GetWrappedNativePrototype(cx, mJSObject, ci,
                                                getter_AddRefs(proto));
   NS_ENSURE_SUCCESS(rv, rv);
 
-  JSObject *realProto = JS_GetPrototype(cx, mJSObject);
+  JSObject *realProto = JS_GetPrototype(mJSObject);
   nsCOMPtr<nsIXPConnectJSObjectHolder> realProtoHolder;
   if (realProto) {
     rv = xpc->HoldObject(cx, realProto, getter_AddRefs(realProtoHolder));
     NS_ENSURE_SUCCESS(rv, rv);
   }
 
   nsCOMPtr<nsISupports> state = new WindowStateHolder(inner,
                                                       mInnerWindowHolder,
--- a/dom/base/nsJSEnvironment.cpp
+++ b/dom/base/nsJSEnvironment.cpp
@@ -1896,17 +1896,17 @@ nsJSContext::CallEventHandler(nsISupport
     return NS_OK;
   }
 
 #ifdef NS_FUNCTION_TIMER
   {
     JSObject *obj = aHandler;
     if (js::IsFunctionProxy(obj))
       obj = js::UnwrapObject(obj);
-    JSString *id = JS_GetFunctionId(static_cast<JSFunction *>(JS_GetPrivate(mContext, obj)));
+    JSString *id = JS_GetFunctionId(static_cast<JSFunction *>(JS_GetPrivate(obj)));
     JSAutoByteString bytes;
     const char *name = !id ? "anonymous" : bytes.encode(mContext, id) ? bytes.ptr() : "<error>";
     NS_TIME_FUNCTION_FMT(1.0, "%s (line %d) (function: %s)", MOZ_FUNCTION_NAME, __LINE__, name);
   }
 #endif
   SAMPLE_LABEL("JS", "CallEventHandler");
 
   JSAutoRequest ar(mContext);
@@ -2267,18 +2267,18 @@ nsJSContext::ConnectToInner(nsIScriptGlo
   JSObject *newInnerJSObject = aNewInner->GetGlobalJSObject();
 #endif
 
   // Now that we're connecting the outer global to the inner one,
   // we must have transplanted it. The JS engine tries to maintain
   // the global object's compartment as its default compartment,
   // so update that now since it might have changed.
   JS_SetGlobalObject(mContext, aOuterGlobal);
-  NS_ASSERTION(JS_GetPrototype(mContext, aOuterGlobal) ==
-               JS_GetPrototype(mContext, newInnerJSObject),
+  NS_ASSERTION(JS_GetPrototype(aOuterGlobal) ==
+               JS_GetPrototype(newInnerJSObject),
                "outer and inner globals should have the same prototype");
 
   return NS_OK;
 }
 
 JSContext*
 nsJSContext::GetNativeContext()
 {
@@ -2329,27 +2329,27 @@ nsJSContext::CreateOuterObject(nsIScript
 
 nsresult
 nsJSContext::SetOuterObject(JSObject* aOuterObject)
 {
   // Force our context's global object to be the outer.
   JS_SetGlobalObject(mContext, aOuterObject);
 
   // NB: JS_SetGlobalObject sets mContext->compartment.
-  JSObject *inner = JS_GetParent(mContext, aOuterObject);
+  JSObject *inner = JS_GetParent(aOuterObject);
 
   nsIXPConnect *xpc = nsContentUtils::XPConnect();
   nsCOMPtr<nsIXPConnectWrappedNative> wrapper;
   nsresult rv = xpc->GetWrappedNativeOfJSObject(mContext, inner,
                                                 getter_AddRefs(wrapper));
   NS_ENSURE_SUCCESS(rv, rv);
   NS_ABORT_IF_FALSE(wrapper, "bad wrapper");
 
   wrapper->RefreshPrototype();
-  JS_SetPrototype(mContext, aOuterObject, JS_GetPrototype(mContext, inner));
+  JS_SetPrototype(mContext, aOuterObject, JS_GetPrototype(inner));
 
   return NS_OK;
 }
 
 nsresult
 nsJSContext::InitOuterWindow()
 {
   JSObject *global = JS_ObjectToInnerObject(mContext, JS_GetGlobalObject(mContext));
@@ -3094,18 +3094,18 @@ nsJSContext::ClearScope(void *aGlobalObj
     // Since the prototype chain is shared between inner and outer (and
     // stays with the inner), we don't clear things from the prototype
     // chain when we're clearing an outer window whose current inner we
     // still want.
     if (aClearFromProtoChain) {
       nsWindowSH::InvalidateGlobalScopePolluter(mContext, obj);
 
       // Clear up obj's prototype chain, but not Object.prototype.
-      for (JSObject *o = ::JS_GetPrototype(mContext, obj), *next;
-           o && (next = ::JS_GetPrototype(mContext, o)); o = next)
+      for (JSObject *o = ::JS_GetPrototype(obj), *next;
+           o && (next = ::JS_GetPrototype(o)); o = next)
         ::JS_ClearScope(mContext, o);
     }
   }
 
   if (stack) {
     stack->Pop(nsnull);
   }
 }
--- a/dom/base/nsJSUtils.cpp
+++ b/dom/base/nsJSUtils.cpp
@@ -109,17 +109,17 @@ nsJSUtils::GetStaticScriptGlobal(JSConte
   glob = JS_GetGlobalForObject(aContext, glob);
   NS_ABORT_IF_FALSE(glob, "Infallible returns null");
 
   clazz = JS_GetClass(glob);
 
   if (!clazz ||
       !(clazz->flags & JSCLASS_HAS_PRIVATE) ||
       !(clazz->flags & JSCLASS_PRIVATE_IS_NSISUPPORTS) ||
-      !(supports = (nsISupports*)::JS_GetPrivate(aContext, glob))) {
+      !(supports = (nsISupports*)::JS_GetPrivate(glob))) {
     return nsnull;
   }
 
   // We might either have a window directly (e.g. if the global is a
   // sandbox whose script object principal pointer is a window), or an
   // XPCWrappedNative for a window.  We could also have other
   // sandbox-related script object principals, but we can't do much
   // about those short of trying to walk the proto chain of |glob|
--- a/dom/indexedDB/IDBIndex.cpp
+++ b/dom/indexedDB/IDBIndex.cpp
@@ -521,17 +521,17 @@ IDBIndex::GetAll(const jsval& aKey,
   nsresult rv;
 
   nsRefPtr<IDBKeyRange> keyRange;
   if (aOptionalArgCount) {
     rv = IDBKeyRange::FromJSVal(aCx, aKey, getter_AddRefs(keyRange));
     NS_ENSURE_SUCCESS(rv, rv);
   }
 
-  if (aOptionalArgCount < 2) {
+  if (aOptionalArgCount < 2 || aLimit == 0) {
     aLimit = PR_UINT32_MAX;
   }
 
   nsRefPtr<IDBRequest> request = GenerateRequest(this);
   NS_ENSURE_TRUE(request, NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR);
 
   nsRefPtr<GetAllHelper> helper =
     new GetAllHelper(transaction, request, this, keyRange, aLimit);
@@ -560,17 +560,17 @@ IDBIndex::GetAllKeys(const jsval& aKey,
   nsresult rv;
 
   nsRefPtr<IDBKeyRange> keyRange;
   if (aOptionalArgCount) {
     rv = IDBKeyRange::FromJSVal(aCx, aKey, getter_AddRefs(keyRange));
     NS_ENSURE_SUCCESS(rv, rv);
   }
 
-  if (aOptionalArgCount < 2) {
+  if (aOptionalArgCount < 2 || aLimit == 0) {
     aLimit = PR_UINT32_MAX;
   }
 
   nsRefPtr<IDBRequest> request = GenerateRequest(this);
   NS_ENSURE_TRUE(request, NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR);
 
   nsRefPtr<GetAllKeysHelper> helper =
     new GetAllKeysHelper(transaction, request, this, keyRange, aLimit);
--- a/dom/indexedDB/IDBObjectStore.cpp
+++ b/dom/indexedDB/IDBObjectStore.cpp
@@ -1527,17 +1527,17 @@ IDBObjectStore::GetAll(const jsval& aKey
   nsresult rv;
 
   nsRefPtr<IDBKeyRange> keyRange;
   if (aOptionalArgCount) {
     rv = IDBKeyRange::FromJSVal(aCx, aKey, getter_AddRefs(keyRange));
     NS_ENSURE_SUCCESS(rv, rv);
   }
 
-  if (aOptionalArgCount < 2) {
+  if (aOptionalArgCount < 2 || aLimit == 0) {
     aLimit = PR_UINT32_MAX;
   }
 
   nsRefPtr<IDBRequest> request = GenerateRequest(this);
   NS_ENSURE_TRUE(request, NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR);
 
   nsRefPtr<GetAllHelper> helper =
     new GetAllHelper(mTransaction, request, this, keyRange, aLimit);
--- a/dom/indexedDB/test/unit/test_getAll.js
+++ b/dom/indexedDB/test/unit/test_getAll.js
@@ -77,16 +77,52 @@ function testSteps()
 
   is(event.target.result instanceof Array, true, "Got an array object");
   is(event.target.result.length, values.length, "Correct length");
 
   for (let i in event.target.result) {
     is(event.target.result[i], values[i], "Same value");
   }
 
+  request = db.transaction("foo").objectStore("foo").getAll(keyRange, 0);
+  request.onerror = errorHandler;
+  request.onsuccess = grabEventAndContinueHandler;
+  event = yield;
+
+  is(event.target.result instanceof Array, true, "Got an array object");
+  is(event.target.result.length, values.length, "Correct length");
+
+  for (let i in event.target.result) {
+    is(event.target.result[i], values[i], "Same value");
+  }
+
+  request = db.transaction("foo").objectStore("foo").getAll(keyRange, null);
+  request.onerror = errorHandler;
+  request.onsuccess = grabEventAndContinueHandler;
+  event = yield;
+
+  is(event.target.result instanceof Array, true, "Got an array object");
+  is(event.target.result.length, values.length, "Correct length");
+
+  for (let i in event.target.result) {
+    is(event.target.result[i], values[i], "Same value");
+  }
+
+  request = db.transaction("foo").objectStore("foo").getAll(keyRange, undefined);
+  request.onerror = errorHandler;
+  request.onsuccess = grabEventAndContinueHandler;
+  event = yield;
+
+  is(event.target.result instanceof Array, true, "Got an array object");
+  is(event.target.result.length, values.length, "Correct length");
+
+  for (let i in event.target.result) {
+    is(event.target.result[i], values[i], "Same value");
+  }
+
   keyRange = IDBKeyRange.bound(4, 7);
 
   request = db.transaction("foo").objectStore("foo").getAll(keyRange);
   request.onerror = errorHandler;
   request.onsuccess = grabEventAndContinueHandler;
   event = yield;
 
   is(event.target.result instanceof Array, true, "Got an array object");
@@ -134,17 +170,17 @@ function testSteps()
   keyRange = IDBKeyRange.bound(4, 7);
 
   request = db.transaction("foo").objectStore("foo").getAll(keyRange, 0);
   request.onerror = errorHandler;
   request.onsuccess = grabEventAndContinueHandler;
   event = yield;
 
   is(event.target.result instanceof Array, true, "Got an array object");
-  is(event.target.result.length, 0, "Correct length");
+  is(event.target.result.length, 4, "Correct length");
 
   keyRange = IDBKeyRange.bound(4, 7, true, true);
 
   request = db.transaction("foo").objectStore("foo").getAll(keyRange);
   request.onerror = errorHandler;
   request.onsuccess = grabEventAndContinueHandler;
   event = yield;
 
--- a/dom/indexedDB/test/unit/test_index_getAll.js
+++ b/dom/indexedDB/test/unit/test_index_getAll.js
@@ -99,16 +99,58 @@ function testSteps()
   is(event.target.result instanceof Array, true, "Got an array object");
   is(event.target.result.length, 2, "Correct length");
 
<