diff -r 546e94dbb8b1 content/base/public/nsContentCreatorFunctions.h
--- a/content/base/public/nsContentCreatorFunctions.h	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/base/public/nsContentCreatorFunctions.h	Fri Oct 12 15:18:39 2007 -0700
@@ -104,7 +104,7 @@ NS_NewHTMLElement(nsIContent** aResult, 
 
 // First argument should be nsHTMLTag, but that adds dependency to parser
 // for a bunch of files.
-already_AddRefed<nsGenericHTMLElement>
+nsGenericHTMLElement*
 CreateHTMLElement(PRUint32 aNodeType, nsINodeInfo *aNodeInfo,
                   PRBool aFromParser);
 
diff -r 546e94dbb8b1 content/base/public/nsContentPolicyUtils.h
--- a/content/base/public/nsContentPolicyUtils.h	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/base/public/nsContentPolicyUtils.h	Fri Oct 12 15:18:39 2007 -0700
@@ -271,16 +271,16 @@ NS_CP_GetDocShellFromContext(nsISupports
         return nsnull;
     }
 
-    nsCOMPtr<nsPIDOMWindow> window = do_QueryInterface(aContext);
+    nsPIDOMWindow* window = do_QueryInterface(aContext);
 
     if (!window) {
         // our context might be a document (which also QIs to nsIDOMNode), so
         // try that first
-        nsCOMPtr<nsIDocument> doc = do_QueryInterface(aContext);
+        nsIDocument* doc = do_QueryInterface(aContext);
         if (!doc) {
             // we were not a document after all, get our ownerDocument,
             // hopefully
-            nsCOMPtr<nsIContent> content = do_QueryInterface(aContext);
+            nsIContent* content = do_QueryInterface(aContext);
             if (content) {
                 doc = content->GetOwnerDoc();
             }
diff -r 546e94dbb8b1 content/base/public/nsContentUtils.h
--- a/content/base/public/nsContentUtils.h	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/base/public/nsContentUtils.h	Fri Oct 12 15:18:39 2007 -0700
@@ -581,7 +581,7 @@ public:
    * @param aRequest The image request [out]
    * @return the nsIImage corresponding to the first frame of the image
    */
-  static already_AddRefed<nsIImage> GetImageFromContent(nsIImageLoadingContent* aContent, imgIRequest **aRequest = nsnull);
+  static nsIImage* GetImageFromContent(nsIImageLoadingContent* aContent, imgIRequest **aRequest = nsnull);
 
   /**
    * Method that decides whether a content node is draggable
@@ -996,7 +996,7 @@ public:
   /**
    * Unbinds the content from the tree and nulls it out if it's not null.
    */
-  static void DestroyAnonymousContent(nsCOMPtr<nsIContent>* aContent);
+  static void DestroyAnonymousContent(nsIContent** aContent);
 
   static nsresult HoldScriptObject(PRUint32 aLangID, void *aObject);
   static nsresult DropScriptObject(PRUint32 aLangID, void *aObject);
diff -r 546e94dbb8b1 content/base/public/nsIContent.h
--- a/content/base/public/nsIContent.h	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/base/public/nsIContent.h	Fri Oct 12 15:18:39 2007 -0700
@@ -226,7 +226,7 @@ public:
    * @param aStr the unparsed attribute string
    * @return the node info. May be nsnull.
    */
-  virtual already_AddRefed<nsINodeInfo> GetExistingAttrNameFromQName(const nsAString& aStr) const = 0;
+  virtual nsINodeInfo* GetExistingAttrNameFromQName(const nsAString& aStr) const = 0;
 
   /**
    * Set attribute values. All attribute values are assumed to have a
@@ -562,7 +562,7 @@ public:
    *
    * @return the base URI
    */
-  virtual already_AddRefed<nsIURI> GetBaseURI() const = 0;
+  virtual nsIURI* GetBaseURI() const = 0;
 
   /**
    * API to check if this is a link that's traversed in response to user input
diff -r 546e94dbb8b1 content/base/public/nsIDocument.h
--- a/content/base/public/nsIDocument.h	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/base/public/nsIDocument.h	Fri Oct 12 15:18:39 2007 -0700
@@ -190,7 +190,7 @@ public:
   /**
    * Return the LoadGroup for the document. May return null.
    */
-  already_AddRefed<nsILoadGroup> GetDocumentLoadGroup() const
+  nsILoadGroup* GetDocumentLoadGroup() const
   {
     nsILoadGroup *group = nsnull;
     if (mDocumentLoadGroup)
@@ -632,7 +632,7 @@ public:
   /**
    * Get the container (docshell) for this document.
    */
-  already_AddRefed<nsISupports> GetContainer() const
+  nsISupports* GetContainer() const
   {
     nsISupports* container = nsnull;
     if (mDocumentContainer)
@@ -756,7 +756,7 @@ public:
    * for nodes in this document.  This may return null; if that happens state
    * saving and restoration is not possible.
    */
-  virtual already_AddRefed<nsILayoutHistoryState> GetLayoutHistoryState() const = 0;
+  virtual nsILayoutHistoryState* GetLayoutHistoryState() const = 0;
 
   /**
    * Methods that can be used to prevent onload firing while an event that
diff -r 546e94dbb8b1 content/base/public/nsIScriptElement.h
--- a/content/base/public/nsIScriptElement.h	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/base/public/nsIScriptElement.h	Fri Oct 12 15:18:39 2007 -0700
@@ -73,7 +73,7 @@ public:
    * Location of script source text. Can return null, in which case
    * this is assumed to be an inline script element.
    */
-  virtual already_AddRefed<nsIURI> GetScriptURI() = 0;
+  virtual nsIURI* GetScriptURI() = 0;
   
   /**
    * Script source text for inline script elements.
diff -r 546e94dbb8b1 content/base/src/nsContentList.h
--- a/content/base/src/nsContentList.h	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/base/src/nsContentList.h	Fri Oct 12 15:18:39 2007 -0700
@@ -381,7 +381,7 @@ protected:
 #endif
 };
 
-already_AddRefed<nsContentList>
+nsContentList*
 NS_GetContentList(nsINode* aRootNode, nsIAtom* aMatchAtom,
                   PRInt32 aMatchNameSpaceId);
 
diff -r 546e94dbb8b1 content/base/src/nsGenericElement.h
--- a/content/base/src/nsGenericElement.h	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/base/src/nsGenericElement.h	Fri Oct 12 15:18:39 2007 -0700
@@ -385,7 +385,7 @@ public:
                               PRBool aNullParent = PR_TRUE);
   virtual nsIAtom *GetIDAttributeName() const;
   virtual nsIAtom *GetClassAttributeName() const;
-  virtual already_AddRefed<nsINodeInfo> GetExistingAttrNameFromQName(const nsAString& aStr) const;
+  virtual nsINodeInfo* GetExistingAttrNameFromQName(const nsAString& aStr) const;
   nsresult SetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
                    const nsAString& aValue, PRBool aNotify)
   {
@@ -426,7 +426,7 @@ public:
   virtual void SetFocus(nsPresContext* aContext);
   virtual nsIContent *GetBindingParent() const;
   virtual PRBool IsNodeOfType(PRUint32 aFlags) const;
-  virtual already_AddRefed<nsIURI> GetBaseURI() const;
+  virtual nsIURI* GetBaseURI() const;
   virtual PRBool IsLink(nsIURI** aURI) const;
   virtual void SetMayHaveFrame(PRBool aMayHaveFrame);
   virtual PRBool MayHaveFrame() const;
@@ -584,7 +584,7 @@ public:
                                      const nsAString& aVersion,
                                      nsISupports** aReturn);
   
-  static already_AddRefed<nsIDOMNSFeatureFactory>
+  static nsIDOMNSFeatureFactory*
     GetDOMFeatureFactory(const nsAString& aFeature, const nsAString& aVersion);
 
   static PRBool ShouldFocus(nsIContent *aContent);
diff -r 546e94dbb8b1 content/base/src/nsNodeInfoManager.h
--- a/content/base/src/nsNodeInfoManager.h	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/base/src/nsNodeInfoManager.h	Fri Oct 12 15:18:39 2007 -0700
@@ -92,17 +92,17 @@ public:
   /**
    * Returns the nodeinfo for text nodes. Can return null if OOM.
    */
-  already_AddRefed<nsINodeInfo> GetTextNodeInfo();
+  nsINodeInfo* GetTextNodeInfo();
 
   /**
    * Returns the nodeinfo for comment nodes. Can return null if OOM.
    */
-  already_AddRefed<nsINodeInfo> GetCommentNodeInfo();
+  nsINodeInfo* GetCommentNodeInfo();
 
   /**
    * Returns the nodeinfo for the document node. Can return null if OOM.
    */
-  already_AddRefed<nsINodeInfo> GetDocumentNodeInfo();     
+  nsINodeInfo* GetDocumentNodeInfo();     
 
   /**
    * Retrieve a pointer to the document that owns this node info
diff -r 546e94dbb8b1 content/base/src/nsNodeUtils.h
--- a/content/base/src/nsNodeUtils.h	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/base/src/nsNodeUtils.h	Fri Oct 12 15:18:39 2007 -0700
@@ -183,10 +183,10 @@ public:
                         JSObject *aNewScope,
                         nsCOMArray<nsINode> &aNodesWithProperties)
   {
-    nsCOMPtr<nsIDOMNode> dummy;
+    nsIDOMNode* dummy;
     return CloneAndAdopt(aNode, PR_FALSE, PR_TRUE, aNewNodeInfoManager, aCx,
                          aOldScope, aNewScope, aNodesWithProperties,
-                         nsnull, getter_AddRefs(dummy));
+                         nsnull, &dummy);
   }
 
   /**
diff -r 546e94dbb8b1 content/html/content/public/nsIRadioControlElement.h
--- a/content/html/content/public/nsIRadioControlElement.h	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/html/content/public/nsIRadioControlElement.h	Fri Oct 12 15:18:39 2007 -0700
@@ -112,7 +112,7 @@ public:
    * Get the radio group container for this radio button
    * @return the radio group container (or null if no container)
    */
-  virtual already_AddRefed<nsIRadioGroupContainer> GetRadioGroupContainer() = 0;
+  virtual nsIRadioGroupContainer* GetRadioGroupContainer() = 0;
 };
 
 NS_DEFINE_STATIC_IID_ACCESSOR(nsIRadioControlElement,
diff -r 546e94dbb8b1 content/html/content/src/nsFormSubmission.cpp
--- a/content/html/content/src/nsFormSubmission.cpp	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/html/content/src/nsFormSubmission.cpp	Fri Oct 12 15:18:39 2007 -0700
@@ -328,9 +328,9 @@ nsFSURLEncoded::AddNameValuePair(nsIDOMH
   // Check if there is an input type=file so that we can warn
   //
   if (!mWarnedFileControl) {
-    nsCOMPtr<nsIFormControl> formControl = do_QueryInterface(aSource);
+    nsIFormControl* formControl = do_QueryInterface(aSource);
     if (formControl->GetType() == NS_FORM_INPUT_FILE) {
-      nsCOMPtr<nsIContent> content = do_QueryInterface(aSource);
+      nsIContent* content = do_QueryInterface(aSource);
       SendJSWarning(content, "ForgotFileEnctypeWarning");
       mWarnedFileControl = PR_TRUE;
     }
@@ -494,14 +494,14 @@ nsFSURLEncoded::GetEncodedSubmission(nsI
 
     } else {
 
-      nsCOMPtr<nsIInputStream> dataStream;
+      nsIInputStream* dataStream;
       // XXX We *really* need to either get the string to disown its data (and
       // not destroy it), or make a string input stream that owns the CString
       // that is passed to it.  Right now this operation does a copy.
-      rv = NS_NewCStringInputStream(getter_AddRefs(dataStream), mQueryString);
+      rv = NS_NewCStringInputStream(&dataStream, mQueryString);
       NS_ENSURE_SUCCESS(rv, rv);
 
-      nsCOMPtr<nsIMIMEInputStream> mimeStream(
+      nsIMIMEInputStream* mimeStream(
         do_CreateInstance("@mozilla.org/network/mime-input-stream;1", &rv));
       NS_ENSURE_SUCCESS(rv, rv);
 
@@ -533,7 +533,7 @@ nsFSURLEncoded::GetEncodedSubmission(nsI
       return NS_OK;
     }
 
-    nsCOMPtr<nsIURL> url = do_QueryInterface(aURI);
+    nsIURL* url = do_QueryInterface(aURI);
     if (url) {
       url->SetQuery(mQueryString);
     }
@@ -892,7 +892,7 @@ nsFSMultipartFormData::GetEncodedSubmiss
   //
   // Make header
   //
-  nsCOMPtr<nsIMIMEInputStream> mimeStream
+  nsIMIMEInputStream* mimeStream
     = do_CreateInstance("@mozilla.org/network/mime-input-stream;1", &rv);
   NS_ENSURE_SUCCESS(rv, rv);
 
@@ -915,8 +915,8 @@ nsFSMultipartFormData::AddPostDataStream
 {
   nsresult rv = NS_OK;
   
-  nsCOMPtr<nsIInputStream> postDataChunkStream;
-  rv = NS_NewCStringInputStream(getter_AddRefs(postDataChunkStream),
+  nsIInputStream* postDataChunkStream;
+  rv = NS_NewCStringInputStream(&postDataChunkStream,
                                 mPostDataChunk);
   NS_ASSERTION(postDataChunkStream, "Could not open a stream for POST!");
   if (postDataChunkStream) {
@@ -1052,15 +1052,15 @@ nsFSTextPlain::GetEncodedSubmission(nsIU
   } else {
 
     // Create data stream
-    nsCOMPtr<nsIInputStream> bodyStream;
-    rv = NS_NewStringInputStream(getter_AddRefs(bodyStream),
+    nsIInputStream* bodyStream;
+    rv = NS_NewStringInputStream(&bodyStream,
                                           mBody);
     if (!bodyStream) {
       return NS_ERROR_OUT_OF_MEMORY;
     }
 
     // Create mime stream with headers and such
-    nsCOMPtr<nsIMIMEInputStream> mimeStream
+    nsIMIMEInputStream* mimeStream
         = do_CreateInstance("@mozilla.org/network/mime-input-stream;1", &rv);
     NS_ENSURE_SUCCESS(rv, rv);
 
@@ -1157,14 +1157,14 @@ GetSubmissionFromForm(nsGenericHTMLEleme
   nsFormSubmission::GetSubmitCharset(aForm, ctrlsModAtSubmit, charset);
 
   // Get unicode encoder
-  nsCOMPtr<nsISaveAsCharset> encoder;
-  nsFormSubmission::GetEncoder(aForm, charset, getter_AddRefs(encoder));
+  nsISaveAsCharset* encoder;
+  nsFormSubmission::GetEncoder(aForm, charset, &encoder);
 
   if (!encoder)
     charset.AssignLiteral("UTF-8");
 
   // Get form processor
-  nsCOMPtr<nsIFormProcessor> formProcessor =
+  nsIFormProcessor* formProcessor =
     do_GetService(kFormProcessorCID, &rv);
 
   //
@@ -1214,8 +1214,8 @@ nsFormSubmission::SubmitTo(nsIURI* aActi
   //
   // Finish encoding (get post data stream and URI)
   //
-  nsCOMPtr<nsIInputStream> postDataStream;
-  rv = GetEncodedSubmission(aActionURI, getter_AddRefs(postDataStream));
+  nsIInputStream* postDataStream;
+  rv = GetEncodedSubmission(aActionURI, &postDataStream);
   NS_ENSURE_SUCCESS(rv, rv);
 
   //
@@ -1248,7 +1248,7 @@ nsFormSubmission::GetSubmitCharset(nsGen
     PRInt32 offset=0;
     PRInt32 spPos=0;
     // get charset from charsets one by one
-    nsCOMPtr<nsICharsetAlias> calias(do_GetService(NS_CHARSETALIAS_CONTRACTID, &rv));
+    nsICharsetAlias* calias(do_GetService(NS_CHARSETALIAS_CONTRACTID, &rv));
     if (NS_FAILED(rv)) {
       return;
     }
@@ -1434,7 +1434,7 @@ nsFormSubmission::ProcessValue(nsIDOMHTM
 {
   // Hijack _charset_ (hidden inputs only) for internationalization (bug 18643)
   if (aName.EqualsLiteral("_charset_")) {
-    nsCOMPtr<nsIFormControl> formControl = do_QueryInterface(aSource);
+    nsIFormControl* formControl = do_QueryInterface(aSource);
     if (formControl && formControl->GetType() == NS_FORM_INPUT_HIDDEN) {
         CopyASCIItoUTF16(mCharset, aResult);
         return NS_OK;
diff -r 546e94dbb8b1 content/html/content/src/nsGenericHTMLElement.cpp
--- a/content/html/content/src/nsGenericHTMLElement.cpp	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/html/content/src/nsGenericHTMLElement.cpp	Fri Oct 12 15:18:39 2007 -0700
@@ -262,11 +262,11 @@ nsGenericHTMLElement::CopyInnerTo(nsGene
       // We can't just set this as a string, because that will fail
       // to reparse the string into style data until the node is
       // inserted into the document.  Clone the HTMLValue instead.
-      nsCOMPtr<nsICSSRule> ruleClone;
-      rv = value->GetCSSStyleRuleValue()->Clone(*getter_AddRefs(ruleClone));
+      nsICSSRule* ruleClone;
+      rv = value->GetCSSStyleRuleValue()->Clone(*&ruleClone);
       NS_ENSURE_SUCCESS(rv, rv);
 
-      nsCOMPtr<nsICSSStyleRule> styleRule = do_QueryInterface(ruleClone);
+      nsICSSStyleRule* styleRule = do_QueryInterface(ruleClone);
       NS_ENSURE_TRUE(styleRule, NS_ERROR_UNEXPECTED);
 
       rv = aDst->SetInlineStyleRule(styleRule, PR_FALSE);
@@ -318,7 +318,7 @@ nsGenericHTMLElement::SetAttribute(const
     nsresult rv = nsContentUtils::CheckQName(aName, PR_FALSE);
     NS_ENSURE_SUCCESS(rv, rv);
 
-    nsCOMPtr<nsIAtom> nameAtom;
+    nsIAtom* nameAtom;
     if (mNodeInfo->NamespaceEquals(kNameSpaceID_None)) {
       nsAutoString lower;
       ToLowerCase(aName, lower);
@@ -574,11 +574,11 @@ nsGenericHTMLElement::GetOffsetRect(nsRe
       // parent chain. We want the offset parent in this case to be
       // the body, so we just get the body element from the document.
 
-      nsCOMPtr<nsIDOMHTMLDocument> html_doc(do_QueryInterface(GetCurrentDoc()));
+      nsIDOMHTMLDocument* html_doc(do_QueryInterface(GetCurrentDoc()));
 
       if (html_doc) {
-        nsCOMPtr<nsIDOMHTMLElement> html_element;
-        html_doc->GetBody(getter_AddRefs(html_element));
+        nsIDOMHTMLElement* html_element;
+        html_doc->GetBody(&html_element);
         if (html_element) {
           CallQueryInterface(html_element, aOffsetParent);
         }
@@ -608,8 +608,8 @@ nsGenericHTMLElement::GetOffsetTop(PRInt
 nsGenericHTMLElement::GetOffsetTop(PRInt32* aOffsetTop)
 {
   nsRect rcFrame;
-  nsCOMPtr<nsIContent> parent;
-  GetOffsetRect(rcFrame, getter_AddRefs(parent));
+  nsIContent* parent;
+  GetOffsetRect(rcFrame, &parent);
 
   *aOffsetTop = rcFrame.y;
 
@@ -620,8 +620,8 @@ nsGenericHTMLElement::GetOffsetLeft(PRIn
 nsGenericHTMLElement::GetOffsetLeft(PRInt32* aOffsetLeft)
 {
   nsRect rcFrame;
-  nsCOMPtr<nsIContent> parent;
-  GetOffsetRect(rcFrame, getter_AddRefs(parent));
+  nsIContent* parent;
+  GetOffsetRect(rcFrame, &parent);
 
   *aOffsetLeft = rcFrame.x;
 
@@ -632,8 +632,8 @@ nsGenericHTMLElement::GetOffsetWidth(PRI
 nsGenericHTMLElement::GetOffsetWidth(PRInt32* aOffsetWidth)
 {
   nsRect rcFrame;
-  nsCOMPtr<nsIContent> parent;
-  GetOffsetRect(rcFrame, getter_AddRefs(parent));
+  nsIContent* parent;
+  GetOffsetRect(rcFrame, &parent);
 
   *aOffsetWidth = rcFrame.width;
 
@@ -644,8 +644,8 @@ nsGenericHTMLElement::GetOffsetHeight(PR
 nsGenericHTMLElement::GetOffsetHeight(PRInt32* aOffsetHeight)
 {
   nsRect rcFrame;
-  nsCOMPtr<nsIContent> parent;
-  GetOffsetRect(rcFrame, getter_AddRefs(parent));
+  nsIContent* parent;
+  GetOffsetRect(rcFrame, &parent);
 
   *aOffsetHeight = rcFrame.height;
 
@@ -656,8 +656,8 @@ nsGenericHTMLElement::GetOffsetParent(ns
 nsGenericHTMLElement::GetOffsetParent(nsIDOMElement** aOffsetParent)
 {
   nsRect rcFrame;
-  nsCOMPtr<nsIContent> parent;
-  GetOffsetRect(rcFrame, getter_AddRefs(parent));
+  nsIContent* parent;
+  GetOffsetRect(rcFrame, &parent);
 
   if (parent) {
     CallQueryInterface(parent, aOffsetParent);
@@ -673,12 +673,12 @@ nsGenericHTMLElement::GetInnerHTML(nsASt
 {
   aInnerHTML.Truncate();
 
-  nsCOMPtr<nsIDocument> doc = GetOwnerDoc();
+  nsIDocument* doc = GetOwnerDoc();
   if (!doc) {
     return NS_OK; // We rely on the document for doing HTML conversion
   }
 
-  nsCOMPtr<nsIDOMNode> thisNode(do_QueryInterface(static_cast<nsIContent *>
+  nsIDOMNode* thisNode(do_QueryInterface(static_cast<nsIContent *>
                                                              (this)));
   nsresult rv = NS_OK;
 
@@ -690,7 +690,7 @@ nsGenericHTMLElement::GetInnerHTML(nsASt
     doc->GetContentType(contentType);
   }
   
-  nsCOMPtr<nsIDocumentEncoder> docEncoder;
+  nsIDocumentEncoder* docEncoder;
   docEncoder =
     do_CreateInstance(PromiseFlatCString(
         nsDependentCString(NS_DOC_ENCODER_CONTRACTID_BASE) +
@@ -705,7 +705,7 @@ nsGenericHTMLElement::GetInnerHTML(nsASt
 
   NS_ENSURE_TRUE(docEncoder, NS_ERROR_FAILURE);
 
-  nsCOMPtr<nsIDOMDocument> domDoc = do_QueryInterface(doc);
+  nsIDOMDocument* domDoc = do_QueryInterface(doc);
   rv = docEncoder->Init(domDoc, contentType,
                         nsIDocumentEncoder::OutputEncodeBasicEntities |
                         // Output DOM-standard newlines
@@ -731,9 +731,9 @@ nsGenericHTMLElement::SetInnerHTML(const
   // Remove childnodes
   nsContentUtils::SetNodeTextContent(this, EmptyString(), PR_FALSE);
 
-  nsCOMPtr<nsIDOMDocumentFragment> df;
-
-  nsCOMPtr<nsIDocument> doc = GetOwnerDoc();
+  nsIDOMDocumentFragment* df;
+
+  nsIDocument* doc = GetOwnerDoc();
 
   // Strong ref since appendChild can fire events
   nsRefPtr<nsScriptLoader> loader;
@@ -745,13 +745,13 @@ nsGenericHTMLElement::SetInnerHTML(const
     loader->SetEnabled(PR_FALSE);
   }
 
-  nsCOMPtr<nsIDOMNode> thisNode(do_QueryInterface(static_cast<nsIContent *>
+  nsIDOMNode* thisNode(do_QueryInterface(static_cast<nsIContent *>
                                                              (this)));
   nsresult rv = nsContentUtils::CreateContextualFragment(thisNode, aInnerHTML,
-                                                         getter_AddRefs(df));
+                                                         &df);
   if (NS_SUCCEEDED(rv)) {
-    nsCOMPtr<nsIDOMNode> tmpNode;
-    rv = thisNode->AppendChild(df, getter_AddRefs(tmpNode));
+    nsIDOMNode* tmpNode;
+    rv = thisNode->AppendChild(df, &tmpNode);
   }
 
   if (scripts_enabled) {
@@ -1022,7 +1022,7 @@ nsGenericHTMLElement::ScrollIntoView(PRB
   }
 
   // Get the presentation shell
-  nsCOMPtr<nsIPresShell> presShell = document->GetPrimaryShell();
+  nsIPresShell* presShell = document->GetPrimaryShell();
   if (!presShell) {
     return NS_OK;
   }
@@ -1066,7 +1066,7 @@ nsGenericHTMLElement::GetSpellcheck(PRBo
   }
 
   if (IsCurrentBodyElement()) {
-    nsCOMPtr<nsIHTMLDocument> doc = do_QueryInterface(GetCurrentDoc());
+    nsIHTMLDocument* doc = do_QueryInterface(GetCurrentDoc());
     if (doc) {
       *aSpellcheck = doc->IsEditingOn();
     }
@@ -1075,7 +1075,7 @@ nsGenericHTMLElement::GetSpellcheck(PRBo
   }
 
   // Is this element editable?
-  nsCOMPtr<nsIFormControl> formControl = do_QueryInterface(this);
+  nsIFormControl* formControl = do_QueryInterface(this);
   if (!formControl) {
     return NS_OK;                       // Not spellchecked by default
   }
@@ -1147,7 +1147,7 @@ nsGenericHTMLElement::BindToTree(nsIDocu
 
   if (aDocument) {
     if (HasFlag(NODE_IS_EDITABLE) && GetContentEditableValue() == eTrue) {
-      nsCOMPtr<nsIHTMLDocument> htmlDocument = do_QueryInterface(aDocument);
+      nsIHTMLDocument* htmlDocument = do_QueryInterface(aDocument);
       if (htmlDocument) {
         htmlDocument->ChangeContentEditableCount(this, +1);
       }
@@ -1168,7 +1168,7 @@ nsGenericHTMLElement::UnbindFromTree(PRB
 nsGenericHTMLElement::UnbindFromTree(PRBool aDeep, PRBool aNullParent)
 {
   if (GetContentEditableValue() == eTrue) {
-    nsCOMPtr<nsIHTMLDocument> htmlDocument = do_QueryInterface(GetCurrentDoc());
+    nsIHTMLDocument* htmlDocument = do_QueryInterface(GetCurrentDoc());
     if (htmlDocument) {
       htmlDocument->ChangeContentEditableCount(this, -1);
     }
@@ -1177,7 +1177,7 @@ nsGenericHTMLElement::UnbindFromTree(PRB
   nsGenericElement::UnbindFromTree(aDeep, aNullParent);
 }
 
-already_AddRefed<nsIDOMHTMLFormElement>
+nsIDOMHTMLFormElement*
 nsGenericHTMLElement::FindForm(nsIForm* aCurrentForm)
 {
   // Make sure we don't end up finding a form that's anonymous from
@@ -1218,7 +1218,7 @@ nsGenericHTMLElement::FindForm(nsIForm* 
       // we're one of those inputs-in-a-table that have a hacked mForm pointer
       // and a subtree containing both us and the form got removed from the
       // DOM.
-      nsCOMPtr<nsIContent> formCOMPtr = do_QueryInterface(aCurrentForm);
+      nsIContent* formCOMPtr = do_QueryInterface(aCurrentForm);
       NS_ASSERTION(formCOMPtr, "aCurrentForm isn't an nsIContent?");
       // Use an nsIContent temporary to reduce addref/releasing as we go up the
       // tree
@@ -1247,7 +1247,7 @@ PRBool
 PRBool
 nsGenericHTMLElement::CheckHandleEventForAnchorsPreconditions(nsEventChainVisitor& aVisitor)
 {
-  NS_PRECONDITION(nsCOMPtr<nsILink>(do_QueryInterface(this)),
+  NS_PRECONDITION((nsILink*)(do_QueryInterface(this)),
                   "should be called only when |this| implements |nsILink|");
 
   if (!aVisitor.mPresContext) {
@@ -1260,9 +1260,9 @@ nsGenericHTMLElement::CheckHandleEventFo
   //Need to check if we hit an imagemap area and if so see if we're handling
   //the event on that map or on a link farther up the tree.  If we're on a
   //link farther up, do nothing.
-  nsCOMPtr<nsIContent> target;
+  nsIContent* target;
   aVisitor.mPresContext->EventStateManager()->
-    GetEventTargetContent(aVisitor.mEvent, getter_AddRefs(target));
+    GetEventTargetContent(aVisitor.mEvent, &target);
 
   return !target || !IsArea(target) || IsArea(this);
 }
@@ -1312,7 +1312,7 @@ nsGenericHTMLElement::GetHrefURIForAncho
   const nsAttrValue* attr = mAttrsAndChildren.GetAttr(nsGkAtoms::href);
   if (attr) {
     // Get base URI.
-    nsCOMPtr<nsIURI> baseURI = GetBaseURI();
+    nsIURI* baseURI = GetBaseURI();
 
     // Get absolute URI.
     nsresult rv = nsContentUtils::NewURIWithDocumentCharset(aURI,
@@ -1367,7 +1367,7 @@ nsGenericHTMLElement::GetEventListenerMa
     nsIDocument *document = GetOwnerDoc();
     nsresult rv = NS_OK;
     if (document && (win = document->GetInnerWindow())) {
-      nsCOMPtr<nsPIDOMEventTarget> piTarget(do_QueryInterface(win));
+      nsPIDOMEventTarget* piTarget(do_QueryInterface(win));
       NS_ENSURE_TRUE(piTarget, NS_ERROR_FAILURE);
 
       rv = piTarget->GetListenerManager(PR_TRUE, aManager);
@@ -1428,8 +1428,8 @@ nsGenericHTMLElement::UnsetAttr(PRInt32 
     }
     else if (nsContentUtils::IsEventAttributeName(aAttribute,
                                                   EventNameType_HTML)) {
-      nsCOMPtr<nsIEventListenerManager> manager;
-      GetListenerManager(PR_FALSE, getter_AddRefs(manager));
+      nsIEventListenerManager* manager;
+      GetListenerManager(PR_FALSE, &manager);
 
       if (manager) {
         manager->RemoveScriptEventListener(aAttribute);
@@ -1448,7 +1448,7 @@ nsGenericHTMLElement::WalkContentStyleRu
   return NS_OK;
 }
 
-already_AddRefed<nsIURI>
+nsIURI*
 nsGenericHTMLElement::GetBaseURI() const
 {
   nsIDocument* doc = GetOwnerDoc();
@@ -1611,9 +1611,9 @@ nsGenericHTMLElement::GetPrimaryPresStat
 
   nsresult result = NS_OK;
 
-  nsCOMPtr<nsILayoutHistoryState> history;
+  nsILayoutHistoryState* history;
   nsCAutoString key;
-  GetLayoutHistoryAndKey(aContent, PR_FALSE, getter_AddRefs(history), key);
+  GetLayoutHistoryAndKey(aContent, PR_FALSE, &history, key);
 
   if (history) {
     // Get the pres state for this key, if it doesn't exist, create one
@@ -1639,7 +1639,7 @@ nsGenericHTMLElement::GetLayoutHistoryAn
   //
   // Get the pres shell
   //
-  nsCOMPtr<nsIDocument> doc = aContent->GetDocument();
+  nsIDocument* doc = aContent->GetDocument();
   if (!doc) {
     return NS_OK;
   }
@@ -1647,7 +1647,7 @@ nsGenericHTMLElement::GetLayoutHistoryAn
   //
   // Get the history (don't bother with the key if the history is not there)
   //
-  *aHistory = doc->GetLayoutHistoryState().get();
+  *aHistory = doc->GetLayoutHistoryState();
   if (!*aHistory) {
     return NS_OK;
   }
@@ -1685,10 +1685,10 @@ nsGenericHTMLElement::RestoreFormControl
 nsGenericHTMLElement::RestoreFormControlState(nsGenericHTMLElement* aContent,
                                               nsIFormControl* aControl)
 {
-  nsCOMPtr<nsILayoutHistoryState> history;
+  nsILayoutHistoryState* history;
   nsCAutoString key;
   nsresult rv = GetLayoutHistoryAndKey(aContent, PR_TRUE,
-                                       getter_AddRefs(history), key);
+                                       &history, key);
   if (!history) {
     return PR_FALSE;
   }
@@ -2197,9 +2197,9 @@ nsGenericHTMLElement::MapBackgroundInto(
         // to get to the element somehow, or store the base URI in the
         // attributes.
         nsIDocument* doc = aData->mPresContext->Document();
-        nsCOMPtr<nsIURI> uri;
+        nsIURI* uri;
         nsresult rv = nsContentUtils::NewURIWithDocumentCharset(
-            getter_AddRefs(uri), spec, doc, doc->GetBaseURI());
+            &uri, spec, doc, doc->GetBaseURI());
         if (NS_SUCCEEDED(rv)) {
           // Note that this should generally succeed here, due to the way
           // |spec| is created.  Maybe we should just add an nsStringBuffer
@@ -2373,14 +2373,14 @@ nsGenericHTMLElement::GetURIAttr(nsIAtom
     return NS_OK;
   }
 
-  nsCOMPtr<nsIURI> baseURI = GetBaseURI();
+  nsIURI* baseURI = GetBaseURI();
   nsresult rv;
 
   if (aBaseAttr) {
     nsAutoString baseAttrValue;
     if (GetAttr(kNameSpaceID_None, aBaseAttr, baseAttrValue)) {
-      nsCOMPtr<nsIURI> baseAttrURI;
-      rv = nsContentUtils::NewURIWithDocumentCharset(getter_AddRefs(baseAttrURI),
+      nsIURI* baseAttrURI;
+      rv = nsContentUtils::NewURIWithDocumentCharset(&baseAttrURI,
                                                      baseAttrValue, GetOwnerDoc(),
                                                      baseURI);
       if (NS_FAILED(rv)) {
@@ -2389,12 +2389,12 @@ nsGenericHTMLElement::GetURIAttr(nsIAtom
 
         return NS_OK;
       }
-      baseURI.swap(baseAttrURI);
-    }
-  }
-
-  nsCOMPtr<nsIURI> attrURI;
-  rv = nsContentUtils::NewURIWithDocumentCharset(getter_AddRefs(attrURI),
+      swap(baseURI, baseAttrURI);
+    }
+  }
+
+  nsIURI* attrURI;
+  rv = nsContentUtils::NewURIWithDocumentCharset(&attrURI,
                                                  attrValue, GetOwnerDoc(),
                                                  baseURI);
   if (NS_FAILED(rv)) {
@@ -2423,7 +2423,7 @@ nsGenericHTMLElement::GetURIListAttr(nsI
     return NS_OK;
 
   nsIDocument* doc = GetOwnerDoc(); 
-  nsCOMPtr<nsIURI> baseURI = GetBaseURI();
+  nsIURI* baseURI = GetBaseURI();
 
   // Value contains relative URIs split on spaces (U+0020)
   const PRUnichar *start = value.BeginReading();
@@ -2439,8 +2439,8 @@ nsGenericHTMLElement::GetURIListAttr(nsI
         if (!aResult.IsEmpty())
           aResult.Append(PRUnichar(' '));
         const nsSubstring& uriPart = Substring(start, iter);
-        nsCOMPtr<nsIURI> attrURI;
-        nsContentUtils::NewURIWithDocumentCharset(getter_AddRefs(attrURI),
+        nsIURI* attrURI;
+        nsContentUtils::NewURIWithDocumentCharset(&attrURI,
                                                   uriPart, doc, baseURI);
         if (attrURI) {
           nsCAutoString spec;
@@ -2585,11 +2585,11 @@ PRUint32
 PRUint32
 nsGenericHTMLFormElement::GetDesiredIMEState()
 {
-  nsCOMPtr<nsIEditor> editor = nsnull;
-  nsresult rv = GetEditorInternal(getter_AddRefs(editor));
+  nsIEditor* editor = nsnull;
+  nsresult rv = GetEditorInternal(&editor);
   if (NS_FAILED(rv) || !editor)
     return nsGenericHTMLElement::GetDesiredIMEState();
-  nsCOMPtr<nsIEditorIMESupport> imeEditor = do_QueryInterface(editor);
+  nsIEditorIMESupport* imeEditor = do_QueryInterface(editor);
   if (!imeEditor)
     return nsGenericHTMLElement::GetDesiredIMEState();
   PRUint32 state;
@@ -2614,15 +2614,15 @@ nsGenericHTMLFrameElement::IsFocusable(P
     // sXBL/XBL2 issue!
     nsIDocument *subDoc = doc->GetSubDocumentFor(this);
     if (subDoc) {
-      nsCOMPtr<nsISupports> container = subDoc->GetContainer();
-      nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(container));
+      nsISupports* container = subDoc->GetContainer();
+      nsIDocShell* docShell(do_QueryInterface(container));
       if (docShell) {
-        nsCOMPtr<nsIContentViewer> contentViewer;
-        docShell->GetContentViewer(getter_AddRefs(contentViewer));
+        nsIContentViewer* contentViewer;
+        docShell->GetContentViewer(&contentViewer);
         if (contentViewer) {
           isFocusable = PR_TRUE;
-          nsCOMPtr<nsIContentViewer> zombieViewer;
-          contentViewer->GetPreviousViewer(getter_AddRefs(zombieViewer));
+          nsIContentViewer* zombieViewer;
+          contentViewer->GetPreviousViewer(&zombieViewer);
           if (zombieViewer) {
             // If there are 2 viewers for the current docshell, that 
             // means the current document is a zombie document.
@@ -2664,7 +2664,7 @@ nsGenericHTMLFormElement::BindToTree(nsI
     // it to the right value.  Also note that even if being bound here didn't
     // change our parent, we still need to search, since our parent chain
     // probably changed _somewhere_.
-    nsCOMPtr<nsIDOMHTMLFormElement> form = FindForm();
+    nsIDOMHTMLFormElement* form = FindForm();
     if (form) {
       SetForm(form, PR_FALSE, PR_FALSE);
     }
@@ -2706,7 +2706,7 @@ nsGenericHTMLFormElement::UnbindFromTree
       SetForm(nsnull, PR_TRUE, PR_TRUE);
     } else {
       // Recheck whether we should still have an mForm.
-      nsCOMPtr<nsIDOMHTMLFormElement> form = FindForm(mForm);
+      nsIDOMHTMLFormElement* form = FindForm(mForm);
       if (!form) {
         SetForm(nsnull, PR_TRUE, PR_TRUE);
       }
@@ -2889,7 +2889,7 @@ nsGenericHTMLFormElement::SetFocusAndScr
     nsIFormControlFrame* formControlFrame = GetFormControlFrame(PR_TRUE);
     if (formControlFrame) {
       formControlFrame->SetFocus(PR_TRUE, PR_TRUE);
-      nsCOMPtr<nsIPresShell> presShell = aPresContext->GetPresShell();
+      nsIPresShell* presShell = aPresContext->GetPresShell();
       if (presShell) {
         presShell->ScrollContentIntoView(this, NS_PRESSHELL_SCROLL_IF_NOT_VISIBLE,
                                          NS_PRESSHELL_SCROLL_IF_NOT_VISIBLE);
@@ -2926,8 +2926,8 @@ nsGenericHTMLFrameElement::GetContentDoc
   NS_PRECONDITION(aContentDocument, "Null out param");
   *aContentDocument = nsnull;
 
-  nsCOMPtr<nsIDOMWindow> win;
-  GetContentWindow(getter_AddRefs(win));
+  nsIDOMWindow* win;
+  GetContentWindow(&win);
 
   if (!win) {
     return NS_OK;
@@ -2956,10 +2956,10 @@ nsGenericHTMLFrameElement::GetContentWin
     return NS_OK;
   }
   
-  nsCOMPtr<nsIDocShell> doc_shell;
-  mFrameLoader->GetDocShell(getter_AddRefs(doc_shell));
-
-  nsCOMPtr<nsPIDOMWindow> win(do_GetInterface(doc_shell));
+  nsIDocShell* doc_shell;
+  mFrameLoader->GetDocShell(&doc_shell);
+
+  nsPIDOMWindow* win(do_GetInterface(doc_shell));
 
   if (!win) {
     return NS_OK;
@@ -3070,7 +3070,7 @@ void
 void
 nsGenericHTMLElement::SetElementFocus(PRBool aDoFocus)
 {
-  nsCOMPtr<nsPresContext> presContext = GetPresContext();
+  nsPresContext* presContext = GetPresContext();
   if (!presContext)
     return;
 
@@ -3223,8 +3223,8 @@ nsGenericHTMLElement::SetProtocolInHrefS
                                               nsAString &aResult)
 {
   aResult.Truncate();
-  nsCOMPtr<nsIURI> uri;
-  nsresult rv = NS_NewURI(getter_AddRefs(uri), aHref);
+  nsIURI* uri;
+  nsresult rv = NS_NewURI(&uri, aHref);
   if (NS_FAILED(rv))
     return rv;
 
@@ -3250,8 +3250,8 @@ nsGenericHTMLElement::SetHostnameInHrefS
                                               nsAString &aResult)
 {
   aResult.Truncate();
-  nsCOMPtr<nsIURI> uri;
-  nsresult rv = NS_NewURI(getter_AddRefs(uri), aHref);
+  nsIURI* uri;
+  nsresult rv = NS_NewURI(&uri, aHref);
   if (NS_FAILED(rv))
     return rv;
 
@@ -3272,12 +3272,12 @@ nsGenericHTMLElement::SetPathnameInHrefS
                                               nsAString &aResult)
 {
   aResult.Truncate();
-  nsCOMPtr<nsIURI> uri;
-  nsresult rv = NS_NewURI(getter_AddRefs(uri), aHref);
+  nsIURI* uri;
+  nsresult rv = NS_NewURI(&uri, aHref);
   if (NS_FAILED(rv))
     return rv;
 
-  nsCOMPtr<nsIURL> url(do_QueryInterface(uri, &rv));
+  nsIURL* url(do_QueryInterface(uri, &rv));
   if (NS_FAILED(rv))
     return rv;
 
@@ -3301,8 +3301,8 @@ nsGenericHTMLElement::SetHostInHrefStrin
   // IPv6 address (like http://[server:443]/)
 
   aResult.Truncate();
-  nsCOMPtr<nsIURI> uri;
-  nsresult rv = NS_NewURI(getter_AddRefs(uri), aHref);
+  nsIURI* uri;
+  nsresult rv = NS_NewURI(&uri, aHref);
   if (NS_FAILED(rv))
     return rv;
 
@@ -3330,13 +3330,13 @@ nsGenericHTMLElement::SetSearchInHrefStr
                                             nsAString &aResult)
 {
   aResult.Truncate();
-  nsCOMPtr<nsIURI> uri;
-
-  nsresult rv = NS_NewURI(getter_AddRefs(uri), aHref);
+  nsIURI* uri;
+
+  nsresult rv = NS_NewURI(&uri, aHref);
   if (NS_FAILED(rv))
     return rv;
 
-  nsCOMPtr<nsIURL> url(do_QueryInterface(uri, &rv));
+  nsIURL* url(do_QueryInterface(uri, &rv));
   if (NS_FAILED(rv))
     return rv;
 
@@ -3357,13 +3357,13 @@ nsGenericHTMLElement::SetHashInHrefStrin
                                           nsAString &aResult)
 {
   aResult.Truncate();
-  nsCOMPtr<nsIURI> uri;
-
-  nsresult rv = NS_NewURI(getter_AddRefs(uri), aHref);
+  nsIURI* uri;
+
+  nsresult rv = NS_NewURI(&uri, aHref);
   if (NS_FAILED(rv))
     return rv;
 
-  nsCOMPtr<nsIURL> url(do_QueryInterface(uri, &rv));
+  nsIURL* url(do_QueryInterface(uri, &rv));
   if (NS_FAILED(rv))
     return rv;
 
@@ -3384,8 +3384,8 @@ nsGenericHTMLElement::SetPortInHrefStrin
                                           nsAString &aResult)
 {
   aResult.Truncate();
-  nsCOMPtr<nsIURI> uri;
-  nsresult rv = NS_NewURI(getter_AddRefs(uri), aHref);
+  nsIURI* uri;
+  nsresult rv = NS_NewURI(&uri, aHref);
 
   if (NS_FAILED(rv))
     return rv;
@@ -3452,8 +3452,8 @@ nsGenericHTMLElement::GetHostFromHrefStr
                                             nsAString& aHost)
 {
   aHost.Truncate();
-  nsCOMPtr<nsIURI> uri;
-  nsresult rv = NS_NewURI(getter_AddRefs(uri), aHref);
+  nsIURI* uri;
+  nsresult rv = NS_NewURI(&uri, aHref);
   if (NS_FAILED(rv)) {
     if (rv == NS_ERROR_MALFORMED_URI) {
       // Don't throw from these methods!  Not a valid URI means return
@@ -3482,8 +3482,8 @@ nsGenericHTMLElement::GetHostnameFromHre
                                                 nsAString& aHostname)
 {
   aHostname.Truncate();
-  nsCOMPtr<nsIURI> url;
-  nsresult rv = NS_NewURI(getter_AddRefs(url), aHref);
+  nsIURI* url;
+  nsresult rv = NS_NewURI(&url, aHref);
   if (NS_FAILED(rv)) {
     if (rv == NS_ERROR_MALFORMED_URI) {
       // Don't throw from these methods!  Not a valid URI means return
@@ -3512,9 +3512,9 @@ nsGenericHTMLElement::GetPathnameFromHre
                                                 nsAString& aPathname)
 {
   aPathname.Truncate();
-  nsCOMPtr<nsIURI> uri;
-
-  nsresult rv = NS_NewURI(getter_AddRefs(uri), aHref);
+  nsIURI* uri;
+
+  nsresult rv = NS_NewURI(&uri, aHref);
   if (NS_FAILED(rv)) {
     if (rv == NS_ERROR_MALFORMED_URI) {
       rv = NS_OK;
@@ -3522,7 +3522,7 @@ nsGenericHTMLElement::GetPathnameFromHre
     return rv;
   }
 
-  nsCOMPtr<nsIURL> url(do_QueryInterface(uri));
+  nsIURL* url(do_QueryInterface(uri));
 
   if (!url) {
     // If this is not a URL, we can't get the pathname from the URI
@@ -3546,9 +3546,9 @@ nsGenericHTMLElement::GetSearchFromHrefS
                                               nsAString& aSearch)
 {
   aSearch.Truncate();
-  nsCOMPtr<nsIURI> uri;
-
-  nsresult rv = NS_NewURI(getter_AddRefs(uri), aHref);
+  nsIURI* uri;
+
+  nsresult rv = NS_NewURI(&uri, aHref);
   if (NS_FAILED(rv)) {
     if (rv == NS_ERROR_MALFORMED_URI) {
       rv = NS_OK;
@@ -3556,7 +3556,7 @@ nsGenericHTMLElement::GetSearchFromHrefS
     return rv;
   }
 
-  nsCOMPtr<nsIURL> url(do_QueryInterface(uri));
+  nsIURL* url(do_QueryInterface(uri));
 
   if (!url) {
     // If this is not a URL, we can't get the query from the URI
@@ -3582,8 +3582,8 @@ nsGenericHTMLElement::GetPortFromHrefStr
                                             nsAString& aPort)
 {
   aPort.Truncate();
-  nsCOMPtr<nsIURI> uri;
-  nsresult rv = NS_NewURI(getter_AddRefs(uri), aHref);
+  nsIURI* uri;
+  nsresult rv = NS_NewURI(&uri, aHref);
   if (NS_FAILED(rv)) {
     if (rv == NS_ERROR_MALFORMED_URI) {
       rv = NS_OK;
@@ -3616,9 +3616,9 @@ nsGenericHTMLElement::GetHashFromHrefStr
                                             nsAString& aHash)
 {
   aHash.Truncate();
-  nsCOMPtr<nsIURI> uri;
-
-  nsresult rv = NS_NewURI(getter_AddRefs(uri), aHref);
+  nsIURI* uri;
+
+  nsresult rv = NS_NewURI(&uri, aHref);
   if (NS_FAILED(rv)) {
     if (rv == NS_ERROR_MALFORMED_URI) {
       rv = NS_OK;
@@ -3626,7 +3626,7 @@ nsGenericHTMLElement::GetHashFromHrefStr
     return rv;
   }
 
-  nsCOMPtr<nsIURL> url(do_QueryInterface(uri));
+  nsIURL* url(do_QueryInterface(uri));
 
   if (!url) {
     // If this is not a URL, we can't get the hash part from the URI
@@ -3689,7 +3689,7 @@ nsGenericHTMLElement::GetEditorInternal(
   return NS_OK;
 }
 
-already_AddRefed<nsIEditor>
+nsIEditor*
 nsGenericHTMLElement::GetAssociatedEditor()
 {
   // If contenteditable is ever implemented, it might need to do something different here?
@@ -3702,19 +3702,19 @@ PRBool
 PRBool
 nsGenericHTMLElement::IsCurrentBodyElement()
 {
-  nsCOMPtr<nsIDOMHTMLBodyElement> bodyElement = do_QueryInterface(this);
+  nsIDOMHTMLBodyElement* bodyElement = do_QueryInterface(this);
   if (!bodyElement) {
     return PR_FALSE;
   }
 
-  nsCOMPtr<nsIDOMHTMLDocument> htmlDocument =
+  nsIDOMHTMLDocument* htmlDocument =
     do_QueryInterface(GetCurrentDoc());
   if (!htmlDocument) {
     return PR_FALSE;
   }
 
-  nsCOMPtr<nsIDOMHTMLElement> htmlElement;
-  htmlDocument->GetBody(getter_AddRefs(htmlElement));
+  nsIDOMHTMLElement* htmlElement;
+  htmlDocument->GetBody(&htmlElement);
   return htmlElement == bodyElement;
 }
 
@@ -3725,7 +3725,7 @@ nsGenericHTMLElement::SyncEditorsOnSubtr
   /* Sync this node */
   nsGenericHTMLElement* element = FromContent(content);
   if (element) {
-    nsCOMPtr<nsIEditor> editor = element->GetAssociatedEditor();
+    nsIEditor* editor = element->GetAssociatedEditor();
     if (editor) {
       editor->SyncRealTimeSpell();
     }
@@ -3818,7 +3818,7 @@ nsGenericHTMLElement::ChangeEditableStat
   }
 
   if (aChange != 0) {
-    nsCOMPtr<nsIHTMLDocument> htmlDocument =
+    nsIHTMLDocument* htmlDocument =
       do_QueryInterface(document);
     if (htmlDocument) {
       htmlDocument->ChangeContentEditableCount(this, aChange);
diff -r 546e94dbb8b1 content/html/content/src/nsGenericHTMLElement.h
--- a/content/html/content/src/nsGenericHTMLElement.h	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/html/content/src/nsGenericHTMLElement.h	Fri Oct 12 15:18:39 2007 -0700
@@ -246,7 +246,7 @@ public:
   virtual void UpdateEditableState();
 
   NS_IMETHOD WalkContentStyleRules(nsRuleWalker* aRuleWalker);
-  already_AddRefed<nsIURI> GetBaseURI() const;
+  nsIURI* GetBaseURI() const;
 
   virtual PRBool ParseAttribute(PRInt32 aNamespaceID,
                                 nsIAtom* aAttribute,
@@ -545,7 +545,7 @@ public:
    *        returned.  This is needed to handle cases when HTML elements have a
    *        current form that they're not descendants of.
    */
-  already_AddRefed<nsIDOMHTMLFormElement> FindForm(nsIForm* aCurrentForm = nsnull);
+  nsIDOMHTMLFormElement* FindForm(nsIForm* aCurrentForm = nsnull);
 
   virtual void RecompileScriptEventListeners();
 
@@ -756,7 +756,7 @@ protected:
    * to get the editor affected by changing the spellcheck attribute on this
    * node.
    */
-  virtual already_AddRefed<nsIEditor> GetAssociatedEditor();
+  virtual nsIEditor* GetAssociatedEditor();
 
   /**
    * Returns true if this is the current document's body element
diff -r 546e94dbb8b1 content/html/content/src/nsHTMLAnchorElement.cpp
--- a/content/html/content/src/nsHTMLAnchorElement.cpp	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/html/content/src/nsHTMLAnchorElement.cpp	Fri Oct 12 15:18:39 2007 -0700
@@ -241,7 +241,7 @@ nsHTMLAnchorElement::SetFocus(nsPresCont
   nsILinkHandler *handler = aPresContext->GetLinkHandler();
   if (handler && aPresContext->EventStateManager()->
                                SetContentState(this, NS_EVENT_STATE_FOCUS)) {
-    nsCOMPtr<nsIPresShell> presShell = aPresContext->GetPresShell();
+    nsIPresShell* presShell = aPresContext->GetPresShell();
     if (presShell) {
       presShell->ScrollContentIntoView(this, NS_PRESSHELL_SCROLL_IF_NOT_VISIBLE,
                                        NS_PRESSHELL_SCROLL_IF_NOT_VISIBLE);
@@ -258,8 +258,8 @@ nsHTMLAnchorElement::IsFocusable(PRInt32
 
   if (!HasAttr(kNameSpaceID_None, nsGkAtoms::tabindex)) {
     // check whether we're actually a link
-    nsCOMPtr<nsIURI> absURI;
-    if (!IsLink(getter_AddRefs(absURI))) {
+    nsIURI* absURI;
+    if (!IsLink(&absURI)) {
       // Not tabbable or focusable without href (bug 17605), unless
       // forced to be via presence of nonnegative tabindex attribute
       if (aTabIndex) {
@@ -527,8 +527,8 @@ nsHTMLAnchorElement::GetText(nsAString& 
   // of the anchor. Returns an empty string if there is no text node.
   // The nsIContentIterator does exactly what we want, if we start the 
   // iteration from the end.
-  nsCOMPtr<nsIContentIterator> iter;
-  nsresult rv = NS_NewContentIterator(getter_AddRefs(iter));
+  nsIContentIterator* iter;
+  nsresult rv = NS_NewContentIterator(&iter);
   NS_ENSURE_SUCCESS(rv, rv);
 
   // Initialize the content iterator with the children of the anchor
@@ -541,7 +541,7 @@ nsHTMLAnchorElement::GetText(nsAString& 
   iter->Prev();
 
   while(!iter->IsDone()) {
-    nsCOMPtr<nsIDOMText> textNode(do_QueryInterface(iter->GetCurrentNode()));
+    nsIDOMText* textNode(do_QueryInterface(iter->GetCurrentNode()));
     if(textNode) {
       // The current node is a text node. Get its value and break the loop.
       textNode->GetData(aText);
diff -r 546e94dbb8b1 content/html/content/src/nsHTMLAreaElement.cpp
--- a/content/html/content/src/nsHTMLAreaElement.cpp	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/html/content/src/nsHTMLAreaElement.cpp	Fri Oct 12 15:18:39 2007 -0700
@@ -206,7 +206,7 @@ nsHTMLAreaElement::SetFocus(nsPresContex
                                                           NS_EVENT_STATE_FOCUS)) {
     return;
   }
-  nsCOMPtr<nsIPresShell> presShell = aPresContext->GetPresShell();
+  nsIPresShell* presShell = aPresContext->GetPresShell();
   if (presShell) {
     presShell->ScrollContentIntoView(this, NS_PRESSHELL_SCROLL_ANYWHERE,
                                      NS_PRESSHELL_SCROLL_ANYWHERE);
diff -r 546e94dbb8b1 content/html/content/src/nsHTMLBodyElement.cpp
--- a/content/html/content/src/nsHTMLBodyElement.cpp	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/html/content/src/nsHTMLBodyElement.cpp	Fri Oct 12 15:18:39 2007 -0700
@@ -113,7 +113,7 @@ public:
   virtual nsMapRuleToAttributesFunc GetAttributeMappingFunction() const;
   NS_IMETHOD WalkContentStyleRules(nsRuleWalker* aRuleWalker);
   NS_IMETHOD_(PRBool) IsAttributeMapped(const nsIAtom* aAttribute) const;
-  virtual already_AddRefed<nsIEditor> GetAssociatedEditor();
+  virtual nsIEditor* GetAssociatedEditor();
   virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
 private:
   nsresult GetColorHelper(nsIAtom* aAtom, nsAString& aColor);
@@ -225,9 +225,9 @@ BodyRule::MapRuleInfoInto(nsRuleData* aD
   // if marginwidth or marginheight is set in the <frame> and not set in the <body>
   // reflect them as margin in the <body>
   if (bodyMarginWidth == -1 || bodyMarginHeight == -1) {
-    nsCOMPtr<nsISupports> container = aData->mPresContext->GetContainer();
+    nsISupports* container = aData->mPresContext->GetContainer();
     if (container) {
-      nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(container));
+      nsIDocShell* docShell(do_QueryInterface(container));
       if (docShell) {
         nscoord frameMarginWidth=-1;  // default value
         nscoord frameMarginHeight=-1; // default value
@@ -573,7 +573,7 @@ nsHTMLBodyElement::IsAttributeMapped(con
   return FindAttributeDependence(aAttribute, map, NS_ARRAY_LENGTH(map));
 }
 
-already_AddRefed<nsIEditor>
+nsIEditor*
 nsHTMLBodyElement::GetAssociatedEditor()
 {
   nsIEditor* editor = nsnull;
@@ -592,8 +592,8 @@ nsHTMLBodyElement::GetAssociatedEditor()
     return nsnull;
   }
 
-  nsCOMPtr<nsISupports> container = presContext->GetContainer();
-  nsCOMPtr<nsIEditorDocShell> editorDocShell = do_QueryInterface(container);
+  nsISupports* container = presContext->GetContainer();
+  nsIEditorDocShell* editorDocShell = do_QueryInterface(container);
   if (!editorDocShell) {
     return nsnull;
   }
diff -r 546e94dbb8b1 content/html/content/src/nsHTMLButtonElement.cpp
--- a/content/html/content/src/nsHTMLButtonElement.cpp	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/html/content/src/nsHTMLButtonElement.cpp	Fri Oct 12 15:18:39 2007 -0700
@@ -218,12 +218,12 @@ nsHTMLButtonElement::Click()
   mHandlingClick = PR_TRUE;
   // Hold on to the document in case one of the events makes it die or
   // something...
-  nsCOMPtr<nsIDocument> doc = GetCurrentDoc();
+  nsIDocument* doc = GetCurrentDoc();
 
   if (doc) {
     nsIPresShell *shell = doc->GetPrimaryShell();
     if (shell) {
-      nsCOMPtr<nsPresContext> context = shell->GetPresContext();
+      nsPresContext* context = shell->GetPresContext();
       if (context) {
         // Click() is never called from native code, but it may be
         // called from chrome JS. Mark this event trusted if Click()
@@ -357,7 +357,7 @@ nsHTMLButtonElement::PostHandleEvent(nsE
       NS_IS_MOUSE_LEFT_CLICK(aVisitor.mEvent)) {
     nsUIEvent actEvent(NS_IS_TRUSTED_EVENT(aVisitor.mEvent), NS_UI_ACTIVATE, 1);
 
-    nsCOMPtr<nsIPresShell> shell = aVisitor.mPresContext->GetPresShell();
+    nsIPresShell* shell = aVisitor.mPresContext->GetPresShell();
     if (shell) {
       nsEventStatus status = nsEventStatus_eIgnore;
       mInInternalActivate = PR_TRUE;
@@ -471,7 +471,7 @@ nsHTMLButtonElement::PostHandleEvent(nsE
         event.originator     = this;
         nsEventStatus status = nsEventStatus_eIgnore;
 
-        nsCOMPtr<nsIPresShell> presShell =
+        nsIPresShell* presShell =
           aVisitor.mPresContext->GetPresShell();
         // If |nsIPresShell::Destroy| has been called due to
         // handling the event, the pres context will return
@@ -480,7 +480,7 @@ nsHTMLButtonElement::PostHandleEvent(nsE
         // Using presShell to dispatch the event. It makes sure that
         // event is not handled if the window is being destroyed.
         if (presShell) {
-          nsCOMPtr<nsIContent> form(do_QueryInterface(mForm));
+          nsIContent* form(do_QueryInterface(mForm));
           presShell->HandleDOMEventWithTarget(form, &event, &status);
         }
       }
diff -r 546e94dbb8b1 content/html/content/src/nsHTMLCanvasElement.cpp
--- a/content/html/content/src/nsHTMLCanvasElement.cpp	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/html/content/src/nsHTMLCanvasElement.cpp	Fri Oct 12 15:18:39 2007 -0700
@@ -145,7 +145,7 @@ nsHTMLCanvasElement::~nsHTMLCanvasElemen
 nsHTMLCanvasElement::~nsHTMLCanvasElement()
 {
   if (mCurrentContext) {
-    nsCOMPtr<nsICanvasRenderingContextInternal> internalctx(do_QueryInterface(mCurrentContext));
+    nsICanvasRenderingContextInternal* internalctx(do_QueryInterface(mCurrentContext));
     internalctx->SetCanvasElement(nsnull);
     mCurrentContext = nsnull;
   }
@@ -286,9 +286,9 @@ nsHTMLCanvasElement::ToDataURL(nsAString
 {
   nsresult rv;
 
-  nsCOMPtr<nsIXPCNativeCallContext> ncc;
+  nsIXPCNativeCallContext* ncc;
   rv = nsContentUtils::XPConnect()->
-    GetCurrentNativeCallContext(getter_AddRefs(ncc));
+    GetCurrentNativeCallContext(&ncc);
   NS_ENSURE_SUCCESS(rv, rv);
 
   if (!ncc)
@@ -365,15 +365,15 @@ nsHTMLCanvasElement::ToDataURLImpl(const
   // We get an input stream from the context. If more than one context type
   // is supported in the future, this will have to be changed to do the right
   // thing. For now, just assume that the 2D context has all the goods.
-  nsCOMPtr<nsICanvasRenderingContextInternal> context;
-  rv = GetContext(NS_LITERAL_STRING("2d"), getter_AddRefs(context));
+  nsICanvasRenderingContextInternal* context;
+  rv = GetContext(NS_LITERAL_STRING("2d"), (nsISupports**)&context);
   NS_ENSURE_SUCCESS(rv, rv);
 
   // get image bytes
-  nsCOMPtr<nsIInputStream> imgStream;
+  nsIInputStream* imgStream;
   NS_ConvertUTF16toUTF8 aMimeType8(aMimeType);
   rv = context->GetInputStream(aMimeType8, aEncoderOptions,
-                               getter_AddRefs(imgStream));
+                               &imgStream);
   // XXX ERRMSG we need to report an error to developers here! (bug 329026)
   NS_ENSURE_SUCCESS(rv, rv);
 
diff -r 546e94dbb8b1 content/html/content/src/nsHTMLFormElement.cpp
--- a/content/html/content/src/nsHTMLFormElement.cpp	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/html/content/src/nsHTMLFormElement.cpp	Fri Oct 12 15:18:39 2007 -0700
@@ -260,7 +260,7 @@ protected:
    * @param aFormSubmission the submission object
    * @param aEvent the DOM event that was passed to us for the submit
    */
-  nsresult BuildSubmission(nsCOMPtr<nsIFormSubmission>& aFormSubmission, 
+  nsresult BuildSubmission(nsIFormSubmission*& aFormSubmission, 
                            nsEvent* aEvent);
   /**
    * Perform the submission (called by DoSubmit and FlushPendingSubmission)
@@ -639,7 +639,7 @@ nsHTMLFormElement::Submit()
 {
   // Send the submit event
   nsresult rv = NS_OK;
-  nsCOMPtr<nsPresContext> presContext = GetPresContext();
+  nsPresContext* presContext = GetPresContext();
   if (mPendingSubmission) {
     // aha, we have a pending submission that was not flushed
     // (this happens when form.submit() is called twice)
@@ -703,7 +703,7 @@ nsHTMLFormElement::BindToTree(nsIDocumen
                                                  aCompileEventHandlers);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  nsCOMPtr<nsIHTMLDocument> htmlDoc(do_QueryInterface(aDocument));
+  nsIHTMLDocument* htmlDoc(do_QueryInterface(aDocument));
   if (htmlDoc) {
     htmlDoc->AddedForm();
   }
@@ -714,7 +714,7 @@ void
 void
 nsHTMLFormElement::UnbindFromTree(PRBool aDeep, PRBool aNullParent)
 {
-  nsCOMPtr<nsIHTMLDocument> oldDocument = do_QueryInterface(GetCurrentDoc());
+  nsIHTMLDocument* oldDocument = do_QueryInterface(GetCurrentDoc());
 
   nsGenericHTMLElement::UnbindFromTree(aDeep, aNullParent);
 
@@ -832,8 +832,8 @@ nsHTMLFormElement::DoReset()
   PRUint32 numElements;
   GetElementCount(&numElements);
   for (PRUint32 elementX = 0; (elementX < numElements); elementX++) {
-    nsCOMPtr<nsIFormControl> controlNode;
-    GetElementAt(elementX, getter_AddRefs(controlNode));
+    nsIFormControl* controlNode;
+    GetElementAt(elementX, &controlNode);
     if (controlNode) {
       controlNode->Reset();
     }
@@ -863,7 +863,7 @@ nsHTMLFormElement::DoSubmit(nsEvent* aEv
   mIsSubmitting = PR_TRUE;
   NS_ASSERTION(!mWebProgress && !mSubmittingRequest, "Web progress / submitting request should not exist here!");
 
-  nsCOMPtr<nsIFormSubmission> submission;
+  nsIFormSubmission* submission;
    
   //
   // prepare the submission object
@@ -899,7 +899,7 @@ nsHTMLFormElement::DoSubmit(nsEvent* aEv
 }
 
 nsresult
-nsHTMLFormElement::BuildSubmission(nsCOMPtr<nsIFormSubmission>& aFormSubmission, 
+nsHTMLFormElement::BuildSubmission(nsIFormSubmission*& aFormSubmission, 
                                    nsEvent* aEvent)
 {
   NS_ASSERTION(!mPendingSubmission, "tried to build two submissions!");
@@ -917,7 +917,7 @@ nsHTMLFormElement::BuildSubmission(nsCOM
   //
   // Get the submission object
   //
-  rv = GetSubmissionFromForm(this, getter_AddRefs(aFormSubmission));
+  rv = GetSubmissionFromForm(this, &aFormSubmission);
   NS_ENSURE_SUBMIT_SUCCESS(rv);
 
   //
@@ -936,8 +936,8 @@ nsHTMLFormElement::SubmitSubmission(nsIF
   //
   // Get the action and target
   //
-  nsCOMPtr<nsIURI> actionURI;
-  rv = GetActionURL(getter_AddRefs(actionURI));
+  nsIURI* actionURI;
+  rv = GetActionURL(&actionURI);
   NS_ENSURE_SUBMIT_SUCCESS(rv);
 
   if (!actionURI) {
@@ -947,8 +947,8 @@ nsHTMLFormElement::SubmitSubmission(nsIF
 
   // If there is no link handler, then we won't actually be able to submit.
   nsIDocument* doc = GetCurrentDoc();
-  nsCOMPtr<nsISupports> container = doc ? doc->GetContainer() : nsnull;
-  nsCOMPtr<nsILinkHandler> linkHandler(do_QueryInterface(container));
+  nsISupports* container = doc ? doc->GetContainer() : nsnull;
+  nsILinkHandler* linkHandler(do_QueryInterface(container));
   if (!linkHandler || IsEditable()) {
     mIsSubmitting = PR_FALSE;
     return NS_OK;
@@ -1003,7 +1003,7 @@ nsHTMLFormElement::SubmitSubmission(nsIF
   //
   // Submit
   //
-  nsCOMPtr<nsIDocShell> docShell;
+  nsIDocShell* docShell;
 
   {
     nsAutoPopupStatePusher popupStatePusher(mSubmitPopupState);
@@ -1011,7 +1011,7 @@ nsHTMLFormElement::SubmitSubmission(nsIF
     nsAutoHandlingUserInputStatePusher userInpStatePusher(mSubmitInitiatedFromUserInput);
 
     rv = aFormSubmission->SubmitTo(actionURI, target, this, linkHandler,
-                                   getter_AddRefs(docShell),
+                                   &docShell,
                                    getter_AddRefs(mSubmittingRequest));
   }
 
@@ -1055,31 +1055,31 @@ nsHTMLFormElement::NotifySubmitObservers
 
   // Notify observers that the form is being submitted.
   nsresult rv = NS_OK;
-  nsCOMPtr<nsIObserverService> service =
+  nsIObserverService* service =
     do_GetService("@mozilla.org/observer-service;1", &rv);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  nsCOMPtr<nsISimpleEnumerator> theEnum;
+  nsISimpleEnumerator* theEnum;
   rv = service->EnumerateObservers(aEarlyNotify ?
                                    NS_EARLYFORMSUBMIT_SUBJECT :
                                    NS_FORMSUBMIT_SUBJECT,
-                                   getter_AddRefs(theEnum));
+                                   &theEnum);
   NS_ENSURE_SUCCESS(rv, rv);
 
   if (theEnum) {
-    nsCOMPtr<nsISupports> inst;
+    nsISupports* inst;
     *aCancelSubmit = PR_FALSE;
 
     // XXXbz what do the submit observers actually want?  The window
     // of the document this is shown in?  Or something else?
     // sXBL/XBL2 issue
-    nsCOMPtr<nsPIDOMWindow> window = GetOwnerDoc()->GetWindow();
+    nsPIDOMWindow* window = GetOwnerDoc()->GetWindow();
 
     PRBool loop = PR_TRUE;
     while (NS_SUCCEEDED(theEnum->HasMoreElements(&loop)) && loop) {
-      theEnum->GetNext(getter_AddRefs(inst));
-
-      nsCOMPtr<nsIFormSubmitObserver> formSubmitObserver(
+      theEnum->GetNext(&inst);
+
+      nsIFormSubmitObserver* formSubmitObserver(
                       do_QueryInterface(inst));
       if (formSubmitObserver) {
         rv = formSubmitObserver->Notify(this,
@@ -1157,8 +1157,8 @@ static PRInt32 CompareFormControlPositio
 {
   NS_ASSERTION(aControl1 != aControl2, "Comparing a form control to itself");
 
-  nsCOMPtr<nsIContent> content1 = do_QueryInterface(aControl1);
-  nsCOMPtr<nsIContent> content2 = do_QueryInterface(aControl2);
+  nsIContent* content1 = do_QueryInterface(aControl1);
+  nsIContent* content2 = do_QueryInterface(aControl2);
 
   NS_ASSERTION(content1 && content2,
                "We should be able to QI to nsIContent here!");
@@ -1199,7 +1199,7 @@ nsHTMLFormElement::AddElement(nsIFormCon
 {
 #ifdef DEBUG
   {
-    nsCOMPtr<nsIContent> content = do_QueryInterface(aChild);
+    nsIContent* content = do_QueryInterface(aChild);
     NS_ASSERTION(content->GetParent(),
                  "Form control should have a parent");
   }
@@ -1215,7 +1215,7 @@ nsHTMLFormElement::AddElement(nsIFormCon
                "Form control already in form");
 
   PRUint32 count = controlList.Length();
-  nsCOMPtr<nsIFormControl> element;
+  nsIFormControl* element;
   
   // Optimize most common case where we insert at the end.
   PRBool lastElement = PR_FALSE;
@@ -1261,7 +1261,7 @@ nsHTMLFormElement::AddElement(nsIFormCon
   //
   PRInt32 type = aChild->GetType();
   if (type == NS_FORM_INPUT_RADIO) {
-    nsCOMPtr<nsIRadioControlElement> radio = do_QueryInterface(aChild);
+    nsIRadioControlElement* radio = do_QueryInterface(aChild);
     nsresult rv = radio->AddedToRadioGroup();
     NS_ENSURE_SUCCESS(rv, rv);
   }
@@ -1322,7 +1322,7 @@ nsHTMLFormElement::AddElement(nsIFormCon
       nsIDocument* document = GetCurrentDoc();
       if (document) {
         MOZ_AUTO_DOC_UPDATE(document, UPDATE_CONTENT_STATE, PR_TRUE);
-        nsCOMPtr<nsIContent> oldElement(do_QueryInterface(oldDefaultSubmit));
+        nsIContent* oldElement(do_QueryInterface(oldDefaultSubmit));
         document->ContentStatesChanged(oldElement, nsnull,
                                        NS_EVENT_STATE_DEFAULT);
       }
@@ -1349,7 +1349,7 @@ nsHTMLFormElement::RemoveElement(nsIForm
   //
   nsresult rv = NS_OK;
   if (aChild->GetType() == NS_FORM_INPUT_RADIO) {
-    nsCOMPtr<nsIRadioControlElement> radio = do_QueryInterface(aChild);
+    nsIRadioControlElement* radio = do_QueryInterface(aChild);
     rv = radio->WillRemoveFromRadioGroup();
     NS_ENSURE_SUCCESS(rv, rv);
   }
@@ -1414,7 +1414,7 @@ nsHTMLFormElement::RemoveElement(nsIForm
       nsIDocument* document = GetCurrentDoc();
       if (document) {
         MOZ_AUTO_DOC_UPDATE(document, UPDATE_CONTENT_STATE, PR_TRUE);
-        nsCOMPtr<nsIContent> newElement(do_QueryInterface(mDefaultSubmitElement));
+        nsIContent* newElement(do_QueryInterface(mDefaultSubmitElement));
         document->ContentStatesChanged(newElement, nsnull,
                                        NS_EVENT_STATE_DEFAULT);
       }
@@ -1455,10 +1455,10 @@ nsHTMLFormElement::OnSubmitClickBegin()
   // Prepare to run NotifySubmitObservers early before the
   // scripts on the page get to modify the form data, possibly
   // throwing off any password manager. (bug 257781)
-  nsCOMPtr<nsIURI> actionURI;
+  nsIURI* actionURI;
   nsresult rv;
 
-  rv = GetActionURL(getter_AddRefs(actionURI));
+  rv = GetActionURL(&actionURI);
   if (NS_FAILED(rv) || !actionURI)
     return NS_OK;
 
@@ -1485,7 +1485,7 @@ NS_IMETHODIMP
 NS_IMETHODIMP
 nsHTMLFormElement::FlushPendingSubmission()
 {
-  nsCOMPtr<nsIFormSubmission> kunkFuDeathGrip(mPendingSubmission);
+  nsIFormSubmission* kunkFuDeathGrip(mPendingSubmission);
 
   if (!mPendingSubmission) {
     return NS_OK;
@@ -1545,24 +1545,24 @@ nsHTMLFormElement::GetActionURL(nsIURI**
   // XUL, do nothing. This prevents undesirable reloading of
   // a document inside XUL.
 
-  nsCOMPtr<nsIURI> actionURL;
+  nsIURI* actionURL;
   if (action.IsEmpty()) {
-    nsCOMPtr<nsIHTMLDocument> htmlDoc(do_QueryInterface(document));
+    nsIHTMLDocument* htmlDoc(do_QueryInterface(document));
     if (!htmlDoc) {
       // Must be a XML, XUL or other non-HTML document type
       // so do nothing.
       return NS_OK;
     }
 
-    rv = docURI->Clone(getter_AddRefs(actionURL));
+    rv = docURI->Clone(&actionURL);
     NS_ENSURE_SUCCESS(rv, rv);
   } else {
-    nsCOMPtr<nsIURI> baseURL = GetBaseURI();
+    nsIURI* baseURL = GetBaseURI();
     NS_ASSERTION(baseURL, "No Base URL found in Form Submit!\n");
     if (!baseURL) {
       return NS_OK; // No base URL -> exit early, see Bug 30721
     }
-    rv = NS_NewURI(getter_AddRefs(actionURL), action, nsnull, baseURL);
+    rv = NS_NewURI(&actionURL, action, nsnull, baseURL);
     NS_ENSURE_SUCCESS(rv, rv);
   }
 
@@ -1749,10 +1749,10 @@ nsHTMLFormElement::GetPositionInGroup(ns
     return NS_OK;
   }
 
-  nsCOMPtr<nsISupports> itemWithName;
-  nsresult rv = ResolveName(name, getter_AddRefs(itemWithName));
+  nsISupports* itemWithName;
+  nsresult rv = ResolveName(name, &itemWithName);
   NS_ENSURE_SUCCESS(rv, rv);
-  nsCOMPtr<nsIDOMNodeList> radioNodeList(do_QueryInterface(itemWithName));
+  nsIDOMNodeList* radioNodeList(do_QueryInterface(itemWithName));
 
   // XXX If ResolveName could return an nsContentList instead then we 
   //     could get an nsContentList instead of using this hacky upcast
@@ -1763,7 +1763,7 @@ nsHTMLFormElement::GetPositionInGroup(ns
     return NS_OK;
   }
 
-  nsCOMPtr<nsIContent> currentRadioNode(do_QueryInterface(aRadio));
+  nsIContent* currentRadioNode(do_QueryInterface(aRadio));
   NS_ASSERTION(currentRadioNode, "No nsIContent for current radio button");
   *aPositionIndex = radioGroup->IndexOf(currentRadioNode, PR_TRUE);
   NS_ASSERTION(*aPositionIndex >= 0, "Radio button not found in its own group");
@@ -1784,17 +1784,17 @@ nsHTMLFormElement::GetNextRadioButton(co
   // If no radio is focused, get the radio relative to the selected one.
   *aRadioOut = nsnull;
 
-  nsCOMPtr<nsIDOMHTMLInputElement> currentRadio;
+  nsIDOMHTMLInputElement* currentRadio;
   if (aFocusedRadio) {
     currentRadio = aFocusedRadio;
   }
   else {
-    mSelectedRadioButtons.Get(aName, getter_AddRefs(currentRadio));
-  }
-
-  nsCOMPtr<nsISupports> itemWithName;
-  ResolveName(aName, getter_AddRefs(itemWithName));
-  nsCOMPtr<nsIDOMNodeList> radioNodeList(do_QueryInterface(itemWithName));
+    mSelectedRadioButtons.Get(aName, &currentRadio);
+  }
+
+  nsISupports* itemWithName;
+  ResolveName(aName, &itemWithName);
+  nsIDOMNodeList* radioNodeList(do_QueryInterface(itemWithName));
 
   // XXX If ResolveName could return an nsContentList instead then we 
   //     could get an nsContentList instead of using this hacky upcast
@@ -1805,7 +1805,7 @@ nsHTMLFormElement::GetNextRadioButton(co
     return NS_ERROR_FAILURE;
   }
 
-  nsCOMPtr<nsIContent> currentRadioNode(do_QueryInterface(currentRadio));
+  nsIContent* currentRadioNode(do_QueryInterface(currentRadio));
   NS_ASSERTION(currentRadioNode, "No nsIContent for current radio button");
   PRInt32 index = radioGroup->IndexOf(currentRadioNode, PR_TRUE);
   if (index < 0) {
@@ -1815,9 +1815,9 @@ nsHTMLFormElement::GetNextRadioButton(co
   PRUint32 numRadios;
   radioGroup->GetLength(&numRadios);
   PRBool disabled = PR_TRUE;
-  nsCOMPtr<nsIDOMHTMLInputElement> radio;
-  nsCOMPtr<nsIDOMNode> radioDOMNode;
-  nsCOMPtr<nsIFormControl> formControl;
+  nsIDOMHTMLInputElement* radio;
+  nsIDOMNode* radioDOMNode;
+  nsIFormControl* formControl;
 
   do {
     if (aPrevious) {
@@ -1828,7 +1828,7 @@ nsHTMLFormElement::GetNextRadioButton(co
     else if (++index >= (PRInt32)numRadios) {
       index = 0;
     }
-    radioGroup->Item(index, getter_AddRefs(radioDOMNode));
+    radioGroup->Item(index, &radioDOMNode);
     radio = do_QueryInterface(radioDOMNode);
     if (!radio)
       continue;
@@ -1858,13 +1858,13 @@ nsHTMLFormElement::WalkRadioGroup(const 
     // XXX If the name is empty, it's not stored in the control list.  There
     // *must* be a more efficient way to do this.
     //
-    nsCOMPtr<nsIFormControl> control;
+    nsIFormControl* control;
     PRUint32 len = 0;
     GetElementCount(&len);
     for (PRUint32 i=0; i<len; i++) {
-      GetElementAt(i, getter_AddRefs(control));
+      GetElementAt(i, &control);
       if (control->GetType() == NS_FORM_INPUT_RADIO) {
-        nsCOMPtr<nsIContent> controlContent(do_QueryInterface(control));
+        nsIContent* controlContent(do_QueryInterface(control));
         if (controlContent) {
           if (controlContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::name,
                                           EmptyString(), eCaseMatters)) {
@@ -1880,27 +1880,27 @@ nsHTMLFormElement::WalkRadioGroup(const 
     //
     // Get the control / list of controls from the form using form["name"]
     //
-    nsCOMPtr<nsISupports> item;
-    rv = DoResolveName(aName, aFlushContent, getter_AddRefs(item));
+    nsISupports* item;
+    rv = DoResolveName(aName, aFlushContent, &item);
 
     if (item) {
       //
       // If it's just a lone radio button, then select it.
       //
-      nsCOMPtr<nsIFormControl> formControl(do_QueryInterface(item));
+      nsIFormControl* formControl(do_QueryInterface(item));
       if (formControl) {
         if (formControl->GetType() == NS_FORM_INPUT_RADIO) {
           aVisitor->Visit(formControl, &stopIterating);
         }
       } else {
-        nsCOMPtr<nsIDOMNodeList> nodeList(do_QueryInterface(item));
+        nsIDOMNodeList* nodeList(do_QueryInterface(item));
         if (nodeList) {
           PRUint32 length = 0;
           nodeList->GetLength(&length);
           for (PRUint32 i=0; i<length; i++) {
-            nsCOMPtr<nsIDOMNode> node;
-            nodeList->Item(i, getter_AddRefs(node));
-            nsCOMPtr<nsIFormControl> formControl(do_QueryInterface(node));
+            nsIDOMNode* node;
+            nodeList->Item(i, &node);
+            nsIFormControl* formControl(do_QueryInterface(node));
             if (formControl) {
               if (formControl->GetType() == NS_FORM_INPUT_RADIO) {
                 aVisitor->Visit(formControl, &stopIterating);
@@ -2062,9 +2062,9 @@ nsFormControlList::NamedItem(const nsASt
 
   nsresult rv = NS_OK;
 
-  nsCOMPtr<nsISupports> supports;
+  nsISupports* supports;
   
-  if (!mNameLookupTable.Get(aName, getter_AddRefs(supports))) // key not found
+  if (!mNameLookupTable.Get(aName, &supports)) // key not found
      return rv;
 
   if (supports) {
@@ -2073,7 +2073,7 @@ nsFormControlList::NamedItem(const nsASt
 
     if (!*aReturn) {
       // If not, we check if it's a node list.
-      nsCOMPtr<nsIDOMNodeList> nodeList(do_QueryInterface(supports));
+      nsIDOMNodeList* nodeList(do_QueryInterface(supports));
       NS_ASSERTION(nodeList, "Huh, what's going one here?");
 
       if (nodeList) {
@@ -2115,18 +2115,18 @@ nsFormControlList::AddElementToTable(nsI
     return NS_OK;
   }
 
-  nsCOMPtr<nsISupports> supports;
-  mNameLookupTable.Get(aName, getter_AddRefs(supports));
+  nsISupports* supports;
+  mNameLookupTable.Get(aName, &supports);
 
   if (!supports) {
     // No entry found, add the form control
-    nsCOMPtr<nsISupports> child(do_QueryInterface(aChild));
+    nsISupports* child(do_QueryInterface(aChild));
 
     NS_ENSURE_TRUE( mNameLookupTable.Put(aName, child), NS_ERROR_FAILURE );
   } else {
     // Found something in the hash, check its type
-    nsCOMPtr<nsIContent> content(do_QueryInterface(supports));
-    nsCOMPtr<nsIContent> newChild(do_QueryInterface(aChild));
+    nsIContent* content(do_QueryInterface(supports));
+    nsIContent* newChild(do_QueryInterface(aChild));
 
     if (content) {
       // Check if the new content is the same as the one we found in the
@@ -2147,19 +2147,19 @@ nsFormControlList::AddElementToTable(nsI
       // Add the new child too
       list->AppendElement(newChild);
 
-      nsCOMPtr<nsISupports> listSupports = do_QueryInterface(list);
+      nsISupports* listSupports = do_QueryInterface(list);
 
       // Replace the element with the list.
       NS_ENSURE_TRUE(mNameLookupTable.Put(aName, listSupports),
                      NS_ERROR_FAILURE);
     } else {
       // There's already a list in the hash, add the child to the list
-      nsCOMPtr<nsIDOMNodeList> nodeList(do_QueryInterface(supports));
+      nsIDOMNodeList* nodeList(do_QueryInterface(supports));
       NS_ENSURE_TRUE(nodeList, NS_ERROR_FAILURE);
 
       // Upcast, uggly, but it works!
       nsBaseContentList *list = static_cast<nsBaseContentList *>
-                                           ((nsIDOMNodeList *)nodeList.get());
+                                           ((nsIDOMNodeList *)nodeList);
 
       PRInt32 oldIndex = list->IndexOf(newChild, PR_FALSE);
       
@@ -2194,17 +2194,17 @@ nsFormControlList::RemoveElementFromTabl
     return NS_OK;
   }
 
-  nsCOMPtr<nsIContent> content = do_QueryInterface(aChild);  
+  nsIContent* content = do_QueryInterface(aChild);  
   if (!content) {
     return NS_OK;
   }
 
-  nsCOMPtr<nsISupports> supports;
-
-  if (!mNameLookupTable.Get(aName, getter_AddRefs(supports)))
+  nsISupports* supports;
+
+  if (!mNameLookupTable.Get(aName, &supports))
     return NS_OK;
 
-  nsCOMPtr<nsIFormControl> fctrl(do_QueryInterface(supports));
+  nsIFormControl* fctrl(do_QueryInterface(supports));
 
   if (fctrl) {
     // Single element in the hash, just remove it if it's the one
@@ -2216,12 +2216,12 @@ nsFormControlList::RemoveElementFromTabl
     return NS_OK;
   }
 
-  nsCOMPtr<nsIDOMNodeList> nodeList(do_QueryInterface(supports));
+  nsIDOMNodeList* nodeList(do_QueryInterface(supports));
   NS_ENSURE_TRUE(nodeList, NS_ERROR_FAILURE);
 
   // Upcast, uggly, but it works!
   nsBaseContentList *list = static_cast<nsBaseContentList *>
-                                       ((nsIDOMNodeList *)nodeList.get());
+                                       ((nsIDOMNodeList *)nodeList);
 
   list->RemoveElement(content);
 
@@ -2235,11 +2235,11 @@ nsFormControlList::RemoveElementFromTabl
   } else if (length == 1) {
     // Only one element left, replace the list in the hash with the
     // single element.
-    nsCOMPtr<nsIDOMNode> node;
-    list->Item(0, getter_AddRefs(node));
+    nsIDOMNode* node;
+    list->Item(0, &node);
 
     if (node) {
-      nsCOMPtr<nsISupports> tmp(do_QueryInterface(node));
+      nsISupports* tmp(do_QueryInterface(node));
       NS_ENSURE_TRUE(mNameLookupTable.Put(aName, tmp),NS_ERROR_FAILURE);
     }
   }
diff -r 546e94dbb8b1 content/html/content/src/nsHTMLImageElement.cpp
--- a/content/html/content/src/nsHTMLImageElement.cpp	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/html/content/src/nsHTMLImageElement.cpp	Fri Oct 12 15:18:39 2007 -0700
@@ -160,15 +160,15 @@ NS_NewHTMLImageElement(nsINodeInfo *aNod
    * that we request the nsINodeInfo from the document's nodeinfo list.
    */
   nsresult rv;
-  nsCOMPtr<nsINodeInfo> nodeInfo(aNodeInfo);
+  nsINodeInfo* nodeInfo(aNodeInfo);
   if (!nodeInfo) {
-    nsCOMPtr<nsIDocument> doc =
+    nsIDocument* doc =
       do_QueryInterface(nsContentUtils::GetDocumentFromCaller());
     NS_ENSURE_TRUE(doc, nsnull);
 
     rv = doc->NodeInfoManager()->GetNodeInfo(nsGkAtoms::img, nsnull,
                                              kNameSpaceID_None,
-                                             getter_AddRefs(nodeInfo));
+                                             &nodeInfo);
     NS_ENSURE_SUCCESS(rv, nsnull);
   }
 
@@ -285,9 +285,9 @@ nsHTMLImageElement::GetWidthHeight()
     size.height = nsPresContext::AppUnitsToIntCSSPixels(size.height);
   } else {
     const nsAttrValue* value;
-    nsCOMPtr<imgIContainer> image;
+    imgIContainer* image;
     if (mCurrentRequest) {
-      mCurrentRequest->GetImage(getter_AddRefs(image));
+      mCurrentRequest->GetImage(&image);
     }
 
     if ((value = GetParsedAttr(nsGkAtoms::width)) &&
@@ -445,7 +445,7 @@ nsHTMLImageElement::IsFocusable(PRInt32 
     // XXXbz which document should this be using?  sXBL/XBL2 issue!  I
     // think that GetOwnerDoc() is right, since we don't want to
     // assume stuff about the document we're bound to.
-    nsCOMPtr<nsIDOMHTMLMapElement> imageMap =
+    nsIDOMHTMLMapElement* imageMap =
       nsImageMapUtils::FindImageMap(GetOwnerDoc(), usemap);
     if (imageMap) {
       if (aTabIndex) {
@@ -486,7 +486,7 @@ nsHTMLImageElement::SetAttr(PRInt32 aNam
       return NS_OK;
     }
 
-    nsCOMPtr<imgIRequest> oldCurrentRequest = mCurrentRequest;
+    imgIRequest* oldCurrentRequest = mCurrentRequest;
 
     // Force image loading here, so that we'll try to load the image from
     // network if it's set to be not cacheable...  If we change things so that
@@ -500,8 +500,8 @@ nsHTMLImageElement::SetAttr(PRInt32 aNam
       // We have a current request, and it's not the same one as we used
       // to have, and we have no pending request.  So imglib already had
       // that image.  Reset the animation on it -- see bug 210001
-      nsCOMPtr<imgIContainer> container;
-      mCurrentRequest->GetImage(getter_AddRefs(container));
+      imgIContainer* container;
+      mCurrentRequest->GetImage(&container);
       if (container) {
         container->ResetAnimation();
       }
@@ -581,8 +581,8 @@ nsHTMLImageElement::GetNaturalHeight(PRI
     return NS_OK;
   }
   
-  nsCOMPtr<imgIContainer> image;
-  mCurrentRequest->GetImage(getter_AddRefs(image));
+  imgIContainer* image;
+  mCurrentRequest->GetImage(&image);
   if (!image) {
     return NS_OK;
   }
@@ -602,8 +602,8 @@ nsHTMLImageElement::GetNaturalWidth(PRIn
     return NS_OK;
   }
   
-  nsCOMPtr<imgIContainer> image;
-  mCurrentRequest->GetImage(getter_AddRefs(image));
+  imgIContainer* image;
+  mCurrentRequest->GetImage(&image);
   if (!image) {
     return NS_OK;
   }
diff -r 546e94dbb8b1 content/html/content/src/nsHTMLInputElement.cpp
--- a/content/html/content/src/nsHTMLInputElement.cpp	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/html/content/src/nsHTMLInputElement.cpp	Fri Oct 12 15:18:39 2007 -0700
@@ -235,7 +235,7 @@ public:
    * Get the radio group container for this button (form or document)
    * @return the radio group container (or null if no form or document)
    */
-  virtual already_AddRefed<nsIRadioGroupContainer> GetRadioGroupContainer();
+  virtual nsIRadioGroupContainer* GetRadioGroupContainer();
 
   virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
 
@@ -430,7 +430,7 @@ nsHTMLInputElement::Clone(nsINodeInfo *a
     return NS_ERROR_OUT_OF_MEMORY;
   }
 
-  nsCOMPtr<nsINode> kungFuDeathGrip = it;
+  nsINode* kungFuDeathGrip = it;
   nsresult rv = CopyInnerTo(it);
   NS_ENSURE_SUCCESS(rv, rv);
 
@@ -467,7 +467,7 @@ nsHTMLInputElement::Clone(nsINodeInfo *a
       break;
   }
 
-  kungFuDeathGrip.swap(*aResult);
+  swap(kungFuDeathGrip, *aResult);
 
   return NS_OK;
 }
@@ -850,8 +850,8 @@ nsHTMLInputElement::GetFile(nsIFile** aF
 
   if (!(*aFile)) {
     // this is no "file://", try as local file
-    nsCOMPtr<nsILocalFile> localFile;
-    rv = NS_NewLocalFile(*mFileName, PR_FALSE, getter_AddRefs(localFile));
+    nsILocalFile* localFile;
+    rv = NS_NewLocalFile(*mFileName, PR_FALSE, &localFile);
     NS_IF_ADDREF(*aFile = localFile);
   }
 
@@ -865,8 +865,8 @@ nsHTMLInputElement::UpdateFileList()
     mFileList->Clear();
 
     if (mType == NS_FORM_INPUT_FILE && mFileName) {
-      nsCOMPtr<nsIFile> file;
-      nsresult rv = GetFile(getter_AddRefs(file));
+      nsIFile* file;
+      nsresult rv = GetFile(&file);
       NS_ENSURE_SUCCESS(rv, rv);
 
       nsRefPtr<nsDOMFile> domFile = new nsDOMFile(file);
@@ -977,9 +977,9 @@ nsHTMLInputElement::DoSetCheckedChanged(
 {
   if (mType == NS_FORM_INPUT_RADIO) {
     if (GET_BOOLBIT(mBitField, BF_CHECKED_CHANGED) != aCheckedChanged) {
-      nsCOMPtr<nsIRadioVisitor> visitor;
+      nsIRadioVisitor* visitor;
       NS_GetRadioSetCheckedChangedVisitor(aCheckedChanged,
-                                          getter_AddRefs(visitor));
+                                          &visitor);
       VisitGroup(visitor, aNotify);
     }
   } else {
@@ -1043,7 +1043,7 @@ nsHTMLInputElement::DoSetChecked(PRBool 
       rv = RadioSetChecked(aNotify);
     } else {
       rv = SetCheckedInternal(PR_FALSE, aNotify);
-      nsCOMPtr<nsIRadioGroupContainer> container = GetRadioGroupContainer();
+      nsIRadioGroupContainer* container = GetRadioGroupContainer();
       if (container) {
         nsAutoString name;
         if (GetNameIfExists(name)) {
@@ -1066,15 +1066,15 @@ nsHTMLInputElement::RadioSetChecked(PRBo
   //
   // Find the selected radio button so we can deselect it
   //
-  nsCOMPtr<nsIDOMHTMLInputElement> currentlySelected;
-  nsCOMPtr<nsIRadioGroupContainer> container = GetRadioGroupContainer();
+  nsIDOMHTMLInputElement* currentlySelected;
+  nsIRadioGroupContainer* container = GetRadioGroupContainer();
   // This is ONLY INITIALIZED IF container EXISTS
   nsAutoString name;
   PRBool nameExists = PR_FALSE;
   if (container) {
     nameExists = GetNameIfExists(name);
     if (nameExists) {
-      container->GetCurrentRadioButton(name, getter_AddRefs(currentlySelected));
+      container->GetCurrentRadioButton(name, &currentlySelected);
     }
   }
 
@@ -1106,7 +1106,7 @@ nsHTMLInputElement::RadioSetChecked(PRBo
   return rv;
 }
 
-/* virtual */ already_AddRefed<nsIRadioGroupContainer>
+/* virtual */ nsIRadioGroupContainer*
 nsHTMLInputElement::GetRadioGroupContainer()
 {
   nsIRadioGroupContainer* retval = nsnull;
@@ -1129,7 +1129,7 @@ nsHTMLInputElement::MaybeSubmitForm(nsPr
     return NS_OK;
   }
   
-  nsCOMPtr<nsIPresShell> shell = aPresContext->GetPresShell();
+  nsIPresShell* shell = aPresContext->GetPresShell();
   if (!shell) {
     return NS_OK;
   }
@@ -1137,7 +1137,7 @@ nsHTMLInputElement::MaybeSubmitForm(nsPr
   // Get the default submit element
   nsIFormControl* submitControl = mForm->GetDefaultSubmitElement();
   if (submitControl) {
-    nsCOMPtr<nsIContent> submitContent(do_QueryInterface(submitControl));
+    nsIContent* submitContent(do_QueryInterface(submitControl));
     NS_ASSERTION(submitContent, "Form control not implementing nsIContent?!");
     // Fire the button's onclick handler and let the button handle
     // submitting the form.
@@ -1146,7 +1146,7 @@ nsHTMLInputElement::MaybeSubmitForm(nsPr
     shell->HandleDOMEventWithTarget(submitContent, &event, &status);
   } else if (mForm->HasSingleTextControl()) {
     // If there's only one text control, just submit the form
-    nsCOMPtr<nsIContent> form = do_QueryInterface(mForm);
+    nsIContent* form = do_QueryInterface(mForm);
     nsFormEvent event(PR_TRUE, NS_FORM_SUBMIT);
     nsEventStatus status  = nsEventStatus_eIgnore;
     shell->HandleDOMEventWithTarget(form, &event, &status);
@@ -1207,7 +1207,7 @@ nsHTMLInputElement::FireOnChange()
   //
   nsEventStatus status = nsEventStatus_eIgnore;
   nsEvent event(PR_TRUE, NS_FORM_CHANGE);
-  nsCOMPtr<nsPresContext> presContext = GetPresContext();
+  nsPresContext* presContext = GetPresContext();
   nsEventDispatcher::Dispatch(static_cast<nsIContent*>(this), presContext,
                               &event, nsnull, &status);
 }
@@ -1251,7 +1251,7 @@ nsHTMLInputElement::SetFocus(nsPresConte
   // If the window is not active, do not allow the focus to bring the
   // window to the front.  We update the focus controller, but do
   // nothing else.
-  nsCOMPtr<nsPIDOMWindow> win = doc->GetWindow();
+  nsPIDOMWindow* win = doc->GetWindow();
   if (win) {
     nsIFocusController *focusController = win->GetRootFocusController();
     if (focusController) {
@@ -1287,7 +1287,7 @@ nsHTMLInputElement::Select()
     // XXX Bug?  We have to give the input focus before contents can be
     // selected
 
-    nsCOMPtr<nsPresContext> presContext = GetPresContext();
+    nsPresContext* presContext = GetPresContext();
 
     // If the window is not active, do not allow the select to bring the
     // window to the front.  We update the focus controller, but do
@@ -1389,7 +1389,7 @@ nsHTMLInputElement::Click()
       mType == NS_FORM_INPUT_IMAGE) {
 
     // Strong in case the event kills it
-    nsCOMPtr<nsIDocument> doc = GetCurrentDoc();
+    nsIDocument* doc = GetCurrentDoc();
     if (!doc) {
       return rv;
     }
@@ -1397,7 +1397,7 @@ nsHTMLInputElement::Click()
     nsIPresShell *shell = doc->GetPrimaryShell();
 
     if (shell) {
-      nsCOMPtr<nsPresContext> context = shell->GetPresContext();
+      nsPresContext* context = shell->GetPresContext();
 
       if (context) {
         // Click() is never called from native code, but it may be
@@ -1495,13 +1495,13 @@ nsHTMLInputElement::PreHandleEvent(nsEve
 
       case NS_FORM_INPUT_RADIO:
         {
-          nsCOMPtr<nsIRadioGroupContainer> container = GetRadioGroupContainer();
+          nsIRadioGroupContainer* container = GetRadioGroupContainer();
           if (container) {
             nsAutoString name;
             if (GetNameIfExists(name)) {
-              nsCOMPtr<nsIDOMHTMLInputElement> selectedRadioButton;
+              nsIDOMHTMLInputElement* selectedRadioButton;
               container->GetCurrentRadioButton(name,
-                                               getter_AddRefs(selectedRadioButton));
+                                               &selectedRadioButton);
               aVisitor.mItemData = selectedRadioButton;
             }
           }
@@ -1589,7 +1589,7 @@ nsHTMLInputElement::PostHandleEvent(nsEv
       NS_IS_MOUSE_LEFT_CLICK(aVisitor.mEvent)) {
     nsUIEvent actEvent(NS_IS_TRUSTED_EVENT(aVisitor.mEvent), NS_UI_ACTIVATE, 1);
 
-    nsCOMPtr<nsIPresShell> shell = aVisitor.mPresContext->GetPresShell();
+    nsIPresShell* shell = aVisitor.mPresContext->GetPresShell();
     if (shell) {
       nsEventStatus status = nsEventStatus_eIgnore;
       SET_BOOLBIT(mBitField, BF_IN_INTERNAL_ACTIVATE, PR_TRUE);
@@ -1628,7 +1628,7 @@ nsHTMLInputElement::PostHandleEvent(nsEv
       // if it was cancelled and a radio button, then set the old
       // selected btn to TRUE. if it is a checkbox then set it to its
       // original value
-      nsCOMPtr<nsIDOMHTMLInputElement> selectedRadioButton =
+      nsIDOMHTMLInputElement* selectedRadioButton =
         do_QueryInterface(aVisitor.mItemData);
       if (selectedRadioButton) {
         selectedRadioButton->SetChecked(PR_TRUE);
@@ -1651,7 +1651,7 @@ nsHTMLInputElement::PostHandleEvent(nsEv
         FireEventForAccessibility(this, aVisitor.mPresContext,
                                   NS_LITERAL_STRING("RadioStateChange"));
         // Fire event for the previous selected radio.
-        nsCOMPtr<nsIDOMHTMLInputElement> previous =
+        nsIDOMHTMLInputElement* previous =
           do_QueryInterface(aVisitor.mItemData);
         if(previous) {
           FireEventForAccessibility(previous, aVisitor.mPresContext,
@@ -1727,14 +1727,14 @@ nsHTMLInputElement::PostHandleEvent(nsEv
               case NS_VK_DOWN:
               case NS_VK_RIGHT:
               // Arrow key pressed, focus+select prev/next radio button
-              nsCOMPtr<nsIRadioGroupContainer> container = GetRadioGroupContainer();
+              nsIRadioGroupContainer* container = GetRadioGroupContainer();
               if (container) {
                 nsAutoString name;
                 if (GetNameIfExists(name)) {
-                  nsCOMPtr<nsIDOMHTMLInputElement> selectedRadioButton;
+                  nsIDOMHTMLInputElement* selectedRadioButton;
                   container->GetNextRadioButton(name, isMovingBack, this,
-                                                getter_AddRefs(selectedRadioButton));
-                  nsCOMPtr<nsIContent> radioContent =
+                                                &selectedRadioButton);
+                  nsIContent* radioContent =
                     do_QueryInterface(selectedRadioButton);
                   if (radioContent) {
                     rv = selectedRadioButton->Focus();
@@ -1780,7 +1780,7 @@ nsHTMLInputElement::PostHandleEvent(nsEv
             // If this is an enter on the button of a file input, don't submit
             // -- that's supposed to put up the filepicker
             if (mType == NS_FORM_INPUT_FILE) {
-              nsCOMPtr<nsIContent> maybeButton =
+              nsIContent* maybeButton =
                 do_QueryInterface(aVisitor.mEvent->originalTarget);
               if (maybeButton) {
                 isButton = maybeButton->AttrValueIs(kNameSpaceID_None,
@@ -1857,14 +1857,14 @@ nsHTMLInputElement::PostHandleEvent(nsEv
             event.originator      = this;
             nsEventStatus status  = nsEventStatus_eIgnore;
 
-            nsCOMPtr<nsIPresShell> presShell =
+            nsIPresShell* presShell =
               aVisitor.mPresContext->GetPresShell();
 
             // If |nsIPresShell::Destroy| has been called due to
             // handling the event the pres context will return a null
             // pres shell.  See bug 125624.
             if (presShell) {
-              nsCOMPtr<nsIContent> form(do_QueryInterface(mForm));
+              nsIContent* form(do_QueryInterface(mForm));
               presShell->HandleDOMEventWithTarget(form, &event, &status);
             }
           }
@@ -2123,7 +2123,7 @@ nsHTMLInputElement::GetControllers(nsICo
       mControllers = do_CreateInstance(kXULControllersCID, &rv);
       NS_ENSURE_SUCCESS(rv, rv);
 
-      nsCOMPtr<nsIController>
+      nsIController*
         controller(do_CreateInstance("@mozilla.org/editor/editorcontroller;1",
                                      &rv));
       NS_ENSURE_SUCCESS(rv, rv);
@@ -2267,7 +2267,7 @@ nsHTMLInputElement::GetPhonetic(nsAStrin
   nsIFormControlFrame* formControlFrame = GetFormControlFrame(PR_TRUE);
 
   if (formControlFrame) {
-    nsCOMPtr<nsIPhonetic>
+    nsIPhonetic*
       phonetic(do_QueryInterface(formControlFrame));
 
     if (phonetic)
@@ -2283,13 +2283,13 @@ FireEventForAccessibility(nsIDOMHTMLInpu
                           nsPresContext* aPresContext,
                           const nsAString& aEventType)
 {
-  nsCOMPtr<nsIDOMEvent> event;
+  nsIDOMEvent* event;
   if (NS_SUCCEEDED(nsEventDispatcher::CreateEvent(aPresContext, nsnull,
                                                   NS_LITERAL_STRING("Events"),
-                                                  getter_AddRefs(event)))) {
+                                                  &event))) {
     event->InitEvent(aEventType, PR_TRUE, PR_TRUE);
 
-    nsCOMPtr<nsIPrivateDOMEvent> privateEvent(do_QueryInterface(event));
+    nsIPrivateDOMEvent* privateEvent(do_QueryInterface(event));
     if (privateEvent) {
       privateEvent->SetTrusted(PR_TRUE);
     }
@@ -2455,9 +2455,9 @@ nsHTMLInputElement::SubmitNamesValues(ns
     //
     // Open the file
     //
-    nsCOMPtr<nsIFile> file;
+    nsIFile* file;
  
-    rv = GetFile(getter_AddRefs(file));
+    rv = GetFile(&file);
 
     if (file) {
 
@@ -2474,7 +2474,7 @@ nsHTMLInputElement::SubmitNamesValues(ns
           //
           // Get content type
           //
-          nsCOMPtr<nsIMIMEService> MIMEService =
+          nsIMIMEService* MIMEService =
             do_GetService(NS_MIMESERVICE_CONTRACTID, &rv);
           NS_ENSURE_SUCCESS(rv, rv);
 
@@ -2487,8 +2487,8 @@ nsHTMLInputElement::SubmitNamesValues(ns
           //
           // Get input stream
           //
-          nsCOMPtr<nsIInputStream> fileStream;
-          rv = NS_NewLocalFileInputStream(getter_AddRefs(fileStream),
+          nsIInputStream* fileStream;
+          rv = NS_NewLocalFileInputStream(&fileStream,
                                           file, -1, -1,
                                           nsIFileInputStream::CLOSE_ON_EOF |
                                           nsIFileInputStream::REOPEN_ON_REWIND);
@@ -2496,8 +2496,8 @@ nsHTMLInputElement::SubmitNamesValues(ns
             //
             // Create buffered stream (for efficiency)
             //
-            nsCOMPtr<nsIInputStream> bufferedStream;
-            rv = NS_NewBufferedInputStream(getter_AddRefs(bufferedStream),
+            nsIInputStream* bufferedStream;
+            rv = NS_NewBufferedInputStream(&bufferedStream,
                                            fileStream, 8192);
             NS_ENSURE_SUCCESS(rv, rv);
             if (bufferedStream) {
@@ -2788,9 +2788,9 @@ nsHTMLInputElement::AddedToRadioGroup(PR
   // the same for this new element as for all the others in the group
   //
   PRBool checkedChanged = PR_FALSE;
-  nsCOMPtr<nsIRadioVisitor> visitor;
+  nsIRadioVisitor* visitor;
   nsresult rv = NS_GetRadioGetCheckedChangedVisitor(&checkedChanged, this,
-                                           getter_AddRefs(visitor));
+                                           &visitor);
   NS_ENSURE_SUCCESS(rv, rv);
   
   VisitGroup(visitor, aNotify);
@@ -2799,7 +2799,7 @@ nsHTMLInputElement::AddedToRadioGroup(PR
   //
   // Add the radio to the radio group container.
   //
-  nsCOMPtr<nsIRadioGroupContainer> container = GetRadioGroupContainer();
+  nsIRadioGroupContainer* container = GetRadioGroupContainer();
   if (container) {
     nsAutoString name;
     if (GetNameIfExists(name)) {
@@ -2839,7 +2839,7 @@ nsHTMLInputElement::WillRemoveFromRadioG
       gotName = PR_TRUE;
     }
 
-    nsCOMPtr<nsIRadioGroupContainer> container = GetRadioGroupContainer();
+    nsIRadioGroupContainer* container = GetRadioGroupContainer();
     if (container) {
       container->SetCurrentRadioButton(name, nsnull);
     }
@@ -2848,7 +2848,7 @@ nsHTMLInputElement::WillRemoveFromRadioG
   //
   // Remove this radio from its group in the container
   //
-  nsCOMPtr<nsIRadioGroupContainer> container = GetRadioGroupContainer();
+  nsIRadioGroupContainer* container = GetRadioGroupContainer();
   if (container) {
     if (!gotName) {
       if (!GetNameIfExists(name)) {
@@ -2907,14 +2907,14 @@ nsHTMLInputElement::IsFocusable(PRInt32 
 
   // Current radio button is not selected.
   // But make it tabbable if nothing in group is selected.
-  nsCOMPtr<nsIRadioGroupContainer> container = GetRadioGroupContainer();
+  nsIRadioGroupContainer* container = GetRadioGroupContainer();
   nsAutoString name;
   if (!container || !GetNameIfExists(name)) {
     return PR_TRUE;
   }
 
-  nsCOMPtr<nsIDOMHTMLInputElement> currentRadio;
-  container->GetCurrentRadioButton(name, getter_AddRefs(currentRadio));
+  nsIDOMHTMLInputElement* currentRadio;
+  container->GetCurrentRadioButton(name, &currentRadio);
   if (currentRadio) {
     *aTabIndex = -1;
   }
@@ -2925,7 +2925,7 @@ nsHTMLInputElement::VisitGroup(nsIRadioV
 nsHTMLInputElement::VisitGroup(nsIRadioVisitor* aVisitor, PRBool aFlushContent)
 {
   nsresult rv = NS_OK;
-  nsCOMPtr<nsIRadioGroupContainer> container = GetRadioGroupContainer();
+  nsIRadioGroupContainer* container = GetRadioGroupContainer();
   if (container) {
     nsAutoString name;
     if (GetNameIfExists(name)) {
@@ -2976,7 +2976,7 @@ public:
 
   NS_IMETHOD Visit(nsIFormControl* aRadio, PRBool* aStop)
   {
-    nsCOMPtr<nsIRadioControlElement> radio(do_QueryInterface(aRadio));
+    nsIRadioControlElement* radio(do_QueryInterface(aRadio));
     NS_ASSERTION(radio, "Visit() passed a null button (or non-radio)!");
     radio->SetCheckedChangedInternal(mCheckedChanged);
     return NS_OK;
@@ -3005,7 +3005,7 @@ public:
     if (aRadio == mExcludeElement) {
       return NS_OK;
     }
-    nsCOMPtr<nsIRadioControlElement> radio(do_QueryInterface(aRadio));
+    nsIRadioControlElement* radio(do_QueryInterface(aRadio));
     NS_ASSERTION(radio, "Visit() passed a null button (or non-radio)!");
     radio->GetCheckedChanged(mCheckedChanged);
     *aStop = PR_TRUE;
diff -r 546e94dbb8b1 content/html/content/src/nsHTMLLabelElement.cpp
--- a/content/html/content/src/nsHTMLLabelElement.cpp	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/html/content/src/nsHTMLLabelElement.cpp	Fri Oct 12 15:18:39 2007 -0700
@@ -107,8 +107,8 @@ public:
   virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
 
 protected:
-  already_AddRefed<nsIContent> GetForContent();
-  already_AddRefed<nsIContent> GetFirstFormControl(nsIContent *current);
+  nsIContent* GetForContent();
+  nsIContent* GetFirstFormControl(nsIContent *current);
 
   // XXX It would be nice if we could use an event flag instead.
   PRBool mHandlingEvent;
@@ -190,7 +190,7 @@ static PRBool
 static PRBool
 EventTargetIn(nsEvent *aEvent, nsIContent *aChild, nsIContent *aStop)
 {
-  nsCOMPtr<nsIContent> c = do_QueryInterface(aEvent->target);
+  nsIContent* c = do_QueryInterface(aEvent->target);
   nsIContent *content = c;
   while (content) {
     if (content == aChild) {
@@ -217,7 +217,7 @@ nsHTMLLabelElement::PostHandleEvent(nsEv
     return NS_OK;
   }
 
-  nsCOMPtr<nsIContent> content = GetForContent();
+  nsIContent* content = GetForContent();
   if (content && !EventTargetIn(aVisitor.mEvent, content, this)) {
     mHandlingEvent = PR_TRUE;
     switch (aVisitor.mEvent->message) {
@@ -271,7 +271,7 @@ nsHTMLLabelElement::SetFocus(nsPresConte
 {
   // Since we don't have '-moz-user-focus: normal', the only time
   // |SetFocus| will be called is when the accesskey is activated.
-  nsCOMPtr<nsIContent> content = GetForContent();
+  nsIContent* content = GetForContent();
   if (content)
     content->SetFocus(aContext);
 }
@@ -326,7 +326,7 @@ nsHTMLLabelElement::PerformAccesskey(PRB
                                      PRBool aIsTrustedEvent)
 {
   if (!aKeyCausesActivation) {
-    nsCOMPtr<nsIContent> content = GetForContent();
+    nsIContent* content = GetForContent();
     if (content)
       content->PerformAccesskey(aKeyCausesActivation, aIsTrustedEvent);
   } else {
@@ -352,7 +352,7 @@ inline PRBool IsNonLabelFormControl(nsIC
          aContent->Tag() != nsGkAtoms::label;
 }
 
-already_AddRefed<nsIContent>
+nsIContent*
 nsHTMLLabelElement::GetForContent()
 {
   nsresult rv;
@@ -362,11 +362,11 @@ nsHTMLLabelElement::GetForContent()
   rv = GetHtmlFor(elementId);
   if (NS_SUCCEEDED(rv) && !elementId.IsEmpty()) {
     // We have a FOR attribute.
-    nsCOMPtr<nsIDOMDocument> domDoc;
-    GetOwnerDocument(getter_AddRefs(domDoc));
+    nsIDOMDocument* domDoc;
+    GetOwnerDocument(&domDoc);
     if (domDoc) {
-      nsCOMPtr<nsIDOMElement> domElement;
-      domDoc->GetElementById(elementId, getter_AddRefs(domElement));
+      nsIDOMElement* domElement;
+      domDoc->GetElementById(elementId, &domElement);
       nsIContent *result = nsnull;
       if (domElement) {
         CallQueryInterface(domElement, &result);
@@ -384,7 +384,7 @@ nsHTMLLabelElement::GetForContent()
   return nsnull;
 }
 
-already_AddRefed<nsIContent>
+nsIContent*
 nsHTMLLabelElement::GetFirstFormControl(nsIContent *current)
 {
   PRUint32 numNodes = current->GetChildCount();
@@ -397,7 +397,7 @@ nsHTMLLabelElement::GetFirstFormControl(
         return child;
       }
 
-      nsIContent* content = GetFirstFormControl(child).get();
+      nsIContent* content = GetFirstFormControl(child);
       if (content) {
         return content;
       }
diff -r 546e94dbb8b1 content/html/content/src/nsHTMLLegendElement.cpp
--- a/content/html/content/src/nsHTMLLegendElement.cpp	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/html/content/src/nsHTMLLegendElement.cpp	Fri Oct 12 15:18:39 2007 -0700
@@ -261,11 +261,11 @@ nsHTMLLegendElement::SetFocus(nsPresCont
   } else {
     // If the legend isn't focusable (no tabindex) we focus whatever is
     // focusable following the legend instead, bug 81481.
-    nsCOMPtr<nsPIDOMWindow> ourWindow = document->GetWindow();
+    nsPIDOMWindow* ourWindow = document->GetWindow();
     if (ourWindow) {
       nsIFocusController* focusController =
         ourWindow->GetRootFocusController();
-      nsCOMPtr<nsIDOMElement> domElement =
+      nsIDOMElement* domElement =
         do_QueryInterface(static_cast<nsIContent *>(this));
       if (focusController && domElement) {
         focusController->MoveFocus(PR_TRUE, domElement);
diff -r 546e94dbb8b1 content/html/content/src/nsHTMLLinkElement.cpp
--- a/content/html/content/src/nsHTMLLinkElement.cpp	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/html/content/src/nsHTMLLinkElement.cpp	Fri Oct 12 15:18:39 2007 -0700
@@ -161,7 +161,7 @@ NS_IMETHODIMP
 NS_IMETHODIMP
 nsHTMLLinkElement::GetDisabled(PRBool* aDisabled)
 {
-  nsCOMPtr<nsIDOMStyleSheet> ss(do_QueryInterface(mStyleSheet));
+  nsIDOMStyleSheet* ss(do_QueryInterface(mStyleSheet));
   nsresult result = NS_OK;
 
   if (ss) {
@@ -176,7 +176,7 @@ NS_IMETHODIMP
 NS_IMETHODIMP 
 nsHTMLLinkElement::SetDisabled(PRBool aDisabled)
 {
-  nsCOMPtr<nsIDOMStyleSheet> ss(do_QueryInterface(mStyleSheet));
+  nsIDOMStyleSheet* ss(do_QueryInterface(mStyleSheet));
   nsresult result = NS_OK;
 
   if (ss) {
@@ -234,7 +234,7 @@ void
 void
 nsHTMLLinkElement::UnbindFromTree(PRBool aDeep, PRBool aNullParent)
 {
-  nsCOMPtr<nsIDocument> oldDoc = GetCurrentDoc();
+  nsIDocument* oldDoc = GetCurrentDoc();
   if (oldDoc) {
     GetCurrentDoc()->ForgetLink(this);
     // If this link is ever reinserted into a document, it might
diff -r 546e94dbb8b1 content/html/content/src/nsHTMLMapElement.cpp
--- a/content/html/content/src/nsHTMLMapElement.cpp	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/html/content/src/nsHTMLMapElement.cpp	Fri Oct 12 15:18:39 2007 -0700
@@ -118,7 +118,7 @@ nsHTMLMapElement::BindToTree(nsIDocument
                                                  aCompileEventHandlers);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  nsCOMPtr<nsIHTMLDocument> htmlDoc = do_QueryInterface(aDocument);
+  nsIHTMLDocument* htmlDoc = do_QueryInterface(aDocument);
 
   if (htmlDoc) {
     htmlDoc->AddImageMap(this);
@@ -130,7 +130,7 @@ void
 void
 nsHTMLMapElement::UnbindFromTree(PRBool aDeep, PRBool aNullParent)
 {
-  nsCOMPtr<nsIHTMLDocument> htmlDoc = do_QueryInterface(GetCurrentDoc());
+  nsIHTMLDocument* htmlDoc = do_QueryInterface(GetCurrentDoc());
 
   if (htmlDoc) {
     htmlDoc->RemoveImageMap(this);
diff -r 546e94dbb8b1 content/html/content/src/nsHTMLObjectElement.cpp
--- a/content/html/content/src/nsHTMLObjectElement.cpp	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/html/content/src/nsHTMLObjectElement.cpp	Fri Oct 12 15:18:39 2007 -0700
@@ -300,10 +300,10 @@ nsHTMLObjectElement::SubmitNamesValues(n
     return NS_OK;
   }
 
-  nsCOMPtr<nsIPluginInstance> pi;
-  objFrame->GetPluginInstance(*getter_AddRefs(pi));
-
-  nsCOMPtr<nsIPluginInstanceInternal> pi_internal(do_QueryInterface(pi));
+  nsIPluginInstance* pi;
+  objFrame->GetPluginInstance(*&pi);
+
+  nsIPluginInstanceInternal* pi_internal(do_QueryInterface(pi));
 
   if (!pi_internal) {
     // No plugin, nothing to submit.
diff -r 546e94dbb8b1 content/html/content/src/nsHTMLOptionElement.cpp
--- a/content/html/content/src/nsHTMLOptionElement.cpp	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/html/content/src/nsHTMLOptionElement.cpp	Fri Oct 12 15:18:39 2007 -0700
@@ -137,15 +137,15 @@ NS_NewHTMLOptionElement(nsINodeInfo *aNo
    * that we request the nsINodeInfo from the document's nodeinfo list.
    */
   nsresult rv;
-  nsCOMPtr<nsINodeInfo> nodeInfo(aNodeInfo);
+  nsINodeInfo* nodeInfo(aNodeInfo);
   if (!nodeInfo) {
-    nsCOMPtr<nsIDocument> doc =
+    nsIDocument* doc =
       do_QueryInterface(nsContentUtils::GetDocumentFromCaller());
     NS_ENSURE_TRUE(doc, nsnull);
 
     rv = doc->NodeInfoManager()->GetNodeInfo(nsGkAtoms::option, nsnull,
                                              kNameSpaceID_None,
-                                             getter_AddRefs(nodeInfo));
+                                             &nodeInfo);
     NS_ENSURE_SUCCESS(rv, nsnull);
   }
 
@@ -190,7 +190,7 @@ nsHTMLOptionElement::GetForm(nsIDOMHTMLF
   NS_ENSURE_ARG_POINTER(aForm);
   *aForm = nsnull;
 
-  nsCOMPtr<nsIFormControl> selectControl = do_QueryInterface(GetSelect());
+  nsIFormControl* selectControl = do_QueryInterface(GetSelect());
 
   if (selectControl) {
     selectControl->GetForm(aForm);
@@ -255,7 +255,7 @@ nsHTMLOptionElement::SetSelected(PRBool 
 {
   // Note: The select content obj maintains all the PresState
   // so defer to it to get the answer
-  nsCOMPtr<nsISelectElement> selectInt = do_QueryInterface(GetSelect());
+  nsISelectElement* selectInt = do_QueryInterface(GetSelect());
   if (selectInt) {
     PRInt32 index;
     GetIndex(&index);
@@ -283,25 +283,25 @@ nsHTMLOptionElement::GetIndex(PRInt32* a
   *aIndex = -1; // -1 indicates the index was not found
 
   // Get our containing select content object.
-  nsCOMPtr<nsIDOMHTMLSelectElement> selectElement =
+  nsIDOMHTMLSelectElement* selectElement =
     do_QueryInterface(GetSelect());
 
   if (selectElement) {
     // Get the options from the select object.
-    nsCOMPtr<nsIDOMHTMLOptionsCollection> options;
-    selectElement->GetOptions(getter_AddRefs(options));
+    nsIDOMHTMLOptionsCollection* options;
+    selectElement->GetOptions(&options);
 
     if (options) {
       // Walk the options to find out where we are in the list (ick, O(n))
       PRUint32 length = 0;
       options->GetLength(&length);
 
-      nsCOMPtr<nsIDOMNode> thisOption;
+      nsIDOMNode* thisOption;
 
       for (PRUint32 i = 0; i < length; i++) {
-        options->Item(i, getter_AddRefs(thisOption));
-
-        if (thisOption.get() == static_cast<nsIDOMNode *>(this)) {
+        options->Item(i, &thisOption);
+
+        if (thisOption == static_cast<nsIDOMNode *>(this)) {
           *aIndex = i;
 
           break;
@@ -409,8 +409,8 @@ nsHTMLOptionElement::Initialize(JSContex
     JSString* jsstr = JS_ValueToString(aContext, argv[0]);
     if (jsstr) {
       // Create a new text node and append it to the option
-      nsCOMPtr<nsIContent> textContent;
-      result = NS_NewTextNode(getter_AddRefs(textContent),
+      nsIContent* textContent;
+      result = NS_NewTextNode(&textContent,
                               mNodeInfo->NodeInfoManager());
       if (NS_FAILED(result)) {
         return result;
diff -r 546e94dbb8b1 content/html/content/src/nsHTMLScriptElement.cpp
--- a/content/html/content/src/nsHTMLScriptElement.cpp	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/html/content/src/nsHTMLScriptElement.cpp	Fri Oct 12 15:18:39 2007 -0700
@@ -197,19 +197,19 @@ nsHTMLScriptEventHandler::Invoke(nsISupp
 
   // Get the line number of the script (used when compiling)
   PRUint32 lineNumber = 0;
-  nsCOMPtr<nsIScriptElement> sele(do_QueryInterface(mOuter));
+  nsIScriptElement* sele(do_QueryInterface(mOuter));
   if (sele) {
     lineNumber = sele->GetScriptLineNumber();
   }
 
   // Get the script context...
-  nsCOMPtr<nsIDOMDocument> domdoc;
-  nsCOMPtr<nsIScriptContext> scriptContext;
+  nsIDOMDocument* domdoc;
+  nsIScriptContext* scriptContext;
   nsIScriptGlobalObject *sgo = nsnull;
 
-  mOuter->GetOwnerDocument(getter_AddRefs(domdoc));
-
-  nsCOMPtr<nsIDocument> doc(do_QueryInterface(domdoc));
+  mOuter->GetOwnerDocument(&domdoc);
+
+  nsIDocument* doc(do_QueryInterface(domdoc));
   if (doc) {
     sgo = doc->GetScriptGlobalObject();
     if (sgo) {
@@ -226,11 +226,11 @@ nsHTMLScriptEventHandler::Invoke(nsISupp
   JSObject *scriptObject = nsnull;
   JSObject *scope = sgo->GetGlobalJSObject();
 
-  nsCOMPtr<nsIXPConnectJSObjectHolder> holder;
+  nsIXPConnectJSObjectHolder* holder;
   nsContentUtils::XPConnect()->WrapNative(cx, scope,
                                           aTargetObject,
                                           NS_GET_IID(nsISupports),
-                                          getter_AddRefs(holder));
+                                          &holder);
   if (holder) {
     holder->GetJSObject(&scriptObject);
   }
@@ -297,15 +297,15 @@ nsHTMLScriptEventHandler::Invoke(nsISupp
 
   // Create an nsIArray for the args (the JS context will efficiently
   // re-fetch the jsvals from this object)
-  nsCOMPtr<nsIArray> argarray;
-  rv = NS_CreateJSArgv(cx, aArgCount, (jsval *)aArgs, getter_AddRefs(argarray));
+  nsIArray* argarray;
+  rv = NS_CreateJSArgv(cx, aArgCount, (jsval *)aArgs, &argarray);
   if (NS_FAILED(rv))
     return rv;
 
   // Invoke the event handler script...
-  nsCOMPtr<nsIVariant> ret;
+  nsIVariant* ret;
   return scriptContext->CallEventHandler(aTargetObject, scope, funcObject,
-                                         argarray, getter_AddRefs(ret));
+                                         argarray, &ret);
 }
 
 
@@ -334,7 +334,7 @@ public:
 
   // nsIScriptElement
   virtual void GetScriptType(nsAString& type);
-  virtual already_AddRefed<nsIURI> GetScriptURI();
+  virtual nsIURI* GetScriptURI();
   virtual void GetScriptText(nsAString& text);
   virtual void GetScriptCharset(nsAString& charset); 
 
@@ -425,7 +425,7 @@ nsHTMLScriptElement::Clone(nsINodeInfo *
     return NS_ERROR_OUT_OF_MEMORY;
   }
 
-  nsCOMPtr<nsINode> kungFuDeathGrip = it;
+  nsINode* kungFuDeathGrip = it;
   nsresult rv = CopyInnerTo(it);
   NS_ENSURE_SUCCESS(rv, rv);
 
@@ -436,7 +436,7 @@ nsHTMLScriptElement::Clone(nsINodeInfo *
   it->mLineNumber = mLineNumber;
   it->mMalformed = mMalformed;
 
-  kungFuDeathGrip.swap(*aResult);
+  swap(kungFuDeathGrip, *aResult);
 
   return NS_OK;
 }
@@ -500,7 +500,7 @@ nsHTMLScriptElement::GetScriptType(nsASt
 // variation of this code in nsSVGScriptElement - check if changes
 // need to be transfered when modifying
 
-already_AddRefed<nsIURI>
+nsIURI*
 nsHTMLScriptElement::GetScriptURI()
 {
   nsIURI *uri = nsnull;
diff -r 546e94dbb8b1 content/html/content/src/nsHTMLSelectElement.cpp
--- a/content/html/content/src/nsHTMLSelectElement.cpp	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/html/content/src/nsHTMLSelectElement.cpp	Fri Oct 12 15:18:39 2007 -0700
@@ -247,15 +247,15 @@ nsHTMLSelectElement::InsertOptionsIntoLi
     }
 
     // Actually select the options if the added options warrant it
-    nsCOMPtr<nsIDOMNode> optionNode;
-    nsCOMPtr<nsIDOMHTMLOptionElement> option;
+    nsIDOMNode* optionNode;
+    nsIDOMHTMLOptionElement* option;
     for (PRInt32 i=aListIndex;i<insertIndex;i++) {
       // Notify the frame that the option is added
       if (selectFrame) {
         selectFrame->AddOption(presContext, i);
       }
 
-      Item(i, getter_AddRefs(optionNode));
+      Item(i, &optionNode);
       option = do_QueryInterface(optionNode);
       if (option) {
         PRBool selected;
@@ -372,7 +372,7 @@ nsHTMLSelectElement::InsertOptionsIntoLi
   // just not going to look for an option inside of an option.
   // Sue me.
 
-  nsCOMPtr<nsIDOMHTMLOptionElement> optElement(do_QueryInterface(aOptions));
+  nsIDOMHTMLOptionElement* optElement(do_QueryInterface(aOptions));
   if (optElement) {
     nsresult rv = mOptions->InsertOptionAt(optElement, *aInsertIndex);
     NS_ENSURE_SUCCESS(rv, rv);
@@ -414,7 +414,7 @@ nsHTMLSelectElement::RemoveOptionsFromLi
   // just not going to look for an option inside of an option.
   // Sue me.
 
-  nsCOMPtr<nsIDOMHTMLOptionElement> optElement(do_QueryInterface(aOptions));
+  nsIDOMHTMLOptionElement* optElement(do_QueryInterface(aOptions));
   if (optElement) {
     if (mOptions->ItemAsOption(aRemoveIndex) != optElement) {
       NS_ERROR("wrong option at index");
@@ -570,7 +570,7 @@ nsHTMLSelectElement::GetOptionIndexAfter
 
   PRInt32 retval = -1;
 
-  nsCOMPtr<nsIContent> parent = aOptions->GetParent();
+  nsIContent* parent = aOptions->GetParent();
 
   if (parent) {
     PRInt32 index = parent->IndexOf(aOptions);
@@ -590,7 +590,7 @@ nsHTMLSelectElement::GetFirstOptionIndex
 nsHTMLSelectElement::GetFirstOptionIndex(nsIContent* aOptions)
 {
   PRInt32 listIndex = -1;
-  nsCOMPtr<nsIDOMHTMLOptionElement> optElement(do_QueryInterface(aOptions));
+  nsIDOMHTMLOptionElement* optElement(do_QueryInterface(aOptions));
   if (optElement) {
     GetOptionIndex(optElement, 0, PR_TRUE, &listIndex);
     // If you nested stuff under the option, you're just plain
@@ -638,51 +638,51 @@ nsHTMLSelectElement::Add(nsIDOMHTMLEleme
 nsHTMLSelectElement::Add(nsIDOMHTMLElement* aElement,
                          nsIDOMHTMLElement* aBefore)
 {
-  nsCOMPtr<nsIDOMNode> added;
+  nsIDOMNode* added;
   if (!aBefore) {
-    return AppendChild(aElement, getter_AddRefs(added));
+    return AppendChild(aElement, &added);
   }
 
   // Just in case we're not the parent, get the parent of the reference
   // element
-  nsCOMPtr<nsIDOMNode> parent;
-  aBefore->GetParentNode(getter_AddRefs(parent));
+  nsIDOMNode* parent;
+  aBefore->GetParentNode(&parent);
   if (!parent) {
     // NOT_FOUND_ERR: Raised if before is not a descendant of the SELECT
     // element.
     return NS_ERROR_DOM_NOT_FOUND_ERR;
   }
 
-  nsCOMPtr<nsIDOMNode> ancestor(parent);
-  nsCOMPtr<nsIDOMNode> temp;
+  nsIDOMNode* ancestor(parent);
+  nsIDOMNode* temp;
   while (ancestor != static_cast<nsIDOMNode*>(this)) {
-    ancestor->GetParentNode(getter_AddRefs(temp));
+    ancestor->GetParentNode(&temp);
     if (!temp) {
       // NOT_FOUND_ERR: Raised if before is not a descendant of the SELECT
       // element.
       return NS_ERROR_DOM_NOT_FOUND_ERR;
     }
-    temp.swap(ancestor);
+    swap(temp, ancestor);
   }
 
   // If the before parameter is not null, we are equivalent to the
   // insertBefore method on the parent of before.
-  return parent->InsertBefore(aElement, aBefore, getter_AddRefs(added));
+  return parent->InsertBefore(aElement, aBefore, &added);
 }
 
 NS_IMETHODIMP
 nsHTMLSelectElement::Remove(PRInt32 aIndex)
 {
-  nsCOMPtr<nsIDOMNode> option;
-  Item(aIndex, getter_AddRefs(option));
+  nsIDOMNode* option;
+  Item(aIndex, &option);
 
   if (option) {
-    nsCOMPtr<nsIDOMNode> parent;
-
-    option->GetParentNode(getter_AddRefs(parent));
+    nsIDOMNode* parent;
+
+    option->GetParentNode(&parent);
     if (parent) {
-      nsCOMPtr<nsIDOMNode> ret;
-      parent->RemoveChild(option, getter_AddRefs(ret));
+      nsIDOMNode* ret;
+      parent->RemoveChild(option, &ret);
     }
   }
 
@@ -738,35 +738,35 @@ nsHTMLSelectElement::SetLength(PRUint32 
     }
   } else if (aLength) {
     // This violates the W3C DOM but we do this for backwards compatibility
-    nsCOMPtr<nsINodeInfo> nodeInfo;
+    nsINodeInfo* nodeInfo;
 
     nsContentUtils::NameChanged(mNodeInfo, nsGkAtoms::option,
-                                getter_AddRefs(nodeInfo));
-
-    nsCOMPtr<nsIContent> element = NS_NewHTMLOptionElement(nodeInfo);
+                                &nodeInfo);
+
+    nsIContent* element = NS_NewHTMLOptionElement(nodeInfo);
     if (!element) {
       return NS_ERROR_OUT_OF_MEMORY;
     }
 
-    nsCOMPtr<nsIContent> text;
-    rv = NS_NewTextNode(getter_AddRefs(text), mNodeInfo->NodeInfoManager());
+    nsIContent* text;
+    rv = NS_NewTextNode(&text, mNodeInfo->NodeInfoManager());
     NS_ENSURE_SUCCESS(rv, rv);
 
     rv = element->AppendChildTo(text, PR_FALSE);
     NS_ENSURE_SUCCESS(rv, rv);
 
-    nsCOMPtr<nsIDOMNode> node(do_QueryInterface(element));
+    nsIDOMNode* node(do_QueryInterface(element));
 
     for (i = curlen; i < (PRInt32)aLength; i++) {
-      nsCOMPtr<nsIDOMNode> tmpNode;
-
-      rv = AppendChild(node, getter_AddRefs(tmpNode));
+      nsIDOMNode* tmpNode;
+
+      rv = AppendChild(node, &tmpNode);
       NS_ENSURE_SUCCESS(rv, rv);
 
       if (i < ((PRInt32)aLength - 1)) {
-        nsCOMPtr<nsIDOMNode> newNode;
-
-        rv = node->CloneNode(PR_TRUE, getter_AddRefs(newNode));
+        nsIDOMNode* newNode;
+
+        rv = node->CloneNode(PR_TRUE, &newNode);
         NS_ENSURE_SUCCESS(rv, rv);
 
         node = newNode;
@@ -839,10 +839,10 @@ nsHTMLSelectElement::OnOptionSelected(ns
   }
 
   // Tell the option to get its bad self selected
-  nsCOMPtr<nsIDOMNode> option;
-  Item(aIndex, getter_AddRefs(option));
+  nsIDOMNode* option;
+  Item(aIndex, &option);
   if (option) {
-    nsCOMPtr<nsIOptionElement> optionElement(do_QueryInterface(option));
+    nsIOptionElement* optionElement(do_QueryInterface(option));
     optionElement->SetSelectedInternal(aSelected, aNotify);
   }
 
@@ -1097,11 +1097,11 @@ nsHTMLSelectElement::IsOptionDisabled(PR
 nsHTMLSelectElement::IsOptionDisabled(PRInt32 aIndex, PRBool* aIsDisabled)
 {
   *aIsDisabled = PR_FALSE;
-  nsCOMPtr<nsIDOMNode> optionNode;
-  Item(aIndex, getter_AddRefs(optionNode));
+  nsIDOMNode* optionNode;
+  Item(aIndex, &optionNode);
   NS_ENSURE_TRUE(optionNode, NS_ERROR_FAILURE);
 
-  nsCOMPtr<nsIDOMHTMLOptionElement> option = do_QueryInterface(optionNode);
+  nsIDOMHTMLOptionElement* option = do_QueryInterface(optionNode);
   if (option) {
     PRBool isDisabled;
     option->GetDisabled(&isDisabled);
@@ -1114,9 +1114,9 @@ nsHTMLSelectElement::IsOptionDisabled(PR
   // Check for disabled optgroups
   // If there are no artifacts, there are no optgroups
   if (mNonOptionChildren) {
-    nsCOMPtr<nsIDOMNode> parent;
+    nsIDOMNode* parent;
     while (1) {
-      optionNode->GetParentNode(getter_AddRefs(parent));
+      optionNode->GetParentNode(&parent);
 
       // If we reached the top of the doc (scary), we're done
       if (!parent) {
@@ -1124,13 +1124,13 @@ nsHTMLSelectElement::IsOptionDisabled(PR
       }
 
       // If we reached the select element, we're done
-      nsCOMPtr<nsIDOMHTMLSelectElement> selectElement =
+      nsIDOMHTMLSelectElement* selectElement =
         do_QueryInterface(parent);
       if (selectElement) {
         break;
       }
 
-      nsCOMPtr<nsIDOMHTMLOptGroupElement> optGroupElement =
+      nsIDOMHTMLOptGroupElement* optGroupElement =
         do_QueryInterface(parent);
 
       if (optGroupElement) {
@@ -1162,11 +1162,11 @@ nsHTMLSelectElement::GetValue(nsAString&
   nsresult rv = GetSelectedIndex(&selectedIndex);
 
   if (NS_SUCCEEDED(rv) && selectedIndex > -1) {
-    nsCOMPtr<nsIDOMNode> node;
-
-    rv = Item(selectedIndex, getter_AddRefs(node));
-
-    nsCOMPtr<nsIDOMHTMLOptionElement> option = do_QueryInterface(node);
+    nsIDOMNode* node;
+
+    rv = Item(selectedIndex, &node);
+
+    nsIDOMHTMLOptionElement* option = do_QueryInterface(node);
     if (NS_SUCCEEDED(rv) && option) {
       return option->GetValue(aValue);
     }
@@ -1186,12 +1186,12 @@ nsHTMLSelectElement::SetValue(const nsAS
   if (NS_SUCCEEDED(rv)) {
     PRUint32 i;
     for (i = 0; i < length; i++) {
-      nsCOMPtr<nsIDOMNode> node;
-
-      rv = Item(i, getter_AddRefs(node));
+      nsIDOMNode* node;
+
+      rv = Item(i, &node);
 
       if (NS_SUCCEEDED(rv) && node) {
-        nsCOMPtr<nsIDOMHTMLOptionElement> option = do_QueryInterface(node);
+        nsIDOMHTMLOptionElement* option = do_QueryInterface(node);
 
         if (option) {
           nsAutoString optionVal;
@@ -1537,9 +1537,9 @@ nsHTMLSelectElement::RestoreState(nsPres
 nsHTMLSelectElement::RestoreState(nsPresState* aState)
 {
   // Get the presentation state object to retrieve our stuff out of.
-  nsCOMPtr<nsISupports> state;
+  nsISupports* state;
   nsresult rv = aState->GetStatePropertyAsSupports(NS_LITERAL_STRING("selecteditems"),
-                                                   getter_AddRefs(state));
+                                                   &state);
   if (NS_SUCCEEDED(rv)) {
     RestoreStateTo((nsSelectState*)(nsISupports*)state);
 
@@ -1563,7 +1563,7 @@ nsHTMLSelectElement::GetBoxObject(nsIBox
 {
   *aResult = nsnull;
 
-  nsCOMPtr<nsIDOMNSDocument> nsDoc = do_QueryInterface(GetCurrentDoc());
+  nsIDOMNSDocument* nsDoc = do_QueryInterface(GetCurrentDoc());
   if (!nsDoc) {
     return NS_ERROR_FAILURE;
   }
@@ -1613,11 +1613,11 @@ nsHTMLSelectElement::Reset()
   NS_ENSURE_SUCCESS(rv, rv);
 
   for (PRUint32 i = 0; i < numOptions; i++) {
-    nsCOMPtr<nsIDOMNode> node;
-    rv = Item(i, getter_AddRefs(node));
+    nsIDOMNode* node;
+    rv = Item(i, &node);
     NS_ENSURE_SUCCESS(rv, rv);
 
-    nsCOMPtr<nsIDOMHTMLOptionElement> option(do_QueryInterface(node));
+    nsIDOMHTMLOptionElement* option(do_QueryInterface(node));
 
     NS_ASSERTION(option, "option not an OptionElement");
     if (option) {
@@ -1699,7 +1699,7 @@ nsHTMLSelectElement::SubmitNamesValues(n
       continue;
     }
 
-    nsCOMPtr<nsIDOMHTMLOptionElement> optionElement = do_QueryInterface(option);
+    nsIDOMHTMLOptionElement* optionElement = do_QueryInterface(option);
     NS_ENSURE_TRUE(optionElement, NS_ERROR_UNEXPECTED);
 
     nsAutoString value;
@@ -1753,7 +1753,7 @@ AddOptionsRecurse(nsIContent* aRoot, nsH
 {
   nsIContent* child;
   for(PRUint32 i = 0; (child = aRoot->GetChildAt(i)); ++i) {
-    nsCOMPtr<nsIDOMHTMLOptionElement> opt = do_QueryInterface(child);
+    nsIDOMHTMLOptionElement* opt = do_QueryInterface(child);
     if (opt) {
       // If we fail here, then at least we've tried our best
       aArray->AppendOption(opt);
@@ -1780,7 +1780,7 @@ VerifyOptionsRecurse(nsIContent* aRoot, 
 {
   nsIContent* child;
   for(PRUint32 i = 0; (child = aRoot->GetChildAt(i)); ++i) {
-    nsCOMPtr<nsIDOMHTMLOptionElement> opt = do_QueryInterface(child);
+    nsIDOMHTMLOptionElement* opt = do_QueryInterface(child);
     if (opt) {
       NS_ASSERTION(opt == aArray->ItemAsOption(aIndex++),
                    "Options collection broken");
@@ -1934,19 +1934,19 @@ nsHTMLOptionCollection::SetOption(PRInt3
 
   NS_ASSERTION(aIndex <= mElements.Count(), "SetLength lied");
   
-  nsCOMPtr<nsIDOMNode> ret;
+  nsIDOMNode* ret;
   if (aIndex == mElements.Count()) {
-    rv = mSelect->AppendChild(aOption, getter_AddRefs(ret));
+    rv = mSelect->AppendChild(aOption, &ret);
   } else {
     // Find the option they're talking about and replace it
     // hold a strong reference to follow COM rules.
-    nsCOMPtr<nsIDOMHTMLOptionElement> refChild = mElements.SafeObjectAt(aIndex);
+    nsIDOMHTMLOptionElement* refChild = mElements.SafeObjectAt(aIndex);
     NS_ENSURE_TRUE(refChild, NS_ERROR_UNEXPECTED);
 
-    nsCOMPtr<nsIDOMNode> parent;
-    refChild->GetParentNode(getter_AddRefs(parent));
+    nsIDOMNode* parent;
+    refChild->GetParentNode(&parent);
     if (parent) {
-      rv = parent->ReplaceChild(aOption, refChild, getter_AddRefs(ret));
+      rv = parent->ReplaceChild(aOption, refChild, &ret);
     }
   }
 
@@ -1989,7 +1989,7 @@ nsHTMLOptionCollection::NamedItem(const 
   *aReturn = nsnull;
 
   for (PRInt32 i = 0; i < count; i++) {
-    nsCOMPtr<nsIContent> content = do_QueryInterface(mElements.ObjectAt(i));
+    nsIContent* content = do_QueryInterface(mElements.ObjectAt(i));
 
     if (content) {
       if (content->AttrValueIs(kNameSpaceID_None, nsGkAtoms::name, aName,
diff -r 546e94dbb8b1 content/html/content/src/nsHTMLSharedElement.cpp
--- a/content/html/content/src/nsHTMLSharedElement.cpp	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/html/content/src/nsHTMLSharedElement.cpp	Fri Oct 12 15:18:39 2007 -0700
@@ -182,7 +182,7 @@ NS_IMETHODIMP
 NS_IMETHODIMP
 nsHTMLSharedElement::GetForm(nsIDOMHTMLFormElement** aForm)
 {
-  *aForm = FindForm().get();
+  *aForm = FindForm();
 
   return NS_OK;
 }
diff -r 546e94dbb8b1 content/html/content/src/nsHTMLStyleElement.cpp
--- a/content/html/content/src/nsHTMLStyleElement.cpp	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/html/content/src/nsHTMLStyleElement.cpp	Fri Oct 12 15:18:39 2007 -0700
@@ -165,7 +165,7 @@ nsHTMLStyleElement::GetDisabled(PRBool* 
   nsresult result = NS_OK;
   
   if (mStyleSheet) {
-    nsCOMPtr<nsIDOMStyleSheet> ss(do_QueryInterface(mStyleSheet));
+    nsIDOMStyleSheet* ss(do_QueryInterface(mStyleSheet));
 
     if (ss) {
       result = ss->GetDisabled(aDisabled);
@@ -184,7 +184,7 @@ nsHTMLStyleElement::SetDisabled(PRBool a
   nsresult result = NS_OK;
   
   if (mStyleSheet) {
-    nsCOMPtr<nsIDOMStyleSheet> ss(do_QueryInterface(mStyleSheet));
+    nsIDOMStyleSheet* ss(do_QueryInterface(mStyleSheet));
 
     if (ss) {
       result = ss->SetDisabled(aDisabled);
@@ -257,7 +257,7 @@ void
 void
 nsHTMLStyleElement::UnbindFromTree(PRBool aDeep, PRBool aNullParent)
 {
-  nsCOMPtr<nsIDocument> oldDoc = GetCurrentDoc();
+  nsIDocument* oldDoc = GetCurrentDoc();
 
   nsGenericHTMLElement::UnbindFromTree(aDeep, aNullParent);
   UpdateStyleSheetInternal(oldDoc);
diff -r 546e94dbb8b1 content/html/content/src/nsHTMLTableCellElement.cpp
--- a/content/html/content/src/nsHTMLTableCellElement.cpp	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/html/content/src/nsHTMLTableCellElement.cpp	Fri Oct 12 15:18:39 2007 -0700
@@ -120,8 +120,8 @@ nsHTMLTableCellElement::GetRow(nsIDOMHTM
 {
   *aRow = nsnull;
 
-  nsCOMPtr<nsIDOMNode> rowNode;
-  GetParentNode(getter_AddRefs(rowNode));
+  nsIDOMNode* rowNode;
+  GetParentNode(&rowNode);
 
   if (rowNode) {
     CallQueryInterface(rowNode, aRow);
@@ -156,17 +156,17 @@ nsHTMLTableCellElement::GetCellIndex(PRI
 {
   *aCellIndex = -1;
 
-  nsCOMPtr<nsIDOMHTMLTableRowElement> row;
-
-  GetRow(getter_AddRefs(row));
+  nsIDOMHTMLTableRowElement* row;
+
+  GetRow(&row);
 
   if (!row) {
     return NS_OK;
   }
 
-  nsCOMPtr<nsIDOMHTMLCollection> cells;
-
-  row->GetCells(getter_AddRefs(cells));
+  nsIDOMHTMLCollection* cells;
+
+  row->GetCells(&cells);
 
   if (!cells) {
     return NS_OK;
@@ -179,10 +179,10 @@ nsHTMLTableCellElement::GetCellIndex(PRI
   PRUint32 i;
 
   for (i = 0; (i < numCells) && !found; i++) {
-    nsCOMPtr<nsIDOMNode> node;
-    cells->Item(i, getter_AddRefs(node));
-
-    if (node.get() == static_cast<nsIDOMNode *>(this)) {
+    nsIDOMNode* node;
+    cells->Item(i, &node);
+
+    if (node == static_cast<nsIDOMNode *>(this)) {
       *aCellIndex = i;
       found = PR_TRUE;
     }
@@ -235,8 +235,8 @@ nsHTMLTableCellElement::GetAlign(nsAStri
   if (!GetAttr(kNameSpaceID_None, nsGkAtoms::align, aValue)) {
     // There's no align attribute, ask the row for the alignment.
 
-    nsCOMPtr<nsIDOMHTMLTableRowElement> row;
-    GetRow(getter_AddRefs(row));
+    nsIDOMHTMLTableRowElement* row;
+    GetRow(&row);
 
     if (row) {
       return row->GetAlign(aValue);
diff -r 546e94dbb8b1 content/html/content/src/nsHTMLTableElement.cpp
--- a/content/html/content/src/nsHTMLTableElement.cpp	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/html/content/src/nsHTMLTableElement.cpp	Fri Oct 12 15:18:39 2007 -0700
@@ -93,7 +93,7 @@ public:
                                                      nsGenericHTMLElement)
 
 protected:
-  already_AddRefed<nsIDOMHTMLTableSectionElement> GetSection(nsIAtom *aTag);
+  nsIDOMHTMLTableSectionElement* GetSection(nsIAtom *aTag);
 
   nsRefPtr<nsContentList> mTBodies;
   nsRefPtr<TableRowsCollection> mRows;
@@ -391,11 +391,11 @@ nsHTMLTableElement::GetCaption(nsIDOMHTM
 nsHTMLTableElement::GetCaption(nsIDOMHTMLTableCaptionElement** aValue)
 {
   *aValue = nsnull;
-  nsCOMPtr<nsIDOMNode> child;
-  GetFirstChild(getter_AddRefs(child));
+  nsIDOMNode* child;
+  GetFirstChild(&child);
 
   while (child) {
-    nsCOMPtr<nsIDOMHTMLTableCaptionElement> caption(do_QueryInterface(child));
+    nsIDOMHTMLTableCaptionElement* caption(do_QueryInterface(child));
 
     if (caption) {
       *aValue = caption;
@@ -404,8 +404,8 @@ nsHTMLTableElement::GetCaption(nsIDOMHTM
       break;
     }
 
-    nsIDOMNode *temp = child.get();
-    temp->GetNextSibling(getter_AddRefs(child));
+    nsIDOMNode *temp = child;
+    temp->GetNextSibling(&child);
   }
 
   return NS_OK;
@@ -418,20 +418,20 @@ nsHTMLTableElement::SetCaption(nsIDOMHTM
 
   if (NS_SUCCEEDED(rv)) {
     if (aValue) {
-      nsCOMPtr<nsIDOMNode> resultingChild;
-      AppendChild(aValue, getter_AddRefs(resultingChild));
+      nsIDOMNode* resultingChild;
+      AppendChild(aValue, &resultingChild);
     }
   }
 
   return rv;
 }
 
-already_AddRefed<nsIDOMHTMLTableSectionElement>
+nsIDOMHTMLTableSectionElement*
 nsHTMLTableElement::GetSection(nsIAtom *aTag)
 {
   PRUint32 childCount = GetChildCount();
 
-  nsCOMPtr<nsIDOMHTMLTableSectionElement> section;
+  nsIDOMHTMLTableSectionElement* section;
 
   for (PRUint32 i = 0; i < childCount; ++i) {
     nsIContent *child = GetChildAt(i);
@@ -452,7 +452,7 @@ NS_IMETHODIMP
 NS_IMETHODIMP
 nsHTMLTableElement::GetTHead(nsIDOMHTMLTableSectionElement** aValue)
 {
-  *aValue = GetSection(nsGkAtoms::thead).get();
+  *aValue = GetSection(nsGkAtoms::thead);
 
   return NS_OK;
 }
@@ -460,7 +460,7 @@ NS_IMETHODIMP
 NS_IMETHODIMP
 nsHTMLTableElement::SetTHead(nsIDOMHTMLTableSectionElement* aValue)
 {
-  nsCOMPtr<nsIContent> content(do_QueryInterface(aValue));
+  nsIContent* content(do_QueryInterface(aValue));
   NS_ENSURE_TRUE(content, NS_ERROR_DOM_HIERARCHY_REQUEST_ERR);
 
   if (!content->NodeInfo()->Equals(nsGkAtoms::thead)) {
@@ -473,14 +473,14 @@ nsHTMLTableElement::SetTHead(nsIDOMHTMLT
   }
 
   if (aValue) {
-    nsCOMPtr<nsIDOMNode> child;
-    rv = GetFirstChild(getter_AddRefs(child));
+    nsIDOMNode* child;
+    rv = GetFirstChild(&child);
     if (NS_FAILED(rv)) {
       return rv;
     }
      
-    nsCOMPtr<nsIDOMNode> resultChild;
-    rv = InsertBefore(aValue, child, getter_AddRefs(resultChild));
+    nsIDOMNode* resultChild;
+    rv = InsertBefore(aValue, child, &resultChild);
   }
 
   return rv;
@@ -489,7 +489,7 @@ NS_IMETHODIMP
 NS_IMETHODIMP
 nsHTMLTableElement::GetTFoot(nsIDOMHTMLTableSectionElement** aValue)
 {
-  *aValue = GetSection(nsGkAtoms::tfoot).get();
+  *aValue = GetSection(nsGkAtoms::tfoot);
 
   return NS_OK;
 }
@@ -497,7 +497,7 @@ NS_IMETHODIMP
 NS_IMETHODIMP
 nsHTMLTableElement::SetTFoot(nsIDOMHTMLTableSectionElement* aValue)
 {
-  nsCOMPtr<nsIContent> content(do_QueryInterface(aValue));
+  nsIContent* content(do_QueryInterface(aValue));
   NS_ENSURE_TRUE(content, NS_ERROR_DOM_HIERARCHY_REQUEST_ERR);
 
   if (!content->NodeInfo()->Equals(nsGkAtoms::tfoot)) {
@@ -507,8 +507,8 @@ nsHTMLTableElement::SetTFoot(nsIDOMHTMLT
   nsresult rv = DeleteTFoot();
   if (NS_SUCCEEDED(rv)) {
     if (aValue) {
-      nsCOMPtr<nsIDOMNode> resultingChild;
-      AppendChild(aValue, getter_AddRefs(resultingChild));
+      nsIDOMNode* resultingChild;
+      AppendChild(aValue, &resultingChild);
     }
   }
 
@@ -558,9 +558,9 @@ nsHTMLTableElement::CreateTHead(nsIDOMHT
 {
   *aValue = nsnull;
   nsresult rv = NS_OK;
-  nsCOMPtr<nsIDOMHTMLTableSectionElement> head;
-
-  GetTHead(getter_AddRefs(head));
+  nsIDOMHTMLTableSectionElement* head;
+
+  GetTHead(&head);
 
   if (head) { // return the existing thead
     CallQueryInterface(head, aValue);
@@ -569,17 +569,17 @@ nsHTMLTableElement::CreateTHead(nsIDOMHT
   }
   else
   { // create a new head rowgroup
-    nsCOMPtr<nsINodeInfo> nodeInfo;
+    nsINodeInfo* nodeInfo;
 
     nsContentUtils::NameChanged(mNodeInfo, nsGkAtoms::thead,
-                                getter_AddRefs(nodeInfo));
-
-    nsCOMPtr<nsIContent> newHead = NS_NewHTMLTableSectionElement(nodeInfo);
+                                &nodeInfo);
+
+    nsIContent* newHead = NS_NewHTMLTableSectionElement(nodeInfo);
 
     if (newHead) {
-      nsCOMPtr<nsIDOMNode> child;
-
-      rv = GetFirstChild(getter_AddRefs(child));
+      nsIDOMNode* child;
+
+      rv = GetFirstChild(&child);
 
       if (NS_FAILED(rv)) {
         return rv;
@@ -587,8 +587,8 @@ nsHTMLTableElement::CreateTHead(nsIDOMHT
 
       CallQueryInterface(newHead, aValue);
 
-      nsCOMPtr<nsIDOMNode> resultChild;
-      rv = InsertBefore(*aValue, child, getter_AddRefs(resultChild));
+      nsIDOMNode* resultChild;
+      rv = InsertBefore(*aValue, child, &resultChild);
     }
   }
 
@@ -598,13 +598,13 @@ NS_IMETHODIMP
 NS_IMETHODIMP
 nsHTMLTableElement::DeleteTHead()
 {
-  nsCOMPtr<nsIDOMHTMLTableSectionElement> childToDelete;
-  nsresult rv = GetTHead(getter_AddRefs(childToDelete));
+  nsIDOMHTMLTableSectionElement* childToDelete;
+  nsresult rv = GetTHead(&childToDelete);
 
   if ((NS_SUCCEEDED(rv)) && childToDelete) {
-    nsCOMPtr<nsIDOMNode> resultingChild;
+    nsIDOMNode* resultingChild;
     // mInner does the notification
-    RemoveChild(childToDelete, getter_AddRefs(resultingChild));
+    RemoveChild(childToDelete, &resultingChild);
   }
 
   return NS_OK;
@@ -615,9 +615,9 @@ nsHTMLTableElement::CreateTFoot(nsIDOMHT
 {
   *aValue = nsnull;
   nsresult rv = NS_OK;
-  nsCOMPtr<nsIDOMHTMLTableSectionElement> foot;
-
-  GetTFoot(getter_AddRefs(foot));
+  nsIDOMHTMLTableSectionElement* foot;
+
+  GetTFoot(&foot);
 
   if (foot) { // return the existing tfoot
     CallQueryInterface(foot, aValue);
@@ -626,11 +626,11 @@ nsHTMLTableElement::CreateTFoot(nsIDOMHT
   }
   else
   { // create a new foot rowgroup
-    nsCOMPtr<nsINodeInfo> nodeInfo;
+    nsINodeInfo* nodeInfo;
     nsContentUtils::NameChanged(mNodeInfo, nsGkAtoms::tfoot,
-                                getter_AddRefs(nodeInfo));
-
-    nsCOMPtr<nsIContent> newFoot = NS_NewHTMLTableSectionElement(nodeInfo);
+                                &nodeInfo);
+
+    nsIContent* newFoot = NS_NewHTMLTableSectionElement(nodeInfo);
 
     if (newFoot) {
       rv = AppendChildTo(newFoot, PR_TRUE);
@@ -644,13 +644,13 @@ NS_IMETHODIMP
 NS_IMETHODIMP
 nsHTMLTableElement::DeleteTFoot()
 {
-  nsCOMPtr<nsIDOMHTMLTableSectionElement> childToDelete;
-  nsresult rv = GetTFoot(getter_AddRefs(childToDelete));
+  nsIDOMHTMLTableSectionElement* childToDelete;
+  nsresult rv = GetTFoot(&childToDelete);
 
   if ((NS_SUCCEEDED(rv)) && childToDelete) {
-    nsCOMPtr<nsIDOMNode> resultingChild;
+    nsIDOMNode* resultingChild;
     // mInner does the notification
-    RemoveChild(childToDelete, getter_AddRefs(resultingChild));
+    RemoveChild(childToDelete, &resultingChild);
   }
 
   return NS_OK;
@@ -661,9 +661,9 @@ nsHTMLTableElement::CreateCaption(nsIDOM
 {
   *aValue = nsnull;
   nsresult rv = NS_OK;
-  nsCOMPtr<nsIDOMHTMLTableCaptionElement> caption;
-
-  GetCaption(getter_AddRefs(caption));
+  nsIDOMHTMLTableCaptionElement* caption;
+
+  GetCaption(&caption);
 
   if (caption) { // return the existing thead
     CallQueryInterface(caption, aValue);
@@ -672,11 +672,11 @@ nsHTMLTableElement::CreateCaption(nsIDOM
   }
   else
   { // create a new head rowgroup
-    nsCOMPtr<nsINodeInfo> nodeInfo;
+    nsINodeInfo* nodeInfo;
     nsContentUtils::NameChanged(mNodeInfo, nsGkAtoms::caption,
-                                getter_AddRefs(nodeInfo));
-
-    nsCOMPtr<nsIContent> newCaption = NS_NewHTMLTableCaptionElement(nodeInfo);
+                                &nodeInfo);
+
+    nsIContent* newCaption = NS_NewHTMLTableCaptionElement(nodeInfo);
 
     if (newCaption) {
       rv = AppendChildTo(newCaption, PR_TRUE);
@@ -690,12 +690,12 @@ NS_IMETHODIMP
 NS_IMETHODIMP
 nsHTMLTableElement::DeleteCaption()
 {
-  nsCOMPtr<nsIDOMHTMLTableCaptionElement> childToDelete;
-  nsresult rv = GetCaption(getter_AddRefs(childToDelete));
+  nsIDOMHTMLTableCaptionElement* childToDelete;
+  nsresult rv = GetCaption(&childToDelete);
 
   if ((NS_SUCCEEDED(rv)) && childToDelete) {
-    nsCOMPtr<nsIDOMNode> resultingChild;
-    RemoveChild(childToDelete, getter_AddRefs(resultingChild));
+    nsIDOMNode* resultingChild;
+    RemoveChild(childToDelete, &resultingChild);
   }
 
   return NS_OK;
@@ -720,8 +720,8 @@ nsHTMLTableElement::InsertRow(PRInt32 aI
 
   nsresult rv;
 
-  nsCOMPtr<nsIDOMHTMLCollection> rows;
-  GetRows(getter_AddRefs(rows));
+  nsIDOMHTMLCollection* rows;
+  GetRows(&rows);
 
   PRUint32 rowCount;
   rows->GetLength(&rowCount);
@@ -741,33 +741,33 @@ nsHTMLTableElement::InsertRow(PRInt32 aI
       refIndex = rowCount - 1;
     }
 
-    nsCOMPtr<nsIDOMNode> refRow;
-    rows->Item(refIndex, getter_AddRefs(refRow));
-
-    nsCOMPtr<nsIDOMNode> parent;
-
-    refRow->GetParentNode(getter_AddRefs(parent));
+    nsIDOMNode* refRow;
+    rows->Item(refIndex, &refRow);
+
+    nsIDOMNode* parent;
+
+    refRow->GetParentNode(&parent);
     // create the row
-    nsCOMPtr<nsINodeInfo> nodeInfo;
+    nsINodeInfo* nodeInfo;
     nsContentUtils::NameChanged(mNodeInfo, nsGkAtoms::tr,
-                                getter_AddRefs(nodeInfo));
-
-    nsCOMPtr<nsIContent> newRow = NS_NewHTMLTableRowElement(nodeInfo);
+                                &nodeInfo);
+
+    nsIContent* newRow = NS_NewHTMLTableRowElement(nodeInfo);
 
     if (newRow) {
-      nsCOMPtr<nsIDOMNode> newRowNode(do_QueryInterface(newRow));
-      nsCOMPtr<nsIDOMNode> retChild;
+      nsIDOMNode* newRowNode(do_QueryInterface(newRow));
+      nsIDOMNode* retChild;
 
       // If index is -1 or equal to the number of rows, the new row
       // is appended.
       if (aIndex == -1 || PRUint32(aIndex) == rowCount) {
-        rv = parent->AppendChild(newRowNode, getter_AddRefs(retChild));
+        rv = parent->AppendChild(newRowNode, &retChild);
       }
       else
       {
         // insert the new row before the reference row we found above
         rv = parent->InsertBefore(newRowNode, refRow,
-                                  getter_AddRefs(retChild));
+                                  &retChild);
       }
 
       if (retChild) {
@@ -778,7 +778,7 @@ nsHTMLTableElement::InsertRow(PRInt32 aI
   else
   { // the row count was 0, so 
     // find the first row group and insert there as first child
-    nsCOMPtr<nsIDOMNode> rowGroup;
+    nsIDOMNode* rowGroup;
 
     PRInt32 namespaceID = mNodeInfo->NamespaceID();
     PRUint32 childCount = GetChildCount();
@@ -797,11 +797,11 @@ nsHTMLTableElement::InsertRow(PRInt32 aI
     }
 
     if (!rowGroup) { // need to create a TBODY
-      nsCOMPtr<nsINodeInfo> nodeInfo;
+      nsINodeInfo* nodeInfo;
       nsContentUtils::NameChanged(mNodeInfo, nsGkAtoms::tbody,
-                                  getter_AddRefs(nodeInfo));
-
-      nsCOMPtr<nsIContent> newRowGroup =
+                                  &nodeInfo);
+
+      nsIContent* newRowGroup =
         NS_NewHTMLTableSectionElement(nodeInfo);
 
       if (newRowGroup) {
@@ -812,28 +812,28 @@ nsHTMLTableElement::InsertRow(PRInt32 aI
     }
 
     if (rowGroup) {
-      nsCOMPtr<nsINodeInfo> nodeInfo;
+      nsINodeInfo* nodeInfo;
       nsContentUtils::NameChanged(mNodeInfo, nsGkAtoms::tr,
-                                  getter_AddRefs(nodeInfo));
-
-      nsCOMPtr<nsIContent> newRow = NS_NewHTMLTableRowElement(nodeInfo);
+                                  &nodeInfo);
+
+      nsIContent* newRow = NS_NewHTMLTableRowElement(nodeInfo);
       if (newRow) {
-        nsCOMPtr<nsIDOMNode> firstRow;
-
-        nsCOMPtr<nsIDOMHTMLTableSectionElement> section =
+        nsIDOMNode* firstRow;
+
+        nsIDOMHTMLTableSectionElement* section =
           do_QueryInterface(rowGroup);
 
         if (section) {
-          nsCOMPtr<nsIDOMHTMLCollection> rows;
-          section->GetRows(getter_AddRefs(rows));
+          nsIDOMHTMLCollection* rows;
+          section->GetRows(&rows);
           if (rows) {
-            rows->Item(0, getter_AddRefs(firstRow));
+            rows->Item(0, &firstRow);
           }
         }
         
-        nsCOMPtr<nsIDOMNode> retNode, newRowNode(do_QueryInterface(newRow));
-
-        rowGroup->InsertBefore(newRowNode, firstRow, getter_AddRefs(retNode));
+        nsIDOMNode* retNode, *newRowNode(do_QueryInterface(newRow));
+
+        rowGroup->InsertBefore(newRowNode, firstRow, &retNode);
 
         if (retNode) {
           CallQueryInterface(retNode, aValue);
@@ -852,8 +852,8 @@ nsHTMLTableElement::DeleteRow(PRInt32 aV
     return NS_ERROR_DOM_INDEX_SIZE_ERR;
   }
 
-  nsCOMPtr<nsIDOMHTMLCollection> rows;
-  GetRows(getter_AddRefs(rows));
+  nsIDOMHTMLCollection* rows;
+  GetRows(&rows);
 
   nsresult rv;
   PRUint32 refIndex;
@@ -871,20 +871,20 @@ nsHTMLTableElement::DeleteRow(PRInt32 aV
     refIndex = (PRUint32)aValue;
   }
 
-  nsCOMPtr<nsIDOMNode> row;
-  rv = rows->Item(refIndex, getter_AddRefs(row));
+  nsIDOMNode* row;
+  rv = rows->Item(refIndex, &row);
   NS_ENSURE_SUCCESS(rv, rv);
 
   if (!row) {
     return NS_ERROR_DOM_INDEX_SIZE_ERR;
   }
 
-  nsCOMPtr<nsIDOMNode> parent;
-  row->GetParentNode(getter_AddRefs(parent));
+  nsIDOMNode* parent;
+  row->GetParentNode(&parent);
   NS_ENSURE_TRUE(parent, NS_ERROR_UNEXPECTED);
 
-  nsCOMPtr<nsIDOMNode> deleted_row;
-  return parent->RemoveChild(row, getter_AddRefs(deleted_row));
+  nsIDOMNode* deleted_row;
+  return parent->RemoveChild(row, &deleted_row);
 }
 
 static const nsAttrValue::EnumTable kFrameTable[] = {
diff -r 546e94dbb8b1 content/html/content/src/nsHTMLTableRowElement.cpp
--- a/content/html/content/src/nsHTMLTableRowElement.cpp	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/html/content/src/nsHTMLTableRowElement.cpp	Fri Oct 12 15:18:39 2007 -0700
@@ -126,8 +126,8 @@ nsHTMLTableRowElement::GetSection(nsIDOM
   NS_ENSURE_ARG_POINTER(aSection);
   *aSection = nsnull;
 
-  nsCOMPtr<nsIDOMNode> sectionNode;
-  nsresult rv = GetParentNode(getter_AddRefs(sectionNode));
+  nsIDOMNode* sectionNode;
+  nsresult rv = GetParentNode(&sectionNode);
   if (NS_SUCCEEDED(rv) && sectionNode) {
     rv = CallQueryInterface(sectionNode, aSection);
   }
@@ -142,8 +142,8 @@ nsHTMLTableRowElement::GetTable(nsIDOMHT
   NS_ENSURE_ARG_POINTER(aTable);
   *aTable = nsnull;
 
-  nsCOMPtr<nsIDOMNode> sectionNode;
-  nsresult rv = GetParentNode(getter_AddRefs(sectionNode));
+  nsIDOMNode* sectionNode;
+  nsresult rv = GetParentNode(&sectionNode);
   if (!sectionNode) {
     return rv;
   }
@@ -154,8 +154,8 @@ nsHTMLTableRowElement::GetTable(nsIDOMHT
     return rv;
   }
 
-  nsCOMPtr<nsIDOMNode> tableNode;
-  rv = sectionNode->GetParentNode(getter_AddRefs(tableNode));
+  nsIDOMNode* tableNode;
+  rv = sectionNode->GetParentNode(&tableNode);
   if (!tableNode) {
     return rv;
   }
@@ -167,14 +167,14 @@ nsHTMLTableRowElement::GetRowIndex(PRInt
 nsHTMLTableRowElement::GetRowIndex(PRInt32* aValue)
 {
   *aValue = -1;
-  nsCOMPtr<nsIDOMHTMLTableElement> table;
-
-  nsresult result = GetTable(getter_AddRefs(table));
+  nsIDOMHTMLTableElement* table;
+
+  nsresult result = GetTable(&table);
 
   if (NS_SUCCEEDED(result) && table) {
-    nsCOMPtr<nsIDOMHTMLCollection> rows;
-
-    table->GetRows(getter_AddRefs(rows));
+    nsIDOMHTMLCollection* rows;
+
+    table->GetRows(&rows);
 
     PRUint32 numRows;
     rows->GetLength(&numRows);
@@ -182,11 +182,11 @@ nsHTMLTableRowElement::GetRowIndex(PRInt
     PRBool found = PR_FALSE;
 
     for (PRUint32 i = 0; (i < numRows) && !found; i++) {
-      nsCOMPtr<nsIDOMNode> node;
-
-      rows->Item(i, getter_AddRefs(node));
-
-      if (node.get() == static_cast<nsIDOMNode *>(this)) {
+      nsIDOMNode* node;
+
+      rows->Item(i, &node);
+
+      if (node == static_cast<nsIDOMNode *>(this)) {
         *aValue = i;
         found = PR_TRUE;
       }
@@ -201,14 +201,14 @@ nsHTMLTableRowElement::GetSectionRowInde
 {
   *aValue = -1;
 
-  nsCOMPtr<nsIDOMHTMLTableSectionElement> section;
-
-  nsresult result = GetSection(getter_AddRefs(section));
+  nsIDOMHTMLTableSectionElement* section;
+
+  nsresult result = GetSection(&section);
 
   if (NS_SUCCEEDED(result) && section) {
-    nsCOMPtr<nsIDOMHTMLCollection> rows;
-
-    section->GetRows(getter_AddRefs(rows));
+    nsIDOMHTMLCollection* rows;
+
+    section->GetRows(&rows);
 
     PRBool found = PR_FALSE;
     PRUint32 numRows;
@@ -216,10 +216,10 @@ nsHTMLTableRowElement::GetSectionRowInde
     rows->GetLength(&numRows);
 
     for (PRUint32 i = 0; (i < numRows) && !found; i++) {
-      nsCOMPtr<nsIDOMNode> node;
-      rows->Item(i, getter_AddRefs(node));
-
-      if (node.get() == static_cast<nsIDOMNode *>(this)) {
+      nsIDOMNode* node;
+      rows->Item(i, &node);
+
+      if (node == static_cast<nsIDOMNode *>(this)) {
         *aValue = i;
         found = PR_TRUE;
       }
@@ -268,8 +268,8 @@ nsHTMLTableRowElement::InsertCell(PRInt3
     return NS_ERROR_DOM_INDEX_SIZE_ERR;
   }
   
-  nsCOMPtr<nsIDOMHTMLCollection> cells;
-  GetCells(getter_AddRefs(cells));
+  nsIDOMHTMLCollection* cells;
+  GetCells(&cells);
 
   PRUint32 cellCount;
   cells->GetLength(&cellCount);
@@ -281,28 +281,28 @@ nsHTMLTableRowElement::InsertCell(PRInt3
   PRBool doInsert = (aIndex < PRInt32(cellCount)) && (aIndex != -1);
 
   // create the cell
-  nsCOMPtr<nsINodeInfo> nodeInfo;
+  nsINodeInfo* nodeInfo;
   nsContentUtils::NameChanged(mNodeInfo, nsGkAtoms::td,
-                              getter_AddRefs(nodeInfo));
-
-  nsCOMPtr<nsIContent> cellContent = NS_NewHTMLTableCellElement(nodeInfo);
+                              &nodeInfo);
+
+  nsIContent* cellContent = NS_NewHTMLTableCellElement(nodeInfo);
   if (!cellContent) {
     return NS_ERROR_OUT_OF_MEMORY;
   }
 
-  nsCOMPtr<nsIDOMNode> cellNode(do_QueryInterface(cellContent));
+  nsIDOMNode* cellNode(do_QueryInterface(cellContent));
   NS_ASSERTION(cellNode, "Should implement nsIDOMNode!");
 
-  nsCOMPtr<nsIDOMNode> retChild;
+  nsIDOMNode* retChild;
 
   nsresult rv;
   if (doInsert) {
-    nsCOMPtr<nsIDOMNode> refCell;
-    cells->Item(aIndex, getter_AddRefs(refCell));
-
-    rv = InsertBefore(cellNode, refCell, getter_AddRefs(retChild));
+    nsIDOMNode* refCell;
+    cells->Item(aIndex, &refCell);
+
+    rv = InsertBefore(cellNode, refCell, &retChild);
   } else {
-    rv = AppendChild(cellNode, getter_AddRefs(retChild));
+    rv = AppendChild(cellNode, &retChild);
   }
 
   if (retChild) {
@@ -320,8 +320,8 @@ nsHTMLTableRowElement::DeleteCell(PRInt3
     return NS_ERROR_DOM_INDEX_SIZE_ERR;
   }
 
-  nsCOMPtr<nsIDOMHTMLCollection> cells;
-  GetCells(getter_AddRefs(cells));
+  nsIDOMHTMLCollection* cells;
+  GetCells(&cells);
 
   nsresult rv;
   PRUint32 refIndex;
@@ -339,16 +339,16 @@ nsHTMLTableRowElement::DeleteCell(PRInt3
     refIndex = (PRUint32)aValue;
   }
 
-  nsCOMPtr<nsIDOMNode> cell;
-  rv = cells->Item(refIndex, getter_AddRefs(cell));
+  nsIDOMNode* cell;
+  rv = cells->Item(refIndex, &cell);
   NS_ENSURE_SUCCESS(rv, rv);
 
   if (!cell) {
     return NS_ERROR_DOM_INDEX_SIZE_ERR;
   }
 
-  nsCOMPtr<nsIDOMNode> retChild;
-  return RemoveChild(cell, getter_AddRefs(retChild));
+  nsIDOMNode* retChild;
+  return RemoveChild(cell, &retChild);
 }
 
 NS_IMPL_STRING_ATTR_DEFAULT_VALUE(nsHTMLTableRowElement, Align, align, "left")
diff -r 546e94dbb8b1 content/html/content/src/nsHTMLTableSectionElement.cpp
--- a/content/html/content/src/nsHTMLTableSectionElement.cpp	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/html/content/src/nsHTMLTableSectionElement.cpp	Fri Oct 12 15:18:39 2007 -0700
@@ -152,8 +152,8 @@ nsHTMLTableSectionElement::InsertRow(PRI
     return NS_ERROR_DOM_INDEX_SIZE_ERR;
   }
 
-  nsCOMPtr<nsIDOMHTMLCollection> rows;
-  GetRows(getter_AddRefs(rows));
+  nsIDOMHTMLCollection* rows;
+  GetRows(&rows);
 
   PRUint32 rowCount;
   rows->GetLength(&rowCount);
@@ -165,28 +165,28 @@ nsHTMLTableSectionElement::InsertRow(PRI
   PRBool doInsert = (aIndex < PRInt32(rowCount)) && (aIndex != -1);
 
   // create the row
-  nsCOMPtr<nsINodeInfo> nodeInfo;
+  nsINodeInfo* nodeInfo;
   nsContentUtils::NameChanged(mNodeInfo, nsGkAtoms::tr,
-                              getter_AddRefs(nodeInfo));
-
-  nsCOMPtr<nsIContent> rowContent = NS_NewHTMLTableRowElement(nodeInfo);
+                              &nodeInfo);
+
+  nsIContent* rowContent = NS_NewHTMLTableRowElement(nodeInfo);
   if (!nodeInfo) {
     return NS_ERROR_OUT_OF_MEMORY;
   }
 
-  nsCOMPtr<nsIDOMNode> rowNode(do_QueryInterface(rowContent));
+  nsIDOMNode* rowNode(do_QueryInterface(rowContent));
   NS_ASSERTION(rowNode, "Should implement nsIDOMNode!");
 
-  nsCOMPtr<nsIDOMNode> retChild;
+  nsIDOMNode* retChild;
 
   nsresult rv;
   if (doInsert) {
-    nsCOMPtr<nsIDOMNode> refRow;
-    rows->Item(aIndex, getter_AddRefs(refRow));
-
-    rv = InsertBefore(rowNode, refRow, getter_AddRefs(retChild));
+    nsIDOMNode* refRow;
+    rows->Item(aIndex, &refRow);
+
+    rv = InsertBefore(rowNode, refRow, &retChild);
   } else {
-    rv = AppendChild(rowNode, getter_AddRefs(retChild));
+    rv = AppendChild(rowNode, &retChild);
   }
 
   if (retChild) {
@@ -203,8 +203,8 @@ nsHTMLTableSectionElement::DeleteRow(PRI
     return NS_ERROR_DOM_INDEX_SIZE_ERR;
   }
 
-  nsCOMPtr<nsIDOMHTMLCollection> rows;
-  GetRows(getter_AddRefs(rows));
+  nsIDOMHTMLCollection* rows;
+  GetRows(&rows);
 
   nsresult rv;
   PRUint32 refIndex;
@@ -222,16 +222,16 @@ nsHTMLTableSectionElement::DeleteRow(PRI
     refIndex = (PRUint32)aValue;
   }
 
-  nsCOMPtr<nsIDOMNode> row;
-  rv = rows->Item(refIndex, getter_AddRefs(row));
+  nsIDOMNode* row;
+  rv = rows->Item(refIndex, &row);
   NS_ENSURE_SUCCESS(rv, rv);
 
   if (!row) {
     return NS_ERROR_DOM_INDEX_SIZE_ERR;
   }
 
-  nsCOMPtr<nsIDOMNode> retChild;
-  return RemoveChild(row, getter_AddRefs(retChild));
+  nsIDOMNode* retChild;
+  return RemoveChild(row, &retChild);
 }
 
 PRBool
diff -r 546e94dbb8b1 content/html/content/src/nsHTMLTextAreaElement.cpp
--- a/content/html/content/src/nsHTMLTextAreaElement.cpp	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/html/content/src/nsHTMLTextAreaElement.cpp	Fri Oct 12 15:18:39 2007 -0700
@@ -367,7 +367,7 @@ nsHTMLTextAreaElement::Select()
   // selected
 
   // Just like SetFocus() but without the ScrollIntoView()!
-  nsCOMPtr<nsPresContext> presContext = GetPresContext();
+  nsPresContext* presContext = GetPresContext();
 
   nsEventStatus status = nsEventStatus_eIgnore;
   nsGUIEvent event(PR_TRUE, NS_FORM_SELECTED, nsnull);
@@ -716,7 +716,7 @@ nsHTMLTextAreaElement::GetControllers(ns
     mControllers = do_CreateInstance(kXULControllersCID, &rv);
     NS_ENSURE_SUCCESS(rv, rv);
 
-    nsCOMPtr<nsIController> controller = do_CreateInstance("@mozilla.org/editor/editorcontroller;1", &rv);
+    nsIController* controller = do_CreateInstance("@mozilla.org/editor/editorcontroller;1", &rv);
     if (NS_FAILED(rv))
       return rv;
 
diff -r 546e94dbb8b1 content/html/content/src/nsHTMLTitleElement.cpp
--- a/content/html/content/src/nsHTMLTitleElement.cpp	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/html/content/src/nsHTMLTitleElement.cpp	Fri Oct 12 15:18:39 2007 -0700
@@ -107,7 +107,7 @@ NS_IMETHODIMP
 NS_IMETHODIMP 
 nsHTMLTitleElement::SetText(const nsAString& aTitle)
 {
-  nsCOMPtr<nsIDOMHTMLDocument> htmlDoc(do_QueryInterface(GetCurrentDoc()));
+  nsIDOMHTMLDocument* htmlDoc(do_QueryInterface(GetCurrentDoc()));
 
   if (htmlDoc) {
     htmlDoc->SetTitle(aTitle);
diff -r 546e94dbb8b1 content/html/content/src/nsImageMapUtils.cpp
--- a/content/html/content/src/nsImageMapUtils.cpp	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/html/content/src/nsImageMapUtils.cpp	Fri Oct 12 15:18:39 2007 -0700
@@ -47,7 +47,7 @@
 #include "nsImageMapUtils.h"
 
 /*static*/
-already_AddRefed<nsIDOMHTMLMapElement>
+nsIDOMHTMLMapElement*
 nsImageMapUtils::FindImageMap(nsIDocument *aDocument, 
                                                     const nsAString &aUsemap)
 {
@@ -79,7 +79,7 @@ nsImageMapUtils::FindImageMap(nsIDocumen
 
   const nsAString& usemap = Substring(start, end);
 
-  nsCOMPtr<nsIHTMLDocument> htmlDoc(do_QueryInterface(aDocument));
+  nsIHTMLDocument* htmlDoc(do_QueryInterface(aDocument));
   if (htmlDoc) {
     nsIDOMHTMLMapElement* map = htmlDoc->GetImageMap(usemap);
     NS_IF_ADDREF(map);
@@ -91,10 +91,10 @@ nsImageMapUtils::FindImageMap(nsIDocumen
     // XHTML. The attribute "name" is officially deprecated.  This
     // simplifies our life becase we can simply get the map with
     // getElementById().
-    nsCOMPtr<nsIDOMDocument> domDoc(do_QueryInterface(aDocument));
+    nsIDOMDocument* domDoc(do_QueryInterface(aDocument));
     if (domDoc) {
-      nsCOMPtr<nsIDOMElement> element;
-      domDoc->GetElementById(usemap, getter_AddRefs(element));
+      nsIDOMElement* element;
+      domDoc->GetElementById(usemap, &element);
 
       if (element) {
         nsIDOMHTMLMapElement* map;
diff -r 546e94dbb8b1 content/html/content/src/nsImageMapUtils.h
--- a/content/html/content/src/nsImageMapUtils.h	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/html/content/src/nsImageMapUtils.h	Fri Oct 12 15:18:39 2007 -0700
@@ -61,7 +61,7 @@ public:
    * @param aUsemap   [in]  The value of the usemap attribute.
    * @return          The first found (if any) map element, addrefed.
    */
-  static already_AddRefed<nsIDOMHTMLMapElement>
+  static nsIDOMHTMLMapElement*
          FindImageMap(nsIDocument *aDocument, const nsAString &aUsemap);
 };
 
diff -r 546e94dbb8b1 content/xbl/src/nsXBLBinding.h
--- a/content/xbl/src/nsXBLBinding.h	Wed Oct 10 16:06:45 2007 -0700
+++ b/content/xbl/src/nsXBLBinding.h	Fri Oct 12 15:18:39 2007 -0700
@@ -151,7 +151,7 @@ public:
 
   void WalkRules(nsIStyleRuleProcessor::EnumFunc aFunc, void* aData);
 
-  already_AddRefed<nsIDOMNodeList> GetAnonymousNodes();
+  nsIDOMNodeList* GetAnonymousNodes();
 
   static nsresult DoInitJSClass(JSContext *cx, JSObject *global, JSObject *obj,
                                 const nsAFlatCString& aClassName,
diff -r 546e94dbb8b1 dom/public/base/nsPIDOMWindow.h
--- a/dom/public/base/nsPIDOMWindow.h	Wed Oct 10 16:06:45 2007 -0700
+++ b/dom/public/base/nsPIDOMWindow.h	Fri Oct 12 15:18:39 2007 -0700
@@ -294,8 +294,8 @@ public:
   {
     NS_ASSERTION(IsOuterWindow(), "EnsureInnerWindow called on inner window");
     // GetDocument forces inner window creation if there isn't one already
-    nsCOMPtr<nsIDOMDocument> doc;
-    GetDocument(getter_AddRefs(doc));
+    nsIDOMDocument* doc;
+    GetDocument(&doc);
     return GetCurrentInnerWindow();
   }
 
diff -r 546e94dbb8b1 dom/public/nsDOMJSUtils.h
--- a/dom/public/nsDOMJSUtils.h	Wed Oct 10 16:06:45 2007 -0700
+++ b/dom/public/nsDOMJSUtils.h	Fri Oct 12 15:18:39 2007 -0700
@@ -14,7 +14,7 @@ GetScriptContextFromJSContext(JSContext 
     return nsnull;
   }
 
-  nsCOMPtr<nsIScriptContext> scx =
+  nsIScriptContext* scx =
     do_QueryInterface(static_cast<nsISupports *>
                                  (::JS_GetContextPrivate(cx)));
 
diff -r 546e94dbb8b1 intl/locale/public/nsILanguageAtomService.h
--- a/intl/locale/public/nsILanguageAtomService.h	Wed Oct 10 16:06:45 2007 -0700
+++ b/intl/locale/public/nsILanguageAtomService.h	Fri Oct 12 15:18:39 2007 -0700
@@ -64,7 +64,7 @@ class nsILanguageAtomService : public ns
 
   virtual nsIAtom* LookupLanguage(const nsAString &aLanguage,
                                   nsresult *aError = nsnull) = 0;
-  virtual already_AddRefed<nsIAtom>
+  virtual nsIAtom*
   LookupCharSet(const char *aCharSet, nsresult *aError = nsnull) = 0;
 
   virtual nsIAtom* GetLocaleLanguageGroup(nsresult *aError = nsnull) = 0;
diff -r 546e94dbb8b1 layout/base/nsIPresShell.h
--- a/layout/base/nsIPresShell.h	Wed Oct 10 16:06:45 2007 -0700
+++ b/layout/base/nsIPresShell.h	Fri Oct 12 15:18:40 2007 -0700
@@ -497,7 +497,7 @@ public:
   /**
    * Set the current caret to a new caret. Returns the old caret.
    */
-  virtual already_AddRefed<nsICaret> SetCaret(nsICaret *aNewCaret) = 0;
+  virtual nsICaret* SetCaret(nsICaret *aNewCaret) = 0;
 
   /**
    * Should the images have borders etc.  Actual visual effects are determined
@@ -709,7 +709,7 @@ public:
    * edge of the presshell area. The aPoint, aScreenRect and aSurface
    * arguments function in a similar manner as RenderSelection.
    */
-  virtual already_AddRefed<gfxASurface> RenderNode(nsIDOMNode* aNode,
+  virtual gfxASurface* RenderNode(nsIDOMNode* aNode,
                                                    nsIRegion* aRegion,
                                                    nsPoint& aPoint,
                                                    nsRect* aScreenRect) = 0;
@@ -729,7 +729,7 @@ public:
    * the original. When scaling does not occur, the mouse point isn't used
    * as the position can be determined from the displayed frames.
    */
-  virtual already_AddRefed<gfxASurface> RenderSelection(nsISelection* aSelection,
+  virtual gfxASurface* RenderSelection(nsISelection* aSelection,
                                                         nsPoint& aPoint,
                                                         nsRect* aScreenRect) = 0;
 
diff -r 546e94dbb8b1 layout/base/nsPresContext.h
--- a/layout/base/nsPresContext.h	Wed Oct 10 16:06:45 2007 -0700
+++ b/layout/base/nsPresContext.h	Fri Oct 12 15:18:40 2007 -0700
@@ -259,12 +259,12 @@ public:
   /**
    * Get the font metrics for a given font.
    */
-  virtual NS_HIDDEN_(already_AddRefed<nsIFontMetrics>)
+  virtual NS_HIDDEN_(nsIFontMetrics*)
    GetMetricsForExternal(const nsFont& aFont);
-  NS_HIDDEN_(already_AddRefed<nsIFontMetrics>)
+  NS_HIDDEN_(nsIFontMetrics*)
     GetMetricsForInternal(const nsFont& aFont);
 #ifdef _IMPL_NS_LAYOUT
-  already_AddRefed<nsIFontMetrics> GetMetricsFor(const nsFont& aFont)
+  nsIFontMetrics* GetMetricsFor(const nsFont& aFont)
   { return GetMetricsForInternal(aFont); }
 #else
   already_AddRefed<nsIFontMetrics> GetMetricsFor(const nsFont& aFont)
@@ -377,10 +377,10 @@ public:
 
   NS_HIDDEN_(void) SetContainer(nsISupports* aContainer);
 
-  virtual NS_HIDDEN_(already_AddRefed<nsISupports>) GetContainerExternal();
-  NS_HIDDEN_(already_AddRefed<nsISupports>) GetContainerInternal();
+  virtual NS_HIDDEN_(nsISupports*) GetContainerExternal();
+  NS_HIDDEN_(nsISupports*) GetContainerInternal();
 #ifdef _IMPL_NS_LAYOUT
-  already_AddRefed<nsISupports> GetContainer()
+  nsISupports* GetContainer()
   { return GetContainerInternal(); }
 #else
   already_AddRefed<nsISupports> GetContainer()
diff -r 546e94dbb8b1 layout/style/nsHTMLStyleSheet.h
--- a/layout/style/nsHTMLStyleSheet.h	Wed Oct 10 16:06:45 2007 -0700
+++ b/layout/style/nsHTMLStyleSheet.h	Fri Oct 12 15:18:40 2007 -0700
@@ -95,7 +95,7 @@ public:
   nsresult SetVisitedLinkColor(nscolor aColor);
 
   // Mapped Attribute management methods
-  already_AddRefed<nsMappedAttributes>
+  nsMappedAttributes*
     UniqueMappedAttributes(nsMappedAttributes* aMapped);
   void DropMappedAttributes(nsMappedAttributes* aMapped);
 
diff -r 546e94dbb8b1 layout/style/nsICSSStyleRule.h
--- a/layout/style/nsICSSStyleRule.h	Wed Oct 10 16:06:45 2007 -0700
+++ b/layout/style/nsICSSStyleRule.h	Fri Oct 12 15:18:40 2007 -0700
@@ -245,10 +245,10 @@ public:
    * |DeclarationChanged| handles replacing the object in the container
    * sheet or group rule if |aHandleContainer| is true.
    */
-  virtual already_AddRefed<nsICSSStyleRule>
+  virtual nsICSSStyleRule*
     DeclarationChanged(PRBool aHandleContainer) = 0;
 
-  virtual already_AddRefed<nsIStyleRule> GetImportantRule(void) = 0;
+  virtual nsIStyleRule* GetImportantRule(void) = 0;
 
   // hooks for DOM rule
   virtual nsresult GetCssText(nsAString& aCssText) = 0;
diff -r 546e94dbb8b1 layout/style/nsStyleContext.h
--- a/layout/style/nsStyleContext.h	Wed Oct 10 16:06:45 2007 -0700
+++ b/layout/style/nsStyleContext.h	Fri Oct 12 15:18:40 2007 -0700
@@ -103,7 +103,7 @@ public:
 
   nsIAtom* GetPseudoType() const { return mPseudoTag; }
 
-  NS_HIDDEN_(already_AddRefed<nsStyleContext>)
+  NS_HIDDEN_(nsStyleContext*)
   FindChildWithRules(const nsIAtom* aPseudoTag, nsRuleNode* aRules);
 
   NS_HIDDEN_(PRBool)    Equals(const nsStyleContext* aOther) const;
@@ -210,7 +210,7 @@ protected:
   PRUint32                mRefCnt;
 };
 
-NS_HIDDEN_(already_AddRefed<nsStyleContext>)
+NS_HIDDEN_(nsStyleContext*)
 NS_NewStyleContext(nsStyleContext* aParentContext,
                    nsIAtom* aPseudoTag,
                    nsRuleNode* aRuleNode,
diff -r 546e94dbb8b1 layout/style/nsStyleSet.h
--- a/layout/style/nsStyleSet.h	Wed Oct 10 16:06:45 2007 -0700
+++ b/layout/style/nsStyleSet.h	Fri Oct 12 15:18:40 2007 -0700
@@ -77,11 +77,11 @@ class nsStyleSet
   void EnableQuirkStyleSheet(PRBool aEnable);
 
   // get a style context for a non-pseudo frame.
-  already_AddRefed<nsStyleContext>
+  nsStyleContext*
   ResolveStyleFor(nsIContent* aContent, nsStyleContext* aParentContext);
 
   // get a style context from some rules
-  already_AddRefed<nsStyleContext>
+  nsStyleContext*
   ResolveStyleForRules(nsStyleContext* aParentContext, const nsCOMArray<nsIStyleRule> &rules);
 
   // Get a style context for a non-element (which no rules will match),
@@ -91,14 +91,14 @@ class nsStyleSet
   // Perhaps this should go away and we shouldn't even create style
   // contexts for such content nodes.  However, not doing any rule
   // matching for them is a first step.
-  already_AddRefed<nsStyleContext>
+  nsStyleContext*
   ResolveStyleForNonElement(nsStyleContext* aParentContext);
 
   // get a style context for a pseudo-element (i.e.,
   // |aPseudoTag == nsCOMPtr<nsIAtom>(do_GetAtom(":first-line"))|, in
   // which case aParentContent must be non-null, or an anonymous box, in
   // which case it may be null or non-null.
-  already_AddRefed<nsStyleContext>
+  nsStyleContext*
   ResolvePseudoStyleFor(nsIContent* aParentContent,
                         nsIAtom* aPseudoTag,
                         nsStyleContext* aParentContext,
@@ -107,7 +107,7 @@ class nsStyleSet
   // This functions just like ResolvePseudoStyleFor except that it will
   // return nsnull if there are no explicit style rules for that
   // pseudo element.  It should be used only for pseudo-elements.
-  already_AddRefed<nsStyleContext>
+  nsStyleContext*
   ProbePseudoStyleFor(nsIContent* aParentContent,
                       nsIAtom* aPseudoTag,
                       nsStyleContext* aParentContext);
@@ -126,7 +126,7 @@ class nsStyleSet
   // Get a new style context that lives in a different parent
   // The new context will be the same as the old if the new parent is the
   // same as the old parent.
-  already_AddRefed<nsStyleContext>
+  nsStyleContext*
     ReParentStyleContext(nsPresContext* aPresContext,
                          nsStyleContext* aStyleContext,
                          nsStyleContext* aNewParentContext);
@@ -239,7 +239,7 @@ class nsStyleSet
   void WalkRuleProcessors(nsIStyleRuleProcessor::EnumFunc aFunc,
                           RuleProcessorData* aData);
 
-  already_AddRefed<nsStyleContext> GetContext(nsPresContext* aPresContext,
+  nsStyleContext* GetContext(nsPresContext* aPresContext,
                                               nsStyleContext* aParentContext,
                                               nsIAtom* aPseudoTag);
 
diff -r 546e94dbb8b1 netwerk/base/public/nsNetUtil.h
--- a/netwerk/base/public/nsNetUtil.h	Wed Oct 10 16:06:45 2007 -0700
+++ b/netwerk/base/public/nsNetUtil.h	Fri Oct 12 15:18:40 2007 -0700
@@ -102,7 +102,7 @@ do_GetIOService(nsresult* error = 0)
 
 // private little helper function... don't call this directly!
 inline nsresult
-net_EnsureIOService(nsIIOService **ios, nsCOMPtr<nsIIOService> &grip)
+net_EnsureIOService(nsIIOService **ios, nsIIOService* &grip)
 {
     nsresult rv = NS_OK;
     if (!*ios) {
@@ -120,7 +120,7 @@ NS_NewURI(nsIURI **result,
           nsIIOService *ioService = nsnull)     // pass in nsIIOService to optimize callers
 {
     nsresult rv;
-    nsCOMPtr<nsIIOService> grip;
+    nsIIOService* grip;
     rv = net_EnsureIOService(&ioService, grip);
     if (ioService)
         rv = ioService->NewURI(spec, charset, baseURI, result);
@@ -152,7 +152,7 @@ NS_NewFileURI(nsIURI* *result,
               nsIIOService* ioService = nsnull)     // pass in nsIIOService to optimize callers
 {
     nsresult rv;
-    nsCOMPtr<nsIIOService> grip;
+    nsIIOService* grip;
     rv = net_EnsureIOService(&ioService, grip);
     if (ioService)
         rv = ioService->NewFileURI(spec, result);
@@ -168,7 +168,7 @@ NS_NewChannel(nsIChannel           **res
               PRUint32               loadFlags = nsIRequest::LOAD_NORMAL)
 {
     nsresult rv;
-    nsCOMPtr<nsIIOService> grip;
+    nsIIOService* grip;
     rv = net_EnsureIOService(&ioService, grip);
     if (ioService) {
         nsIChannel *chan;
@@ -203,8 +203,8 @@ NS_OpenURI(nsIInputStream       **result
            nsIChannel           **channelOut = nsnull)
 {
     nsresult rv;
-    nsCOMPtr<nsIChannel> channel;
-    rv = NS_NewChannel(getter_AddRefs(channel), uri, ioService,
+    nsIChannel* channel;
+    rv = NS_NewChannel(&channel, uri, ioService,
                        loadGroup, callbacks, loadFlags);
     if (NS_SUCCEEDED(rv)) {
         nsIInputStream *stream;
@@ -213,7 +213,7 @@ NS_OpenURI(nsIInputStream       **result
             *result = stream;
             if (channelOut) {
                 *channelOut = nsnull;
-                channel.swap(*channelOut);
+                swap(channel, *channelOut);
             }
         }
     }
@@ -230,8 +230,8 @@ NS_OpenURI(nsIStreamListener     *listen
            PRUint32               loadFlags = nsIRequest::LOAD_NORMAL)
 {
     nsresult rv;
-    nsCOMPtr<nsIChannel> channel;
-    rv = NS_NewChannel(getter_AddRefs(channel), uri, ioService,
+    nsIChannel* channel;
+    rv = NS_NewChannel(&channel, uri, ioService,
                        loadGroup, callbacks, loadFlags);
     if (NS_SUCCEEDED(rv))
         rv = channel->AsyncOpen(listener, context);
@@ -323,13 +323,13 @@ NS_GetRealPort(nsIURI* aURI,
     if (NS_FAILED(rv))
         return -1;
 
-    nsCOMPtr<nsIIOService> grip;
+    nsIIOService* grip;
     rv = net_EnsureIOService(&ioService, grip);
     if (!ioService)
         return -1;
 
-    nsCOMPtr<nsIProtocolHandler> handler;
-    rv = ioService->GetProtocolHandler(scheme.get(), getter_AddRefs(handler));
+    nsIProtocolHandler* handler;
+    rv = ioService->GetProtocolHandler(scheme.get(), &handler);
     if (NS_FAILED(rv))
         return -1;
 
@@ -346,7 +346,7 @@ NS_NewInputStreamChannel(nsIChannel     
                          const nsACString *contentCharset)
 {
     nsresult rv;
-    nsCOMPtr<nsIInputStreamChannel> isc =
+    nsIInputStreamChannel* isc =
         do_CreateInstance(NS_INPUTSTREAMCHANNEL_CONTRACTID, &rv);
     if (NS_FAILED(rv))
         return rv;
@@ -354,7 +354,7 @@ NS_NewInputStreamChannel(nsIChannel     
     rv |= isc->SetContentStream(stream);
     if (NS_FAILED(rv))
         return rv;
-    nsCOMPtr<nsIChannel> chan = do_QueryInterface(isc, &rv);
+    nsIChannel* chan = do_QueryInterface(isc, &rv);
     if (NS_FAILED(rv))
         return rv;
     if (!contentType.IsEmpty())
@@ -363,7 +363,7 @@ NS_NewInputStreamChannel(nsIChannel     
         rv |= chan->SetContentCharset(*contentCharset);
     if (NS_SUCCEEDED(rv)) {
         *result = nsnull;
-        chan.swap(*result);
+        swap(chan, *result);
     }
     return rv;
 }
@@ -398,14 +398,14 @@ NS_NewInputStreamPump(nsIInputStreamPump
                       PRBool               closeWhenDone = PR_FALSE)
 {
     nsresult rv;
-    nsCOMPtr<nsIInputStreamPump> pump =
+    nsIInputStreamPump* pump =
         do_CreateInstance(NS_INPUTSTREAMPUMP_CONTRACTID, &rv);
     if (NS_SUCCEEDED(rv)) {
         rv = pump->Init(stream, streamPos, streamLen,
                         segsize, segcount, closeWhenDone);
         if (NS_SUCCEEDED(rv)) {
             *result = nsnull;
-            pump.swap(*result);
+            swap(pump, *result);
         }
     }
     return rv;
@@ -424,13 +424,13 @@ NS_NewAsyncStreamCopier(nsIAsyncStreamCo
                         PRUint32               chunkSize = 0)
 {
     nsresult rv;
-    nsCOMPtr<nsIAsyncStreamCopier> copier =
+    nsIAsyncStreamCopier* copier =
         do_CreateInstance(NS_ASYNCSTREAMCOPIER_CONTRACTID, &rv);
     if (NS_SUCCEEDED(rv)) {
         rv = copier->Init(source, sink, target, sourceBuffered, sinkBuffered, chunkSize);
         if (NS_SUCCEEDED(rv)) {
             *result = nsnull;
-            copier.swap(*result);
+            swap(copier, *result);
         }
     }
     return rv;
@@ -441,13 +441,13 @@ NS_NewLoadGroup(nsILoadGroup      **resu
                 nsIRequestObserver *obs)
 {
     nsresult rv;
-    nsCOMPtr<nsILoadGroup> group =
+    nsILoadGroup* group =
         do_CreateInstance(NS_LOADGROUP_CONTRACTID, &rv);
     if (NS_SUCCEEDED(rv)) {
         rv = group->SetGroupObserver(obs);
         if (NS_SUCCEEDED(rv)) {
             *result = nsnull;
-            group.swap(*result);
+            swap(group, *result);
         }
     }
     return rv;
@@ -459,7 +459,7 @@ NS_NewDownloader(nsIStreamListener   **r
                  nsIFile              *downloadLocation = nsnull)
 {
     nsresult rv;
-    nsCOMPtr<nsIDownloader> downloader =
+    nsIDownloader* downloader =
         do_CreateInstance(NS_DOWNLOADER_CONTRACTID, &rv);
     if (NS_SUCCEEDED(rv)) {
         rv = downloader->Init(observer, downloadLocation);
@@ -474,13 +474,13 @@ NS_NewStreamLoader(nsIStreamLoader      
                    nsIStreamLoaderObserver *observer)
 {
     nsresult rv;
-    nsCOMPtr<nsIStreamLoader> loader =
+    nsIStreamLoader* loader =
         do_CreateInstance(NS_STREAMLOADER_CONTRACTID, &rv);
     if (NS_SUCCEEDED(rv)) {
         rv = loader->Init(observer);
         if (NS_SUCCEEDED(rv)) {
             *result = nsnull;
-            loader.swap(*result);
+            swap(loader, *result);
         }
     }
     return rv;
@@ -497,15 +497,15 @@ NS_NewStreamLoader(nsIStreamLoader      
                    nsIURI                  *referrer  = nsnull)
 {
     nsresult rv;
-    nsCOMPtr<nsIChannel> channel;
-    rv = NS_NewChannel(getter_AddRefs(channel),
+    nsIChannel* channel;
+    rv = NS_NewChannel(&channel,
                        uri,
                        nsnull,
                        loadGroup,
                        callbacks,
                        loadFlags);
     if (NS_SUCCEEDED(rv)) {
-        nsCOMPtr<nsIHttpChannel> httpChannel(do_QueryInterface(channel));
+        nsIHttpChannel* httpChannel(do_QueryInterface(channel));
         if (httpChannel)
             httpChannel->SetReferrer(referrer);
         rv = NS_NewStreamLoader(result, observer);
@@ -521,13 +521,13 @@ NS_NewUnicharStreamLoader(nsIUnicharStre
                           PRUint32                        segmentSize = nsIUnicharStreamLoader::DEFAULT_SEGMENT_SIZE)
 {
     nsresult rv;
-    nsCOMPtr<nsIUnicharStreamLoader> loader =
+    nsIUnicharStreamLoader* loader =
         do_CreateInstance(NS_UNICHARSTREAMLOADER_CONTRACTID, &rv);
     if (NS_SUCCEEDED(rv)) {
         rv = loader->Init(observer, segmentSize);
         if (NS_SUCCEEDED(rv)) {
             *result = nsnull;
-            loader.swap(*result);
+            swap(loader, *result);
         }
     }
     return rv;
@@ -538,7 +538,7 @@ NS_NewSyncStreamListener(nsIStreamListen
                          nsIInputStream    **stream)
 {
     nsresult rv;
-    nsCOMPtr<nsISyncStreamListener> listener =
+    nsISyncStreamListener* listener =
         do_CreateInstance(NS_SYNCSTREAMLISTENER_CONTRACTID, &rv);
     if (NS_SUCCEEDED(rv)) {
         rv = listener->GetInputStream(stream);
@@ -559,10 +559,10 @@ NS_ImplementChannelOpen(nsIChannel      
 NS_ImplementChannelOpen(nsIChannel      *channel,
                         nsIInputStream **result)
 {
-    nsCOMPtr<nsIStreamListener> listener;
-    nsCOMPtr<nsIInputStream> stream;
-    nsresult rv = NS_NewSyncStreamListener(getter_AddRefs(listener),
-                                           getter_AddRefs(stream));
+    nsIStreamListener* listener;
+    nsIInputStream* stream;
+    nsresult rv = NS_NewSyncStreamListener(&listener,
+                                           &stream);
     if (NS_SUCCEEDED(rv)) {
         rv = channel->AsyncOpen(listener, nsnull);
         if (NS_SUCCEEDED(rv)) {
@@ -571,7 +571,7 @@ NS_ImplementChannelOpen(nsIChannel      
             rv = stream->Available(&n);
             if (NS_SUCCEEDED(rv)) {
                 *result = nsnull;
-                stream.swap(*result);
+                swap(stream, *result);
             }
         }
     }
@@ -584,7 +584,7 @@ NS_NewRequestObserverProxy(nsIRequestObs
                            nsIEventTarget      *target = nsnull)
 {
     nsresult rv;
-    nsCOMPtr<nsIRequestObserverProxy> proxy =
+    nsIRequestObserverProxy* proxy =
         do_CreateInstance(NS_REQUESTOBSERVERPROXY_CONTRACTID, &rv);
     if (NS_SUCCEEDED(rv)) {
         rv = proxy->Init(observer, target);
@@ -600,7 +600,7 @@ NS_NewSimpleStreamListener(nsIStreamList
                            nsIRequestObserver *observer = nsnull)
 {
     nsresult rv;
-    nsCOMPtr<nsISimpleStreamListener> listener = 
+    nsISimpleStreamListener* listener = 
         do_CreateInstance(NS_SIMPLESTREAMLISTENER_CONTRACTID, &rv);
     if (NS_SUCCEEDED(rv)) {
         rv = listener->Init(sink, observer);
@@ -616,7 +616,7 @@ NS_CheckPortSafety(PRInt32       port,
                    nsIIOService *ioService = nsnull)
 {
     nsresult rv;
-    nsCOMPtr<nsIIOService> grip;
+    nsIIOService* grip;
     rv = net_EnsureIOService(&ioService, grip);
     if (ioService) {
         PRBool allow;
@@ -649,7 +649,7 @@ NS_NewProxyInfo(const nsACString &type,
                 nsIProxyInfo    **result)
 {
     nsresult rv;
-    nsCOMPtr<nsIProtocolProxyService> pps =
+    nsIProtocolProxyService* pps =
             do_GetService(NS_PROTOCOLPROXYSERVICE_CONTRACTID, &rv);
     if (NS_SUCCEEDED(rv))
         rv = pps->NewProxyInfo(type, host, port, flags, PR_UINT32_MAX, nsnull,
@@ -662,11 +662,11 @@ NS_GetFileProtocolHandler(nsIFileProtoco
                           nsIIOService            *ioService = nsnull)
 {
     nsresult rv;
-    nsCOMPtr<nsIIOService> grip;
+    nsIIOService* grip;
     rv = net_EnsureIOService(&ioService, grip);
     if (ioService) {
-        nsCOMPtr<nsIProtocolHandler> handler;
-        rv = ioService->GetProtocolHandler("file", getter_AddRefs(handler));
+        nsIProtocolHandler* handler;
+        rv = ioService->GetProtocolHandler("file", &handler);
         if (NS_SUCCEEDED(rv))
             rv = CallQueryInterface(handler, result);
     }
@@ -679,8 +679,8 @@ NS_GetFileFromURLSpec(const nsACString  
                       nsIIOService      *ioService = nsnull)
 {
     nsresult rv;
-    nsCOMPtr<nsIFileProtocolHandler> fileHandler;
-    rv = NS_GetFileProtocolHandler(getter_AddRefs(fileHandler), ioService);
+    nsIFileProtocolHandler* fileHandler;
+    rv = NS_GetFileProtocolHandler(&fileHandler, ioService);
     if (NS_SUCCEEDED(rv))
         rv = fileHandler->GetFileFromURLSpec(inURL, result);
     return rv;
@@ -692,8 +692,8 @@ NS_GetURLSpecFromFile(nsIFile      *file
                       nsIIOService *ioService = nsnull)
 {
     nsresult rv;
-    nsCOMPtr<nsIFileProtocolHandler> fileHandler;
-    rv = NS_GetFileProtocolHandler(getter_AddRefs(fileHandler), ioService);
+    nsIFileProtocolHandler* fileHandler;
+    rv = NS_GetFileProtocolHandler(&fileHandler, ioService);
     if (NS_SUCCEEDED(rv))
         rv = fileHandler->GetURLSpecFromFile(file, url);
     return rv;
@@ -707,7 +707,7 @@ NS_ExamineForProxy(const char    *scheme
                    nsIProxyInfo **proxyInfo)
 {
     nsresult rv;
-    nsCOMPtr<nsIProtocolProxyService> pps =
+    nsIProtocolProxyService* pps =
             do_GetService(NS_PROTOCOLPROXYSERVICE_CONTRACTID, &rv);
     if (NS_SUCCEEDED(rv)) {
         nsCAutoString spec(scheme);
@@ -721,7 +721,7 @@ NS_ExamineForProxy(const char    *scheme
         // syntactically valid for the specific protocol), and all we need
         // is something which has a valid scheme, hostname, and a string
         // to pass to PAC if needed - bbaetz
-        nsCOMPtr<nsIURI> uri =
+        nsIURI* uri =
                 do_CreateInstance(NS_STANDARDURL_CONTRACTID, &rv);
         if (NS_SUCCEEDED(rv)) {
             rv = uri->SetSpec(spec);
@@ -740,7 +740,7 @@ NS_ParseContentType(const nsACString &ra
 {
     // contentCharset is left untouched if not present in rawContentType
     nsresult rv;
-    nsCOMPtr<nsINetUtil> util = do_GetIOService(&rv);
+    nsINetUtil* util = do_GetIOService(&rv);
     NS_ENSURE_SUCCESS(rv, rv);
     nsCString charset;
     PRBool hadCharset;
@@ -759,7 +759,7 @@ NS_NewLocalFileInputStream(nsIInputStrea
                            PRInt32          behaviorFlags = 0)
 {
     nsresult rv;
-    nsCOMPtr<nsIFileInputStream> in =
+    nsIFileInputStream* in =
         do_CreateInstance(NS_LOCALFILEINPUTSTREAM_CONTRACTID, &rv);
     if (NS_SUCCEEDED(rv)) {
         rv = in->Init(file, ioFlags, perm, behaviorFlags);
@@ -777,7 +777,7 @@ NS_NewLocalFileOutputStream(nsIOutputStr
                             PRInt32           behaviorFlags = 0)
 {
     nsresult rv;
-    nsCOMPtr<nsIFileOutputStream> out =
+    nsIFileOutputStream* out =
         do_CreateInstance(NS_LOCALFILEOUTPUTSTREAM_CONTRACTID, &rv);
     if (NS_SUCCEEDED(rv)) {
         rv = out->Init(file, ioFlags, perm, behaviorFlags);
@@ -796,7 +796,7 @@ NS_NewSafeLocalFileOutputStream(nsIOutpu
                                 PRInt32           behaviorFlags = 0)
 {
     nsresult rv;
-    nsCOMPtr<nsIFileOutputStream> out =
+    nsIFileOutputStream* out =
         do_CreateInstance(NS_SAFELOCALFILEOUTPUTSTREAM_CONTRACTID, &rv);
     if (NS_SUCCEEDED(rv)) {
         rv = out->Init(file, ioFlags, perm, behaviorFlags);
@@ -816,12 +816,12 @@ NS_BackgroundInputStream(nsIInputStream 
                          PRUint32         segmentCount = 0)
 {
     nsresult rv;
-    nsCOMPtr<nsIStreamTransportService> sts =
+    nsIStreamTransportService* sts =
         do_GetService(NS_STREAMTRANSPORTSERVICE_CONTRACTID, &rv);
     if (NS_SUCCEEDED(rv)) {
-        nsCOMPtr<nsITransport> inTransport;
+        nsITransport* inTransport;
         rv = sts->CreateInputTransport(stream, nsInt64(-1), nsInt64(-1),
-                                       PR_TRUE, getter_AddRefs(inTransport));
+                                       PR_TRUE, &inTransport);
         if (NS_SUCCEEDED(rv))
             rv = inTransport->OpenInputStream(nsITransport::OPEN_BLOCKING,
                                               segmentSize, segmentCount,
@@ -840,12 +840,12 @@ NS_BackgroundOutputStream(nsIOutputStrea
                           PRUint32          segmentCount = 0)
 {
     nsresult rv;
-    nsCOMPtr<nsIStreamTransportService> sts =
+    nsIStreamTransportService* sts =
         do_GetService(NS_STREAMTRANSPORTSERVICE_CONTRACTID, &rv);
     if (NS_SUCCEEDED(rv)) {
-        nsCOMPtr<nsITransport> inTransport;
+        nsITransport* inTransport;
         rv = sts->CreateOutputTransport(stream, nsInt64(-1), nsInt64(-1),
-                                        PR_TRUE, getter_AddRefs(inTransport));
+                                        PR_TRUE, &inTransport);
         if (NS_SUCCEEDED(rv))
             rv = inTransport->OpenOutputStream(nsITransport::OPEN_BLOCKING,
                                                segmentSize, segmentCount,
@@ -860,7 +860,7 @@ NS_NewBufferedInputStream(nsIInputStream
                           PRUint32         bufferSize)
 {
     nsresult rv;
-    nsCOMPtr<nsIBufferedInputStream> in =
+    nsIBufferedInputStream* in =
         do_CreateInstance(NS_BUFFEREDINPUTSTREAM_CONTRACTID, &rv);
     if (NS_SUCCEEDED(rv)) {
         rv = in->Init(str, bufferSize);
@@ -878,7 +878,7 @@ NS_NewBufferedOutputStream(nsIOutputStre
                            PRUint32          bufferSize)
 {
     nsresult rv;
-    nsCOMPtr<nsIBufferedOutputStream> out =
+    nsIBufferedOutputStream* out =
         do_CreateInstance(NS_BUFFEREDOUTPUTSTREAM_CONTRACTID, &rv);
     if (NS_SUCCEEDED(rv)) {
         rv = out->Init(str, bufferSize);
@@ -899,12 +899,12 @@ NS_NewPostDataStream(nsIInputStream  **r
     nsresult rv;
 
     if (isFile) {
-        nsCOMPtr<nsILocalFile> file;
-        nsCOMPtr<nsIInputStream> fileStream;
-
-        rv = NS_NewNativeLocalFile(data, PR_FALSE, getter_AddRefs(file));
+        nsILocalFile* file;
+        nsIInputStream* fileStream;
+
+        rv = NS_NewNativeLocalFile(data, PR_FALSE, &file);
         if (NS_SUCCEEDED(rv)) {
-            rv = NS_NewLocalFileInputStream(getter_AddRefs(fileStream), file);
+            rv = NS_NewLocalFileInputStream(&fileStream, file);
             if (NS_SUCCEEDED(rv)) {
                 // wrap the file stream with a buffered input stream
                 rv = NS_NewBufferedInputStream(result, fileStream, 8192);
@@ -914,7 +914,7 @@ NS_NewPostDataStream(nsIInputStream  **r
     }
 
     // otherwise, create a string stream for the data (copies)
-    nsCOMPtr<nsIStringInputStream> stream
+    nsIStringInputStream* stream
         (do_CreateInstance("@mozilla.org/io/string-input-stream;1", &rv));
     if (NS_FAILED(rv))
         return rv;
@@ -932,16 +932,16 @@ NS_LoadPersistentPropertiesFromURI(nsIPe
                                    nsIURI                   *uri,
                                    nsIIOService             *ioService = nsnull)
 {
-    nsCOMPtr<nsIInputStream> in;
-    nsresult rv = NS_OpenURI(getter_AddRefs(in), uri, ioService);
-    if (NS_SUCCEEDED(rv)) {
-        nsCOMPtr<nsIPersistentProperties> properties = 
+    nsIInputStream* in;
+    nsresult rv = NS_OpenURI(&in, uri, ioService);
+    if (NS_SUCCEEDED(rv)) {
+        nsIPersistentProperties* properties = 
             do_CreateInstance(NS_PERSISTENTPROPERTIES_CONTRACTID, &rv);
         if (NS_SUCCEEDED(rv)) {
             rv = properties->Load(in);
             if (NS_SUCCEEDED(rv)) {
                 *result = nsnull;
-                properties.swap(*result);
+                swap(properties, *result);
             }
         }
     }
@@ -955,9 +955,9 @@ NS_LoadPersistentPropertiesFromURISpec(n
                                        nsIURI                  *baseURI = nsnull,
                                        nsIIOService            *ioService = nsnull)     
 {
-    nsCOMPtr<nsIURI> uri;
+    nsIURI* uri;
     nsresult rv = 
-        NS_NewURI(getter_AddRefs(uri), spec, charset, baseURI, ioService);
+        NS_NewURI(&uri, spec, charset, baseURI, ioService);
 
     if (NS_SUCCEEDED(rv))
         rv = NS_LoadPersistentPropertiesFromURI(result, uri, ioService);
@@ -980,16 +980,16 @@ NS_QueryNotificationCallbacks(nsIChannel
     NS_PRECONDITION(channel, "null channel");
     *result = nsnull;
 
-    nsCOMPtr<nsIInterfaceRequestor> cbs;
-    channel->GetNotificationCallbacks(getter_AddRefs(cbs));
+    nsIInterfaceRequestor* cbs;
+    channel->GetNotificationCallbacks(&cbs);
     if (cbs)
         cbs->GetInterface(iid, result);
     if (!*result) {
         // try load group's notification callbacks...
-        nsCOMPtr<nsILoadGroup> loadGroup;
-        channel->GetLoadGroup(getter_AddRefs(loadGroup));
+        nsILoadGroup* loadGroup;
+        channel->GetLoadGroup(&loadGroup);
         if (loadGroup) {
-            loadGroup->GetNotificationCallbacks(getter_AddRefs(cbs));
+            loadGroup->GetNotificationCallbacks(&cbs);
             if (cbs)
                 cbs->GetInterface(iid, result);
         }
@@ -1022,8 +1022,8 @@ NS_QueryNotificationCallbacks(nsIInterfa
     if (!*result) {
         // try load group's notification callbacks...
         if (loadGroup) {
-            nsCOMPtr<nsIInterfaceRequestor> cbs;
-            loadGroup->GetNotificationCallbacks(getter_AddRefs(cbs));
+            nsIInterfaceRequestor* cbs;
+            loadGroup->GetNotificationCallbacks(&cbs);
             if (cbs)
                 cbs->GetInterface(iid, result);
         }
@@ -1039,7 +1039,7 @@ inline void
 inline void
 NS_WrapAuthPrompt(nsIAuthPrompt *aAuthPrompt, nsIAuthPrompt2** aAuthPrompt2)
 {
-    nsCOMPtr<nsIAuthPromptAdapterFactory> factory =
+    nsIAuthPromptAdapterFactory* factory =
         do_GetService(NS_AUTHPROMPT_ADAPTER_FACTORY_CONTRACTID);
     if (!factory)
         return;
@@ -1061,7 +1061,7 @@ NS_QueryAuthPrompt2(nsIInterfaceRequesto
         return;
 
     // Maybe only nsIAuthPrompt is provided and we have to wrap it.
-    nsCOMPtr<nsIAuthPrompt> prompt(do_GetInterface(aCallbacks));
+    nsIAuthPrompt* prompt(do_GetInterface(aCallbacks));
     if (!prompt)
         return;
 
@@ -1083,20 +1083,20 @@ NS_QueryAuthPrompt2(nsIChannel      *aCh
     // Therefore, we can't just use NS_QueryNotificationCallbacks, because
     // that would prefer a loadgroup's nsIAuthPrompt2 over a channel's
     // nsIAuthPrompt.
-    nsCOMPtr<nsIInterfaceRequestor> callbacks;
-    aChannel->GetNotificationCallbacks(getter_AddRefs(callbacks));
+    nsIInterfaceRequestor* callbacks;
+    aChannel->GetNotificationCallbacks(&callbacks);
     if (callbacks) {
         NS_QueryAuthPrompt2(callbacks, aAuthPrompt);
         if (*aAuthPrompt)
             return;
     }
 
-    nsCOMPtr<nsILoadGroup> group;
-    aChannel->GetLoadGroup(getter_AddRefs(group));
+    nsILoadGroup* group;
+    aChannel->GetLoadGroup(&group);
     if (!group)
         return;
 
-    group->GetNotificationCallbacks(getter_AddRefs(callbacks));
+    group->GetNotificationCallbacks(&callbacks);
     if (!callbacks)
         return;
     NS_QueryAuthPrompt2(callbacks, aAuthPrompt);
@@ -1140,9 +1140,9 @@ NS_NewNotificationCallbacksAggregation(n
                                        nsILoadGroup           *loadGroup,
                                        nsIInterfaceRequestor **result)
 {
-    nsCOMPtr<nsIInterfaceRequestor> cbs;
+    nsIInterfaceRequestor* cbs;
     if (loadGroup)
-        loadGroup->GetNotificationCallbacks(getter_AddRefs(cbs));
+        loadGroup->GetNotificationCallbacks(&cbs);
     return NS_NewInterfaceRequestorAggregation(callbacks, cbs, result);
 }
 
@@ -1153,7 +1153,7 @@ NS_IsOffline()
 NS_IsOffline()
 {
     PRBool offline = PR_TRUE;
-    nsCOMPtr<nsIIOService> ios = do_GetIOService();
+    nsIIOService* ios = do_GetIOService();
     if (ios)
         ios->GetOffline(&offline);
     return offline;
@@ -1171,21 +1171,21 @@ NS_DoImplGetInnermostURI(nsINestedURI* n
     NS_PRECONDITION(nestedURI, "Must have a nested URI!");
     NS_PRECONDITION(!*result, "Must have null *result");
     
-    nsCOMPtr<nsIURI> inner;
-    nsresult rv = nestedURI->GetInnerURI(getter_AddRefs(inner));
+    nsIURI* inner;
+    nsresult rv = nestedURI->GetInnerURI(&inner);
     NS_ENSURE_SUCCESS(rv, rv);
 
     // We may need to loop here until we reach the innermost
     // URI.
-    nsCOMPtr<nsINestedURI> nestedInner(do_QueryInterface(inner));
+    nsINestedURI* nestedInner(do_QueryInterface(inner));
     while (nestedInner) {
-        rv = nestedInner->GetInnerURI(getter_AddRefs(inner));
+        rv = nestedInner->GetInnerURI(&inner);
         NS_ENSURE_SUCCESS(rv, rv);
         nestedInner = do_QueryInterface(inner);
     }
 
     // Found the innermost one if we reach here.
-    inner.swap(*result);
+    swap(inner, *result);
 
     return rv;
 }
@@ -1211,7 +1211,7 @@ NS_EnsureSafeToReturn(nsIURI* uri, nsIUR
     
     // Assume mutable until told otherwise
     PRBool isMutable = PR_TRUE;
-    nsCOMPtr<nsIMutable> mutableObj(do_QueryInterface(uri));
+    nsIMutable* mutableObj(do_QueryInterface(uri));
     if (mutableObj) {
         nsresult rv = mutableObj->GetMutable(&isMutable);
         isMutable = NS_FAILED(rv) || isMutable;
@@ -1231,7 +1231,7 @@ inline void
 inline void
 NS_TryToSetImmutable(nsIURI* uri)
 {
-    nsCOMPtr<nsIMutable> mutableObj(do_QueryInterface(uri));
+    nsIMutable* mutableObj(do_QueryInterface(uri));
     if (mutableObj) {
         mutableObj->SetMutable(PR_FALSE);
     }
@@ -1242,12 +1242,12 @@ NS_TryToSetImmutable(nsIURI* uri)
  * the input URI.  The optional second arg indicates whether we had to fall
  * back to the input URI.  Passing in a null URI is ok.
  */
-inline already_AddRefed<nsIURI>
+inline nsIURI*
 NS_TryToMakeImmutable(nsIURI* uri,
                       nsresult* outRv = nsnull)
 {
     nsresult rv;
-    nsCOMPtr<nsINetUtil> util = do_GetIOService(&rv);
+    nsINetUtil* util = do_GetIOService(&rv);
     nsIURI* result = nsnull;
     if (NS_SUCCEEDED(rv)) {
         NS_ASSERTION(util, "do_GetIOService lied");
@@ -1275,7 +1275,7 @@ NS_URIChainHasFlags(nsIURI   *uri,
                     PRBool   *result)
 {
     nsresult rv;
-    nsCOMPtr<nsINetUtil> util = do_GetIOService(&rv);
+    nsINetUtil* util = do_GetIOService(&rv);
     NS_ENSURE_SUCCESS(rv, rv);
 
     return util->URIChainHasFlags(uri, flags, result);
@@ -1285,12 +1285,12 @@ NS_URIChainHasFlags(nsIURI   *uri,
  * Helper function for getting the innermost URI for a given URI.  The return
  * value could be just the object passed in if it's not a nested URI.
  */
-inline already_AddRefed<nsIURI>
+inline nsIURI*
 NS_GetInnermostURI(nsIURI *uri)
 {
     NS_PRECONDITION(uri, "Must have URI");
     
-    nsCOMPtr<nsINestedURI> nestedURI(do_QueryInterface(uri));
+    nsINestedURI* nestedURI(do_QueryInterface(uri));
     if (!nestedURI) {
         NS_ADDREF(uri);
         return uri;
diff -r 546e94dbb8b1 xpcom/io/nsDirectoryServiceUtils.h
--- a/xpcom/io/nsDirectoryServiceUtils.h	Wed Oct 10 16:06:45 2007 -0700
+++ b/xpcom/io/nsDirectoryServiceUtils.h	Fri Oct 12 15:18:40 2007 -0700
@@ -50,7 +50,7 @@ NS_GetSpecialDirectory(const char* speci
 NS_GetSpecialDirectory(const char* specialDirName, nsIFile* *result)
 {
     nsresult rv;
-    nsCOMPtr<nsIProperties> serv(do_GetService(NS_DIRECTORY_SERVICE_CONTRACTID, &rv));
+    nsIProperties* serv(do_GetService(NS_DIRECTORY_SERVICE_CONTRACTID, &rv));
     if (NS_FAILED(rv))
         return rv;