diff --git a/accessible/src/atk/nsAccessibleHyperText.cpp b/accessible/src/atk/nsAccessibleHyperText.cpp
index 08cc7654da1d..88e8ef7db56a 100644
--- a/accessible/src/atk/nsAccessibleHyperText.cpp
+++ b/accessible/src/atk/nsAccessibleHyperText.cpp
@@ -59,7 +59,7 @@ nsAccessibleHyperText::nsAccessibleHyperText(nsIDOMNode* aDomNode, nsIWeakRefere
   nsCOMPtr<nsIContent> content(do_QueryInterface(aDomNode));
   if (content) {
     nsCOMPtr<nsIContent> parentContent;
-    content->GetParent(*getter_AddRefs(parentContent));
+    content->GetParent(getter_AddRefs(parentContent));
     if (parentContent)
       parentContent->IndexOf(content, mIndex);
   }
diff --git a/accessible/src/atk/nsHTMLLinkAccessibleWrap.cpp b/accessible/src/atk/nsHTMLLinkAccessibleWrap.cpp
index 7e61f26a224f..4c1d365ab4ae 100644
--- a/accessible/src/atk/nsHTMLLinkAccessibleWrap.cpp
+++ b/accessible/src/atk/nsHTMLLinkAccessibleWrap.cpp
@@ -173,9 +173,9 @@ NS_IMETHODIMP nsHTMLImageMapAccessible::GetURI(PRInt32 aIndex, nsIURI **aURI)
   nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
   if (content) {
     nsCOMPtr<nsIDocument> doc;
-    if (NS_SUCCEEDED(content->GetDocument(*getter_AddRefs(doc)))) {
+    if (NS_SUCCEEDED(content->GetDocument(getter_AddRefs(doc)))) {
       nsCOMPtr<nsIURI> baseURI;
-      if (NS_SUCCEEDED(doc->GetBaseURL(*getter_AddRefs(baseURI)))) {
+      if (NS_SUCCEEDED(doc->GetBaseURL(getter_AddRefs(baseURI)))) {
         nsCOMPtr<nsIDOMElement> area(do_QueryInterface(domNode));
         nsAutoString hrefValue;
         if (NS_SUCCEEDED(area->GetAttribute(NS_LITERAL_STRING("href"), hrefValue))) {
diff --git a/accessible/src/atk/nsHTMLTableAccessibleWrap.cpp b/accessible/src/atk/nsHTMLTableAccessibleWrap.cpp
index c2bd7caa495a..bba37cada688 100644
--- a/accessible/src/atk/nsHTMLTableAccessibleWrap.cpp
+++ b/accessible/src/atk/nsHTMLTableAccessibleWrap.cpp
@@ -508,7 +508,7 @@ nsHTMLTableAccessibleWrap::GetTableLayout(nsITableLayout **aLayoutObject)
   NS_ENSURE_TRUE(content, NS_ERROR_FAILURE);
 
   nsCOMPtr<nsIDocument> document;
-  rv = content->GetDocument(*getter_AddRefs(document));
+  rv = content->GetDocument(getter_AddRefs(document));
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCOMPtr<nsIPresShell> presShell;
diff --git a/accessible/src/base/nsAccessibilityService.cpp b/accessible/src/base/nsAccessibilityService.cpp
index b4c3806c2198..e956d2fd2732 100644
--- a/accessible/src/base/nsAccessibilityService.cpp
+++ b/accessible/src/base/nsAccessibilityService.cpp
@@ -152,7 +152,7 @@ nsAccessibilityService::GetInfo(nsISupports* aFrame, nsIFrame** aRealFrame, nsIW
   NS_IF_ADDREF(*aNode);
 
   nsCOMPtr<nsIDocument> document;
-  content->GetDocument(*getter_AddRefs(document));
+  content->GetDocument(getter_AddRefs(document));
   if (!document)
     return NS_ERROR_FAILURE;
 
@@ -1435,7 +1435,7 @@ NS_IMETHODIMP nsAccessibilityService::GetAccessibleFor(nsIDOMNode *aNode,
   nsCOMPtr<nsIContent> content(do_QueryInterface(aNode));
   nsCOMPtr<nsIDocument> doc;
   if (content) {
-    content->GetDocument(*getter_AddRefs(doc));
+    content->GetDocument(getter_AddRefs(doc));
   }
   else {// Could be document node
     doc = do_QueryInterface(aNode);
diff --git a/accessible/src/base/nsAccessible.cpp b/accessible/src/base/nsAccessible.cpp
index 4bebee89f1bc..64ca9776a819 100644
--- a/accessible/src/base/nsAccessible.cpp
+++ b/accessible/src/base/nsAccessible.cpp
@@ -495,7 +495,7 @@ NS_IMETHODIMP nsAccessible::GetFocusedNode(nsIDOMNode **aFocusedNode)
   nsCOMPtr<nsIDocument> document;
   nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
   if (content)
-    content->GetDocument(*getter_AddRefs(document));
+    content->GetDocument(getter_AddRefs(document));
 
   if (!document)
     document = do_QueryInterface(mDOMNode);
@@ -1015,7 +1015,7 @@ NS_IMETHODIMP nsAccessible::AppendFlatStringFromContentNode(nsIContent *aContent
       }
 
       nsCOMPtr<nsIContent> parentContent;
-      aContent->GetParent(*getter_AddRefs(parentContent));
+      aContent->GetParent(getter_AddRefs(parentContent));
       if (parentContent) {
         nsresult rv = shell->GetPrimaryFrameFor(parentContent, &frame);
         if (NS_SUCCEEDED(rv)) {
@@ -1070,7 +1070,7 @@ NS_IMETHODIMP nsAccessible::AppendFlatStringFromContentNode(nsIContent *aContent
       // We don't want that text.
 
       nsCOMPtr<nsIDocument> doc;
-      aContent->GetDocument(*getter_AddRefs(doc));
+      aContent->GetDocument(getter_AddRefs(doc));
       nsCOMPtr<nsIImageDocument> imageDoc(do_QueryInterface(doc));
       if (imageDoc)  // We don't want this faux error text
         textEquivalent.Truncate();
@@ -1125,11 +1125,11 @@ nsresult nsAccessible::AppendFlatStringFromSubtreeRecurse(nsIContent *aContent,
     AppendFlatStringFromContentNode(aContent, aFlatString);
     return NS_OK;
   }
-    
-  nsIContent *contentWalker;
+
+  nsCOMPtr<nsIContent> contentWalker;
   PRInt32 index;
   for (index = 0; index < numChildren; index++) {
-    aContent->ChildAt(index, contentWalker);
+    aContent->ChildAt(index, getter_AddRefs(contentWalker));
     AppendFlatStringFromSubtree(contentWalker, aFlatString);
   }
   return NS_OK;
@@ -1179,10 +1179,10 @@ NS_IMETHODIMP nsAccessible::AppendLabelFor(nsIContent *aLookNode, const nsAStrin
   }
 
   aLookNode->ChildCount(numChildren);
-  nsIContent *contentWalker;
+  nsCOMPtr<nsIContent> contentWalker;
   PRInt32 index;
   for (index = 0; index < numChildren; index++) {
-    aLookNode->ChildAt(index, contentWalker);
+    aLookNode->ChildAt(index, getter_AddRefs(contentWalker));
     if (contentWalker)
       AppendLabelFor(contentWalker, aId, aLabel);
   }
@@ -1215,7 +1215,7 @@ NS_IMETHODIMP nsAccessible::GetHTMLAccName(nsAString& _retval)
       break;
     }
     nsCOMPtr<nsIContent> nextParent;
-    walkUpContent->GetParent(*getter_AddRefs(nextParent));
+    walkUpContent->GetParent(getter_AddRefs(nextParent));
     if (!nextParent) {
       break;
     }
@@ -1294,7 +1294,7 @@ NS_IMETHODIMP nsAccessible::GetXULAccName(nsAString& _retval)
       //
       //      nsCOMPtr<nsIDocument> doc;
       //      nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-      //      content->GetDocument(*getter_AddRefs(doc));
+      //      content->GetDocument(getter_AddRefs(doc));
       //      nsCOMPtr<nsIDOMXULDocument> xulDoc(do_QueryInterface(doc));
       //      if (xulDoc) {
       //        nsCOMPtr<nsIDOMNodeList>labelList;
@@ -1459,7 +1459,7 @@ nsresult nsAccessible::GetParentBlockNode(nsIDOMNode *aCurrentNode, nsIDOMNode *
     return NS_ERROR_FAILURE;
 
   nsCOMPtr<nsIDocument> doc;
-  content->GetDocument(*getter_AddRefs(doc));
+  content->GetDocument(getter_AddRefs(doc));
   if (!doc)
     return NS_ERROR_FAILURE;
 
diff --git a/accessible/src/base/nsBaseWidgetAccessible.cpp b/accessible/src/base/nsBaseWidgetAccessible.cpp
index f4fb3e26ff50..e26171acb54d 100644
--- a/accessible/src/base/nsBaseWidgetAccessible.cpp
+++ b/accessible/src/base/nsBaseWidgetAccessible.cpp
@@ -308,7 +308,7 @@ PRBool nsLinkableAccessible::IsALink()
           mIsLinkVisited = PR_TRUE;
         return PR_TRUE;
       }
-      walkUpContent->GetParent(*getter_AddRefs(tempContent));
+      walkUpContent->GetParent(getter_AddRefs(tempContent));
       walkUpContent = tempContent;
     }
   }
diff --git a/accessible/src/base/nsOuterDocAccessible.cpp b/accessible/src/base/nsOuterDocAccessible.cpp
index 4ee8146e839b..152de2064104 100644
--- a/accessible/src/base/nsOuterDocAccessible.cpp
+++ b/accessible/src/base/nsOuterDocAccessible.cpp
@@ -102,7 +102,7 @@ NS_IMETHODIMP nsOuterDocAccessible::Init()
   NS_ASSERTION(content, "No nsIContent for <browser>/<iframe>/<editor> dom node");
 
   nsCOMPtr<nsIDocument> outerDoc;
-  content->GetDocument(*getter_AddRefs(outerDoc));
+  content->GetDocument(getter_AddRefs(outerDoc));
   NS_ENSURE_TRUE(outerDoc, NS_ERROR_FAILURE);
 
   nsCOMPtr<nsIDocument> innerDoc;
diff --git a/accessible/src/html/nsHTMLSelectAccessible.cpp b/accessible/src/html/nsHTMLSelectAccessible.cpp
index 07f38ab0f631..145ec5f2d5c8 100644
--- a/accessible/src/html/nsHTMLSelectAccessible.cpp
+++ b/accessible/src/html/nsHTMLSelectAccessible.cpp
@@ -729,7 +729,7 @@ nsresult nsHTMLSelectOptionAccessible::GetFocusedOptionNode(nsIDOMNode *aListNod
 
   nsCOMPtr<nsIContent> content(do_QueryInterface(aListNode));
   nsCOMPtr<nsIDocument> document;
-  content->GetDocument(*getter_AddRefs(document));
+  content->GetDocument(getter_AddRefs(document));
   nsCOMPtr<nsIPresShell> shell;
   if (document) 
     document->GetShellAt(0,getter_AddRefs(shell));
diff --git a/accessible/src/msaa/nsAccessNodeWrap.cpp b/accessible/src/msaa/nsAccessNodeWrap.cpp
index 8bbd345b8428..da23fea1a9d7 100644
--- a/accessible/src/msaa/nsAccessNodeWrap.cpp
+++ b/accessible/src/msaa/nsAccessNodeWrap.cpp
@@ -153,7 +153,7 @@ STDMETHODIMP nsAccessNodeWrap::get_nodeInfo(
   PRInt32 nameSpaceID = 0;
   *aUniqueID = 0; // magic value of 0 means we're on the document node.
   if (content) {
-    content->GetNameSpaceID(nameSpaceID);
+    content->GetNameSpaceID(&nameSpaceID);
     // This is a unique ID for every content node.
     // The 3rd party accessibility application can compare this to the childID we return for 
     // events such as focus events, to correlate back to data nodes in their internal object model.
@@ -200,7 +200,7 @@ STDMETHODIMP nsAccessNodeWrap::get_attributes(
     nsAutoString attributeValue;
     const char *pszAttributeName; 
 
-    if (NS_SUCCEEDED(content->GetAttrNameAt(index, nameSpaceID, *getter_AddRefs(nameAtom), *getter_AddRefs(prefixAtom)))) {
+    if (NS_SUCCEEDED(content->GetAttrNameAt(index, &nameSpaceID, getter_AddRefs(nameAtom), getter_AddRefs(prefixAtom)))) {
       aNameSpaceIDs[index] = NS_STATIC_CAST(short, nameSpaceID);
       nameAtom->GetUTF8String(&pszAttributeName);
       aAttribNames[index] = ::SysAllocString(NS_ConvertUTF8toUCS2(pszAttributeName).get());
@@ -226,7 +226,7 @@ STDMETHODIMP nsAccessNodeWrap::get_attributesForNames(
     return E_FAIL;
 
   nsCOMPtr<nsIDocument> doc;
-  content->GetDocument(*getter_AddRefs(doc));
+  content->GetDocument(getter_AddRefs(doc));
   
   if (!doc)
     return E_FAIL;
@@ -267,7 +267,7 @@ NS_IMETHODIMP nsAccessNodeWrap::GetComputedStyleDeclaration(nsIDOMCSSStyleDeclar
 
   nsCOMPtr<nsIDocument> doc;
   if (content) 
-    content->GetDocument(*getter_AddRefs(doc));
+    content->GetDocument(getter_AddRefs(doc));
 
   if (!doc) {
     return NS_ERROR_FAILURE;
@@ -383,7 +383,7 @@ ISimpleDOMNode* nsAccessNodeWrap::MakeAccessNode(nsIDOMNode *node)
   nsCOMPtr<nsIDocument> doc;
 
   if (content) 
-    content->GetDocument(*getter_AddRefs(doc));
+    content->GetDocument(getter_AddRefs(doc));
   else {
     // Get the document via QueryInterface, since there is no content node
     doc = do_QueryInterface(node);
@@ -490,7 +490,7 @@ nsAccessNodeWrap::get_childAt(unsigned aChildIndex,
     return E_FAIL;  // Node already shut down
 
   nsCOMPtr<nsIContent> childContent;
-  content->ChildAt(aChildIndex, *getter_AddRefs(childContent));
+  content->ChildAt(aChildIndex, getter_AddRefs(childContent));
   nsCOMPtr<nsIDOMNode> node(do_QueryInterface(childContent));
 
   if (!node)
diff --git a/chrome/src/nsChromeRegistry.cpp b/chrome/src/nsChromeRegistry.cpp
index ec09a3881e8a..3a3eb4d6f6a6 100644
--- a/chrome/src/nsChromeRegistry.cpp
+++ b/chrome/src/nsChromeRegistry.cpp
@@ -3109,7 +3109,7 @@ nsChromeRegistry::GetAgentSheets(nsIDocShell* aDocShell, nsISupportsArray **aRes
         while (token) {
           nsCOMPtr<nsIContent> content(do_QueryInterface(elt));
           nsCOMPtr<nsIDocument> doc;
-          content->GetDocument(*getter_AddRefs(doc));
+          content->GetDocument(getter_AddRefs(doc));
           nsCOMPtr<nsIURI> docURL;
           doc->GetDocumentURL(getter_AddRefs(docURL));
           nsCOMPtr<nsIURI> url;
diff --git a/content/base/public/nsIAttribute.h b/content/base/public/nsIAttribute.h
index 755a1d1b2e4c..c1c329eff5f7 100644
--- a/content/base/public/nsIAttribute.h
+++ b/content/base/public/nsIAttribute.h
@@ -59,7 +59,7 @@ public:
   NS_IMETHOD SetContent(nsIContent* aContent) = 0;
   NS_IMETHOD GetContent(nsIContent** aContent) = 0;
 
-  NS_IMETHOD GetNodeInfo(nsINodeInfo*& aNodeInfo) = 0;
+  NS_IMETHOD GetNodeInfo(nsINodeInfo** aNodeInfo) = 0;
 };
 
 #endif /* nsIAttribute_h___ */
diff --git a/content/base/public/nsIContent.h b/content/base/public/nsIContent.h
index 84c681e16a5f..765211198ac9 100644
--- a/content/base/public/nsIContent.h
+++ b/content/base/public/nsIContent.h
@@ -73,7 +73,7 @@ public:
    * Get the document for this content.
    * @param aResult the document [OUT]
    */
-  NS_IMETHOD GetDocument(nsIDocument*& aResult) const = 0;
+  NS_IMETHOD GetDocument(nsIDocument** aResult) const = 0;
 
   /**
    * Set the document for this content.
@@ -89,7 +89,7 @@ public:
    * Get the parent content for this content.
    * @param aResult the parent, or null if no parent [OUT]
    */
-  NS_IMETHOD GetParent(nsIContent*& aResult) const = 0;
+  NS_IMETHOD GetParent(nsIContent** aResult) const = 0;
 
   /**
    * Set the parent content for this content.  (This does not add the child to
@@ -116,19 +116,19 @@ public:
    * Get the namespace that this element's tag is defined in
    * @param aResult the namespace [OUT]
    */
-  NS_IMETHOD GetNameSpaceID(PRInt32& aResult) const = 0;
+  NS_IMETHOD GetNameSpaceID(PRInt32* aResult) const = 0;
 
   /**
    * Get the tag for this element
    * @param aResult the tag [OUT]
    */
-  NS_IMETHOD GetTag(nsIAtom*& aResult) const = 0;
+  NS_IMETHOD GetTag(nsIAtom** aResult) const = 0;
 
   /**
    * Get the NodeInfo for this element
    * @param aResult the tag [OUT]
    */
-  NS_IMETHOD GetNodeInfo(nsINodeInfo*& aResult) const = 0;
+  NS_IMETHOD GetNodeInfo(nsINodeInfo** aResult) const = 0;
 
   /**
    * Tell whether this element can contain children
@@ -147,7 +147,7 @@ public:
    * @param aIndex the index of the child to get, or null if index out of bounds
    * @param aResult the child [OUT]
    */
-  NS_IMETHOD ChildAt(PRInt32 aIndex, nsIContent*& aResult) const = 0;
+  NS_IMETHOD ChildAt(PRInt32 aIndex, nsIContent** aResult) const = 0;
 
   /**
    * Get the index of a child within this content
@@ -212,7 +212,7 @@ public:
    *        attribute
    */
   NS_IMETHOD NormalizeAttrString(const nsAString& aStr, 
-                                 nsINodeInfo*& aNodeInfo) = 0;
+                                 nsINodeInfo** aNodeInfo) = 0;
 
   /**
    * Set attribute values. All attribute values are assumed to have a
@@ -280,7 +280,7 @@ public:
    */
 
   NS_IMETHOD GetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
-                     nsIAtom*& aPrefix, nsAString& aResult) const = 0;
+                     nsIAtom** aPrefix, nsAString& aResult) const = 0;
 
   /**
    * Determine if an attribute has been set (empty string or otherwise).
@@ -310,13 +310,13 @@ public:
    * @param aIndex the index of the attribute name
    * @param aNameSpace the name space ID of the attribute name [OUT]
    * @param aName the attribute name [OUT]
-   * @param aPrefix the attribute prefix [OUt]
+   * @param aPrefix the attribute prefix [OUT]
    *
    */
   NS_IMETHOD GetAttrNameAt(PRInt32 aIndex,
-                           PRInt32& aNameSpaceID, 
-                           nsIAtom*& aName,
-                           nsIAtom*& aPrefix) const = 0;
+                           PRInt32* aNameSpaceID,
+                           nsIAtom** aName,
+                           nsIAtom** aPrefix) const = 0;
 
   /**
    * Get the number of all specified attributes.
@@ -347,7 +347,7 @@ public:
    * Get the list of ranges that have either endpoint in this content item
    * @param aResult the list of ranges owned partially by this content [OUT]
    */
-  NS_IMETHOD GetRangeList(nsVoidArray*& aResult) const = 0;
+  NS_IMETHOD GetRangeList(nsVoidArray** aResult) const = 0;
   
   /**
    * Handle a DOM event for this piece of content.  This method is responsible
diff --git a/content/base/public/nsIDocument.h b/content/base/public/nsIDocument.h
index 4b95be955db4..c1241dc2117d 100644
--- a/content/base/public/nsIDocument.h
+++ b/content/base/public/nsIDocument.h
@@ -143,7 +143,7 @@ public:
    * Return the base URL for relative URLs in the document. May return
    * null (or the document URL).
    */
-  NS_IMETHOD GetBaseURL(nsIURI*& aURL) const = 0;
+  NS_IMETHOD GetBaseURL(nsIURI** aURL) const = 0;
   NS_IMETHOD SetBaseURL(nsIURI* aURL) = 0;
 
   /**
@@ -271,7 +271,7 @@ public:
    * Get the direct children of the document - content in
    * the prolog, the root content and content in the epilog.
    */
-  NS_IMETHOD ChildAt(PRInt32 aIndex, nsIContent*& aResult) const = 0;
+  NS_IMETHOD ChildAt(PRInt32 aIndex, nsIContent** aResult) const = 0;
   NS_IMETHOD IndexOf(nsIContent* aPossibleChild, PRInt32& aIndex) const = 0;
   NS_IMETHOD GetChildCount(PRInt32& aCount) = 0;
 
@@ -437,7 +437,7 @@ public:
 
   NS_IMETHOD GetBindingManager(nsIBindingManager** aResult) = 0;
 
-  NS_IMETHOD GetNodeInfoManager(nsINodeInfoManager*& aNodeInfoManager) = 0;
+  NS_IMETHOD GetNodeInfoManager(nsINodeInfoManager** aNodeInfoManager) = 0;
 
   NS_IMETHOD Reset(nsIChannel* aChannel, nsILoadGroup* aLoadGroup) = 0;
   NS_IMETHOD ResetToURI(nsIURI *aURI, nsILoadGroup* aLoadGroup) = 0;
diff --git a/content/base/public/nsIDocumentViewer.h b/content/base/public/nsIDocumentViewer.h
index 058c6dc8dd9d..73027cc8fea8 100644
--- a/content/base/public/nsIDocumentViewer.h
+++ b/content/base/public/nsIDocumentViewer.h
@@ -59,14 +59,14 @@ public:
 
   NS_IMETHOD SetUAStyleSheet(nsIStyleSheet* aUAStyleSheet) = 0;
   
-  NS_IMETHOD GetDocument(nsIDocument*& aResult) = 0;
+  NS_IMETHOD GetDocument(nsIDocument** aResult) = 0;
   
-  NS_IMETHOD GetPresShell(nsIPresShell*& aResult) = 0;
+  NS_IMETHOD GetPresShell(nsIPresShell** aResult) = 0;
   
-  NS_IMETHOD GetPresContext(nsIPresContext*& aResult) = 0;
+  NS_IMETHOD GetPresContext(nsIPresContext** aResult) = 0;
 
   NS_IMETHOD CreateDocumentViewerUsing(nsIPresContext* aPresContext,
-                                       nsIDocumentViewer*& aResult) = 0;
+                                       nsIDocumentViewer** aResult) = 0;
 };
 
 #endif /* nsIDocumentViewer_h___ */
diff --git a/content/base/public/nsINameSpace.h b/content/base/public/nsINameSpace.h
index d32436ab8814..41a94162c257 100644
--- a/content/base/public/nsINameSpace.h
+++ b/content/base/public/nsINameSpace.h
@@ -65,24 +65,24 @@ public:
   NS_DEFINE_STATIC_IID_ACCESSOR(NS_INAMESPACE_IID)
 
   // Get data of this name space
-  NS_IMETHOD GetNameSpaceID(PRInt32& aID) const = 0;
+  NS_IMETHOD GetNameSpaceID(PRInt32* aID) const = 0;
   NS_IMETHOD GetNameSpaceURI(nsAString& aURI) const = 0;
-  NS_IMETHOD GetNameSpacePrefix(nsIAtom*& aPrefix) const = 0;
+  NS_IMETHOD GetNameSpacePrefix(nsIAtom** aPrefix) const = 0;
 
-  NS_IMETHOD GetParentNameSpace(nsINameSpace*& aParent) const = 0;
+  NS_IMETHOD GetParentNameSpace(nsINameSpace** aParent) const = 0;
 
   // find name space within self and parents (not children)
-  NS_IMETHOD FindNameSpace(nsIAtom* aPrefix, nsINameSpace*& aNameSpace) const = 0;
-  NS_IMETHOD FindNameSpaceID(nsIAtom* aPrefix, PRInt32& aNameSpaceID) const = 0;
-  NS_IMETHOD FindNameSpacePrefix(PRInt32 aNameSpaceID, nsIAtom*& aPrefix) const = 0;
+  NS_IMETHOD FindNameSpace(nsIAtom* aPrefix, nsINameSpace** aNameSpace) const = 0;
+  NS_IMETHOD FindNameSpaceID(nsIAtom* aPrefix, PRInt32* aNameSpaceID) const = 0;
+  NS_IMETHOD FindNameSpacePrefix(PRInt32 aNameSpaceID, nsIAtom** aPrefix) const = 0;
 
   // create new child name space
   NS_IMETHOD CreateChildNameSpace(nsIAtom* aPrefix, 
                                   const nsAString& aURI,
-                                  nsINameSpace*& aChildNameSpace) = 0;
+                                  nsINameSpace** aChildNameSpace) = 0;
 
   NS_IMETHOD CreateChildNameSpace(nsIAtom* aPrefix, PRInt32 aNameSpaceID,
-                                  nsINameSpace*& aChildNameSpace) = 0;
+                                  nsINameSpace** aChildNameSpace) = 0;
 };
 
 #endif // nsINameSpace_h___
diff --git a/content/base/public/nsINameSpaceManager.h b/content/base/public/nsINameSpaceManager.h
index 67cec1d7f394..4e50ad4d525b 100644
--- a/content/base/public/nsINameSpaceManager.h
+++ b/content/base/public/nsINameSpaceManager.h
@@ -88,15 +88,15 @@ class nsINameSpaceManager : public nsISupports
 public:
   NS_DEFINE_STATIC_IID_ACCESSOR(NS_INAMESPACEMANAGER_IID)
 
-  NS_IMETHOD CreateRootNameSpace(nsINameSpace*& aRootNameSpace) = 0;
+  NS_IMETHOD CreateRootNameSpace(nsINameSpace** aRootNameSpace) = 0;
 
   NS_IMETHOD RegisterNameSpace(const nsAString& aURI, 
-			                         PRInt32& aNameSpaceID) = 0;
+                               PRInt32& aNameSpaceID) = 0;
 
   NS_IMETHOD GetNameSpaceURI(PRInt32 aNameSpaceID,
                              nsAString& aURI) = 0;
   NS_IMETHOD GetNameSpaceID(const nsAString& aURI,
-                            PRInt32& aNameSpaceID) = 0;
+                            PRInt32* aNameSpaceID) = 0;
 
   NS_IMETHOD GetElementFactory(PRInt32 aNameSpaceID,
                                nsIElementFactory **aElementFactory) = 0;
diff --git a/content/base/public/nsINodeInfo.h b/content/base/public/nsINodeInfo.h
index b9fce05dbc3b..d432668bbf0b 100644
--- a/content/base/public/nsINodeInfo.h
+++ b/content/base/public/nsINodeInfo.h
@@ -113,12 +113,10 @@ public:
    * For the HTML element "<body>" this will return the "body" atom and for
    * the XML element "<html:body>" this will return the "body" atom.
    */
-  nsresult GetNameAtom(nsIAtom*& aAtom) const
+  already_AddRefed<nsIAtom> GetNameAtom() const
   {
-    aAtom = mInner.mName;
-    NS_ADDREF(aAtom);
-
-    return NS_OK;
+    NS_ADDREF(mInner.mName);
+    return mInner.mName;
   }
 
   /*
@@ -164,12 +162,11 @@ public:
    * For the HTML element "<body>" this will return a null atom and for
    * the XML element "<html:body>" this will return the "html" atom.
    */
-  nsresult GetPrefixAtom(nsIAtom*& aAtom) const
+  already_AddRefed<nsIAtom> GetPrefixAtom() const
   {
-    aAtom = mInner.mPrefix;
-    NS_IF_ADDREF(aAtom);
+    NS_IF_ADDREF(mInner.mPrefix);
 
-    return NS_OK;
+    return mInner.mPrefix;
   }
 
   /*
@@ -193,11 +190,9 @@ public:
    * xmlns:html='http://www.w3.org/1999/xhtml' attribute) this will return
    * the namespace ID for "http://www.w3.org/1999/xhtml".
    */
-  nsresult GetNamespaceID(PRInt32& aNameSpaceID) const
+  PRInt32 GetNamespaceID() const
   {
-    aNameSpaceID = mInner.mNamespaceID;
-
-    return NS_OK;
+    return mInner.mNamespaceID;
   }
 
   /*
@@ -212,7 +207,7 @@ public:
   /*
    * Get the owning node info manager, this will never return null.
    */
-  NS_IMETHOD GetNodeInfoManager(nsINodeInfoManager*& aNodeInfoManager) const = 0;
+  NS_IMETHOD GetNodeInfoManager(nsINodeInfoManager** aNodeInfoManager) const = 0;
 
   /*
    * Utility functions that can be used to check if a nodeinfo holds a specific
@@ -276,18 +271,18 @@ public:
    * This is a convinience method that creates a new nsINodeInfo that differs
    * only by name from the one this is called on.
    */
-  NS_IMETHOD NameChanged(nsIAtom *aName, nsINodeInfo*& aResult) = 0;
+  NS_IMETHOD NameChanged(nsIAtom *aName, nsINodeInfo** aResult) = 0;
 
   /*
    * This is a convinience method that creates a new nsINodeInfo that differs
    * only by prefix from the one this is called on.
    */
-  NS_IMETHOD PrefixChanged(nsIAtom *aPrefix, nsINodeInfo*& aResult) = 0;
+  NS_IMETHOD PrefixChanged(nsIAtom *aPrefix, nsINodeInfo** aResult) = 0;
 
   /*
    * Retrieve a pointer to the document that owns this node info.
    */
-  NS_IMETHOD GetDocument(nsIDocument*& aDocument) const = 0;
+  NS_IMETHOD GetDocument(nsIDocument** aDocument) const = 0;
 
   /*
    * Retrieve a pointer to the principal for the document of this node info.
@@ -349,23 +344,23 @@ public:
    * Methods for creating nodeinfo's from atoms and/or strings.
    */
   NS_IMETHOD GetNodeInfo(nsIAtom *aName, nsIAtom *aPrefix,
-                         PRInt32 aNamespaceID, nsINodeInfo*& aNodeInfo) = 0;
+                         PRInt32 aNamespaceID, nsINodeInfo** aNodeInfo) = 0;
   NS_IMETHOD GetNodeInfo(const nsAString& aName, nsIAtom *aPrefix,
-                         PRInt32 aNamespaceID, nsINodeInfo*& aNodeInfo) = 0;
+                         PRInt32 aNamespaceID, nsINodeInfo** aNodeInfo) = 0;
   NS_IMETHOD GetNodeInfo(const nsAString& aName, const nsAString& aPrefix,
-                         PRInt32 aNamespaceID, nsINodeInfo*& aNodeInfo) = 0;
+                         PRInt32 aNamespaceID, nsINodeInfo** aNodeInfo) = 0;
   NS_IMETHOD GetNodeInfo(const nsAString& aName, const nsAString& aPrefix,
                          const nsAString& aNamespaceURI,
-                         nsINodeInfo*& aNodeInfo) = 0;
+                         nsINodeInfo** aNodeInfo) = 0;
   NS_IMETHOD GetNodeInfo(const nsAString& aQualifiedName,
                          const nsAString& aNamespaceURI,
-                         nsINodeInfo*& aNodeInfo) = 0;
+                         nsINodeInfo** aNodeInfo) = 0;
 
   /*
    * Retrieve a pointer to the document that owns this node info
    * manager.
    */
-  NS_IMETHOD GetDocument(nsIDocument*& aDocument) = 0;
+  NS_IMETHOD GetDocument(nsIDocument** aDocument) = 0;
 
   /**
    * Gets the principal of the document associated with this.
diff --git a/content/base/public/nsIStyledContent.h b/content/base/public/nsIStyledContent.h
index 9ecae87837ab..8bdfee17a8e7 100644
--- a/content/base/public/nsIStyledContent.h
+++ b/content/base/public/nsIStyledContent.h
@@ -60,7 +60,7 @@ public:
   // corresponds to the attribute nsHTMLAtoms::id and that the Class
   // corresponds to the attribute nsHTMLAtoms::kClass.  If this becomes
   // incorrect, then new methods need to be added here.
-  NS_IMETHOD GetID(nsIAtom*& aResult) const = 0;
+  NS_IMETHOD GetID(nsIAtom** aResult) const = 0;
   NS_IMETHOD GetClasses(nsVoidArray& aArray) const = 0;
   NS_IMETHOD_(PRBool) HasClass(nsIAtom* aClass, PRBool aCaseSensitive) const = 0;
 
diff --git a/content/base/src/mozSanitizingSerializer.cpp b/content/base/src/mozSanitizingSerializer.cpp
index 5727e2f56486..c1663cf1a395 100644
--- a/content/base/src/mozSanitizingSerializer.cpp
+++ b/content/base/src/mozSanitizingSerializer.cpp
@@ -213,7 +213,7 @@ mozSanitizingHTMLSerializer::GetIdForContent(nsIContent* aContent,
   }
 
   nsCOMPtr<nsIAtom> tagname;
-  mContent->GetTag(*getter_AddRefs(tagname));
+  mContent->GetTag(getter_AddRefs(tagname));
   if (!tagname)
     return NS_ERROR_FAILURE;
   
diff --git a/content/base/src/nsCommentNode.cpp b/content/base/src/nsCommentNode.cpp
index 381db7f1989c..c07bebddf062 100644
--- a/content/base/src/nsCommentNode.cpp
+++ b/content/base/src/nsCommentNode.cpp
@@ -63,7 +63,7 @@ public:
   // Empty interface
 
   // nsIContent
-  NS_IMETHOD GetTag(nsIAtom*& aResult) const;
+  NS_IMETHOD GetTag(nsIAtom** aResult) const;
 
 #ifdef DEBUG
   NS_IMETHOD List(FILE* out, PRInt32 aIndent) const;
@@ -113,10 +113,10 @@ NS_IMPL_RELEASE_INHERITED(nsCommentNode, nsGenericDOMDataNode)
 
 
 NS_IMETHODIMP
-nsCommentNode::GetTag(nsIAtom*& aResult) const
+nsCommentNode::GetTag(nsIAtom** aResult) const
 {
-  aResult = nsLayoutAtoms::commentTagName;
-  NS_ADDREF(aResult);
+  NS_ADDREF(*aResult = nsLayoutAtoms::commentTagName);
+
   return NS_OK;
 }
 
diff --git a/content/base/src/nsContentAreaDragDrop.cpp b/content/base/src/nsContentAreaDragDrop.cpp
index a75eb0fdff59..578ce9747fba 100644
--- a/content/base/src/nsContentAreaDragDrop.cpp
+++ b/content/base/src/nsContentAreaDragDrop.cpp
@@ -623,7 +623,7 @@ nsContentAreaDragDrop::GetAnchorURL(nsIDOMNode* inNode, nsAString& outURL)
         // ... or just get the ID
         nsCOMPtr<nsIXMLContent> xml(do_QueryInterface(inNode));
         nsCOMPtr<nsIAtom> id;
-        if (xml && NS_SUCCEEDED(xml->GetID(*getter_AddRefs(id))) && id) {
+        if (xml && NS_SUCCEEDED(xml->GetID(getter_AddRefs(id))) && id) {
           id->ToString(outURL);
         }
       }
@@ -1228,7 +1228,7 @@ nsresult nsContentAreaDragDrop::GetDraggableSelectionData(nsISelection* inSelect
             {
               PRInt32 childOffset = (anchorOffset < focusOffset) ? anchorOffset : focusOffset;
               nsCOMPtr<nsIContent> childContent;
-              selStartContent->ChildAt(childOffset, *getter_AddRefs(childContent));
+              selStartContent->ChildAt(childOffset, getter_AddRefs(childContent));
               // if we find an image, we'll fall into the node-dragging code,
               // rather the the selection-dragging code
               nsCOMPtr<nsIDOMHTMLImageElement> selectedImage;
diff --git a/content/base/src/nsContentIterator.cpp b/content/base/src/nsContentIterator.cpp
index 0fa96ef0bd2c..bf088a1f7184 100644
--- a/content/base/src/nsContentIterator.cpp
+++ b/content/base/src/nsContentIterator.cpp
@@ -135,7 +135,7 @@ ContentToParentOffset(nsIContent *aContent, nsIDOMNode **aParent, PRInt32 *aOffs
     return;
 
   nsCOMPtr<nsIContent> parent;
-  nsresult rv = aContent->GetParent(*getter_AddRefs(parent));
+  nsresult rv = aContent->GetParent(getter_AddRefs(parent));
 
   if (NS_FAILED(rv) || !parent)
     return;
@@ -478,7 +478,7 @@ nsresult nsContentIterator::Init(nsIDOMRange* aRange)
   nsCOMPtr<nsIContent> cChild;
 
   if (!cData && ContentHasChildren(startCon))
-    startCon->ChildAt(startIndx,*getter_AddRefs(cChild));
+    startCon->ChildAt(startIndx, getter_AddRefs(cChild));
 
   if (!cChild) // no children, must be a text node
   {
@@ -552,7 +552,7 @@ nsresult nsContentIterator::Init(nsIDOMRange* aRange)
   {
     PRInt32 indx = endIndx;
 
-    endCon->ChildAt(--indx, *getter_AddRefs(cChild));
+    endCon->ChildAt(--indx, getter_AddRefs(cChild));
 
     if (!cChild)  // No child at offset!
     {
@@ -609,7 +609,7 @@ nsresult nsContentIterator::RebuildIndexStack()
   current = mCurNode;
   while (current && current != mCommonParent)
   {
-    if (NS_FAILED(current->GetParent(*getter_AddRefs(parent))))
+    if (NS_FAILED(current->GetParent(getter_AddRefs(parent))))
       return NS_ERROR_FAILURE;
     if (!parent || NS_FAILED(parent->IndexOf(current, indx)))
       return NS_ERROR_FAILURE;
@@ -640,7 +640,7 @@ nsCOMPtr<nsIContent> nsContentIterator::GetDeepFirstChild(nsCOMPtr<nsIContent> a
   {  
     nsCOMPtr<nsIContent> cN = aRoot;
     nsCOMPtr<nsIContent> cChild;
-    cN->ChildAt(0,*getter_AddRefs(cChild));
+    cN->ChildAt(0, getter_AddRefs(cChild));
     while ( cChild )
     {
       if (aIndexes)
@@ -649,7 +649,7 @@ nsCOMPtr<nsIContent> nsContentIterator::GetDeepFirstChild(nsCOMPtr<nsIContent> a
         aIndexes->AppendElement(NS_INT32_TO_PTR(0));
       }
       cN = cChild;
-      cN->ChildAt(0,*getter_AddRefs(cChild));
+      cN->ChildAt(0, getter_AddRefs(cChild));
     }
     deepFirstChild = cN;
   }
@@ -671,7 +671,7 @@ nsCOMPtr<nsIContent> nsContentIterator::GetDeepLastChild(nsCOMPtr<nsIContent> aR
 
     while ( numChildren )
     {
-      cN->ChildAt(--numChildren,*getter_AddRefs(cChild));
+      cN->ChildAt(--numChildren, getter_AddRefs(cChild));
       if (cChild)
       {
         if (aIndexes)
@@ -707,7 +707,7 @@ nsresult nsContentIterator::GetNextSibling(nsCOMPtr<nsIContent> aNode,
   nsCOMPtr<nsIContent> parent;
   PRInt32              indx;
   
-  if (NS_FAILED(aNode->GetParent(*getter_AddRefs(parent))) || !parent)
+  if (NS_FAILED(aNode->GetParent(getter_AddRefs(parent))) || !parent)
     return NS_ERROR_FAILURE;
 
   if (aIndexes)
@@ -721,7 +721,7 @@ nsresult nsContentIterator::GetNextSibling(nsCOMPtr<nsIContent> aNode,
   // reverify that the index of the current node hasn't changed.
   // not super cheap, but a lot cheaper than IndexOf(), and still O(1).
   // ignore result this time - the index may now be out of range.
-  (void) parent->ChildAt(indx, *getter_AddRefs(sib)); // sib defaults to nsnull
+  (void) parent->ChildAt(indx, getter_AddRefs(sib)); // sib defaults to nsnull
   if (sib != aNode)
   {
     // someone changed our index - find the new index the painful way
@@ -730,7 +730,7 @@ nsresult nsContentIterator::GetNextSibling(nsCOMPtr<nsIContent> aNode,
   }
 
   // indx is now canonically correct
-  if (NS_SUCCEEDED(parent->ChildAt(++indx, *getter_AddRefs(sib))) && sib)
+  if (NS_SUCCEEDED(parent->ChildAt(++indx, getter_AddRefs(sib))) && sib)
   {
     *aSibling = sib;
     // update index cache
@@ -775,7 +775,7 @@ nsresult nsContentIterator::GetPrevSibling(nsCOMPtr<nsIContent> aNode,
   nsCOMPtr<nsIContent> parent;
   PRInt32              indx;
   
-  if (NS_FAILED(aNode->GetParent(*getter_AddRefs(parent))) || !parent)
+  if (NS_FAILED(aNode->GetParent(getter_AddRefs(parent))) || !parent)
     return NS_ERROR_FAILURE;
 
   if (aIndexes)
@@ -788,7 +788,7 @@ nsresult nsContentIterator::GetPrevSibling(nsCOMPtr<nsIContent> aNode,
   
   // reverify that the index of the current node hasn't changed
   // ignore result this time - the index may now be out of range.
-  (void) parent->ChildAt(indx, *getter_AddRefs(sib)); // sib defaults to nsnull
+  (void) parent->ChildAt(indx, getter_AddRefs(sib)); // sib defaults to nsnull
   if (sib != aNode)
   {
     // someone changed our index - find the new index the painful way
@@ -798,7 +798,7 @@ nsresult nsContentIterator::GetPrevSibling(nsCOMPtr<nsIContent> aNode,
 
   // indx is now canonically correct
   if (indx > 0 && 
-      NS_SUCCEEDED(parent->ChildAt(--indx, *getter_AddRefs(sib))) && sib)
+      NS_SUCCEEDED(parent->ChildAt(--indx, getter_AddRefs(sib))) && sib)
   {
     *aSibling = sib;
     // update index cache
@@ -843,7 +843,7 @@ nsresult nsContentIterator::NextNode(nsCOMPtr<nsIContent> *ioNextNode, nsVoidArr
     // if it has children then next node is first child
     if (numChildren)
     {
-      if (NS_FAILED(cN->ChildAt(0,*getter_AddRefs(cFirstChild))))
+      if (NS_FAILED(cN->ChildAt(0, getter_AddRefs(cFirstChild))))
         return NS_ERROR_FAILURE;
       if (!cFirstChild)
         return NS_ERROR_FAILURE;
@@ -870,7 +870,7 @@ nsresult nsContentIterator::NextNode(nsCOMPtr<nsIContent> *ioNextNode, nsVoidArr
     PRInt32              indx;
   
     // get next sibling if there is one
-    if (NS_FAILED(cN->GetParent(*getter_AddRefs(parent))))
+    if (NS_FAILED(cN->GetParent(getter_AddRefs(parent))))
       return NS_ERROR_FAILURE;
       
     // get the cached index
@@ -886,7 +886,7 @@ nsresult nsContentIterator::NextNode(nsCOMPtr<nsIContent> *ioNextNode, nsVoidArr
     // not super cheap, but a lot cheaper than IndexOf(), and still O(1).
     // ignore result this time - the index may now be out of range.
     if (indx >= 0)
-      (void) parent->ChildAt(indx, *getter_AddRefs(cSibling));
+      (void) parent->ChildAt(indx, getter_AddRefs(cSibling));
     if (cSibling != cN)
     {
       // someone changed our index - find the new index the painful way
@@ -895,7 +895,7 @@ nsresult nsContentIterator::NextNode(nsCOMPtr<nsIContent> *ioNextNode, nsVoidArr
     }
 
     // indx is now canonically correct
-    if (NS_SUCCEEDED(parent->ChildAt(++indx,*getter_AddRefs(cSibling))) && cSibling)
+    if (NS_SUCCEEDED(parent->ChildAt(++indx, getter_AddRefs(cSibling))) && cSibling)
     {
       // update cache
       if (aIndexes)
@@ -940,7 +940,7 @@ nsresult nsContentIterator::PrevNode(nsCOMPtr<nsIContent> *ioNextNode, nsVoidArr
     PRInt32              indx;
   
     // get prev sibling if there is one
-    if (NS_FAILED(cN->GetParent(*getter_AddRefs(parent))))
+    if (NS_FAILED(cN->GetParent(getter_AddRefs(parent))))
       return NS_ERROR_FAILURE;
 
     // get the cached index
@@ -956,7 +956,7 @@ nsresult nsContentIterator::PrevNode(nsCOMPtr<nsIContent> *ioNextNode, nsVoidArr
     // not super cheap, but a lot cheaper than IndexOf(), and still O(1).
     // ignore result this time - the index may now be out of range.
     if (indx >= 0)
-      (void) parent->ChildAt(indx, *getter_AddRefs(cSibling));
+      (void) parent->ChildAt(indx, getter_AddRefs(cSibling));
     if (cSibling != cN)
     {
       // someone changed our index - find the new index the painful way
@@ -965,7 +965,7 @@ nsresult nsContentIterator::PrevNode(nsCOMPtr<nsIContent> *ioNextNode, nsVoidArr
     }
 
     // indx is now canonically correct
-    if (indx && NS_SUCCEEDED(parent->ChildAt(--indx,*getter_AddRefs(cSibling))) && cSibling)
+    if (indx && NS_SUCCEEDED(parent->ChildAt(--indx, getter_AddRefs(cSibling))) && cSibling)
     {
       // update cache
       if (aIndexes)
@@ -1000,7 +1000,7 @@ nsresult nsContentIterator::PrevNode(nsCOMPtr<nsIContent> *ioNextNode, nsVoidArr
     // if it has children then prev node is last child
     if (numChildren)
     {
-      if (NS_FAILED(cN->ChildAt(--numChildren,*getter_AddRefs(cLastChild))))
+      if (NS_FAILED(cN->ChildAt(--numChildren, getter_AddRefs(cLastChild))))
         return NS_ERROR_FAILURE;
       if (!cLastChild)
         return NS_ERROR_FAILURE;
@@ -1173,7 +1173,7 @@ nsresult nsContentIterator::PositionAt(nsIContent* aCurNode)
     // Insert at head since we're walking up
     oldParentStack.InsertElementAt(tempNode,0);
 
-    if (NS_FAILED(tempNode->GetParent(*getter_AddRefs(parent))))
+    if (NS_FAILED(tempNode->GetParent(getter_AddRefs(parent))))
       return NS_ERROR_FAILURE;
 
     if (!parent)  // this node has no parent, and thus no index
@@ -1196,7 +1196,7 @@ nsresult nsContentIterator::PositionAt(nsIContent* aCurNode)
   {
     PRInt32 indx;
 
-    if (NS_FAILED(newCurNode->GetParent(*getter_AddRefs(parent))))
+    if (NS_FAILED(newCurNode->GetParent(getter_AddRefs(parent))))
       return NS_ERROR_FAILURE;
 
     if (!parent)  // this node has no parent, and thus no index
@@ -1378,7 +1378,7 @@ nsresult nsContentSubtreeIterator::Init(nsIDOMRange* aRange)
   // short circuit when start node == end node
   if (startParent == endParent)
   {
-    cStartP->ChildAt(0,*getter_AddRefs(cChild));
+    cStartP->ChildAt(0, getter_AddRefs(cChild));
   
     if (!cChild) // no children, must be a text node or empty container
     {
@@ -1582,7 +1582,7 @@ nsresult nsContentSubtreeIterator::Next()
     // as long as we are finding ancestors of the endpoint of the range,
     // dive down into their children
     nsCOMPtr<nsIContent> cChild;
-    nextNode->ChildAt(0,*getter_AddRefs(cChild));
+    nextNode->ChildAt(0, getter_AddRefs(cChild));
     if (!cChild) return NS_ERROR_NULL_POINTER;
     // should be impossible to get a null pointer.  If we went all the 
     // down the child chain to the bottom without finding an interior node, 
@@ -1649,7 +1649,7 @@ nsresult nsContentSubtreeIterator::GetTopAncestorInRange(
   nsCOMPtr<nsIContent> parent, tmp;
   while (aNode)
   {
-    if (NS_FAILED(aNode->GetParent(*getter_AddRefs(parent))))
+    if (NS_FAILED(aNode->GetParent(getter_AddRefs(parent))))
       return NS_ERROR_FAILURE;
     if (!parent)
     {
diff --git a/content/base/src/nsContentList.cpp b/content/base/src/nsContentList.cpp
index 86535e702873..5d13a0890478 100644
--- a/content/base/src/nsContentList.cpp
+++ b/content/base/src/nsContentList.cpp
@@ -176,7 +176,7 @@ static PRBool BelongsInForm(nsIDOMHTMLFormElement *aForm,
 
   nsCOMPtr<nsIContent> content;
 
-  aContent->GetParent(*getter_AddRefs(content));
+  aContent->GetParent(getter_AddRefs(content));
 
   while (content) {
     if (content == form) {
@@ -187,7 +187,7 @@ static PRBool BelongsInForm(nsIDOMHTMLFormElement *aForm,
 
     nsCOMPtr<nsIAtom> tag;
 
-    content->GetTag(*getter_AddRefs(tag));
+    content->GetTag(getter_AddRefs(tag));
 
     if (tag.get() == nsHTMLAtoms::form) {
       // The child is contained within a form, but not the right form
@@ -198,7 +198,7 @@ static PRBool BelongsInForm(nsIDOMHTMLFormElement *aForm,
 
     nsIContent *tmp = content;
 
-    tmp->GetParent(*getter_AddRefs(content));
+    tmp->GetParent(getter_AddRefs(content));
   }
 
   PRInt32 count = 0;
@@ -670,7 +670,7 @@ nsContentList::ContentAppended(nsIDocument *aDocument, nsIContent* aContainer,
       if (ourLastDOM3Node) {
         nsCOMPtr<nsIContent> firstAppendedContent;
         aContainer->ChildAt(aNewIndexInContainer,
-                            *getter_AddRefs(firstAppendedContent));
+                            getter_AddRefs(firstAppendedContent));
         nsCOMPtr<nsIDOMNode> newNode(do_QueryInterface(firstAppendedContent));
         NS_ASSERTION(newNode, "Content being inserted is not a node.... why?");
         PRUint16 comparisonFlags;
@@ -690,7 +690,7 @@ nsContentList::ContentAppended(nsIDocument *aDocument, nsIContent* aContainer,
       // whether we need to invalidate
       nsCOMPtr<nsIContent> content;
       for (i = aNewIndexInContainer; i <= count-1; ++i) {
-        aContainer->ChildAt(i, *getter_AddRefs(content));
+        aContainer->ChildAt(i, getter_AddRefs(content));
         if (MatchSelf(content)) {
           // Uh-oh.  We're gonna have to add elements into the middle
           // of our list. That's not worth the effort.
@@ -717,7 +717,7 @@ nsContentList::ContentAppended(nsIDocument *aDocument, nsIContent* aContainer,
      */
     nsCOMPtr<nsIContent> content;
     for (i = aNewIndexInContainer; i <= count-1; ++i) {
-      aContainer->ChildAt(i, *getter_AddRefs(content));
+      aContainer->ChildAt(i, getter_AddRefs(content));
       PRUint32 limit = PRUint32(-1);
       PopulateWith(content, PR_TRUE, limit);
     }
@@ -804,7 +804,7 @@ nsContentList::Match(nsIContent *aContent)
 
   if (mMatchAtom) {
     nsCOMPtr<nsINodeInfo> ni;
-    aContent->GetNodeInfo(*getter_AddRefs(ni));
+    aContent->GetNodeInfo(getter_AddRefs(ni));
 
     if (!ni)
       return PR_FALSE;
@@ -839,7 +839,7 @@ nsContentList::CheckDocumentExistence()
 {
   nsresult result = NS_OK;
   if (!mDocument && mRootContent) {
-    result = mRootContent->GetDocument(mDocument);
+    result = mRootContent->GetDocument(&mDocument);
     if (mDocument) {
       mDocument->AddObserver(this);
       mState = LIST_DIRTY;
@@ -862,7 +862,7 @@ nsContentList::MatchSelf(nsIContent *aContent)
   aContent->ChildCount(count);
   nsCOMPtr<nsIContent> child;
   for (i = 0; i < count; i++) {
-    aContent->ChildAt(i, *getter_AddRefs(child));
+    aContent->ChildAt(i, getter_AddRefs(child));
     if (MatchSelf(child)) {
       return PR_TRUE;
     }
@@ -888,7 +888,7 @@ nsContentList::PopulateWith(nsIContent *aContent, PRBool aIncludeRoot,
   aContent->ChildCount(count);
   nsCOMPtr<nsIContent> child;
   for (i = 0; i < count; i++) {
-    aContent->ChildAt(i, *getter_AddRefs(child));
+    aContent->ChildAt(i, getter_AddRefs(child));
     PopulateWith(child, PR_TRUE, aElementsToAppend);
     if (aElementsToAppend == 0)
       return;
@@ -914,7 +914,7 @@ nsContentList::PopulateWithStartingAfter(nsIContent *aStartRoot,
   aStartRoot->ChildCount(childCount);
   nsCOMPtr<nsIContent> child;
   for ( ; i < childCount; ++i) {
-    aStartRoot->ChildAt(i, *getter_AddRefs(child));
+    aStartRoot->ChildAt(i, getter_AddRefs(child));
     PopulateWith(child, PR_TRUE, aElementsToAppend);
     NS_ASSERTION(aElementsToAppend + mElements.Count() == invariant,
                  "Something is awry in PopulateWith!");
@@ -928,7 +928,7 @@ nsContentList::PopulateWithStartingAfter(nsIContent *aStartRoot,
     return;
   
   nsCOMPtr<nsIContent> parent;
-  aStartRoot->GetParent(*getter_AddRefs(parent));
+  aStartRoot->GetParent(getter_AddRefs(parent));
   
   if (parent)
     PopulateWithStartingAfter(parent, aStartRoot, aElementsToAppend);
@@ -996,7 +996,7 @@ nsContentList::IsDescendantOfRoot(nsIContent* aContainer)
     // check.
     if (aContainer) { 
       nsCOMPtr<nsIDocument> doc;
-      aContainer->GetDocument(*getter_AddRefs(doc));
+      aContainer->GetDocument(getter_AddRefs(doc));
       NS_ASSERTION(doc == mDocument, "We should not get in here if aContainer is in some _other_ document!");
     }
 #endif
diff --git a/content/base/src/nsContentUtils.cpp b/content/base/src/nsContentUtils.cpp
index ca6b3591b11d..b212feef5857 100644
--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@@ -454,10 +454,10 @@ nsContentUtils::GetDocumentAndPrincipal(nsIDOMNode* aNode,
       // manager
       nsCOMPtr<nsINodeInfo> ni;
       if (content) {
-        content->GetNodeInfo(*getter_AddRefs(ni));
+        content->GetNodeInfo(getter_AddRefs(ni));
       }
       else {
-        attr->GetNodeInfo(*getter_AddRefs(ni));
+        attr->GetNodeInfo(getter_AddRefs(ni));
       }
 
       if (!ni) {
@@ -531,7 +531,7 @@ nsContentUtils::CheckSameOrigin(nsIDOMNode *aTrustedNode,
       NS_ENSURE_TRUE(cont, NS_ERROR_UNEXPECTED);
       
       nsCOMPtr<nsINodeInfo> ni;
-      cont->GetNodeInfo(*getter_AddRefs(ni));
+      cont->GetNodeInfo(getter_AddRefs(ni));
       NS_ENSURE_TRUE(ni, NS_ERROR_UNEXPECTED);
       
       ni->GetDocumentPrincipal(getter_AddRefs(trustedPrincipal));
@@ -670,7 +670,7 @@ nsContentUtils::InProlog(nsIDOMNode *aNode)
   while (pos > 0) {
     --pos;
     nsCOMPtr<nsIContent> sibl;
-    doc->ChildAt(pos, *getter_AddRefs(sibl));
+    doc->ChildAt(pos, getter_AddRefs(sibl));
     if (sibl->IsContentOfType(nsIContent::eELEMENT)) {
       return PR_FALSE;
     }
@@ -725,7 +725,7 @@ nsContentUtils::doReparentContentWrapper(nsIContent *aChild,
   aChild->ChildCount(count);
 
   for (i = 0; i < count; i++) {
-    aChild->ChildAt(i, *getter_AddRefs(child));
+    aChild->ChildAt(i, getter_AddRefs(child));
     NS_ENSURE_TRUE(child, NS_ERROR_UNEXPECTED);
 
     rv = doReparentContentWrapper(child, aNewDocument, aOldDocument, cx, old);
@@ -779,10 +779,10 @@ nsContentUtils::ReparentContentWrapper(nsIContent *aContent,
   if (!old_doc) {
     nsCOMPtr<nsINodeInfo> ni;
 
-    aContent->GetNodeInfo(*getter_AddRefs(ni));
+    aContent->GetNodeInfo(getter_AddRefs(ni));
 
     if (ni) {
-      ni->GetDocument(*getter_AddRefs(old_doc));
+      ni->GetDocument(getter_AddRefs(old_doc));
     }
 
     if (!old_doc) {
@@ -927,8 +927,8 @@ nsContentUtils::InSameDoc(nsIDOMNode* aNode, nsIDOMNode* aOther)
   if (content && other) {
     nsCOMPtr<nsIDocument> contentDoc;
     nsCOMPtr<nsIDocument> otherDoc;
-    content->GetDocument(*getter_AddRefs(contentDoc));
-    other->GetDocument(*getter_AddRefs(otherDoc));
+    content->GetDocument(getter_AddRefs(contentDoc));
+    other->GetDocument(getter_AddRefs(otherDoc));
     // XXXcaa Don't bother to check that either node is in a
     // document.  Editor relies on us returning true if neither
     // node is in a document.  See bug 154401.
@@ -952,7 +952,7 @@ nsContentUtils::ContentIsDescendantOf(nsIContent* aPossibleDescendant,
   do {
     if (aPossibleDescendant == aPossibleAncestor)
       return PR_TRUE;
-    aPossibleDescendant->GetParent(*getter_AddRefs(parent));
+    aPossibleDescendant->GetParent(getter_AddRefs(parent));
     aPossibleDescendant = parent;
   } while (aPossibleDescendant);
 
@@ -1011,13 +1011,13 @@ nsContentUtils::GetAncestorsAndOffsets(nsIDOMNode* aNode,
   aAncestorOffsets->AppendElement(NS_INT32_TO_PTR(aOffset));
 
   // insert all the ancestors
-  content->GetParent(*getter_AddRefs(ancestor));
+  content->GetParent(getter_AddRefs(ancestor));
   while (ancestor) {
     ancestor->IndexOf(content, offset);
     aAncestorNodes->AppendElement(ancestor.get());
     aAncestorOffsets->AppendElement(NS_INT32_TO_PTR(offset));
     content = ancestor;
-    content->GetParent(*getter_AddRefs(ancestor));
+    content->GetParent(getter_AddRefs(ancestor));
   }
 
   return NS_OK;
@@ -1410,7 +1410,7 @@ nsContentUtils::GenerateStateKey(nsIContent* aContent,
   }
 
   nsCOMPtr<nsIDocument> doc;
-  aContent->GetDocument(*getter_AddRefs(doc));
+  aContent->GetDocument(getter_AddRefs(doc));
   nsCOMPtr<nsIHTMLDocument> htmlDocument(do_QueryInterface(doc));
 
   PRBool generatedUniqueKey = PR_FALSE;
@@ -1542,7 +1542,7 @@ nsCxPusher::Push(nsISupports *aCurrentTarget)
   nsCOMPtr<nsIDocument> document;
 
   if (content) {
-    content->GetDocument(*getter_AddRefs(document));
+    content->GetDocument(getter_AddRefs(document));
   }
 
   if (!document) {
diff --git a/content/base/src/nsCopySupport.cpp b/content/base/src/nsCopySupport.cpp
index 8ed11a31bacb..428eaf7774f2 100644
--- a/content/base/src/nsCopySupport.cpp
+++ b/content/base/src/nsCopySupport.cpp
@@ -358,7 +358,7 @@ nsresult nsCopySupport::IsPlainTextContext(nsISelection *aSel, nsIDocument *aDoc
   {
     // checking for selection inside a plaintext form widget
     nsCOMPtr<nsIAtom> atom;
-    selContent->GetTag(*getter_AddRefs(atom));
+    selContent->GetTag(getter_AddRefs(atom));
 
     if (atom.get() == nsHTMLAtoms::input ||
         atom.get() == nsHTMLAtoms::textarea)
@@ -381,7 +381,7 @@ nsresult nsCopySupport::IsPlainTextContext(nsISelection *aSel, nsIDocument *aDoc
         break;
       }
     }
-    selContent->GetParent(*getter_AddRefs(tmp));
+    selContent->GetParent(getter_AddRefs(tmp));
     selContent = tmp;
   }
   
diff --git a/content/base/src/nsDOMAttribute.cpp b/content/base/src/nsDOMAttribute.cpp
index e3cae9ab6b87..53be98774716 100644
--- a/content/base/src/nsDOMAttribute.cpp
+++ b/content/base/src/nsDOMAttribute.cpp
@@ -108,10 +108,9 @@ nsDOMAttribute::GetContent(nsIContent** aContent)
 }
 
 NS_IMETHODIMP
-nsDOMAttribute::GetNodeInfo(nsINodeInfo*& aNodeInfo)
+nsDOMAttribute::GetNodeInfo(nsINodeInfo** aNodeInfo)
 {
-  aNodeInfo = mNodeInfo;
-  NS_IF_ADDREF(aNodeInfo);
+  NS_IF_ADDREF(*aNodeInfo = mNodeInfo);
 
   return NS_OK;
 }
@@ -129,23 +128,21 @@ nsDOMAttribute::GetValue(nsAString& aValue)
 {
   NS_ENSURE_TRUE(mNodeInfo, NS_ERROR_FAILURE);
 
-  nsresult result = NS_OK;
   if (mContent) {
-    nsresult attrResult;
-    PRInt32 nameSpaceID;
-    nsCOMPtr<nsIAtom> name;
-
-    mNodeInfo->GetNameAtom(*getter_AddRefs(name));
-    mNodeInfo->GetNamespaceID(nameSpaceID);
+    nsCOMPtr<nsIAtom> name = mNodeInfo->GetNameAtom();
+    PRInt32 nameSpaceID = mNodeInfo->GetNamespaceID();
 
     nsAutoString tmpValue;
-    attrResult = mContent->GetAttr(nameSpaceID, name, tmpValue);
+    nsresult attrResult = mContent->GetAttr(nameSpaceID, name,
+                                            tmpValue);
     if (NS_CONTENT_ATTR_NOT_THERE != attrResult) {
       mValue = tmpValue;
     }
   }
-  aValue=mValue;
-  return result;
+
+  aValue = mValue;
+
+  return NS_OK;
 }
 
 nsresult
@@ -168,28 +165,17 @@ nsDOMAttribute::GetSpecified(PRBool* aSpecified)
   NS_ENSURE_TRUE(mNodeInfo, NS_ERROR_FAILURE);
   NS_ENSURE_ARG_POINTER(aSpecified);
 
-  nsresult result = NS_OK;
-  if (nsnull == mContent) {
+  if (!mContent) {
     *aSpecified = PR_FALSE;
-  } else {
-    nsAutoString value;
-    nsresult attrResult;
-    PRInt32 nameSpaceID;
-    nsCOMPtr<nsIAtom> name;
-
-    mNodeInfo->GetNameAtom(*getter_AddRefs(name));
-    mNodeInfo->GetNamespaceID(nameSpaceID);
-
-    attrResult = mContent->GetAttr(nameSpaceID, name, value);
-    if (NS_CONTENT_ATTR_HAS_VALUE == attrResult) {
-      *aSpecified = PR_TRUE;
-    }
-    else {
-      *aSpecified = PR_FALSE;
-    }
+    return NS_OK;
   }
 
-  return result;
+  nsCOMPtr<nsIAtom> name = mNodeInfo->GetNameAtom();
+  PRInt32 nameSpaceID = mNodeInfo->GetNamespaceID();
+
+  *aSpecified = mContent->HasAttr(nameSpaceID, name);
+
+  return NS_OK;
 }
 
 NS_IMETHODIMP
@@ -376,13 +362,10 @@ nsDOMAttribute::CloneNode(PRBool aDeep, nsIDOMNode** aReturn)
   nsDOMAttribute* newAttr;
 
   if (mContent) {
-    nsAutoString value;
-    PRInt32 nameSpaceID;
-    nsCOMPtr<nsIAtom> name;
-
-    mNodeInfo->GetNameAtom(*getter_AddRefs(name));
-    mNodeInfo->GetNamespaceID(nameSpaceID);
+    nsCOMPtr<nsIAtom> name = mNodeInfo->GetNameAtom();
+    PRInt32 nameSpaceID = mNodeInfo->GetNamespaceID();
   
+    nsAutoString value;
     mContent->GetAttr(nameSpaceID, name, value);
     newAttr = new nsDOMAttribute(nsnull, mNodeInfo, value); 
   }
@@ -436,22 +419,19 @@ nsDOMAttribute::SetPrefix(const nsAString& aPrefix)
   NS_ENSURE_TRUE(mNodeInfo, NS_ERROR_FAILURE);
   nsCOMPtr<nsINodeInfo> newNodeInfo;
   nsCOMPtr<nsIAtom> prefix;
-  nsresult rv = NS_OK;
 
-  if (!aPrefix.IsEmpty() && !DOMStringIsNull(aPrefix))
+  if (!aPrefix.IsEmpty() && !DOMStringIsNull(aPrefix)) {
     prefix = do_GetAtom(aPrefix);
+  }
 
-  rv = mNodeInfo->PrefixChanged(prefix, *getter_AddRefs(newNodeInfo));
+  nsresult rv = mNodeInfo->PrefixChanged(prefix, getter_AddRefs(newNodeInfo));
   NS_ENSURE_SUCCESS(rv, rv);
 
   if (mContent) {
-    nsCOMPtr<nsIAtom> name;
-    PRInt32 nameSpaceID;
+    nsCOMPtr<nsIAtom> name = mNodeInfo->GetNameAtom();
+    PRInt32 nameSpaceID = mNodeInfo->GetNamespaceID();
+
     nsAutoString tmpValue;
-
-    mNodeInfo->GetNameAtom(*getter_AddRefs(name));
-    mNodeInfo->GetNamespaceID(nameSpaceID);
-
     rv = mContent->GetAttr(nameSpaceID, name, tmpValue);
     if (rv == NS_CONTENT_ATTR_HAS_VALUE) {
       mContent->UnsetAttr(nameSpaceID, name, PR_TRUE);
@@ -643,7 +623,7 @@ nsDOMAttribute::IsSameNode(nsIDOMNode* aOther,
       // Check to see if we're in HTML.
       if (content->IsContentOfType(nsIContent::eHTML)) {
         nsCOMPtr<nsINodeInfo> ni;
-        content->GetNodeInfo(*getter_AddRefs(ni));
+        content->GetNodeInfo(getter_AddRefs(ni));
         if (ni) {
           // If there is no namespace, we're in HTML (as opposed to XHTML)
           // and we'll need to compare node names case insensitively.
diff --git a/content/base/src/nsDOMAttribute.h b/content/base/src/nsDOMAttribute.h
index 9f5d0ce0d0e2..0ac8e2926600 100644
--- a/content/base/src/nsDOMAttribute.h
+++ b/content/base/src/nsDOMAttribute.h
@@ -93,7 +93,7 @@ public:
   NS_IMETHOD DropReference();
   NS_IMETHOD SetContent(nsIContent* aContent);
   NS_IMETHOD GetContent(nsIContent** aContent);
-  NS_IMETHOD GetNodeInfo(nsINodeInfo*& aNodeInfo);
+  NS_IMETHOD GetNodeInfo(nsINodeInfo** aNodeInfo);
 
 private:
   nsIContent* mContent;
diff --git a/content/base/src/nsDOMAttributeMap.cpp b/content/base/src/nsDOMAttributeMap.cpp
index 132c85b83a39..204e7582986e 100644
--- a/content/base/src/nsDOMAttributeMap.cpp
+++ b/content/base/src/nsDOMAttributeMap.cpp
@@ -84,19 +84,14 @@ nsDOMAttributeMap::GetNamedItem(const nsAString& aAttrName,
   nsresult rv = NS_OK;
   if (mContent) {
     nsCOMPtr<nsINodeInfo> ni;
-    mContent->NormalizeAttrString(aAttrName, *getter_AddRefs(ni));
+    mContent->NormalizeAttrString(aAttrName, getter_AddRefs(ni));
     NS_ENSURE_TRUE(ni, NS_ERROR_FAILURE);
 
-    PRInt32 nsid;
-    nsCOMPtr<nsIAtom> nameAtom;
-
-    ni->GetNamespaceID(nsid);
-    ni->GetNameAtom(*getter_AddRefs(nameAtom));
-
-    nsresult attrResult;
+    PRInt32 nsid = ni->GetNamespaceID();
+    nsCOMPtr<nsIAtom> nameAtom = ni->GetNameAtom();
 
     nsAutoString value;
-    attrResult = mContent->GetAttr(nsid, nameAtom, value);
+    nsresult attrResult = mContent->GetAttr(nsid, nameAtom, value);
 
     if (NS_CONTENT_ATTR_NOT_THERE != attrResult && NS_SUCCEEDED(attrResult)) {
       nsDOMAttribute* domAttribute;
@@ -137,14 +132,11 @@ nsDOMAttributeMap::SetNamedItem(nsIDOMNode *aNode, nsIDOMNode **aReturn)
     attribute->GetName(name);
 
     nsCOMPtr<nsINodeInfo> ni;
-    mContent->NormalizeAttrString(name, *getter_AddRefs(ni));
+    mContent->NormalizeAttrString(name, getter_AddRefs(ni));
     NS_ENSURE_TRUE(ni, NS_ERROR_FAILURE);
 
-    nsCOMPtr<nsIAtom> nameAtom;
-    PRInt32 nsid;
-
-    ni->GetNamespaceID(nsid);
-    ni->GetNameAtom(*getter_AddRefs(nameAtom));
+    PRInt32 nsid = ni->GetNamespaceID();
+    nsCOMPtr<nsIAtom> nameAtom = ni->GetNameAtom();
 
     nsresult attrResult = mContent->GetAttr(nsid, nameAtom, value);
 
@@ -179,14 +171,11 @@ nsDOMAttributeMap::RemoveNamedItem(const nsAString& aName,
 
   if (mContent) {
     nsCOMPtr<nsINodeInfo> ni;
-    mContent->NormalizeAttrString(aName, *getter_AddRefs(ni));
+    mContent->NormalizeAttrString(aName, getter_AddRefs(ni));
     NS_ENSURE_TRUE(ni, NS_ERROR_FAILURE);
 
-    nsCOMPtr<nsIAtom> nameAtom;
-    PRInt32 nsid;
-
-    ni->GetNamespaceID(nsid);
-    ni->GetNameAtom(*getter_AddRefs(nameAtom));
+    PRInt32 nsid = ni->GetNamespaceID();
+    nsCOMPtr<nsIAtom> nameAtom = ni->GetNameAtom();
 
     nsCOMPtr<nsIDOMNode> attribute;
 
@@ -223,21 +212,21 @@ nsDOMAttributeMap::Item(PRUint32 aIndex, nsIDOMNode** aReturn)
   nsresult rv = NS_OK;
   if (mContent &&
       NS_SUCCEEDED(mContent->GetAttrNameAt(aIndex,
-                                           nameSpaceID,
-                                           *getter_AddRefs(nameAtom),
-                                           *getter_AddRefs(prefix)))) {
+                                           &nameSpaceID,
+                                           getter_AddRefs(nameAtom),
+                                           getter_AddRefs(prefix)))) {
     nsAutoString value, name;
     mContent->GetAttr(nameSpaceID, nameAtom, value);
 
     nsCOMPtr<nsINodeInfo> ni;
-    mContent->GetNodeInfo(*getter_AddRefs(ni));
+    mContent->GetNodeInfo(getter_AddRefs(ni));
     NS_ENSURE_TRUE(ni, NS_ERROR_FAILURE);
 
     nsCOMPtr<nsINodeInfoManager> nimgr;
-    ni->GetNodeInfoManager(*getter_AddRefs(nimgr));
+    ni->GetNodeInfoManager(getter_AddRefs(nimgr));
     NS_ENSURE_TRUE(nimgr, NS_ERROR_FAILURE);
 
-    nimgr->GetNodeInfo(nameAtom, prefix, nameSpaceID, *getter_AddRefs(ni));
+    nimgr->GetNodeInfo(nameAtom, prefix, nameSpaceID, getter_AddRefs(ni));
     NS_ENSURE_TRUE(ni, NS_ERROR_FAILURE);
 
     nsDOMAttribute* domAttribute = new nsDOMAttribute(mContent, ni, value);
@@ -284,16 +273,16 @@ nsDOMAttributeMap::GetNamedItemNS(const nsAString& aNamespaceURI,
     nsCOMPtr<nsIAtom> prefix;
 
     nsCOMPtr<nsINodeInfo> ni;
-    mContent->GetNodeInfo(*getter_AddRefs(ni));
+    mContent->GetNodeInfo(getter_AddRefs(ni));
     NS_ENSURE_TRUE(ni, NS_ERROR_FAILURE);
 
     nsCOMPtr<nsINodeInfoManager> nimgr;
-    ni->GetNodeInfoManager(*getter_AddRefs(nimgr));
+    ni->GetNodeInfoManager(getter_AddRefs(nimgr));
     NS_ENSURE_TRUE(nimgr, NS_ERROR_FAILURE);
 
     if (aNamespaceURI.Length()) {
       nsContentUtils::GetNSManagerWeakRef()->GetNameSpaceID(aNamespaceURI,
-                                                            nameSpaceID);
+                                                            &nameSpaceID);
 
       if (nameSpaceID == kNameSpaceID_Unknown)
         return NS_OK;
@@ -303,10 +292,10 @@ nsDOMAttributeMap::GetNamedItemNS(const nsAString& aNamespaceURI,
     nsAutoString value;
 
     attrResult = mContent->GetAttr(nameSpaceID, nameAtom,
-                                   *getter_AddRefs(prefix), value);
+                                   getter_AddRefs(prefix), value);
 
     if (NS_CONTENT_ATTR_NOT_THERE != attrResult && NS_SUCCEEDED(attrResult)) {
-      nimgr->GetNodeInfo(nameAtom, prefix, nameSpaceID, *getter_AddRefs(ni));
+      nimgr->GetNodeInfo(nameAtom, prefix, nameSpaceID, getter_AddRefs(ni));
       NS_ENSURE_TRUE(ni, NS_ERROR_FAILURE);
 
       nsDOMAttribute* domAttribute;
@@ -339,26 +328,24 @@ nsDOMAttributeMap::SetNamedItemNS(nsIDOMNode* aArg, nsIDOMNode** aReturn)
     }
 
     nsAutoString name, nsURI, value;
-    nsCOMPtr<nsIAtom> nameAtom;
-    PRInt32 nameSpaceID;
 
     attribute->GetName(name);
     attribute->GetPrefix(name);
     attribute->GetNamespaceURI(nsURI);
 
     nsCOMPtr<nsINodeInfo> ni;
-    mContent->GetNodeInfo(*getter_AddRefs(ni));
+    mContent->GetNodeInfo(getter_AddRefs(ni));
     NS_ENSURE_TRUE(ni, NS_ERROR_FAILURE);
 
     nsCOMPtr<nsINodeInfoManager> nimgr;
-    ni->GetNodeInfoManager(*getter_AddRefs(nimgr));
+    ni->GetNodeInfoManager(getter_AddRefs(nimgr));
     NS_ENSURE_TRUE(nimgr, NS_ERROR_FAILURE);
 
-    nimgr->GetNodeInfo(name, nsURI, *getter_AddRefs(ni));
+    nimgr->GetNodeInfo(name, nsURI, getter_AddRefs(ni));
     NS_ENSURE_TRUE(ni, NS_ERROR_FAILURE);
 
-    ni->GetNameAtom(*getter_AddRefs(nameAtom));
-    ni->GetNamespaceID(nameSpaceID);
+    PRInt32 nameSpaceID = ni->GetNamespaceID();
+    nsCOMPtr<nsIAtom> nameAtom = ni->GetNameAtom();
 
     nsresult attrResult = mContent->GetAttr(nameSpaceID, nameAtom, value);
 
@@ -399,16 +386,16 @@ nsDOMAttributeMap::RemoveNamedItemNS(const nsAString& aNamespaceURI,
     nsCOMPtr<nsIAtom> prefix;
 
     nsCOMPtr<nsINodeInfo> ni;
-    mContent->GetNodeInfo(*getter_AddRefs(ni));
+    mContent->GetNodeInfo(getter_AddRefs(ni));
     NS_ENSURE_TRUE(ni, NS_ERROR_FAILURE);
 
     nsCOMPtr<nsINodeInfoManager> nimgr;
-    ni->GetNodeInfoManager(*getter_AddRefs(nimgr));
+    ni->GetNodeInfoManager(getter_AddRefs(nimgr));
     NS_ENSURE_TRUE(nimgr, NS_ERROR_FAILURE);
 
     if (aNamespaceURI.Length()) {
       nsContentUtils::GetNSManagerWeakRef()->GetNameSpaceID(aNamespaceURI,
-                                                            nameSpaceID);
+                                                            &nameSpaceID);
 
       if (nameSpaceID == kNameSpaceID_Unknown)
         return NS_ERROR_DOM_NOT_FOUND_ERR;
@@ -417,10 +404,10 @@ nsDOMAttributeMap::RemoveNamedItemNS(const nsAString& aNamespaceURI,
     nsresult attrResult;
     nsAutoString value;
     attrResult = mContent->GetAttr(nameSpaceID, nameAtom,
-                                   *getter_AddRefs(prefix), value);
+                                   getter_AddRefs(prefix), value);
 
     if (NS_CONTENT_ATTR_NOT_THERE != attrResult && NS_SUCCEEDED(attrResult)) {
-      nimgr->GetNodeInfo(nameAtom, prefix, nameSpaceID, *getter_AddRefs(ni));
+      nimgr->GetNodeInfo(nameAtom, prefix, nameSpaceID, getter_AddRefs(ni));
       NS_ENSURE_TRUE(ni, NS_ERROR_FAILURE);
 
       nsDOMAttribute* domAttribute;
diff --git a/content/base/src/nsDOMDocumentType.cpp b/content/base/src/nsDOMDocumentType.cpp
index e6cbc0e1d28a..0ff1cf038978 100644
--- a/content/base/src/nsDOMDocumentType.cpp
+++ b/content/base/src/nsDOMDocumentType.cpp
@@ -165,9 +165,9 @@ nsDOMDocumentType::GetInternalSubset(nsAString& aInternalSubset)
 }
 
 NS_IMETHODIMP 
-nsDOMDocumentType::GetTag(nsIAtom*& aResult) const
+nsDOMDocumentType::GetTag(nsIAtom** aResult) const
 {
-  aResult = NS_NewAtom(mName.get());
+  *aResult = NS_NewAtom(mName.get());
 
   return NS_OK;
 }
diff --git a/content/base/src/nsDOMDocumentType.h b/content/base/src/nsDOMDocumentType.h
index 672f21b7174a..f85625ce4a08 100644
--- a/content/base/src/nsDOMDocumentType.h
+++ b/content/base/src/nsDOMDocumentType.h
@@ -72,7 +72,7 @@ public:
   NS_DECL_NSIDOMDOCUMENTTYPE
 
   // nsIContent
-  NS_IMETHOD GetTag(nsIAtom*& aResult) const;
+  NS_IMETHOD GetTag(nsIAtom** aResult) const;
 
 protected:
   nsString mName;
diff --git a/content/base/src/nsDocument.cpp b/content/base/src/nsDocument.cpp
index 6bbbbef2e346..cc6079c9e89c 100644
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -430,7 +430,7 @@ nsDocumentChildNodes::Item(PRUint32 aIndex, nsIDOMNode** aReturn)
 
   if (mDocument) {
     nsCOMPtr<nsIContent> content;
-    mDocument->ChildAt(aIndex, *getter_AddRefs(content));
+    mDocument->ChildAt(aIndex, getter_AddRefs(content));
     if (content) {
       return CallQueryInterface(content, aReturn);
     }
@@ -534,7 +534,7 @@ nsDocument::~nsDocument()
   if (mRootContent) {
     nsCOMPtr<nsIDocument> doc;
 
-    mRootContent->GetDocument(*getter_AddRefs(doc));
+    mRootContent->GetDocument(getter_AddRefs(doc));
 
     if (doc) {
       // The root content still has a pointer back to the document,
@@ -904,15 +904,15 @@ nsDocument::GetDocumentLoadGroup(nsILoadGroup **aGroup) const
 }
 
 NS_IMETHODIMP
-nsDocument::GetBaseURL(nsIURI*& aURL) const
+nsDocument::GetBaseURL(nsIURI** aURL) const
 {
-  aURL = mDocumentBaseURL;
+  *aURL = mDocumentBaseURL;
 
-  if (!aURL) {
-    aURL = mDocumentURL;
+  if (!*aURL) {
+    *aURL = mDocumentURL;
   }
 
-  NS_IF_ADDREF(aURL);
+  NS_IF_ADDREF(*aURL);
 
   return NS_OK;
 }
@@ -1409,13 +1409,13 @@ nsDocument::SetRootContent(nsIContent* aRoot)
 }
 
 NS_IMETHODIMP
-nsDocument::ChildAt(PRInt32 aIndex, nsIContent*& aResult) const
+nsDocument::ChildAt(PRInt32 aIndex, nsIContent** aResult) const
 {
   NS_PRECONDITION(aIndex >= 0, "Negative indices are bad");
   if (aIndex < 0 || aIndex >= mChildren.Count()) {
-    aResult = nsnull;
+    *aResult = nsnull;
   } else {
-    NS_IF_ADDREF(aResult = mChildren[aIndex]);
+    NS_IF_ADDREF(*aResult = mChildren[aIndex]);
   }
   return NS_OK;
 }
@@ -2416,7 +2416,7 @@ nsDocument::CreateAttribute(const nsAString& aName,
 
   nsCOMPtr<nsINodeInfo> nodeInfo;
   nsresult rv = mNodeInfoManager->GetNodeInfo(aName, nsnull, kNameSpaceID_None,
-                                              *getter_AddRefs(nodeInfo));
+                                              getter_AddRefs(nodeInfo));
   NS_ENSURE_SUCCESS(rv, rv);
 
   attribute = new nsDOMAttribute(nsnull, nodeInfo, value);
@@ -2435,7 +2435,7 @@ nsDocument::CreateAttributeNS(const nsAString & aNamespaceURI,
 
   nsCOMPtr<nsINodeInfo> nodeInfo;
   nsresult rv = mNodeInfoManager->GetNodeInfo(aQualifiedName, aNamespaceURI,
-                                              *getter_AddRefs(nodeInfo));
+                                              getter_AddRefs(nodeInfo));
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsAutoString value;
@@ -2479,7 +2479,7 @@ nsDocument::GetElementsByTagNameNS(const nsAString& aNamespaceURI,
 
   if (!aNamespaceURI.Equals(NS_LITERAL_STRING("*"))) {
     nsContentUtils::GetNSManagerWeakRef()->GetNameSpaceID(aNamespaceURI,
-                                                          nameSpaceId);
+                                                          &nameSpaceId);
 
     if (nameSpaceId == kNameSpaceID_Unknown) {
       // Unknown namespace means no matches, we create an empty list...
@@ -2670,7 +2670,7 @@ GetElementByAttribute(nsIContent* aContent, nsIAtom* aAttrName,
 
   for (PRInt32 i = 0; i < childCount; ++i) {
     nsCOMPtr<nsIContent> current;
-    aContent->ChildAt(i, *getter_AddRefs(current));
+    aContent->ChildAt(i, getter_AddRefs(current));
 
     GetElementByAttribute(current, aAttrName, aAttrValue, aUniversalMatch,
                           aResult);
@@ -3459,7 +3459,7 @@ nsDocument::CompareDocumentPosition(nsIDOMNode* aOther, PRUint16* aReturn)
   }
 
   nsCOMPtr<nsIDocument> otherDoc;
-  otherContent->GetDocument(*getter_AddRefs(otherDoc));
+  otherContent->GetDocument(getter_AddRefs(otherDoc));
   if (this == otherDoc) {
     // If the node being compared is contained by our node,
     // then it follows it.
@@ -3864,12 +3864,11 @@ nsDocument::GetBindingManager(nsIBindingManager** aResult)
 
 
 NS_IMETHODIMP
-nsDocument::GetNodeInfoManager(nsINodeInfoManager*& aNodeInfoManager)
+nsDocument::GetNodeInfoManager(nsINodeInfoManager** aNodeInfoManager)
 {
   NS_ENSURE_TRUE(mNodeInfoManager, NS_ERROR_NOT_INITIALIZED);
 
-  aNodeInfoManager = mNodeInfoManager;
-  NS_ADDREF(aNodeInfoManager);
+  NS_ADDREF(*aNodeInfoManager = mNodeInfoManager);
 
   return NS_OK;
 }
diff --git a/content/base/src/nsDocument.h b/content/base/src/nsDocument.h
index 55df5289f542..5b952846416b 100644
--- a/content/base/src/nsDocument.h
+++ b/content/base/src/nsDocument.h
@@ -300,7 +300,7 @@ public:
   /**
    * Return the base URL for relative URLs in the document. May return null (or the document URL).
    */
-  NS_IMETHOD GetBaseURL(nsIURI*& aURL) const;
+  NS_IMETHOD GetBaseURL(nsIURI** aURL) const;
   NS_IMETHOD SetBaseURL(nsIURI* aURL);
 
   /**
@@ -391,7 +391,7 @@ public:
    * Get the direct children of the document - content in
    * the prolog, the root content and content in the epilog.
    */
-  NS_IMETHOD ChildAt(PRInt32 aIndex, nsIContent*& aResult) const;
+  NS_IMETHOD ChildAt(PRInt32 aIndex, nsIContent** aResult) const;
   NS_IMETHOD IndexOf(nsIContent* aPossibleChild, PRInt32& aIndex) const;
   NS_IMETHOD GetChildCount(PRInt32& aCount);
 
@@ -487,7 +487,7 @@ public:
                                        PRBool aUpdateViews = PR_FALSE);
   NS_IMETHOD GetAndIncrementContentID(PRInt32* aID);
   NS_IMETHOD GetBindingManager(nsIBindingManager** aResult);
-  NS_IMETHOD GetNodeInfoManager(nsINodeInfoManager*& aNodeInfoManager);
+  NS_IMETHOD GetNodeInfoManager(nsINodeInfoManager** aNodeInfoManager);
   NS_IMETHOD AddReference(void *aKey, nsISupports *aReference);
   NS_IMETHOD RemoveReference(void *aKey, nsISupports **aOldReference);
   NS_IMETHOD SetContainer(nsISupports *aContainer);
diff --git a/content/base/src/nsDocumentEncoder.cpp b/content/base/src/nsDocumentEncoder.cpp
index ac5805635a3c..286e0b414793 100644
--- a/content/base/src/nsDocumentEncoder.cpp
+++ b/content/base/src/nsDocumentEncoder.cpp
@@ -424,7 +424,7 @@ nsDocumentEncoder::IsTag(nsIDOMNode* aNode, nsIAtom* aAtom)
     nsCOMPtr<nsIAtom> atom;
     nsCOMPtr<nsIContent> content = do_QueryInterface(aNode);
     if (content)
-      content->GetTag(*getter_AddRefs(atom));
+      content->GetTag(getter_AddRefs(atom));
     if (atom)
     {
       if (atom.get() == aAtom)
@@ -532,7 +532,7 @@ static nsresult ChildAt(nsIDOMNode* aNode, PRInt32 aIndex, nsIDOMNode*& aChild)
 
   NS_ENSURE_TRUE(node, NS_ERROR_FAILURE);
 
-  node->ChildAt(aIndex, *getter_AddRefs(child));
+  node->ChildAt(aIndex, getter_AddRefs(child));
 
   if (child)
     return CallQueryInterface(child, &aChild);
@@ -767,7 +767,7 @@ nsDocumentEncoder::SerializeRangeNodes(nsIDOMRange* aRange,
       // serialize the children of this node that are in the range
       for (j=startOffset; j<endOffset; j++)
       {
-        rv = content->ChildAt(j, *getter_AddRefs(child));
+        rv = content->ChildAt(j, getter_AddRefs(child));
         childAsNode = do_QueryInterface(child);
         NS_ENSURE_SUCCESS(rv, rv);
         if ((j==startOffset) || (j==endOffset-1))
@@ -1153,7 +1153,7 @@ nsHTMLCopyEncoder::SetSelection(nsISelection* aSelection)
   {
     // checking for selection inside a plaintext form widget
     nsCOMPtr<nsIAtom> atom;
-    selContent->GetTag(*getter_AddRefs(atom));
+    selContent->GetTag(getter_AddRefs(atom));
     if (atom.get() == nsHTMLAtoms::input ||
         atom.get() == nsHTMLAtoms::textarea)
     {
@@ -1174,7 +1174,7 @@ nsHTMLCopyEncoder::SetSelection(nsISelection* aSelection)
         break;
       }
     }
-    selContent->GetParent(*getter_AddRefs(tmp));
+    selContent->GetParent(getter_AddRefs(tmp));
     selContent = tmp;
   }
   
@@ -1303,7 +1303,7 @@ nsHTMLCopyEncoder::IncludeInContext(nsIDOMNode *aNode)
 
   nsCOMPtr<nsIAtom> tag;
 
-  content->GetTag(*getter_AddRefs(tag));
+  content->GetTag(getter_AddRefs(tag));
 
   if (tag.get() == nsHTMLAtoms::b        ||
       tag.get() == nsHTMLAtoms::i        ||
@@ -1498,7 +1498,7 @@ nsHTMLCopyEncoder::GetPromotedPoint(Endpoint aWhere, nsIDOMNode *aNode, PRInt32
           {
             PRBool isBlock = PR_FALSE;
             PRInt32 id;
-            content->GetTag(*getter_AddRefs(atom));
+            content->GetTag(getter_AddRefs(atom));
             atom->ToString(tag);
             parserService->HTMLStringTagToId(tag, &id);
             parserService->IsBlock(id, isBlock);
@@ -1587,7 +1587,7 @@ nsHTMLCopyEncoder::GetPromotedPoint(Endpoint aWhere, nsIDOMNode *aNode, PRInt32
           {
             PRBool isBlock = PR_FALSE;
             PRInt32 id;
-            content->GetTag(*getter_AddRefs(atom));
+            content->GetTag(getter_AddRefs(atom));
             atom->ToString(tag);
             parserService->HTMLStringTagToId(tag, &id);
             parserService->IsBlock(id, isBlock);
@@ -1639,7 +1639,7 @@ nsHTMLCopyEncoder::GetChildAt(nsIDOMNode *aParent, PRInt32 aOffset)
   nsCOMPtr<nsIContent> cChild;
   NS_PRECONDITION(content, "null content in nsHTMLCopyEncoder::GetChildAt");
   
-  if (NS_FAILED(content->ChildAt(aOffset, *getter_AddRefs(cChild))))
+  if (NS_FAILED(content->ChildAt(aOffset, getter_AddRefs(cChild))))
     return resultNode;
   
   resultNode = do_QueryInterface(cChild);
diff --git a/content/base/src/nsDocumentFragment.cpp b/content/base/src/nsDocumentFragment.cpp
index e749c032a437..812ddf1f3d24 100644
--- a/content/base/src/nsDocumentFragment.cpp
+++ b/content/base/src/nsDocumentFragment.cpp
@@ -152,18 +152,19 @@ public:
                      nsAString& aResult) const
     { return NS_CONTENT_ATTR_NOT_THERE; }
   NS_IMETHOD GetAttr(PRInt32 aNameSpaceID, nsIAtom* aName, 
-                     nsIAtom*& aPrefix, nsAString& aResult) const
+                     nsIAtom** aPrefix, nsAString& aResult) const
     { return NS_CONTENT_ATTR_NOT_THERE; }
   NS_IMETHOD UnsetAttr(PRInt32 aNameSpaceID, nsIAtom* aAttribute, 
                        PRBool aNotify)
     { return NS_OK; }
   NS_IMETHOD GetAttrNameAt(PRInt32 aIndex,
-                           PRInt32& aNameSpaceID, 
-                           nsIAtom*& aName,
-                           nsIAtom*& aPrefix) const
+                           PRInt32* aNameSpaceID,
+                           nsIAtom** aName,
+                           nsIAtom** aPrefix) const
     {
-      aName = nsnull;
-      aPrefix = nsnull;
+      *aNameSpaceID = kNameSpaceID_None;
+      *aName = nsnull;
+      *aPrefix = nsnull;
       return NS_ERROR_ILLEGAL_VALUE;
     }
   NS_IMETHOD HandleDOMEvent(nsIPresContext* aPresContext,
@@ -193,15 +194,15 @@ NS_NewDocumentFragment(nsIDOMDocumentFragment** aInstancePtrResult,
   nsresult rv;
 
   if (aOwnerDocument) {
-    rv = aOwnerDocument->GetNodeInfoManager(*getter_AddRefs(nimgr));
+    rv = aOwnerDocument->GetNodeInfoManager(getter_AddRefs(nimgr));
   } else {
-    rv = nsNodeInfoManager::GetAnonymousManager(*getter_AddRefs(nimgr));
+    rv = nsNodeInfoManager::GetAnonymousManager(getter_AddRefs(nimgr));
   }
   NS_ENSURE_SUCCESS(rv, rv);
 
   rv = nimgr->GetNodeInfo(NS_LITERAL_STRING("#document-fragment"),
                           nsnull, kNameSpaceID_None,
-                          *getter_AddRefs(nodeInfo));
+                          getter_AddRefs(nodeInfo));
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsDocumentFragment* it = new nsDocumentFragment(aOwnerDocument);
@@ -258,7 +259,7 @@ nsDocumentFragment::DisconnectChildren()
   ChildCount(count);
 
   for (i = 0; i < count; i++) {
-    ChildAt(i, *getter_AddRefs(child));
+    ChildAt(i, getter_AddRefs(child));
     NS_ASSERTION(child, "Bad content container");
 
     child->SetParent(nsnull);
@@ -276,10 +277,10 @@ nsDocumentFragment::ReconnectChildren()
   ChildCount(count);
 
   for (i = 0; i < count; i++) {
-    ChildAt(i, *getter_AddRefs(child));
+    ChildAt(i, getter_AddRefs(child));
     NS_ASSERTION(child, "Bad content container");
 
-    child->GetParent(*getter_AddRefs(parent));
+    child->GetParent(getter_AddRefs(parent));
 
     if (parent) {
       PRInt32 indx = -1;
diff --git a/content/base/src/nsDocumentViewer.cpp b/content/base/src/nsDocumentViewer.cpp
index bccdc9d4b3da..4c96da25dda2 100644
--- a/content/base/src/nsDocumentViewer.cpp
+++ b/content/base/src/nsDocumentViewer.cpp
@@ -339,11 +339,11 @@ public:
 
   // nsIDocumentViewer interface...
   NS_IMETHOD SetUAStyleSheet(nsIStyleSheet* aUAStyleSheet);
-  NS_IMETHOD GetDocument(nsIDocument*& aResult);
-  NS_IMETHOD GetPresShell(nsIPresShell*& aResult);
-  NS_IMETHOD GetPresContext(nsIPresContext*& aResult);
+  NS_IMETHOD GetDocument(nsIDocument** aResult);
+  NS_IMETHOD GetPresShell(nsIPresShell** aResult);
+  NS_IMETHOD GetPresContext(nsIPresContext** aResult);
   NS_IMETHOD CreateDocumentViewerUsing(nsIPresContext* aPresContext,
-                                       nsIDocumentViewer*& aResult);
+                                       nsIDocumentViewer** aResult);
 
   // nsIContentViewerEdit
   NS_DECL_NSICONTENTVIEWEREDIT
@@ -1252,26 +1252,26 @@ DocumentViewerImpl::SetUAStyleSheet(nsIStyleSheet* aUAStyleSheet)
 }
 
 NS_IMETHODIMP
-DocumentViewerImpl::GetDocument(nsIDocument*& aResult)
+DocumentViewerImpl::GetDocument(nsIDocument** aResult)
 {
-  aResult = mDocument;
-  NS_IF_ADDREF(aResult);
+  NS_IF_ADDREF(*aResult = mDocument);
+
   return NS_OK;
 }
 
 NS_IMETHODIMP
-DocumentViewerImpl::GetPresShell(nsIPresShell*& aResult)
+DocumentViewerImpl::GetPresShell(nsIPresShell** aResult)
 {
-  aResult = mPresShell;
-  NS_IF_ADDREF(aResult);
+  NS_IF_ADDREF(*aResult = mPresShell);
+
   return NS_OK;
 }
 
 NS_IMETHODIMP
-DocumentViewerImpl::GetPresContext(nsIPresContext*& aResult)
+DocumentViewerImpl::GetPresContext(nsIPresContext** aResult)
 {
-  aResult = mPresContext;
-  NS_IF_ADDREF(aResult);
+  NS_IF_ADDREF(*aResult = mPresContext);
+
   return NS_OK;
 }
 
@@ -1729,7 +1729,7 @@ DocumentViewerImpl::FindFrameSetWithIID(nsIContent * aParentContent,
   PRInt32 inx;
   for (inx = 0; inx < numChildren; ++inx) {
     nsCOMPtr<nsIContent> child;
-    if (NS_SUCCEEDED(aParentContent->ChildAt(inx, *getter_AddRefs(child))) && child) {
+    if (NS_SUCCEEDED(aParentContent->ChildAt(inx, getter_AddRefs(child))) && child) {
       nsCOMPtr<nsISupports> temp;
       if (NS_SUCCEEDED(child->QueryInterface(aIID, (void**)getter_AddRefs(temp)))) {
         return NS_OK;
@@ -1915,7 +1915,7 @@ nsresult DocumentViewerImpl::GetDocumentSelection(nsISelection **aSelection,
 
 NS_IMETHODIMP
 DocumentViewerImpl::CreateDocumentViewerUsing(nsIPresContext* aPresContext,
-                                              nsIDocumentViewer*& aResult)
+                                              nsIDocumentViewer** aResult)
 {
   if (!mDocument) {
     // XXX better error
@@ -1939,7 +1939,7 @@ DocumentViewerImpl::CreateDocumentViewerUsing(nsIPresContext* aPresContext,
   // Bind the new viewer to the old document
   nsresult rv = viewer->LoadStart(mDocument);
 
-  aResult = viewer;
+  *aResult = viewer;
 
   return rv;
 }
@@ -2207,7 +2207,7 @@ NS_IMETHODIMP DocumentViewerImpl::ScrollToNode(nsIDOMNode* aNode)
    NS_ENSURE_ARG(aNode);
    NS_ENSURE_TRUE(mDocument, NS_ERROR_NOT_AVAILABLE);
    nsCOMPtr<nsIPresShell> presShell;
-   NS_ENSURE_SUCCESS(GetPresShell(*(getter_AddRefs(presShell))), NS_ERROR_FAILURE);
+   NS_ENSURE_SUCCESS(GetPresShell(getter_AddRefs(presShell)), NS_ERROR_FAILURE);
 
    // Get the nsIContent interface, because that's what we need to
    // get the primary frame
@@ -2673,14 +2673,14 @@ NS_IMETHODIMP DocumentViewerImpl::SizeToContent()
    NS_ENSURE_TRUE(!docShellParent, NS_ERROR_FAILURE);
 
    nsCOMPtr<nsIPresShell> presShell;
-   GetPresShell(*getter_AddRefs(presShell));
+   GetPresShell(getter_AddRefs(presShell));
    NS_ENSURE_TRUE(presShell, NS_ERROR_FAILURE);
 
    NS_ENSURE_SUCCESS(presShell->ResizeReflow(NS_UNCONSTRAINEDSIZE,
       NS_UNCONSTRAINEDSIZE), NS_ERROR_FAILURE);
 
    nsCOMPtr<nsIPresContext> presContext;
-   GetPresContext(*getter_AddRefs(presContext));
+   GetPresContext(getter_AddRefs(presContext));
    NS_ENSURE_TRUE(presContext, NS_ERROR_FAILURE);
 
    nsRect  shellArea;
@@ -2744,7 +2744,7 @@ DocumentViewerImpl::GetPopupNode(nsIDOMNode** aNode)
 
   // get the document
   nsCOMPtr<nsIDocument> document;
-  rv = GetDocument(*getter_AddRefs(document));
+  rv = GetDocument(getter_AddRefs(document));
   NS_ENSURE_SUCCESS(rv, rv);
   NS_ENSURE_TRUE(document, NS_ERROR_FAILURE);
 
@@ -2939,7 +2939,7 @@ NS_IMETHODIMP nsDocViewerSelectionListener::NotifySelectionChanged(nsIDOMDocumen
   if (!mGotSelectionState || mSelectionWasCollapsed != selectionCollapsed)
   {
     nsCOMPtr<nsIDocument> theDoc;
-    mDocViewer->GetDocument(*getter_AddRefs(theDoc));
+    mDocViewer->GetDocument(getter_AddRefs(theDoc));
     if (!theDoc) return NS_ERROR_FAILURE;
 
     nsCOMPtr<nsIScriptGlobalObject> scriptGlobalObject;
@@ -2979,7 +2979,7 @@ nsDocViewerFocusListener::Focus(nsIDOMEvent* aEvent)
   if(!mDocViewer)
     return NS_ERROR_FAILURE;
 
-  nsresult result = mDocViewer->GetPresShell(*getter_AddRefs(shell));//deref once cause it take a ptr ref
+  nsresult result = mDocViewer->GetPresShell(getter_AddRefs(shell));
   if(NS_FAILED(result) || !shell)
     return result?result:NS_ERROR_FAILURE;
   nsCOMPtr<nsISelectionController> selCon;
@@ -3005,7 +3005,7 @@ nsDocViewerFocusListener::Blur(nsIDOMEvent* aEvent)
   if(!mDocViewer)
     return NS_ERROR_FAILURE;
 
-  nsresult result = mDocViewer->GetPresShell(*getter_AddRefs(shell));//deref once cause it take a ptr ref
+  nsresult result = mDocViewer->GetPresShell(getter_AddRefs(shell));
   if(NS_FAILED(result) || !shell)
     return result?result:NS_ERROR_FAILURE;
   nsCOMPtr<nsISelectionController> selCon;
diff --git a/content/base/src/nsFrameLoader.cpp b/content/base/src/nsFrameLoader.cpp
index 87d68540bb13..20583eb6cbd7 100644
--- a/content/base/src/nsFrameLoader.cpp
+++ b/content/base/src/nsFrameLoader.cpp
@@ -146,7 +146,7 @@ nsFrameLoader::LoadFrame()
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCOMPtr<nsIDocument> doc;
-  mOwnerContent->GetDocument(*getter_AddRefs(doc));
+  mOwnerContent->GetDocument(getter_AddRefs(doc));
   if (!doc) {
     return NS_OK;
   }
@@ -162,7 +162,7 @@ nsFrameLoader::LoadFrame()
 
   // Make an absolute URI
   nsCOMPtr<nsIURI> base_uri;
-  doc->GetBaseURL(*getter_AddRefs(base_uri));
+  doc->GetBaseURL(getter_AddRefs(base_uri));
 
   nsAutoString doc_charset;
   doc->GetDocumentCharacterSet(doc_charset);
@@ -254,7 +254,7 @@ nsFrameLoader::Destroy()
   if (mOwnerContent) {
     nsCOMPtr<nsIDocument> doc;
 
-    mOwnerContent->GetDocument(*getter_AddRefs(doc));
+    mOwnerContent->GetDocument(getter_AddRefs(doc));
 
     if (doc) {
       doc->SetSubDocumentFor(mOwnerContent, nsnull);
@@ -302,7 +302,7 @@ nsFrameLoader::GetPresContext(nsIPresContext **aPresContext)
   *aPresContext = nsnull;
 
   nsCOMPtr<nsIDocument> doc;
-  mOwnerContent->GetDocument(*getter_AddRefs(doc));
+  mOwnerContent->GetDocument(getter_AddRefs(doc));
 
   while (doc) {
     nsCOMPtr<nsIPresShell> presShell;
@@ -511,7 +511,7 @@ nsFrameLoader::GetURL(nsAString& aURI)
   aURI.Truncate();
 
   nsCOMPtr<nsIAtom> type;
-  mOwnerContent->GetTag(*getter_AddRefs(type));
+  mOwnerContent->GetTag(getter_AddRefs(type));
 
   if (type == nsHTMLAtoms::object) {
     mOwnerContent->GetAttr(kNameSpaceID_None, nsHTMLAtoms::data, aURI);
diff --git a/content/base/src/nsGeneratedIterator.cpp b/content/base/src/nsGeneratedIterator.cpp
index bdf0eab44f4a..06071eeab09d 100644
--- a/content/base/src/nsGeneratedIterator.cpp
+++ b/content/base/src/nsGeneratedIterator.cpp
@@ -338,7 +338,7 @@ nsresult nsGeneratedContentIterator::Init(nsIDOMRange* aRange)
   // short circuit when start node == end node
   if (startDOM == endDOM)
   {
-    startCon->ChildAt(0,*getter_AddRefs(cChild));
+    startCon->ChildAt(0, getter_AddRefs(cChild));
   
     if (!cChild) // no children, must be a text node or empty container
     {
@@ -358,7 +358,7 @@ nsresult nsGeneratedContentIterator::Init(nsIDOMRange* aRange)
   }
   
   // find first node in range
-  startCon->ChildAt(0,*getter_AddRefs(cChild));
+  startCon->ChildAt(0, getter_AddRefs(cChild));
   
   if (!cChild) // no children, must be a text node
   {
@@ -366,7 +366,7 @@ nsresult nsGeneratedContentIterator::Init(nsIDOMRange* aRange)
   }
   else
   {
-    startCon->ChildAt(startIndx,*getter_AddRefs(cChild));
+    startCon->ChildAt(startIndx, getter_AddRefs(cChild));
     if (!cChild)  // offset after last child, parent is first node
     {
       mFirst = startCon;
@@ -394,7 +394,7 @@ nsresult nsGeneratedContentIterator::Init(nsIDOMRange* aRange)
   }
   
   // find last node in range
-  endCon->ChildAt(0,*getter_AddRefs(cChild));
+  endCon->ChildAt(0, getter_AddRefs(cChild));
 
   if (!cChild) // no children, must be a text node
   {
@@ -406,11 +406,11 @@ nsresult nsGeneratedContentIterator::Init(nsIDOMRange* aRange)
   }
   else
   {
-    endCon->ChildAt(--endIndx,*getter_AddRefs(cChild));
+    endCon->ChildAt(--endIndx, getter_AddRefs(cChild));
     if (!cChild)  // offset after last child, last child is last node
     {
       endCon->ChildCount(endIndx);
-      endCon->ChildAt(--endIndx,*getter_AddRefs(cChild)); 
+      endCon->ChildAt(--endIndx, getter_AddRefs(cChild));
       if (!cChild)
       {
         NS_NOTREACHED("nsGeneratedContentIterator::nsGeneratedContentIterator");
@@ -463,7 +463,7 @@ nsCOMPtr<nsIContent> nsGeneratedContentIterator::GetDeepFirstChild(nsCOMPtr<nsIC
       return cN;
     }
 #endif
-    cN->ChildAt(0,*getter_AddRefs(cChild));
+    cN->ChildAt(0, getter_AddRefs(cChild));
     while ( cChild )
     {
       cN = cChild;
@@ -480,7 +480,7 @@ nsCOMPtr<nsIContent> nsGeneratedContentIterator::GetDeepFirstChild(nsCOMPtr<nsIC
       }
 #endif
 
-      cN->ChildAt(0,*getter_AddRefs(cChild));
+      cN->ChildAt(0, getter_AddRefs(cChild));
     }
     deepFirstChild = cN;
   }
@@ -515,7 +515,7 @@ nsCOMPtr<nsIContent> nsGeneratedContentIterator::GetDeepLastChild(nsCOMPtr<nsICo
 
     while ( numChildren )
     {
-      cN->ChildAt(--numChildren,*getter_AddRefs(cChild));
+      cN->ChildAt(--numChildren, getter_AddRefs(cChild));
       if (cChild)
       {
 #if DO_AFTER
@@ -555,13 +555,13 @@ nsresult nsGeneratedContentIterator::GetNextSibling(nsCOMPtr<nsIContent> aNode,
   nsCOMPtr<nsIContent> parent;
   PRInt32              indx;
   
-  if (NS_FAILED(aNode->GetParent(*getter_AddRefs(parent))) || !parent)
+  if (NS_FAILED(aNode->GetParent(getter_AddRefs(parent))) || !parent)
     return NS_ERROR_FAILURE;
 
   if (NS_FAILED(parent->IndexOf(aNode, indx)))
     return NS_ERROR_FAILURE;
 
-  if (NS_SUCCEEDED(parent->ChildAt(++indx, *getter_AddRefs(sib))) && sib)
+  if (NS_SUCCEEDED(parent->ChildAt(++indx, getter_AddRefs(sib))) && sib)
   {
     *aSibling = sib;
   }
@@ -605,13 +605,13 @@ nsresult nsGeneratedContentIterator::GetPrevSibling(nsCOMPtr<nsIContent> aNode,
   nsCOMPtr<nsIContent> parent;
   PRInt32              indx;
   
-  if (NS_FAILED(aNode->GetParent(*getter_AddRefs(parent))) || !parent)
+  if (NS_FAILED(aNode->GetParent(getter_AddRefs(parent))) || !parent)
     return NS_ERROR_FAILURE;
 
   if (NS_FAILED(parent->IndexOf(aNode, indx)))
     return NS_ERROR_FAILURE;
 
-  if (indx && NS_SUCCEEDED(parent->ChildAt(--indx, *getter_AddRefs(sib))) && sib)
+  if (indx && NS_SUCCEEDED(parent->ChildAt(--indx, getter_AddRefs(sib))) && sib)
   {
     *aSibling = sib;
   }
@@ -660,7 +660,7 @@ nsresult nsGeneratedContentIterator::NextNode(nsCOMPtr<nsIContent> *ioNextNode)
       return NS_OK;
     }
     nsCOMPtr<nsIContent>cN;
-    (*ioNextNode)->ChildAt(0,*getter_AddRefs(cN));
+    (*ioNextNode)->ChildAt(0, getter_AddRefs(cN));
     if (cN)
     {
       *ioNextNode=GetDeepFirstChild(cN);
@@ -675,7 +675,7 @@ nsresult nsGeneratedContentIterator::NextNode(nsCOMPtr<nsIContent> *ioNextNode)
     PRInt32              indx;
   
     // get next sibling if there is one
-    if (NS_FAILED(cN->GetParent(*getter_AddRefs(parent))))
+    if (NS_FAILED(cN->GetParent(getter_AddRefs(parent))))
       return NS_ERROR_FAILURE;
     if (!parent || NS_FAILED(parent->IndexOf(cN, indx)))
     {
@@ -683,7 +683,7 @@ nsresult nsGeneratedContentIterator::NextNode(nsCOMPtr<nsIContent> *ioNextNode)
       NS_NOTREACHED("nsGeneratedContentIterator::NextNode() : no parent found");
       return NS_ERROR_FAILURE;
     }
-    if (NS_SUCCEEDED(parent->ChildAt(++indx,*getter_AddRefs(cSibling))) && cSibling)
+    if (NS_SUCCEEDED(parent->ChildAt(++indx, getter_AddRefs(cSibling))) && cSibling)
     {
       // next node is siblings "deep left" child
       *ioNextNode = GetDeepFirstChild(cSibling); 
@@ -730,7 +730,7 @@ nsresult nsGeneratedContentIterator::PrevNode(nsCOMPtr<nsIContent> *ioNextNode)
   // if it has children then prev node is last child
   if (numChildren)
   {
-    if (NS_FAILED(cN->ChildAt(--numChildren,*getter_AddRefs(cLastChild))))
+    if (NS_FAILED(cN->ChildAt(--numChildren, getter_AddRefs(cLastChild))))
       return NS_ERROR_FAILURE;
     if (!cLastChild)
       return NS_ERROR_FAILURE;
@@ -972,7 +972,7 @@ nsresult nsGeneratedSubtreeIterator::Init(nsIDOMRange* aRange)
   // short circuit when start node == end node
   if (startParent == endParent)
   {
-    cStartP->ChildAt(0,*getter_AddRefs(cChild));
+    cStartP->ChildAt(0, getter_AddRefs(cChild));
   
     if (!cChild) // no children, must be a text node or empty container
     {
@@ -1171,7 +1171,9 @@ nsresult nsGeneratedSubtreeIterator::Next()
     if (mGenIter->IsDone())
     {
       mGenIter = 0;
-      if (mIterType == nsIPresShell::After || NS_FAILED(mCurNode->ChildAt(0,*getter_AddRefs(nextNode))))
+      if (mIterType == nsIPresShell::After ||
+          NS_FAILED(mCurNode->ChildAt(0,
+                                      getter_AddRefs(nextNode))))
       {
         if (NS_FAILED(GetNextSibling(mCurNode, address_of(nextNode))))
           return NS_OK;
@@ -1244,7 +1246,7 @@ nsresult nsGeneratedSubtreeIterator::GetTopAncestorInRange(
   nsCOMPtr<nsIContent> parent;
   while (aNode)
   {
-    if (NS_FAILED(aNode->GetParent(*getter_AddRefs(parent))) || !parent)
+    if (NS_FAILED(aNode->GetParent(getter_AddRefs(parent))) || !parent)
       return NS_ERROR_FAILURE;
     if (NS_FAILED(nsRange::CompareNodeToRange(parent, mRange, &nodeBefore,
                                               &nodeAfter)))
diff --git a/content/base/src/nsGenericDOMDataNode.cpp b/content/base/src/nsGenericDOMDataNode.cpp
index 789f6d5e9bbc..113287f8cff5 100644
--- a/content/base/src/nsGenericDOMDataNode.cpp
+++ b/content/base/src/nsGenericDOMDataNode.cpp
@@ -154,7 +154,7 @@ nsGenericDOMDataNode::GetPreviousSibling(nsIDOMNode** aPrevSibling)
     PRInt32 pos;
     parent_weak->IndexOf(this, pos);
     if (pos > 0 ) {
-      parent_weak->ChildAt(--pos, *getter_AddRefs(sibling));
+      parent_weak->ChildAt(--pos, getter_AddRefs(sibling));
     }
   } else if (mDocument) {
     // Nodes that are just below the document (their parent is the
@@ -162,7 +162,7 @@ nsGenericDOMDataNode::GetPreviousSibling(nsIDOMNode** aPrevSibling)
     PRInt32 pos;
     mDocument->IndexOf(this, pos);
     if (pos > 0 ) {
-      mDocument->ChildAt(--pos, *getter_AddRefs(sibling));
+      mDocument->ChildAt(--pos, getter_AddRefs(sibling));
     }
   }
 
@@ -188,7 +188,7 @@ nsGenericDOMDataNode::GetNextSibling(nsIDOMNode** aNextSibling)
     PRInt32 pos;
     parent_weak->IndexOf(this, pos);
     if (pos > -1 ) {
-      parent_weak->ChildAt(++pos, *getter_AddRefs(sibling));
+      parent_weak->ChildAt(++pos, getter_AddRefs(sibling));
     }
   }
   else if (mDocument) {
@@ -197,7 +197,7 @@ nsGenericDOMDataNode::GetNextSibling(nsIDOMNode** aNextSibling)
     PRInt32 pos;
     mDocument->IndexOf(this, pos);
     if (pos > -1 ) {
-      mDocument->ChildAt(++pos, *getter_AddRefs(sibling));
+      mDocument->ChildAt(++pos, getter_AddRefs(sibling));
     }
   }
 
@@ -638,9 +638,9 @@ nsGenericDOMDataNode::ToCString(nsAString& aBuf, PRInt32 aOffset,
 #endif
 
 NS_IMETHODIMP
-nsGenericDOMDataNode::GetDocument(nsIDocument*& aResult) const
+nsGenericDOMDataNode::GetDocument(nsIDocument** aResult) const
 {
-  aResult = mDocument;
+  *aResult = mDocument;
   NS_IF_ADDREF(mDocument);
   return NS_OK;
 }
@@ -660,10 +660,9 @@ nsGenericDOMDataNode::SetDocument(nsIDocument* aDocument, PRBool aDeep,
 }
 
 NS_IMETHODIMP
-nsGenericDOMDataNode::GetParent(nsIContent*& aResult) const
+nsGenericDOMDataNode::GetParent(nsIContent** aResult) const
 {
-  aResult = GetParentWeak();
-  NS_IF_ADDREF(aResult);
+  NS_IF_ADDREF(*aResult = GetParentWeak());
 
   return NS_OK;;
 }
@@ -694,17 +693,17 @@ nsGenericDOMDataNode::SetNativeAnonymous(PRBool aAnonymous)
 }
 
 NS_IMETHODIMP
-nsGenericDOMDataNode::GetNameSpaceID(PRInt32& aID) const
+nsGenericDOMDataNode::GetNameSpaceID(PRInt32* aID) const
 {
-  aID = kNameSpaceID_None;
+  *aID = kNameSpaceID_None;
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsGenericDOMDataNode::NormalizeAttrString(const nsAString& aStr,
-                                          nsINodeInfo*& aNodeInfo)
+                                          nsINodeInfo** aNodeInfo)
 {
-  aNodeInfo = nsnull;
+  *aNodeInfo = nsnull;
   return NS_OK;
 }
 
@@ -740,10 +739,10 @@ nsGenericDOMDataNode::GetAttr(PRInt32 aNameSpaceID, nsIAtom *aAttr,
 
 NS_IMETHODIMP
 nsGenericDOMDataNode::GetAttr(PRInt32 aNameSpaceID, nsIAtom *aAttr,
-                              nsIAtom*& aPrefix,
+                              nsIAtom** aPrefix,
                               nsAString& aResult) const
 {
-  aPrefix = nsnull;
+  *aPrefix = nsnull;
   aResult.Truncate();
 
   return NS_CONTENT_ATTR_NOT_THERE;
@@ -756,12 +755,13 @@ nsGenericDOMDataNode::HasAttr(PRInt32 aNameSpaceID, nsIAtom *aAttribute) const
 }
 
 NS_IMETHODIMP
-nsGenericDOMDataNode::GetAttrNameAt(PRInt32 aIndex, PRInt32& aNameSpaceID,
-                                    nsIAtom*& aName, nsIAtom*& aPrefix) const
+nsGenericDOMDataNode::GetAttrNameAt(PRInt32 aIndex, PRInt32* aNameSpaceID,
+                                    nsIAtom** aName, nsIAtom** aPrefix) const
 {
-  aNameSpaceID = kNameSpaceID_None;
-  aName = nsnull;
-  aPrefix = nsnull;
+  *aNameSpaceID = kNameSpaceID_None;
+  *aName = nsnull;
+  *aPrefix = nsnull;
+
   return NS_ERROR_ILLEGAL_VALUE;
 }
 
@@ -871,9 +871,9 @@ nsGenericDOMDataNode::SetContentID(PRUint32 aID)
 }
 
 NS_IMETHODIMP
-nsGenericDOMDataNode::GetNodeInfo(nsINodeInfo*& aResult) const
+nsGenericDOMDataNode::GetNodeInfo(nsINodeInfo** aResult) const
 {
-  aResult = nsnull;
+  *aResult = nsnull;
   return NS_OK;
 }
 
@@ -892,9 +892,9 @@ nsGenericDOMDataNode::ChildCount(PRInt32& aResult) const
 }
 
 NS_IMETHODIMP
-nsGenericDOMDataNode::ChildAt(PRInt32 aIndex, nsIContent*& aResult) const
+nsGenericDOMDataNode::ChildAt(PRInt32 aIndex, nsIContent** aResult) const
 {
-  aResult = nsnull;
+  *aResult = nsnull;
   return NS_OK;
 }
 
@@ -1018,9 +1018,9 @@ nsGenericDOMDataNode::RangeRemove(nsIDOMRange* aRange)
 
 
 NS_IMETHODIMP
-nsGenericDOMDataNode::GetRangeList(nsVoidArray*& aResult) const
+nsGenericDOMDataNode::GetRangeList(nsVoidArray** aResult) const
 {
-  aResult = LookupRangeList();
+  *aResult = LookupRangeList();
   return NS_OK;
 }
 
@@ -1118,7 +1118,7 @@ nsGenericDOMDataNode::SplitText(PRUint32 aOffset, nsIDOMText** aReturn)
   }
 
   nsCOMPtr<nsIContent> parentNode;
-  GetParent(*getter_AddRefs(parentNode));
+  GetParent(getter_AddRefs(parentNode));
 
   if (parentNode) {
     PRInt32 index;
diff --git a/content/base/src/nsGenericDOMDataNode.h b/content/base/src/nsGenericDOMDataNode.h
index f04be4653594..869b64708001 100644
--- a/content/base/src/nsGenericDOMDataNode.h
+++ b/content/base/src/nsGenericDOMDataNode.h
@@ -168,16 +168,16 @@ public:
                        const nsAString& aArg);
 
   // Implementation for nsIContent
-  NS_IMETHOD GetDocument(nsIDocument*& aResult) const;
+  NS_IMETHOD GetDocument(nsIDocument** aResult) const;
   NS_IMETHOD SetDocument(nsIDocument* aDocument, PRBool aDeep,
                          PRBool aCompileEventHandlers);
-  NS_IMETHOD GetParent(nsIContent*& aResult) const;
+  NS_IMETHOD GetParent(nsIContent** aResult) const;
   NS_IMETHOD SetParent(nsIContent* aParent);
   NS_IMETHOD_(PRBool) IsNativeAnonymous() const;
   NS_IMETHOD_(void) SetNativeAnonymous(PRBool aAnonymous);
-  NS_IMETHOD GetNameSpaceID(PRInt32& aID) const;
+  NS_IMETHOD GetNameSpaceID(PRInt32* aID) const;
   NS_IMETHOD NormalizeAttrString(const nsAString& aStr,
-                                 nsINodeInfo*& aNodeInfo);
+                                 nsINodeInfo** aNodeInfo);
   NS_IMETHOD SetAttr(PRInt32 aNameSpaceID, nsIAtom* aAttribute,
                      const nsAString& aValue, PRBool aNotify);
   NS_IMETHOD SetAttr(nsINodeInfo *aNodeInfo,
@@ -187,10 +187,10 @@ public:
   NS_IMETHOD GetAttr(PRInt32 aNameSpaceID, nsIAtom *aAttribute,
                      nsAString& aResult) const;
   NS_IMETHOD GetAttr(PRInt32 aNameSpaceID, nsIAtom *aAttribute,
-                     nsIAtom*& aPrefix, nsAString& aResult) const;
+                     nsIAtom** aPrefix, nsAString& aResult) const;
   NS_IMETHOD_(PRBool) HasAttr(PRInt32 aNameSpaceID, nsIAtom *aAttribute) const;
-  NS_IMETHOD GetAttrNameAt(PRInt32 aIndex, PRInt32& aNameSpaceID, 
-                           nsIAtom*& aName, nsIAtom*& aPrefix) const;
+  NS_IMETHOD GetAttrNameAt(PRInt32 aIndex, PRInt32* aNameSpaceID,
+                           nsIAtom** aName, nsIAtom** aPrefix) const;
   NS_IMETHOD GetAttrCount(PRInt32& aResult) const;
 #ifdef DEBUG
   NS_IMETHOD List(FILE* out, PRInt32 aIndent) const;
@@ -203,7 +203,7 @@ public:
   NS_IMETHOD SetContentID(PRUint32 aID);
   NS_IMETHOD RangeAdd(nsIDOMRange* aRange);
   NS_IMETHOD RangeRemove(nsIDOMRange* aRange);
-  NS_IMETHOD GetRangeList(nsVoidArray*& aResult) const;
+  NS_IMETHOD GetRangeList(nsVoidArray** aResult) const;
   NS_IMETHOD SetFocus(nsIPresContext *aPresContext);
   NS_IMETHOD RemoveFocus(nsIPresContext *aPresContext);
 
@@ -214,10 +214,10 @@ public:
   NS_IMETHOD GetListenerManager(nsIEventListenerManager** aInstancePtrResult);
   NS_IMETHOD DoneCreatingElement();
 
-  NS_IMETHOD GetNodeInfo(nsINodeInfo*& aResult) const;
+  NS_IMETHOD GetNodeInfo(nsINodeInfo** aResult) const;
   NS_IMETHOD CanContainChildren(PRBool& aResult) const;
   NS_IMETHOD ChildCount(PRInt32& aResult) const;
-  NS_IMETHOD ChildAt(PRInt32 aIndex, nsIContent*& aResult) const;
+  NS_IMETHOD ChildAt(PRInt32 aIndex, nsIContent** aResult) const;
   NS_IMETHOD IndexOf(nsIContent* aPossibleChild, PRInt32& aResult) const;
   NS_IMETHOD InsertChildAt(nsIContent* aKid, PRInt32 aIndex, PRBool aNotify,
                            PRBool aDeepSetDocument);
diff --git a/content/base/src/nsGenericElement.cpp b/content/base/src/nsGenericElement.cpp
index 67c4adb6b5aa..7c4dc5f16d10 100644
--- a/content/base/src/nsGenericElement.cpp
+++ b/content/base/src/nsGenericElement.cpp
@@ -149,7 +149,7 @@ nsChildContentList::Item(PRUint32 aIndex, nsIDOMNode** aReturn)
 
   if (mContent) {
     nsCOMPtr<nsIContent> content;
-    mContent->ChildAt(aIndex, *getter_AddRefs(content));
+    mContent->ChildAt(aIndex, getter_AddRefs(content));
     if (content) {
       return CallQueryInterface(content, aReturn);
     }
@@ -192,7 +192,7 @@ nsNode3Tearoff::GetBaseURI(nsAString& aURI)
 
   nsCOMPtr<nsIDocument> doc;
 
-  mContent->GetDocument(*getter_AddRefs(doc));
+  mContent->GetDocument(getter_AddRefs(doc));
 
   aURI.Truncate();
 
@@ -211,7 +211,7 @@ nsNode3Tearoff::GetBaseURI(nsAString& aURI)
     }
 
     nsCOMPtr<nsIContent> parent;
-    content->GetParent(*getter_AddRefs(parent));
+    content->GetParent(getter_AddRefs(parent));
     content.swap(parent);
   } while (content);
 
@@ -219,7 +219,7 @@ nsNode3Tearoff::GetBaseURI(nsAString& aURI)
     // HTML document or for some reason there was no XML content in
     // XML document
 
-    doc->GetBaseURL(*getter_AddRefs(uri));
+    doc->GetBaseURL(getter_AddRefs(uri));
 
     if (!uri) {
       doc->GetDocumentURL(getter_AddRefs(uri));
@@ -321,7 +321,7 @@ nsNode3Tearoff::LookupNamespacePrefix(const nsAString& aNamespaceURI,
   // Get the namespace id for the URI
   PRInt32 namespaceId;
   nsContentUtils::GetNSManagerWeakRef()->GetNameSpaceID(aNamespaceURI,
-                                                        namespaceId);
+                                                        &namespaceId);
   if (namespaceId == kNameSpaceID_Unknown) {
     return NS_OK;
   }
@@ -341,8 +341,8 @@ nsNode3Tearoff::LookupNamespacePrefix(const nsAString& aNamespaceURI,
     content->GetAttrCount(attrCount);
 
     for (i = 0; i < attrCount; i++) {
-      content->GetAttrNameAt(i, namespace_id, *getter_AddRefs(name),
-                             *getter_AddRefs(prefix));
+      content->GetAttrNameAt(i, &namespace_id, getter_AddRefs(name),
+                             getter_AddRefs(prefix));
 
       if (namespace_id == kNameSpaceID_XMLNS) {
         nsresult rv = content->GetAttr(namespace_id, name, ns);
@@ -357,7 +357,7 @@ nsNode3Tearoff::LookupNamespacePrefix(const nsAString& aNamespaceURI,
     }
 
     nsCOMPtr<nsIContent> tmp(content);
-    tmp->GetParent(*getter_AddRefs(content));
+    tmp->GetParent(getter_AddRefs(content));
   }
 
   return NS_OK;
@@ -388,7 +388,7 @@ nsNode3Tearoff::LookupNamespaceURI(const nsAString& aNamespacePrefix,
     }
 
     nsCOMPtr<nsIContent> tmp(content);
-    tmp->GetParent(*getter_AddRefs(content));
+    tmp->GetParent(getter_AddRefs(content));
   }
 
   SetDOMStringToNull(aNamespaceURI);
@@ -965,7 +965,7 @@ nsGenericElement::GetPreviousSibling(nsIDOMNode** aPrevSibling)
     PRInt32 pos;
     mParent->IndexOf(this, pos);
     if (pos > 0 ) {
-      mParent->ChildAt(--pos, *getter_AddRefs(sibling));
+      mParent->ChildAt(--pos, getter_AddRefs(sibling));
     }
   } else if (mDocument) {
     // Nodes that are just below the document (their parent is the
@@ -973,7 +973,7 @@ nsGenericElement::GetPreviousSibling(nsIDOMNode** aPrevSibling)
     PRInt32 pos;
     mDocument->IndexOf(this, pos);
     if (pos > 0 ) {
-      mDocument->ChildAt(--pos, *getter_AddRefs(sibling));
+      mDocument->ChildAt(--pos, getter_AddRefs(sibling));
     }
   }
 
@@ -996,7 +996,7 @@ nsGenericElement::GetNextSibling(nsIDOMNode** aNextSibling)
     PRInt32 pos;
     mParent->IndexOf(this, pos);
     if (pos > -1 ) {
-      mParent->ChildAt(++pos, *getter_AddRefs(sibling));
+      mParent->ChildAt(++pos, getter_AddRefs(sibling));
     }
   } else if (mDocument) {
     // Nodes that are just below the document (their parent is the
@@ -1004,7 +1004,7 @@ nsGenericElement::GetNextSibling(nsIDOMNode** aNextSibling)
     PRInt32 pos;
     mDocument->IndexOf(this, pos);
     if (pos > -1 ) {
-      mDocument->ChildAt(++pos, *getter_AddRefs(sibling));
+      mDocument->ChildAt(++pos, getter_AddRefs(sibling));
     }
   }
 
@@ -1027,7 +1027,7 @@ nsGenericElement::GetOwnerDocument(nsIDOMDocument** aOwnerDocument)
   if (!doc) {
     // If we're not part of the document we can check if our nodeinfo
     // can get at the document
-    mNodeInfo->GetDocument(*getter_AddRefs(doc));
+    mNodeInfo->GetDocument(getter_AddRefs(doc));
   }
 
   if (doc) {
@@ -1056,7 +1056,6 @@ nsGenericElement::SetPrefix(const nsAString& aPrefix)
 {
   // XXX: Validate the prefix string!
 
-  nsINodeInfo *newNodeInfo = nsnull;
   nsCOMPtr<nsIAtom> prefix;
 
   if (!aPrefix.IsEmpty() && !DOMStringIsNull(aPrefix)) {
@@ -1064,13 +1063,17 @@ nsGenericElement::SetPrefix(const nsAString& aPrefix)
     NS_ENSURE_TRUE(prefix, NS_ERROR_OUT_OF_MEMORY);
   }
 
-  nsresult rv = mNodeInfo->PrefixChanged(prefix, newNodeInfo);
+  nsCOMPtr<nsINodeInfo> newNodeInfo;
+  nsresult rv = mNodeInfo->PrefixChanged(prefix,
+                                         getter_AddRefs(newNodeInfo));
   NS_ENSURE_SUCCESS(rv, rv);
 
   NS_RELEASE(mNodeInfo);
 
   mNodeInfo = newNodeInfo;
 
+  NS_ADDREF(mNodeInfo);
+
   return NS_OK;
 }
 
@@ -1199,14 +1202,11 @@ nsGenericElement::GetAttribute(const nsAString& aName,
                                nsAString& aReturn)
 {
   nsCOMPtr<nsINodeInfo> ni;
-  NormalizeAttrString(aName, *getter_AddRefs(ni));
+  NormalizeAttrString(aName, getter_AddRefs(ni));
   NS_ENSURE_TRUE(ni, NS_ERROR_FAILURE);
 
-  PRInt32 nsid;
-  nsCOMPtr<nsIAtom> nameAtom;
-
-  ni->GetNamespaceID(nsid);
-  ni->GetNameAtom(*getter_AddRefs(nameAtom));
+  PRInt32 nsid = ni->GetNamespaceID();
+  nsCOMPtr<nsIAtom> nameAtom = ni->GetNameAtom();
 
   nsresult rv = GetAttr(nsid, nameAtom, aReturn);
 
@@ -1222,7 +1222,7 @@ nsGenericElement::SetAttribute(const nsAString& aName,
                                const nsAString& aValue)
 {
   nsCOMPtr<nsINodeInfo> ni;
-  NormalizeAttrString(aName, *getter_AddRefs(ni));
+  NormalizeAttrString(aName, getter_AddRefs(ni));
 
   return SetAttr(ni, aValue, PR_TRUE);
 }
@@ -1231,14 +1231,11 @@ nsresult
 nsGenericElement::RemoveAttribute(const nsAString& aName)
 {
   nsCOMPtr<nsINodeInfo> ni;
-  NormalizeAttrString(aName, *getter_AddRefs(ni));
+  NormalizeAttrString(aName, getter_AddRefs(ni));
   NS_ENSURE_TRUE(ni, NS_ERROR_FAILURE);
 
-  PRInt32 nsid;
-  nsCOMPtr<nsIAtom> tag;
-
-  ni->GetNamespaceID(nsid);
-  ni->GetNameAtom(*getter_AddRefs(tag));
+  PRInt32 nsid = ni->GetNamespaceID();
+  nsCOMPtr<nsIAtom> tag = ni->GetNameAtom();
 
   return UnsetAttr(nsid, tag, PR_TRUE);
 }
@@ -1339,7 +1336,7 @@ nsGenericElement::GetAttributeNS(const nsAString& aNamespaceURI,
   nsCOMPtr<nsIAtom> name = do_GetAtom(aLocalName);
   PRInt32 nsid;
 
-  nsContentUtils::GetNSManagerWeakRef()->GetNameSpaceID(aNamespaceURI, nsid);
+  nsContentUtils::GetNSManagerWeakRef()->GetNameSpaceID(aNamespaceURI, &nsid);
 
   if (nsid == kNameSpaceID_Unknown) {
     // Unkonwn namespace means no attr...
@@ -1360,12 +1357,12 @@ nsGenericElement::SetAttributeNS(const nsAString& aNamespaceURI,
                                  const nsAString& aValue)
 {
   nsCOMPtr<nsINodeInfoManager> nimgr;
-  mNodeInfo->GetNodeInfoManager(*getter_AddRefs(nimgr));
+  mNodeInfo->GetNodeInfoManager(getter_AddRefs(nimgr));
   NS_ENSURE_TRUE(nimgr, NS_ERROR_FAILURE);
 
   nsCOMPtr<nsINodeInfo> ni;
   nsresult rv = nimgr->GetNodeInfo(aQualifiedName, aNamespaceURI,
-                                   *getter_AddRefs(ni));
+                                   getter_AddRefs(ni));
   NS_ENSURE_SUCCESS(rv, rv);
 
   return SetAttr(ni, aValue, PR_TRUE);
@@ -1378,7 +1375,7 @@ nsGenericElement::RemoveAttributeNS(const nsAString& aNamespaceURI,
   nsCOMPtr<nsIAtom> name = do_GetAtom(aLocalName);
   PRInt32 nsid;
 
-  nsContentUtils::GetNSManagerWeakRef()->GetNameSpaceID(aNamespaceURI, nsid);
+  nsContentUtils::GetNSManagerWeakRef()->GetNameSpaceID(aNamespaceURI, &nsid);
 
   if (nsid == kNameSpaceID_Unknown) {
     // Unkonwn namespace means no attr...
@@ -1450,7 +1447,7 @@ nsGenericElement::GetElementsByTagNameNS(const nsAString& aNamespaceURI,
 
   if (!aNamespaceURI.Equals(NS_LITERAL_STRING("*"))) {
     nsContentUtils::GetNSManagerWeakRef()->GetNameSpaceID(aNamespaceURI,
-                                                          nameSpaceId);
+                                                          &nameSpaceId);
 
     if (nameSpaceId == kNameSpaceID_Unknown) {
       // Unknown namespace means no matches, we create an empty list...
@@ -1478,14 +1475,11 @@ nsGenericElement::HasAttribute(const nsAString& aName, PRBool* aReturn)
   NS_ENSURE_ARG_POINTER(aReturn);
 
   nsCOMPtr<nsINodeInfo> ni;
-  NormalizeAttrString(aName, *getter_AddRefs(ni));
+  NormalizeAttrString(aName, getter_AddRefs(ni));
   NS_ENSURE_TRUE(ni, NS_ERROR_FAILURE);
 
-  PRInt32 nsid;
-  nsCOMPtr<nsIAtom> nameAtom;
-
-  ni->GetNamespaceID(nsid);
-  ni->GetNameAtom(*getter_AddRefs(nameAtom));
+  PRInt32 nsid = ni->GetNamespaceID();
+  nsCOMPtr<nsIAtom> nameAtom = ni->GetNameAtom();
 
   *aReturn = HasAttr(nsid, nameAtom);
   return NS_OK;
@@ -1501,7 +1495,7 @@ nsGenericElement::HasAttributeNS(const nsAString& aNamespaceURI,
   nsCOMPtr<nsIAtom> name = do_GetAtom(aLocalName);
   PRInt32 nsid;
 
-  nsContentUtils::GetNSManagerWeakRef()->GetNameSpaceID(aNamespaceURI, nsid);
+  nsContentUtils::GetNSManagerWeakRef()->GetNameSpaceID(aNamespaceURI, &nsid);
 
   if (nsid == kNameSpaceID_Unknown) {
     // Unkonwn namespace means no attr...
@@ -1549,7 +1543,7 @@ nsGenericElement::Normalize()
   for (index = 0; (index < count) && (NS_OK == result); index++) {
     nsCOMPtr<nsIContent> child;
 
-    result = ChildAt(index, *getter_AddRefs(child));
+    result = ChildAt(index, getter_AddRefs(child));
     if (NS_FAILED(result)) {
       return result;
     }
@@ -1568,7 +1562,7 @@ nsGenericElement::Normalize()
             // Get the sibling. If it's also a text node, then
             // remove it from the tree and join the two text
             // nodes.
-            result = ChildAt(index+1, *getter_AddRefs(sibling));
+            result = ChildAt(index+1, getter_AddRefs(sibling));
             if (NS_FAILED(result)) {
               return result;
             }
@@ -1612,10 +1606,9 @@ nsGenericElement::Normalize()
 
 
 nsresult
-nsGenericElement::GetDocument(nsIDocument*& aResult) const
+nsGenericElement::GetDocument(nsIDocument** aResult) const
 {
-  aResult = mDocument;
-  NS_IF_ADDREF(aResult);
+  NS_IF_ADDREF(*aResult = mDocument);
 
   return NS_OK;
 }
@@ -1631,7 +1624,7 @@ nsGenericElement::SetDocumentInChildrenOf(nsIContent* aContent,
   aContent->ChildCount(n);
 
   for (i = 0; i < n; i++) {
-    aContent->ChildAt(i, *getter_AddRefs(child));
+    aContent->ChildAt(i, getter_AddRefs(child));
 
     if (child) {
       child->SetDocument(aDocument, PR_TRUE, aCompileEventHandlers);
@@ -1671,24 +1664,23 @@ nsGenericElement::SetDocument(nsIDocument* aDocument, PRBool aDeep,
       // check the document on the nodeinfo to see whether we need a
       // new nodeinfo
       nsCOMPtr<nsIDocument> nodeinfoDoc;
-      mNodeInfo->GetDocument(*getter_AddRefs(nodeinfoDoc));
+      mNodeInfo->GetDocument(getter_AddRefs(nodeinfoDoc));
       if (aDocument != nodeinfoDoc) {
         // get a new nodeinfo
-        nsCOMPtr<nsIAtom> name;
-        mNodeInfo->GetNameAtom(*getter_AddRefs(name));
-        nsCOMPtr<nsIAtom> prefix;
-        mNodeInfo->GetPrefixAtom(*getter_AddRefs(prefix));
-        PRInt32 nameSpaceID;
-        mNodeInfo->GetNamespaceID(nameSpaceID);
+        nsCOMPtr<nsIAtom> name = mNodeInfo->GetNameAtom();
+        nsCOMPtr<nsIAtom> prefix = mNodeInfo->GetPrefixAtom();
+        PRInt32 nameSpaceID = mNodeInfo->GetNamespaceID();
+
         nsCOMPtr<nsINodeInfoManager> nodeInfoManager;
-        aDocument->GetNodeInfoManager(*getter_AddRefs(nodeInfoManager));
+        aDocument->GetNodeInfoManager(getter_AddRefs(nodeInfoManager));
         if (nodeInfoManager) {
-          nsINodeInfo* newNodeInfo;
+          nsCOMPtr<nsINodeInfo> newNodeInfo;
           nodeInfoManager->GetNodeInfo(name, prefix, nameSpaceID,
-                                       newNodeInfo);
+                                       getter_AddRefs(newNodeInfo));
           if (newNodeInfo) {
             NS_RELEASE(mNodeInfo);
             mNodeInfo = newNodeInfo;
+            NS_ADDREF(mNodeInfo);
           }
         }
       }
@@ -1706,10 +1698,10 @@ nsGenericElement::SetDocument(nsIDocument* aDocument, PRBool aDeep,
 
 
 nsresult
-nsGenericElement::GetParent(nsIContent*& aResult) const
+nsGenericElement::GetParent(nsIContent** aResult) const
 {
-  aResult = mParent;
-  NS_IF_ADDREF(aResult);
+  NS_IF_ADDREF(*aResult = mParent);
+
   return NS_OK;
 }
 
@@ -1743,22 +1735,26 @@ nsGenericElement::SetNativeAnonymous(PRBool aAnonymous)
 }
 
 nsresult
-nsGenericElement::GetNameSpaceID(PRInt32& aNameSpaceID) const
+nsGenericElement::GetNameSpaceID(PRInt32* aNameSpaceID) const
 {
-  return mNodeInfo->GetNamespaceID(aNameSpaceID);
+  *aNameSpaceID = mNodeInfo->GetNamespaceID();
+
+  return NS_OK;
 }
 
 nsresult
-nsGenericElement::GetTag(nsIAtom*& aResult) const
+nsGenericElement::GetTag(nsIAtom** aResult) const
 {
-  return mNodeInfo->GetNameAtom(aResult);
+  // AddRefs
+  *aResult = mNodeInfo->GetNameAtom().get();
+
+  return NS_OK;
 }
 
 nsresult
-nsGenericElement::GetNodeInfo(nsINodeInfo*& aResult) const
+nsGenericElement::GetNodeInfo(nsINodeInfo** aResult) const
 {
-  aResult = mNodeInfo;
-  NS_ADDREF(aResult);
+  NS_ADDREF(*aResult = mNodeInfo);
 
   return NS_OK;
 }
@@ -2043,9 +2039,9 @@ nsGenericElement::MaybeTriggerAutoLink(nsIDocShell *aShell)
 }
 
 NS_IMETHODIMP
-nsGenericElement::GetID(nsIAtom*& aResult) const
+nsGenericElement::GetID(nsIAtom** aResult) const
 {
-  aResult = nsnull;
+  *aResult = nsnull;
 
   return NS_OK;
 }
@@ -2129,7 +2125,7 @@ nsGenericElement::StringToAttribute(nsIAtom* aAttribute,
 }
 
 NS_IMETHODIMP
-nsGenericElement::GetBaseURL(nsIURI*& aBaseURL) const
+nsGenericElement::GetBaseURL(nsIURI** aBaseURL) const
 {
   return NS_ERROR_NOT_IMPLEMENTED;
 }
@@ -2239,9 +2235,9 @@ nsGenericElement::RangeRemove(nsIDOMRange* aRange)
 
 
 nsresult
-nsGenericElement::GetRangeList(nsVoidArray*& aResult) const
+nsGenericElement::GetRangeList(nsVoidArray** aResult) const
 {
-  aResult = nsnull;
+  *aResult = nsnull;
 
   if (!HasRangeList()) {
     return NS_OK;
@@ -2259,7 +2255,7 @@ nsGenericElement::GetRangeList(nsVoidArray*& aResult) const
     return NS_ERROR_UNEXPECTED;
   }
 
-  aResult = entry->mRangeList;
+  *aResult = entry->mRangeList;
 
   return NS_OK;
 }
@@ -2319,7 +2315,7 @@ nsGenericElement::SetBindingParent(nsIContent* aParent)
     ChildCount(count);
     for (PRInt32 i = 0; i < count; i++) {
       nsCOMPtr<nsIContent> child;
-      ChildAt(i, *getter_AddRefs(child));
+      ChildAt(i, getter_AddRefs(child));
       child->SetBindingParent(aParent);
     }
   }
@@ -2411,7 +2407,7 @@ isSelfOrAncestor(nsIContent *aNode, nsIContent *aChild)
     return PR_FALSE;
   }
 
-  aNode->GetParent(*getter_AddRefs(parent));
+  aNode->GetParent(getter_AddRefs(parent));
 
   while (parent) {
     if (parent.get() == aChild) {
@@ -2421,7 +2417,7 @@ isSelfOrAncestor(nsIContent *aNode, nsIContent *aChild)
       return PR_TRUE;
     }
 
-    parent->GetParent(*getter_AddRefs(tmpNode));
+    parent->GetParent(getter_AddRefs(tmpNode));
 
     parent = tmpNode;
   }
@@ -2501,7 +2497,7 @@ nsGenericElement::doInsertBefore(nsIDOMNode* aNewChild,
   }
 
   nsCOMPtr<nsIDocument> old_doc;
-  newContent->GetDocument(*getter_AddRefs(old_doc));
+  newContent->GetDocument(getter_AddRefs(old_doc));
   if (old_doc && old_doc != mDocument &&
       !nsContentUtils::CanCallerAccess(aNewChild)) {
     return NS_ERROR_DOM_SECURITY_ERR;
@@ -2551,7 +2547,7 @@ nsGenericElement::doInsertBefore(nsIDOMNode* aNewChild,
       // won't be removed from the document fragment when inserted
       // into the new parent. This lets us do this operation *much*
       // faster.
-      res = newContent->ChildAt(i, *getter_AddRefs(childContent));
+      res = newContent->ChildAt(i, getter_AddRefs(childContent));
       if (NS_FAILED(res)) {
         break;
       }
@@ -2622,7 +2618,7 @@ nsGenericElement::doInsertBefore(nsIDOMNode* aNewChild,
            */
           nsCOMPtr<nsIContent> tmpContent;
 
-          ChildAt(refPos - 1, *getter_AddRefs(tmpContent));
+          ChildAt(refPos - 1, getter_AddRefs(tmpContent));
 
           if (refContent == tmpContent) {
             refPos--;
@@ -2689,7 +2685,7 @@ nsGenericElement::doReplaceChild(nsIDOMNode* aNewChild,
 
   nsCOMPtr<nsIContent> replacedChild;
 
-  ChildAt(oldPos, *getter_AddRefs(replacedChild));
+  ChildAt(oldPos, getter_AddRefs(replacedChild));
 
   PRUint16 nodeType = 0;
 
@@ -2723,7 +2719,7 @@ nsGenericElement::doReplaceChild(nsIDOMNode* aNewChild,
   }
 
   nsCOMPtr<nsIDocument> old_doc;
-  newContent->GetDocument(*getter_AddRefs(old_doc));
+  newContent->GetDocument(getter_AddRefs(old_doc));
   if (old_doc && old_doc != mDocument &&
       !nsContentUtils::CanCallerAccess(aNewChild)) {
     return NS_ERROR_DOM_SECURITY_ERR;
@@ -2731,7 +2727,7 @@ nsGenericElement::doReplaceChild(nsIDOMNode* aNewChild,
 
   nsCOMPtr<nsIDocument> document;
 
-  GetDocument(*getter_AddRefs(document));
+  GetDocument(getter_AddRefs(document));
 
   /*
    * Make sure the new child is not "this" node or one of this nodes
@@ -2761,7 +2757,7 @@ nsGenericElement::doReplaceChild(nsIDOMNode* aNewChild,
     for (i = 0; i < count; i++) {
       // Always get and remove the first child, since the child indexes
       // change as we go along.
-      res = newContent->ChildAt(0, *getter_AddRefs(childContent));
+      res = newContent->ChildAt(0, getter_AddRefs(childContent));
       if (NS_FAILED(res)) {
         return res;
       }
@@ -2823,7 +2819,7 @@ nsGenericElement::doReplaceChild(nsIDOMNode* aNewChild,
          */
         nsCOMPtr<nsIContent> tmpContent;
 
-        ChildAt(oldPos - 1, *getter_AddRefs(tmpContent));
+        ChildAt(oldPos - 1, getter_AddRefs(tmpContent));
 
         if (oldContent == tmpContent) {
           oldPos--;
@@ -3121,7 +3117,8 @@ nsGenericContainerElement::~nsGenericContainerElement()
 }
 
 nsresult
-nsGenericContainerElement::NormalizeAttrString(const nsAString& aStr, nsINodeInfo*& aNodeInfo)
+nsGenericContainerElement::NormalizeAttrString(const nsAString& aStr,
+                                               nsINodeInfo** aNodeInfo)
 {
   NS_ConvertUCS2toUTF8 utf8String(aStr);
   if (mAttributes) {
@@ -3129,8 +3126,7 @@ nsGenericContainerElement::NormalizeAttrString(const nsAString& aStr, nsINodeInf
     for (indx = 0; indx < count; indx++) {
       nsGenericAttribute* attr = (nsGenericAttribute*)mAttributes->ElementAt(indx);
       if (attr->mNodeInfo->QualifiedNameEquals(utf8String)) {
-        aNodeInfo = attr->mNodeInfo;
-        NS_ADDREF(aNodeInfo);
+        NS_ADDREF(*aNodeInfo = attr->mNodeInfo);
 
         return NS_OK;
       }
@@ -3138,7 +3134,7 @@ nsGenericContainerElement::NormalizeAttrString(const nsAString& aStr, nsINodeInf
   }
 
   nsCOMPtr<nsINodeInfoManager> nimgr;
-  mNodeInfo->GetNodeInfoManager(*getter_AddRefs(nimgr));
+  mNodeInfo->GetNodeInfoManager(getter_AddRefs(nimgr));
   NS_ENSURE_TRUE(nimgr, NS_ERROR_FAILURE);
 
   return nimgr->GetNodeInfo(aStr, nsnull, kNameSpaceID_None, aNodeInfo);
@@ -3265,12 +3261,12 @@ nsGenericContainerElement::SetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
 {
   nsresult rv;
   nsCOMPtr<nsINodeInfoManager> nimgr;
-  rv = mNodeInfo->GetNodeInfoManager(*getter_AddRefs(nimgr));
+  rv = mNodeInfo->GetNodeInfoManager(getter_AddRefs(nimgr));
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCOMPtr<nsINodeInfo> ni;
   rv = nimgr->GetNodeInfo(aName, nsnull, aNameSpaceID,
-                          *getter_AddRefs(ni));
+                          getter_AddRefs(ni));
   NS_ENSURE_SUCCESS(rv, rv);
 
   return SetAttr(ni, aValue, aNotify);
@@ -3282,7 +3278,7 @@ PRBool nsGenericElement::HasMutationListeners(nsIContent* aContent,
                                               PRUint32 aType)
 {
   nsCOMPtr<nsIDocument> doc;
-  aContent->GetDocument(*getter_AddRefs(doc));
+  aContent->GetDocument(getter_AddRefs(doc));
   if (!doc)
     return PR_FALSE;
 
@@ -3318,7 +3314,7 @@ PRBool nsGenericElement::HasMutationListeners(nsIContent* aContent,
     }
 
     nsCOMPtr<nsIContent> prev = curr;
-    prev->GetParent(*getter_AddRefs(curr));
+    prev->GetParent(getter_AddRefs(curr));
   }
 
   nsCOMPtr<nsIDOMEventReceiver> rec(do_QueryInterface(doc));
@@ -3363,11 +3359,8 @@ nsGenericContainerElement::SetAttr(nsINodeInfo* aNodeInfo,
     NS_ENSURE_TRUE(mAttributes, NS_ERROR_OUT_OF_MEMORY);
   }
 
-  nsCOMPtr<nsIAtom> name;
-  PRInt32 nameSpaceID;
-
-  aNodeInfo->GetNameAtom(*getter_AddRefs(name));
-  aNodeInfo->GetNamespaceID(nameSpaceID);
+  nsCOMPtr<nsIAtom> name = aNodeInfo->GetNameAtom();
+  PRInt32 nameSpaceID = aNodeInfo->GetNamespaceID();
 
   if (aNotify && (nsnull != mDocument)) {
     mDocument->BeginUpdate();
@@ -3455,22 +3448,23 @@ nsGenericContainerElement::GetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
                                    nsAString& aResult) const
 {
   nsCOMPtr<nsIAtom> prefix;
-  return GetAttr(aNameSpaceID, aName, *getter_AddRefs(prefix), aResult);
+  return GetAttr(aNameSpaceID, aName, getter_AddRefs(prefix), aResult);
 }
 
 nsresult
 nsGenericContainerElement::GetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
-                                   nsIAtom*& aPrefix,
+                                   nsIAtom** aPrefix,
                                    nsAString& aResult) const
 {
   NS_ASSERTION(nsnull != aName, "must have attribute name");
-  if (nsnull == aName) {
+  if (!aName) {
     return NS_ERROR_NULL_POINTER;
   }
 
+  *aPrefix = nsnull;
   nsresult rv = NS_CONTENT_ATTR_NOT_THERE;
 
-  if (nsnull != mAttributes) {
+  if (mAttributes) {
     PRInt32 count = mAttributes->Count();
     PRInt32 index;
     for (index = 0; index < count; index++) {
@@ -3478,7 +3472,7 @@ nsGenericContainerElement::GetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
       if ((aNameSpaceID == kNameSpaceID_Unknown ||
            attr->mNodeInfo->NamespaceEquals(aNameSpaceID)) &&
           (attr->mNodeInfo->Equals(aName))) {
-        attr->mNodeInfo->GetPrefixAtom(aPrefix);
+        *aPrefix = attr->mNodeInfo->GetPrefixAtom().get();
         aResult.Assign(attr->mValue);
         if (!aResult.IsEmpty()) {
           rv = NS_CONTENT_ATTR_HAS_VALUE;
@@ -3601,22 +3595,25 @@ nsGenericContainerElement::UnsetAttr(PRInt32 aNameSpaceID,
 
 nsresult
 nsGenericContainerElement::GetAttrNameAt(PRInt32 aIndex,
-                                         PRInt32& aNameSpaceID,
-                                         nsIAtom*& aName,
-                                         nsIAtom*& aPrefix) const
+                                         PRInt32* aNameSpaceID,
+                                         nsIAtom** aName,
+                                         nsIAtom** aPrefix) const
 {
-  if (nsnull != mAttributes) {
+  if (mAttributes) {
     nsGenericAttribute* attr = (nsGenericAttribute*)mAttributes->ElementAt(aIndex);
-    if (nsnull != attr) {
-      attr->mNodeInfo->GetNamespaceID(aNameSpaceID);
-      attr->mNodeInfo->GetNameAtom(aName);
-      attr->mNodeInfo->GetPrefixAtom(aPrefix);
+    if (attr) {
+      *aNameSpaceID = attr->mNodeInfo->GetNamespaceID();
+      *aName = attr->mNodeInfo->GetNameAtom().get();
+      *aPrefix = attr->mNodeInfo->GetPrefixAtom().get();
 
       return NS_OK;
     }
   }
-  aNameSpaceID = kNameSpaceID_None;
-  aName = nsnull;
+
+  *aNameSpaceID = kNameSpaceID_None;
+  *aName = nsnull;
+  *aPrefix = nsnull;
+
   return NS_ERROR_ILLEGAL_VALUE;
 }
 
@@ -3680,11 +3677,10 @@ nsGenericContainerElement::List(FILE* out, PRInt32 aIndent) const
     fputs("\n", out);
     PRInt32 kids;
     ChildCount(kids);
+    nsCOMPtr<nsIContent> kid;
     for (index = 0; index < kids; index++) {
-      nsIContent* kid;
-      ChildAt(index, kid);
+      ChildAt(index, getter_AddRefs(kid));
       kid->List(out, aIndent + 1);
-      NS_RELEASE(kid);
     }
     for (index = aIndent; --index >= 0; ) fputs("  ", out);
   }
@@ -3774,13 +3770,13 @@ nsGenericContainerElement::ChildCount(PRInt32& aCount) const
 
 nsresult
 nsGenericContainerElement::ChildAt(PRInt32 aIndex,
-                                   nsIContent*& aResult) const
+                                   nsIContent** aResult) const
 {
   // I really prefer NOT to do this test on all ChildAt calls - perhaps we
   // should add FastChildAt().
   nsIContent *child = (nsIContent *)mChildren.SafeElementAt(aIndex);
   NS_IF_ADDREF(child);
-  aResult = child;
+  *aResult = child;
 
   return NS_OK;
 }
diff --git a/content/base/src/nsGenericElement.h b/content/base/src/nsGenericElement.h
index cf6de2c36221..9a06f7d637e1 100644
--- a/content/base/src/nsGenericElement.h
+++ b/content/base/src/nsGenericElement.h
@@ -348,19 +348,19 @@ public:
   static void Shutdown();
 
   // nsIContent interface methods
-  NS_IMETHOD GetDocument(nsIDocument*& aResult) const;
+  NS_IMETHOD GetDocument(nsIDocument** aResult) const;
   NS_IMETHOD SetDocument(nsIDocument* aDocument, PRBool aDeep,
                          PRBool aCompileEventHandlers);
-  NS_IMETHOD GetParent(nsIContent*& aResult) const;
+  NS_IMETHOD GetParent(nsIContent** aResult) const;
   NS_IMETHOD SetParent(nsIContent* aParent);
   NS_IMETHOD_(PRBool) IsNativeAnonymous() const;
   NS_IMETHOD_(void) SetNativeAnonymous(PRBool aAnonymous);
-  NS_IMETHOD GetNameSpaceID(PRInt32& aNameSpaceID) const;
-  NS_IMETHOD GetTag(nsIAtom*& aResult) const;
-  NS_IMETHOD GetNodeInfo(nsINodeInfo*& aResult) const;
+  NS_IMETHOD GetNameSpaceID(PRInt32* aNameSpaceID) const;
+  NS_IMETHOD GetTag(nsIAtom** aResult) const;
+  NS_IMETHOD GetNodeInfo(nsINodeInfo** aResult) const;
   // NS_IMETHOD CanContainChildren(PRBool& aResult) const;
   // NS_IMETHOD ChildCount(PRInt32& aResult) const;
-  // NS_IMETHOD ChildAt(PRInt32 aIndex, nsIContent*& aResult) const;
+  // NS_IMETHOD ChildAt(PRInt32 aIndex, nsIContent** aResult) const;
   // NS_IMETHOD IndexOf(nsIContent* aPossibleChild, PRInt32& aResult) const;
   // NS_IMETHOD InsertChildAt(nsIContent* aKid, PRInt32 aIndex,
   //                          PRBool aNotify);
@@ -369,7 +369,7 @@ public:
   // NS_IMETHOD AppendChildTo(nsIContent* aKid, PRBool aNotify);
   // NS_IMETHOD RemoveChildAt(PRInt32 aIndex, PRBool aNotify);
   // NS_IMETHOD NormalizeAttrString(const nsAString& aStr,
-  //                                nsINodeInfo*& aNodeInfo);
+  //                                nsINodeInfo** aNodeInfo);
   // NS_IMETHOD SetAttr(PRInt32 aNameSpaceID, nsIAtom* aName, 
   //                    const nsAString& aValue,
   //                    PRBool aNotify);
@@ -379,14 +379,14 @@ public:
   // NS_IMETHOD GetAttr(PRInt32 aNameSpaceID, nsIAtom* aName, 
   //                    nsAString& aResult) const;
   // NS_IMETHOD GetAttr(PRInt32 aNameSpaceID, nsIAtom* aName, 
-  //                    nsIAtom*& aPrefix,
+  //                    nsIAtom** aPrefix,
   //                    nsAString& aResult) const;
   // NS_IMETHOD UnsetAttr(PRInt32 aNameSpaceID, nsIAtom* aAttribute, 
   //                      PRBool aNotify);
   // NS_IMETHOD GetAttrNameAt(PRInt32 aIndex,
   //                          PRInt32& aNameSpaceID, 
-  //                          nsIAtom*& aName,
-  //                          nsIAtom*& aPrefix) const;
+  //                          nsIAtom** aName,
+  //                          nsIAtom** aPrefix) const;
   // NS_IMETHOD GetAttrCount(PRInt32& aResult) const;
 #ifdef DEBUG
   // NS_IMETHOD List(FILE* out, PRInt32 aIndent) const;
@@ -394,7 +394,7 @@ public:
 #endif
   NS_IMETHOD RangeAdd(nsIDOMRange* aRange);
   NS_IMETHOD RangeRemove(nsIDOMRange* aRange);
-  NS_IMETHOD GetRangeList(nsVoidArray*& aResult) const;
+  NS_IMETHOD GetRangeList(nsVoidArray** aResult) const;
   NS_IMETHOD HandleDOMEvent(nsIPresContext* aPresContext,
                             nsEvent* aEvent,
                             nsIDOMEvent** aDOMEvent,
@@ -412,7 +412,7 @@ public:
 
 
   // nsIStyledContent interface methods
-  NS_IMETHOD GetID(nsIAtom*& aResult) const;
+  NS_IMETHOD GetID(nsIAtom** aResult) const;
   NS_IMETHOD GetClasses(nsVoidArray& aArray) const;
   NS_IMETHOD_(PRBool) HasClass(nsIAtom* aClass, PRBool aCaseSensitive) const;
   NS_IMETHOD WalkContentStyleRules(nsRuleWalker* aRuleWalker);
@@ -438,7 +438,7 @@ public:
   NS_IMETHOD StringToAttribute(nsIAtom* aAttribute,
                                const nsAString& aValue,
                                nsHTMLValue& aResult);
-  NS_IMETHOD GetBaseURL(nsIURI*& aBaseURL) const;
+  NS_IMETHOD GetBaseURL(nsIURI** aBaseURL) const;
   NS_IMETHOD GetBaseTarget(nsAString& aBaseTarget) const;
 
   // nsIDOMNode method implementation
@@ -761,7 +761,7 @@ public:
 
   // Remainder of nsIContent
   NS_IMETHOD NormalizeAttrString(const nsAString& aStr,
-                                 nsINodeInfo*& aNodeInfo);
+                                 nsINodeInfo** aNodeInfo);
   NS_IMETHOD SetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
                      const nsAString& aValue,
                      PRBool aNotify);
@@ -771,14 +771,14 @@ public:
   NS_IMETHOD GetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
                      nsAString& aResult) const;
   NS_IMETHOD GetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
-                     nsIAtom*& aPrefix, nsAString& aResult) const;
+                     nsIAtom** aPrefix, nsAString& aResult) const;
   NS_IMETHOD_(PRBool) HasAttr(PRInt32 aNameSpaceID, nsIAtom* aName) const;
   NS_IMETHOD UnsetAttr(PRInt32 aNameSpaceID, nsIAtom* aAttribute,
                        PRBool aNotify);
   NS_IMETHOD GetAttrNameAt(PRInt32 aIndex,
-                           PRInt32& aNameSpaceID,
-                           nsIAtom*& aName,
-                           nsIAtom*& aPrefix) const;
+                           PRInt32* aNameSpaceID,
+                           nsIAtom** aName,
+                           nsIAtom** aPrefix) const;
   NS_IMETHOD GetAttrCount(PRInt32& aResult) const;
 #ifdef DEBUG
   NS_IMETHOD List(FILE* out, PRInt32 aIndent) const;
@@ -786,7 +786,7 @@ public:
 #endif
   NS_IMETHOD CanContainChildren(PRBool& aResult) const;
   NS_IMETHOD ChildCount(PRInt32& aResult) const;
-  NS_IMETHOD ChildAt(PRInt32 aIndex, nsIContent*& aResult) const;
+  NS_IMETHOD ChildAt(PRInt32 aIndex, nsIContent** aResult) const;
   NS_IMETHOD IndexOf(nsIContent* aPossibleChild, PRInt32& aResult) const;
   NS_IMETHOD InsertChildAt(nsIContent* aKid, PRInt32 aIndex, PRBool aNotify,
                            PRBool aDeepSetDocument);
diff --git a/content/base/src/nsHTMLContentSerializer.cpp b/content/base/src/nsHTMLContentSerializer.cpp
index e07747ab5257..e93157fc1ec8 100644
--- a/content/base/src/nsHTMLContentSerializer.cpp
+++ b/content/base/src/nsHTMLContentSerializer.cpp
@@ -574,9 +574,9 @@ nsHTMLContentSerializer::SerializeAttributes(nsIContent* aContent,
   
   for (index = 0; index < count; index++) {
     aContent->GetAttrNameAt(index, 
-                            namespaceID,
-                            *getter_AddRefs(attrName),
-                            *getter_AddRefs(attrPrefix));
+                            &namespaceID,
+                            getter_AddRefs(attrName),
+                            getter_AddRefs(attrPrefix));
 
     // Filter out any attribute starting with [-|_]moz
     const char* sharedName;
@@ -621,10 +621,10 @@ nsHTMLContentSerializer::SerializeAttributes(nsIContent* aContent,
         // search the tag list for CODEBASE as well.
         // For now, just leave them relative.
         nsCOMPtr<nsIDocument> document;
-        aContent->GetDocument(*getter_AddRefs(document));
+        aContent->GetDocument(getter_AddRefs(document));
         if (document) {
           nsCOMPtr<nsIURI> uri;
-          document->GetBaseURL(*getter_AddRefs(uri));
+          document->GetBaseURL(getter_AddRefs(uri));
           if (!uri)
             document->GetDocumentURL(getter_AddRefs(uri));
           if (uri) {
@@ -681,7 +681,7 @@ nsHTMLContentSerializer::AppendElementStart(nsIDOMElement *aElement,
   PRBool hasDirtyAttr = HasDirtyAttr(content);
 
   nsCOMPtr<nsIAtom> name;
-  content->GetTag(*getter_AddRefs(name));
+  content->GetTag(getter_AddRefs(name));
 
   if (name.get() == nsHTMLAtoms::br && mPreLevel > 0
       && (mFlags & nsIDocumentEncoder::OutputNoFormattingInPre)) {
@@ -795,7 +795,7 @@ nsHTMLContentSerializer::AppendElementEnd(nsIDOMElement *aElement,
   PRBool hasDirtyAttr = HasDirtyAttr(content);
 
   nsCOMPtr<nsIAtom> name;
-  content->GetTag(*getter_AddRefs(name));
+  content->GetTag(getter_AddRefs(name));
 
   if ((name.get() == nsHTMLAtoms::pre) ||
       (name.get() == nsHTMLAtoms::script) ||
diff --git a/content/base/src/nsImageLoadingContent.cpp b/content/base/src/nsImageLoadingContent.cpp
index 5f62cc8b3edd..d6f49b999439 100644
--- a/content/base/src/nsImageLoadingContent.cpp
+++ b/content/base/src/nsImageLoadingContent.cpp
@@ -460,13 +460,13 @@ nsImageLoadingContent::ImageURIChanged(const nsACString& aNewURI)
   NS_ENSURE_TRUE(thisContent, rv);
 
   nsCOMPtr<nsIDocument> tempDoc;
-  thisContent->GetDocument(*getter_AddRefs(tempDoc));
+  thisContent->GetDocument(getter_AddRefs(tempDoc));
   if (!doc) {
     return NS_OK;
   }
 
   nsCOMPtr<nsIContent> parent;
-  thisContent->GetParent(*getter_AddRefs(parent));
+  thisContent->GetParent(getter_AddRefs(parent));
   if (!parent) {
     return NS_OK;
   }
@@ -562,12 +562,12 @@ nsImageLoadingContent::GetOurDocument(nsIDocument** aDocument)
   nsCOMPtr<nsIContent> thisContent = do_QueryInterface(this, &rv);
   NS_ENSURE_TRUE(thisContent, rv);
 
-  rv = thisContent->GetDocument(*aDocument);
+  rv = thisContent->GetDocument(aDocument);
   if (!*aDocument) {  // nodeinfo time
     nsCOMPtr<nsINodeInfo> nodeInfo;
-    rv = thisContent->GetNodeInfo(*getter_AddRefs(nodeInfo));
+    rv = thisContent->GetNodeInfo(getter_AddRefs(nodeInfo));
     if (nodeInfo) {
-      rv = nodeInfo->GetDocument(*aDocument);
+      rv = nodeInfo->GetDocument(aDocument);
     }
   }
 
@@ -588,9 +588,9 @@ nsImageLoadingContent::StringToURI(const nsACString& aSpec,
   nsCOMPtr<nsIURI> baseURL;
   nsCOMPtr<nsIHTMLContent> thisContent = do_QueryInterface(this);
   if (thisContent) {
-    rv = thisContent->GetBaseURL(*getter_AddRefs(baseURL));
+    rv = thisContent->GetBaseURL(getter_AddRefs(baseURL));
   } else {
-    rv = aDocument->GetBaseURL(*getter_AddRefs(baseURL));
+    rv = aDocument->GetBaseURL(getter_AddRefs(baseURL));
     if (!baseURL) {
       rv = aDocument->GetDocumentURL(getter_AddRefs(baseURL));
     }
diff --git a/content/base/src/nsNameSpaceManager.cpp b/content/base/src/nsNameSpaceManager.cpp
index 926404a7c27e..8d4dcdc2a5c8 100644
--- a/content/base/src/nsNameSpaceManager.cpp
+++ b/content/base/src/nsNameSpaceManager.cpp
@@ -78,20 +78,20 @@ public:
 
   NS_DECL_ISUPPORTS
 
-  NS_IMETHOD GetNameSpaceID(PRInt32& aID) const;
+  NS_IMETHOD GetNameSpaceID(PRInt32* aID) const;
   NS_IMETHOD GetNameSpaceURI(nsAString& aURI) const;
-  NS_IMETHOD GetNameSpacePrefix(nsIAtom*& aPrefix) const;
+  NS_IMETHOD GetNameSpacePrefix(nsIAtom** aPrefix) const;
 
-  NS_IMETHOD GetParentNameSpace(nsINameSpace*& aParent) const;
+  NS_IMETHOD GetParentNameSpace(nsINameSpace** aParent) const;
 
-  NS_IMETHOD FindNameSpace(nsIAtom* aPrefix, nsINameSpace*& aNameSpace) const;
-  NS_IMETHOD FindNameSpaceID(nsIAtom* aPrefix, PRInt32& aNameSpaceID) const;
-  NS_IMETHOD FindNameSpacePrefix(PRInt32 aNameSpaceID, nsIAtom*& aPrefix) const;
+  NS_IMETHOD FindNameSpace(nsIAtom* aPrefix, nsINameSpace** aNameSpace) const;
+  NS_IMETHOD FindNameSpaceID(nsIAtom* aPrefix, PRInt32* aNameSpaceID) const;
+  NS_IMETHOD FindNameSpacePrefix(PRInt32 aNameSpaceID, nsIAtom** aPrefix) const;
 
   NS_IMETHOD CreateChildNameSpace(nsIAtom* aPrefix, const nsAString& aURI,
-                                  nsINameSpace*& aChildNameSpace);
+                                  nsINameSpace** aChildNameSpace);
   NS_IMETHOD CreateChildNameSpace(nsIAtom* aPrefix, PRInt32 aNameSpaceID,
-                                  nsINameSpace*& aChildNameSpace);
+                                  nsINameSpace** aChildNameSpace);
 
 private:
   // These are not supported and are not implemented!
@@ -131,9 +131,9 @@ NameSpaceImpl::~NameSpaceImpl()
 NS_IMPL_ISUPPORTS1(NameSpaceImpl, nsINameSpace)
 
 NS_IMETHODIMP
-NameSpaceImpl::GetNameSpaceID(PRInt32& aID) const
+NameSpaceImpl::GetNameSpaceID(PRInt32* aID) const
 {
-  aID = mID;
+  *aID = mID;
 
   return NS_OK;
 }
@@ -145,51 +145,49 @@ NameSpaceImpl::GetNameSpaceURI(nsAString& aURI) const
 }
 
 NS_IMETHODIMP
-NameSpaceImpl::GetNameSpacePrefix(nsIAtom*& aPrefix) const
+NameSpaceImpl::GetNameSpacePrefix(nsIAtom** aPrefix) const
 {
-  aPrefix = mPrefix;
-  NS_IF_ADDREF(aPrefix);
+  NS_IF_ADDREF(*aPrefix = mPrefix);
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
-NameSpaceImpl::GetParentNameSpace(nsINameSpace*& aParent) const
+NameSpaceImpl::GetParentNameSpace(nsINameSpace** aParent) const
 {
-  aParent = mParent;
-  NS_IF_ADDREF(aParent);
+  NS_IF_ADDREF(*aParent = mParent);
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
-NameSpaceImpl::FindNameSpace(nsIAtom* aPrefix, nsINameSpace*& aNameSpace) const
+NameSpaceImpl::FindNameSpace(nsIAtom* aPrefix, nsINameSpace** aNameSpace) const
 {
   const NameSpaceImpl* nameSpace = this;
 
   do {
     if (aPrefix == nameSpace->mPrefix) {
-      aNameSpace = (nsINameSpace*)nameSpace;
-      NS_ADDREF(aNameSpace);
+      *aNameSpace = (nsINameSpace*)nameSpace;
+      NS_ADDREF(*aNameSpace);
 
       return NS_OK;
     }
     nameSpace = nameSpace->mParent;
   } while (nameSpace);
 
-  aNameSpace = nsnull;
+  *aNameSpace = nsnull;
 
   return NS_ERROR_ILLEGAL_VALUE;
 }
 
 NS_IMETHODIMP
-NameSpaceImpl::FindNameSpaceID(nsIAtom* aPrefix, PRInt32& aNameSpaceID) const
+NameSpaceImpl::FindNameSpaceID(nsIAtom* aPrefix, PRInt32* aNameSpaceID) const
 {
   const NameSpaceImpl* nameSpace = this;
 
   do {
     if (aPrefix == nameSpace->mPrefix) {
-      aNameSpaceID = nameSpace->mID;
+      *aNameSpaceID = nameSpace->mID;
 
       return NS_OK;
     }
@@ -197,51 +195,51 @@ NameSpaceImpl::FindNameSpaceID(nsIAtom* aPrefix, PRInt32& aNameSpaceID) const
   } while (nameSpace);
 
   if (!aPrefix) {
-    aNameSpaceID = kNameSpaceID_None;
+    *aNameSpaceID = kNameSpaceID_None;
   }
   else {
-    aNameSpaceID = kNameSpaceID_Unknown;
+    *aNameSpaceID = kNameSpaceID_Unknown;
   }
 
   return NS_ERROR_ILLEGAL_VALUE;
 }
 
 NS_IMETHODIMP
-NameSpaceImpl::FindNameSpacePrefix(PRInt32 aNameSpaceID, nsIAtom*& aPrefix) const 
+NameSpaceImpl::FindNameSpacePrefix(PRInt32 aNameSpaceID,
+                                   nsIAtom** aPrefix) const
 {
   const NameSpaceImpl* nameSpace = this;
 
   do {
     if (aNameSpaceID == nameSpace->mID) {
-      aPrefix = nameSpace->mPrefix;
-      NS_IF_ADDREF(aPrefix);
+      NS_IF_ADDREF(*aPrefix = nameSpace->mPrefix);
 
       return NS_OK;
     }
     nameSpace = nameSpace->mParent;
   } while (nameSpace);
 
-  aPrefix = nsnull;
+  *aPrefix = nsnull;
 
   return NS_ERROR_ILLEGAL_VALUE;
 }
 
 NS_IMETHODIMP
 NameSpaceImpl::CreateChildNameSpace(nsIAtom* aPrefix, const nsAString& aURI,
-                                    nsINameSpace*& aChildNameSpace)
+                                    nsINameSpace** aChildNameSpace)
 {
   NameSpaceImpl* child = new NameSpaceImpl(this, aPrefix, aURI);
   NS_ENSURE_TRUE(child, NS_ERROR_OUT_OF_MEMORY);
 
-  aChildNameSpace = NS_STATIC_CAST(nsINameSpace*, child);
-  NS_ADDREF(aChildNameSpace);
+  *aChildNameSpace = NS_STATIC_CAST(nsINameSpace*, child);
+  NS_ADDREF(*aChildNameSpace);
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 NameSpaceImpl::CreateChildNameSpace(nsIAtom* aPrefix, PRInt32 aNameSpaceID,
-                                    nsINameSpace*& aChildNameSpace)
+                                    nsINameSpace** aChildNameSpace)
 {
   PRBool hasNSURI;
   gNameSpaceManager->HasNameSpaceURI(aNameSpaceID, &hasNSURI);
@@ -249,12 +247,12 @@ NameSpaceImpl::CreateChildNameSpace(nsIAtom* aPrefix, PRInt32 aNameSpaceID,
     NameSpaceImpl* child = new NameSpaceImpl(this, aPrefix, aNameSpaceID);
     NS_ENSURE_TRUE(child, NS_ERROR_OUT_OF_MEMORY);
 
-    aChildNameSpace = NS_STATIC_CAST(nsINameSpace*, child);
-    NS_ADDREF(aChildNameSpace);
+    *aChildNameSpace = NS_STATIC_CAST(nsINameSpace*, child);
+    NS_ADDREF(*aChildNameSpace);
 
     return NS_OK;
   }
-  aChildNameSpace = nsnull;
+  *aChildNameSpace = nsnull;
 
   return NS_ERROR_ILLEGAL_VALUE;
 }
@@ -315,14 +313,14 @@ public:
 
   nsresult Init();
 
-  NS_IMETHOD CreateRootNameSpace(nsINameSpace*& aRootNameSpace);
+  NS_IMETHOD CreateRootNameSpace(nsINameSpace** aRootNameSpace);
 
   NS_IMETHOD RegisterNameSpace(const nsAString& aURI, 
 			                         PRInt32& aNameSpaceID);
 
   NS_IMETHOD GetNameSpaceURI(PRInt32 aNameSpaceID, nsAString& aURI);
   NS_IMETHOD GetNameSpaceID(const nsAString& aURI,
-                            PRInt32& aNameSpaceID);
+                            PRInt32* aNameSpaceID);
   NS_IMETHOD GetElementFactory(PRInt32 aNameSpaceID,
                                nsIElementFactory **aElementFactory);
   NS_IMETHOD HasRegisteredFactory(PRInt32 aNameSpaceID,
@@ -374,10 +372,10 @@ nsresult NameSpaceManagerImpl::Init()
 }
 
 NS_IMETHODIMP
-NameSpaceManagerImpl::CreateRootNameSpace(nsINameSpace*& aRootNameSpace)
+NameSpaceManagerImpl::CreateRootNameSpace(nsINameSpace** aRootNameSpace)
 {
   nsresult  rv = NS_ERROR_OUT_OF_MEMORY;
-  aRootNameSpace = nsnull;
+  *aRootNameSpace = nsnull;
 
   NameSpaceImpl* xmlns = new NameSpaceImpl(nsnull,
                                            nsLayoutAtoms::xmlnsNameSpace,
@@ -387,7 +385,7 @@ NameSpaceManagerImpl::CreateRootNameSpace(nsINameSpace*& aRootNameSpace)
                                            nsLayoutAtoms::xmlNameSpace,
                                            kNameSpaceID_XML);
     if (xml) {
-      rv = CallQueryInterface(xml, &aRootNameSpace);
+      rv = CallQueryInterface(xml, aRootNameSpace);
     }
     else {
       delete xmlns;
@@ -440,17 +438,17 @@ NameSpaceManagerImpl::GetNameSpaceURI(PRInt32 aNameSpaceID, nsAString& aURI)
 }
 
 NS_IMETHODIMP
-NameSpaceManagerImpl::GetNameSpaceID(const nsAString& aURI, PRInt32& aNameSpaceID)
+NameSpaceManagerImpl::GetNameSpaceID(const nsAString& aURI, PRInt32* aNameSpaceID)
 {
   if (aURI.IsEmpty()) {
-    aNameSpaceID = kNameSpaceID_None; // xmlns="", see bug 75700 for details
+    *aNameSpaceID = kNameSpaceID_None; // xmlns="", see bug 75700 for details
 
     return NS_OK;
   }
 
   nsNameSpaceEntry* entry = mURIToIDTable.GetEntry(aURI);
 
-  aNameSpaceID = entry ? entry->mNameSpaceID : kNameSpaceID_Unknown;
+  *aNameSpaceID = entry ? entry->mNameSpaceID : kNameSpaceID_Unknown;
 
   return NS_OK;
 }
diff --git a/content/base/src/nsNodeInfo.cpp b/content/base/src/nsNodeInfo.cpp
index fb6d308acaa6..6dad08833495 100644
--- a/content/base/src/nsNodeInfo.cpp
+++ b/content/base/src/nsNodeInfo.cpp
@@ -170,11 +170,9 @@ nsNodeInfo::SetIDAttributeAtom(nsIAtom* aID)
 
 
 NS_IMETHODIMP
-nsNodeInfo::GetNodeInfoManager(nsINodeInfoManager*& aNodeInfoManager) const
+nsNodeInfo::GetNodeInfoManager(nsINodeInfoManager** aNodeInfoManager) const
 {
-  aNodeInfoManager = mOwnerManager;
-
-  NS_ADDREF(aNodeInfoManager);
+  NS_ADDREF(*aNodeInfoManager = mOwnerManager);
 
   return NS_OK;
 }
@@ -227,7 +225,7 @@ NS_IMETHODIMP_(PRBool)
 nsNodeInfo::NamespaceEquals(const nsAString& aNamespaceURI) const
 {
   PRInt32 nsid;
-  nsContentUtils::GetNSManagerWeakRef()->GetNameSpaceID(aNamespaceURI, nsid);
+  nsContentUtils::GetNSManagerWeakRef()->GetNameSpaceID(aNamespaceURI, &nsid);
 
   return nsINodeInfo::NamespaceEquals(nsid);
 }
@@ -276,7 +274,7 @@ nsNodeInfo::QualifiedNameEquals(const nsACString& aQualifiedName) const
 }
 
 NS_IMETHODIMP
-nsNodeInfo::NameChanged(nsIAtom *aName, nsINodeInfo*& aResult)
+nsNodeInfo::NameChanged(nsIAtom *aName, nsINodeInfo** aResult)
 {
   return mOwnerManager->GetNodeInfo(aName, mInner.mPrefix, mInner.mNamespaceID,
                                     aResult);
@@ -284,14 +282,14 @@ nsNodeInfo::NameChanged(nsIAtom *aName, nsINodeInfo*& aResult)
 
 
 NS_IMETHODIMP
-nsNodeInfo::PrefixChanged(nsIAtom *aPrefix, nsINodeInfo*& aResult)
+nsNodeInfo::PrefixChanged(nsIAtom *aPrefix, nsINodeInfo** aResult)
 {
   return mOwnerManager->GetNodeInfo(mInner.mName, aPrefix, mInner.mNamespaceID,
                                     aResult);
 }
 
 NS_IMETHODIMP
-nsNodeInfo::GetDocument(nsIDocument*& aDocument) const
+nsNodeInfo::GetDocument(nsIDocument** aDocument) const
 {
   return mOwnerManager->GetDocument(aDocument);
 }
diff --git a/content/base/src/nsNodeInfo.h b/content/base/src/nsNodeInfo.h
index 9fcebf9c83dd..2e7c297edf06 100644
--- a/content/base/src/nsNodeInfo.h
+++ b/content/base/src/nsNodeInfo.h
@@ -57,7 +57,7 @@ public:
   NS_IMETHOD GetNamespaceURI(nsAString& aNameSpaceURI) const;
   NS_IMETHOD GetIDAttributeAtom(nsIAtom** aResult) const;
   NS_IMETHOD SetIDAttributeAtom(nsIAtom* aResult);
-  NS_IMETHOD GetNodeInfoManager(nsINodeInfoManager*& aNodeInfoManager) const;
+  NS_IMETHOD GetNodeInfoManager(nsINodeInfoManager** aNodeInfoManager) const;
   NS_IMETHOD_(PRBool) Equals(const nsAString& aName) const;
   NS_IMETHOD_(PRBool) Equals(const nsAString& aName,
                              const nsAString& aPrefix) const;
@@ -68,9 +68,9 @@ public:
   NS_IMETHOD_(PRBool) NamespaceEquals(const nsAString& aNamespaceURI) const;
   NS_IMETHOD_(PRBool) QualifiedNameEquals(const nsACString& aQualifiedName) const;
 
-  NS_IMETHOD NameChanged(nsIAtom *aName, nsINodeInfo*& aResult);
-  NS_IMETHOD PrefixChanged(nsIAtom *aPrefix, nsINodeInfo*& aResult);
-  NS_IMETHOD GetDocument(nsIDocument*& aDocument) const;
+  NS_IMETHOD NameChanged(nsIAtom *aName, nsINodeInfo** aResult);
+  NS_IMETHOD PrefixChanged(nsIAtom *aPrefix, nsINodeInfo** aResult);
+  NS_IMETHOD GetDocument(nsIDocument** aDocument) const;
   NS_IMETHOD GetDocumentPrincipal(nsIPrincipal** aPrincipal) const;
 
   // nsNodeInfo
diff --git a/content/base/src/nsNodeInfoManager.cpp b/content/base/src/nsNodeInfoManager.cpp
index 9149290c93d1..ba9ed87a4a87 100644
--- a/content/base/src/nsNodeInfoManager.cpp
+++ b/content/base/src/nsNodeInfoManager.cpp
@@ -185,7 +185,7 @@ nsNodeInfoManager::DropDocumentReference()
 
 NS_IMETHODIMP
 nsNodeInfoManager::GetNodeInfo(nsIAtom *aName, nsIAtom *aPrefix,
-                               PRInt32 aNamespaceID, nsINodeInfo*& aNodeInfo)
+                               PRInt32 aNamespaceID, nsINodeInfo** aNodeInfo)
 {
   NS_ENSURE_ARG_POINTER(aName);
 
@@ -194,9 +194,9 @@ nsNodeInfoManager::GetNodeInfo(nsIAtom *aName, nsIAtom *aPrefix,
   void *node = PL_HashTableLookup(mNodeInfoHash, &tmpKey);
 
   if (node) {
-    aNodeInfo = NS_STATIC_CAST(nsINodeInfo *, node);
+    *aNodeInfo = NS_STATIC_CAST(nsINodeInfo *, node);
 
-    NS_ADDREF(aNodeInfo);
+    NS_ADDREF(*aNodeInfo);
 
     return NS_OK;
   }
@@ -213,7 +213,7 @@ nsNodeInfoManager::GetNodeInfo(nsIAtom *aName, nsIAtom *aPrefix,
   he = PL_HashTableAdd(mNodeInfoHash, &newNodeInfo->mInner, newNodeInfo);
   NS_ENSURE_TRUE(he, NS_ERROR_OUT_OF_MEMORY);
 
-  aNodeInfo = newNodeInfo;
+  *aNodeInfo = newNodeInfo;
 
   return NS_OK;
 }
@@ -221,7 +221,7 @@ nsNodeInfoManager::GetNodeInfo(nsIAtom *aName, nsIAtom *aPrefix,
 
 NS_IMETHODIMP
 nsNodeInfoManager::GetNodeInfo(const nsAString& aName, nsIAtom *aPrefix,
-                               PRInt32 aNamespaceID, nsINodeInfo*& aNodeInfo)
+                               PRInt32 aNamespaceID, nsINodeInfo** aNodeInfo)
 {
   NS_ENSURE_ARG(!aName.IsEmpty());
 
@@ -235,7 +235,7 @@ nsNodeInfoManager::GetNodeInfo(const nsAString& aName, nsIAtom *aPrefix,
 NS_IMETHODIMP
 nsNodeInfoManager::GetNodeInfo(const nsAString& aName,
                                const nsAString& aPrefix, PRInt32 aNamespaceID,
-                               nsINodeInfo*& aNodeInfo)
+                               nsINodeInfo** aNodeInfo)
 {
   NS_ENSURE_ARG(!aName.IsEmpty());
 
@@ -257,7 +257,7 @@ NS_IMETHODIMP
 nsNodeInfoManager::GetNodeInfo(const nsAString& aName,
                                const nsAString& aPrefix,
                                const nsAString& aNamespaceURI,
-                               nsINodeInfo*& aNodeInfo)
+                               nsINodeInfo** aNodeInfo)
 {
   NS_ENSURE_ARG(!aName.IsEmpty());
 
@@ -282,7 +282,7 @@ nsNodeInfoManager::GetNodeInfo(const nsAString& aName,
 NS_IMETHODIMP
 nsNodeInfoManager::GetNodeInfo(const nsAString& aQualifiedName,
                                const nsAString& aNamespaceURI,
-                               nsINodeInfo*& aNodeInfo)
+                               nsINodeInfo** aNodeInfo)
 {
   NS_ENSURE_ARG(!aQualifiedName.IsEmpty());
 
@@ -315,11 +315,9 @@ nsNodeInfoManager::GetNodeInfo(const nsAString& aQualifiedName,
 }
 
 NS_IMETHODIMP
-nsNodeInfoManager::GetDocument(nsIDocument*& aDocument)
+nsNodeInfoManager::GetDocument(nsIDocument** aDocument)
 {
-  aDocument = mDocument;
-
-  NS_IF_ADDREF(aDocument);
+  NS_IF_ADDREF(*aDocument = mDocument);
 
   return NS_OK;
 }
@@ -407,7 +405,7 @@ nsNodeInfoManager::RemoveNodeInfo(nsNodeInfo *aNodeInfo)
 
 
 nsresult
-nsNodeInfoManager::GetAnonymousManager(nsINodeInfoManager*& aNodeInfoManager)
+nsNodeInfoManager::GetAnonymousManager(nsINodeInfoManager** aNodeInfoManager)
 {
   if (!gAnonymousNodeInfoManager) {
     gAnonymousNodeInfoManager = new nsNodeInfoManager;
@@ -418,7 +416,7 @@ nsNodeInfoManager::GetAnonymousManager(nsINodeInfoManager*& aNodeInfoManager)
     NS_ADDREF(gAnonymousNodeInfoManager);
   }
 
-  aNodeInfoManager = gAnonymousNodeInfoManager;
+  *aNodeInfoManager = gAnonymousNodeInfoManager;
 
   /*
    * If the only nodeinfo manager is the global one we don't hold a ref
@@ -426,7 +424,7 @@ nsNodeInfoManager::GetAnonymousManager(nsINodeInfoManager*& aNodeInfoManager)
    * even if it's the last one arround.
    */
   if (gNodeManagerCount > 1) {
-    NS_ADDREF(aNodeInfoManager);
+    NS_ADDREF(*aNodeInfoManager);
   }
 
   return NS_OK;
diff --git a/content/base/src/nsNodeInfoManager.h b/content/base/src/nsNodeInfoManager.h
index a991fc7ff775..816b105aa0a6 100644
--- a/content/base/src/nsNodeInfoManager.h
+++ b/content/base/src/nsNodeInfoManager.h
@@ -57,18 +57,18 @@ public:
   NS_IMETHOD Init(nsIDocument *aDocument);
   NS_IMETHOD DropDocumentReference();
   NS_IMETHOD GetNodeInfo(nsIAtom *aName, nsIAtom *aPrefix,
-                         PRInt32 aNamespaceID, nsINodeInfo*& aNodeInfo);
+                         PRInt32 aNamespaceID, nsINodeInfo** aNodeInfo);
   NS_IMETHOD GetNodeInfo(const nsAString& aName, nsIAtom *aPrefix,
-                         PRInt32 aNamespaceID, nsINodeInfo*& aNodeInfo);
+                         PRInt32 aNamespaceID, nsINodeInfo** aNodeInfo);
   NS_IMETHOD GetNodeInfo(const nsAString& aName, const nsAString& aPrefix,
-                         PRInt32 aNamespaceID, nsINodeInfo*& aNodeInfo);
+                         PRInt32 aNamespaceID, nsINodeInfo** aNodeInfo);
   NS_IMETHOD GetNodeInfo(const nsAString& aName, const nsAString& aPrefix,
                          const nsAString& aNamespaceURI,
-                         nsINodeInfo*& aNodeInfo);
+                         nsINodeInfo** aNodeInfo);
   NS_IMETHOD GetNodeInfo(const nsAString& aQualifiedName,
                          const nsAString& aNamespaceURI,
-                         nsINodeInfo*& aNodeInfo); 
-  NS_IMETHOD GetDocument(nsIDocument*& aDocument);
+                         nsINodeInfo** aNodeInfo);
+  NS_IMETHOD GetDocument(nsIDocument** aDocument);
   NS_IMETHOD GetDocumentPrincipal(nsIPrincipal** aPrincipal);
   NS_IMETHOD SetDocumentPrincipal(nsIPrincipal* aPrincipal);
   NS_IMETHOD GetNodeInfoArray(nsISupportsArray** aArray);
@@ -79,7 +79,7 @@ public:
 
   void RemoveNodeInfo(nsNodeInfo *aNodeInfo);
 
-  static nsresult GetAnonymousManager(nsINodeInfoManager*& aNodeInfoManager);
+  static nsresult GetAnonymousManager(nsINodeInfoManager** aNodeInfoManager);
 
 private:
   static PRIntn PR_CALLBACK NodeInfoInnerKeyCompare(const void *key1,
diff --git a/content/base/src/nsPlainTextSerializer.cpp b/content/base/src/nsPlainTextSerializer.cpp
index f36dbe51e157..fbd3b6b1dae7 100644
--- a/content/base/src/nsPlainTextSerializer.cpp
+++ b/content/base/src/nsPlainTextSerializer.cpp
@@ -1843,7 +1843,7 @@ nsPlainTextSerializer::GetIdForContent(nsIContent* aContent,
   }
 
   nsCOMPtr<nsIAtom> tagname;
-  mContent->GetTag(*getter_AddRefs(tagname));
+  mContent->GetTag(getter_AddRefs(tagname));
   if (!tagname) return NS_ERROR_FAILURE;
   
   nsAutoString namestr;
diff --git a/content/base/src/nsPrintEngine.cpp b/content/base/src/nsPrintEngine.cpp
index 8f3eab353e39..1d5db12d734f 100644
--- a/content/base/src/nsPrintEngine.cpp
+++ b/content/base/src/nsPrintEngine.cpp
@@ -1966,7 +1966,7 @@ nsPrintEngine::MapContentForPO(nsPrintObject*   aRootObject,
   NS_ASSERTION(aContent, "Pointer is null!");
 
   nsCOMPtr<nsIDocument> doc;
-  aContent->GetDocument(*getter_AddRefs(doc));
+  aContent->GetDocument(getter_AddRefs(doc));
 
   if (!doc) {
     NS_ERROR("No document!");
@@ -2025,9 +2025,9 @@ nsPrintEngine::MapContentForPO(nsPrintObject*   aRootObject,
   // walk children content
   PRInt32 count;
   aContent->ChildCount(count);
-  for (PRInt32 i=0;i<count;i++) {
-    nsIContent* child;
-    aContent->ChildAt(i, child);
+  nsCOMPtr<nsIContent> child;
+  for (PRInt32 i = 0; i < count; ++i) {
+    aContent->ChildAt(i, getter_AddRefs(child));
     MapContentForPO(aRootObject, aPresShell, child);
   }
 }
@@ -2757,7 +2757,8 @@ nsPrintEngine::ReflowPrintObject(nsPrintObject * aPO, PRBool aDoCalcShrink)
   // get the old history
   nsCOMPtr<nsIPresShell> presShell;
   nsCOMPtr<nsILayoutHistoryState>  layoutState;
-  NS_ENSURE_SUCCESS(mDocViewer->GetPresShell(*(getter_AddRefs(presShell))), NS_ERROR_FAILURE);
+  rv = mDocViewer->GetPresShell(getter_AddRefs(presShell));
+  NS_ENSURE_SUCCESS(rv, rv);
   presShell->CaptureHistoryState(getter_AddRefs(layoutState), PR_TRUE);
 
   // set it on the new pres shell
@@ -3707,7 +3708,7 @@ nsPrintEngine::FindFrameByType(nsIPresContext* aPresContext,
     child->GetContent(getter_AddRefs(content));
     if (content) {
       nsCOMPtr<nsIAtom> type;
-      content->GetTag(*getter_AddRefs(type));
+      content->GetTag(getter_AddRefs(type));
       if (type.get() == aType) {
         nsRect r;
         child->GetRect(r);
@@ -4000,7 +4001,7 @@ nsPrintEngine::FindFocusedDOMWindowInternal()
   nsCOMPtr<nsIFocusController>    focusController;
   nsIDOMWindowInternal *          domWin = nsnull;
 
-  mDocViewer->GetDocument(*getter_AddRefs(theDoc));
+  mDocViewer->GetDocument(getter_AddRefs(theDoc));
   if(theDoc){
     theDoc->GetScriptGlobalObject(getter_AddRefs(theSGO));
     if(theSGO){
diff --git a/content/base/src/nsRange.cpp b/content/base/src/nsRange.cpp
index f63da0af05bc..d71dac568756 100644
--- a/content/base/src/nsRange.cpp
+++ b/content/base/src/nsRange.cpp
@@ -891,7 +891,7 @@ nsresult nsRange::PopRanges(nsIDOMNode* aDestNode, PRInt32 aOffset, nsIContent*
   iter->CurrentNode(getter_AddRefs(cN));
   while (cN && (NS_ENUMERATOR_FALSE == iter->IsDone()))
   {
-    cN->GetRangeList(theRangeList);
+    cN->GetRangeList(&theRangeList);
     if (theRangeList)
     {
        nsRange* theRange;
@@ -923,7 +923,7 @@ nsresult nsRange::PopRanges(nsIDOMNode* aDestNode, PRInt32 aOffset, nsIContent*
             }          
           }
           // must refresh theRangeList - it might have gone away!
-          cN->GetRangeList(theRangeList);
+          cN->GetRangeList(&theRangeList);
           if (theRangeList)
             theCount = theRangeList->Count();
           else
@@ -2347,7 +2347,7 @@ nsresult nsRange::OwnerChildInserted(nsIContent* aParentNode, PRInt32 aOffset)
   nsCOMPtr<nsIContent> parent( do_QueryInterface(aParentNode) );
   // quick return if no range list
   nsVoidArray *theRangeList;
-  parent->GetRangeList(theRangeList);
+  parent->GetRangeList(&theRangeList);
   if (!theRangeList) return NS_OK;
 
   nsresult res;
@@ -2400,7 +2400,7 @@ nsresult nsRange::OwnerChildRemoved(nsIContent* aParentNode, PRInt32 aOffset, ns
 
   // quick return if no range list
   nsVoidArray *theRangeList;
-  parent->GetRangeList(theRangeList);
+  parent->GetRangeList(&theRangeList);
   if (!theRangeList) return NS_OK;
   
   PRInt32   count = theRangeList->Count();
@@ -2460,7 +2460,7 @@ nsresult nsRange::TextOwnerChanged(nsIContent* aTextNode, PRInt32 aStartChanged,
 
   nsCOMPtr<nsIContent> textNode( do_QueryInterface(aTextNode) );
   nsVoidArray *theRangeList;
-  aTextNode->GetRangeList(theRangeList);
+  aTextNode->GetRangeList(&theRangeList);
   // the caller already checked to see if there was a range list
   
   nsCOMPtr<nsIDOMNode> domNode(do_QueryInterface(textNode));
diff --git a/content/base/src/nsScriptLoader.cpp b/content/base/src/nsScriptLoader.cpp
index ffe4372db299..1ad22044ad96 100644
--- a/content/base/src/nsScriptLoader.cpp
+++ b/content/base/src/nsScriptLoader.cpp
@@ -209,12 +209,11 @@ nsScriptLoader::InNonScriptingContainer(nsIDOMHTMLScriptElement* aScriptElement)
     }
     
     nsCOMPtr<nsINodeInfo> nodeInfo;
-    content->GetNodeInfo(*getter_AddRefs(nodeInfo));
+    content->GetNodeInfo(getter_AddRefs(nodeInfo));
     NS_ASSERTION(nodeInfo, "element without node info");
 
     if (nodeInfo) {
-      nsCOMPtr<nsIAtom> localName;
-      nodeInfo->GetNameAtom(*getter_AddRefs(localName));
+      nsCOMPtr<nsIAtom> localName = nodeInfo->GetNameAtom();
       
       // XXX noframes and noembed are currently unconditionally not
       // displayed and processed. This might change if we support either
@@ -402,7 +401,7 @@ nsScriptLoader::ProcessScriptElement(nsIDOMHTMLScriptElement *aElement,
     nsCOMPtr<nsIURI> baseURI, scriptURI;
     
     // Use the SRC attribute value to load the URL
-    mDocument->GetBaseURL(*getter_AddRefs(baseURI));
+    mDocument->GetBaseURL(getter_AddRefs(baseURI));
     rv = NS_NewURI(getter_AddRefs(scriptURI), src, nsnull, baseURI);
     if (NS_FAILED(rv)) {
       return FireErrorNotification(rv, aElement, aObserver);
diff --git a/content/base/src/nsSelection.cpp b/content/base/src/nsSelection.cpp
index d3a6435b17dc..a56774f1458f 100644
--- a/content/base/src/nsSelection.cpp
+++ b/content/base/src/nsSelection.cpp
@@ -764,7 +764,7 @@ IsValidSelectionPoint(nsSelection *aFrameSel, nsIContent *aContent)
     if (tLimiter && tLimiter != aContent)
     {
       nsCOMPtr<nsIContent> parent;
-      result = aContent->GetParent(*getter_AddRefs(parent));
+      result = aContent->GetParent(getter_AddRefs(parent));
       if (NS_FAILED(result))
         return PR_FALSE;
       if (tLimiter != parent) //if newfocus == the limiter. thats ok. but if not there and not parent bad
@@ -1115,7 +1115,7 @@ nsSelection::GetRootForContentSubtree(nsIContent *aContent, nsIContent **aParent
 
   while (child)
   {
-    result = child->GetParent(*getter_AddRefs(parent));
+    result = child->GetParent(getter_AddRefs(parent));
 
     if (NS_FAILED(result))
       return result;
@@ -1383,7 +1383,7 @@ nsCOMPtr<nsIAtom> GetTag(nsIDOMNode *aNode)
   
   nsCOMPtr<nsIContent> content = do_QueryInterface(aNode);
   if (content)
-    content->GetTag(*getter_AddRefs(atom));
+    content->GetTag(getter_AddRefs(atom));
 
   return atom;
 }
@@ -1398,7 +1398,7 @@ ParentOffset(nsIDOMNode *aNode, nsIDOMNode **aParent, PRInt32 *aChildOffset)
   if (NS_SUCCEEDED(result) && content)
   {
     nsCOMPtr<nsIContent> parent;
-    result = content->GetParent(*getter_AddRefs(parent));
+    result = content->GetParent(getter_AddRefs(parent));
     if (NS_SUCCEEDED(result) && parent)
     {
       result = parent->IndexOf(content, *aChildOffset);
@@ -2743,7 +2743,7 @@ nsSelection::TakeFocus(nsIContent *aNewFocus, PRUint32 aContentOffset,
   nsCOMPtr<nsIDOMNode> domNode;
   nsCOMPtr<nsIContent> parent;
   nsCOMPtr<nsIContent> parent2;
-  if (NS_FAILED(aNewFocus->GetParent(*getter_AddRefs(parent))) || !parent)
+  if (NS_FAILED(aNewFocus->GetParent(getter_AddRefs(parent))) || !parent)
     return NS_ERROR_FAILURE;
   //END HACKHACKHACK /checking for root frames/content
 
@@ -3006,7 +3006,7 @@ nsSelection::GetFrameForNodeOffset(nsIContent *aNode, PRInt32 aOffset, HINT aHin
     
     nsCOMPtr<nsIContent> childNode;
 
-    result = theNode->ChildAt(childIndex, *getter_AddRefs(childNode));
+    result = theNode->ChildAt(childIndex, getter_AddRefs(childNode));
 
     if (NS_FAILED(result))
       return result;
@@ -3338,7 +3338,7 @@ nsSelection::FrameOrParentHasSpecialSelectionStyle(nsIFrame* aFrame, PRUint8 aSe
 static PRBool IsCell(nsIContent *aContent)
 {
   nsCOMPtr<nsIAtom> tag;
-  aContent->GetTag(*getter_AddRefs(tag));
+  aContent->GetTag(getter_AddRefs(tag));
   return (tag == nsHTMLAtoms::td);
 }
 
@@ -3398,7 +3398,10 @@ nsSelection::HandleTableSelection(nsIContent *aParentContent, PRInt32 aContentOf
   if (!parentNode)  return NS_ERROR_FAILURE;
 
   nsCOMPtr<nsIContent> childContent;
-  nsresult result = aParentContent->ChildAt(aContentOffset, *getter_AddRefs(childContent));
+  nsresult result =
+      aParentContent->ChildAt(aContentOffset,
+                              getter_AddRefs(childContent));
+
   if (NS_FAILED(result)) return result;
   if (!childContent)  return NS_ERROR_FAILURE;
 
@@ -3663,7 +3666,7 @@ printf("HandleTableSelection: Unselecting mUnselectCellOnMouseUp; rangeCount=%d\
           // Be sure previous selection is a table cell
           nsCOMPtr<nsIContent> parentContent = do_QueryInterface(parent);
           nsCOMPtr<nsIContent> child;
-          result = parentContent->ChildAt(offset, *getter_AddRefs(child));
+          result = parentContent->ChildAt(offset, getter_AddRefs(child));
           if (NS_FAILED(result)) return result;
           if (child && IsCell(child))
             previousCellParent = parent;
@@ -3904,9 +3907,12 @@ nsSelection::SelectRowOrColumn(nsIContent *aCellContent, PRUint32 aTarget)
 //  but doesn't allow dragging OFF of an existing selection to unselect!
   do {
     // Loop through all cells in column or row
-    result = tableLayout->GetCellDataAt(rowIndex, colIndex, *getter_AddRefs(cellElement),
-                                        curRowIndex, curColIndex, rowSpan, colSpan, 
-                                        actualRowSpan, actualColSpan, isSelected);
+    result = tableLayout->GetCellDataAt(rowIndex, colIndex,
+                                        getter_AddRefs(cellElement),
+                                        curRowIndex, curColIndex,
+                                        rowSpan, colSpan,
+                                        actualRowSpan, actualColSpan,
+                                        isSelected);
     if (NS_FAILED(result)) return result;
     // We're done when cell is not found
     if (!cellElement) break;
@@ -3952,7 +3958,7 @@ nsSelection::GetFirstCellNodeInRange(nsIDOMRange *aRange, nsIDOMNode **aCellNode
 
   nsCOMPtr<nsIContent> parentContent = do_QueryInterface(startParent);
   nsCOMPtr<nsIContent> childContent;
-  result = parentContent->ChildAt(offset, *getter_AddRefs(childContent));
+  result = parentContent->ChildAt(offset, getter_AddRefs(childContent));
   if (NS_FAILED(result)) return result;
   if (!childContent) return NS_ERROR_NULL_POINTER;
   // Don't return node if not a cell
@@ -4097,27 +4103,29 @@ nsSelection::IsInSameTable(nsIContent *aContent1, nsIContent *aContent2, nsICont
 nsresult
 nsSelection::GetParentTable(nsIContent *aCell, nsIContent **aTable)
 {
-  if (!aCell || !aTable)
+  if (!aCell || !aTable) {
     return NS_ERROR_NULL_POINTER;
+  }
 
   nsCOMPtr<nsIContent> parent;
-  nsresult result = aCell->GetParent(*getter_AddRefs(parent));
+  aCell->GetParent(getter_AddRefs(parent));
 
-  while (NS_SUCCEEDED(result) && parent)
-  {  
-    nsIAtom *tag;
-    parent->GetTag(tag);
-    if (tag == nsHTMLAtoms::table)
-    {
+  nsCOMPtr<nsIAtom> tag;
+  while (parent) {
+    parent->GetTag(getter_AddRefs(tag));
+    if (tag == nsHTMLAtoms::table) {
       *aTable = parent;
       NS_ADDREF(*aTable);
+
       return NS_OK;
     }
+
     nsCOMPtr<nsIContent> temp;
-    result = parent->GetParent(*getter_AddRefs(temp));
+    parent->GetParent(getter_AddRefs(temp));
     parent = temp;
   }
-  return result;
+
+  return NS_OK;
 }
 
 nsresult
@@ -4174,7 +4182,7 @@ nsTypedSelection::getTableCellLocationFromRange(nsIDOMRange *aRange, PRInt32 *aS
   if (NS_FAILED(result)) return result;
 
   nsCOMPtr<nsIContent> child;
-  result = content->ChildAt(startOffset, *getter_AddRefs(child));
+  result = content->ChildAt(startOffset, getter_AddRefs(child));
   if (NS_FAILED(result)) return result;
   if (!child) return NS_ERROR_FAILURE;
 
@@ -4305,7 +4313,7 @@ nsTypedSelection::GetTableSelectionType(nsIDOMRange* aRange, PRInt32* aTableSele
     return NS_OK;
 
   nsCOMPtr<nsIAtom> atom;
-  content->GetTag(*getter_AddRefs(atom));
+  content->GetTag(getter_AddRefs(atom));
   if (!atom) return NS_ERROR_FAILURE;
 
   if (atom == nsHTMLAtoms::tr)
@@ -4315,11 +4323,11 @@ nsTypedSelection::GetTableSelectionType(nsIDOMRange* aRange, PRInt32* aTableSele
   else //check to see if we are selecting a table or row (column and all cells not done yet)
   {
     nsCOMPtr<nsIContent> child;
-    result = content->ChildAt(startOffset, *getter_AddRefs(child));
+    result = content->ChildAt(startOffset, getter_AddRefs(child));
     if (NS_FAILED(result)) return result;
     if (!child) return NS_ERROR_FAILURE;
 
-    child->GetTag(*getter_AddRefs(atom));
+    child->GetTag(getter_AddRefs(atom));
     if (!atom) return NS_ERROR_FAILURE;
 
     if (atom == nsHTMLAtoms::table)
@@ -4371,7 +4379,7 @@ nsSelection::AdjustOffsetsFromStyle(nsIFrame *aFrame, PRBool *changeSelection,
   if (selectAllContent)
   {
     nsCOMPtr<nsIContent>  parentContent;
-    rv = selectAllContent->GetParent(*getter_AddRefs(parentContent));
+    rv = selectAllContent->GetParent(getter_AddRefs(parentContent));
     if (parentContent)
     {
       PRInt32 startOffset;
@@ -4382,7 +4390,7 @@ nsSelection::AdjustOffsetsFromStyle(nsIFrame *aFrame, PRBool *changeSelection,
         // hrmm, this is probably anonymous content. Let's go up another level
         // do we need to do this if we get the right frameSelection to start with?
         nsCOMPtr<nsIContent> superParent;
-        parentContent->GetParent(*getter_AddRefs(superParent));
+        parentContent->GetParent(getter_AddRefs(superParent));
         if (superParent)
         {
           PRInt32 superStartOffset;
@@ -4952,7 +4960,7 @@ nsTypedSelection::GetPrimaryFrameForRangeEndpoint(nsIDOMNode *aNode, PRInt32 aOf
     if (aOffset >= 0)
     {
       nsCOMPtr<nsIContent> child;
-      result = content->ChildAt(aOffset, *getter_AddRefs(child));
+      result = content->ChildAt(aOffset, getter_AddRefs(child));
       if (NS_FAILED(result))
         return result;
       if (!child) //out of bounds?
@@ -6080,7 +6088,7 @@ nsTypedSelection::Collapse(nsIDOMNode* aParentNode, PRInt32 aOffset)
     if (!content)
       return NS_ERROR_FAILURE;
     nsCOMPtr<nsIAtom> tag;
-    content->GetTag(*getter_AddRefs(tag));
+    content->GetTag(getter_AddRefs(tag));
     if (tag)
     {
       nsAutoString tagString;
@@ -6870,7 +6878,7 @@ nsTypedSelection::Extend(nsIDOMNode* aParentNode, PRInt32 aOffset)
     nsCOMPtr<nsIContent>content;
     content = do_QueryInterface(aParentNode);
     nsCOMPtr<nsIAtom> tag;
-    content->GetTag(*getter_AddRefs(tag));
+    content->GetTag(getter_AddRefs(tag));
     if (tag)
     {
       nsAutoString tagString;
diff --git a/content/base/src/nsStyleLinkElement.cpp b/content/base/src/nsStyleLinkElement.cpp
index 9a1bc5a7a556..f2b88b308842 100644
--- a/content/base/src/nsStyleLinkElement.cpp
+++ b/content/base/src/nsStyleLinkElement.cpp
@@ -201,7 +201,7 @@ nsStyleLinkElement::UpdateStyleSheet(nsIDocument *aOldDocument,
   NS_ENSURE_TRUE(thisContent, NS_ERROR_FAILURE);
 
   nsCOMPtr<nsIDocument> doc;
-  thisContent->GetDocument(*getter_AddRefs(doc));
+  thisContent->GetDocument(getter_AddRefs(doc));
 
   if (!doc) {
     return NS_OK;
@@ -298,7 +298,7 @@ nsStyleLinkElement::UpdateStyleSheet(nsIDocument *aOldDocument,
     PRInt32 i;
     nsCOMPtr<nsIContent> node;
     for (i = 0; i < count; ++i) {
-      thisContent->ChildAt(i, *getter_AddRefs(node));
+      thisContent->ChildAt(i, getter_AddRefs(node));
       nsCOMPtr<nsIDOMText> tc = do_QueryInterface(node);
       // Ignore nodes that are not DOMText.
       if (!tc) {
diff --git a/content/base/src/nsTextNode.cpp b/content/base/src/nsTextNode.cpp
index 47258fca039b..5c18e6d71f94 100644
--- a/content/base/src/nsTextNode.cpp
+++ b/content/base/src/nsTextNode.cpp
@@ -62,7 +62,7 @@ public:
   NS_FORWARD_NSIDOMTEXT(nsGenericDOMDataNode::)
 
   // nsIContent
-  NS_IMETHOD GetTag(nsIAtom*& aResult) const;
+  NS_IMETHOD GetTag(nsIAtom** aResult) const;
   NS_IMETHOD_(PRBool) IsContentOfType(PRUint32 aFlags);
 #ifdef DEBUG
   NS_IMETHOD List(FILE* out, PRInt32 aIndent) const;
@@ -106,10 +106,10 @@ NS_INTERFACE_MAP_BEGIN(nsTextNode)
 NS_INTERFACE_MAP_END_INHERITING(nsGenericDOMDataNode)
 
 NS_IMETHODIMP
-nsTextNode::GetTag(nsIAtom*& aResult) const
+nsTextNode::GetTag(nsIAtom** aResult) const
 {
-  aResult = nsLayoutAtoms::textTagName;
-  NS_ADDREF(aResult);
+  NS_ADDREF(*aResult = nsLayoutAtoms::textTagName);
+
   return NS_OK;
 }
 
diff --git a/content/base/src/nsTreeWalker.cpp b/content/base/src/nsTreeWalker.cpp
index 060cd0d2d15a..30b4def28e28 100644
--- a/content/base/src/nsTreeWalker.cpp
+++ b/content/base/src/nsTreeWalker.cpp
@@ -623,7 +623,7 @@ nsresult nsTreeWalker::IndexOf(nsIDOMNode* aParent,
 
         if (possibleIndex >= 0) {
             nsCOMPtr<nsIContent> tmp;
-            contParent->ChildAt(possibleIndex, *getter_AddRefs(tmp));
+            contParent->ChildAt(possibleIndex, getter_AddRefs(tmp));
             if (tmp == child) {
                 *_childNum = possibleIndex;
                 return NS_OK;
@@ -641,7 +641,7 @@ nsresult nsTreeWalker::IndexOf(nsIDOMNode* aParent,
 
         if (possibleIndex >= 0) {
             nsCOMPtr<nsIContent> tmp;
-            docParent->ChildAt(possibleIndex, *getter_AddRefs(tmp));
+            docParent->ChildAt(possibleIndex, getter_AddRefs(tmp));
             if (tmp == child) {
                 *_childNum = possibleIndex;
                 return NS_OK;
diff --git a/content/base/src/nsXMLContentSerializer.cpp b/content/base/src/nsXMLContentSerializer.cpp
index 941014c7f6b8..5c461661e532 100644
--- a/content/base/src/nsXMLContentSerializer.cpp
+++ b/content/base/src/nsXMLContentSerializer.cpp
@@ -496,10 +496,10 @@ nsXMLContentSerializer::AppendElementStart(nsIDOMElement *aElement,
   // First scan for namespace declarations, pushing each on the stack
   for (index = 0; index < count; index++) {
     
-    content->GetAttrNameAt(index, 
-                           namespaceID,
-                           *getter_AddRefs(attrName),
-                           *getter_AddRefs(attrPrefix));
+    content->GetAttrNameAt(index,
+                           &namespaceID,
+                           getter_AddRefs(attrName),
+                           getter_AddRefs(attrPrefix));
     
     if (namespaceID == kNameSpaceID_XMLNS) {
       content->GetAttr(namespaceID, attrName, uriStr);
@@ -536,10 +536,10 @@ nsXMLContentSerializer::AppendElementStart(nsIDOMElement *aElement,
   // XXX Unfortunately we need a namespace manager to get
   // attribute URIs.
   for (index = 0; index < count; index++) {
-    content->GetAttrNameAt(index, 
-                           namespaceID,
-                           *getter_AddRefs(attrName),
-                           *getter_AddRefs(attrPrefix));
+    content->GetAttrNameAt(index,
+                           &namespaceID,
+                           getter_AddRefs(attrName),
+                           getter_AddRefs(attrPrefix));
 
     if (attrPrefix) {
       attrPrefix->ToString(prefixStr);
@@ -566,10 +566,10 @@ nsXMLContentSerializer::AppendElementStart(nsIDOMElement *aElement,
 
     if (namespaceID == kNameSpaceID_None) {
       PRInt32 elementNsID;
-      content->GetNameSpaceID(elementNsID);
+      content->GetNameSpaceID(&elementNsID);
       if (elementNsID == kNameSpaceID_XHTML) {
         nsCOMPtr<nsIAtom> elementName;
-        content->GetTag(*getter_AddRefs(elementName));
+        content->GetTag(getter_AddRefs(elementName));
         if (IsShorthandAttr(attrName, elementName) &&
             valueStr.IsEmpty()) {
           valueStr = nameStr;
diff --git a/content/events/src/nsEventListenerManager.cpp b/content/events/src/nsEventListenerManager.cpp
index 943dd253b723..5a341e2b8a7d 100644
--- a/content/events/src/nsEventListenerManager.cpp
+++ b/content/events/src/nsEventListenerManager.cpp
@@ -429,7 +429,7 @@ nsEventListenerManager::AddEventListener(nsIDOMEventListener *aListener,
     nsCOMPtr<nsIDocument> document;
     nsCOMPtr<nsIContent> content(do_QueryInterface(mTarget));
     if (content)
-      content->GetDocument(*getter_AddRefs(document));
+      content->GetDocument(getter_AddRefs(document));
     else document = do_QueryInterface(mTarget);
     if (document)
       document->GetScriptGlobalObject(getter_AddRefs(global));
@@ -2664,13 +2664,13 @@ nsEventListenerManager::DispatchEvent(nsIDOMEvent* aEvent, PRBool *_retval)
   }
   
   nsCOMPtr<nsIDocument> document;
-  targetContent->GetDocument(*getter_AddRefs(document));
+  targetContent->GetDocument(getter_AddRefs(document));
 
   if (!document) {
     nsCOMPtr<nsINodeInfo> nodeInfo;
-    targetContent->GetNodeInfo(*getter_AddRefs(nodeInfo));
+    targetContent->GetNodeInfo(getter_AddRefs(nodeInfo));
     if (nodeInfo) {
-      nodeInfo->GetDocument(*getter_AddRefs(document));
+      nodeInfo->GetDocument(getter_AddRefs(document));
     }
   }
 
diff --git a/content/events/src/nsEventStateManager.cpp b/content/events/src/nsEventStateManager.cpp
index d3720d894b16..163c20358d58 100644
--- a/content/events/src/nsEventStateManager.cpp
+++ b/content/events/src/nsEventStateManager.cpp
@@ -488,7 +488,7 @@ nsEventStateManager::PreHandleEvent(nsIPresContext* aPresContext,
 
               nsCOMPtr<nsIDocument> doc;
               if (gLastFocusedContent) // could have changed in HandleDOMEvent
-                gLastFocusedContent->GetDocument(*getter_AddRefs(doc));
+                gLastFocusedContent->GetDocument(getter_AddRefs(doc));
               if (doc) {
                 nsCOMPtr<nsIPresShell> shell;
                 doc->GetShellAt(0, getter_AddRefs(shell));
@@ -618,7 +618,7 @@ nsEventStateManager::PreHandleEvent(nsIPresContext* aPresContext,
         nsCOMPtr<nsIScriptGlobalObject> ourGlobal;
         if (gLastFocusedContent) {
           nsCOMPtr<nsIDocument> doc;
-          gLastFocusedContent->GetDocument(*getter_AddRefs(doc));
+          gLastFocusedContent->GetDocument(getter_AddRefs(doc));
           if (doc)
             doc->GetScriptGlobalObject(getter_AddRefs(ourGlobal));
           else {
@@ -642,7 +642,7 @@ nsEventStateManager::PreHandleEvent(nsIPresContext* aPresContext,
             // Retrieve this content node's pres context. it can be out of sync
             // in the Ender widget case.
             nsCOMPtr<nsIDocument> doc;
-            gLastFocusedContent->GetDocument(*getter_AddRefs(doc));
+            gLastFocusedContent->GetDocument(getter_AddRefs(doc));
             if (doc) {
               nsCOMPtr<nsIPresShell> shell;
               doc->GetShellAt(0, getter_AddRefs(shell));
@@ -915,7 +915,7 @@ nsEventStateManager::HandleAccessKey(nsIPresContext* aPresContext,
 
         // find out what type of content node this is
         nsCOMPtr<nsIAtom> atom;
-        nsresult rv = content->GetTag(*getter_AddRefs(atom));
+        nsresult rv = content->GetTag(getter_AddRefs(atom));
         if (NS_SUCCEEDED(rv) && atom) {
           if (atom == nsXULAtoms::label) {
             // If anything fails, this will be null ...
@@ -925,7 +925,7 @@ nsEventStateManager::HandleAccessKey(nsIPresContext* aPresContext,
             content->GetAttr(kNameSpaceID_None, nsXULAtoms::control, control);
             if (!control.IsEmpty()) {
               nsCOMPtr<nsIDocument> document;
-              content->GetDocument(*getter_AddRefs(document));
+              content->GetDocument(getter_AddRefs(document));
               nsCOMPtr<nsIDOMDocument> domDocument = do_QueryInterface(document);
               if (domDocument)
                 domDocument->GetElementById(control, getter_AddRefs(element));
@@ -983,7 +983,7 @@ nsEventStateManager::HandleAccessKey(nsIPresContext* aPresContext,
 
             // find out what type of content node this is
             nsCOMPtr<nsIAtom> atom;
-            nsresult rv = content->GetTag(*getter_AddRefs(atom));
+            nsresult rv = content->GetTag(getter_AddRefs(atom));
 
             if (NS_SUCCEEDED(rv) && atom) {
               // define behavior for each type of XUL element:
@@ -1153,7 +1153,7 @@ nsEventStateManager :: CreateClickHoldTimer ( nsIPresContext* inPresContext, nsG
       
       // check for a <menubutton> like bookmarks
       nsCOMPtr<nsIAtom> tag;
-      clickedContent->GetTag ( *getter_AddRefs(tag) );
+      clickedContent->GetTag ( getter_AddRefs(tag) );
       if ( tag == nsXULAtoms::menubutton )
         return;
     }
@@ -1266,7 +1266,7 @@ nsEventStateManager :: FireContextClick ( )
       PRBool allowedToDispatch = PR_TRUE;
 
       nsCOMPtr<nsIAtom> tag;
-      lastContent->GetTag ( *getter_AddRefs(tag) );
+      lastContent->GetTag ( getter_AddRefs(tag) );
       nsCOMPtr<nsIDOMHTMLInputElement> inputElm ( do_QueryInterface(lastContent) );
       PRBool isFormControl =
         lastContent->IsContentOfType(nsIContent::eHTML_FORM_CONTROL);
@@ -1611,7 +1611,7 @@ nsEventStateManager::DoWheelScroll(nsIPresContext* aPresContext,
     GetFocusedContent(getter_AddRefs(targetContent));
   if (!targetContent) return NS_OK;
   nsCOMPtr<nsIDocument> targetDoc;
-  targetContent->GetDocument(*getter_AddRefs(targetDoc));
+  targetContent->GetDocument(getter_AddRefs(targetDoc));
   if (!targetDoc) return NS_OK;
   nsCOMPtr<nsIDOMDocumentEvent> targetDOMDoc(do_QueryInterface(targetDoc));
 
@@ -1940,7 +1940,7 @@ nsEventStateManager::PostHandleEvent(nsIPresContext* aPresContext,
           nsCOMPtr<nsIDOMElement> elt(do_QueryInterface(activeContent));
           if (!elt) {
             nsCOMPtr<nsIContent> par;
-            activeContent->GetParent(*getter_AddRefs(par));
+            activeContent->GetParent(getter_AddRefs(par));
             if (par)
               activeContent = par;
           }
@@ -2349,7 +2349,7 @@ PRBool
 nsEventStateManager::CheckDisabled(nsIContent* aContent)
 {
   nsCOMPtr<nsIAtom> tag;
-  aContent->GetTag(*getter_AddRefs(tag));
+  aContent->GetTag(getter_AddRefs(tag));
 
   if (tag == nsHTMLAtoms::input    ||
       tag == nsHTMLAtoms::select   ||
@@ -2596,7 +2596,7 @@ nsEventStateManager::MaybeDispatchMouseEventToIframe(
     parentDoc->FindContentForSubDocument(mDocument, getter_AddRefs(docContent));
     if (docContent) {
       nsCOMPtr<nsIAtom> tag;
-      docContent->GetTag(*getter_AddRefs(tag));
+      docContent->GetTag(getter_AddRefs(tag));
       if (tag == nsHTMLAtoms::iframe) {
         // We're an IFRAME.  Send an event to our IFRAME tag.
         nsCOMPtr<nsIPresShell> parentShell;
@@ -3223,7 +3223,7 @@ nsEventStateManager::ShiftFocusInternal(PRBool aForward, nsIContent* aStart)
     nsCOMPtr<nsIDocShell> sub_shell;
 
     nsCOMPtr<nsIDocument> doc, sub_doc;
-    nextFocus->GetDocument(*getter_AddRefs(doc));
+    nextFocus->GetDocument(getter_AddRefs(doc));
 
     if (doc) {
       doc->GetSubDocumentFor(nextFocus, getter_AddRefs(sub_doc));
@@ -3274,7 +3274,7 @@ nsEventStateManager::ShiftFocusInternal(PRBool aForward, nsIContent* aStart)
 
       if (oldFocus) {
         nsCOMPtr<nsIDocument> newElementDocument;
-        nextFocus->GetDocument(*getter_AddRefs(newElementDocument));
+        nextFocus->GetDocument(getter_AddRefs(newElementDocument));
         if (doc != newElementDocument)
           return ShiftFocusInternal(aForward, oldFocus);
       }
@@ -3403,7 +3403,7 @@ void nsEventStateManager::TabIndexFrom(nsIContent *aFrom, PRInt32 *aOutIndex)
 {
   if (aFrom->IsContentOfType(nsIContent::eHTML)) {
     nsCOMPtr<nsIAtom> tag;
-    aFrom->GetTag(*getter_AddRefs(tag));
+    aFrom->GetTag(getter_AddRefs(tag));
     if (nsHTMLAtoms::a != tag && nsHTMLAtoms::area != tag && nsHTMLAtoms::button != tag && 
       nsHTMLAtoms::input != tag && nsHTMLAtoms::object != tag && nsHTMLAtoms::select != tag && nsHTMLAtoms::textarea != tag)
       return;
@@ -3456,7 +3456,7 @@ nsEventStateManager::GetNextTabbableContent(nsIContent* aRootContent,
   //Need to do special check in case we're in an imagemap which has multiple content per frame
   if (mCurrentFocus) {
     nsCOMPtr<nsIAtom> tag;
-    mCurrentFocus->GetTag(*getter_AddRefs(tag));
+    mCurrentFocus->GetTag(getter_AddRefs(tag));
     if (nsHTMLAtoms::area==tag) {
       //Focus is in an imagemap area
       if (aFrame == mCurrentFocusFrame) {
@@ -3537,7 +3537,7 @@ nsEventStateManager::GetNextTabbableContent(nsIContent* aRootContent,
         mPrefBranch->GetIntPref("accessibility.tabfocus", &tabFocusModel);
       }
 
-      child->GetTag(*getter_AddRefs(tag));
+      child->GetTag(getter_AddRefs(tag));
       if (child->IsContentOfType(nsIContent::eHTML)) {
         if (nsHTMLAtoms::input==tag) {
           nsCOMPtr<nsIDOMHTMLInputElement> nextInput(do_QueryInterface(child));
@@ -3623,7 +3623,8 @@ nsEventStateManager::GetNextTabbableContent(nsIContent* aRootContent,
             nsAutoString usemap;
             if (nextImage) {
               nsCOMPtr<nsIDocument> doc;
-              if (NS_SUCCEEDED(child->GetDocument(*getter_AddRefs(doc))) && doc) {
+              child->GetDocument(getter_AddRefs(doc));
+              if (doc) {
                 nextImage->GetAttribute(NS_LITERAL_STRING("usemap"), usemap);
                 nsCOMPtr<nsIDOMHTMLMapElement> imageMap;
                 if (NS_SUCCEEDED(nsImageMapUtils::FindImageMap(doc,usemap,getter_AddRefs(imageMap))) && imageMap) {
@@ -3634,7 +3635,7 @@ nsEventStateManager::GetNextTabbableContent(nsIContent* aRootContent,
                     map->ChildCount(count);
                     //First see if mCurrentFocus is in this map
                     for (index = 0; index < count; index++) {
-                      map->ChildAt(index, *getter_AddRefs(childArea));
+                      map->ChildAt(index, getter_AddRefs(childArea));
                       if (childArea == mCurrentFocus) {
                         PRInt32 val = 0;
                         TabIndexFrom(childArea, &val);
@@ -3653,7 +3654,7 @@ nsEventStateManager::GetNextTabbableContent(nsIContent* aRootContent,
                     PRInt32 start = index < count ? index + increment : (forward ? 0 : count - 1);
                     for (index = start; index < count && index >= 0; index += increment) {
                       //Iterate over the children.
-                      map->ChildAt(index, *getter_AddRefs(childArea));
+                      map->ChildAt(index, getter_AddRefs(childArea));
 
                       //Got the map area, check its tabindex.
                       PRInt32 val = 0;
@@ -3686,7 +3687,7 @@ nsEventStateManager::GetNextTabbableContent(nsIContent* aRootContent,
           disabled = PR_TRUE;
           if (child) {
             nsCOMPtr<nsIDocument> doc;
-            child->GetDocument(*getter_AddRefs(doc));
+            child->GetDocument(getter_AddRefs(doc));
             if (doc) {
               nsCOMPtr<nsIDocument> subDoc;
               doc->GetSubDocumentFor(child, getter_AddRefs(subDoc));
@@ -3778,7 +3779,7 @@ nsEventStateManager::GetNextTabIndex(nsIContent* aParent, PRBool forward)
   if (forward) {
     tabIndex = 0;
     for (PRInt32 index = 0; index < count; index++) {
-      aParent->ChildAt(index, *getter_AddRefs(child));
+      aParent->ChildAt(index, getter_AddRefs(child));
       childTabIndex = GetNextTabIndex(child, forward);
       if (childTabIndex > mCurrentTabIndex && childTabIndex != tabIndex) {
         tabIndex = (tabIndex == 0 || childTabIndex < tabIndex) ? childTabIndex : tabIndex; 
@@ -3795,7 +3796,7 @@ nsEventStateManager::GetNextTabIndex(nsIContent* aParent, PRBool forward)
   else { /* !forward */
     tabIndex = 1;
     for (PRInt32 index = 0; index < count; index++) {
-      aParent->ChildAt(index, *getter_AddRefs(child));
+      aParent->ChildAt(index, getter_AddRefs(child));
       childTabIndex = GetNextTabIndex(child, forward);
       if ((mCurrentTabIndex==0 && childTabIndex > tabIndex) ||
           (childTabIndex < mCurrentTabIndex && childTabIndex > tabIndex)) {
@@ -3914,9 +3915,9 @@ nsEventStateManager::GetContentState(nsIContent *aContent, PRInt32& aState)
       aState |= NS_EVENT_STATE_HOVER;
       break;
     }
-    nsIContent *parent;
-    hoverContent->GetParent(parent);
-    hoverContent = dont_AddRef(parent);
+    nsCOMPtr<nsIContent> parent;
+    hoverContent->GetParent(getter_AddRefs(parent));
+    hoverContent.swap(parent);
   }
 
   if (aContent == mCurrentFocus) {
@@ -3980,26 +3981,26 @@ nsEventStateManager::SetContentState(nsIContent *aContent, PRInt32 aState)
       nsCOMPtr<nsIContent> oldAncestor = mHoverContent;
       for (;;) {
         ++offset;
-        nsIContent *parent;
-        oldAncestor->GetParent(parent);
+        nsCOMPtr<nsIContent> parent;
+        oldAncestor->GetParent(getter_AddRefs(parent));
         if (!parent)
           break;
-        oldAncestor = dont_AddRef(parent);
+        oldAncestor.swap(parent);
       }
       nsCOMPtr<nsIContent> newAncestor = aContent;
       for (;;) {
         --offset;
-        nsIContent *parent;
-        newAncestor->GetParent(parent);
+        nsCOMPtr<nsIContent> parent;
+        newAncestor->GetParent(getter_AddRefs(parent));
         if (!parent)
           break;
-        newAncestor = dont_AddRef(parent);
+        newAncestor.swap(parent);
       }
 #ifdef DEBUG
       if (oldAncestor != newAncestor) {
         // This could be a performance problem.
         nsCOMPtr<nsIDocument> oldDoc;
-        oldAncestor->GetDocument(*getter_AddRefs(oldDoc));
+        oldAncestor->GetDocument(getter_AddRefs(oldDoc));
         // The |!oldDoc| case (that the old hover node has been removed
         // from the document) could be a slight performance problem.
         // It's rare enough that it shouldn't be an issue, but common
@@ -4014,23 +4015,23 @@ nsEventStateManager::SetContentState(nsIContent *aContent, PRInt32 aState)
         oldAncestor = mHoverContent;
         newAncestor = aContent;
         while (offset > 0) {
-          nsIContent *parent;
-          oldAncestor->GetParent(parent);
-          oldAncestor = dont_AddRef(parent);
+          nsCOMPtr<nsIContent> parent;
+          oldAncestor->GetParent(getter_AddRefs(parent));
+          oldAncestor.swap(parent);
           --offset;
         }
         while (offset < 0) {
-          nsIContent *parent;
-          newAncestor->GetParent(parent);
-          newAncestor = dont_AddRef(parent);
+          nsCOMPtr<nsIContent> parent;
+          newAncestor->GetParent(getter_AddRefs(parent));
+          newAncestor.swap(parent);
           ++offset;
         }
         while (oldAncestor != newAncestor) {
-          nsIContent *parent;
-          oldAncestor->GetParent(parent);
-          oldAncestor = dont_AddRef(parent);
-          newAncestor->GetParent(parent);
-          newAncestor = dont_AddRef(parent);
+          nsCOMPtr<nsIContent> parent;
+          oldAncestor->GetParent(getter_AddRefs(parent));
+          oldAncestor.swap(parent);
+          newAncestor->GetParent(getter_AddRefs(parent));
+          newAncestor.swap(parent);
         }
         commonHoverAncestor = oldAncestor;
       }
@@ -4077,12 +4078,13 @@ nsEventStateManager::SetContentState(nsIContent *aContent, PRInt32 aState)
 
   // remove notifications for content not in document.
   // we may decide this is possible later but right now it has problems.
-  nsIDocument* doc = nsnull;
+  nsCOMPtr<nsIDocument> doc;
   for  (int i = 0; i < maxNotify; i++) {
-    if (notifyContent[i] && NS_SUCCEEDED(notifyContent[i]->GetDocument(doc)) && !doc) {
+    if (notifyContent[i] &&
+        NS_SUCCEEDED(notifyContent[i]->GetDocument(getter_AddRefs(doc))) &&
+        !doc) {
       NS_RELEASE(notifyContent[i]);
     }
-    NS_IF_RELEASE(doc);
   }
 
   // compress the notify array to group notifications tighter
@@ -4115,20 +4117,20 @@ nsEventStateManager::SetContentState(nsIContent *aContent, PRInt32 aState)
   if (notifyContent[0] || newHover || oldHover) { // have at least one to notify about
     nsCOMPtr<nsIDocument> doc1, doc2;  // this presumes content can't get/lose state if not connected to doc
     if (notifyContent[0]) {
-      notifyContent[0]->GetDocument(*getter_AddRefs(doc1));
+      notifyContent[0]->GetDocument(getter_AddRefs(doc1));
       if (notifyContent[1]) {
         //For :focus this might be a different doc so check
-        notifyContent[1]->GetDocument(*getter_AddRefs(doc2));
+        notifyContent[1]->GetDocument(getter_AddRefs(doc2));
         if (doc1 == doc2) {
           doc2 = nsnull;
         }
       }
     }
     else if (newHover) {
-      newHover->GetDocument(*getter_AddRefs(doc1));
+      newHover->GetDocument(getter_AddRefs(doc1));
     }
     else {
-      oldHover->GetDocument(*getter_AddRefs(doc1));
+      oldHover->GetDocument(getter_AddRefs(doc1));
     }
     if (doc1) {
       doc1->BeginUpdate();
@@ -4136,16 +4138,16 @@ nsEventStateManager::SetContentState(nsIContent *aContent, PRInt32 aState)
       // Notify all content from newHover to the commonHoverAncestor
       while (newHover && newHover != commonHoverAncestor) {
         doc1->ContentStatesChanged(newHover, nsnull, NS_EVENT_STATE_HOVER);
-        nsIContent *parent;
-        newHover->GetParent(parent);
-        newHover = dont_AddRef(parent);
+        nsCOMPtr<nsIContent> parent;
+        newHover->GetParent(getter_AddRefs(parent));
+        newHover.swap(parent);
       }
       // Notify all content from oldHover to the commonHoverAncestor
       while (oldHover && oldHover != commonHoverAncestor) {
         doc1->ContentStatesChanged(oldHover, nsnull, NS_EVENT_STATE_HOVER);
-        nsIContent *parent;
-        oldHover->GetParent(parent);
-        oldHover = dont_AddRef(parent);
+        nsCOMPtr<nsIContent> parent;
+        oldHover->GetParent(getter_AddRefs(parent));
+        oldHover.swap(parent);
       }
 
       if (notifyContent[0]) {
@@ -4211,7 +4213,7 @@ nsEventStateManager::SendFocusBlur(nsIPresContext* aPresContext, nsIContent *aCo
       // Retrieve this content node's pres context. it can be out of sync in
       // the Ender widget case.
       nsCOMPtr<nsIDocument> doc;
-      gLastFocusedContent->GetDocument(*getter_AddRefs(doc));
+      gLastFocusedContent->GetDocument(getter_AddRefs(doc));
       if (doc) {
         // The order of the nsIViewManager and nsIPresShell COM pointers is
         // important below.  We want the pres shell to get released before the
@@ -4418,7 +4420,7 @@ nsEventStateManager::GetFocusedFrame(nsIFrame** aFrame)
 {
   if (!mCurrentFocusFrame && mCurrentFocus) {
     nsCOMPtr<nsIDocument> doc;
-    mCurrentFocus->GetDocument(*getter_AddRefs(doc));
+    mCurrentFocus->GetDocument(getter_AddRefs(doc));
     if (doc) {
       nsCOMPtr<nsIPresShell> shell;
       doc->GetShellAt(0, getter_AddRefs(shell));
@@ -4449,7 +4451,7 @@ nsEventStateManager::ContentRemoved(nsIContent* aContent)
   if (aContent == mHoverContent) {
     // Since hover is hierarchical, set the current hover to the
     // content's parent node.
-    aContent->GetParent(*getter_AddRefs(mHoverContent));
+    aContent->GetParent(getter_AddRefs(mHoverContent));
   }
 
   if (aContent == mActiveContent) {
@@ -4697,7 +4699,7 @@ nsresult nsEventStateManager::GetDocSelectionLocation(nsIContent **aStartContent
       startContent = do_QueryInterface(startNode);
       if (NS_SUCCEEDED(startContent->CanContainChildren(canContainChildren)) &&
           canContainChildren) {
-        startContent->ChildAt(*aStartOffset, *getter_AddRefs(childContent));
+        startContent->ChildAt(*aStartOffset, getter_AddRefs(childContent));
         if (childContent)
           startContent = childContent;
       }
@@ -4707,7 +4709,7 @@ nsresult nsEventStateManager::GetDocSelectionLocation(nsIContent **aStartContent
           canContainChildren) {
         PRInt32 endOffset = 0;
         domRange->GetEndOffset(&endOffset);
-        endContent->ChildAt(endOffset, *getter_AddRefs(childContent));
+        endContent->ChildAt(endOffset, getter_AddRefs(childContent));
         if (childContent)
           endContent = childContent;
       }
@@ -4891,7 +4893,7 @@ NS_IMETHODIMP nsEventStateManager::MoveFocusToCaret(PRBool aCanFocusDoc, PRBool
       return NS_OK;  // already focused on this node, this whole thing's moot
     }
 
-    testContent->GetTag(*getter_AddRefs(tag));
+    testContent->GetTag(getter_AddRefs(tag));
 
     // Add better focusable test here later if necessary ... 
     if (nsHTMLAtoms::a == tag.get()) {
@@ -4914,9 +4916,9 @@ NS_IMETHODIMP nsEventStateManager::MoveFocusToCaret(PRBool aCanFocusDoc, PRBool
     }
 
     // Get the parent
-    nsIContent* parent;
-    testContent->GetParent(parent);
-    testContent = dont_AddRef(parent);
+    nsCOMPtr<nsIContent> parent;
+    testContent->GetParent(getter_AddRefs(parent));
+    testContent.swap(parent);
 
     if (!testContent) {
       // We run this loop again, checking the ancestor chain of the selection's end point
@@ -4941,7 +4943,7 @@ NS_IMETHODIMP nsEventStateManager::MoveFocusToCaret(PRBool aCanFocusDoc, PRBool
     // Right now we only look for elements with the <a> tag.
     // Add better focusable test here later if necessary ... 
     if (testContent) {
-      testContent->GetTag(*getter_AddRefs(tag));
+      testContent->GetTag(getter_AddRefs(tag));
       if (nsHTMLAtoms::a == tag.get()) {
         *aIsSelectionWithFocus = PR_TRUE;
         FocusElementButNotDocument(testContent);
@@ -5017,7 +5019,7 @@ NS_IMETHODIMP nsEventStateManager::MoveCaretToFocus()
                             &selectionFrame, &selectionOffset);
     while (selectionContent) {
       nsCOMPtr<nsIContent> parentContent;
-      selectionContent->GetParent(*getter_AddRefs(parentContent));
+      selectionContent->GetParent(getter_AddRefs(parentContent));
       if (mCurrentFocus == selectionContent && parentContent)
         return NS_OK; // selection is already within focus node that isn't the root content
       selectionContent = parentContent; // Keep checking up chain of parents, focus may be in a link above us
@@ -5204,9 +5206,9 @@ nsEventStateManager::IsFrameSetDoc(nsIDocShell* aDocShell)
         rootContent->ChildCount(childCount);
         for (PRInt32 i = 0; i < childCount; ++i) {
           nsCOMPtr<nsIContent> childContent;
-          rootContent->ChildAt(i, *getter_AddRefs(childContent));
+          rootContent->ChildAt(i, getter_AddRefs(childContent));
           nsCOMPtr<nsIAtom> childTag;
-          childContent->GetTag(*getter_AddRefs(childTag));
+          childContent->GetTag(getter_AddRefs(childTag));
           if (childTag == nsHTMLAtoms::frameset) {
             isFrameSet = PR_TRUE;
             break;
@@ -5262,7 +5264,7 @@ nsEventStateManager::IsIFrameDoc(nsIDocShell* aDocShell)
     return PR_FALSE;
   
   nsCOMPtr<nsIAtom> tag;
-  docContent->GetTag(*getter_AddRefs(tag));
+  docContent->GetTag(getter_AddRefs(tag));
   return (tag == nsHTMLAtoms::iframe);
 }
 
diff --git a/content/html/content/public/nsIHTMLContent.h b/content/html/content/public/nsIHTMLContent.h
index efbd0a79f973..94041ab846ae 100644
--- a/content/html/content/public/nsIHTMLContent.h
+++ b/content/html/content/public/nsIHTMLContent.h
@@ -141,7 +141,7 @@ public:
    *
    * @param aBaseURL the base URL [OUT]
    */
-  NS_IMETHOD GetBaseURL(nsIURI*& aBaseURL) const = 0;
+  NS_IMETHOD GetBaseURL(nsIURI** aBaseURL) const = 0;
 
   /**
    * Get the base target for any links within this piece
diff --git a/content/html/content/src/GenericElementCollection.cpp b/content/html/content/src/GenericElementCollection.cpp
index 99cc1faa40f8..53ad5fd94a65 100644
--- a/content/html/content/src/GenericElementCollection.cpp
+++ b/content/html/content/src/GenericElementCollection.cpp
@@ -67,14 +67,14 @@ GenericElementCollection::GetLength(PRUint32* aLength)
   if (mParent) {
     nsCOMPtr<nsIContent> child;
     PRUint32 childIndex = 0;
-    mParent->ChildAt(childIndex, *getter_AddRefs(child));
+    mParent->ChildAt(childIndex, getter_AddRefs(child));
     while (child) {
       nsCOMPtr<nsIAtom> childTag;
-      child->GetTag(*getter_AddRefs(childTag));
+      child->GetTag(getter_AddRefs(childTag));
       if (mTag == childTag) {
         ++(*aLength);
       }
-      mParent->ChildAt(++childIndex, *getter_AddRefs(child));
+      mParent->ChildAt(++childIndex, getter_AddRefs(child));
     }
   }
 
@@ -91,12 +91,12 @@ GenericElementCollection::Item(PRUint32 aIndex, nsIDOMNode** aReturn)
   if (mParent) {
     nsCOMPtr<nsIContent> child;
     PRUint32 childIndex = 0;
-    mParent->ChildAt(childIndex, *getter_AddRefs(child));
+    mParent->ChildAt(childIndex, getter_AddRefs(child));
 
     PRUint32 theIndex = 0;
     while (child) {
       nsCOMPtr<nsIAtom> childTag;
-      child->GetTag(*getter_AddRefs(childTag));
+      child->GetTag(getter_AddRefs(childTag));
       if (mTag == childTag) {
         if (aIndex == theIndex) {
           CallQueryInterface(child, aReturn);
@@ -106,7 +106,7 @@ GenericElementCollection::Item(PRUint32 aIndex, nsIDOMNode** aReturn)
         }
         ++theIndex;
       }
-      mParent->ChildAt(++childIndex, *getter_AddRefs(child));
+      mParent->ChildAt(++childIndex, getter_AddRefs(child));
     }
   }
 
diff --git a/content/html/content/src/nsAttributeContent.cpp b/content/html/content/src/nsAttributeContent.cpp
index a09af4b6b792..698e778240e1 100644
--- a/content/html/content/src/nsAttributeContent.cpp
+++ b/content/html/content/src/nsAttributeContent.cpp
@@ -83,32 +83,36 @@ public:
   NS_DECL_ISUPPORTS
 
   // Implementation for nsIContent
-  NS_IMETHOD GetDocument(nsIDocument*& aResult) const;
+  NS_IMETHOD GetDocument(nsIDocument** aResult) const;
   NS_IMETHOD SetDocument(nsIDocument* aDocument, PRBool aDeep, PRBool aCompileEventHandlers);
-  NS_IMETHOD GetParent(nsIContent*& aResult) const;
+  NS_IMETHOD GetParent(nsIContent** aResult) const;
   NS_IMETHOD SetParent(nsIContent* aParent);
   NS_IMETHOD_(PRBool) IsNativeAnonymous() const { return PR_TRUE; }
   NS_IMETHOD_(void) SetNativeAnonymous(PRBool aAnonymous) { }
 
-  NS_IMETHOD GetNameSpaceID(PRInt32& aID) const {
-    aID = kNameSpaceID_None;
+  NS_IMETHOD GetNameSpaceID(PRInt32* aID) const
+  {
+    *aID = kNameSpaceID_None;
     return NS_OK;
   }
 
-  NS_IMETHOD GetTag(nsIAtom*& aResult) const {
-    aResult = nsnull;
+  NS_IMETHOD GetTag(nsIAtom** aResult) const
+  {
+    *aResult = nsnull;
     return NS_OK;
   }
 
-  NS_IMETHOD GetNodeInfo(nsINodeInfo*& aResult) const {
-    aResult = nsnull;
+  NS_IMETHOD GetNodeInfo(nsINodeInfo** aResult) const
+  {
+    *aResult = nsnull;
     return NS_OK;
   }
 
 
   NS_IMETHOD NormalizeAttrString(const nsAString& aStr, 
-                                 nsINodeInfo*& aNodeInfo) { 
-    aNodeInfo = nsnull;
+                                 nsINodeInfo** aNodeInfo)
+  {
+    *aNodeInfo = nsnull;
     return NS_OK; 
   }
 
@@ -141,11 +145,11 @@ public:
                      PRBool aNotify) {  return NS_OK; }
   NS_IMETHOD UnsetAttr(PRInt32 aNameSpaceID, nsIAtom* aAttribute, PRBool aNotify) { return NS_OK; }
   NS_IMETHOD GetAttr(PRInt32 aNameSpaceID, nsIAtom *aAttribute, nsAString& aResult) const {return NS_CONTENT_ATTR_NOT_THERE; }
-  NS_IMETHOD GetAttr(PRInt32 aNameSpaceID, nsIAtom *aAttribute, nsIAtom*& aPrefix, nsAString& aResult) const {return NS_CONTENT_ATTR_NOT_THERE; }
+  NS_IMETHOD GetAttr(PRInt32 aNameSpaceID, nsIAtom *aAttribute, nsIAtom** aPrefix, nsAString& aResult) const {return NS_CONTENT_ATTR_NOT_THERE; }
   NS_IMETHOD_(PRBool) HasAttr(PRInt32 aNameSpaceID, nsIAtom *aAttribute) const {
     return PR_FALSE;
   }
-  NS_IMETHOD GetAttrNameAt(PRInt32 aIndex, PRInt32& aNameSpaceID, nsIAtom*& aName, nsIAtom*& aPrefix) const {
+  NS_IMETHOD GetAttrNameAt(PRInt32 aIndex, PRInt32* aNameSpaceID, nsIAtom** aName, nsIAtom** aPrefix) const {
     aName = nsnull;
     aPrefix = nsnull;
     return NS_ERROR_ILLEGAL_VALUE;
@@ -174,13 +178,13 @@ public:
 
   NS_IMETHOD RangeAdd(nsIDOMRange* aRange);
   NS_IMETHOD RangeRemove(nsIDOMRange* aRange);
-  NS_IMETHOD GetRangeList(nsVoidArray*& aResult) const;
+  NS_IMETHOD GetRangeList(nsVoidArray** aResult) const;
 
   // Implementation for nsIContent
   NS_IMETHOD CanContainChildren(PRBool& aResult) const { aResult = PR_FALSE; return NS_OK; }
 
   NS_IMETHOD ChildCount(PRInt32& aResult) const { aResult = 0; return NS_OK;  }
-  NS_IMETHOD ChildAt(PRInt32 aIndex, nsIContent*& aResult) const { aResult = nsnull; return NS_OK;  }
+  NS_IMETHOD ChildAt(PRInt32 aIndex, nsIContent** aResult) const { aResult = nsnull; return NS_OK;  }
   NS_IMETHOD IndexOf(nsIContent* aPossibleChild, PRInt32& aResult) const { aResult = -1; return NS_OK;  }
   NS_IMETHOD InsertChildAt(nsIContent* aKid, PRInt32 aIndex, PRBool aNotify,
                            PRBool aDeepSetDocument) { return NS_OK;  }
@@ -306,9 +310,9 @@ nsAttributeContent::ToCString(nsAString& aBuf, PRInt32 aOffset,
 }
 
 nsresult
-nsAttributeContent::GetDocument(nsIDocument*& aResult) const
+nsAttributeContent::GetDocument(nsIDocument** aResult) const
 {
-  aResult = mDocument;
+  *aResult = mDocument;
   NS_IF_ADDREF(mDocument);
   return NS_OK;
 }
@@ -323,10 +327,10 @@ nsAttributeContent::SetDocument(nsIDocument* aDocument, PRBool aDeep, PRBool aCo
 }
 
 nsresult
-nsAttributeContent::GetParent(nsIContent*& aResult) const
+nsAttributeContent::GetParent(nsIContent** aResult) const
 {
   NS_IF_ADDREF(mParent);
-  aResult = mParent;
+  *aResult = mParent;
   return NS_OK;;
 }
 
@@ -364,7 +368,7 @@ nsAttributeContent::RangeRemove(nsIDOMRange* aRange)
 
 
 nsresult 
-nsAttributeContent::GetRangeList(nsVoidArray*& aResult) const
+nsAttributeContent::GetRangeList(nsVoidArray** aResult) const
 {
   return NS_ERROR_FAILURE;
 }
diff --git a/content/html/content/src/nsFormSubmission.cpp b/content/html/content/src/nsFormSubmission.cpp
index aa2b00e024b4..e69040db65a1 100644
--- a/content/html/content/src/nsFormSubmission.cpp
+++ b/content/html/content/src/nsFormSubmission.cpp
@@ -1073,7 +1073,7 @@ SendJSWarning(nsIHTMLContent* aContent,
   nsCAutoString documentURLSpec;
   {
     nsCOMPtr<nsIDocument> document;
-    aContent->GetDocument(*getter_AddRefs(document));
+    aContent->GetDocument(getter_AddRefs(document));
     if (document) {
       nsCOMPtr<nsIURI> documentURL;
       document->GetDocumentURL(getter_AddRefs(documentURL));
@@ -1274,7 +1274,7 @@ nsFormSubmission::GetSubmitCharset(nsIHTMLContent* aForm,
   // if there are no accept-charset or all the charset are not supported
   // Get the charset from document
   nsCOMPtr<nsIDocument> doc;
-  aForm->GetDocument(*getter_AddRefs(doc));
+  aForm->GetDocument(getter_AddRefs(doc));
   if (doc) {
     nsAutoString docCharset;
     rv = doc->GetDocumentCharacterSet(docCharset);
diff --git a/content/html/content/src/nsGenericHTMLElement.cpp b/content/html/content/src/nsGenericHTMLElement.cpp
index 086829786ed7..7d692a60794f 100644
--- a/content/html/content/src/nsGenericHTMLElement.cpp
+++ b/content/html/content/src/nsGenericHTMLElement.cpp
@@ -329,8 +329,8 @@ nsGenericHTMLElement::CopyInnerTo(nsIContent* aSrcContent,
     nsAutoString value;
 
     for (index = 0; index < count; index++) {
-      rv = GetAttrNameAt(index, namespace_id, *getter_AddRefs(name),
-                         *getter_AddRefs(prefix));
+      rv = GetAttrNameAt(index, &namespace_id, getter_AddRefs(name),
+                         getter_AddRefs(prefix));
       NS_ENSURE_SUCCESS(rv, rv);
       rv = GetAttr(namespace_id, name, value);
       NS_ENSURE_SUCCESS(rv, rv);
@@ -606,7 +606,7 @@ nsGenericHTMLElement::GetOffsetRect(nsRect& aRect,
   frame->GetContent(getter_AddRefs(content));
 
   if (content) {
-    content->GetTag(*getter_AddRefs(tag));
+    content->GetTag(getter_AddRefs(tag));
 
     if (IsBodyTag(tag) || content == docElement) {
       done = PR_TRUE;
@@ -669,7 +669,7 @@ nsGenericHTMLElement::GetOffsetRect(nsRect& aRect,
           break;
         }
 
-        content->GetTag(*getter_AddRefs(tag));
+        content->GetTag(getter_AddRefs(tag));
 
         // If the tag of this frame is a offset parent tag and this
         // element is *not* positioned, break here. Also break if we
@@ -853,7 +853,7 @@ nsGenericHTMLElement::GetInnerHTML(nsAString& aInnerHTML)
   aInnerHTML.Truncate();
 
   nsCOMPtr<nsIDocument> doc;
-  mNodeInfo->GetDocument(*getter_AddRefs(doc));
+  mNodeInfo->GetDocument(getter_AddRefs(doc));
   if (!doc) {
     return NS_OK; // We rely on the document for doing HTML conversion
   }
@@ -905,7 +905,7 @@ nsGenericHTMLElement::SetInnerHTML(const nsAString& aInnerHTML)
   nsCOMPtr<nsIDOMDocumentFragment> df;
 
   nsCOMPtr<nsIDocument> doc;
-  mNodeInfo->GetDocument(*getter_AddRefs(doc));
+  mNodeInfo->GetDocument(getter_AddRefs(doc));
 
   nsCOMPtr<nsIScriptContext> scx;
   PRBool scripts_enabled = PR_FALSE;
@@ -958,7 +958,7 @@ nsGenericHTMLElement::GetScrollInfo(nsIScrollableView **aScrollableView,
 
   // Get the the document
   nsCOMPtr<nsIDocument> doc;
-  GetDocument(*getter_AddRefs(doc));
+  GetDocument(getter_AddRefs(doc));
   if (!doc) {
     return NS_OK;
   }
@@ -1259,7 +1259,7 @@ nsGenericHTMLElement::ScrollIntoView(PRBool aTop)
 {
   // Get the the document
   nsCOMPtr<nsIDocument> doc;
-  GetDocument(*getter_AddRefs(doc));
+  GetDocument(getter_AddRefs(doc));
   if (!doc) {
     return NS_OK;
   }
@@ -1359,7 +1359,7 @@ nsGenericHTMLElement::FindForm(nsIDOMHTMLFormElement **aForm)
 
   while (content) {
     if (content->IsContentOfType(nsIContent::eHTML)) {
-      content->GetTag(*getter_AddRefs(tag));
+      content->GetTag(getter_AddRefs(tag));
 
       // If the current ancestor is a form, return it as our form
       if (tag == nsHTMLAtoms::form) {
@@ -1368,7 +1368,7 @@ nsGenericHTMLElement::FindForm(nsIDOMHTMLFormElement **aForm)
     }
 
     nsIContent *tmp = content;
-    tmp->GetParent(*getter_AddRefs(content));
+    tmp->GetParent(getter_AddRefs(content));
 
     if (content) {
       PRInt32 i;
@@ -1430,7 +1430,7 @@ nsGenericHTMLElement::HandleDOMEventForAnchors(nsIContent* aOuter,
       esm->GetEventTargetContent(aEvent, getter_AddRefs(target));
       if (target) {
         nsCOMPtr<nsIAtom> tag;
-        target->GetTag(*getter_AddRefs(tag));
+        target->GetTag(getter_AddRefs(tag));
         if (tag && tag.get() == nsHTMLAtoms::area) {
           targetIsArea = PR_TRUE;
         }
@@ -1441,7 +1441,7 @@ nsGenericHTMLElement::HandleDOMEventForAnchors(nsIContent* aOuter,
       //We are over an area.  If our element is not one, then return without
       //running anchor code.
       nsCOMPtr<nsIAtom> tag;
-      GetTag(*getter_AddRefs(tag));
+      GetTag(getter_AddRefs(tag));
       if (tag && tag.get() != nsHTMLAtoms::area) {
         return ret;
       }
@@ -1515,7 +1515,7 @@ nsGenericHTMLElement::HandleDOMEventForAnchors(nsIContent* aOuter,
           nsInputEvent* inputEvent = NS_STATIC_CAST(nsInputEvent*, aEvent);
           nsAutoString target;
           nsCOMPtr<nsIURI> baseURL;
-          GetBaseURL(*getter_AddRefs(baseURL));
+          GetBaseURL(getter_AddRefs(baseURL));
           GetAttr(kNameSpaceID_None, nsHTMLAtoms::target, target);
           if (target.IsEmpty()) {
             GetBaseTarget(target);
@@ -1570,7 +1570,7 @@ nsGenericHTMLElement::HandleDOMEventForAnchors(nsIContent* aOuter,
       {
         nsAutoString target;
         nsCOMPtr<nsIURI> baseURL;
-        GetBaseURL(*getter_AddRefs(baseURL));
+        GetBaseURL(getter_AddRefs(baseURL));
         GetAttr(kNameSpaceID_None, nsHTMLAtoms::target, target);
         if (target.IsEmpty()) {
           GetBaseTarget(target);
@@ -1596,25 +1596,25 @@ nsGenericHTMLElement::HandleDOMEventForAnchors(nsIContent* aOuter,
 }
 
 NS_IMETHODIMP
-nsGenericHTMLElement::GetNameSpaceID(PRInt32& aID) const
+nsGenericHTMLElement::GetNameSpaceID(PRInt32* aID) const
 {
   // XXX
   // XXX This is incorrect!!!!!!!!!!!!!!!!
   // XXX
-  aID = kNameSpaceID_XHTML;
+  *aID = kNameSpaceID_XHTML;
   return NS_OK;
 }
 
 nsresult
 nsGenericHTMLElement::NormalizeAttrString(const nsAString& aStr,
-                                          nsINodeInfo*& aNodeInfo)
+                                          nsINodeInfo** aNodeInfo)
 {
   // XXX need to validate/strip namespace prefix
   nsAutoString lower(aStr);
   ToLowerCase(lower);
 
   nsCOMPtr<nsINodeInfoManager> nimgr;
-  mNodeInfo->GetNodeInfoManager(*getter_AddRefs(nimgr));
+  mNodeInfo->GetNodeInfoManager(getter_AddRefs(nimgr));
   NS_ENSURE_TRUE(nimgr, NS_ERROR_FAILURE);
 
   return nimgr->GetNodeInfo(lower, nsnull, kNameSpaceID_None, aNodeInfo);
@@ -1634,12 +1634,12 @@ nsGenericHTMLElement::SetAttr(PRInt32 aNameSpaceID,
 
   if (aNameSpaceID != kNameSpaceID_None) {
     nsCOMPtr<nsINodeInfoManager> nimgr;
-    result = mNodeInfo->GetNodeInfoManager(*getter_AddRefs(nimgr));
+    result = mNodeInfo->GetNodeInfoManager(getter_AddRefs(nimgr));
     NS_ENSURE_SUCCESS(result, result);
 
     nsCOMPtr<nsINodeInfo> ni;
     result = nimgr->GetNodeInfo(aAttribute, nsnull, kNameSpaceID_None,
-                                *getter_AddRefs(ni));
+                                getter_AddRefs(ni));
     NS_ENSURE_SUCCESS(result, result);
 
     return SetAttr(ni, aValue, aNotify);
@@ -1769,12 +1769,8 @@ nsGenericHTMLElement::SetAttr(nsINodeInfo* aNodeInfo,
 {
   NS_ENSURE_ARG_POINTER(aNodeInfo);
 
-  nsresult rv;
-  nsCOMPtr<nsIAtom> localName;
-  PRInt32 namespaceID;
-
-  aNodeInfo->GetNameAtom(*getter_AddRefs(localName));
-  aNodeInfo->GetNamespaceID(namespaceID);
+  nsCOMPtr<nsIAtom> localName = aNodeInfo->GetNameAtom();
+  PRInt32 namespaceID = aNodeInfo->GetNamespaceID();
 
   NS_ASSERTION(namespaceID != kNameSpaceID_XHTML,
                "Error, attribute on [X]HTML element set with XHTML namespace, "
@@ -1791,7 +1787,7 @@ nsGenericHTMLElement::SetAttr(nsINodeInfo* aNodeInfo,
   nsAutoString strValue;
 
   // don't do any update if old == new
-  rv = GetAttr(namespaceID, localName, strValue);
+  nsresult rv = GetAttr(namespaceID, localName, strValue);
   if (rv != NS_CONTENT_ATTR_NOT_THERE && aValue.Equals(strValue))
     return NS_OK;
 
@@ -2129,17 +2125,17 @@ nsGenericHTMLElement::GetAttr(PRInt32 aNameSpaceID, nsIAtom *aAttribute,
                               nsAString& aResult) const
 {
   nsCOMPtr<nsIAtom> prefix;
-  return GetAttr(aNameSpaceID, aAttribute, *getter_AddRefs(prefix), aResult);
+  return GetAttr(aNameSpaceID, aAttribute, getter_AddRefs(prefix), aResult);
 }
 
 nsresult
 nsGenericHTMLElement::GetAttr(PRInt32 aNameSpaceID, nsIAtom *aAttribute,
-                              nsIAtom*& aPrefix, nsAString& aResult) const
+                              nsIAtom** aPrefix, nsAString& aResult) const
 {
   nsresult rv;
   aResult.Truncate();
 
-  aPrefix = nsnull;
+  *aPrefix = nsnull;
   const nsHTMLValue* value;
   if (aNameSpaceID != kNameSpaceID_None) {
     rv = mAttributes ? mAttributes->GetAttribute(aAttribute, aNameSpaceID,
@@ -2238,17 +2234,19 @@ nsGenericHTMLElement::GetHTMLAttribute(nsIAtom* aAttribute,
 
 nsresult
 nsGenericHTMLElement::GetAttrNameAt(PRInt32 aIndex,
-                                    PRInt32& aNameSpaceID,
-                                    nsIAtom*& aName,
-                                    nsIAtom*& aPrefix) const
+                                    PRInt32* aNameSpaceID,
+                                    nsIAtom** aName,
+                                    nsIAtom** aPrefix) const
 {
-  if (nsnull != mAttributes) {
+  if (mAttributes) {
     return mAttributes->GetAttributeNameAt(aIndex, aNameSpaceID, aName,
                                            aPrefix);
   }
-  aNameSpaceID = kNameSpaceID_None;
-  aName = nsnull;
-  aPrefix = nsnull;
+
+  *aNameSpaceID = kNameSpaceID_None;
+  *aName = nsnull;
+  *aPrefix = nsnull;
+
   return NS_ERROR_ILLEGAL_VALUE;
 }
 
@@ -2263,12 +2261,14 @@ nsGenericHTMLElement::GetAttrCount(PRInt32& aCount) const
 }
 
 nsresult
-nsGenericHTMLElement::GetID(nsIAtom*& aResult) const
+nsGenericHTMLElement::GetID(nsIAtom** aResult) const
 {
-  if (nsnull != mAttributes) {
+  if (mAttributes) {
     return mAttributes->GetID(aResult);
   }
-  aResult = nsnull;
+
+  *aResult = nsnull;
+
   return NS_OK;
 }
 
@@ -2326,7 +2326,7 @@ nsGenericHTMLElement::GetInlineStyleRule(nsIStyleRule** aStyleRule)
 }
 
 nsresult
-nsGenericHTMLElement::GetBaseURL(nsIURI*& aBaseURL) const
+nsGenericHTMLElement::GetBaseURL(nsIURI** aBaseURL) const
 {
   nsHTMLValue baseHref;
   if (mAttributes) {
@@ -2336,10 +2336,10 @@ nsGenericHTMLElement::GetBaseURL(nsIURI*& aBaseURL) const
   nsCOMPtr<nsIDocument> doc(mDocument);
 
   if (!doc) {
-    mNodeInfo->GetDocument(*getter_AddRefs(doc));
+    mNodeInfo->GetDocument(getter_AddRefs(doc));
   }
 
-  return GetBaseURL(baseHref, doc, &aBaseURL);
+  return GetBaseURL(baseHref, doc, aBaseURL);
 }
 
 nsresult
@@ -2349,10 +2349,10 @@ nsGenericHTMLElement::GetBaseURL(const nsHTMLValue& aBaseHref,
 {
   nsresult result = NS_OK;
 
-  nsIURI* docBaseURL = nsnull;
+  nsCOMPtr<nsIURI> docBaseURL;
 
   if (aDocument) {
-    result = aDocument->GetBaseURL(docBaseURL);
+    result = aDocument->GetBaseURL(getter_AddRefs(docBaseURL));
   }
 
   *aBaseURL = docBaseURL;
@@ -2362,13 +2362,13 @@ nsGenericHTMLElement::GetBaseURL(const nsHTMLValue& aBaseHref,
     aBaseHref.GetStringValue(baseHref);
     baseHref.Trim(" \t\n\r");
 
-    nsIURI* url = nsnull;
-    result = NS_NewURI(&url, baseHref, nsnull, docBaseURL);
+    nsCOMPtr<nsIURI> url;
+    result = NS_NewURI(getter_AddRefs(url), baseHref, nsnull, docBaseURL);
 
-    NS_IF_RELEASE(docBaseURL);
     *aBaseURL = url;
   }
 
+  NS_IF_ADDREF(*aBaseURL);
   return result;
 }
 
@@ -2404,11 +2404,11 @@ nsGenericHTMLElement::ListAttributes(FILE* out) const
   GetAttrCount(count);
   for (index = 0; index < count; index++) {
     // name
-    nsIAtom* attr = nsnull;
-    nsIAtom* prefix = nsnull;
+    nsCOMPtr<nsIAtom> attr;
+    nsCOMPtr<nsIAtom> prefix;
     PRInt32 nameSpaceID;
-    GetAttrNameAt(index, nameSpaceID, attr, prefix);
-    NS_IF_RELEASE(prefix);
+    GetAttrNameAt(index, &nameSpaceID, getter_AddRefs(attr),
+                  getter_AddRefs(prefix));
 
     nsAutoString buffer;
     attr->ToString(buffer);
@@ -2426,7 +2426,6 @@ nsGenericHTMLElement::ListAttributes(FILE* out) const
 
     fputs(" ", out);
     fputs(NS_LossyConvertUCS2toASCII(buffer).get(), out);
-    NS_RELEASE(attr);
   }
 }
 
@@ -2439,7 +2438,7 @@ nsGenericHTMLElement::List(FILE* out, PRInt32 aIndent) const
   for (index = aIndent; --index >= 0; ) fputs("  ", out);
 
   nsCOMPtr<nsIAtom> tag;
-  GetTag(*getter_AddRefs(tag));
+  GetTag(getter_AddRefs(tag));
   if (tag) {
     nsAutoString buf;
     tag->ToString(buf);
@@ -2457,11 +2456,10 @@ nsGenericHTMLElement::List(FILE* out, PRInt32 aIndent) const
     fputs("\n", out);
     PRInt32 kids;
     ChildCount(kids);
+    nsCOMPtr<nsIContent> kid;
     for (index = 0; index < kids; index++) {
-      nsIContent* kid;
-      ChildAt(index, kid);
+      ChildAt(index, getter_AddRefs(kid));
       kid->List(out, aIndent + 1);
-      NS_RELEASE(kid);
     }
     for (index = aIndent; --index >= 0; ) fputs("  ", out);
   }
@@ -2479,7 +2477,7 @@ nsGenericHTMLElement::DumpContent(FILE* out, PRInt32 aIndent,PRBool aDumpAll) co
 
   nsAutoString buf;
   nsCOMPtr<nsIAtom> tag;
-  GetTag(*getter_AddRefs(tag));
+  GetTag(getter_AddRefs(tag));
   if (tag) {
     tag->ToString(buf);
     fputs("<",out);
@@ -2496,12 +2494,11 @@ nsGenericHTMLElement::DumpContent(FILE* out, PRInt32 aIndent,PRBool aDumpAll) co
     if(aIndent) fputs("\n", out);
     PRInt32 kids;
     ChildCount(kids);
+    nsCOMPtr<nsIContent> kid;
     for (index = 0; index < kids; index++) {
-      nsIContent* kid;
-      ChildAt(index, kid);
-      PRInt32 indent=(aIndent)? aIndent+1:0;
-      kid->DumpContent(out,indent,aDumpAll);
-      NS_RELEASE(kid);
+      ChildAt(index, getter_AddRefs(kid));
+      PRInt32 indent = aIndent ? aIndent + 1 : 0;
+      kid->DumpContent(out, indent, aDumpAll);
     }
     for (index = aIndent; --index >= 0; ) fputs("  ", out);
     fputs("</",out);
@@ -2677,7 +2674,7 @@ nsGenericHTMLElement::GetLayoutHistoryAndKey(nsIHTMLContent* aContent,
   // Get the pres shell
   //
   nsCOMPtr<nsIDocument> doc;
-  nsresult rv = aContent->GetDocument(*getter_AddRefs(doc));
+  nsresult rv = aContent->GetDocument(getter_AddRefs(doc));
   if (!doc) {
     return rv;
   }
@@ -2743,22 +2740,20 @@ nsresult
 nsGenericHTMLElement::GetPresContext(nsIHTMLContent* aContent,
                                      nsIPresContext** aPresContext)
 {
-  nsIDocument* doc = nsnull;
-  nsresult res = NS_NOINTERFACE;
-   // Get the document
-  if (NS_OK == aContent->GetDocument(doc)) {
-    if (nsnull != doc) {
-       // Get presentation shell 0
-      nsCOMPtr<nsIPresShell> presShell;
-      doc->GetShellAt(0, getter_AddRefs(presShell));
-      if (nsnull != presShell) {
-        res = presShell->GetPresContext(aPresContext);
-      }
-      NS_RELEASE(doc);
+  nsCOMPtr<nsIDocument> doc;
+
+  // Get the document
+  aContent->GetDocument(getter_AddRefs(doc));
+  if (doc) {
+    // Get presentation shell 0
+    nsCOMPtr<nsIPresShell> presShell;
+    doc->GetShellAt(0, getter_AddRefs(presShell));
+    if (presShell) {
+      return presShell->GetPresContext(aPresContext);
     }
   }
 
-  return res;
+  return NS_NOINTERFACE;
 }
 
 // XXX check all mappings against ebina's usage
@@ -3078,7 +3073,7 @@ nsGenericHTMLElement::ParseStyleAttribute(const nsAString& aValue, nsHTMLValue&
   nsCOMPtr<nsIDocument> doc = mDocument;
 
   if (!doc) {
-    mNodeInfo->GetDocument(*getter_AddRefs(doc));
+    mNodeInfo->GetDocument(getter_AddRefs(doc));
   }
 
   if (doc) {
@@ -3112,7 +3107,7 @@ nsGenericHTMLElement::ParseStyleAttribute(const nsAString& aValue, nsHTMLValue&
       }
       if (cssParser) {
         nsCOMPtr<nsIURI> docURL;
-        doc->GetBaseURL(*getter_AddRefs(docURL));
+        doc->GetBaseURL(getter_AddRefs(docURL));
 
         nsCOMPtr<nsIStyleRule> rule;
         result = cssParser->ParseStyleAttribute(aValue, docURL, getter_AddRefs(rule));
@@ -3624,13 +3619,13 @@ nsGenericHTMLContainerElement::ChildCount(PRInt32& aCount) const
 
 NS_IMETHODIMP
 nsGenericHTMLContainerElement::ChildAt(PRInt32 aIndex,
-                                       nsIContent*& aResult) const
+                                       nsIContent** aResult) const
 {
   // I really prefer NOT to do this test on all ChildAt calls - perhaps we
   // should add FastChildAt().
   nsIContent *child = (nsIContent *)mChildren.SafeElementAt(aIndex);
   NS_IF_ADDREF(child);
-  aResult = child;
+  *aResult = child;
 
   return NS_OK;
 }
@@ -3832,7 +3827,7 @@ nsGenericHTMLContainerElement::ReplaceContentsWithText(const nsAString& aText,
   nsCOMPtr<nsIDOMText> textChild;
   // if we already have a DOMText child, reuse it.
   if (children > 0) {
-    rv = ChildAt(0, *getter_AddRefs(firstChild));
+    rv = ChildAt(0, getter_AddRefs(firstChild));
     NS_ENSURE_SUCCESS(rv, rv);
     textChild = do_QueryInterface(firstChild);
   }
@@ -3872,7 +3867,7 @@ nsGenericHTMLContainerElement::GetContentsAsText(nsAString& aText)
 
   PRInt32 i;
   for (i = 0; i < children; ++i) {
-    ChildAt(i, *getter_AddRefs(child));
+    ChildAt(i, getter_AddRefs(child));
     tc = do_QueryInterface(child);
     if (tc) {
       if (aText.IsEmpty()) {
@@ -4033,7 +4028,7 @@ nsGenericHTMLContainerFormElement::SetDocument(nsIDocument* aDocument,
     nsCOMPtr<nsIContent> formContent(do_QueryInterface(mForm, &rv));
     if (formContent) {
       nsCOMPtr<nsIDocument> doc;
-      rv = formContent->GetDocument(*getter_AddRefs(doc));
+      rv = formContent->GetDocument(getter_AddRefs(doc));
       NS_ENSURE_SUCCESS(rv, rv);
       if (doc) {
         SetForm(nsnull);
@@ -4283,7 +4278,7 @@ nsGenericHTMLLeafFormElement::SetDocument(nsIDocument* aDocument,
     nsCOMPtr<nsIContent> formContent(do_QueryInterface(mForm, &rv));
     if (formContent) {
       nsCOMPtr<nsIDocument> doc;
-      rv = formContent->GetDocument(*getter_AddRefs(doc));
+      rv = formContent->GetDocument(getter_AddRefs(doc));
       NS_ENSURE_SUCCESS(rv, rv);
       if (doc) {
         SetForm(nsnull);
@@ -4579,7 +4574,7 @@ nsGenericHTMLElement::GetProtocolFromHrefString(const nsAString& aHref,
     nsCOMPtr<nsIURI> uri;
 
     if (aDocument) {
-      aDocument->GetBaseURL(*getter_AddRefs(uri));
+      aDocument->GetBaseURL(getter_AddRefs(uri));
 
       if (!uri) {
         aDocument->GetDocumentURL(getter_AddRefs(uri));
diff --git a/content/html/content/src/nsGenericHTMLElement.h b/content/html/content/src/nsGenericHTMLElement.h
index 916629ba0c22..fe8f78f186c1 100644
--- a/content/html/content/src/nsGenericHTMLElement.h
+++ b/content/html/content/src/nsGenericHTMLElement.h
@@ -176,9 +176,9 @@ public:
   // Implementation for nsIContent
   NS_IMETHOD SetDocument(nsIDocument* aDocument, PRBool aDeep,
                          PRBool aCompileEventHandlers);
-  NS_IMETHOD GetNameSpaceID(PRInt32& aID) const;
+  NS_IMETHOD GetNameSpaceID(PRInt32* aID) const;
   NS_IMETHOD NormalizeAttrString(const nsAString& aStr,
-                                 nsINodeInfo*& aNodeInfo);
+                                 nsINodeInfo** aNodeInfo);
   NS_IMETHOD SetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
                      const nsAString& aValue,
                           PRBool aNotify);
@@ -188,14 +188,14 @@ public:
   NS_IMETHOD GetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
                      nsAString& aResult) const;
   NS_IMETHOD GetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
-                     nsIAtom*& aPrefix, nsAString& aResult) const;
+                     nsIAtom** aPrefix, nsAString& aResult) const;
   NS_IMETHOD_(PRBool) HasAttr(PRInt32 aNameSpaceID, nsIAtom* aName) const;
   NS_IMETHOD UnsetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
                        PRBool aNotify);
   NS_IMETHOD GetAttrNameAt(PRInt32 aIndex,
-                           PRInt32& aNameSpaceID, 
-                           nsIAtom*& aName,
-                           nsIAtom*& aPrefix) const;
+                           PRInt32* aNameSpaceID,
+                           nsIAtom** aName,
+                           nsIAtom** aPrefix) const;
   NS_IMETHOD GetAttrCount(PRInt32& aResult) const;
 #ifdef DEBUG
   NS_IMETHOD List(FILE* out, PRInt32 aIndent) const;
@@ -218,12 +218,12 @@ public:
   NS_IMETHOD SetHTMLAttribute(nsIAtom* aAttribute, const nsHTMLValue& aValue,
                               PRBool aNotify);
   NS_IMETHOD GetHTMLAttribute(nsIAtom* aAttribute, nsHTMLValue& aValue) const;
-  NS_IMETHOD GetID(nsIAtom*& aResult) const;
+  NS_IMETHOD GetID(nsIAtom** aResult) const;
   NS_IMETHOD GetClasses(nsVoidArray& aArray) const;
   NS_IMETHOD_(PRBool) HasClass(nsIAtom* aClass, PRBool aCaseSensitive) const;
   NS_IMETHOD WalkContentStyleRules(nsRuleWalker* aRuleWalker);
   NS_IMETHOD GetInlineStyleRule(nsIStyleRule** aStyleRule);
-  NS_IMETHOD GetBaseURL(nsIURI*& aBaseURL) const;
+  NS_IMETHOD GetBaseURL(nsIURI** aBaseURL) const;
   NS_IMETHOD GetBaseTarget(nsAString& aBaseTarget) const;
 
   //----------------------------------------
@@ -814,7 +814,7 @@ public:
     aResult = 0;
     return NS_OK;
   }
-  NS_IMETHOD ChildAt(PRInt32 aIndex, nsIContent*& aResult) const {
+  NS_IMETHOD ChildAt(PRInt32 aIndex, nsIContent** aResult) const {
     aResult = nsnull;
     return NS_OK;
   }
@@ -883,7 +883,7 @@ public:
   NS_IMETHOD Compact();
   NS_IMETHOD CanContainChildren(PRBool& aResult) const;
   NS_IMETHOD ChildCount(PRInt32& aResult) const;
-  NS_IMETHOD ChildAt(PRInt32 aIndex, nsIContent*& aResult) const;
+  NS_IMETHOD ChildAt(PRInt32 aIndex, nsIContent** aResult) const;
   NS_IMETHOD IndexOf(nsIContent* aPossibleChild, PRInt32& aResult) const;
   NS_IMETHOD InsertChildAt(nsIContent* aKid, PRInt32 aIndex, PRBool aNotify,
                            PRBool aDeepSetDocument);
diff --git a/content/html/content/src/nsHTMLAnchorElement.cpp b/content/html/content/src/nsHTMLAnchorElement.cpp
index 00071748ed5b..a333b2e1890a 100644
--- a/content/html/content/src/nsHTMLAnchorElement.cpp
+++ b/content/html/content/src/nsHTMLAnchorElement.cpp
@@ -310,7 +310,7 @@ nsHTMLAnchorElement::RemoveFocus(nsIPresContext* aPresContext)
 
   if (esm) {
     nsCOMPtr<nsIDocument> doc;
-    GetDocument(*getter_AddRefs(doc));
+    GetDocument(getter_AddRefs(doc));
     if (!doc)
       return NS_ERROR_NULL_POINTER;
 
@@ -404,7 +404,7 @@ nsHTMLAnchorElement::GetProtocol(nsAString& aProtocol)
     return rv;
 
   nsCOMPtr<nsIDocument> doc;
-  mNodeInfo->GetDocument(*getter_AddRefs(doc));
+  mNodeInfo->GetDocument(getter_AddRefs(doc));
 
   return GetProtocolFromHrefString(href, aProtocol, doc);
 }
@@ -673,7 +673,7 @@ nsHTMLAnchorElement::GetHrefCString(char* &aBuf)
 
     // Get base URL.
     nsCOMPtr<nsIURI> baseURL;
-    GetBaseURL(*getter_AddRefs(baseURL));
+    GetBaseURL(getter_AddRefs(baseURL));
 
     if (baseURL) {
       // Get absolute URL.
diff --git a/content/html/content/src/nsHTMLAreaElement.cpp b/content/html/content/src/nsHTMLAreaElement.cpp
index b7ab2cfdb52e..7cf96de46683 100644
--- a/content/html/content/src/nsHTMLAreaElement.cpp
+++ b/content/html/content/src/nsHTMLAreaElement.cpp
@@ -365,7 +365,7 @@ nsHTMLAreaElement::GetProtocol(nsAString& aProtocol)
     return rv;
 
   nsCOMPtr<nsIDocument> doc;
-  mNodeInfo->GetDocument(*getter_AddRefs(doc));
+  mNodeInfo->GetDocument(getter_AddRefs(doc));
 
   return GetProtocolFromHrefString(href, aProtocol, doc);
 }
@@ -583,7 +583,7 @@ nsHTMLAreaElement::GetHrefCString(char* &aBuf)
 
     // Get base URL.
     nsCOMPtr<nsIURI> baseURL;
-    GetBaseURL(*getter_AddRefs(baseURL));
+    GetBaseURL(getter_AddRefs(baseURL));
 
     if (baseURL) {
       // Get absolute URL.
diff --git a/content/html/content/src/nsHTMLButtonElement.cpp b/content/html/content/src/nsHTMLButtonElement.cpp
index cf2920c21d1c..520f17fc32a7 100644
--- a/content/html/content/src/nsHTMLButtonElement.cpp
+++ b/content/html/content/src/nsHTMLButtonElement.cpp
@@ -285,7 +285,7 @@ nsHTMLButtonElement::Click()
 
   mHandlingClick = PR_TRUE;
   nsCOMPtr<nsIDocument> doc; 
-  GetDocument(*getter_AddRefs(doc));
+  GetDocument(getter_AddRefs(doc));
 
   if (doc) {
     PRInt32 numShells = doc->GetNumberOfShells();
@@ -361,7 +361,7 @@ nsHTMLButtonElement::RemoveFocus(nsIPresContext* aPresContext)
   if (NS_OK == aPresContext->GetEventStateManager(getter_AddRefs(esm))) {
 
     nsCOMPtr<nsIDocument> doc;
-    GetDocument(*getter_AddRefs(doc));
+    GetDocument(getter_AddRefs(doc));
     if (!doc)
       return NS_ERROR_NULL_POINTER;
 
diff --git a/content/html/content/src/nsHTMLFormElement.cpp b/content/html/content/src/nsHTMLFormElement.cpp
index e1d2760e8e5f..4500e9e02b50 100644
--- a/content/html/content/src/nsHTMLFormElement.cpp
+++ b/content/html/content/src/nsHTMLFormElement.cpp
@@ -789,7 +789,7 @@ nsHTMLFormElement::DoSubmitOrReset(nsIPresContext* aPresContext,
 
   // Make sure the presentation is up-to-date
   nsCOMPtr<nsIDocument> doc;
-  GetDocument(*getter_AddRefs(doc));
+  GetDocument(getter_AddRefs(doc));
   if (doc) {
     doc->FlushPendingNotifications();
   }
@@ -1306,7 +1306,7 @@ nsHTMLFormElement::GetActionURL(nsIURI** aActionURL)
     NS_ENSURE_SUCCESS(rv, rv);
   } else {
     nsCOMPtr<nsIURI> baseURL;
-    GetBaseURL(*getter_AddRefs(baseURL));
+    GetBaseURL(getter_AddRefs(baseURL));
     NS_ASSERTION(baseURL, "No Base URL found in Form Submit!\n");
     if (!baseURL) {
       return NS_OK; // No base URL -> exit early, see Bug 30721
diff --git a/content/html/content/src/nsHTMLFrameSetElement.cpp b/content/html/content/src/nsHTMLFrameSetElement.cpp
index e8bd2325c895..132746254357 100644
--- a/content/html/content/src/nsHTMLFrameSetElement.cpp
+++ b/content/html/content/src/nsHTMLFrameSetElement.cpp
@@ -518,7 +518,7 @@ nsHTMLFrameSetElement::ParseRowColSpec(nsString&       aSpec,
         htmlDocument = do_QueryInterface(mDocument);
       } else {
         nsCOMPtr<nsIDocument> doc;
-        mNodeInfo->GetDocument(*getter_AddRefs(doc));
+        mNodeInfo->GetDocument(getter_AddRefs(doc));
         htmlDocument = do_QueryInterface(doc);
       }
       if (htmlDocument) {
diff --git a/content/html/content/src/nsHTMLImageElement.cpp b/content/html/content/src/nsHTMLImageElement.cpp
index 8b76fb6cb3f0..8bddc284ae9f 100644
--- a/content/html/content/src/nsHTMLImageElement.cpp
+++ b/content/html/content/src/nsHTMLImageElement.cpp
@@ -167,12 +167,12 @@ NS_NewHTMLImageElement(nsIHTMLContent** aInstancePtrResult,
     NS_ENSURE_TRUE(doc, NS_ERROR_UNEXPECTED);
 
     nsCOMPtr<nsINodeInfoManager> nodeInfoManager;
-    doc->GetNodeInfoManager(*getter_AddRefs(nodeInfoManager));
+    doc->GetNodeInfoManager(getter_AddRefs(nodeInfoManager));
     NS_ENSURE_TRUE(nodeInfoManager, NS_ERROR_UNEXPECTED);
 
     rv = nodeInfoManager->GetNodeInfo(nsHTMLAtoms::img, nsnull,
                                       kNameSpaceID_None,
-                                      *getter_AddRefs(nodeInfo));
+                                      getter_AddRefs(nodeInfo));
     NS_ENSURE_SUCCESS(rv, rv);
   }
 
@@ -672,7 +672,7 @@ nsHTMLImageElement::GetSrc(nsAString& aSrc)
   nsCOMPtr<nsIURI> baseURL;
 
   // Get base URL.
-  GetBaseURL(*getter_AddRefs(baseURL));
+  GetBaseURL(getter_AddRefs(baseURL));
 
   // Get href= attribute (relative URL).
   nsGenericHTMLLeafElement::GetAttr(kNameSpaceID_None, nsHTMLAtoms::src,
diff --git a/content/html/content/src/nsHTMLInputElement.cpp b/content/html/content/src/nsHTMLInputElement.cpp
index 533fd7117952..f6e540efa0a4 100644
--- a/content/html/content/src/nsHTMLInputElement.cpp
+++ b/content/html/content/src/nsHTMLInputElement.cpp
@@ -1101,7 +1101,7 @@ nsHTMLInputElement::RemoveFocus(nsIPresContext* aPresContext)
   if (esm) {
     nsCOMPtr<nsIDocument> doc;
 
-    GetDocument(*getter_AddRefs(doc));
+    GetDocument(getter_AddRefs(doc));
 
     if (!doc)
       return NS_ERROR_NULL_POINTER;
@@ -1236,7 +1236,7 @@ nsHTMLInputElement::Click()
       mType == NS_FORM_INPUT_SUBMIT) {
 
     nsCOMPtr<nsIDocument> doc; // Strong
-    rv = GetDocument(*getter_AddRefs(doc));
+    rv = GetDocument(getter_AddRefs(doc));
 
     if (doc) {
       PRInt32 numShells = doc->GetNumberOfShells();
diff --git a/content/html/content/src/nsHTMLLabelElement.cpp b/content/html/content/src/nsHTMLLabelElement.cpp
index 7efe240ff80a..b01e3451eaa9 100644
--- a/content/html/content/src/nsHTMLLabelElement.cpp
+++ b/content/html/content/src/nsHTMLLabelElement.cpp
@@ -339,12 +339,14 @@ EventTargetIn(nsIPresContext *aPresContext, nsEvent *aEvent,
     if (c == aChild) {
       return PR_TRUE;
     }
+
     if (c == aStop) {
       break;
     }
-    nsIContent *parent;
-    c->GetParent(parent);
-    c = dont_AddRef(parent);
+
+    nsCOMPtr<nsIContent> parent;
+    c->GetParent(getter_AddRefs(parent));
+    c.swap(parent);
   }
   return PR_FALSE;
 }
@@ -512,7 +514,7 @@ nsHTMLLabelElement::GetFirstFormControl(nsIContent *current)
   if (NS_SUCCEEDED(rv)) {
     for (PRInt32 i = 0; i < numNodes; i++) {
       nsIContent *child;
-      current->ChildAt(i, child);
+      current->ChildAt(i, &child);
       if (child) {
         if (child->IsContentOfType(nsIContent::eHTML_FORM_CONTROL)) {
           return child;
diff --git a/content/html/content/src/nsHTMLLinkElement.cpp b/content/html/content/src/nsHTMLLinkElement.cpp
index 0356d940330e..a166734b0c8d 100644
--- a/content/html/content/src/nsHTMLLinkElement.cpp
+++ b/content/html/content/src/nsHTMLLinkElement.cpp
@@ -388,7 +388,7 @@ nsHTMLLinkElement::GetHrefCString(char* &aBuf)
 
     // Get base URL.
     nsCOMPtr<nsIURI> baseURL;
-    GetBaseURL(*getter_AddRefs(baseURL));
+    GetBaseURL(getter_AddRefs(baseURL));
 
     if (baseURL) {
       // Get absolute URL.
diff --git a/content/html/content/src/nsHTMLOptGroupElement.cpp b/content/html/content/src/nsHTMLOptGroupElement.cpp
index d13725dd7b70..6c23e19d08b1 100644
--- a/content/html/content/src/nsHTMLOptGroupElement.cpp
+++ b/content/html/content/src/nsHTMLOptGroupElement.cpp
@@ -218,14 +218,14 @@ nsHTMLOptGroupElement::GetSelect(nsISelectElement **aSelectElement)
   // Get the containing element (Either a select or an optGroup)
   nsCOMPtr<nsIContent> parent;
   nsCOMPtr<nsIContent> prevParent;
-  GetParent(*getter_AddRefs(parent));
+  GetParent(getter_AddRefs(parent));
   while (parent) {
     CallQueryInterface(parent, aSelectElement);
     if (*aSelectElement) {
       break;
     }
     prevParent = parent;
-    prevParent->GetParent(*getter_AddRefs(parent));
+    prevParent->GetParent(getter_AddRefs(parent));
   }
 }
 
diff --git a/content/html/content/src/nsHTMLOptionElement.cpp b/content/html/content/src/nsHTMLOptionElement.cpp
index 8d9a28cfdb65..b17c12665a19 100644
--- a/content/html/content/src/nsHTMLOptionElement.cpp
+++ b/content/html/content/src/nsHTMLOptionElement.cpp
@@ -170,12 +170,12 @@ NS_NewHTMLOptionElement(nsIHTMLContent** aInstancePtrResult,
     NS_ENSURE_TRUE(doc, NS_ERROR_UNEXPECTED);
 
     nsCOMPtr<nsINodeInfoManager> nodeInfoManager;
-    doc->GetNodeInfoManager(*getter_AddRefs(nodeInfoManager));
+    doc->GetNodeInfoManager(getter_AddRefs(nodeInfoManager));
     NS_ENSURE_TRUE(nodeInfoManager, NS_ERROR_UNEXPECTED);
 
     rv = nodeInfoManager->GetNodeInfo(nsHTMLAtoms::option, nsnull,
                                       kNameSpaceID_None,
-                                      *getter_AddRefs(nodeInfo));
+                                      getter_AddRefs(nodeInfo));
     NS_ENSURE_SUCCESS(rv, rv);
   }
 
@@ -538,7 +538,7 @@ nsHTMLOptionElement::GetText(nsAString& aText)
   for (i = 0; i < numNodes; i++) {
     nsCOMPtr<nsIContent> node;
 
-    ChildAt(i, *getter_AddRefs(node));
+    ChildAt(i, getter_AddRefs(node));
 
     if (node) {
       nsCOMPtr<nsIDOMText> domText(do_QueryInterface(node));
@@ -578,7 +578,7 @@ nsHTMLOptionElement::SetText(const nsAString& aText)
   for (i = 0; i < numNodes; i++) {
     nsCOMPtr<nsIContent> node;
 
-    ChildAt(i, *getter_AddRefs(node));
+    ChildAt(i, getter_AddRefs(node));
 
     nsCOMPtr<nsIDOMText> domText(do_QueryInterface(node));
 
@@ -609,7 +609,7 @@ nsHTMLOptionElement::SetText(const nsAString& aText)
 
     nsCOMPtr<nsIDocument> doc;
 
-    GetDocument(*getter_AddRefs(doc));
+    GetDocument(getter_AddRefs(doc));
 
     if (doc) {
       rv = text->SetDocument(doc, PR_FALSE, PR_TRUE);
@@ -715,14 +715,14 @@ nsHTMLOptionElement::GetSelect(nsIDOMHTMLSelectElement **aSelectElement) const
   // Get the containing element (Either a select or an optGroup)
   nsCOMPtr<nsIContent> parent;
   nsCOMPtr<nsIContent> prevParent;
-  GetParent(*getter_AddRefs(parent));
+  GetParent(getter_AddRefs(parent));
   while (parent) {
     CallQueryInterface(parent, aSelectElement);
     if (*aSelectElement) {
       break;
     }
     prevParent = parent;
-    prevParent->GetParent(*getter_AddRefs(parent));
+    prevParent->GetParent(getter_AddRefs(parent));
   }
 }
 
diff --git a/content/html/content/src/nsHTMLSelectElement.cpp b/content/html/content/src/nsHTMLSelectElement.cpp
index 3c3cd2cb7ec6..b670a53843b1 100644
--- a/content/html/content/src/nsHTMLSelectElement.cpp
+++ b/content/html/content/src/nsHTMLSelectElement.cpp
@@ -756,7 +756,7 @@ nsHTMLSelectElement::InsertOptionsIntoListRecurse(nsIContent* aOptions,
   }
 
   nsCOMPtr<nsIAtom> tag;
-  aOptions->GetTag(*getter_AddRefs(tag));
+  aOptions->GetTag(getter_AddRefs(tag));
   if (tag == nsHTMLAtoms::optgroup) {
     mOptGroupCount++;
     DispatchDOMEvent(NS_LITERAL_STRING("selectHasGroups"));
@@ -772,8 +772,8 @@ nsHTMLSelectElement::InsertOptionsIntoListRecurse(nsIContent* aOptions,
   PRInt32 numChildren;
   aOptions->ChildCount(numChildren);
   nsCOMPtr<nsIContent> child;
-  for (PRInt32 i=0;i<numChildren;i++) {
-    aOptions->ChildAt(i,*getter_AddRefs(child));
+  for (PRInt32 i = 0; i < numChildren; ++i) {
+    aOptions->ChildAt(i, getter_AddRefs(child));
     nsresult rv = InsertOptionsIntoListRecurse(child, aInsertIndex, aDepth+1);
     NS_ENSURE_SUCCESS(rv, rv);
   }
@@ -809,7 +809,7 @@ nsHTMLSelectElement::RemoveOptionsFromListRecurse(nsIContent* aOptions,
 
   if (mOptGroupCount) {
     nsCOMPtr<nsIAtom> tag;
-    aOptions->GetTag(*getter_AddRefs(tag));
+    aOptions->GetTag(getter_AddRefs(tag));
     if (tag == nsHTMLAtoms::optgroup) {
       mOptGroupCount--;
       DispatchDOMEvent(NS_LITERAL_STRING("selectHasNoGroups"));
@@ -826,9 +826,11 @@ nsHTMLSelectElement::RemoveOptionsFromListRecurse(nsIContent* aOptions,
   PRInt32 numChildren;
   aOptions->ChildCount(numChildren);
   nsCOMPtr<nsIContent> child;
-  for (PRInt32 i=0;i<numChildren;i++) {
-    aOptions->ChildAt(i,*getter_AddRefs(child));
-    nsresult rv = RemoveOptionsFromListRecurse(child, aRemoveIndex, aNumRemoved, aDepth+1);
+  for (PRInt32 i = 0; i < numChildren; ++i) {
+    aOptions->ChildAt(i, getter_AddRefs(child));
+    nsresult rv = RemoveOptionsFromListRecurse(child, aRemoveIndex,
+                                               aNumRemoved,
+                                               aDepth + 1);
     NS_ENSURE_SUCCESS(rv, rv);
   }
 
@@ -869,7 +871,7 @@ nsHTMLSelectElement::WillAddOptions(nsIContent* aOptions,
       // we want to get the option currently at the index and insert in front of
       // that.
       nsCOMPtr<nsIContent> currentKid;
-      aParent->ChildAt(aContentIndex, *getter_AddRefs(currentKid));
+      aParent->ChildAt(aContentIndex, getter_AddRefs(currentKid));
       NS_ASSERTION(currentKid, "Child not found!");
       if (currentKid) {
         ind = GetOptionIndexAt(currentKid);
@@ -895,7 +897,7 @@ nsHTMLSelectElement::WillRemoveOptions(nsIContent* aParent,
 
   // Get the index where the options will be removed
   nsCOMPtr<nsIContent> currentKid;
-  aParent->ChildAt(aContentIndex, *getter_AddRefs(currentKid));
+  aParent->ChildAt(aContentIndex, getter_AddRefs(currentKid));
   if (currentKid) {
     PRInt32 ind;
     if (!mNonOptionChildren) { 
@@ -924,7 +926,7 @@ nsHTMLSelectElement::GetContentDepth(nsIContent* aContent)
   while (content != this) {
     retval++;
     prevContent = content;
-    prevContent->GetParent(*getter_AddRefs(content));
+    prevContent->GetParent(getter_AddRefs(content));
     if (!content) {
       retval = -1;
       break;
@@ -963,7 +965,7 @@ nsHTMLSelectElement::GetOptionIndexAfter(nsIContent* aOptions)
   PRInt32 retval = -1;
 
   nsCOMPtr<nsIContent> parent;
-  aOptions->GetParent(*getter_AddRefs(parent));
+  aOptions->GetParent(getter_AddRefs(parent));
 
   if (parent) {
     PRInt32 index;
@@ -1007,8 +1009,8 @@ nsHTMLSelectElement::GetFirstChildOptionIndex(nsIContent* aOptions,
 {
   PRInt32 retval = -1;
   nsCOMPtr<nsIContent> child;
-  for (PRInt32 i=aStartIndex;i<aEndIndex;i++) {
-    aOptions->ChildAt(i,*getter_AddRefs(child));
+  for (PRInt32 i = aStartIndex; i < aEndIndex; ++i) {
+    aOptions->ChildAt(i, getter_AddRefs(child));
     retval = GetFirstOptionIndex(child);
     if (retval != -1) {
       break;
@@ -1137,7 +1139,7 @@ nsHTMLSelectElement::SetLength(PRUint32 aLength)
     nsCOMPtr<nsIHTMLContent> element;
     nsCOMPtr<nsINodeInfo> nodeInfo;
 
-    mNodeInfo->NameChanged(nsHTMLAtoms::option, *getter_AddRefs(nodeInfo));
+    mNodeInfo->NameChanged(nsHTMLAtoms::option, getter_AddRefs(nodeInfo));
 
     rv = NS_NewHTMLOptionElement(getter_AddRefs(element), nodeInfo);
     NS_ENSURE_SUCCESS(rv, rv);
@@ -1733,7 +1735,7 @@ nsHTMLSelectElement::RemoveFocus(nsIPresContext* aPresContext)
   if (esm) {
     nsCOMPtr<nsIDocument> doc;
 
-    GetDocument(*getter_AddRefs(doc));
+    GetDocument(getter_AddRefs(doc));
 
     if (!doc) {
       return NS_ERROR_NULL_POINTER;
@@ -2191,7 +2193,7 @@ void
 nsHTMLSelectElement::DispatchDOMEvent(const nsAString& aName)
 {
   nsCOMPtr<nsIDocument> document;
-  GetDocument(*getter_AddRefs(document));
+  GetDocument(getter_AddRefs(document));
   nsCOMPtr<nsIDOMDocumentEvent> domDoc = do_QueryInterface(document);
   if (domDoc) {
     nsCOMPtr<nsIDOMEvent> selectEvent;
diff --git a/content/html/content/src/nsHTMLSpanElement.cpp b/content/html/content/src/nsHTMLSpanElement.cpp
index cb7a9c092480..702e99ee8b51 100644
--- a/content/html/content/src/nsHTMLSpanElement.cpp
+++ b/content/html/content/src/nsHTMLSpanElement.cpp
@@ -146,7 +146,7 @@ nsresult
 nsHTMLSpanElement::GetInnerHTML(nsAString& aInnerHTML)
 {
   nsCOMPtr<nsIAtom> tag;
-  GetTag(*getter_AddRefs(tag));
+  GetTag(getter_AddRefs(tag));
   if (tag == nsHTMLAtoms::xmp || tag == nsHTMLAtoms::plaintext) {
     return GetContentsAsText(aInnerHTML);
   }
@@ -158,7 +158,7 @@ nsresult
 nsHTMLSpanElement::SetInnerHTML(const nsAString& aInnerHTML)
 {
   nsCOMPtr<nsIAtom> tag;
-  GetTag(*getter_AddRefs(tag));
+  GetTag(getter_AddRefs(tag));
   if (tag == nsHTMLAtoms::xmp || tag == nsHTMLAtoms::plaintext) {
     return ReplaceContentsWithText(aInnerHTML, PR_TRUE);
   }
diff --git a/content/html/content/src/nsHTMLStyleElement.cpp b/content/html/content/src/nsHTMLStyleElement.cpp
index f572736a1452..a239ef1a7a5c 100644
--- a/content/html/content/src/nsHTMLStyleElement.cpp
+++ b/content/html/content/src/nsHTMLStyleElement.cpp
@@ -327,7 +327,7 @@ nsHTMLStyleElement::GetHrefCString(char* &aBuf)
 
     // Get base URL.
     nsCOMPtr<nsIURI> baseURL;
-    GetBaseURL(*getter_AddRefs(baseURL));
+    GetBaseURL(getter_AddRefs(baseURL));
 
     if (baseURL) {
       // Get absolute URL.
diff --git a/content/html/content/src/nsHTMLTableCellElement.cpp b/content/html/content/src/nsHTMLTableCellElement.cpp
index 8bc63563f7a4..597c0ae391cc 100644
--- a/content/html/content/src/nsHTMLTableCellElement.cpp
+++ b/content/html/content/src/nsHTMLTableCellElement.cpp
@@ -248,17 +248,17 @@ nsHTMLTableCellElement::WalkContentStyleRules(nsRuleWalker* aRuleWalker)
   // XXX can we safely presume structure or do we need to QI on the way up?
   nsCOMPtr<nsIContent> row;
 
-  GetParent(*getter_AddRefs(row));
+  GetParent(getter_AddRefs(row));
 
   if (row) {
     nsCOMPtr<nsIContent> section;
 
-    row->GetParent(*getter_AddRefs(section));
+    row->GetParent(getter_AddRefs(section));
 
     if (section) {
       nsCOMPtr<nsIContent> table;
 
-      section->GetParent(*getter_AddRefs(table));
+      section->GetParent(getter_AddRefs(table));
 
       if (table) {
         nsCOMPtr<nsIStyledContent> styledTable(do_QueryInterface(table));
diff --git a/content/html/content/src/nsHTMLTableElement.cpp b/content/html/content/src/nsHTMLTableElement.cpp
index 948aac84ad7e..241e5e91be55 100644
--- a/content/html/content/src/nsHTMLTableElement.cpp
+++ b/content/html/content/src/nsHTMLTableElement.cpp
@@ -465,7 +465,7 @@ nsHTMLTableElement::GetTHead(nsIDOMHTMLTableSectionElement** aValue)
       nsCOMPtr<nsIAtom> tag;
       nsCOMPtr<nsIContent> content = do_QueryInterface(section);
 
-      content->GetTag(*getter_AddRefs(tag));
+      content->GetTag(getter_AddRefs(tag));
       if (tag.get() == nsHTMLAtoms::thead) {
         *aValue = section;
         NS_ADDREF(*aValue);
@@ -517,7 +517,7 @@ nsHTMLTableElement::GetTFoot(nsIDOMHTMLTableSectionElement** aValue)
       nsCOMPtr<nsIAtom> tag;
       nsCOMPtr<nsIContent> content = do_QueryInterface(section);
 
-      content->GetTag(*getter_AddRefs(tag));
+      content->GetTag(getter_AddRefs(tag));
 
       if (tag.get() == nsHTMLAtoms::tfoot) {
         *aValue = section;
@@ -599,7 +599,7 @@ nsHTMLTableElement::CreateTHead(nsIDOMHTMLElement** aValue)
     nsCOMPtr<nsIHTMLContent> newHead;
     nsCOMPtr<nsINodeInfo> nodeInfo;
 
-    mNodeInfo->NameChanged(nsHTMLAtoms::thead, *getter_AddRefs(nodeInfo));
+    mNodeInfo->NameChanged(nsHTMLAtoms::thead, getter_AddRefs(nodeInfo));
 
     rv = NS_NewHTMLTableSectionElement(getter_AddRefs(newHead),nodeInfo);
 
@@ -656,7 +656,7 @@ nsHTMLTableElement::CreateTFoot(nsIDOMHTMLElement** aValue)
     nsCOMPtr<nsIHTMLContent> newFoot;
 
     nsCOMPtr<nsINodeInfo> nodeInfo;
-    mNodeInfo->NameChanged(nsHTMLAtoms::tfoot, *getter_AddRefs(nodeInfo));
+    mNodeInfo->NameChanged(nsHTMLAtoms::tfoot, getter_AddRefs(nodeInfo));
 
     rv = NS_NewHTMLTableSectionElement(getter_AddRefs(newFoot),nodeInfo);
 
@@ -703,7 +703,7 @@ nsHTMLTableElement::CreateCaption(nsIDOMHTMLElement** aValue)
     nsCOMPtr<nsIHTMLContent> newCaption;
 
     nsCOMPtr<nsINodeInfo> nodeInfo;
-    mNodeInfo->NameChanged(nsHTMLAtoms::caption, *getter_AddRefs(nodeInfo));
+    mNodeInfo->NameChanged(nsHTMLAtoms::caption, getter_AddRefs(nodeInfo));
 
     rv = NS_NewHTMLTableCaptionElement(getter_AddRefs(newCaption),nodeInfo);
 
@@ -781,7 +781,7 @@ nsHTMLTableElement::InsertRow(PRInt32 aIndex, nsIDOMHTMLElement** aValue)
     nsCOMPtr<nsIHTMLContent> newRow;
 
     nsCOMPtr<nsINodeInfo> nodeInfo;
-    mNodeInfo->NameChanged(nsHTMLAtoms::tr, *getter_AddRefs(nodeInfo));
+    mNodeInfo->NameChanged(nsHTMLAtoms::tr, getter_AddRefs(nodeInfo));
 
     rv = NS_NewHTMLTableRowElement(getter_AddRefs(newRow), nodeInfo);
 
@@ -848,7 +848,7 @@ nsHTMLTableElement::InsertRow(PRInt32 aIndex, nsIDOMHTMLElement** aValue)
       nsCOMPtr<nsIHTMLContent> newRowGroup;
 
       nsCOMPtr<nsINodeInfo> nodeInfo;
-      mNodeInfo->NameChanged(nsHTMLAtoms::tbody, *getter_AddRefs(nodeInfo));
+      mNodeInfo->NameChanged(nsHTMLAtoms::tbody, getter_AddRefs(nodeInfo));
 
       rv = NS_NewHTMLTableSectionElement(getter_AddRefs(newRowGroup),
                                          nodeInfo);
@@ -864,7 +864,7 @@ nsHTMLTableElement::InsertRow(PRInt32 aIndex, nsIDOMHTMLElement** aValue)
       nsCOMPtr<nsIHTMLContent> newRow;
 
       nsCOMPtr<nsINodeInfo> nodeInfo;
-      mNodeInfo->NameChanged(nsHTMLAtoms::tr, *getter_AddRefs(nodeInfo));
+      mNodeInfo->NameChanged(nsHTMLAtoms::tr, getter_AddRefs(nodeInfo));
 
       rv = NS_NewHTMLTableRowElement(getter_AddRefs(newRow), nodeInfo);
       nsCOMPtr<nsIContent> rowGroupContent(do_QueryInterface(rowGroup));
diff --git a/content/html/content/src/nsHTMLTableRowElement.cpp b/content/html/content/src/nsHTMLTableRowElement.cpp
index 69b24b4cb837..dea2474a33ba 100644
--- a/content/html/content/src/nsHTMLTableRowElement.cpp
+++ b/content/html/content/src/nsHTMLTableRowElement.cpp
@@ -97,11 +97,11 @@ nsTableCellCollection::GetLength(PRUint32* aLength)
     nsCOMPtr<nsIContent> child;
     PRUint32 childIndex = 0;
 
-    mParent->ChildAt(childIndex, *getter_AddRefs(child));
+    mParent->ChildAt(childIndex, getter_AddRefs(child));
 
     while (child) {
       nsCOMPtr<nsIAtom> childTag;
-      child->GetTag(*getter_AddRefs(childTag));
+      child->GetTag(getter_AddRefs(childTag));
 
       if ((nsHTMLAtoms::td == childTag.get()) ||
           (nsHTMLAtoms::th == childTag.get())) {
@@ -109,7 +109,7 @@ nsTableCellCollection::GetLength(PRUint32* aLength)
       }
 
       childIndex++;
-      mParent->ChildAt(childIndex, *getter_AddRefs(child));
+      mParent->ChildAt(childIndex, getter_AddRefs(child));
     }
   }
 
@@ -128,12 +128,12 @@ nsTableCellCollection::Item(PRUint32     aIndex,
     nsCOMPtr<nsIContent> child;
     PRUint32 childIndex = 0;
 
-    mParent->ChildAt(childIndex, *getter_AddRefs(child));
+    mParent->ChildAt(childIndex, getter_AddRefs(child));
 
     while (child) {
       nsCOMPtr<nsIAtom> childTag;
 
-      child->GetTag(*getter_AddRefs(childTag));
+      child->GetTag(getter_AddRefs(childTag));
 
       if ((nsHTMLAtoms::td == childTag.get()) ||
           (nsHTMLAtoms::th == childTag.get())) {
@@ -147,7 +147,7 @@ nsTableCellCollection::Item(PRUint32     aIndex,
       }
 
       childIndex++;
-      mParent->ChildAt(childIndex, *getter_AddRefs(child));
+      mParent->ChildAt(childIndex, getter_AddRefs(child));
     }
   }
 
@@ -200,7 +200,7 @@ void DebugList(nsIDOMHTMLTableElement* aTable) {
   nsCOMPtr<nsIHTMLContent> content = do_QueryInterface(aTable);
   if (content) {
     nsCOMPtr<nsIDocument> doc;
-    result = content->GetDocument(*getter_AddRefs(doc));
+    result = content->GetDocument(getter_AddRefs(doc));
     if (doc) {
       nsCOMPtr<nsIContent> root;
       doc->GetRootContent(getter_AddRefs(root));
@@ -441,7 +441,7 @@ nsHTMLTableRowElement::InsertCell(PRInt32 aIndex, nsIDOMHTMLElement** aValue)
 
   // create the cell
   nsCOMPtr<nsINodeInfo> nodeInfo;
-  mNodeInfo->NameChanged(nsHTMLAtoms::td, *getter_AddRefs(nodeInfo));
+  mNodeInfo->NameChanged(nsHTMLAtoms::td, getter_AddRefs(nodeInfo));
 
   nsCOMPtr<nsIHTMLContent> cellContent;
   nsresult rv = NS_NewHTMLTableCellElement(getter_AddRefs(cellContent),
diff --git a/content/html/content/src/nsHTMLTableSectionElement.cpp b/content/html/content/src/nsHTMLTableSectionElement.cpp
index 3343aaaa6b9b..f3e194a116d8 100644
--- a/content/html/content/src/nsHTMLTableSectionElement.cpp
+++ b/content/html/content/src/nsHTMLTableSectionElement.cpp
@@ -216,7 +216,7 @@ nsHTMLTableSectionElement::InsertRow(PRInt32 aIndex,
 
   // create the row
   nsCOMPtr<nsINodeInfo> nodeInfo;
-  mNodeInfo->NameChanged(nsHTMLAtoms::tr, *getter_AddRefs(nodeInfo));
+  mNodeInfo->NameChanged(nsHTMLAtoms::tr, getter_AddRefs(nodeInfo));
 
   nsCOMPtr<nsIHTMLContent> rowContent;
   nsresult rv = NS_NewHTMLTableRowElement(getter_AddRefs(rowContent),
diff --git a/content/html/content/src/nsHTMLTextAreaElement.cpp b/content/html/content/src/nsHTMLTextAreaElement.cpp
index 4fa6670d641e..e6329a5e014a 100644
--- a/content/html/content/src/nsHTMLTextAreaElement.cpp
+++ b/content/html/content/src/nsHTMLTextAreaElement.cpp
@@ -324,7 +324,7 @@ nsHTMLTextAreaElement::RemoveFocus(nsIPresContext* aPresContext)
   if (esm) {
     nsCOMPtr<nsIDocument> doc;
 
-    GetDocument(*getter_AddRefs(doc));
+    GetDocument(getter_AddRefs(doc));
     if (!doc)
       return NS_ERROR_NULL_POINTER;
 
diff --git a/content/html/content/src/nsHTMLTitleElement.cpp b/content/html/content/src/nsHTMLTitleElement.cpp
index 5f1a401b0dc6..cd2aac11876c 100644
--- a/content/html/content/src/nsHTMLTitleElement.cpp
+++ b/content/html/content/src/nsHTMLTitleElement.cpp
@@ -172,7 +172,7 @@ nsHTMLTitleElement::SetText(const nsAString& aTitle)
   nsCOMPtr<nsIDOMNode> child;
   nsCOMPtr<nsIDocument> document;
 
-  result = GetDocument(*getter_AddRefs(document));
+  result = GetDocument(getter_AddRefs(document));
 
   if (NS_OK == result) {
     nsCOMPtr<nsIDOMHTMLDocument> htmlDoc(do_QueryInterface(document));
diff --git a/content/html/document/src/nsHTMLContentSink.cpp b/content/html/document/src/nsHTMLContentSink.cpp
index 3a0620585a0b..92b3e2788f5e 100644
--- a/content/html/document/src/nsHTMLContentSink.cpp
+++ b/content/html/document/src/nsHTMLContentSink.cpp
@@ -922,7 +922,7 @@ HTMLContentSink::CreateContentObject(const nsIParserNode& aNode,
     ToLowerCase(tmp);
 
     rv = mNodeInfoManager->GetNodeInfo(tmp, nsnull, kNameSpaceID_None,
-                                       *getter_AddRefs(nodeInfo));
+                                       getter_AddRefs(nodeInfo));
   } else {
     nsCOMPtr<nsIDTD> dtd;
     rv = mParser->GetDTD(getter_AddRefs(dtd));
@@ -930,7 +930,7 @@ HTMLContentSink::CreateContentObject(const nsIParserNode& aNode,
       nsDependentString tag(dtd->IntTagToStringTag(aNodeType));
 
       rv = mNodeInfoManager->GetNodeInfo(tag, nsnull, kNameSpaceID_None,
-                                         *getter_AddRefs(nodeInfo));
+                                         getter_AddRefs(nodeInfo));
     }
   }
 
@@ -1001,9 +1001,7 @@ NS_CreateHTMLElement(nsIHTMLContent** aResult, nsINodeInfo *aNodeInfo,
   if (!parserService)
     return NS_ERROR_OUT_OF_MEMORY;
 
-  nsCOMPtr<nsIAtom> name;
-  rv = aNodeInfo->GetNameAtom(*getter_AddRefs(name));
-  NS_ENSURE_SUCCESS(rv, rv);
+  nsCOMPtr<nsIAtom> name = aNodeInfo->GetNameAtom();
 
   // Find tag in tag table
   PRInt32 id;
@@ -1032,7 +1030,7 @@ NS_CreateHTMLElement(nsIHTMLContent** aResult, nsINodeInfo *aNodeInfo,
       if (!name->Equals(nsDependentString(tag))) {
         nsCOMPtr<nsIAtom> atom = do_GetAtom(tag);
 
-        rv = aNodeInfo->NameChanged(atom, *getter_AddRefs(kungFuDeathGrip));
+        rv = aNodeInfo->NameChanged(atom, getter_AddRefs(kungFuDeathGrip));
         NS_ENSURE_SUCCESS(rv, rv);
 
         nodeInfo = kungFuDeathGrip;
@@ -1719,7 +1717,7 @@ SinkContext::CloseContainer(const nsHTMLTag aTag)
 #ifdef NS_DEBUG
       // Tracing code
       nsCOMPtr<nsIAtom> tag;
-      mStack[mStackPos].mContent->GetTag(*getter_AddRefs(tag));
+      mStack[mStackPos].mContent->GetTag(getter_AddRefs(tag));
       const char *tagStr;
       tag->GetUTF8String(&tagStr);
 
@@ -2135,7 +2133,7 @@ SinkContext::FlushTags(PRBool aNotify)
 #ifdef NS_DEBUG
         // Tracing code
         nsCOMPtr<nsIAtom> tag;
-        mStack[stackPos].mContent->GetTag(*getter_AddRefs(tag));
+        mStack[stackPos].mContent->GetTag(getter_AddRefs(tag));
         const char* tagStr;
         tag->GetUTF8String(&tagStr);
 
@@ -2455,7 +2453,7 @@ HTMLContentSink::Init(nsIDocument* aDoc,
   aDoc->AddObserver(this);
   CallQueryInterface(aDoc, &mHTMLDocument);
 
-  rv = mDocument->GetNodeInfoManager(*getter_AddRefs(mNodeInfoManager));
+  rv = mDocument->GetNodeInfoManager(getter_AddRefs(mNodeInfoManager));
   NS_ENSURE_SUCCESS(rv, rv);
 
   mDocumentURI = aURL;
@@ -2574,7 +2572,7 @@ HTMLContentSink::Init(nsIDocument* aDoc,
   nsCOMPtr<nsINodeInfo> nodeInfo;
   rv = mNodeInfoManager->GetNodeInfo(nsHTMLAtoms::html, nsnull,
                                      kNameSpaceID_None,
-                                     *getter_AddRefs(nodeInfo));
+                                     getter_AddRefs(nodeInfo));
   NS_ENSURE_SUCCESS(rv, rv);
 
   // Make root part
@@ -2601,7 +2599,7 @@ HTMLContentSink::Init(nsIDocument* aDoc,
   // Make head part
   rv = mNodeInfoManager->GetNodeInfo(NS_LITERAL_STRING("head"),
                                      nsnull, kNameSpaceID_None,
-                                     *getter_AddRefs(nodeInfo));
+                                     getter_AddRefs(nodeInfo));
   NS_ENSURE_SUCCESS(rv, rv);
 
   rv = NS_NewHTMLHeadElement(&mHead, nodeInfo);
@@ -3310,7 +3308,7 @@ HTMLContentSink::OpenForm(const nsIParserNode& aNode)
     nsCOMPtr<nsINodeInfo> nodeInfo;
     result = mNodeInfoManager->GetNodeInfo(nsHTMLAtoms::form, nsnull,
                                            kNameSpaceID_None,
-                                           *getter_AddRefs(nodeInfo));
+                                           getter_AddRefs(nodeInfo));
     NS_ENSURE_SUCCESS(result, result);
 
     nsCOMPtr<nsIHTMLContent> content;
@@ -3642,7 +3640,7 @@ HTMLContentSink::SetDocumentTitle(const nsAString& aTitle)
   nsCOMPtr<nsINodeInfo> nodeInfo;
   nsresult rv = mNodeInfoManager->GetNodeInfo(nsHTMLAtoms::title, nsnull,
                                               kNameSpaceID_None,
-                                              *getter_AddRefs(nodeInfo));
+                                              getter_AddRefs(nodeInfo));
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCOMPtr<nsIHTMLContent> it;
@@ -4447,7 +4445,7 @@ HTMLContentSink::ProcessBaseHref(const nsAString& aBaseHref)
 
     if (NS_SUCCEEDED(rv)) {
       NS_RELEASE(mDocumentBaseURL);
-      mDocument->GetBaseURL(mDocumentBaseURL);
+      mDocument->GetBaseURL(&mDocumentBaseURL);
     }
   } else {
     // NAV compatibility quirk
@@ -4565,7 +4563,7 @@ HTMLContentSink::ProcessBASETag(const nsIParserNode& aNode)
     nsCOMPtr<nsINodeInfo> nodeInfo;
     mNodeInfoManager->GetNodeInfo(NS_LITERAL_STRING("base"), nsnull,
                                   kNameSpaceID_None,
-                                  *getter_AddRefs(nodeInfo));
+                                  getter_AddRefs(nodeInfo));
 
     result = NS_CreateHTMLElement(getter_AddRefs(element), nodeInfo, PR_FALSE);
     NS_ENSURE_SUCCESS(result, result);
@@ -4967,7 +4965,7 @@ HTMLContentSink::ProcessLINKTag(const nsIParserNode& aNode)
     nsCOMPtr<nsIHTMLContent> element;
     nsCOMPtr<nsINodeInfo> nodeInfo;
     mNodeInfoManager->GetNodeInfo(nsHTMLAtoms::link, nsnull, kNameSpaceID_None,
-                                  *getter_AddRefs(nodeInfo));
+                                  getter_AddRefs(nodeInfo));
 
     result = NS_CreateHTMLElement(getter_AddRefs(element), nodeInfo, PR_FALSE);
     NS_ENSURE_SUCCESS(result, result);
@@ -5065,7 +5063,7 @@ HTMLContentSink::ProcessMETATag(const nsIParserNode& aNode)
   nsCOMPtr<nsINodeInfo> nodeInfo;
   rv = mNodeInfoManager->GetNodeInfo(NS_LITERAL_STRING("meta"), nsnull,
                                      kNameSpaceID_None,
-                                     *getter_AddRefs(nodeInfo));
+                                     getter_AddRefs(nodeInfo));
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCOMPtr<nsIHTMLContent> it;
@@ -5606,7 +5604,7 @@ HTMLContentSink::ProcessSCRIPTTag(const nsIParserNode& aNode)
   nsCOMPtr<nsIHTMLContent> element;
   nsCOMPtr<nsINodeInfo> nodeInfo;
   mNodeInfoManager->GetNodeInfo(nsHTMLAtoms::script, nsnull, kNameSpaceID_None,
-                                *getter_AddRefs(nodeInfo));
+                                getter_AddRefs(nodeInfo));
 
   rv = NS_CreateHTMLElement(getter_AddRefs(element), nodeInfo, PR_FALSE);
   if (NS_FAILED(rv)) {
@@ -5737,7 +5735,7 @@ HTMLContentSink::ProcessSTYLETag(const nsIParserNode& aNode)
   // Create content object
   nsCOMPtr<nsINodeInfo> nodeInfo;
   mNodeInfoManager->GetNodeInfo(nsHTMLAtoms::style, nsnull, kNameSpaceID_None,
-                                *getter_AddRefs(nodeInfo));
+                                getter_AddRefs(nodeInfo));
 
   nsCOMPtr<nsIHTMLContent> element;
   rv = NS_CreateHTMLElement(getter_AddRefs(element), nodeInfo, PR_FALSE);
diff --git a/content/html/document/src/nsHTMLDocument.cpp b/content/html/document/src/nsHTMLDocument.cpp
index 98cf661d4dec..882826cb88d2 100644
--- a/content/html/document/src/nsHTMLDocument.cpp
+++ b/content/html/document/src/nsHTMLDocument.cpp
@@ -1375,7 +1375,7 @@ nsHTMLDocument::ContentAppended(nsIContent* aContainer,
   PRInt32 i;
   nsCOMPtr<nsIContent> newChild;
   for (i = aNewIndexInContainer; i < count; ++i) {
-    aContainer->ChildAt(i, *getter_AddRefs(newChild));
+    aContainer->ChildAt(i, getter_AddRefs(newChild));
     if (newChild)
       RegisterNamedItems(newChild);
   }
@@ -1447,7 +1447,7 @@ nsHTMLDocument::AttributeWillChange(nsIContent* aContent, PRInt32 aNameSpaceID,
     nsCOMPtr<nsIAtom> tag;
     nsAutoString value;
 
-    aContent->GetTag(*getter_AddRefs(tag));
+    aContent->GetTag(getter_AddRefs(tag));
 
     if (IsNamedItem(aContent, tag, value)) {
       nsresult rv = RemoveFromNameTable(value, aContent);
@@ -1480,7 +1480,7 @@ nsHTMLDocument::AttributeChanged(nsIContent* aContent, PRInt32 aNameSpaceID,
     nsCOMPtr<nsIAtom> tag;
     nsAutoString value;
 
-    aContent->GetTag(*getter_AddRefs(tag));
+    aContent->GetTag(getter_AddRefs(tag));
 
     if (IsNamedItem(aContent, tag, value)) {
       nsresult rv = UpdateNameTableEntry(value, aContent);
@@ -1553,15 +1553,13 @@ nsHTMLDocument::CreateElementNS(const nsAString& aNamespaceURI,
                                 const nsAString& aQualifiedName,
                                 nsIDOMElement** aReturn)
 {
-  nsresult rv = NS_OK;
-
   nsCOMPtr<nsINodeInfo> nodeInfo;
-  rv = mNodeInfoManager->GetNodeInfo(aQualifiedName, aNamespaceURI,
-                                     *getter_AddRefs(nodeInfo));
+  nsresult rv = mNodeInfoManager->GetNodeInfo(aQualifiedName,
+                                              aNamespaceURI,
+                                              getter_AddRefs(nodeInfo));
   NS_ENSURE_SUCCESS(rv, rv);
 
-  PRInt32 namespaceID;
-  nodeInfo->GetNamespaceID(namespaceID);
+  PRInt32 namespaceID = nodeInfo->GetNamespaceID();
 
   nsCOMPtr<nsIElementFactory> elementFactory;
   nsContentUtils::GetNSManagerWeakRef()->GetElementFactory(namespaceID,
@@ -1603,7 +1601,7 @@ nsHTMLDocument::CreateElement(const nsAString& aTagName,
   }
 
   nsresult rv = mNodeInfoManager->GetNodeInfo(tmp, nsnull, mDefaultNamespaceID,
-                                              *getter_AddRefs(nodeInfo));
+                                              getter_AddRefs(nodeInfo));
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCOMPtr<nsIHTMLContent> content;
@@ -2184,7 +2182,7 @@ PRInt32
 GetHTMLDocumentNamespace(nsIContent *aContent)
 {
   nsCOMPtr<nsIDocument> doc;
-  aContent->GetDocument(*getter_AddRefs(doc));
+  aContent->GetDocument(getter_AddRefs(doc));
 
   NS_ASSERTION(doc, "This method should never be called on content nodes "
                "that are not in a document!");
@@ -2207,7 +2205,7 @@ PRBool
 nsHTMLDocument::MatchLinks(nsIContent *aContent, nsString* aData)
 {
   nsCOMPtr<nsINodeInfo> ni;
-  aContent->GetNodeInfo(*getter_AddRefs(ni));
+  aContent->GetNodeInfo(getter_AddRefs(ni));
 
   if (ni) {
     PRInt32 namespaceID = GetHTMLDocumentNamespace(aContent);
@@ -2241,7 +2239,7 @@ PRBool
 nsHTMLDocument::MatchAnchors(nsIContent *aContent, nsString* aData)
 {
   nsCOMPtr<nsINodeInfo> ni;
-  aContent->GetNodeInfo(*getter_AddRefs(ni));
+  aContent->GetNodeInfo(getter_AddRefs(ni));
 
   if (ni) {
     PRInt32 namespaceID = GetHTMLDocumentNamespace(aContent);
@@ -2481,8 +2479,8 @@ nsHTMLDocument::OpenCommon(nsIURI* aSourceURL)
       nsCOMPtr<nsIAtom> name, prefix;
       PRInt32 nsid;
 
-      root->GetAttrNameAt(count, nsid, *getter_AddRefs(name),
-                          *getter_AddRefs(prefix));
+      root->GetAttrNameAt(count, &nsid, getter_AddRefs(name),
+                          getter_AddRefs(prefix));
 
       root->UnsetAttr(nsid, name, PR_FALSE);
     }
@@ -3610,7 +3608,7 @@ nsHTMLDocument::UnregisterNamedItems(nsIContent *aContent)
 {
   nsCOMPtr<nsIAtom> tag;
 
-  aContent->GetTag(*getter_AddRefs(tag));
+  aContent->GetTag(getter_AddRefs(tag));
 
   if (tag == nsLayoutAtoms::textTagName) {
     // Text nodes are not named items nor can they have children.
@@ -3640,13 +3638,11 @@ nsHTMLDocument::UnregisterNamedItems(nsIContent *aContent)
   aContent->ChildCount(count);
 
   for (i = 0; i < count; i++) {
-    nsIContent *child;
+    nsCOMPtr<nsIContent> child;
 
-    aContent->ChildAt(i, child);
+    aContent->ChildAt(i, getter_AddRefs(child));
 
     UnregisterNamedItems(child);
-
-    NS_RELEASE(child);
   }
 
   return NS_OK;
@@ -3657,7 +3653,7 @@ nsHTMLDocument::RegisterNamedItems(nsIContent *aContent)
 {
   nsCOMPtr<nsIAtom> tag;
 
-  aContent->GetTag(*getter_AddRefs(tag));
+  aContent->GetTag(getter_AddRefs(tag));
 
   if (tag == nsLayoutAtoms::textTagName) {
     // Text nodes are not named items nor can they have children.
@@ -3686,13 +3682,11 @@ nsHTMLDocument::RegisterNamedItems(nsIContent *aContent)
   aContent->ChildCount(count);
 
   for (i = 0; i < count; i++) {
-    nsIContent *child;
+    nsCOMPtr<nsIContent> child;
 
-    aContent->ChildAt(i, child);
+    aContent->ChildAt(i, getter_AddRefs(child));
 
     RegisterNamedItems(child);
-
-    NS_RELEASE(child);
   }
 
   return NS_OK;
@@ -3706,7 +3700,7 @@ FindNamedItems(const nsAString& aName, nsIContent *aContent,
                "Entry w/o content list passed to FindNamedItems()!");
 
   nsCOMPtr<nsIAtom> tag;
-  aContent->GetTag(*getter_AddRefs(tag));
+  aContent->GetTag(getter_AddRefs(tag));
 
   if (tag == nsLayoutAtoms::textTagName) {
     // Text nodes are not named items nor can they have children.
@@ -3735,7 +3729,7 @@ FindNamedItems(const nsAString& aName, nsIContent *aContent,
   nsCOMPtr<nsIContent> child;
 
   for (i = 0; i < count; i++) {
-    aContent->ChildAt(i, *getter_AddRefs(child));
+    aContent->ChildAt(i, getter_AddRefs(child));
 
     FindNamedItems(aName, child, aEntry, aIsXHTML);
   }
@@ -3874,7 +3868,7 @@ nsHTMLDocument::ResolveName(const nsAString& aName,
 
   if (e && e != ID_NOT_IN_DOCUMENT) {
     nsCOMPtr<nsIAtom> tag;
-    e->GetTag(*getter_AddRefs(tag));
+    e->GetTag(getter_AddRefs(tag));
 
     if (tag == nsHTMLAtoms::embed  ||
         tag == nsHTMLAtoms::img    ||
@@ -3907,12 +3901,12 @@ nsHTMLDocument::GetBodyContent()
   for (i = 0; i < child_count; i++) {
     nsCOMPtr<nsIContent> child;
 
-    root->ChildAt(i, *getter_AddRefs(child));
+    root->ChildAt(i, getter_AddRefs(child));
     NS_ENSURE_TRUE(child, NS_ERROR_UNEXPECTED);
 
     if (child->IsContentOfType(nsIContent::eHTML)) {
       nsCOMPtr<nsINodeInfo> ni;
-      child->GetNodeInfo(*getter_AddRefs(ni));
+      child->GetNodeInfo(getter_AddRefs(ni));
 
       if (ni->Equals(nsHTMLAtoms::body, mDefaultNamespaceID)) {
         mBodyContent = do_QueryInterface(child);
diff --git a/content/html/document/src/nsHTMLFragmentContentSink.cpp b/content/html/document/src/nsHTMLFragmentContentSink.cpp
index e8436f72a56b..ba86ba911211 100644
--- a/content/html/document/src/nsHTMLFragmentContentSink.cpp
+++ b/content/html/document/src/nsHTMLFragmentContentSink.cpp
@@ -338,7 +338,7 @@ nsHTMLFragmentContentSink::SetTitle(const nsString& aValue)
   nsCOMPtr<nsINodeInfo> nodeInfo;
   result = mNodeInfoManager->GetNodeInfo(nsHTMLAtoms::title, nsnull, 
                                          kNameSpaceID_None,
-                                         *getter_AddRefs(nodeInfo));
+                                         getter_AddRefs(nodeInfo));
   if(NS_SUCCEEDED(result)) {
     nsCOMPtr<nsIHTMLContent> content=nsnull;
     result = NS_NewHTMLTitleElement(getter_AddRefs(content), nodeInfo);
@@ -492,7 +492,7 @@ nsHTMLFragmentContentSink::OpenContainer(const nsIParserNode& aNode)
       result =
         mNodeInfoManager->GetNodeInfo(aNode.GetText(), nsnull,
                                       kNameSpaceID_None,
-                                      *getter_AddRefs(nodeInfo));
+                                      getter_AddRefs(nodeInfo));
     } else {
       nsIParserService* parserService =
         nsContentUtils::GetParserServiceWeakRef();
@@ -507,7 +507,7 @@ nsHTMLFragmentContentSink::OpenContainer(const nsIParserNode& aNode)
       result =
         mNodeInfoManager->GetNodeInfo(nsDependentString(name), nsnull,
                                       kNameSpaceID_None,
-                                      *getter_AddRefs(nodeInfo));
+                                      getter_AddRefs(nodeInfo));
     }
 
     NS_ENSURE_SUCCESS(result, result);
@@ -587,7 +587,7 @@ nsHTMLFragmentContentSink::AddLeaf(const nsIParserNode& aNode)
           result =
             mNodeInfoManager->GetNodeInfo(aNode.GetText(), nsnull,
                                           kNameSpaceID_None,
-                                          *getter_AddRefs(nodeInfo));
+                                          getter_AddRefs(nodeInfo));
         } else {
           const PRUnichar *name = nsnull;
           result = parserService->HTMLIdToStringTag(nodeType, &name);
@@ -596,7 +596,7 @@ nsHTMLFragmentContentSink::AddLeaf(const nsIParserNode& aNode)
           result =
             mNodeInfoManager->GetNodeInfo(nsDependentString(name), nsnull,
                                           kNameSpaceID_None,
-                                          *getter_AddRefs(nodeInfo));
+                                          getter_AddRefs(nodeInfo));
         }
 
         NS_ENSURE_SUCCESS(result, result);
@@ -728,7 +728,7 @@ NS_IMETHODIMP
 nsHTMLFragmentContentSink::SetTargetDocument(nsIDocument* aTargetDocument)
 {
   if (aTargetDocument) {
-    aTargetDocument->GetNodeInfoManager(*getter_AddRefs(mNodeInfoManager));
+    aTargetDocument->GetNodeInfoManager(getter_AddRefs(mNodeInfoManager));
   }
 
   if (mNodeInfoManager) {
diff --git a/content/html/document/src/nsImageDocument.cpp b/content/html/document/src/nsImageDocument.cpp
index 235c5c8d9ced..753fbba6ce8e 100644
--- a/content/html/document/src/nsImageDocument.cpp
+++ b/content/html/document/src/nsImageDocument.cpp
@@ -485,7 +485,7 @@ nsImageDocument::CreateSyntheticDocument()
   nsCOMPtr<nsINodeInfo> nodeInfo;
   rv = mNodeInfoManager->GetNodeInfo(nsHTMLAtoms::img, nsnull,
                                      kNameSpaceID_None,
-                                     *getter_AddRefs(nodeInfo));
+                                     getter_AddRefs(nodeInfo));
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCOMPtr<nsIHTMLContent> image;
diff --git a/content/html/document/src/nsMediaDocument.cpp b/content/html/document/src/nsMediaDocument.cpp
index 324246830cd2..368326031ab5 100644
--- a/content/html/document/src/nsMediaDocument.cpp
+++ b/content/html/document/src/nsMediaDocument.cpp
@@ -175,7 +175,7 @@ nsMediaDocument::CreateSyntheticDocument()
   nsCOMPtr<nsINodeInfo> nodeInfo;
   rv = mNodeInfoManager->GetNodeInfo(nsHTMLAtoms::html, nsnull,
                                      kNameSpaceID_None,
-                                     *getter_AddRefs(nodeInfo));
+                                     getter_AddRefs(nodeInfo));
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCOMPtr<nsIHTMLContent> root;
@@ -188,7 +188,7 @@ nsMediaDocument::CreateSyntheticDocument()
 
   rv = mNodeInfoManager->GetNodeInfo(nsHTMLAtoms::body, nsnull,
                                      kNameSpaceID_None,
-                                     *getter_AddRefs(nodeInfo));
+                                     getter_AddRefs(nodeInfo));
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCOMPtr<nsIHTMLContent> body;
diff --git a/content/html/document/src/nsPluginDocument.cpp b/content/html/document/src/nsPluginDocument.cpp
index a307ce594eb5..f5b1ed90591e 100644
--- a/content/html/document/src/nsPluginDocument.cpp
+++ b/content/html/document/src/nsPluginDocument.cpp
@@ -172,7 +172,7 @@ nsPluginDocument::CreateSyntheticPluginDocument()
   nsCOMPtr<nsINodeInfo> nodeInfo;
   rv = mNodeInfoManager->GetNodeInfo(nsHTMLAtoms::embed, nsnull,
                                      kNameSpaceID_None,
-                                    *getter_AddRefs(nodeInfo));
+                                    getter_AddRefs(nodeInfo));
   NS_ENSURE_SUCCESS(rv, rv);
   rv = NS_NewHTMLSharedLeafElement(getter_AddRefs(mPluginContent), nodeInfo);
   if (NS_FAILED(rv)) {
diff --git a/content/html/style/src/nsCSSLoader.cpp b/content/html/style/src/nsCSSLoader.cpp
index ce3ad3dcfbc2..0e1727cdb8fc 100644
--- a/content/html/style/src/nsCSSLoader.cpp
+++ b/content/html/style/src/nsCSSLoader.cpp
@@ -1059,7 +1059,7 @@ CSSLoaderImpl::CreateSheet(nsIURI* aURI,
       // Inline style.  Use the document's base URL so that @import in
       // the inline sheet picks up the right base.
       NS_ASSERTION(mDocument, "How did we get in here without a document?");
-      mDocument->GetBaseURL(*getter_AddRefs(sheetURI));
+      mDocument->GetBaseURL(getter_AddRefs(sheetURI));
     }
 
     rv = NS_NewCSSStyleSheet(aSheet, sheetURI);
diff --git a/content/html/style/src/nsCSSParser.cpp b/content/html/style/src/nsCSSParser.cpp
index adeb2d402d9d..ce7e445ad1c6 100644
--- a/content/html/style/src/nsCSSParser.cpp
+++ b/content/html/style/src/nsCSSParser.cpp
@@ -1841,13 +1841,12 @@ void CSSParserImpl::ParseTypeOrUniversalSelector(PRInt32&  aDataMask,
     else {  // was universal element selector
       aSelector.SetNameSpace(kNameSpaceID_Unknown); // wildcard
       if (mNameSpace) { // look for default namespace
-        nsINameSpace* defaultNameSpace = nsnull;
-        mNameSpace->FindNameSpace(nsnull, defaultNameSpace);
+        nsCOMPtr<nsINameSpace> defaultNameSpace;
+        mNameSpace->FindNameSpace(nsnull, getter_AddRefs(defaultNameSpace));
         if (defaultNameSpace) {
           PRInt32 defaultID;
-          defaultNameSpace->GetNameSpaceID(defaultID);
+          defaultNameSpace->GetNameSpaceID(&defaultID);
           aSelector.SetNameSpace(defaultID);
-          NS_RELEASE(defaultNameSpace);
         }
       }
       aDataMask |= SEL_MASK_ELEM;
@@ -1867,7 +1866,7 @@ void CSSParserImpl::ParseTypeOrUniversalSelector(PRInt32&  aDataMask,
       if (mNameSpace) {
         ToLowerCase(buffer); // always case insensitive, since stays within CSS
         nsCOMPtr<nsIAtom> prefix = do_GetAtom(buffer);
-        mNameSpace->FindNameSpaceID(prefix, nameSpaceID);
+        mNameSpace->FindNameSpaceID(prefix, &nameSpaceID);
       } // else, no declared namespaces
       if (kNameSpaceID_Unknown == nameSpaceID) {  // unknown prefix, dump it
         REPORT_UNEXPECTED(NS_LITERAL_STRING("Unknown namespace prefix '") +
@@ -1907,13 +1906,12 @@ void CSSParserImpl::ParseTypeOrUniversalSelector(PRInt32&  aDataMask,
     else {  // was element name
       aSelector.SetNameSpace(kNameSpaceID_Unknown); // wildcard
       if (mNameSpace) { // look for default namespace
-        nsINameSpace* defaultNameSpace = nsnull;
-        mNameSpace->FindNameSpace(nsnull, defaultNameSpace);
+        nsCOMPtr<nsINameSpace> defaultNameSpace;
+        mNameSpace->FindNameSpace(nsnull, getter_AddRefs(defaultNameSpace));
         if (defaultNameSpace) {
           PRInt32 defaultID;
-          defaultNameSpace->GetNameSpaceID(defaultID);
+          defaultNameSpace->GetNameSpaceID(&defaultID);
           aSelector.SetNameSpace(defaultID);
-          NS_RELEASE(defaultNameSpace);
         }
       }
       if (mCaseSensitive) {
@@ -1971,13 +1969,12 @@ void CSSParserImpl::ParseTypeOrUniversalSelector(PRInt32&  aDataMask,
     // set namespace to unknown since it is not specified
     aSelector.SetNameSpace(kNameSpaceID_Unknown); // wildcard
     if (mNameSpace) { // look for default namespace
-      nsINameSpace* defaultNameSpace = nsnull;
-      mNameSpace->FindNameSpace(nsnull, defaultNameSpace);
+      nsCOMPtr<nsINameSpace> defaultNameSpace;
+      mNameSpace->FindNameSpace(nsnull, getter_AddRefs(defaultNameSpace));
       if (defaultNameSpace) {
         PRInt32 defaultID;
-        defaultNameSpace->GetNameSpaceID(defaultID);
+        defaultNameSpace->GetNameSpaceID(&defaultID);
         aSelector.SetNameSpace(defaultID);
-        NS_RELEASE(defaultNameSpace);
       }
     }
   }
@@ -2054,7 +2051,7 @@ void CSSParserImpl::ParseAttributeSelector(PRInt32&  aDataMask,
       if (mNameSpace) {
         ToLowerCase(attr); // always case insensitive, since stays within CSS
         nsCOMPtr<nsIAtom> prefix = do_GetAtom(attr);
-        mNameSpace->FindNameSpaceID(prefix, nameSpaceID);
+        mNameSpace->FindNameSpaceID(prefix, &nameSpaceID);
       } // else, no declared namespaces
       if (kNameSpaceID_Unknown == nameSpaceID) {  // unknown prefix, dump it
         REPORT_UNEXPECTED(NS_LITERAL_STRING("Unknown namespace prefix '") +
@@ -3536,7 +3533,7 @@ PRBool CSSParserImpl::ParseAttr(PRInt32& aErrorCode, nsCSSValue& aValue)
           if (mNameSpace) {
             ToLowerCase(holdIdent); // always case insensitive, since stays within CSS
             nsCOMPtr<nsIAtom> prefix = do_GetAtom(holdIdent);
-            mNameSpace->FindNameSpaceID(prefix, nameSpaceID);
+            mNameSpace->FindNameSpaceID(prefix, &nameSpaceID);
           } // else, no declared namespaces
           if (kNameSpaceID_Unknown == nameSpaceID) {  // unknown prefix, dump it
             return PR_FALSE;
diff --git a/content/html/style/src/nsCSSStyleRule.cpp b/content/html/style/src/nsCSSStyleRule.cpp
index 426197f10a58..10caf433d4e8 100644
--- a/content/html/style/src/nsCSSStyleRule.cpp
+++ b/content/html/style/src/nsCSSStyleRule.cpp
@@ -565,7 +565,7 @@ nsresult nsCSSSelector::ToString( nsAString& aString, nsICSSStyleSheet* aSheet,
     aSheet->GetNameSpace(*getter_AddRefs(sheetNS));
     nsCOMPtr<nsIAtom> prefixAtom;
     // will return null if namespace was the default
-    sheetNS->FindNameSpacePrefix(mNameSpace, *getter_AddRefs(prefixAtom));
+    sheetNS->FindNameSpacePrefix(mNameSpace, getter_AddRefs(prefixAtom));
     if (prefixAtom) {
       nsAutoString prefix;
       prefixAtom->ToString(prefix);
@@ -627,7 +627,8 @@ nsresult nsCSSSelector::ToString( nsAString& aString, nsICSSStyleSheet* aSheet,
         aSheet->GetNameSpace(*getter_AddRefs(sheetNS));
         nsCOMPtr<nsIAtom> prefixAtom;
         // will return null if namespace was the default
-        sheetNS->FindNameSpacePrefix(list->mNameSpace, *getter_AddRefs(prefixAtom));
+        sheetNS->FindNameSpacePrefix(list->mNameSpace,
+                                     getter_AddRefs(prefixAtom));
         if (prefixAtom) { 
           nsAutoString prefix;
           prefixAtom->ToString(prefix);
diff --git a/content/html/style/src/nsCSSStyleSheet.cpp b/content/html/style/src/nsCSSStyleSheet.cpp
index b9c6ac39a470..d5ab04818315 100644
--- a/content/html/style/src/nsCSSStyleSheet.cpp
+++ b/content/html/style/src/nsCSSStyleSheet.cpp
@@ -1549,7 +1549,7 @@ CreateNameSpace(nsISupports* aRule, void* aNameSpacePtr)
     nsAutoString  urlSpec;
     nameSpaceRule->GetPrefix(prefix);
     nameSpaceRule->GetURLSpec(urlSpec);
-    lastNameSpace->CreateChildNameSpace(prefix, urlSpec, newNameSpace);
+    lastNameSpace->CreateChildNameSpace(prefix, urlSpec, &newNameSpace);
     NS_IF_RELEASE(prefix);
     if (newNameSpace) {
       NS_RELEASE(lastNameSpace);
@@ -1566,11 +1566,12 @@ CreateNameSpace(nsISupports* aRule, void* aNameSpacePtr)
 void 
 CSSStyleSheetInner::RebuildNameSpaces(void)
 {
-  nsContentUtils::GetNSManagerWeakRef()->CreateRootNameSpace(*getter_AddRefs(mNameSpace));
+  nsContentUtils::GetNSManagerWeakRef()->
+      CreateRootNameSpace(getter_AddRefs(mNameSpace));
   if (kNameSpaceID_Unknown != mDefaultNameSpaceID) {
     nsCOMPtr<nsINameSpace> defaultNameSpace;
     mNameSpace->CreateChildNameSpace(nsnull, mDefaultNameSpaceID,
-                                     *getter_AddRefs(defaultNameSpace));
+                                     getter_AddRefs(defaultNameSpace));
     if (defaultNameSpace) {
       mNameSpace = defaultNameSpace;
     }
@@ -2115,7 +2116,8 @@ CSSStyleSheetImpl::AppendStyleRule(nsICSSRule* aRule)
       aRule->GetType(type);
       if (nsICSSRule::NAMESPACE_RULE == type) {
         if (! mInner->mNameSpace) {
-          nsContentUtils::GetNSManagerWeakRef()->CreateRootNameSpace(*getter_AddRefs(mInner->mNameSpace));
+          nsContentUtils::GetNSManagerWeakRef()->
+              CreateRootNameSpace(getter_AddRefs(mInner->mNameSpace));
         }
 
         if (mInner->mNameSpace) {
@@ -2126,8 +2128,9 @@ CSSStyleSheetImpl::AppendStyleRule(nsICSSRule* aRule)
           nsAutoString  urlSpec;
           nameSpaceRule->GetPrefix(*getter_AddRefs(prefix));
           nameSpaceRule->GetURLSpec(urlSpec);
-          mInner->mNameSpace->CreateChildNameSpace(prefix, urlSpec,
-                                                   *getter_AddRefs(newNameSpace));
+          mInner->mNameSpace->
+              CreateChildNameSpace(prefix, urlSpec,
+                                   getter_AddRefs(newNameSpace));
           if (newNameSpace) {
             mInner->mNameSpace = newNameSpace;
           }
@@ -2720,7 +2723,8 @@ CSSStyleSheetImpl::InsertRule(const nsAString& aRule,
     cssRule->GetType(type);
     if (type == nsICSSRule::NAMESPACE_RULE) {
       if (! mInner->mNameSpace) {
-        nsContentUtils::GetNSManagerWeakRef()->CreateRootNameSpace(*getter_AddRefs(mInner->mNameSpace));
+        nsContentUtils::GetNSManagerWeakRef()->
+            CreateRootNameSpace(getter_AddRefs(mInner->mNameSpace));
       }
 
       NS_ENSURE_TRUE(mInner->mNameSpace, NS_ERROR_FAILURE);
@@ -2733,7 +2737,7 @@ CSSStyleSheetImpl::InsertRule(const nsAString& aRule,
       nameSpaceRule->GetPrefix(*getter_AddRefs(prefix));
       nameSpaceRule->GetURLSpec(urlSpec);
       mInner->mNameSpace->CreateChildNameSpace(prefix, urlSpec,
-                                               *getter_AddRefs(newNameSpace));
+                                               getter_AddRefs(newNameSpace));
       if (newNameSpace) {
         mInner->mNameSpace = newNameSpace;
       }
@@ -3151,11 +3155,11 @@ RuleProcessorData::RuleProcessorData(nsIPresContext* aPresContext,
     mContent = aContent;
 
     // get the namespace
-    aContent->GetNameSpaceID(mNameSpaceID);
+    aContent->GetNameSpaceID(&mNameSpaceID);
 
     // get the tag and parent
-    aContent->GetTag(mContentTag);
-    aContent->GetParent(mParentContent);
+    aContent->GetTag(&mContentTag);
+    aContent->GetParent(&mParentContent);
 
     // get the event state
     nsIEventStateManager* eventStateManager = nsnull;
@@ -3168,7 +3172,7 @@ RuleProcessorData::RuleProcessorData(nsIPresContext* aPresContext,
     // get the styledcontent interface and the ID
     if (NS_SUCCEEDED(aContent->QueryInterface(NS_GET_IID(nsIStyledContent), (void**)&mStyledContent))) {
       NS_ASSERTION(mStyledContent, "Succeeded but returned null");
-      mStyledContent->GetID(mContentID);
+      mStyledContent->GetID(&mContentID);
     }
 
     // see if there are attributes for the content
@@ -3255,9 +3259,10 @@ const nsString* RuleProcessorData::GetLang(void)
           break;
         }
       }
-      nsIContent *parent;
-      content->GetParent(parent);
-      content = dont_AddRef(parent);
+
+      nsCOMPtr<nsIContent> parent;
+      content->GetParent(getter_AddRefs(parent));
+      content = parent;
     }
   }
   return mLanguage;
@@ -3339,14 +3344,14 @@ inline PRBool IsQuirkEventSensitive(nsIAtom *aContentTag)
 
 static PRBool IsSignificantChild(nsIContent* aChild, PRBool aAcceptNonWhitespaceText)
 {
-  nsIAtom* tag;
-  aChild->GetTag(tag); // skip text & comments
+  nsCOMPtr<nsIAtom> tag;
+  aChild->GetTag(getter_AddRefs(tag)); // skip text & comments
   if ((tag != nsLayoutAtoms::textTagName) && 
       (tag != nsLayoutAtoms::commentTagName) &&
       (tag != nsLayoutAtoms::processingInstructionTagName)) {
-    NS_IF_RELEASE(tag);
     return PR_TRUE;
   }
+
   if (aAcceptNonWhitespaceText) {
     if (tag == nsLayoutAtoms::textTagName) {  // skip only whitespace text
       nsITextContent* text = nsnull;
@@ -3355,13 +3360,12 @@ static PRBool IsSignificantChild(nsIContent* aChild, PRBool aAcceptNonWhitespace
         text->IsOnlyWhitespace(&isWhite);
         NS_RELEASE(text);
         if (! isWhite) {
-          NS_RELEASE(tag);
           return PR_TRUE;
         }
       }
     }
   }
-  NS_IF_RELEASE(tag);
+
   return PR_FALSE;
 }
 
@@ -3446,17 +3450,16 @@ static PRBool SelectorMatches(RuleProcessorData &data,
     while (result && (nsnull != pseudoClass)) {
       if ((nsCSSPseudoClasses::firstChild == pseudoClass->mAtom) ||
           (nsCSSPseudoClasses::firstNode == pseudoClass->mAtom) ) {
-        nsIContent* firstChild = nsnull;
-        nsIContent* parent = data.mParentContent;
+        nsCOMPtr<nsIContent> firstChild;
+        nsCOMPtr<nsIContent> parent = data.mParentContent;
         if (parent) {
           PRInt32 index = -1;
           do {
-            parent->ChildAt(++index, firstChild);
+            parent->ChildAt(++index, getter_AddRefs(firstChild));
             if (firstChild) { // stop at first non-comment and non-whitespace node (and non-text node for firstChild)
               if (IsSignificantChild(firstChild, (nsCSSPseudoClasses::firstNode == pseudoClass->mAtom))) {
                 break;
               }
-              NS_RELEASE(firstChild);
             }
             else {
               break;
@@ -3464,22 +3467,20 @@ static PRBool SelectorMatches(RuleProcessorData &data,
           } while (1 == 1);
         }
         result = PRBool(localTrue == (data.mContent == firstChild));
-        NS_IF_RELEASE(firstChild);
       }
       else if ((nsCSSPseudoClasses::lastChild == pseudoClass->mAtom) ||
                (nsCSSPseudoClasses::lastNode == pseudoClass->mAtom)) {
-        nsIContent* lastChild = nsnull;
-        nsIContent* parent = data.mParentContent;
+        nsCOMPtr<nsIContent> lastChild;
+        nsCOMPtr<nsIContent> parent = data.mParentContent;
         if (parent) {
           PRInt32 index;
           parent->ChildCount(index);
           do {
-            parent->ChildAt(--index, lastChild);
+            parent->ChildAt(--index, getter_AddRefs(lastChild));
             if (lastChild) { // stop at first non-comment and non-whitespace node (and non-text node for lastChild)
               if (IsSignificantChild(lastChild, (nsCSSPseudoClasses::lastNode == pseudoClass->mAtom))) {
                 break;
               }
-              NS_RELEASE(lastChild);
             }
             else {
               break;
@@ -3487,26 +3488,23 @@ static PRBool SelectorMatches(RuleProcessorData &data,
           } while (1 == 1);
         }
         result = PRBool(localTrue == (data.mContent == lastChild));
-        NS_IF_RELEASE(lastChild);
       }
       else if (nsCSSPseudoClasses::empty == pseudoClass->mAtom) {
-        nsIContent* child = nsnull;
-        nsIContent* element = data.mContent;
+        nsCOMPtr<nsIContent> child;
+        nsCOMPtr<nsIContent> element = data.mContent;
         PRInt32 index = -1;
         do {
-          element->ChildAt(++index, child);
+          element->ChildAt(++index, getter_AddRefs(child));
           if (child) { // stop at first non-comment and non-whitespace node
             if (IsSignificantChild(child, PR_TRUE)) {
               break;
             }
-            NS_RELEASE(child);
           }
           else {
             break;
           }
         } while (1 == 1);
         result = PRBool(localTrue == (child == nsnull));
-        NS_IF_RELEASE(child);
       }
       else if (nsCSSPseudoClasses::root == pseudoClass->mAtom) {
         if (data.mParentContent) {
@@ -3535,7 +3533,7 @@ static PRBool SelectorMatches(RuleProcessorData &data,
           }
           else {
             nsCOMPtr<nsIDocument> doc;
-            data.mContent->GetDocument(*getter_AddRefs(doc));
+            data.mContent->GetDocument(getter_AddRefs(doc));
             if (doc) {
               // Try to get the language from the HTTP header or if this
               // is missing as well from the preferences.
@@ -3798,18 +3796,17 @@ static PRBool SelectorMatchesTree(RuleProcessorData &data,
       if (PRUnichar('+') == selector->mOperator) {
         newdata = curdata->mPreviousSiblingData;
         if (!newdata) {
-          nsIContent* parent;
+          nsCOMPtr<nsIContent> parent;
           PRInt32 index;
-          lastContent->GetParent(parent);
+          lastContent->GetParent(getter_AddRefs(parent));
           if (parent) {
             parent->IndexOf(lastContent, index);
             while (0 <= --index) {  // skip text & comment nodes
-              parent->ChildAt(index, content);
-              nsIAtom* tag;
-              content->GetTag(tag);
+              parent->ChildAt(index, &content);
+              nsCOMPtr<nsIAtom> tag;
+              content->GetTag(getter_AddRefs(tag));
               if ((tag != nsLayoutAtoms::textTagName) && 
                   (tag != nsLayoutAtoms::commentTagName)) {
-                NS_IF_RELEASE(tag);
                 newdata =
                     new (curdata->mPresContext) RuleProcessorData(curdata->mPresContext, content,
                                                                     curdata->mRuleWalker, &compat);
@@ -3817,9 +3814,7 @@ static PRBool SelectorMatchesTree(RuleProcessorData &data,
                 break;
               }
               NS_RELEASE(content);
-              NS_IF_RELEASE(tag);
             }
-            NS_RELEASE(parent);
           }
         } else {
           content = newdata->mContent;
@@ -3831,7 +3826,7 @@ static PRBool SelectorMatchesTree(RuleProcessorData &data,
       else {
         newdata = curdata->mParentData;
         if (!newdata) {
-          lastContent->GetParent(content);
+          lastContent->GetParent(&content);
           if (content) {
             newdata = new (curdata->mPresContext) RuleProcessorData(curdata->mPresContext, content,
                                                                       curdata->mRuleWalker, &compat);
diff --git a/content/html/style/src/nsComputedDOMStyle.cpp b/content/html/style/src/nsComputedDOMStyle.cpp
index 230bd9685997..c4708d402eda 100644
--- a/content/html/style/src/nsComputedDOMStyle.cpp
+++ b/content/html/style/src/nsComputedDOMStyle.cpp
@@ -2974,7 +2974,7 @@ nsComputedDOMStyle::FlushPendingReflows()
 {
   // Flush all pending notifications so that our frames are up to date
   nsCOMPtr<nsIDocument> document;
-  mContent->GetDocument(*getter_AddRefs(document));
+  mContent->GetDocument(getter_AddRefs(document));
   if (document) {
     document->FlushPendingNotifications();
   }
diff --git a/content/html/style/src/nsDOMCSSAttrDeclaration.cpp b/content/html/style/src/nsDOMCSSAttrDeclaration.cpp
index 225e4fafa5e2..5d0e37a2ea05 100644
--- a/content/html/style/src/nsDOMCSSAttrDeclaration.cpp
+++ b/content/html/style/src/nsDOMCSSAttrDeclaration.cpp
@@ -181,18 +181,18 @@ nsDOMCSSAttributeDeclaration::GetCSSParsingEnvironment(nsIContent* aContent,
   *aCSSParser = nsnull;
   
   nsCOMPtr<nsINodeInfo> nodeInfo;
-  nsresult result = aContent->GetNodeInfo(*getter_AddRefs(nodeInfo));
+  nsresult result = aContent->GetNodeInfo(getter_AddRefs(nodeInfo));
   if (NS_FAILED(result)) {
     return result;
   }
   nsCOMPtr<nsIDocument> doc;
-  result = nodeInfo->GetDocument(*getter_AddRefs(doc));
+  result = nodeInfo->GetDocument(getter_AddRefs(doc));
   if (NS_FAILED(result)) {
     return result;
   }
   
   if (doc) {
-    doc->GetBaseURL(*aBaseURI);
+    doc->GetBaseURL(aBaseURI);
     nsCOMPtr<nsIHTMLContentContainer> htmlContainer(do_QueryInterface(doc));
     if (htmlContainer) {
       htmlContainer->GetCSSLoader(*aCSSLoader);
diff --git a/content/html/style/src/nsHTMLAttributes.cpp b/content/html/style/src/nsHTMLAttributes.cpp
index 68cec41bc031..3369ed771fab 100644
--- a/content/html/style/src/nsHTMLAttributes.cpp
+++ b/content/html/style/src/nsHTMLAttributes.cpp
@@ -1256,7 +1256,7 @@ nsHTMLAttributes::SetAttributeFor(nsINodeInfo* aAttrName,
 #ifdef DEBUG
   {
     PRInt32 namespaceID;
-    aAttrName->GetNamespaceID(namespaceID);
+    aAttrName->GetNamespaceID(&namespaceID);
     NS_ASSERTION(namespaceID != kNameSpaceID_None, "namespace is null in SetAttributeFor");
   }
 #endif
@@ -1265,10 +1265,9 @@ nsHTMLAttributes::SetAttributeFor(nsINodeInfo* aAttrName,
   rv = SetAttributeName(aAttrName, haveAttr);
   NS_ENSURE_SUCCESS(rv, rv);
   if (haveAttr) {
-    PRInt32 namespaceID;
-    nsCOMPtr<nsIAtom> localName;
-    aAttrName->GetNamespaceID(namespaceID);
-    aAttrName->GetNameAtom(*getter_AddRefs(localName));
+    PRInt32 namespaceID = aAttrName->GetNamespaceID();
+    nsCOMPtr<nsIAtom> localName = aAttrName->GetNameAtom();
+
     HTMLAttribute* attr = HTMLAttribute::FindHTMLAttribute(localName,
                                                            namespaceID,
                                                            mFirstUnmapped);
@@ -1289,7 +1288,7 @@ nsHTMLAttributes::SetAttributeFor(nsINodeInfo* aAttrName,
 
 NS_IMETHODIMP
 nsHTMLAttributes::GetAttribute(nsIAtom* aAttrName, PRInt32 aNamespaceID,
-                               nsIAtom*& aPrefix,
+                               nsIAtom** aPrefix,
                                const nsHTMLValue** aValue) const
 {
   NS_ASSERTION(aNamespaceID != kNameSpaceID_None, "namespace is null in UnsetAttributeFor");
@@ -1303,7 +1302,10 @@ nsHTMLAttributes::GetAttribute(nsIAtom* aAttrName, PRInt32 aNamespaceID,
   }
 
   *aValue = &attr->mValue;
-  attr->mAttribute.GetNodeInfo()->GetPrefixAtom(aPrefix);
+
+  // AddRefs
+  *aPrefix = attr->mAttribute.GetNodeInfo()->GetPrefixAtom().get();
+
   return attr->mValue.GetUnit() == eHTMLUnit_Null ? 
          NS_CONTENT_ATTR_NO_VALUE : 
          NS_CONTENT_ATTR_HAS_VALUE;
@@ -1312,24 +1314,27 @@ nsHTMLAttributes::GetAttribute(nsIAtom* aAttrName, PRInt32 aNamespaceID,
 
 NS_IMETHODIMP
 nsHTMLAttributes::GetAttributeNameAt(PRInt32 aIndex,
-                                     PRInt32& aNamespaceID,
-                                     nsIAtom*& aName,
-                                     nsIAtom*& aPrefix) const
+                                     PRInt32* aNamespaceID,
+                                     nsIAtom** aName,
+                                     nsIAtom** aPrefix) const
 {
   nsresult result = NS_ERROR_ILLEGAL_VALUE;
 
   if ((0 <= aIndex) && (aIndex < mAttrCount)) {
     if (mAttrNames[aIndex].IsAtom()) {
-        aNamespaceID = kNameSpaceID_None;
-        aName = mAttrNames[aIndex].mAtom;
-        NS_ADDREF(aName);
-        aPrefix = nsnull;
+        *aNamespaceID = kNameSpaceID_None;
+        *aName = mAttrNames[aIndex].mAtom;
+        NS_ADDREF(*aName);
+        *aPrefix = nsnull;
     }
     else {
         nsINodeInfo* ni = mAttrNames[aIndex].GetNodeInfo();
-        ni->GetNamespaceID(aNamespaceID);
-        ni->GetNameAtom(aName);
-        ni->GetPrefixAtom(aPrefix);
+        *aNamespaceID = ni->GetNamespaceID();
+
+        // AddRefs
+        *aName = ni->GetNameAtom().get();
+        // AddRefs
+        *aPrefix = ni->GetPrefixAtom().get();
     }
     result = NS_OK;
   }
@@ -1344,10 +1349,10 @@ nsHTMLAttributes::GetAttributeCount(PRInt32& aCount) const
 }
 
 NS_IMETHODIMP
-nsHTMLAttributes::GetID(nsIAtom*& aResult) const
+nsHTMLAttributes::GetID(nsIAtom** aResult) const
 {
-  aResult = mID;
-  NS_IF_ADDREF(aResult);
+  *aResult = mID;
+  NS_IF_ADDREF(*aResult);
   return NS_OK;
 }
 
@@ -1499,10 +1504,10 @@ nsHTMLAttributes::List(FILE* out, PRInt32 aIndent) const
       nsINodeInfo* ni = mAttrNames[index].GetNodeInfo();
       PRInt32 namespaceID;
       nsCOMPtr<nsIAtom> localName, prefix;
-      ni->GetNameAtom(*getter_AddRefs(localName));
-      ni->GetNamespaceID(namespaceID);
+      ni->GetNameAtom(getter_AddRefs(localName));
+      ni->GetNamespaceID(&namespaceID);
       const nsHTMLValue *tmp;
-      GetAttribute(localName, namespaceID, *getter_AddRefs(prefix), &tmp);
+      GetAttribute(localName, namespaceID, getter_AddRefs(prefix), &tmp);
       value = *tmp;
       ni->GetQualifiedName(buffer);
     }
diff --git a/content/html/style/src/nsHTMLAttributes.h b/content/html/style/src/nsHTMLAttributes.h
index 77b651d81fa7..4604ab9a209b 100644
--- a/content/html/style/src/nsHTMLAttributes.h
+++ b/content/html/style/src/nsHTMLAttributes.h
@@ -214,18 +214,18 @@ public:
   NS_METHOD SetAttributeFor(nsINodeInfo* aAttrName,
                             const nsAString& aValue);
   NS_METHOD GetAttribute(nsIAtom* aAttrName, PRInt32 aNamespaceID,
-                         nsIAtom*& aPrefix,
+                         nsIAtom** aPrefix,
                          const nsHTMLValue** aValue) const;
 
 
   NS_METHOD GetAttributeNameAt(PRInt32 aIndex,
-                               PRInt32& aNamespaceID,
-                               nsIAtom*& aName,
-                               nsIAtom*& aPrefix) const;
+                               PRInt32* aNamespaceID,
+                               nsIAtom** aName,
+                               nsIAtom** aPrefix) const;
 
   NS_METHOD GetAttributeCount(PRInt32& aCount) const;
 
-  NS_METHOD GetID(nsIAtom*& aResult) const;
+  NS_METHOD GetID(nsIAtom** aResult) const;
   NS_METHOD GetClasses(nsVoidArray& aArray) const;
   NS_METHOD_(PRBool) HasClass(nsIAtom* aClass, PRBool aCaseSensitive) const;
 
diff --git a/content/html/style/src/nsInspectorCSSUtils.cpp b/content/html/style/src/nsInspectorCSSUtils.cpp
index 4ecb91a0a4c7..9d4a2e01ecae 100644
--- a/content/html/style/src/nsInspectorCSSUtils.cpp
+++ b/content/html/style/src/nsInspectorCSSUtils.cpp
@@ -151,7 +151,7 @@ nsInspectorCSSUtils::GetStyleContextForContent(nsIContent* aContent,
     // No frame has been created, so resolve the style ourselves
     nsRefPtr<nsStyleContext> parentContext;
     nsCOMPtr<nsIContent> parent;
-    aContent->GetParent(*getter_AddRefs(parent));
+    aContent->GetParent(getter_AddRefs(parent));
     if (parent)
         parentContext = GetStyleContextForContent(parent, aPresShell);
 
@@ -173,7 +173,7 @@ nsInspectorCSSUtils::GetRuleNodeForContent(nsIContent* aContent,
     *aRuleNode = nsnull;
 
     nsCOMPtr<nsIDocument> doc;
-    aContent->GetDocument(*getter_AddRefs(doc));
+    aContent->GetDocument(getter_AddRefs(doc));
     NS_ENSURE_TRUE(doc, NS_ERROR_UNEXPECTED);
 
     nsCOMPtr<nsIPresShell> presShell;
diff --git a/content/html/style/src/nsStyleUtil.cpp b/content/html/style/src/nsStyleUtil.cpp
index 94b25514a808..072173ea1b9b 100644
--- a/content/html/style/src/nsStyleUtil.cpp
+++ b/content/html/style/src/nsStyleUtil.cpp
@@ -655,13 +655,13 @@ PRBool nsStyleUtil::IsSimpleXlink(nsIContent *aContent, nsIPresContext *aPresCon
           // XXX why do this? will nsIHTMLContent's
           // GetBaseURL() may return something different
           // than the URL of the document it lives in?
-          htmlContent->GetBaseURL(*getter_AddRefs(baseURI));
+          htmlContent->GetBaseURL(getter_AddRefs(baseURI));
         }
         else {
           nsCOMPtr<nsIDocument> doc;
-          aContent->GetDocument(*getter_AddRefs(doc));
+          aContent->GetDocument(getter_AddRefs(doc));
           if (doc) {
-            doc->GetBaseURL(*getter_AddRefs(baseURI));
+            doc->GetBaseURL(getter_AddRefs(baseURI));
           }
         }
 
diff --git a/content/svg/content/src/nsSVGAttributes.cpp b/content/svg/content/src/nsSVGAttributes.cpp
index a5587ea7ef63..30c88c78a3ee 100644
--- a/content/svg/content/src/nsSVGAttributes.cpp
+++ b/content/svg/content/src/nsSVGAttributes.cpp
@@ -220,7 +220,7 @@ nsSVGAttribute::SetPrefix(const nsAString& aPrefix)
 {
   // XXX: Validate the prefix string!
   
-  nsINodeInfo *newNodeInfo = nsnull;
+  nsCOMPtr<nsINodeInfo> newNodeInfo;
   nsCOMPtr<nsIAtom> prefix;
   
   if (!aPrefix.IsEmpty()) {
@@ -228,7 +228,8 @@ nsSVGAttribute::SetPrefix(const nsAString& aPrefix)
     NS_ENSURE_TRUE(prefix, NS_ERROR_OUT_OF_MEMORY);
   }
   
-  nsresult rv = mNodeInfo->PrefixChanged(prefix, newNodeInfo);
+  nsresult rv = mNodeInfo->PrefixChanged(prefix,
+                                         getter_AddRefs(newNodeInfo));
   NS_ENSURE_SUCCESS(rv, rv);
   
   mNodeInfo = newNodeInfo;
@@ -531,7 +532,7 @@ nsSVGAttributes::Count() const
 
 NS_IMETHODIMP
 nsSVGAttributes::GetAttr(PRInt32 aNameSpaceID, nsIAtom* aName, 
-                         nsIAtom*& aPrefix,
+                         nsIAtom** aPrefix,
                          nsAString& aResult)
 {
   NS_ASSERTION(nsnull != aName, "must have attribute name");
@@ -548,7 +549,8 @@ nsSVGAttributes::GetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
     if ((aNameSpaceID == kNameSpaceID_Unknown ||
          attr->GetNodeInfo()->NamespaceEquals(aNameSpaceID)) &&
         (attr->GetNodeInfo()->Equals(aName))) {
-      attr->GetNodeInfo()->GetPrefixAtom(aPrefix);
+      // AddRefs
+      *aPrefix = attr->GetNodeInfo()->GetPrefixAtom().get();
       attr->GetValue()->GetValueString(aResult);
       if (!aResult.IsEmpty()) {
         rv = NS_CONTENT_ATTR_HAS_VALUE;
@@ -565,6 +567,7 @@ nsSVGAttributes::GetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
     // Since we are returning a success code we'd better do
     // something about the out parameters (someone may have
     // given us a non-empty string).
+    *aPrefix = nsnull;
     aResult.Truncate();
   }
   
@@ -583,7 +586,7 @@ nsSVGAttributes::SetAttr(nsINodeInfo* aNodeInfo,
 
   nsCOMPtr<nsIDocument> document;
   if (mContent)
-    mContent->GetDocument(*getter_AddRefs(document));
+    mContent->GetDocument(getter_AddRefs(document));
   
   if (aNotify && document) {
     document->BeginUpdate();
@@ -621,11 +624,8 @@ nsSVGAttributes::SetAttr(nsINodeInfo* aNodeInfo,
   }
 
   if (document && NS_SUCCEEDED(rv)) {
-    nsCOMPtr<nsIAtom> name;
-    PRInt32 nameSpaceID;
-    
-    aNodeInfo->GetNameAtom(*getter_AddRefs(name));
-    aNodeInfo->GetNamespaceID(nameSpaceID);
+    nsCOMPtr<nsIAtom> name = aNodeInfo->GetNameAtom();
+    PRInt32 nameSpaceID = aNodeInfo->GetNamespaceID();
 
     nsCOMPtr<nsIBindingManager> bindingManager;
     document->GetBindingManager(getter_AddRefs(bindingManager));
@@ -682,7 +682,7 @@ nsSVGAttributes::UnsetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
 
   nsCOMPtr<nsIDocument> document;
   if (mContent)
-    mContent->GetDocument(*getter_AddRefs(document));
+    mContent->GetDocument(getter_AddRefs(document));
   
   PRInt32 count = Count();
   PRInt32 index;
@@ -765,15 +765,15 @@ nsSVGAttributes::HasAttr(PRInt32 aNameSpaceID, nsIAtom* aName) const
 
 NS_IMETHODIMP
 nsSVGAttributes::NormalizeAttrString(const nsAString& aStr,
-                                     nsINodeInfo*& aNodeInfo)
+                                     nsINodeInfo** aNodeInfo)
 {
   PRInt32 indx, count = Count();
   NS_ConvertUCS2toUTF8 utf8String(aStr);
   for (indx = 0; indx < count; indx++) {
     nsSVGAttribute* attr = ElementAt(indx);
     if (attr->GetNodeInfo()->QualifiedNameEquals(utf8String)) {
-      aNodeInfo = attr->GetNodeInfo();
-      NS_ADDREF(aNodeInfo);
+      *aNodeInfo = attr->GetNodeInfo();
+      NS_ADDREF(*aNodeInfo);
       
       return NS_OK;
     }
@@ -783,10 +783,10 @@ nsSVGAttributes::NormalizeAttrString(const nsAString& aStr,
   if (!mContent) return NS_ERROR_FAILURE;
 
   nsCOMPtr<nsINodeInfo> contentNodeInfo;
-  mContent->GetNodeInfo(*getter_AddRefs(contentNodeInfo));
+  mContent->GetNodeInfo(getter_AddRefs(contentNodeInfo));
   
   nsCOMPtr<nsINodeInfoManager> nimgr;
-  contentNodeInfo->GetNodeInfoManager(*getter_AddRefs(nimgr));
+  contentNodeInfo->GetNodeInfoManager(getter_AddRefs(nimgr));
   NS_ENSURE_TRUE(nimgr, NS_ERROR_FAILURE);
   
   return nimgr->GetNodeInfo(aStr, nsnull, kNameSpaceID_None, aNodeInfo);
@@ -794,21 +794,25 @@ nsSVGAttributes::NormalizeAttrString(const nsAString& aStr,
 
 NS_IMETHODIMP
 nsSVGAttributes::GetAttrNameAt(PRInt32 aIndex,
-                               PRInt32& aNameSpaceID, 
-                               nsIAtom*& aName,
-                               nsIAtom*& aPrefix)
+                               PRInt32* aNameSpaceID,
+                               nsIAtom** aName,
+                               nsIAtom** aPrefix)
 {
   nsSVGAttribute* attr = ElementAt(aIndex);
   if (attr) {
-    attr->GetNodeInfo()->GetNamespaceID(aNameSpaceID);
-    attr->GetNodeInfo()->GetNameAtom(aName);
-    attr->GetNodeInfo()->GetPrefixAtom(aPrefix);
-    
+    *aNameSpaceID = attr->GetNodeInfo()->GetNamespaceID();
+    // AddRefs
+    *aName = attr->GetNodeInfo()->GetNameAtom().get();
+    // AddRefs
+    *aPrefix = attr->GetNodeInfo()->GetPrefixAtom().get();
+
     return NS_OK;
   }
   
-  aNameSpaceID = kNameSpaceID_None;
-  aName = nsnull;
+  *aNameSpaceID = kNameSpaceID_None;
+  *aName = nsnull;
+  *aPrefix = nsnull;
+
   return NS_ERROR_ILLEGAL_VALUE;  
 }
 
@@ -822,14 +826,14 @@ nsSVGAttributes::AddMappedSVGValue(nsIAtom* name, nsISupports* value)
   if (!mContent) return NS_ERROR_FAILURE;
   
   nsCOMPtr<nsINodeInfo> contentNodeInfo;
-  mContent->GetNodeInfo(*getter_AddRefs(contentNodeInfo));
+  mContent->GetNodeInfo(getter_AddRefs(contentNodeInfo));
   
   nsCOMPtr<nsINodeInfoManager> nimgr;
-  contentNodeInfo->GetNodeInfoManager(*getter_AddRefs(nimgr));
+  contentNodeInfo->GetNodeInfoManager(getter_AddRefs(nimgr));
   NS_ENSURE_TRUE(nimgr, NS_ERROR_FAILURE);
 
   nsCOMPtr<nsINodeInfo> ni;
-  nimgr->GetNodeInfo(name, nsnull, kNameSpaceID_None, *getter_AddRefs(ni));
+  nimgr->GetNodeInfo(name, nsnull, kNameSpaceID_None, getter_AddRefs(ni));
   NS_ENSURE_TRUE(ni, NS_ERROR_FAILURE);
 
   nsSVGAttribute* attrib = nsnull;
@@ -898,7 +902,7 @@ nsSVGAttributes::GetNamedItem(const nsAString& aName,
   
   nsCOMPtr<nsINodeInfo> inpNodeInfo;
   
-  if (NS_FAILED(rv = mContent->NormalizeAttrString(aName, *getter_AddRefs(inpNodeInfo))))
+  if (NS_FAILED(rv = mContent->NormalizeAttrString(aName, getter_AddRefs(inpNodeInfo))))
     return rv;
   
   for (PRInt32 i = mAttributes.Count() - 1; i >= 0; --i) {
diff --git a/content/svg/content/src/nsSVGAttributes.h b/content/svg/content/src/nsSVGAttributes.h
index aba90089b828..070129663ac9 100644
--- a/content/svg/content/src/nsSVGAttributes.h
+++ b/content/svg/content/src/nsSVGAttributes.h
@@ -163,7 +163,7 @@ public:
 
   PRInt32 Count() const;
   NS_IMETHOD GetAttr(PRInt32 aNameSpaceID, nsIAtom* aName, 
-                     nsIAtom*& aPrefix,
+                     nsIAtom** aPrefix,
                      nsAString& aResult);
   NS_IMETHOD SetAttr(nsINodeInfo* aNodeInfo,
                      const nsAString& aValue,
@@ -173,11 +173,11 @@ public:
   NS_IMETHOD_(PRBool) HasAttr(PRInt32 aNameSpaceID,
                               nsIAtom* aName) const;
   NS_IMETHOD NormalizeAttrString(const nsAString& aStr,
-                                 nsINodeInfo*& aNodeInfo);
+                                 nsINodeInfo** aNodeInfo);
   NS_IMETHOD GetAttrNameAt(PRInt32 aIndex,
-                           PRInt32& aNameSpaceID, 
-                           nsIAtom*& aName,
-                           nsIAtom*& aPrefix);
+                           PRInt32* aNameSpaceID,
+                           nsIAtom** aName,
+                           nsIAtom** aPrefix);
 
   NS_IMETHOD AddMappedSVGValue(nsIAtom* name, nsISupports* value);
 
diff --git a/content/svg/content/src/nsSVGElement.cpp b/content/svg/content/src/nsSVGElement.cpp
index 7fc7232990c4..5fcdb8041489 100644
--- a/content/svg/content/src/nsSVGElement.cpp
+++ b/content/svg/content/src/nsSVGElement.cpp
@@ -108,7 +108,7 @@ nsSVGElement::Init()
   NS_ENSURE_SUCCESS(rv,rv);
 
   nsCOMPtr<nsINodeInfoManager> nimgr;  
-  rv = mNodeInfo->GetNodeInfoManager(*getter_AddRefs(nimgr));
+  rv = mNodeInfo->GetNodeInfoManager(getter_AddRefs(nimgr));
   NS_ENSURE_SUCCESS(rv,rv);
   
   nsCOMPtr<nsINodeInfo> ni;
@@ -142,13 +142,12 @@ nsSVGElement::ChildCount(PRInt32& aResult) const
 }
 
 NS_IMETHODIMP
-nsSVGElement::ChildAt(PRInt32 aIndex, nsIContent*& aResult) const
+nsSVGElement::ChildAt(PRInt32 aIndex, nsIContent** aResult) const
 {
   nsIContent *child = (nsIContent *)mChildren.SafeElementAt(aIndex);
-  if (nsnull != child) {
-    NS_ADDREF(child);
-  }
-  aResult = child;
+
+  *aResult = child;
+  NS_IF_ADDREF(*aResult);
   return NS_OK;
 }
 
@@ -324,7 +323,7 @@ nsSVGElement::RemoveChildAt(PRInt32 aIndex, PRBool aNotify)
 
 NS_IMETHODIMP
 nsSVGElement::NormalizeAttrString(const nsAString& aStr,
-                                       nsINodeInfo*& aNodeInfo)
+                                  nsINodeInfo** aNodeInfo)
 {
   return mAttributes->NormalizeAttrString(aStr, aNodeInfo);
 }
@@ -336,11 +335,11 @@ nsSVGElement::SetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
 {
     nsCOMPtr<nsINodeInfoManager> nimgr;
 
-    mNodeInfo->GetNodeInfoManager(*getter_AddRefs(nimgr));
+    mNodeInfo->GetNodeInfoManager(getter_AddRefs(nimgr));
     NS_ENSURE_TRUE(nimgr, NS_ERROR_FAILURE);
 
     nsCOMPtr<nsINodeInfo> ni;
-    nimgr->GetNodeInfo(aName, nsnull, aNameSpaceID, *getter_AddRefs(ni));
+    nimgr->GetNodeInfo(aName, nsnull, aNameSpaceID, getter_AddRefs(ni));
 
     return SetAttr(ni, aValue, aNotify);
 }
@@ -358,12 +357,12 @@ nsSVGElement::GetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
                            nsAString& aResult) const
 {
   nsCOMPtr<nsIAtom> prefix;
-  return GetAttr(aNameSpaceID, aName, *getter_AddRefs(prefix), aResult);
+  return GetAttr(aNameSpaceID, aName, getter_AddRefs(prefix), aResult);
 }
 
 NS_IMETHODIMP
 nsSVGElement::GetAttr(PRInt32 aNameSpaceID, nsIAtom* aName, 
-                      nsIAtom*& aPrefix,
+                      nsIAtom** aPrefix,
                       nsAString& aResult) const
 {
   return mAttributes->GetAttr(aNameSpaceID, aName, aPrefix, aResult);
@@ -384,9 +383,9 @@ nsSVGElement::HasAttr(PRInt32 aNameSpaceID, nsIAtom* aName) const
 
 NS_IMETHODIMP
 nsSVGElement::GetAttrNameAt(PRInt32 aIndex,
-                            PRInt32& aNameSpaceID, 
-                            nsIAtom*& aName,
-                            nsIAtom*& aPrefix) const
+                            PRInt32* aNameSpaceID,
+                            nsIAtom** aName,
+                            nsIAtom** aPrefix) const
 {
   return mAttributes->GetAttrNameAt(aIndex, aNameSpaceID, aName, aPrefix);
 }
@@ -420,14 +419,16 @@ nsSVGElement::DumpContent(FILE* out, PRInt32 aIndent,PRBool aDumpAll) const
 // nsIStyledContent methods
 
 NS_IMETHODIMP
-nsSVGElement::GetID(nsIAtom*& aId)const
+nsSVGElement::GetID(nsIAtom** aId)const
 {
-  nsresult rv;  
   nsAutoString value;
   
-  rv = NS_CONST_CAST(nsSVGElement*,this)->GetAttribute(NS_LITERAL_STRING("id"), value);
+  nsresult rv = NS_CONST_CAST(nsSVGElement*,this)->
+                    GetAttribute(NS_LITERAL_STRING("id"), value);
   if (NS_SUCCEEDED(rv))
-    aId = NS_NewAtom(value);
+    *aId = NS_NewAtom(value);
+  else
+    *aId = nsnull;
   
   return rv;
 }
@@ -731,7 +732,7 @@ nsSVGElement::GetOwnerSVGElement(nsIDOMSVGSVGElement * *aOwnerSVGElement)
 
     if (!next) {
       // no anonymous parent, so use explicit one
-      parent->GetParent(*getter_AddRefs(next));
+      parent->GetParent(getter_AddRefs(next));
     }
     
     parent = next;
diff --git a/content/svg/content/src/nsSVGElement.h b/content/svg/content/src/nsSVGElement.h
index 9da4b8150b62..ef92df914e5f 100644
--- a/content/svg/content/src/nsSVGElement.h
+++ b/content/svg/content/src/nsSVGElement.h
@@ -71,18 +71,18 @@ public:
 
   // nsIContent interface methods
 
-  // NS_IMETHOD GetDocument(nsIDocument*& aResult) const;
+  // NS_IMETHOD GetDocument(nsIDocument** aResult) const;
   // NS_IMETHOD SetDocument(nsIDocument* aDocument, PRBool aDeep,
   //                       PRBool aCompileEventHandlers);
-  // NS_IMETHOD GetParent(nsIContent*& aResult) const;
+  // NS_IMETHOD GetParent(nsIContent** aResult) const;
   // NS_IMETHOD SetParent(nsIContent* aParent);
   // NS_IMETHOD GetNameSpaceID(PRInt32& aNameSpaceID) const;
-  // NS_IMETHOD GetTag(nsIAtom*& aResult) const;
-  // NS_IMETHOD GetNodeInfo(nsINodeInfo*& aResult) const;
+  // NS_IMETHOD GetTag(nsIAtom** aResult) const;
+  // NS_IMETHOD GetNodeInfo(nsINodeInfo** aResult) const;
   
   NS_IMETHOD CanContainChildren(PRBool& aResult) const;
   NS_IMETHOD ChildCount(PRInt32& aResult) const;
-  NS_IMETHOD ChildAt(PRInt32 aIndex, nsIContent*& aResult) const;
+  NS_IMETHOD ChildAt(PRInt32 aIndex, nsIContent** aResult) const;
   NS_IMETHOD IndexOf(nsIContent* aPossibleChild, PRInt32& aResult) const;
   NS_IMETHOD InsertChildAt(nsIContent* aKid, PRInt32 aIndex,
                            PRBool aNotify,
@@ -94,7 +94,7 @@ public:
                            PRBool aDeepSetDocument);
   NS_IMETHOD RemoveChildAt(PRInt32 aIndex, PRBool aNotify);
   NS_IMETHOD NormalizeAttrString(const nsAString& aStr,
-                                 nsINodeInfo*& aNodeInfo);
+                                 nsINodeInfo** aNodeInfo);
   NS_IMETHOD SetAttr(PRInt32 aNameSpaceID, nsIAtom* aName, 
                      const nsAString& aValue,
                           PRBool aNotify);
@@ -104,15 +104,15 @@ public:
   NS_IMETHOD GetAttr(PRInt32 aNameSpaceID, nsIAtom* aName, 
                      nsAString& aResult) const;
   NS_IMETHOD GetAttr(PRInt32 aNameSpaceID, nsIAtom* aName, 
-                     nsIAtom*& aPrefix,
+                     nsIAtom** aPrefix,
                      nsAString& aResult) const;
   NS_IMETHOD_(PRBool) HasAttr(PRInt32 aNameSpaceID, nsIAtom* aName) const;
   NS_IMETHOD UnsetAttr(PRInt32 aNameSpaceID, nsIAtom* aAttribute, 
                        PRBool aNotify);
   NS_IMETHOD GetAttrNameAt(PRInt32 aIndex,
-                           PRInt32& aNameSpaceID, 
-                           nsIAtom*& aName,
-                           nsIAtom*& aPrefix) const;
+                           PRInt32* aNameSpaceID,
+                           nsIAtom** aName,
+                           nsIAtom** aPrefix) const;
   NS_IMETHOD GetAttrCount(PRInt32& aResult) const;
 #ifdef DEBUG
   NS_IMETHOD List(FILE* out, PRInt32 aIndent) const;
@@ -121,7 +121,7 @@ public:
   
   // NS_IMETHOD RangeAdd(nsIDOMRange& aRange);
 //   NS_IMETHOD RangeRemove(nsIDOMRange& aRange);
-//   NS_IMETHOD GetRangeList(nsVoidArray*& aResult) const;
+//   NS_IMETHOD GetRangeList(nsVoidArray** aResult) const;
 //   NS_IMETHOD HandleDOMEvent(nsIPresContext* aPresContext,
 //                             nsEvent* aEvent,
 //                             nsIDOMEvent** aDOMEvent,
@@ -138,7 +138,7 @@ public:
 //   NS_IMETHOD MaybeTriggerAutoLink(nsIDocShell *aShell);
 
   // nsIStyledContent
-  NS_IMETHOD GetID(nsIAtom*& aResult) const;
+  NS_IMETHOD GetID(nsIAtom** aResult) const;
 //   NS_IMETHOD GetClasses(nsVoidArray& aArray) const;
 //   NS_IMETHOD HasClass(nsIAtom* aClass) const;
   
diff --git a/content/svg/content/src/nsSVGElementFactory.cpp b/content/svg/content/src/nsSVGElementFactory.cpp
index 9cbc51fcf4b6..d5f9c2c89c82 100644
--- a/content/svg/content/src/nsSVGElementFactory.cpp
+++ b/content/svg/content/src/nsSVGElementFactory.cpp
@@ -118,8 +118,7 @@ NS_IMETHODIMP
 nsSVGElementFactory::CreateInstanceByTag(nsINodeInfo *aNodeInfo,
                                            nsIContent** aResult)
 {
-  nsCOMPtr<nsIAtom> name;
-  aNodeInfo->GetNameAtom(*getter_AddRefs(name));
+  nsCOMPtr<nsIAtom> name = aNodeInfo->GetNameAtom();
   
   if (name == nsSVGAtoms::polyline)
     return NS_NewSVGPolylineElement(aResult, aNodeInfo);
diff --git a/content/svg/content/src/nsSVGGraphicElement.cpp b/content/svg/content/src/nsSVGGraphicElement.cpp
index 93f0f359f677..83ed58b26c0c 100644
--- a/content/svg/content/src/nsSVGGraphicElement.cpp
+++ b/content/svg/content/src/nsSVGGraphicElement.cpp
@@ -160,7 +160,7 @@ NS_IMETHODIMP nsSVGGraphicElement::GetCTM(nsIDOMSVGMatrix **_retval)
 
     if (!next) {
       // no anonymous parent, so use explicit one
-      parent->GetParent(*getter_AddRefs(next));
+      parent->GetParent(getter_AddRefs(next));
     }
 
     parent = next;
@@ -239,7 +239,7 @@ NS_IMETHODIMP nsSVGGraphicElement::GetScreenCTM(nsIDOMSVGMatrix **_retval)
 
     if (!next) {
       // no anonymous parent, so use explicit one
-      parent->GetParent(*getter_AddRefs(next));
+      parent->GetParent(getter_AddRefs(next));
     }
 
     parent = next;
diff --git a/content/svg/content/src/nsSVGSVGElement.cpp b/content/svg/content/src/nsSVGSVGElement.cpp
index 80ba97d71382..9b624b610a25 100644
--- a/content/svg/content/src/nsSVGSVGElement.cpp
+++ b/content/svg/content/src/nsSVGSVGElement.cpp
@@ -839,7 +839,7 @@ nsSVGSVGElement::GetCTM(nsIDOMSVGMatrix **_retval)
 
     if (!next) {
       // no anonymous parent, so use explicit one
-      parent->GetParent(*getter_AddRefs(next));
+      parent->GetParent(getter_AddRefs(next));
     }
 
     parent = next;
@@ -919,7 +919,7 @@ nsSVGSVGElement::GetScreenCTM(nsIDOMSVGMatrix **_retval)
 
     if (!next) {
       // no anonymous parent, so use explicit one
-      parent->GetParent(*getter_AddRefs(next));
+      parent->GetParent(getter_AddRefs(next));
     }
 
     parent = next;
diff --git a/content/svg/content/src/nsSVGStyleValue.cpp b/content/svg/content/src/nsSVGStyleValue.cpp
index 11baf8a16d4b..d1a8cbffed1d 100644
--- a/content/svg/content/src/nsSVGStyleValue.cpp
+++ b/content/svg/content/src/nsSVGStyleValue.cpp
@@ -154,7 +154,7 @@ nsSVGStyleValue::UpdateStyleRule(nsIDocument* baseDoc)
 
   NS_ASSERTION(baseDoc,"need base document");
   nsCOMPtr <nsIURI> docURL;
-  baseDoc->GetBaseURL(*getter_AddRefs(docURL));
+  baseDoc->GetBaseURL(getter_AddRefs(docURL));
   
   nsCOMPtr<nsICSSParser> css;
   nsComponentManager::CreateInstance(kCSSParserCID,
diff --git a/content/xbl/src/nsBindingManager.cpp b/content/xbl/src/nsBindingManager.cpp
index 36d1a7e3d780..18e0ce931e04 100644
--- a/content/xbl/src/nsBindingManager.cpp
+++ b/content/xbl/src/nsBindingManager.cpp
@@ -628,8 +628,8 @@ nsBindingManager::ResolveTag(nsIContent* aContent, PRInt32* aNameSpaceID, nsIAto
     }
   }
 
-  aContent->GetNameSpaceID(*aNameSpaceID);
-  return aContent->GetTag(*aResult);
+  aContent->GetNameSpaceID(aNameSpaceID);
+  return aContent->GetTag(aResult);
 }
 
 NS_IMETHODIMP
@@ -1176,7 +1176,7 @@ nsBindingManager::GetBindingImplementation(nsIContent* aContent, REFNSIID aIID,
       // Create an XPC wrapper for the script object and hand it back.
 
       nsCOMPtr<nsIDocument> doc;
-      aContent->GetDocument(*getter_AddRefs(doc));
+      aContent->GetDocument(getter_AddRefs(doc));
       if (!doc)
         return NS_NOINTERFACE;
 
@@ -1242,7 +1242,7 @@ nsBindingManager::InheritsStyle(nsIContent* aContent, PRBool* aResult)
   if (parent) {
     // See if the parent is our parent.
     nsCOMPtr<nsIContent> ourParent;
-    aContent->GetParent(*getter_AddRefs(ourParent));
+    aContent->GetParent(getter_AddRefs(ourParent));
     if (ourParent == parent) {
       // Yes. Check the binding and see if it wants to allow us
       // to inherit styles.
@@ -1340,7 +1340,7 @@ nsBindingManager::WalkRules(nsIStyleSet* aStyleSet,
     // We cut ourselves off, but we still need to walk the document's attribute sheet
     // so that inline style continues to work on anonymous content.
     nsCOMPtr<nsIDocument> document;
-    content->GetDocument(*getter_AddRefs(document));
+    content->GetDocument(getter_AddRefs(document));
     nsCOMPtr<nsIHTMLContentContainer> container(do_QueryInterface(document));
     if (container) {
       nsCOMPtr<nsIHTMLCSSStyleSheet> inlineSheet;
@@ -1434,7 +1434,7 @@ nsBindingManager::ContentAppended(nsIDocument* aDocument,
   PRInt32 childCount;
   nsCOMPtr<nsIContent> child;
   aContainer->ChildCount(childCount);
-  aContainer->ChildAt(aNewIndexInContainer, *getter_AddRefs(child));
+  aContainer->ChildAt(aNewIndexInContainer, getter_AddRefs(child));
   
   nsCOMPtr<nsIContent> ins;
   GetNestedInsertionPoint(aContainer, child, getter_AddRefs(ins));
@@ -1458,7 +1458,7 @@ nsBindingManager::ContentAppended(nsIDocument* aDocument,
           // We're real. Jam all the kids in.
           // XXX Check the filters to find the correct points.
           for (PRInt32 j = aNewIndexInContainer; j < childCount; j++) {
-            aContainer->ChildAt(j, *getter_AddRefs(child));
+            aContainer->ChildAt(j, getter_AddRefs(child));
             point->AddChild(child);
             SetInsertionParent(child, ins);
           }
diff --git a/content/xbl/src/nsXBLBinding.cpp b/content/xbl/src/nsXBLBinding.cpp
index 26424fc82c28..9e04a596239e 100644
--- a/content/xbl/src/nsXBLBinding.cpp
+++ b/content/xbl/src/nsXBLBinding.cpp
@@ -313,7 +313,7 @@ nsXBLBinding::InstallAnonymousContent(nsIContent* aAnonParent, nsIContent* aElem
   // (1) The anonymous content should be fooled into thinking it's in the bound
   // element's document.
   nsCOMPtr<nsIDocument> doc;
-  aElement->GetDocument(*getter_AddRefs(doc));
+  aElement->GetDocument(getter_AddRefs(doc));
 
   aAnonParent->SetDocument(doc, PR_TRUE, AllowScripts());
 
@@ -323,7 +323,7 @@ nsXBLBinding::InstallAnonymousContent(nsIContent* aAnonParent, nsIContent* aElem
   aAnonParent->ChildCount(childCount);
   for (PRInt32 i = 0; i < childCount; i++) {
     nsCOMPtr<nsIContent> child;
-    aAnonParent->ChildAt(i, *getter_AddRefs(child));
+    aAnonParent->ChildAt(i, getter_AddRefs(child));
     child->SetParent(aElement);
     child->SetBindingParent(mBoundElement);
 
@@ -569,7 +569,7 @@ PRBool PR_CALLBACK RealizeDefaultContent(nsHashKey* aKey, void* aData, void* aCl
         clonedContent->ChildCount(cloneKidCount);
         for (PRInt32 k = 0; k < cloneKidCount; k++) {
           nsCOMPtr<nsIContent> cloneChild;
-          clonedContent->ChildAt(k, *getter_AddRefs(cloneChild));
+          clonedContent->ChildAt(k, getter_AddRefs(cloneChild));
           bm->SetInsertionParent(cloneChild, insParent);
           currPoint->AddChild(cloneChild);
         }
@@ -639,7 +639,7 @@ nsXBLBinding::GenerateAnonymousContent()
 
   if (hasContent || hasInsertionPoints) {
     nsCOMPtr<nsIDocument> doc;
-    mBoundElement->GetDocument(*getter_AddRefs(doc));
+    mBoundElement->GetDocument(getter_AddRefs(doc));
 
     // XXX doc will be null if we're in the midst of paint suppression.
     if (! doc)
@@ -664,7 +664,7 @@ nsXBLBinding::GenerateAnonymousContent()
         children->Item(i, getter_AddRefs(node));
         childContent = do_QueryInterface(node);
         nsCOMPtr<nsIAtom> tag;
-        childContent->GetTag(*getter_AddRefs(tag));
+        childContent->GetTag(getter_AddRefs(tag));
         if (tag != nsXULAtoms::observes && tag != nsXULAtoms::templateAtom) {
           hasContent = PR_FALSE;
           break;
@@ -742,7 +742,7 @@ nsXBLBinding::GenerateAnonymousContent()
                 // We were unable to place this child.  All anonymous content
                 // should be thrown out.  Special-case template and observes.
                 nsCOMPtr<nsIAtom> tag;
-                childContent->GetTag(*getter_AddRefs(tag));
+                childContent->GetTag(getter_AddRefs(tag));
                 if (tag != nsXULAtoms::observes && tag != nsXULAtoms::templateAtom) {
                   // Kill all anonymous content.
                   mContent = nsnull;
@@ -794,7 +794,8 @@ nsXBLBinding::GenerateAnonymousContent()
   nsCOMPtr<nsIAtom> prefix;
 
   for (PRInt32 i = 0; i < length; ++i) {
-    content->GetAttrNameAt(i, namespaceID, *getter_AddRefs(name), *getter_AddRefs(prefix));
+    content->GetAttrNameAt(i, &namespaceID, getter_AddRefs(name),
+                           getter_AddRefs(prefix));
 
     if (name != nsXBLAtoms::includes) {
       nsAutoString value;
@@ -875,7 +876,7 @@ nsXBLBinding::InstallEventHandlers()
               attachType == NS_LITERAL_STRING("_window"))
             {
               nsCOMPtr<nsIDocument> boundDoc;
-              mBoundElement->GetDocument(*getter_AddRefs(boundDoc));
+              mBoundElement->GetDocument(getter_AddRefs(boundDoc));
               if (attachType == NS_LITERAL_STRING("_window")) {
                 nsCOMPtr<nsIScriptGlobalObject> global;
                 boundDoc->GetScriptGlobalObject(getter_AddRefs(global));
@@ -885,7 +886,7 @@ nsXBLBinding::InstallEventHandlers()
             }
           else if (!attachType.IsEmpty() && !attachType.Equals(NS_LITERAL_STRING("_element"))) {
             nsCOMPtr<nsIDocument> boundDoc;
-            mBoundElement->GetDocument(*getter_AddRefs(boundDoc));
+            mBoundElement->GetDocument(getter_AddRefs(boundDoc));
             nsCOMPtr<nsIDOMDocument> domDoc(do_QueryInterface(boundDoc));
             nsCOMPtr<nsIDOMElement> otherElement;
             domDoc->GetElementById(attachType, getter_AddRefs(otherElement));
@@ -1374,7 +1375,7 @@ nsXBLBinding::InitClass(const nsCString& aClassName,
 
   // Root mBoundElement so that it doesn't loose it's binding
   nsCOMPtr<nsIDocument> doc;
-  mBoundElement->GetDocument(*getter_AddRefs(doc));
+  mBoundElement->GetDocument(getter_AddRefs(doc));
 
   if (doc) {
     nsCOMPtr<nsIXPConnectWrappedNative> native_wrapper =
@@ -1398,9 +1399,9 @@ nsXBLBinding::GetImmediateChild(nsIAtom* aTag, nsIContent** aResult)
   binding->ChildCount(childCount);
   for (PRInt32 i = 0; i < childCount; i++) {
     nsCOMPtr<nsIContent> child;
-    binding->ChildAt(i, *getter_AddRefs(child));
+    binding->ChildAt(i, getter_AddRefs(child));
     nsCOMPtr<nsIAtom> tag;
-    child->GetTag(*getter_AddRefs(tag));
+    child->GetTag(getter_AddRefs(tag));
     if (aTag == tag) {
       *aResult = child;
       NS_ADDREF(*aResult);
@@ -1471,7 +1472,7 @@ nsXBLBinding::AddScriptEventListener(nsIContent* aElement, nsIAtom* aName,
 
   nsresult rv;
   nsCOMPtr<nsIDocument> document;
-  aElement->GetDocument(*getter_AddRefs(document));
+  aElement->GetDocument(getter_AddRefs(document));
   if (!document)
     return NS_OK;
 
@@ -1513,7 +1514,7 @@ nsXBLBinding::GetTextData(nsIContent *aParent, nsString& aResult)
   nsAutoString answer;
   for (PRInt32 j = 0; j < textCount; j++) {
     // Get the child.
-    aParent->ChildAt(j, *getter_AddRefs(textChild));
+    aParent->ChildAt(j, getter_AddRefs(textChild));
     nsCOMPtr<nsIDOMText> text(do_QueryInterface(textChild));
     if (text) {
       nsAutoString data;
diff --git a/content/xbl/src/nsXBLContentSink.cpp b/content/xbl/src/nsXBLContentSink.cpp
index 0294a3f54b01..d7fc3b580187 100644
--- a/content/xbl/src/nsXBLContentSink.cpp
+++ b/content/xbl/src/nsXBLContentSink.cpp
@@ -815,7 +815,7 @@ nsXBLContentSink::AddAttributesToXULPrototype(const PRUnichar **aAtts,
     } 
 
     mNodeInfoManager->GetNodeInfo(nameAtom, nameSpacePrefix, nameSpaceID,
-                                  *getter_AddRefs(attrs->mNodeInfo));
+                                  getter_AddRefs(attrs->mNodeInfo));
     
     attrs->mValue.SetValue(nsDependentString(aAtts[1]));
     ++attrs;
diff --git a/content/xbl/src/nsXBLEventHandler.cpp b/content/xbl/src/nsXBLEventHandler.cpp
index 2aa515255e33..55f3e3d02ff4 100644
--- a/content/xbl/src/nsXBLEventHandler.cpp
+++ b/content/xbl/src/nsXBLEventHandler.cpp
@@ -140,7 +140,7 @@ nsXBLEventHandler::GetTextData(nsIContent *aParent, nsAString& aResult)
 
   for (PRInt32 j = 0; j < textCount; j++) {
     // Get the child.
-    aParent->ChildAt(j, *getter_AddRefs(textChild));
+    aParent->ChildAt(j, getter_AddRefs(textChild));
     nsCOMPtr<nsIDOMText> text(do_QueryInterface(textChild));
     if (text) {
       nsAutoString data;
diff --git a/content/xbl/src/nsXBLProtoImpl.cpp b/content/xbl/src/nsXBLProtoImpl.cpp
index 474cad167375..e025072fb4de 100644
--- a/content/xbl/src/nsXBLProtoImpl.cpp
+++ b/content/xbl/src/nsXBLProtoImpl.cpp
@@ -57,7 +57,7 @@ nsXBLProtoImpl::InstallImplementation(nsXBLPrototypeBinding* aBinding, nsIConten
     return NS_OK; // Nothing to do, so let's not waste time.
 
   nsCOMPtr<nsIDocument> document;
-  aBoundElement->GetDocument(*getter_AddRefs(document));
+  aBoundElement->GetDocument(getter_AddRefs(document));
   if (!document) return NS_OK;
 
   nsCOMPtr<nsIScriptGlobalObject> global;
@@ -126,7 +126,7 @@ nsXBLProtoImpl::InitTargetObjects(nsXBLPrototypeBinding* aBinding,
 
   // Root ourselves in the document.
   nsCOMPtr<nsIDocument> doc;
-  aBoundElement->GetDocument(*getter_AddRefs(doc));
+  aBoundElement->GetDocument(getter_AddRefs(doc));
   if (doc) {
     nsCOMPtr<nsIXPConnectWrappedNative> nativeWrapper(do_QueryInterface(wrapper));
     if (nativeWrapper)
diff --git a/content/xbl/src/nsXBLPrototypeBinding.cpp b/content/xbl/src/nsXBLPrototypeBinding.cpp
index d9b9e94ffbab..5242dae4e929 100644
--- a/content/xbl/src/nsXBLPrototypeBinding.cpp
+++ b/content/xbl/src/nsXBLPrototypeBinding.cpp
@@ -503,7 +503,7 @@ nsXBLPrototypeBinding::AttributeChanged(nsIAtom* aAttribute,
       // set or unset on us.  We may also be a tag that is having
       // xbl:text set on us.
       nsCOMPtr<nsIAtom> tag;
-      realElement->GetTag(*getter_AddRefs(tag));
+      realElement->GetTag(getter_AddRefs(tag));
       if (dstAttr == nsXBLAtoms::xbltext || (tag == nsHTMLAtoms::html) && (dstAttr == nsHTMLAtoms::value)) {
         // Flush out all our kids.
         PRInt32 childCount;
@@ -518,7 +518,7 @@ nsXBLPrototypeBinding::AttributeChanged(nsIAtom* aAttribute,
           if (!value.IsEmpty()) {
             nsCOMPtr<nsIDOMText> textNode;
             nsCOMPtr<nsIDocument> doc;
-            aChangedElement->GetDocument(*getter_AddRefs(doc));
+            aChangedElement->GetDocument(getter_AddRefs(doc));
             nsCOMPtr<nsIDOMDocument> domDoc(do_QueryInterface(doc));
             domDoc->CreateTextNode(value, getter_AddRefs(textNode));
             nsCOMPtr<nsIDOMNode> dummy;
@@ -612,7 +612,7 @@ nsXBLPrototypeBinding::GetInsertionPoint(nsIContent* aBoundElement,
 {
   if (mInsertionPointTable) {
     nsCOMPtr<nsIAtom> tag;
-    aChild->GetTag(*getter_AddRefs(tag));
+    aChild->GetTag(getter_AddRefs(tag));
     nsISupportsKey key(tag);
     nsXBLInsertionPointEntry* entry = NS_STATIC_CAST(nsXBLInsertionPointEntry*, mInsertionPointTable->Get(&key));
     if (!entry) {
@@ -731,9 +731,9 @@ nsXBLPrototypeBinding::GetImmediateChild(nsIAtom* aTag)
   mBinding->ChildCount(childCount);
   for (PRInt32 i = 0; i < childCount; i++) {
     nsCOMPtr<nsIContent> child;
-    mBinding->ChildAt(i, *getter_AddRefs(child));
+    mBinding->ChildAt(i, getter_AddRefs(child));
     nsCOMPtr<nsIAtom> tag;
-    child->GetTag(*getter_AddRefs(tag));
+    child->GetTag(getter_AddRefs(tag));
     if (aTag == tag) {
       nsIContent* result = child;
       NS_ADDREF(result);
@@ -774,14 +774,14 @@ nsXBLPrototypeBinding::LocateInstance(nsIContent* aBoundElement,
   nsCOMPtr<nsIContent> templParent;
   nsCOMPtr<nsIContent> copyParent;
   nsCOMPtr<nsIContent> childPoint;
-  aTemplChild->GetParent(*getter_AddRefs(templParent));
+  aTemplChild->GetParent(getter_AddRefs(templParent));
   
   if (aBoundElement) {
     nsCOMPtr<nsIAtom> tag;
-    templParent->GetTag(*getter_AddRefs(tag));
+    templParent->GetTag(getter_AddRefs(tag));
     if (tag == nsXBLAtoms::children) {
       childPoint = templParent;
-      childPoint->GetParent(*getter_AddRefs(templParent));
+      childPoint->GetParent(getter_AddRefs(templParent));
     }
   }
 
@@ -799,7 +799,7 @@ nsXBLPrototypeBinding::LocateInstance(nsIContent* aBoundElement,
     // First we have to locate this insertion point and use its index and its
     // count to detemine our precise position within the template.
     nsCOMPtr<nsIDocument> doc;
-    aBoundElement->GetDocument(*getter_AddRefs(doc));
+    aBoundElement->GetDocument(getter_AddRefs(doc));
     nsCOMPtr<nsIBindingManager> bm;
     doc->GetBindingManager(getter_AddRefs(bm));
     nsCOMPtr<nsIXBLBinding> binding;
@@ -838,7 +838,7 @@ nsXBLPrototypeBinding::LocateInstance(nsIContent* aBoundElement,
           
           // Now we just have to find the corresponding elt underneath the cloned
           // default content.
-          defContent->ChildAt(index, result); // addrefs
+          defContent->ChildAt(index, &result); // addrefs
         } 
         break;
       }
@@ -848,7 +848,7 @@ nsXBLPrototypeBinding::LocateInstance(nsIContent* aBoundElement,
   {
     PRInt32 index;
     templParent->IndexOf(aTemplChild, index);
-    copyParent->ChildAt(index, result); // Addref happens here.
+    copyParent->ChildAt(index, &result); // Addref happens here.
   }
 
   return result;
@@ -908,12 +908,12 @@ PRBool PR_CALLBACK SetAttrs(nsHashKey* aKey, void* aData, void* aClosure)
       if (realElement) {
         realElement->SetAttr(kNameSpaceID_None, dst, value, PR_FALSE);
         nsCOMPtr<nsIAtom> tag;
-        realElement->GetTag(*getter_AddRefs(tag));
+        realElement->GetTag(getter_AddRefs(tag));
         if (dst == nsXBLAtoms::xbltext ||
             (tag == nsHTMLAtoms::html) && (dst == nsHTMLAtoms::value) && !value.IsEmpty()) {
           nsCOMPtr<nsIDOMText> textNode;
           nsCOMPtr<nsIDocument> doc;
-          changeData->mBoundElement->GetDocument(*getter_AddRefs(doc));
+          changeData->mBoundElement->GetDocument(getter_AddRefs(doc));
           nsCOMPtr<nsIDOMDocument> domDoc(do_QueryInterface(doc));
           domDoc->CreateTextNode(value, getter_AddRefs(textNode));
           nsCOMPtr<nsIDOMNode> dummy;
@@ -1062,7 +1062,7 @@ nsXBLPrototypeBinding::ConstructAttributeTable(nsIContent* aElement)
   aElement->ChildCount(childCount);
   for (PRInt32 i = 0; i < childCount; i++) {
     nsCOMPtr<nsIContent> child;
-    aElement->ChildAt(i, *getter_AddRefs(child));
+    aElement->ChildAt(i, getter_AddRefs(child));
     ConstructAttributeTable(child);
   }
 }
@@ -1098,7 +1098,7 @@ nsXBLPrototypeBinding::ConstructInsertionTable(nsIContent* aContent)
     nsCOMPtr<nsIContent> child(do_QueryInterface(supp));
     if (child) {
       nsCOMPtr<nsIContent> parent; 
-      child->GetParent(*getter_AddRefs(parent));
+      child->GetParent(getter_AddRefs(parent));
 
       // Create an XBL insertion point entry.
       nsXBLInsertionPointEntry* xblIns = nsXBLInsertionPointEntry::Create(parent);
@@ -1249,9 +1249,9 @@ nsXBLPrototypeBinding::GetNestedChildren(nsIAtom* aTag, nsIContent* aContent,
   aContent->ChildCount(childCount);
   for (PRInt32 i = 0; i < childCount; i++) {
     nsCOMPtr<nsIContent> child;
-    aContent->ChildAt(i, *getter_AddRefs(child));
+    aContent->ChildAt(i, getter_AddRefs(child));
     nsCOMPtr<nsIAtom> tag;
-    child->GetTag(*getter_AddRefs(tag));
+    child->GetTag(getter_AddRefs(tag));
     if (aTag == tag) {
       if (!*aList)
         NS_NewISupportsArray(aList); // Addref happens here.
diff --git a/content/xbl/src/nsXBLPrototypeHandler.cpp b/content/xbl/src/nsXBLPrototypeHandler.cpp
index d067fb99ed6a..0db55a13cb09 100644
--- a/content/xbl/src/nsXBLPrototypeHandler.cpp
+++ b/content/xbl/src/nsXBLPrototypeHandler.cpp
@@ -265,7 +265,7 @@ nsXBLPrototypeHandler::ExecuteHandler(nsIDOMEventReceiver* aReceiver,
         nsCOMPtr<nsIContent> elt(do_QueryInterface(aReceiver));
         nsCOMPtr<nsIDocument> doc;
         if (elt)
-          elt->GetDocument(*getter_AddRefs(doc));
+          elt->GetDocument(getter_AddRefs(doc));
 
         if (!doc)
           doc = do_QueryInterface(aReceiver);
@@ -378,7 +378,7 @@ nsXBLPrototypeHandler::ExecuteHandler(nsIDOMEventReceiver* aReceiver,
       nsCOMPtr<nsIContent> content(do_QueryInterface(aReceiver));
       if (!content)
         return NS_OK;
-      content->GetDocument(*getter_AddRefs(boundDocument));
+      content->GetDocument(getter_AddRefs(boundDocument));
       if (!boundDocument)
         return NS_OK;
     }
@@ -977,7 +977,7 @@ nsXBLPrototypeHandler::GetTextData(nsIContent *aParent, nsString& aResult)
   nsAutoString answer;
   for (PRInt32 j = 0; j < textCount; j++) {
     // Get the child.
-    aParent->ChildAt(j, *getter_AddRefs(textChild));
+    aParent->ChildAt(j, getter_AddRefs(textChild));
     nsCOMPtr<nsIDOMText> text(do_QueryInterface(textChild));
     if (text) {
       nsAutoString data;
diff --git a/content/xbl/src/nsXBLResourceLoader.cpp b/content/xbl/src/nsXBLResourceLoader.cpp
index a7d82c06fd71..c6c3f3015efc 100644
--- a/content/xbl/src/nsXBLResourceLoader.cpp
+++ b/content/xbl/src/nsXBLResourceLoader.cpp
@@ -264,7 +264,7 @@ nsXBLResourceLoader::NotifyBoundElements()
 
     if (ready) {
       nsCOMPtr<nsIDocument> doc;
-      content->GetDocument(*getter_AddRefs(doc));
+      content->GetDocument(getter_AddRefs(doc));
     
       if (doc) {
         // Flush first
@@ -272,7 +272,7 @@ nsXBLResourceLoader::NotifyBoundElements()
 
         // Notify
         nsCOMPtr<nsIContent> parent;
-        content->GetParent(*getter_AddRefs(parent));
+        content->GetParent(getter_AddRefs(parent));
         PRInt32 index = 0;
         if (parent)
           parent->IndexOf(content, index);
diff --git a/content/xbl/src/nsXBLService.cpp b/content/xbl/src/nsXBLService.cpp
index 8c92ae4c9775..c9d7fb599227 100644
--- a/content/xbl/src/nsXBLService.cpp
+++ b/content/xbl/src/nsXBLService.cpp
@@ -137,7 +137,7 @@ public:
   void DocumentLoaded(nsIDocument* aBindingDoc)
   {
     nsCOMPtr<nsIDocument> doc;
-    mBoundElement->GetDocument(*getter_AddRefs(doc));
+    mBoundElement->GetDocument(getter_AddRefs(doc));
     if (!doc)
       return;
 
@@ -151,7 +151,7 @@ public:
     // XXX Deal with layered bindings.
     // Now do a ContentInserted notification to cause the frames to get installed finally,
     nsCOMPtr<nsIContent> parent;
-    mBoundElement->GetParent(*getter_AddRefs(parent));
+    mBoundElement->GetParent(getter_AddRefs(parent));
     PRInt32 index = 0;
     if (parent)
       parent->IndexOf(mBoundElement, index);
@@ -387,7 +387,7 @@ nsXBLStreamListener::Load(nsIDOMEvent* aEvent)
     if (count > 0) {
       nsXBLBindingRequest* req = (nsXBLBindingRequest*)mBindingRequests.ElementAt(0);
       nsCOMPtr<nsIDocument> document;
-      req->mBoundElement->GetDocument(*getter_AddRefs(document));
+      req->mBoundElement->GetDocument(getter_AddRefs(document));
       if (document)
         document->FlushPendingNotifications();
     }
@@ -448,7 +448,7 @@ nsXBLStreamListener::Load(nsIDOMEvent* aEvent)
     if (count > 0) {
       nsXBLBindingRequest* req = (nsXBLBindingRequest*)mBindingRequests.ElementAt(0);
       nsCOMPtr<nsIDocument> document;
-      req->mBoundElement->GetDocument(*getter_AddRefs(document));
+      req->mBoundElement->GetDocument(getter_AddRefs(document));
       if (document)
         document->FlushPendingNotifications();
     }
@@ -545,7 +545,7 @@ nsXBLService::LoadBindings(nsIContent* aContent, const nsAString& aURL, PRBool a
   nsresult rv;
 
   nsCOMPtr<nsIDocument> document;
-  aContent->GetDocument(*getter_AddRefs(document));
+  aContent->GetDocument(getter_AddRefs(document));
 
   // XXX document may be null if we're in the midst of paint suppression
   if (!document)
@@ -668,7 +668,7 @@ nsresult
 nsXBLService::FlushStyleBindings(nsIContent* aContent)
 {
   nsCOMPtr<nsIDocument> document;
-  aContent->GetDocument(*getter_AddRefs(document));
+  aContent->GetDocument(getter_AddRefs(document));
 
   // XXX doc will be null if we're in the midst of paint suppression.
   if (! document)
@@ -687,7 +687,7 @@ nsXBLService::FlushStyleBindings(nsIContent* aContent)
     if (styleBinding) {
       // Clear out the script references.
       nsCOMPtr<nsIDocument> document;
-      aContent->GetDocument(*getter_AddRefs(document));
+      aContent->GetDocument(getter_AddRefs(document));
       styleBinding->UnhookEventHandlers();
       styleBinding->ChangeDocument(document, nsnull);
     }
@@ -703,7 +703,7 @@ NS_IMETHODIMP
 nsXBLService::ResolveTag(nsIContent* aContent, PRInt32* aNameSpaceID, nsIAtom** aResult)
 {
   nsCOMPtr<nsIDocument> document;
-  aContent->GetDocument(*getter_AddRefs(document));
+  aContent->GetDocument(getter_AddRefs(document));
   if (document) {
     nsCOMPtr<nsIBindingManager> bindingManager;
     document->GetBindingManager(getter_AddRefs(bindingManager));
@@ -712,8 +712,8 @@ nsXBLService::ResolveTag(nsIContent* aContent, PRInt32* aNameSpaceID, nsIAtom**
       return bindingManager->ResolveTag(aContent, aNameSpaceID, aResult);
   }
 
-  aContent->GetNameSpaceID(*aNameSpaceID);
-  aContent->GetTag(*aResult); // Addref happens here.
+  aContent->GetNameSpaceID(aNameSpaceID);
+  aContent->GetTag(aResult); // Addref happens here.
   return NS_OK;
 }
 
@@ -736,7 +736,7 @@ nsXBLService::GetXBLDocumentInfo(const nsCString& aURLStr, nsIContent* aBoundEle
   if (!*aResult) {
     // The second line of defense is the binding manager's document table.
     nsCOMPtr<nsIDocument> boundDocument;
-    aBoundElement->GetDocument(*getter_AddRefs(boundDocument));
+    aBoundElement->GetDocument(getter_AddRefs(boundDocument));
     if (boundDocument) {
       nsCOMPtr<nsIBindingManager> bindingManager;
       boundDocument->GetBindingManager(getter_AddRefs(bindingManager));
@@ -763,7 +763,7 @@ nsXBLService::AttachGlobalKeyHandler(nsIDOMEventReceiver* aReceiver)
   nsCOMPtr<nsIContent> contentNode(do_QueryInterface(aReceiver));
   if (contentNode) {
     nsCOMPtr<nsIDocument> doc;
-    contentNode->GetDocument(*getter_AddRefs(doc));  
+    contentNode->GetDocument(getter_AddRefs(doc));
     if (doc)
       rec = do_QueryInterface(doc); // We're a XUL keyset. Attach to our document.
   }
@@ -901,7 +901,7 @@ NS_IMETHODIMP nsXBLService::GetBindingInternal(nsIContent* aBoundElement,
   uri.Truncate(indx);
 
   nsCOMPtr<nsIDocument> boundDocument;
-  aBoundElement->GetDocument(*getter_AddRefs(boundDocument));
+  aBoundElement->GetDocument(getter_AddRefs(boundDocument));
 
   nsCOMPtr<nsIXBLDocumentInfo> docInfo;
   LoadBindingDocumentInfo(aBoundElement, boundDocument, uri, ref, PR_FALSE, getter_AddRefs(docInfo));
@@ -995,7 +995,7 @@ NS_IMETHODIMP nsXBLService::GetBindingInternal(nsIContent* aBoundElement,
             PRInt32 nameSpaceID;
 
             nsContentUtils::GetNSManagerWeakRef()->GetNameSpaceID(nameSpace,
-                                                                  nameSpaceID);
+                                                                  &nameSpaceID);
 
             nsCOMPtr<nsIAtom> tagName = do_GetAtom(display);
             protoBinding->SetBaseTag(nameSpaceID, tagName);
@@ -1069,7 +1069,7 @@ nsXBLService::LoadBindingDocumentInfo(nsIContent* aBoundElement, nsIDocument* aB
 
     nsCOMPtr<nsIAtom> tagName;
     if (aBoundElement)
-      aBoundElement->GetTag(*getter_AddRefs(tagName));
+      aBoundElement->GetTag(getter_AddRefs(tagName));
     if (!info && bindingManager &&
         (tagName != nsXULAtoms::scrollbar) &&
         (tagName != nsXULAtoms::thumb) &&
@@ -1167,7 +1167,7 @@ nsXBLService::FetchBindingDocument(nsIContent* aBoundElement, nsIDocument* aBoun
 
   nsCOMPtr<nsIAtom> tagName;
   if (aBoundElement)
-    aBoundElement->GetTag(*getter_AddRefs(tagName)); 
+    aBoundElement->GetTag(getter_AddRefs(tagName));
 
   if (tagName == nsXULAtoms::scrollbar ||
       tagName == nsXULAtoms::thumb || 
diff --git a/content/xbl/src/nsXBLWindowHandler.cpp b/content/xbl/src/nsXBLWindowHandler.cpp
index eb37a20f525f..516c7440eedb 100644
--- a/content/xbl/src/nsXBLWindowHandler.cpp
+++ b/content/xbl/src/nsXBLWindowHandler.cpp
@@ -292,7 +292,7 @@ nsXBLWindowHandler::WalkHandlersInternal(nsIDOMEvent* aEvent,
         if (!command.IsEmpty()) {
           // Locate the command element in question.
           nsCOMPtr<nsIDocument> doc;
-          elt->GetDocument(*getter_AddRefs(doc));
+          elt->GetDocument(getter_AddRefs(doc));
           nsCOMPtr<nsIDOMDocument> domDoc(do_QueryInterface(doc));
           if (domDoc)
             domDoc->GetElementById(command, getter_AddRefs(commandElt));
diff --git a/content/xbl/src/nsXBLWindowKeyHandler.cpp b/content/xbl/src/nsXBLWindowKeyHandler.cpp
index 75929a5ec87f..1ccffa85ec02 100644
--- a/content/xbl/src/nsXBLWindowKeyHandler.cpp
+++ b/content/xbl/src/nsXBLWindowKeyHandler.cpp
@@ -80,7 +80,7 @@ BuildHandlerChain(nsIContent* aContent, nsXBLPrototypeHandler** aResult)
   aContent->ChildCount(handlerCount);
   for (PRInt32 j = 0; j < handlerCount; j++) {
     nsCOMPtr<nsIContent> handler;
-    aContent->ChildAt(j, *getter_AddRefs(handler));
+    aContent->ChildAt(j, getter_AddRefs(handler));
     
     nsXBLPrototypeHandler* newHandler = new nsXBLPrototypeHandler(handler);
     
diff --git a/content/xml/content/src/nsXMLCDATASection.cpp b/content/xml/content/src/nsXMLCDATASection.cpp
index 656b2ab3e799..af0f8b5b2a1d 100644
--- a/content/xml/content/src/nsXMLCDATASection.cpp
+++ b/content/xml/content/src/nsXMLCDATASection.cpp
@@ -66,7 +66,7 @@ public:
   // Empty interface
 
   // nsIContent
-  NS_IMETHOD GetTag(nsIAtom*& aResult) const;
+  NS_IMETHOD GetTag(nsIAtom** aResult) const;
 #ifdef DEBUG
   NS_IMETHOD List(FILE* out, PRInt32 aIndent) const;
   NS_IMETHOD DumpContent(FILE* out, PRInt32 aIndent,PRBool aDumpAll) const;
@@ -113,10 +113,10 @@ NS_IMPL_RELEASE_INHERITED(nsXMLCDATASection, nsGenericDOMDataNode)
 
 
 NS_IMETHODIMP 
-nsXMLCDATASection::GetTag(nsIAtom*& aResult) const
+nsXMLCDATASection::GetTag(nsIAtom** aResult) const
 {
-  aResult = nsLayoutAtoms::textTagName;
-  NS_ADDREF(aResult);
+  *aResult = nsLayoutAtoms::textTagName;
+  NS_ADDREF(*aResult);
   return NS_OK;
 }
 
diff --git a/content/xml/content/src/nsXMLElement.cpp b/content/xml/content/src/nsXMLElement.cpp
index 99b36b3a404e..a7bb0e3789f1 100644
--- a/content/xml/content/src/nsXMLElement.cpp
+++ b/content/xml/content/src/nsXMLElement.cpp
@@ -209,14 +209,14 @@ nsXMLElement::GetXMLBaseURI(nsIURI **aURI)
       }
     } // if (rv == NS_CONTENT_ATTR_HAS_VALUE) {
     nsCOMPtr<nsIContent> parent;
-    rv = content->GetParent(*getter_AddRefs(parent));
+    rv = content->GetParent(getter_AddRefs(parent));
     content = parent;
   } // while
 
   if (NS_SUCCEEDED(rv)) {
     if (!*aURI && mDocument) {
       nsCOMPtr<nsIURI> docBase;
-      mDocument->GetBaseURL(*getter_AddRefs(docBase));
+      mDocument->GetBaseURL(getter_AddRefs(docBase));
       if (!docBase) {
         mDocument->GetDocumentURL(getter_AddRefs(docBase));
       }
@@ -243,20 +243,20 @@ nsXMLElement::GetXMLBaseURI(nsIURI **aURI)
 
           if (content) { // content is the last content we tried above
             nsCOMPtr<nsIContent> parent;
-            content->GetParent(*getter_AddRefs(parent));
+            content->GetParent(getter_AddRefs(parent));
             content = parent;
             while (content) {
               nsCOMPtr<nsIXMLContent> xml(do_QueryInterface(content));
               if (xml) {
                 return xml->GetXMLBaseURI(aURI);
               }
-              content->GetParent(*getter_AddRefs(parent));
+              content->GetParent(getter_AddRefs(parent));
               content = parent;
             }
           }
           
           nsCOMPtr<nsIURI> docBase;
-          mDocument->GetBaseURL(*getter_AddRefs(docBase));
+          mDocument->GetBaseURL(getter_AddRefs(docBase));
           if (!docBase) {
             mDocument->GetDocumentURL(getter_AddRefs(docBase));
           }
diff --git a/content/xml/content/src/nsXMLEntity.cpp b/content/xml/content/src/nsXMLEntity.cpp
index 38af263f4031..cb7c8739ad47 100644
--- a/content/xml/content/src/nsXMLEntity.cpp
+++ b/content/xml/content/src/nsXMLEntity.cpp
@@ -61,7 +61,7 @@ public:
   // nsIDOMEntity
   NS_DECL_NSIDOMENTITY
 
-  NS_IMETHOD GetTag(nsIAtom*& aResult) const;
+  NS_IMETHOD GetTag(nsIAtom** aResult) const;
 
 #ifdef DEBUG
   NS_IMETHOD List(FILE* out, PRInt32 aIndent) const;
@@ -146,12 +146,12 @@ nsXMLEntity::GetNotationName(nsAString& aNotationName)
 }
 
 NS_IMETHODIMP 
-nsXMLEntity::GetTag(nsIAtom*& aResult) const
+nsXMLEntity::GetTag(nsIAtom** aResult) const
 {
-//  aResult = nsLayoutAtoms::EntityTagName;
-//  NS_ADDREF(aResult);
+//  *aResult = nsLayoutAtoms::EntityTagName;
+//  NS_ADDREF(*aResult);
 
-  aResult = nsnull;
+  *aResult = nsnull;
 
   return NS_OK;
 }
diff --git a/content/xml/content/src/nsXMLNotation.cpp b/content/xml/content/src/nsXMLNotation.cpp
index 06d2d94f9ef1..fdab406380ce 100644
--- a/content/xml/content/src/nsXMLNotation.cpp
+++ b/content/xml/content/src/nsXMLNotation.cpp
@@ -70,7 +70,7 @@ public:
 #endif
 
   // nsIContent
-  NS_IMETHOD GetTag(nsIAtom*& aResult) const;
+  NS_IMETHOD GetTag(nsIAtom** aResult) const;
 
 protected:
   nsAutoString mName;
@@ -133,12 +133,12 @@ nsXMLNotation::GetSystemId(nsAString& aSystemId)
 }
 
 NS_IMETHODIMP 
-nsXMLNotation::GetTag(nsIAtom*& aResult) const
+nsXMLNotation::GetTag(nsIAtom** aResult) const
 {
-//  aResult = nsLayoutAtoms::NotationTagName;
-//  NS_ADDREF(aResult);
+//  *aResult = nsLayoutAtoms::NotationTagName;
+//  NS_ADDREF(*aResult);
 
-  aResult = nsnull;
+  *aResult = nsnull;
 
   return NS_OK;
 }
diff --git a/content/xml/content/src/nsXMLProcessingInstruction.cpp b/content/xml/content/src/nsXMLProcessingInstruction.cpp
index 6a9f497ab50d..8ce6911e3e60 100644
--- a/content/xml/content/src/nsXMLProcessingInstruction.cpp
+++ b/content/xml/content/src/nsXMLProcessingInstruction.cpp
@@ -113,10 +113,10 @@ nsXMLProcessingInstruction::GetAttrValue(const nsAString& aAttr,
 }
 
 NS_IMETHODIMP
-nsXMLProcessingInstruction::GetTag(nsIAtom*& aResult) const
+nsXMLProcessingInstruction::GetTag(nsIAtom** aResult) const
 {
-  aResult = nsLayoutAtoms::processingInstructionTagName;
-  NS_ADDREF(aResult);
+  *aResult = nsLayoutAtoms::processingInstructionTagName;
+  NS_ADDREF(*aResult);
   return NS_OK;
 }
 
diff --git a/content/xml/content/src/nsXMLProcessingInstruction.h b/content/xml/content/src/nsXMLProcessingInstruction.h
index 949c04ab96a7..4ed62a08ce56 100644
--- a/content/xml/content/src/nsXMLProcessingInstruction.h
+++ b/content/xml/content/src/nsXMLProcessingInstruction.h
@@ -64,7 +64,7 @@ public:
   NS_DECL_NSIDOMPROCESSINGINSTRUCTION
 
   // nsIContent
-  NS_IMETHOD GetTag(nsIAtom*& aResult) const;
+  NS_IMETHOD GetTag(nsIAtom** aResult) const;
 
 #ifdef DEBUG
   NS_IMETHOD List(FILE* out, PRInt32 aIndent) const;
diff --git a/content/xml/content/src/nsXMLStylesheetPI.cpp b/content/xml/content/src/nsXMLStylesheetPI.cpp
index de75248ba4e9..fbda72d10b3a 100644
--- a/content/xml/content/src/nsXMLStylesheetPI.cpp
+++ b/content/xml/content/src/nsXMLStylesheetPI.cpp
@@ -170,7 +170,7 @@ nsXMLStylesheetPI::GetStyleSheetURL(PRBool* aIsInline,
 
   nsCOMPtr<nsIURI> url, baseURL;
   if (mDocument) {
-    mDocument->GetBaseURL(*getter_AddRefs(baseURL));
+    mDocument->GetBaseURL(getter_AddRefs(baseURL));
   }
   NS_MakeAbsoluteURI(aUrl, href, baseURL);
 }
diff --git a/content/xml/document/src/nsXMLContentSink.cpp b/content/xml/document/src/nsXMLContentSink.cpp
index 9143cb8695f6..37b6fcebaa3b 100644
--- a/content/xml/document/src/nsXMLContentSink.cpp
+++ b/content/xml/document/src/nsXMLContentSink.cpp
@@ -291,7 +291,7 @@ nsXMLContentSink::Init(nsIDocument* aDoc,
 
   ProcessHTTPHeaders(aChannel);
 
-  return aDoc->GetNodeInfoManager(*getter_AddRefs(mNodeInfoManager));
+  return aDoc->GetNodeInfoManager(getter_AddRefs(mNodeInfoManager));
 }
 
 NS_IMPL_THREADSAFE_ADDREF(nsXMLContentSink)
@@ -615,8 +615,7 @@ nsXMLContentSink::CreateElement(const PRUnichar** aAtts, PRUint32 aAttsCount,
   *aAppendContent = PR_TRUE;
   nsresult rv = NS_OK;
 
-  PRInt32 nameSpaceID;
-  aNodeInfo->GetNamespaceID(nameSpaceID);
+  PRInt32 nameSpaceID = aNodeInfo->GetNamespaceID();
 
   // XHTML needs some special attention
   if (nameSpaceID != kNameSpaceID_XHTML) {
@@ -651,9 +650,7 @@ nsXMLContentSink::CreateElement(const PRUnichar** aAtts, PRUint32 aAttsCount,
   rv = CallQueryInterface(htmlContent, aResult);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  nsCOMPtr<nsIAtom> tagAtom;
-  aNodeInfo->GetNameAtom(*getter_AddRefs(tagAtom));
-
+  nsCOMPtr<nsIAtom> tagAtom = aNodeInfo->GetNameAtom();
   if (tagAtom == nsHTMLAtoms::script) {
     // Don't append the content to the tree until we're all
     // done collecting its contents
@@ -707,7 +704,7 @@ nsXMLContentSink::CloseElement(nsIContent* aContent, PRBool* aAppendContent)
   }
   
   nsCOMPtr<nsIAtom> tagAtom;
-  aContent->GetTag(*getter_AddRefs(tagAtom));
+  aContent->GetTag(getter_AddRefs(tagAtom));
 
   nsresult rv = NS_OK;
 
@@ -889,7 +886,7 @@ nsXMLContentSink::ProcessBASETag(nsIContent* aContent)
         rv = mDocument->SetBaseURL(baseURI); // The document checks if it is legal to set this base
         if (NS_SUCCEEDED(rv)) {
           NS_IF_RELEASE(mDocumentBaseURL);
-          mDocument->GetBaseURL(mDocumentBaseURL);
+          mDocument->GetBaseURL(&mDocumentBaseURL);
         }
       }
     }
@@ -1287,7 +1284,7 @@ nsXMLContentSink::GetNameSpaceId(nsIAtom* aPrefix)
   if (mNameSpaceStack && mNameSpaceStack->Count() > 0) {
     PRInt32 index = mNameSpaceStack->Count() - 1;
     nsINameSpace* nameSpace = (nsINameSpace*)mNameSpaceStack->ElementAt(index);
-    nameSpace->FindNameSpaceID(aPrefix, id);
+    nameSpace->FindNameSpaceID(aPrefix, &id);
   }
 
   return id;
@@ -1639,7 +1636,7 @@ MathMLElementFactoryImpl::CreateInstanceByTag(nsINodeInfo* aNodeInfo,
 
   // this bit of code is to load mathml.css on demand
   nsCOMPtr<nsIDocument> doc;
-  aNodeInfo->GetDocument(*getter_AddRefs(doc));
+  aNodeInfo->GetDocument(getter_AddRefs(doc));
   if (doc) {
     nsCOMPtr<nsIHTMLContentContainer> htmlContainer(do_QueryInterface(doc));
     if (htmlContainer) {
@@ -1733,7 +1730,7 @@ nsXMLContentSink::HandleStartElement(const PRUnichar *aName,
   nsCOMPtr<nsINodeInfo> nodeInfo;
 
   mNodeInfoManager->GetNodeInfo(tagAtom, nameSpacePrefix, nameSpaceID,
-                                *getter_AddRefs(nodeInfo));
+                                getter_AddRefs(nodeInfo));
 
   result = CreateElement(aAtts, aAttsCount, nodeInfo, aLineNumber,
                          getter_AddRefs(content), &appendContent);
@@ -2091,7 +2088,8 @@ nsXMLContentSink::PushNameSpacesFrom(const PRUnichar** aAtts)
     nameSpace =
       (nsINameSpace*)mNameSpaceStack->ElementAt(mNameSpaceStack->Count() - 1);
   } else {
-    rv = nsContentUtils::GetNSManagerWeakRef()->CreateRootNameSpace(*getter_AddRefs(nameSpace));
+    rv = nsContentUtils::GetNSManagerWeakRef()->
+        CreateRootNameSpace(getter_AddRefs(nameSpace));
     NS_ENSURE_SUCCESS(rv, rv);
   }
 
@@ -2133,7 +2131,7 @@ nsXMLContentSink::PushNameSpacesFrom(const PRUnichar** aAtts)
 
       nsCOMPtr<nsINameSpace> child;
       rv = nameSpace->CreateChildNameSpace(prefixAtom, nsDependentString(aAtts[1]),
-                                           *getter_AddRefs(child));
+                                           getter_AddRefs(child));
       NS_ENSURE_SUCCESS(rv, rv);
 
       nameSpace = child;
@@ -2189,7 +2187,7 @@ nsXMLContentSink::AddAttributes(const PRUnichar** aAtts,
 
     nsCOMPtr<nsINodeInfo> ni;
     mNodeInfoManager->GetNodeInfo(nameAtom, nameSpacePrefix, nameSpaceID,
-                                  *getter_AddRefs(ni));
+                                  getter_AddRefs(ni));
     NS_ENSURE_TRUE(ni, NS_ERROR_FAILURE);
 
     // Add attribute to content
diff --git a/content/xml/document/src/nsXMLDocument.cpp b/content/xml/document/src/nsXMLDocument.cpp
index 0997334bfb30..60179f153285 100644
--- a/content/xml/document/src/nsXMLDocument.cpp
+++ b/content/xml/document/src/nsXMLDocument.cpp
@@ -878,7 +878,7 @@ nsXMLDocument::CreateElement(const nsAString& aTagName,
   nsresult rv;
 
   rv = mNodeInfoManager->GetNodeInfo(aTagName, nsnull, kNameSpaceID_None,
-                                     *getter_AddRefs(nodeInfo));
+                                     getter_AddRefs(nodeInfo));
   NS_ENSURE_SUCCESS(rv, rv);
 
   return CreateElement(nodeInfo, aReturn);
@@ -971,7 +971,7 @@ nsXMLDocument::CreateAttributeNS(const nsAString& aNamespaceURI,
 
   nsCOMPtr<nsINodeInfo> nodeInfo;
   nsresult rv = mNodeInfoManager->GetNodeInfo(aQualifiedName, aNamespaceURI,
-                                              *getter_AddRefs(nodeInfo));
+                                              getter_AddRefs(nodeInfo));
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsAutoString value;
@@ -993,7 +993,7 @@ nsXMLDocument::CreateElementNS(const nsAString& aNamespaceURI,
 
   nsCOMPtr<nsINodeInfo> nodeInfo;
   rv = mNodeInfoManager->GetNodeInfo(aQualifiedName, aNamespaceURI,
-                                     *getter_AddRefs(nodeInfo));
+                                     getter_AddRefs(nodeInfo));
   NS_ENSURE_SUCCESS(rv, rv);
 
   return CreateElement(nodeInfo, aReturn);
@@ -1019,7 +1019,7 @@ MatchElementId(nsIContent *aContent, const nsAString& aId)
 
     if (xmlContent) {
       nsCOMPtr<nsIAtom> value;
-      if (NS_SUCCEEDED(xmlContent->GetID(*getter_AddRefs(value))) &&
+      if (NS_SUCCEEDED(xmlContent->GetID(getter_AddRefs(value))) &&
           value && value->Equals(aId)) {
         return aContent;
       }
@@ -1030,11 +1030,10 @@ MatchElementId(nsIContent *aContent, const nsAString& aId)
   PRInt32 i, count;
 
   aContent->ChildCount(count);
+  nsCOMPtr<nsIContent> child;
   for (i = 0; i < count && result == nsnull; i++) {
-    nsIContent *child;
-    aContent->ChildAt(i, child);
+    aContent->ChildAt(i, getter_AddRefs(child));
     result = MatchElementId(child, aId);
-    NS_RELEASE(child);
   }  
 
   return result;
@@ -1132,8 +1131,7 @@ nsXMLDocument::CreateElement(nsINodeInfo *aNodeInfo, nsIDOMElement** aResult)
   
   nsCOMPtr<nsIContent> content;
 
-  PRInt32 namespaceID;
-  aNodeInfo->GetNamespaceID(namespaceID);
+  PRInt32 namespaceID = aNodeInfo->GetNamespaceID();
 
   nsCOMPtr<nsIElementFactory> elementFactory;
   nsContentUtils::GetNSManagerWeakRef()->GetElementFactory(namespaceID,
diff --git a/content/xul/content/src/nsXULAttributes.cpp b/content/xul/content/src/nsXULAttributes.cpp
index 7fd7d7a71ca7..cf99c648e46a 100644
--- a/content/xul/content/src/nsXULAttributes.cpp
+++ b/content/xul/content/src/nsXULAttributes.cpp
@@ -304,7 +304,7 @@ nsXULAttribute::SetPrefix(const nsAString& aPrefix)
 {
     // XXX: Validate the prefix string!
 
-    nsINodeInfo *newNodeInfo = nsnull;
+    nsCOMPtr<nsINodeInfo> newNodeInfo;
     nsCOMPtr<nsIAtom> prefix;
 
     if (!aPrefix.IsEmpty()) {
@@ -312,11 +312,13 @@ nsXULAttribute::SetPrefix(const nsAString& aPrefix)
         NS_ENSURE_TRUE(prefix, NS_ERROR_OUT_OF_MEMORY);
     }
 
-    nsresult rv = mNodeInfo->PrefixChanged(prefix, newNodeInfo);
+    nsresult rv = mNodeInfo->PrefixChanged(prefix,
+                                           getter_AddRefs(newNodeInfo));
     NS_ENSURE_SUCCESS(rv, rv);
 
     NS_RELEASE(mNodeInfo);
     mNodeInfo = newNodeInfo;
+    NS_ADDREF(mNodeInfo);
 
     return NS_OK;
 }
@@ -646,7 +648,7 @@ nsXULAttributes::GetNamedItem(const nsAString& aName,
     // PRInt32 nameSpaceID;
     nsCOMPtr<nsINodeInfo> inpNodeInfo;
 
-    if (NS_FAILED(rv = mContent->NormalizeAttrString(aName, *getter_AddRefs(inpNodeInfo))))
+    if (NS_FAILED(rv = mContent->NormalizeAttrString(aName, getter_AddRefs(inpNodeInfo))))
         return rv;
 
     // if (kNameSpaceID_Unknown == nameSpaceID) {
diff --git a/content/xul/content/src/nsXULElement.cpp b/content/xul/content/src/nsXULElement.cpp
index 307a8c4cdc92..0d1c43aaf1d8 100644
--- a/content/xul/content/src/nsXULElement.cpp
+++ b/content/xul/content/src/nsXULElement.cpp
@@ -341,7 +341,7 @@ FinishEventHandlerMap()
 static PRBool HasMutationListeners(nsIContent* aContent, PRUint32 aType)
 {
   nsCOMPtr<nsIDocument> doc;
-  aContent->GetDocument(*getter_AddRefs(doc));
+  aContent->GetDocument(getter_AddRefs(doc));
   if (!doc)
     return PR_FALSE;
 
@@ -377,7 +377,7 @@ static PRBool HasMutationListeners(nsIContent* aContent, PRUint32 aType)
     }
 
     nsCOMPtr<nsIContent> prev = curr;
-    prev->GetParent(*getter_AddRefs(curr));
+    prev->GetParent(getter_AddRefs(curr));
   }
 
   nsCOMPtr<nsIDOMEventReceiver> rec(do_QueryInterface(doc));
@@ -410,8 +410,7 @@ static PRBool HasMutationListeners(nsIContent* aContent, PRUint32 aType)
 static nsChangeHint
 StyleHintFor(nsINodeInfo* aNodeInfo)
 {
-    nsCOMPtr<nsIAtom> tagName;
-    aNodeInfo->GetNameAtom(*getter_AddRefs(tagName));
+    nsCOMPtr<nsIAtom> tagName = aNodeInfo->GetNameAtom();
     if ((tagName == nsXULAtoms::broadcaster) ||
         (tagName == nsXULAtoms::command) ||
         (tagName == nsXULAtoms::key)) {
@@ -747,7 +746,7 @@ nsXULElement::GetChildNodes(nsIDOMNodeList** aChildNodes)
 
     for (PRInt32 i = 0; i < count; ++i) {
         nsCOMPtr<nsIContent> child;
-        rv = ChildAt(i, *getter_AddRefs(child));
+        rv = ChildAt(i, getter_AddRefs(child));
         NS_ASSERTION(NS_SUCCEEDED(rv), "unable to get child");
         if (NS_FAILED(rv))
             break;
@@ -775,7 +774,7 @@ nsXULElement::GetFirstChild(nsIDOMNode** aFirstChild)
 {
     nsresult rv;
     nsCOMPtr<nsIContent> child;
-    rv = ChildAt(0, *getter_AddRefs(child));
+    rv = ChildAt(0, getter_AddRefs(child));
 
     if (child) {
         rv = CallQueryInterface(child, aFirstChild);
@@ -798,7 +797,7 @@ nsXULElement::GetLastChild(nsIDOMNode** aLastChild)
 
     if (NS_SUCCEEDED(rv) && (count != 0)) {
         nsCOMPtr<nsIContent> child;
-        rv = ChildAt(count - 1, *getter_AddRefs(child));
+        rv = ChildAt(count - 1, getter_AddRefs(child));
 
         NS_ASSERTION(child, "no child");
 
@@ -822,7 +821,7 @@ nsXULElement::GetPreviousSibling(nsIDOMNode** aPreviousSibling)
         mParent->IndexOf(NS_STATIC_CAST(nsIStyledContent*, this), pos);
         if (pos > 0) {
             nsCOMPtr<nsIContent> prev;
-            mParent->ChildAt(--pos, *getter_AddRefs(prev));
+            mParent->ChildAt(--pos, getter_AddRefs(prev));
             if (prev) {
                 nsresult rv = CallQueryInterface(prev, aPreviousSibling);
                 NS_ASSERTION(*aPreviousSibling, "not a DOM node");
@@ -846,7 +845,7 @@ nsXULElement::GetNextSibling(nsIDOMNode** aNextSibling)
         mParent->IndexOf(NS_STATIC_CAST(nsIStyledContent*, this), pos);
         if (pos > -1) {
             nsCOMPtr<nsIContent> next;
-            mParent->ChildAt(++pos, *getter_AddRefs(next));
+            mParent->ChildAt(++pos, getter_AddRefs(next));
             if (next) {
                 nsresult res = CallQueryInterface(next, aNextSibling);
                 NS_ASSERTION(*aNextSibling, "not a DOM Node");
@@ -901,7 +900,7 @@ nsXULElement::GetOwnerDocument(nsIDOMDocument** aOwnerDocument)
         return CallQueryInterface(mDocument, aOwnerDocument);
     }
     nsCOMPtr<nsIDocument> doc;
-    NodeInfo()->GetDocument(*getter_AddRefs(doc));
+    NodeInfo()->GetDocument(getter_AddRefs(doc));
     if (doc) {
         return CallQueryInterface(doc, aOwnerDocument);
     }
@@ -929,7 +928,7 @@ nsXULElement::SetPrefix(const nsAString& aPrefix)
 {
     // XXX: Validate the prefix string!
 
-    nsINodeInfo *newNodeInfo = nsnull;
+    nsCOMPtr<nsINodeInfo> newNodeInfo;
     nsCOMPtr<nsIAtom> prefix;
 
     if (!aPrefix.IsEmpty() && !DOMStringIsNull(aPrefix)) {
@@ -940,7 +939,8 @@ nsXULElement::SetPrefix(const nsAString& aPrefix)
     nsresult rv = EnsureSlots();
     NS_ENSURE_SUCCESS(rv, rv);
 
-    rv = mSlots->mNodeInfo->PrefixChanged(prefix, newNodeInfo);
+    rv = mSlots->mNodeInfo->PrefixChanged(prefix,
+                                          getter_AddRefs(newNodeInfo));
     NS_ENSURE_SUCCESS(rv, rv);
 
     NS_ASSERTION(newNodeInfo, "trying to assign null nodeinfo!");
@@ -984,7 +984,7 @@ nsXULElement::InsertBefore(nsIDOMNode* aNewChild, nsIDOMNode* aRefChild,
     // First, check to see if the content was already parented
     // somewhere. If so, remove it.
     nsCOMPtr<nsIContent> oldparent;
-    rv = newcontent->GetParent(*getter_AddRefs(oldparent));
+    rv = newcontent->GetParent(getter_AddRefs(oldparent));
     if (NS_FAILED(rv)) return rv;
 
     if (oldparent) {
@@ -1258,10 +1258,10 @@ nsXULElement::GetTagName(nsAString& aTagName)
 }
 
 NS_IMETHODIMP
-nsXULElement::GetNodeInfo(nsINodeInfo*& aResult) const
+nsXULElement::GetNodeInfo(nsINodeInfo** aResult) const
 {
-    aResult = NodeInfo();
-    NS_IF_ADDREF(aResult);
+    *aResult = NodeInfo();
+    NS_IF_ADDREF(*aResult);
 
     return NS_OK;
 }
@@ -1270,19 +1270,16 @@ NS_IMETHODIMP
 nsXULElement::GetAttribute(const nsAString& aName,
                            nsAString& aReturn)
 {
-    nsresult rv;
-    PRInt32 nameSpaceID;
-    nsCOMPtr<nsIAtom> nameAtom;
     nsCOMPtr<nsINodeInfo> nodeInfo;
-
-    if (NS_FAILED(rv = NormalizeAttrString(aName,
-                                           *getter_AddRefs(nodeInfo)))) {
+    nsresult rv = NormalizeAttrString(aName,
+                                      getter_AddRefs(nodeInfo));
+    if (NS_FAILED(rv)) {
         NS_WARNING("unable to normalize attribute name");
         return rv;
     }
 
-    nodeInfo->GetNameAtom(*getter_AddRefs(nameAtom));
-    nodeInfo->GetNamespaceID(nameSpaceID);
+    nsCOMPtr<nsIAtom> nameAtom = nodeInfo->GetNameAtom();
+    PRInt32 nameSpaceID = nodeInfo->GetNamespaceID();
 
     GetAttr(nameSpaceID, nameAtom, aReturn);
     return NS_OK;
@@ -1297,7 +1294,7 @@ nsXULElement::SetAttribute(const nsAString& aName,
 
     nsCOMPtr<nsINodeInfo> ni;
 
-    rv = NormalizeAttrString(aName, *getter_AddRefs(ni));
+    rv = NormalizeAttrString(aName, getter_AddRefs(ni));
     NS_ASSERTION(NS_SUCCEEDED(rv), "unable to normalize attribute name");
 
     if (NS_SUCCEEDED(rv)) {
@@ -1312,18 +1309,14 @@ nsXULElement::SetAttribute(const nsAString& aName,
 NS_IMETHODIMP
 nsXULElement::RemoveAttribute(const nsAString& aName)
 {
-    nsresult rv;
-
-    PRInt32 nameSpaceID;
-    nsCOMPtr<nsIAtom> tag;
     nsCOMPtr<nsINodeInfo> ni;
 
-    rv = NormalizeAttrString(aName, *getter_AddRefs(ni));
+    nsresult rv = NormalizeAttrString(aName, getter_AddRefs(ni));
     NS_ASSERTION(NS_SUCCEEDED(rv), "unable to parse attribute name");
 
     if (NS_SUCCEEDED(rv)) {
-        ni->GetNameAtom(*getter_AddRefs(tag));
-        ni->GetNamespaceID(nameSpaceID);
+        nsCOMPtr<nsIAtom> tag = ni->GetNameAtom();
+        PRInt32 nameSpaceID = ni->GetNamespaceID();
 
         rv = UnsetAttr(nameSpaceID, tag, PR_TRUE);
         NS_ASSERTION(NS_SUCCEEDED(rv), "unable to remove attribute");
@@ -1415,7 +1408,7 @@ nsXULElement::GetAttributeNS(const nsAString& aNamespaceURI,
     PRInt32 nsid;
 
     nsContentUtils::GetNSManagerWeakRef()->GetNameSpaceID(aNamespaceURI,
-                                                          nsid);
+                                                          &nsid);
 
     if (nsid == kNameSpaceID_Unknown) {
         // Unkonwn namespace means no attr...
@@ -1435,11 +1428,11 @@ nsXULElement::SetAttributeNS(const nsAString& aNamespaceURI,
                              const nsAString& aValue)
 {
     nsCOMPtr<nsINodeInfoManager> nimgr;
-    nsresult rv = NodeInfo()->GetNodeInfoManager(*getter_AddRefs(nimgr));
+    nsresult rv = NodeInfo()->GetNodeInfoManager(getter_AddRefs(nimgr));
     NS_ENSURE_SUCCESS(rv, rv);
 
     nsCOMPtr<nsINodeInfo> ni;
-    rv = nimgr->GetNodeInfo(aQualifiedName, aNamespaceURI, *getter_AddRefs(ni));
+    rv = nimgr->GetNodeInfo(aQualifiedName, aNamespaceURI, getter_AddRefs(ni));
     NS_ENSURE_SUCCESS(rv, rv);
 
     return SetAttr(ni, aValue, PR_TRUE);
@@ -1453,7 +1446,7 @@ nsXULElement::RemoveAttributeNS(const nsAString& aNamespaceURI,
     nsCOMPtr<nsIAtom> tag = do_GetAtom(aLocalName);
 
     nsContentUtils::GetNSManagerWeakRef()->GetNameSpaceID(aNamespaceURI,
-                                                          nameSpaceId);
+                                                          &nameSpaceId);
 
     return UnsetAttr(nameSpaceId, tag, PR_TRUE);
 }
@@ -1506,7 +1499,7 @@ nsXULElement::GetElementsByTagNameNS(const nsAString& aNamespaceURI,
 
     if (!aNamespaceURI.Equals(NS_LITERAL_STRING("*"))) {
         nsContentUtils::GetNSManagerWeakRef()->GetNameSpaceID(aNamespaceURI,
-                                                              nameSpaceId);
+                                                              &nameSpaceId);
 
         if (nameSpaceId == kNameSpaceID_Unknown) {
             // Unknown namespace means no matches, we create an empty list...
@@ -1530,15 +1523,13 @@ nsXULElement::HasAttribute(const nsAString& aName, PRBool* aReturn)
 {
   NS_ENSURE_ARG_POINTER(aReturn);
 
-  nsCOMPtr<nsIAtom> name;
   nsCOMPtr<nsINodeInfo> ni;
-  PRInt32 nsid;
 
-  nsresult rv = NormalizeAttrString(aName, *getter_AddRefs(ni));
+  nsresult rv = NormalizeAttrString(aName, getter_AddRefs(ni));
   NS_ENSURE_SUCCESS(rv, rv);
 
-  ni->GetNameAtom(*getter_AddRefs(name));
-  ni->GetNamespaceID(nsid);
+  nsCOMPtr<nsIAtom> name = ni->GetNameAtom();
+  PRInt32 nsid = ni->GetNamespaceID();
 
   *aReturn = HasAttr(nsid, name);
   return NS_OK;
@@ -1554,7 +1545,7 @@ nsXULElement::HasAttributeNS(const nsAString& aNamespaceURI,
     nsCOMPtr<nsIAtom> name = do_GetAtom(aLocalName);
     PRInt32 nsid;
 
-    nsContentUtils::GetNSManagerWeakRef()->GetNameSpaceID(aNamespaceURI, nsid);
+    nsContentUtils::GetNSManagerWeakRef()->GetNameSpaceID(aNamespaceURI, &nsid);
 
     if (nsid == kNameSpaceID_Unknown) {
         // Unkonwn namespace means no attr...
@@ -1605,9 +1596,9 @@ nsXULElement::GetXMLBaseURI(nsIURI **aURI)
 {
   // XXX TODO, should share the impl with nsXMLElement
   NS_ENSURE_ARG_POINTER(aURI);
-  *aURI=nsnull;
+  *aURI = nsnull;
   if (mDocument) {
-    mDocument->GetBaseURL(*aURI);
+    mDocument->GetBaseURL(aURI);
     if (!*aURI) {
       mDocument->GetDocumentURL(aURI);
     }
@@ -1848,10 +1839,10 @@ nsXULElement::CompileEventHandler(nsIScriptContext* aContext,
 //
 
 NS_IMETHODIMP
-nsXULElement::GetDocument(nsIDocument*& aResult) const
+nsXULElement::GetDocument(nsIDocument** aResult) const
 {
-    aResult = mDocument;
-    NS_IF_ADDREF(aResult);
+    *aResult = mDocument;
+    NS_IF_ADDREF(*aResult);
     return NS_OK;
 }
 
@@ -1862,12 +1853,10 @@ nsXULElement::AddListenerFor(nsINodeInfo *aNodeInfo,
     // If appropriate, add a popup listener and/or compile the event
     // handler. Called when we change the element's document, create a
     // new element, change an attribute's value, etc.
-    PRInt32 nameSpaceID;
-    aNodeInfo->GetNamespaceID(nameSpaceID);
+    PRInt32 nameSpaceID = aNodeInfo->GetNamespaceID();
 
     if (nameSpaceID == kNameSpaceID_None) {
-        nsCOMPtr<nsIAtom> attr;
-        aNodeInfo->GetNameAtom(*getter_AddRefs(attr));
+        nsCOMPtr<nsIAtom> attr = aNodeInfo->GetNameAtom();
 
         if (attr == nsXULAtoms::menu ||
             attr == nsXULAtoms::contextmenu ||
@@ -1987,10 +1976,10 @@ nsXULElement::SetDocument(nsIDocument* aDocument, PRBool aDeep, PRBool aCompileE
 }
 
 NS_IMETHODIMP
-nsXULElement::GetParent(nsIContent*& aResult) const
+nsXULElement::GetParent(nsIContent** aResult) const
 {
-    aResult = mParent;
-    NS_IF_ADDREF(aResult);
+    *aResult = mParent;
+    NS_IF_ADDREF(*aResult);
     return NS_OK;
 }
 
@@ -2041,17 +2030,17 @@ nsXULElement::ChildCount(PRInt32& aResult) const
 }
 
 NS_IMETHODIMP
-nsXULElement::ChildAt(PRInt32 aIndex, nsIContent*& aResult) const
+nsXULElement::ChildAt(PRInt32 aIndex, nsIContent** aResult) const
 {
     nsresult rv;
     if (NS_FAILED(rv = EnsureContentsGenerated())) {
-        aResult = nsnull;
+        *aResult = nsnull;
         return rv;
     }
 
     nsIContent* content = NS_STATIC_CAST(nsIContent*, mChildren.SafeElementAt(aIndex));
-    aResult = content;
-    NS_IF_ADDREF(aResult);
+    *aResult = content;
+    NS_IF_ADDREF(*aResult);
 
     return NS_OK;
 }
@@ -2234,7 +2223,7 @@ nsXULElement::RemoveChildAt(PRInt32 aIndex, PRBool aNotify)
     // anything else = index to re-set as current
     PRInt32 newCurrentIndex = -1;
 
-    oldKid->GetTag(*getter_AddRefs(tag));
+    oldKid->GetTag(getter_AddRefs(tag));
     if (tag == nsXULAtoms::listitem) {
       // This is the nasty case. We have (potentially) a slew of selected items
       // and cells going away.
@@ -2337,20 +2326,25 @@ nsXULElement::RemoveChildAt(PRInt32 aIndex, PRBool aNotify)
 }
 
 NS_IMETHODIMP
-nsXULElement::GetNameSpaceID(PRInt32& aNameSpaceID) const
+nsXULElement::GetNameSpaceID(PRInt32* aNameSpaceID) const
 {
-    return NodeInfo()->GetNamespaceID(aNameSpaceID);
+    *aNameSpaceID = NodeInfo()->GetNamespaceID();
+
+    return NS_OK;
 }
 
 NS_IMETHODIMP
-nsXULElement::GetTag(nsIAtom*& aResult) const
+nsXULElement::GetTag(nsIAtom** aResult) const
 {
-    return NodeInfo()->GetNameAtom(aResult);
+    // AddRefs
+    *aResult = NodeInfo()->GetNameAtom().get();
+
+    return NS_OK;
 }
 
 NS_IMETHODIMP
 nsXULElement::NormalizeAttrString(const nsAString& aStr,
-                                  nsINodeInfo*& aNodeInfo)
+                                  nsINodeInfo** aNodeInfo)
 {
     PRInt32 i, count = Attributes() ? Attributes()->Count() : 0;
     NS_ConvertUCS2toUTF8 utf8String(aStr);
@@ -2360,8 +2354,8 @@ nsXULElement::NormalizeAttrString(const nsAString& aStr,
                                                    Attributes()->ElementAt(i));
         nsINodeInfo *ni = attr->GetNodeInfo();
         if (ni->QualifiedNameEquals(utf8String)) {
-            aNodeInfo = ni;
-            NS_ADDREF(aNodeInfo);
+            *aNodeInfo = ni;
+            NS_ADDREF(*aNodeInfo);
 
             return NS_OK;
         }
@@ -2373,15 +2367,15 @@ nsXULElement::NormalizeAttrString(const nsAString& aStr,
 
         nsINodeInfo *ni = attr->mNodeInfo;
         if (ni->QualifiedNameEquals(utf8String)) {
-            aNodeInfo = ni;
-            NS_ADDREF(aNodeInfo);
+            *aNodeInfo = ni;
+            NS_ADDREF(*aNodeInfo);
 
             return NS_OK;
         }
     }
 
     nsCOMPtr<nsINodeInfoManager> nimgr;
-    NodeInfo()->GetNodeInfoManager(*getter_AddRefs(nimgr));
+    NodeInfo()->GetNodeInfoManager(getter_AddRefs(nimgr));
     NS_ENSURE_TRUE(nimgr, NS_ERROR_FAILURE);
 
     return nimgr->GetNodeInfo(aStr, nsnull, kNameSpaceID_None, aNodeInfo);
@@ -2401,7 +2395,7 @@ nsXULElement::UnregisterAccessKey(const nsAString& aOldValue)
 
             // find out what type of content node this is
             nsCOMPtr<nsIAtom> atom;
-            nsresult rv = GetTag(*getter_AddRefs(atom));
+            nsresult rv = GetTag(getter_AddRefs(atom));
             if (NS_SUCCEEDED(rv) && atom) {
                 if (atom == nsXULAtoms::label) {
                     // XXXjag a side-effect is that we filter out anonymous <label>s
@@ -2439,12 +2433,8 @@ nsXULElement::SetAttr(nsINodeInfo* aNodeInfo,
     if (nsnull == aNodeInfo)
         return NS_ERROR_NULL_POINTER;
 
-    nsresult rv;
-    nsCOMPtr<nsIAtom> attrName;
-    PRInt32 attrns;
-
-    aNodeInfo->GetNameAtom(*getter_AddRefs(attrName));
-    aNodeInfo->GetNamespaceID(attrns);
+    nsCOMPtr<nsIAtom> attrName = aNodeInfo->GetNameAtom();
+    PRInt32 attrns = aNodeInfo->GetNamespaceID();
 
     // XXXwaterson should likely also be conditioned on aNotify. Do we
     // need to BeginUpdate() here as well?
@@ -2452,7 +2442,7 @@ nsXULElement::SetAttr(nsINodeInfo* aNodeInfo,
         mDocument->AttributeWillChange(this, attrns, attrName);
     }
 
-    rv = EnsureAttributes();
+    nsresult rv = EnsureAttributes();
     if (NS_FAILED(rv)) return rv;
 
     // XXX Class and Style attribute setting should be checking for the XUL namespace!
@@ -2469,13 +2459,13 @@ nsXULElement::SetAttr(nsINodeInfo* aNodeInfo,
     if (aNodeInfo->Equals(nsXULAtoms::style, kNameSpaceID_None) &&
         (mDocument != nsnull)) {
         nsCOMPtr <nsIURI> docURL;
-        mDocument->GetBaseURL(*getter_AddRefs(docURL));
+        mDocument->GetBaseURL(getter_AddRefs(docURL));
         Attributes()->UpdateStyleRule(docURL, aValue);
         // XXX Some kind of special document update might need to happen here.
     }
 
     nsCOMPtr<nsIAtom> tag;
-    GetTag(*getter_AddRefs(tag));
+    GetTag(getter_AddRefs(tag));
 
     if (tag == nsXULAtoms::window &&
         aNodeInfo->Equals(nsXULAtoms::hidechrome)) {
@@ -2582,11 +2572,11 @@ nsXULElement::SetAttr(PRInt32 aNameSpaceID,
 {
     nsCOMPtr<nsINodeInfoManager> nimgr;
 
-    NodeInfo()->GetNodeInfoManager(*getter_AddRefs(nimgr));
+    NodeInfo()->GetNodeInfoManager(getter_AddRefs(nimgr));
     NS_ENSURE_TRUE(nimgr, NS_ERROR_FAILURE);
 
     nsCOMPtr<nsINodeInfo> ni;
-    nimgr->GetNodeInfo(aName, nsnull, aNameSpaceID, *getter_AddRefs(ni));
+    nimgr->GetNodeInfo(aName, nsnull, aNameSpaceID, getter_AddRefs(ni));
 
     return SetAttr(ni, aValue, aNotify);
 }
@@ -2597,13 +2587,13 @@ nsXULElement::GetAttr(PRInt32 aNameSpaceID,
                       nsAString& aResult) const
 {
     nsCOMPtr<nsIAtom> prefix;
-    return GetAttr(aNameSpaceID, aName, *getter_AddRefs(prefix), aResult);
+    return GetAttr(aNameSpaceID, aName, getter_AddRefs(prefix), aResult);
 }
 
 NS_IMETHODIMP
 nsXULElement::GetAttr(PRInt32 aNameSpaceID,
                       nsIAtom* aName,
-                      nsIAtom*& aPrefix,
+                      nsIAtom** aPrefix,
                       nsAString& aResult) const
 {
     NS_ASSERTION(nsnull != aName, "must have attribute name");
@@ -2621,7 +2611,8 @@ nsXULElement::GetAttr(PRInt32 aNameSpaceID,
 
                 nsINodeInfo *ni = attr->GetNodeInfo();
                 if (ni->Equals(aName, aNameSpaceID)) {
-                    ni->GetPrefixAtom(aPrefix);
+                    // AddRefs
+                    *aPrefix = ni->GetPrefixAtom().get();
                     attr->GetValue(aResult);
                     return aResult.IsEmpty() ? NS_CONTENT_ATTR_NO_VALUE : NS_CONTENT_ATTR_HAS_VALUE;
                 }
@@ -2636,7 +2627,8 @@ nsXULElement::GetAttr(PRInt32 aNameSpaceID,
 
             nsINodeInfo *ni = attr->mNodeInfo;
             if (ni->Equals(aName, aNameSpaceID)) {
-                ni->GetPrefixAtom(aPrefix);
+                // AddRefs
+                *aPrefix = ni->GetPrefixAtom().get();
                 attr->mValue.GetValue( aResult );
                 return aResult.IsEmpty() ? NS_CONTENT_ATTR_NO_VALUE : NS_CONTENT_ATTR_HAS_VALUE;
             }
@@ -2645,6 +2637,7 @@ nsXULElement::GetAttr(PRInt32 aNameSpaceID,
 
     // Not found.
     aResult.Truncate();
+    *aPrefix = nsnull;
     return NS_CONTENT_ATTR_NOT_THERE;
 }
 
@@ -2754,7 +2747,7 @@ nsXULElement::UnsetAttr(PRInt32 aNameSpaceID,
             Attributes()->UpdateClassList(nsAutoString());
         } else if (aName == nsXULAtoms::style) {
             nsCOMPtr <nsIURI> docURL;
-            mDocument->GetBaseURL(*getter_AddRefs(docURL));
+            mDocument->GetBaseURL(getter_AddRefs(docURL));
             Attributes()->UpdateStyleRule(docURL, nsAutoString());
             // XXX Some kind of special document update might need to happen here.
         }
@@ -2762,7 +2755,7 @@ nsXULElement::UnsetAttr(PRInt32 aNameSpaceID,
     }
 
     nsCOMPtr<nsIAtom> tag;
-    GetTag(*getter_AddRefs(tag));
+    GetTag(getter_AddRefs(tag));
 
     if (tag == nsXULAtoms::window &&
         aName == nsXULAtoms::hidechrome)
@@ -2848,9 +2841,9 @@ nsXULElement::UnsetAttr(PRInt32 aNameSpaceID,
 
 NS_IMETHODIMP
 nsXULElement::GetAttrNameAt(PRInt32 aIndex,
-                            PRInt32& aNameSpaceID,
-                            nsIAtom*& aName,
-                            nsIAtom*& aPrefix) const
+                            PRInt32* aNameSpaceID,
+                            nsIAtom** aName,
+                            nsIAtom** aPrefix) const
 {
 #ifdef DEBUG_ATTRIBUTE_STATS
     int local = Attributes() ? Attributes()->Count() : 0;
@@ -2863,10 +2856,12 @@ nsXULElement::GetAttrNameAt(PRInt32 aIndex,
         haveLocalAttributes = PR_TRUE;
         if (aIndex < Attributes()->Count()) {
             nsXULAttribute* attr = NS_REINTERPRET_CAST(nsXULAttribute*, Attributes()->ElementAt(aIndex));
-            if (nsnull != attr) {
-                attr->GetNodeInfo()->GetNamespaceID(aNameSpaceID);
-                attr->GetNodeInfo()->GetNameAtom(aName);
-                attr->GetNodeInfo()->GetPrefixAtom(aPrefix);
+            if (attr) {
+                *aNameSpaceID = attr->GetNodeInfo()->GetNamespaceID();
+                // AddRefs
+                *aName = attr->GetNodeInfo()->GetNameAtom().get();
+                // AddRefs
+                *aPrefix = attr->GetNodeInfo()->GetPrefixAtom().get();
 #ifdef DEBUG_ATTRIBUTE_STATS
                 fprintf(stderr, " local!\n");
 #endif
@@ -2895,9 +2890,13 @@ nsXULElement::GetAttrNameAt(PRInt32 aIndex,
 #ifdef DEBUG_ATTRIBUTE_STATS
                 fprintf(stderr, " proto[%d]!\n", aIndex);
 #endif
-                attr->mNodeInfo->GetNamespaceID(aNameSpaceID);
-                attr->mNodeInfo->GetNameAtom(aName);
-                attr->mNodeInfo->GetPrefixAtom(aPrefix);
+                *aNameSpaceID = attr->mNodeInfo->GetNamespaceID();
+
+                // AddRefs
+                *aName = attr->mNodeInfo->GetNameAtom().get();
+                // AddRefs
+                *aPrefix = attr->mNodeInfo->GetPrefixAtom().get();
+
                 return NS_OK;
             }
             // else, we are out of attrs to return, fall-through
@@ -2908,9 +2907,10 @@ nsXULElement::GetAttrNameAt(PRInt32 aIndex,
     fprintf(stderr, " not found\n");
 #endif
 
-    aNameSpaceID = kNameSpaceID_None;
-    aName = nsnull;
-    aPrefix = nsnull;
+    *aNameSpaceID = kNameSpaceID_None;
+    *aName = nsnull;
+    *aPrefix = nsnull;
+
     return NS_ERROR_ILLEGAL_VALUE;
 }
 
@@ -2995,7 +2995,8 @@ nsXULElement::List(FILE* out, PRInt32 aIndent) const
         nsCOMPtr<nsIAtom> attr;
         nsCOMPtr<nsIAtom> prefix;
         PRInt32 nameSpaceID;
-        GetAttrNameAt(i, nameSpaceID, *getter_AddRefs(attr), *getter_AddRefs(prefix));
+        GetAttrNameAt(i, &nameSpaceID, getter_AddRefs(attr),
+                      getter_AddRefs(prefix));
 
         nsAutoString v;
         GetAttr(nameSpaceID, attr, v);
@@ -3026,7 +3027,7 @@ nsXULElement::List(FILE* out, PRInt32 aIndent) const
 
         for (i = 0; i < nchildren; ++i) {
             nsCOMPtr<nsIContent> child;
-            ChildAt(i, *getter_AddRefs(child));
+            ChildAt(i, getter_AddRefs(child));
 
             child->List(out, aIndent + 1);
         }
@@ -3390,10 +3391,10 @@ nsXULElement::RangeRemove(nsIDOMRange* aRange)
 
 
 NS_IMETHODIMP
-nsXULElement::GetRangeList(nsVoidArray*& aResult) const
+nsXULElement::GetRangeList(nsVoidArray** aResult) const
 {
-    // rdf content does not yet support DOM ranges
-    aResult = nsnull;
+    // XUL content does not yet support DOM ranges
+    *aResult = nsnull;
     return NS_OK;
 }
 
@@ -3497,7 +3498,7 @@ nsXULElement::EnsureContentsGenerated(void) const
             }
 
             nsCOMPtr<nsIContent> parent;
-            element->GetParent(*getter_AddRefs(parent));
+            element->GetParent(getter_AddRefs(parent));
 
             element = parent;
         } while (element);
@@ -3570,7 +3571,7 @@ nsXULElement::GetElementsByAttribute(nsIDOMNode* aNode,
 
 // nsIStyledContent Implementation
 NS_IMETHODIMP
-nsXULElement::GetID(nsIAtom*& aResult) const
+nsXULElement::GetID(nsIAtom** aResult) const
 {
     if (mSlots) {
         nsXULAttributes *attrs = mSlots->GetAttributes();
@@ -3583,7 +3584,7 @@ nsXULElement::GetID(nsIAtom*& aResult) const
                     NS_STATIC_CAST(nsXULAttribute*, attrs->ElementAt(i));
 
                 if (attr->GetNodeInfo()->Equals(nsXULAtoms::id, kNameSpaceID_None)) {
-                    attr->GetValueAsAtom(&aResult);
+                    attr->GetValueAsAtom(aResult);
                     return NS_OK;
                 }
             }
@@ -3595,13 +3596,13 @@ nsXULElement::GetID(nsIAtom*& aResult) const
         for (PRInt32 i = 0; i < count; i++) {
             nsXULPrototypeAttribute* attr = &(mPrototype->mAttributes[i]);
             if (attr->mNodeInfo->Equals(nsXULAtoms::id, kNameSpaceID_None)) {
-                attr->mValue.GetValueAsAtom(&aResult);
+                attr->mValue.GetValueAsAtom(aResult);
                 return NS_OK;
             }
         }
     }
 
-    aResult = nsnull;
+    *aResult = nsnull;
     return NS_OK;
 }
 
@@ -3667,7 +3668,7 @@ nsXULElement::GetMappedAttributeImpact(const nsIAtom* aAttribute, PRInt32 aModTy
     if (aAttribute == nsXULAtoms::value &&
         (aModType == nsIDOMMutationEvent::REMOVAL || aModType == nsIDOMMutationEvent::ADDITION)) {
       nsCOMPtr<nsIAtom> tag;
-      GetTag(*getter_AddRefs(tag));
+      GetTag(getter_AddRefs(tag));
       if (tag == nsXULAtoms::label || tag == nsXULAtoms::description)
         // Label and description dynamically morph between a normal block and a cropping single-line
         // XUL text frame.  If the value attribute is being added or removed, then we need to return
@@ -4187,10 +4188,10 @@ NS_IMETHODIMP
 nsXULElement::GetParentTree(nsIDOMXULMultiSelectControlElement** aTreeElement)
 {
   nsCOMPtr<nsIContent> current;
-  GetParent(*getter_AddRefs(current));
+  GetParent(getter_AddRefs(current));
   while (current) {
     nsCOMPtr<nsIAtom> tag;
-    current->GetTag(*getter_AddRefs(tag));
+    current->GetTag(getter_AddRefs(tag));
     if (tag == nsXULAtoms::listbox) {
       nsCOMPtr<nsIDOMXULMultiSelectControlElement> element = do_QueryInterface(current);
       *aTreeElement = element;
@@ -4199,7 +4200,7 @@ nsXULElement::GetParentTree(nsIDOMXULMultiSelectControlElement** aTreeElement)
     }
 
     nsCOMPtr<nsIContent> parent;
-    current->GetParent(*getter_AddRefs(parent));
+    current->GetParent(getter_AddRefs(parent));
     current = parent;
   }
   return NS_OK;
@@ -4275,7 +4276,7 @@ nsXULElement::Click()
     return NS_OK;
 
   nsCOMPtr<nsIDocument> doc; // Strong
-  GetDocument(*getter_AddRefs(doc));
+  GetDocument(getter_AddRefs(doc));
   if (doc) {
     PRInt32 numShells = doc->GetNumberOfShells();
     nsCOMPtr<nsIPresShell> shell; // Strong
@@ -4322,7 +4323,7 @@ NS_IMETHODIMP
 nsXULElement::DoCommand()
 {
   nsCOMPtr<nsIDocument> doc;
-  GetDocument(*getter_AddRefs(doc));
+  GetDocument(getter_AddRefs(doc));
   if (doc) {
     PRInt32 numShells = doc->GetNumberOfShells();
     nsCOMPtr<nsIPresShell> shell;
@@ -4386,7 +4387,7 @@ nsXULElement::SetBindingParent(nsIContent* aParent)
     ChildCount(count);
     for (PRInt32 i = 0; i < count; i++) {
       nsCOMPtr<nsIContent> child;
-      ChildAt(i, *getter_AddRefs(child));
+      ChildAt(i, getter_AddRefs(child));
       child->SetBindingParent(aParent);
     }
   }
diff --git a/content/xul/content/src/nsXULElement.h b/content/xul/content/src/nsXULElement.h
index 041746e4dcdf..f3528b861efc 100644
--- a/content/xul/content/src/nsXULElement.h
+++ b/content/xul/content/src/nsXULElement.h
@@ -406,15 +406,15 @@ public:
     NS_DECL_ISUPPORTS
 
     // nsIContent (from nsIStyledContent)
-    NS_IMETHOD GetDocument(nsIDocument*& aResult) const;
+    NS_IMETHOD GetDocument(nsIDocument** aResult) const;
     NS_IMETHOD SetDocument(nsIDocument* aDocument, PRBool aDeep, PRBool aCompileEventHandlers);
-    NS_IMETHOD GetParent(nsIContent*& aResult) const;
+    NS_IMETHOD GetParent(nsIContent** aResult) const;
     NS_IMETHOD SetParent(nsIContent* aParent);
     NS_IMETHOD_(PRBool) IsNativeAnonymous() const;
     NS_IMETHOD_(void) SetNativeAnonymous(PRBool aAnonymous);
     NS_IMETHOD CanContainChildren(PRBool& aResult) const;
     NS_IMETHOD ChildCount(PRInt32& aResult) const;
-    NS_IMETHOD ChildAt(PRInt32 aIndex, nsIContent*& aResult) const;
+    NS_IMETHOD ChildAt(PRInt32 aIndex, nsIContent** aResult) const;
     NS_IMETHOD IndexOf(nsIContent* aPossibleChild, PRInt32& aResult) const;
     NS_IMETHOD InsertChildAt(nsIContent* aKid, PRInt32 aIndex, PRBool aNotify,
                              PRBool aDeepSetDocument);
@@ -423,18 +423,18 @@ public:
     NS_IMETHOD AppendChildTo(nsIContent* aKid, PRBool aNotify,
                              PRBool aDeepSetDocument);
     NS_IMETHOD RemoveChildAt(PRInt32 aIndex, PRBool aNotify);
-    NS_IMETHOD GetNameSpaceID(PRInt32& aNameSpeceID) const;
-    NS_IMETHOD GetTag(nsIAtom*& aResult) const;
-    NS_IMETHOD GetNodeInfo(nsINodeInfo*& aResult) const;
-    NS_IMETHOD NormalizeAttrString(const nsAString& aStr, nsINodeInfo*& aNodeInfo);
+    NS_IMETHOD GetNameSpaceID(PRInt32* aNameSpeceID) const;
+    NS_IMETHOD GetTag(nsIAtom** aResult) const;
+    NS_IMETHOD GetNodeInfo(nsINodeInfo** aResult) const;
+    NS_IMETHOD NormalizeAttrString(const nsAString& aStr, nsINodeInfo** aNodeInfo);
     NS_IMETHOD SetAttr(PRInt32 aNameSpaceID, nsIAtom* aName, const nsAString& aValue, PRBool aNotify);
     NS_IMETHOD SetAttr(nsINodeInfo *aNodeInfo, const nsAString& aValue, PRBool aNotify);
     NS_IMETHOD GetAttr(PRInt32 aNameSpaceID, nsIAtom* aName, nsAString& aResult) const;
-    NS_IMETHOD GetAttr(PRInt32 aNameSpaceID, nsIAtom* aName, nsIAtom*& aPrefix, nsAString& aResult) const;
+    NS_IMETHOD GetAttr(PRInt32 aNameSpaceID, nsIAtom* aName, nsIAtom** aPrefix, nsAString& aResult) const;
     NS_IMETHOD_(PRBool) HasAttr(PRInt32 aNameSpaceID, nsIAtom* aName) const;
     NS_IMETHOD UnsetAttr(PRInt32 aNameSpaceID, nsIAtom* aName, PRBool aNotify);
-    NS_IMETHOD GetAttrNameAt(PRInt32 aIndex, PRInt32& aNameSpaceID,
-                             nsIAtom*& aName, nsIAtom*& aPrefix) const;
+    NS_IMETHOD GetAttrNameAt(PRInt32 aIndex, PRInt32* aNameSpaceID,
+                             nsIAtom** aName, nsIAtom** aPrefix) const;
     NS_IMETHOD GetAttrCount(PRInt32& aResult) const;
 #ifdef DEBUG
     NS_IMETHOD List(FILE* out, PRInt32 aIndent) const;
@@ -452,7 +452,7 @@ public:
 
     NS_IMETHOD RangeAdd(nsIDOMRange* aRange);
     NS_IMETHOD RangeRemove(nsIDOMRange* aRange);
-    NS_IMETHOD GetRangeList(nsVoidArray*& aResult) const;
+    NS_IMETHOD GetRangeList(nsVoidArray** aResult) const;
     NS_IMETHOD SetFocus(nsIPresContext* aPresContext);
     NS_IMETHOD RemoveFocus(nsIPresContext* aPresContext);
 
@@ -466,7 +466,7 @@ public:
     NS_IMETHOD GetXMLBaseURI(nsIURI **aURI);
 
     // nsIStyledContent
-    NS_IMETHOD GetID(nsIAtom*& aResult) const;
+    NS_IMETHOD GetID(nsIAtom** aResult) const;
     NS_IMETHOD GetClasses(nsVoidArray& aArray) const;
     NS_IMETHOD_(PRBool) HasClass(nsIAtom* aClass, PRBool aCaseSensitive) const;
 
diff --git a/content/xul/content/src/nsXULPopupListener.cpp b/content/xul/content/src/nsXULPopupListener.cpp
index a7537e8df4fa..57514db0ca7c 100644
--- a/content/xul/content/src/nsXULPopupListener.cpp
+++ b/content/xul/content/src/nsXULPopupListener.cpp
@@ -239,7 +239,7 @@ XULPopupListenerImpl::PreLaunchPopup(nsIDOMEvent* aMouseEvent)
   if (popupType == eXULPopupType_popup) {
     nsCOMPtr<nsIContent> targetContent = do_QueryInterface(target);
     nsCOMPtr<nsIAtom> tag;
-    targetContent->GetTag(*getter_AddRefs(tag));
+    targetContent->GetTag(getter_AddRefs(tag));
     if (tag && (tag.get() == nsXULAtoms::menu || tag.get() == nsXULAtoms::menuitem))
       return NS_OK;
   }
@@ -248,7 +248,7 @@ XULPopupListenerImpl::PreLaunchPopup(nsIDOMEvent* aMouseEvent)
   nsCOMPtr<nsIDocument> document;
   nsCOMPtr<nsIContent> content = do_QueryInterface(mElement);
   nsresult rv;
-  if (NS_FAILED(rv = content->GetDocument(*getter_AddRefs(document)))) {
+  if (NS_FAILED(rv = content->GetDocument(getter_AddRefs(document)))) {
     NS_ERROR("Unable to retrieve the document.");
     return rv;
   }
@@ -412,9 +412,9 @@ GetImmediateChild(nsIContent* aContent, nsIAtom *aTag, nsIContent** aResult)
   aContent->ChildCount(childCount);
   for (PRInt32 i = 0; i < childCount; i++) {
     nsCOMPtr<nsIContent> child;
-    aContent->ChildAt(i, *getter_AddRefs(child));
+    aContent->ChildAt(i, getter_AddRefs(child));
     nsCOMPtr<nsIAtom> tag;
-    child->GetTag(*getter_AddRefs(tag));
+    child->GetTag(getter_AddRefs(tag));
     if (aTag == tag.get()) {
       *aResult = child;
       NS_ADDREF(*aResult);
@@ -514,7 +514,7 @@ XULPopupListenerImpl::LaunchPopup(PRInt32 aClientX, PRInt32 aClientY)
   // Try to find the popup content and the document.
   nsCOMPtr<nsIDocument> document;
   nsCOMPtr<nsIContent> content = do_QueryInterface(mElement);
-  if (NS_FAILED(rv = content->GetDocument(*getter_AddRefs(document)))) {
+  if (NS_FAILED(rv = content->GetDocument(getter_AddRefs(document)))) {
     NS_ERROR("Unable to retrieve the document.");
     return rv;
   }
@@ -549,7 +549,7 @@ XULPopupListenerImpl::LaunchPopup(PRInt32 aClientX, PRInt32 aClientY)
           list->Item(ctr, getter_AddRefs(node));
           nsCOMPtr<nsIContent> childContent(do_QueryInterface(node));
           nsCOMPtr<nsIAtom> childTag;
-          childContent->GetTag(*getter_AddRefs(childTag));
+          childContent->GetTag(getter_AddRefs(childTag));
           if (childTag.get() == tag) {
             popupContent = do_QueryInterface(childContent);
             break;
diff --git a/content/xul/document/src/nsElementMap.cpp b/content/xul/document/src/nsElementMap.cpp
index 5d12d594dd57..b9582089c05e 100644
--- a/content/xul/document/src/nsElementMap.cpp
+++ b/content/xul/document/src/nsElementMap.cpp
@@ -202,7 +202,7 @@ nsElementMap::Add(const nsAString& aID, nsIContent* aContent)
                     nsresult rv;
 
                     nsCOMPtr<nsIAtom> tag;
-                    rv = aContent->GetTag(*getter_AddRefs(tag));
+                    rv = aContent->GetTag(getter_AddRefs(tag));
                     if (NS_FAILED(rv)) return rv;
 
                     nsAutoString tagname;
@@ -239,7 +239,7 @@ nsElementMap::Add(const nsAString& aID, nsIContent* aContent)
         nsresult rv;
 
         nsCOMPtr<nsIAtom> tag;
-        rv = aContent->GetTag(*getter_AddRefs(tag));
+        rv = aContent->GetTag(getter_AddRefs(tag));
         if (NS_FAILED(rv)) return rv;
 
         nsAutoString tagname;
@@ -277,7 +277,7 @@ nsElementMap::Remove(const nsAString& aID, nsIContent* aContent)
         nsresult rv;
 
         nsCOMPtr<nsIAtom> tag;
-        rv = aContent->GetTag(*getter_AddRefs(tag));
+        rv = aContent->GetTag(getter_AddRefs(tag));
         if (NS_FAILED(rv)) return rv;
 
         nsAutoString tagname;
diff --git a/content/xul/document/src/nsXULCommandDispatcher.cpp b/content/xul/document/src/nsXULCommandDispatcher.cpp
index e34a53852d85..73198f005297 100644
--- a/content/xul/document/src/nsXULCommandDispatcher.cpp
+++ b/content/xul/document/src/nsXULCommandDispatcher.cpp
@@ -352,7 +352,7 @@ nsXULCommandDispatcher::UpdateCommands(const nsAString& aEventName)
       return NS_ERROR_UNEXPECTED;
 
     nsCOMPtr<nsIDocument> document;
-    rv = content->GetDocument(*getter_AddRefs(document));
+    rv = content->GetDocument(getter_AddRefs(document));
     NS_ASSERTION(NS_SUCCEEDED(rv), "unable to get document");
     if (NS_FAILED(rv)) return rv;
 
diff --git a/content/xul/document/src/nsXULContentSink.cpp b/content/xul/document/src/nsXULContentSink.cpp
index 01a5df36275d..7f884612ffba 100644
--- a/content/xul/document/src/nsXULContentSink.cpp
+++ b/content/xul/document/src/nsXULContentSink.cpp
@@ -156,7 +156,7 @@ protected:
     nsresult PushNameSpacesFrom(const PRUnichar** aAttributes);
 
     // RDF-specific parsing
-    nsresult ParseTag(const PRUnichar* aText, nsINodeInfo*& aNodeInfo);
+    nsresult ParseTag(const PRUnichar* aText, nsINodeInfo** aNodeInfo);
     nsresult AddAttributes(const PRUnichar** aAttributes, 
                            const PRUint32 aAttrLen, 
                            nsXULPrototypeElement* aElement);
@@ -191,7 +191,7 @@ protected:
     
     
     nsresult NormalizeAttributeString(const nsAFlatString& aText,
-                                      nsINodeInfo*& aNodeInfo);
+                                      nsINodeInfo** aNodeInfo);
     nsresult CreateElement(nsINodeInfo *aNodeInfo, nsXULPrototypeElement** aResult);
 
     // Style sheets
@@ -367,7 +367,7 @@ XULContentSinkImpl::~XULContentSinkImpl()
                 nsCOMPtr<nsIAtom> prefixAtom;
 
                 nameSpace->GetNameSpaceURI(uri);
-                nameSpace->GetNameSpacePrefix(*getter_AddRefs(prefixAtom));
+                nameSpace->GetNameSpacePrefix(getter_AddRefs(prefixAtom));
 
                 nsAutoString prefix;
                 if (prefixAtom)
@@ -703,7 +703,7 @@ XULContentSinkImpl::FlushText(PRBool aCreateTextNode)
 
 nsresult
 XULContentSinkImpl::NormalizeAttributeString(const nsAFlatString& aText,
-                                             nsINodeInfo*& aNodeInfo)
+                                             nsINodeInfo** aNodeInfo)
 {
     PRInt32 nameSpaceID = kNameSpaceID_None;
 
@@ -724,7 +724,7 @@ XULContentSinkImpl::NormalizeAttributeString(const nsAFlatString& aText,
         GetTopNameSpace(address_of(ns));
 
         if (ns) {
-            ns->FindNameSpaceID(prefix, nameSpaceID);
+            ns->FindNameSpaceID(prefix, &nameSpaceID);
 
             if (nameSpaceID == kNameSpaceID_Unknown) {
                 NS_WARNING("Undeclared prefix used in attribute name.");
@@ -806,7 +806,7 @@ XULContentSinkImpl::HandleStartElement(const PRUnichar *aName,
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCOMPtr<nsINodeInfo> nodeInfo;
-  rv = ParseTag(aName, *getter_AddRefs(nodeInfo));
+  rv = ParseTag(aName, getter_AddRefs(nodeInfo));
   if (NS_FAILED(rv)) {
      return rv;
   }
@@ -1125,7 +1125,8 @@ XULContentSinkImpl::PushNameSpacesFrom(const PRUnichar** aAttributes)
         nameSpace =
             (nsINameSpace*)mNameSpaceStack.ElementAt(mNameSpaceStack.Count() - 1);
     } else {
-        nsContentUtils::GetNSManagerWeakRef()->CreateRootNameSpace(*getter_AddRefs(nameSpace));
+        nsContentUtils::GetNSManagerWeakRef()->
+            CreateRootNameSpace(getter_AddRefs(nameSpace));
         if (! nameSpace)
             return NS_ERROR_OUT_OF_MEMORY;
     }
@@ -1171,7 +1172,7 @@ XULContentSinkImpl::PushNameSpacesFrom(const PRUnichar** aAttributes)
             nsCOMPtr<nsINameSpace> child;
             nsresult rv =
                 nameSpace->CreateChildNameSpace(prefixAtom, value,
-                                                *getter_AddRefs(child));
+                                                getter_AddRefs(child));
             NS_ENSURE_SUCCESS(rv, rv);
 
             nameSpace = child;
@@ -1215,7 +1216,7 @@ XULContentSinkImpl::GetTopNameSpace(nsCOMPtr<nsINameSpace>* aNameSpace)
 
 nsresult
 XULContentSinkImpl::ParseTag(const PRUnichar* aText, 
-                             nsINodeInfo*& aNodeInfo)
+                             nsINodeInfo** aNodeInfo)
 {
     // Split the tag into prefix and tag substrings.
 
@@ -1243,7 +1244,7 @@ XULContentSinkImpl::ParseTag(const PRUnichar* aText,
     PRInt32 namespaceID = kNameSpaceID_None;
 
     if (ns) {
-        ns->FindNameSpaceID(prefix, namespaceID);
+        ns->FindNameSpaceID(prefix, &namespaceID);
 
         if (namespaceID == kNameSpaceID_Unknown) {
             NS_WARNING("Undeclared prefix used in tag name!");
@@ -1503,7 +1504,7 @@ XULContentSinkImpl::AddAttributes(const PRUnichar** aAttributes,
   // Copy the attributes into the prototype
   for (; *aAttributes; aAttributes += 2) {
       rv = NormalizeAttributeString(nsDependentString(aAttributes[0]),
-                                    *getter_AddRefs(attrs->mNodeInfo));
+                                    getter_AddRefs(attrs->mNodeInfo));
 
       if (NS_FAILED(rv)) {
 #ifdef PR_LOGGING
diff --git a/content/xul/document/src/nsXULDocument.cpp b/content/xul/document/src/nsXULDocument.cpp
index ad2cb2c51ba2..14d31e805665 100644
--- a/content/xul/document/src/nsXULDocument.cpp
+++ b/content/xul/document/src/nsXULDocument.cpp
@@ -849,9 +849,9 @@ nsXULDocument::SynchronizeBroadcastListener(nsIDOMElement   *aBroadcaster,
             PRInt32 nameSpaceID;
             nsCOMPtr<nsIAtom> name;
             nsCOMPtr<nsIAtom> prefix;
-            broadcaster->GetAttrNameAt(count, nameSpaceID,
-                                       *getter_AddRefs(name),
-                                       *getter_AddRefs(prefix));
+            broadcaster->GetAttrNameAt(count, &nameSpaceID,
+                                       getter_AddRefs(name),
+                                       getter_AddRefs(prefix));
 
             // _Don't_ push the |id|, |ref|, or |persist| attribute's value!
             if (! CanBroadcast(nameSpaceID, name))
@@ -1038,10 +1038,10 @@ nsXULDocument::ExecuteOnBroadcastHandlerFor(nsIContent* aBroadcaster,
         // aBroadcaster, and an |attribute| element that tells us what
         // attriubtes we're listening for.
         nsCOMPtr<nsIContent> child;
-        listener->ChildAt(i, *getter_AddRefs(child));
+        listener->ChildAt(i, getter_AddRefs(child));
 
         nsCOMPtr<nsIAtom> tag;
-        child->GetTag(*getter_AddRefs(tag));
+        child->GetTag(getter_AddRefs(tag));
         if (tag != nsXULAtoms::observes)
             continue;
 
@@ -1189,7 +1189,7 @@ nsXULDocument::ContentAppended(nsIContent* aContainer,
 
     for (PRInt32 i = aNewIndexInContainer; i < count; ++i) {
         nsCOMPtr<nsIContent> child;
-        rv = aContainer->ChildAt(i, *getter_AddRefs(child));
+        rv = aContainer->ChildAt(i, getter_AddRefs(child));
         if (NS_FAILED(rv)) return rv;
 
         rv = AddSubtreeToDocument(child);
@@ -1478,7 +1478,7 @@ nsXULDocument::CreateElement(const nsAString& aTagName,
 
     // CreateElement in the XUL document defaults to the XUL namespace.
     mNodeInfoManager->GetNodeInfo(name, prefix, kNameSpaceID_XUL,
-                                  *getter_AddRefs(ni));
+                                  getter_AddRefs(ni));
 
     nsCOMPtr<nsIContent> result;
     rv = CreateElement(ni, getter_AddRefs(result));
@@ -1547,14 +1547,12 @@ nsXULDocument::Persist(const nsAString& aID,
     if (! element)
         return NS_ERROR_UNEXPECTED;
 
-    PRInt32 nameSpaceID;
-    nsCOMPtr<nsIAtom> tag;
     nsCOMPtr<nsINodeInfo> ni;
-    rv = element->NormalizeAttrString(aAttr, *getter_AddRefs(ni));
+    rv = element->NormalizeAttrString(aAttr, getter_AddRefs(ni));
     if (NS_FAILED(rv)) return rv;
 
-    ni->GetNameAtom(*getter_AddRefs(tag));
-    ni->GetNamespaceID(nameSpaceID);
+    nsCOMPtr<nsIAtom> tag = ni->GetNameAtom();
+    PRInt32 nameSpaceID = ni->GetNamespaceID();
 
     rv = Persist(element, nameSpaceID, tag);
     if (NS_FAILED(rv)) return rv;
@@ -1912,7 +1910,7 @@ nsXULDocument::AddElementToDocumentPost(nsIContent* aElement)
 {
     // We need to pay special attention to the keyset tag to set up a listener
     nsCOMPtr<nsIAtom> tag;
-    aElement->GetTag(*getter_AddRefs(tag));
+    aElement->GetTag(getter_AddRefs(tag));
     if (tag == nsXULAtoms::keyset) {
         // Create our XUL key listener and hook it up.
         nsCOMPtr<nsIXBLService> xblService(do_GetService("@mozilla.org/xbl;1"));
@@ -1965,7 +1963,7 @@ nsXULDocument::AddSubtreeToDocument(nsIContent* aElement)
 
     while (--count >= 0) {
         nsCOMPtr<nsIContent> child;
-        rv = aElement->ChildAt(count, *getter_AddRefs(child));
+        rv = aElement->ChildAt(count, getter_AddRefs(child));
         if (NS_FAILED(rv)) return rv;
 
         rv = AddSubtreeToDocument(child);
@@ -1991,7 +1989,7 @@ nsXULDocument::RemoveSubtreeFromDocument(nsIContent* aElement)
 
     while (--count >= 0) {
         nsCOMPtr<nsIContent> child;
-        rv = aElement->ChildAt(count, *getter_AddRefs(child));
+        rv = aElement->ChildAt(count, getter_AddRefs(child));
         if (NS_FAILED(rv)) return rv;
 
         rv = RemoveSubtreeFromDocument(child);
@@ -2380,8 +2378,7 @@ nsXULDocument::CreateElement(nsINodeInfo *aNodeInfo, nsIContent** aResult)
         if (NS_FAILED(rv)) return rv;
     }
     else {
-        PRInt32 namespaceID;
-        aNodeInfo->GetNamespaceID(namespaceID);
+        PRInt32 namespaceID = aNodeInfo->GetNamespaceID();
 
         nsCOMPtr<nsIElementFactory> elementFactory;
         GetElementFactory(namespaceID, getter_AddRefs(elementFactory));
@@ -2704,17 +2701,17 @@ nsXULDocument::ContextStack::IsInsideXULTemplate()
         nsCOMPtr<nsIContent> element = dont_QueryInterface(mTop->mElement);
         while (element) {
             PRInt32 nameSpaceID;
-            element->GetNameSpaceID(nameSpaceID);
+            element->GetNameSpaceID(&nameSpaceID);
             if (nameSpaceID == kNameSpaceID_XUL) {
                 nsCOMPtr<nsIAtom> tag;
-                element->GetTag(*getter_AddRefs(tag));
+                element->GetTag(getter_AddRefs(tag));
                 if (tag.get() == nsXULAtoms::Template) {
                     return PR_TRUE;
                 }
             }
 
             nsCOMPtr<nsIContent> parent;
-            element->GetParent(*getter_AddRefs(parent));
+            element->GetParent(getter_AddRefs(parent));
             element = parent;
         }
     }
@@ -3520,8 +3517,7 @@ nsXULDocument::CreateElement(nsXULPrototypeElement* aPrototype, nsIContent** aRe
         // what. So we need to copy everything out of the prototype
         // into the element.
 
-        PRInt32 namespaceID;
-        aPrototype->mNodeInfo->GetNamespaceID(namespaceID);
+        PRInt32 namespaceID = aPrototype->mNodeInfo->GetNamespaceID();
 
         nsCOMPtr<nsIElementFactory> elementFactory;
         GetElementFactory(namespaceID,
@@ -3638,8 +3634,8 @@ nsXULDocument::CreateTemplateBuilder(nsIContent* aElement)
         xblService->ResolveTag(aElement, &nameSpaceID, getter_AddRefs(baseTag));
     }
     else {
-        aElement->GetNameSpaceID(nameSpaceID);
-        aElement->GetTag(*getter_AddRefs(baseTag));
+        aElement->GetNameSpaceID(&nameSpaceID);
+        aElement->GetTag(getter_AddRefs(baseTag));
     }
 
     if ((nameSpaceID == kNameSpaceID_XUL) && (baseTag == nsXULAtoms::tree)) {
@@ -3674,7 +3670,7 @@ nsXULDocument::CreateTemplateBuilder(nsIContent* aElement)
         if (! bodyContent) {
             // Get the document.
             nsCOMPtr<nsIDocument> doc;
-            aElement->GetDocument(*getter_AddRefs(doc));
+            aElement->GetDocument(getter_AddRefs(doc));
             NS_ASSERTION(doc, "no document");
             if (! doc)
                 return NS_ERROR_UNEXPECTED;
@@ -3854,7 +3850,9 @@ nsXULDocument::OverlayForwardReference::Merge(nsIContent* aTargetNode,
     for (i = 0; i < attrCount; ++i) {
         PRInt32 nameSpaceID;
         nsCOMPtr<nsIAtom> attr, prefix;
-        rv = aOverlayNode->GetAttrNameAt(i, nameSpaceID, *getter_AddRefs(attr), *getter_AddRefs(prefix));
+        rv = aOverlayNode->GetAttrNameAt(i, &nameSpaceID,
+                                         getter_AddRefs(attr),
+                                         getter_AddRefs(prefix));
         if (NS_FAILED(rv)) return rv;
 
         // We don't want to swap IDs, they should be the same.
@@ -3873,7 +3871,7 @@ nsXULDocument::OverlayForwardReference::Merge(nsIContent* aTargetNode,
         if (attr.get() == nsXULAtoms::removeelement &&
             value.EqualsIgnoreCase("true")) {
             nsCOMPtr<nsIContent> parent;
-            rv = aTargetNode->GetParent(*getter_AddRefs(parent));
+            rv = aTargetNode->GetParent(getter_AddRefs(parent));
             if (NS_FAILED(rv)) return rv;
 
             rv = RemoveElement(parent, aTargetNode);
@@ -3883,14 +3881,14 @@ nsXULDocument::OverlayForwardReference::Merge(nsIContent* aTargetNode,
         }
 
         nsCOMPtr<nsINodeInfo> ni;
-        aTargetNode->GetNodeInfo(*getter_AddRefs(ni));
+        aTargetNode->GetNodeInfo(getter_AddRefs(ni));
 
         if (ni) {
             nsCOMPtr<nsINodeInfoManager> nimgr;
-            ni->GetNodeInfoManager(*getter_AddRefs(nimgr));
+            ni->GetNodeInfoManager(getter_AddRefs(nimgr));
 
             nimgr->GetNodeInfo(attr, prefix, nameSpaceID,
-                               *getter_AddRefs(ni));
+                               getter_AddRefs(ni));
         }
 
         rv = aTargetNode->SetAttr(ni, value, PR_FALSE);
@@ -3911,7 +3909,7 @@ nsXULDocument::OverlayForwardReference::Merge(nsIContent* aTargetNode,
 
     for (i = 0; i < childCount; ++i) {
         nsCOMPtr<nsIContent> currContent;
-        rv = aOverlayNode->ChildAt(0, *getter_AddRefs(currContent));
+        rv = aOverlayNode->ChildAt(0, getter_AddRefs(currContent));
         if (NS_FAILED(rv)) return rv;
 
         nsAutoString id;
@@ -3921,7 +3919,7 @@ nsXULDocument::OverlayForwardReference::Merge(nsIContent* aTargetNode,
         nsCOMPtr<nsIDOMElement> nodeInDocument;
         if (rv == NS_CONTENT_ATTR_HAS_VALUE) {
             nsCOMPtr<nsIDocument> document;
-            rv = aTargetNode->GetDocument(*getter_AddRefs(document));
+            rv = aTargetNode->GetDocument(getter_AddRefs(document));
             if (NS_FAILED(rv)) return rv;
 
             nsCOMPtr<nsIDOMDocument> domDocument(do_QueryInterface(document));
@@ -4021,7 +4019,7 @@ nsXULDocument::BroadcasterHookup::~BroadcasterHookup()
         nsresult rv;
 
         nsCOMPtr<nsIAtom> tag;
-        rv = mObservesElement->GetTag(*getter_AddRefs(tag));
+        rv = mObservesElement->GetTag(getter_AddRefs(tag));
         if (NS_FAILED(rv)) return;
 
         nsAutoString broadcasterID;
@@ -4099,11 +4097,11 @@ nsXULDocument::CheckBroadcasterHookup(nsXULDocument* aDocument,
     *aDidResolve = PR_FALSE;
 
     PRInt32 nameSpaceID;
-    rv = aElement->GetNameSpaceID(nameSpaceID);
+    rv = aElement->GetNameSpaceID(&nameSpaceID);
     if (NS_FAILED(rv)) return rv;
 
     nsCOMPtr<nsIAtom> tag;
-    rv = aElement->GetTag(*getter_AddRefs(tag));
+    rv = aElement->GetTag(getter_AddRefs(tag));
     if (NS_FAILED(rv)) return rv;
 
     nsCOMPtr<nsIDOMElement> listener;
@@ -4117,11 +4115,11 @@ nsXULDocument::CheckBroadcasterHookup(nsXULDocument* aDocument,
         // broadcaster element, and an 'attribute' element, which
         // specifies the name of the attribute to observe.
         nsCOMPtr<nsIContent> parent;
-        rv = aElement->GetParent(*getter_AddRefs(parent));
+        rv = aElement->GetParent(getter_AddRefs(parent));
         if (NS_FAILED(rv)) return rv;
 
         nsCOMPtr<nsIAtom> parentTag;
-        rv = parent->GetTag(*getter_AddRefs(parentTag));
+        rv = parent->GetTag(getter_AddRefs(parentTag));
         if (NS_FAILED(rv)) return rv;
 
         // If we're still parented by an 'overlay' tag, then we haven't
@@ -4157,7 +4155,7 @@ nsXULDocument::CheckBroadcasterHookup(nsXULDocument* aDocument,
               // We've got something in the command attribute.  We only treat this as
               // a normal broadcaster if we are not a menuitem or a key.
 
-              aElement->GetTag(*getter_AddRefs(tag));
+              aElement->GetTag(getter_AddRefs(tag));
               if (tag.get() == nsXULAtoms::menuitem || tag.get() == nsXULAtoms::key) {
                 *aNeedsHookup = PR_FALSE;
                 return NS_OK;
@@ -4206,7 +4204,7 @@ nsXULDocument::CheckBroadcasterHookup(nsXULDocument* aDocument,
             return rv;
 
         nsCOMPtr<nsIAtom> tag2;
-        rv = content->GetTag(*getter_AddRefs(tag2));
+        rv = content->GetTag(getter_AddRefs(tag2));
         if (NS_FAILED(rv)) return rv;
 
         nsAutoString tagStr;
@@ -4254,7 +4252,7 @@ nsXULDocument::InsertElement(nsIContent* aParent, nsIContent* aChild)
 
     if (rv == NS_CONTENT_ATTR_HAS_VALUE) {
         nsCOMPtr<nsIDocument> document;
-        rv = aParent->GetDocument(*getter_AddRefs(document));
+        rv = aParent->GetDocument(getter_AddRefs(document));
         if (NS_FAILED(rv)) return rv;
 
         nsCOMPtr<nsIDOMDocument> domDocument(do_QueryInterface(document));
diff --git a/content/xul/document/src/nsXULPrototypeDocument.cpp b/content/xul/document/src/nsXULPrototypeDocument.cpp
index 380ffe34d783..fb07657045e5 100644
--- a/content/xul/document/src/nsXULPrototypeDocument.cpp
+++ b/content/xul/document/src/nsXULPrototypeDocument.cpp
@@ -421,7 +421,7 @@ nsXULPrototypeDocument::Read(nsIObjectInputStream* aStream)
         rv |= aStream->ReadString(qualifiedName);
 
         nsCOMPtr<nsINodeInfo> nodeInfo;
-        rv |= mNodeInfoManager->GetNodeInfo(qualifiedName, namespaceURI, *getter_AddRefs(nodeInfo));
+        rv |= mNodeInfoManager->GetNodeInfo(qualifiedName, namespaceURI, getter_AddRefs(nodeInfo));
         rv |= nodeInfos->AppendElement(nodeInfo);
     }
 
diff --git a/content/xul/templates/src/nsContentSupportMap.cpp b/content/xul/templates/src/nsContentSupportMap.cpp
index 51e1332b285e..78492bdee191 100644
--- a/content/xul/templates/src/nsContentSupportMap.cpp
+++ b/content/xul/templates/src/nsContentSupportMap.cpp
@@ -89,7 +89,7 @@ nsContentSupportMap::Remove(nsIContent* aElement)
 
     for (PRInt32 i = 0; i < count; ++i) {
         nsCOMPtr<nsIContent> child;
-        aElement->ChildAt(i, *getter_AddRefs(child));
+        aElement->ChildAt(i, getter_AddRefs(child));
 
         Remove(child);
     }
diff --git a/content/xul/templates/src/nsContentTagTestNode.cpp b/content/xul/templates/src/nsContentTagTestNode.cpp
index 41f54607a2e2..eb5dbe455d0a 100644
--- a/content/xul/templates/src/nsContentTagTestNode.cpp
+++ b/content/xul/templates/src/nsContentTagTestNode.cpp
@@ -86,7 +86,7 @@ nsContentTagTestNode::FilterInstantiations(InstantiationSet& aInstantiations, vo
         }
 
         nsCOMPtr<nsIAtom> tag;
-        rv = VALUE_TO_ICONTENT(value)->GetTag(*getter_AddRefs(tag));
+        rv = VALUE_TO_ICONTENT(value)->GetTag(getter_AddRefs(tag));
         if (NS_FAILED(rv)) return rv;
 
         if (tag != mTag) {
diff --git a/content/xul/templates/src/nsContentTestNode.cpp b/content/xul/templates/src/nsContentTestNode.cpp
index 56e84a4a50b8..7b80a3b6856f 100644
--- a/content/xul/templates/src/nsContentTestNode.cpp
+++ b/content/xul/templates/src/nsContentTestNode.cpp
@@ -89,7 +89,7 @@ ElementToString(nsIContent *aContent, nsString &aResult)
     aResult.Truncate();
 
     nsCOMPtr<nsIAtom> tag;
-    aContent->GetTag(*getter_AddRefs(tag));
+    aContent->GetTag(getter_AddRefs(tag));
     tag->ToString(aResult);
 
     aResult.Append(PRUnichar('@'));
@@ -139,7 +139,7 @@ nsContentTestNode::FilterInstantiations(InstantiationSet& aInstantiations, void*
             if (mTag) {
                 // If we're supposed to be checking the tag, do it now.
                 nsCOMPtr<nsIAtom> tag;
-                content->GetTag(*getter_AddRefs(tag));
+                content->GetTag(getter_AddRefs(tag));
 
                 if (tag != mTag)
                     consistent = PR_FALSE;
@@ -179,7 +179,7 @@ nsContentTestNode::FilterInstantiations(InstantiationSet& aInstantiations, void*
             if (mTag) {
                 // If we're supposed to be checking the tag, do it now.
                 nsCOMPtr<nsIAtom> tag;
-                content->GetTag(*getter_AddRefs(tag));
+                content->GetTag(getter_AddRefs(tag));
 
                 if (tag != mTag) {
                     consistent = PR_FALSE;
@@ -250,7 +250,7 @@ nsContentTestNode::FilterInstantiations(InstantiationSet& aInstantiations, void*
                         // If we've got a tag, check it to ensure
                         // we're consistent.
                         nsCOMPtr<nsIAtom> tag;
-                        content->GetTag(*getter_AddRefs(tag));
+                        content->GetTag(getter_AddRefs(tag));
 
                         if (tag != mTag)
                             continue;
diff --git a/content/xul/templates/src/nsTemplateMap.h b/content/xul/templates/src/nsTemplateMap.h
index 1cb2e8c1f812..56e14763b858 100644
--- a/content/xul/templates/src/nsTemplateMap.h
+++ b/content/xul/templates/src/nsTemplateMap.h
@@ -99,7 +99,7 @@ public:
 
         for (PRInt32 i = 0; i < count; ++i) {
             nsCOMPtr<nsIContent> child;
-            aContent->ChildAt(i, *getter_AddRefs(child));
+            aContent->ChildAt(i, getter_AddRefs(child));
 
             Remove(child);
         } }
diff --git a/content/xul/templates/src/nsXULContentBuilder.cpp b/content/xul/templates/src/nsXULContentBuilder.cpp
index e471c793504a..f9d9ce243953 100644
--- a/content/xul/templates/src/nsXULContentBuilder.cpp
+++ b/content/xul/templates/src/nsXULContentBuilder.cpp
@@ -88,7 +88,7 @@ IsElementInBuilder(nsIContent *aContent, nsIXULTemplateBuilder *aBuilder)
     // Make sure that the element is contained within the heirarchy
     // that we're supposed to be processing.
     nsCOMPtr<nsIDocument> doc;
-    aContent->GetDocument(*getter_AddRefs(doc));
+    aContent->GetDocument(getter_AddRefs(doc));
 
     nsCOMPtr<nsIXULDocument> xuldoc = do_QueryInterface(doc);
     if (! xuldoc)
@@ -107,7 +107,7 @@ IsElementInBuilder(nsIContent *aContent, nsIXULTemplateBuilder *aBuilder)
         }
 
         nsCOMPtr<nsIContent> parent;
-        content->GetParent(*getter_AddRefs(parent));
+        content->GetParent(getter_AddRefs(parent));
         content = parent;
     } while (content);
 
@@ -444,7 +444,7 @@ nsXULContentBuilder::BuildContentFromTemplate(nsIContent *aTemplateNode,
     // resource that is being used as the index into the graph.
     if (PR_LOG_TEST(gXULTemplateLog, PR_LOG_DEBUG)) {
         nsCOMPtr<nsIAtom> tag;
-        rv = aTemplateNode->GetTag(*getter_AddRefs(tag));
+        rv = aTemplateNode->GetTag(getter_AddRefs(tag));
         if (NS_FAILED(rv)) return rv;
 
         nsXPIDLCString resourceCStr;
@@ -476,11 +476,11 @@ nsXULContentBuilder::BuildContentFromTemplate(nsIContent *aTemplateNode,
 
     for (PRInt32 kid = 0; kid < count; kid++) {
         nsCOMPtr<nsIContent> tmplKid;
-        rv = aTemplateNode->ChildAt(kid, *getter_AddRefs(tmplKid));
+        rv = aTemplateNode->ChildAt(kid, getter_AddRefs(tmplKid));
         if (NS_FAILED(rv)) return rv;
 
         PRInt32 nameSpaceID;
-        rv = tmplKid->GetNameSpaceID(nameSpaceID);
+        rv = tmplKid->GetNameSpaceID(&nameSpaceID);
         if (NS_FAILED(rv)) return rv;
 
         // Check whether this element is the "resource" element. The
@@ -552,7 +552,7 @@ nsXULContentBuilder::BuildContentFromTemplate(nsIContent *aTemplateNode,
         }
 
         nsCOMPtr<nsIAtom> tag;
-        rv = tmplKid->GetTag(*getter_AddRefs(tag));
+        rv = tmplKid->GetTag(getter_AddRefs(tag));
         if (NS_FAILED(rv)) return rv;
 
 #ifdef PR_LOGGING
@@ -654,7 +654,7 @@ nsXULContentBuilder::BuildContentFromTemplate(nsIContent *aTemplateNode,
                 // element map if aNotify is true. If not, we gotta do
                 // it ourselves. Yay.
                 nsCOMPtr<nsIDocument> doc;
-                mRoot->GetDocument(*getter_AddRefs(doc));
+                mRoot->GetDocument(getter_AddRefs(doc));
 
                 if (doc) {
                     nsCOMPtr<nsIXULDocument> xuldoc = do_QueryInterface(doc);
@@ -749,7 +749,9 @@ nsXULContentBuilder::BuildContentFromTemplate(nsIContent *aTemplateNode,
                 PRInt32 attribNameSpaceID;
                 nsCOMPtr<nsIAtom> attribName, prefix;
 
-                rv = tmplKid->GetAttrNameAt(attr, attribNameSpaceID, *getter_AddRefs(attribName), *getter_AddRefs(prefix));
+                rv = tmplKid->GetAttrNameAt(attr, &attribNameSpaceID,
+                                            getter_AddRefs(attribName),
+                                            getter_AddRefs(prefix));
                 if (NS_FAILED(rv)) return rv;
 
                 if (! IsIgnoreableAttribute(attribNameSpaceID, attribName)) {
@@ -883,15 +885,13 @@ nsXULContentBuilder::AddPersistentAttributes(nsIContent* aTemplateNode,
         if (attribute.IsEmpty())
             break;
 
-        PRInt32 nameSpaceID;
-        nsCOMPtr<nsIAtom> tag;
         nsCOMPtr<nsINodeInfo> ni;
         rv = aTemplateNode->NormalizeAttrString(attribute,
-                                                *getter_AddRefs(ni));
+                                                getter_AddRefs(ni));
         if (NS_FAILED(rv)) return rv;
 
-        ni->GetNameAtom(*getter_AddRefs(tag));
-        ni->GetNamespaceID(nameSpaceID);
+        nsCOMPtr<nsIAtom> tag = ni->GetNameAtom();
+        PRInt32 nameSpaceID = ni->GetNamespaceID();
 
         nsCOMPtr<nsIRDFResource> property;
         rv = nsXULContentUtils::GetResource(nameSpaceID, tag, getter_AddRefs(property));
@@ -943,9 +943,9 @@ nsXULContentBuilder::SynchronizeUsingTemplate(nsIContent* aTemplateNode,
             PRInt32    attribNameSpaceID;
             nsCOMPtr<nsIAtom> attribName, prefix;
             rv = aTemplateNode->GetAttrNameAt(aLoop,
-                                              attribNameSpaceID,
-                                              *getter_AddRefs(attribName),
-                                              *getter_AddRefs(prefix));
+                                              &attribNameSpaceID,
+                                              getter_AddRefs(attribName),
+                                              getter_AddRefs(prefix));
             if (NS_FAILED(rv)) break;
 
             // See if it's one of the attributes that we unilaterally
@@ -998,14 +998,14 @@ nsXULContentBuilder::SynchronizeUsingTemplate(nsIContent* aTemplateNode,
 
         for (PRInt32 loop=0; loop<count; loop++) {
             nsCOMPtr<nsIContent> tmplKid;
-            rv = aTemplateNode->ChildAt(loop, *getter_AddRefs(tmplKid));
+            rv = aTemplateNode->ChildAt(loop, getter_AddRefs(tmplKid));
             if (NS_FAILED(rv)) return rv;
 
             if (! tmplKid)
                 break;
 
             nsCOMPtr<nsIContent> realKid;
-            rv = aRealElement->ChildAt(loop, *getter_AddRefs(realKid));
+            rv = aRealElement->ChildAt(loop, getter_AddRefs(realKid));
             if (NS_FAILED(rv)) return rv;
 
             if (! realKid)
@@ -1050,20 +1050,20 @@ nsXULContentBuilder::IsDirectlyContainedBy(nsIContent* aChild, nsIContent* aPare
 
         // Walk up the generated tree
         nsIContent *tmp = generated;
-        tmp->GetParent(*getter_AddRefs(generated));
+        tmp->GetParent(getter_AddRefs(generated));
         if (! generated) 
             return PR_FALSE;
 
         // Walk up the template tree
         tmp = tmpl;
-        tmp->GetParent(*getter_AddRefs(tmpl));
+        tmp->GetParent(getter_AddRefs(tmpl));
         if (! tmpl)
             return PR_FALSE;
 
         // The content within a template ends when we hit the
         // <template> or <rule> element in the simple syntax, or the
         // <action> element in the extended syntax.
-        tmpl->GetTag(*getter_AddRefs(tag));
+        tmpl->GetTag(getter_AddRefs(tag));
     } while (tag.get() != nsXULAtoms::templateAtom &&
              tag.get() != nsXULAtoms::rule &&
              tag.get() != nsXULAtoms::action);
@@ -1103,7 +1103,7 @@ nsXULContentBuilder::RemoveMember(nsIContent* aContainerElement,
             continue;
 
         nsCOMPtr<nsIContent> parent;
-        rv = child->GetParent(*getter_AddRefs(parent));
+        rv = child->GetParent(getter_AddRefs(parent));
         if (NS_FAILED(rv)) return rv;
 
         PRInt32 pos;
@@ -1130,7 +1130,7 @@ nsXULContentBuilder::RemoveMember(nsIContent* aContainerElement,
 #ifdef PR_LOGGING
         if (PR_LOG_TEST(gXULTemplateLog, PR_LOG_ALWAYS)) {
             nsCOMPtr<nsIAtom> parentTag;
-            rv = parent->GetTag(*getter_AddRefs(parentTag));
+            rv = parent->GetTag(getter_AddRefs(parentTag));
             if (NS_FAILED(rv)) return rv;
 
             nsAutoString parentTagStr;
@@ -1138,7 +1138,7 @@ nsXULContentBuilder::RemoveMember(nsIContent* aContainerElement,
             if (NS_FAILED(rv)) return rv;
 
             nsCOMPtr<nsIAtom> childTag;
-            rv = child->GetTag(*getter_AddRefs(childTag));
+            rv = child->GetTag(getter_AddRefs(childTag));
             if (NS_FAILED(rv)) return rv;
 
             nsAutoString childTagStr;
@@ -1351,7 +1351,7 @@ nsXULContentBuilder::CreateTemplateContents(nsIContent* aElement,
             break;
 
         nsCOMPtr<nsIContent> parent;
-        element->GetParent(*getter_AddRefs(parent));
+        element->GetParent(getter_AddRefs(parent));
 
         element = parent;
     }
@@ -1415,7 +1415,7 @@ nsXULContentBuilder::IsOpen(nsIContent* aElement)
     // XXXhyatt - use XBL service to obtain base tag.
 
     nsCOMPtr<nsIAtom> tag;
-    rv = aElement->GetTag(*getter_AddRefs(tag));
+    rv = aElement->GetTag(getter_AddRefs(tag));
     if (NS_FAILED(rv)) return PR_FALSE;
 
     // Treat the 'root' element as always open, -unless- it's a
@@ -1461,7 +1461,7 @@ nsXULContentBuilder::RemoveGeneratedContent(nsIContent* aElement)
 
         while (--i >= 0) {
             nsCOMPtr<nsIContent> child;
-            element->ChildAt(i, *getter_AddRefs(child));
+            element->ChildAt(i, getter_AddRefs(child));
             NS_ASSERTION(child != nsnull, "huh? no child?");
             if (! child)
                 continue;
@@ -1470,7 +1470,7 @@ nsXULContentBuilder::RemoveGeneratedContent(nsIContent* aElement)
             // it won't have any generated content: there's no reason
             // to even check this subtree.
             nsCOMPtr<nsIAtom> tag;
-            element->GetTag(*getter_AddRefs(tag));
+            element->GetTag(getter_AddRefs(tag));
             if (tag.get() == nsXULAtoms::templateAtom)
                 continue;
 
@@ -1514,13 +1514,13 @@ nsXULContentBuilder::IsLazyWidgetItem(nsIContent* aElement)
     nsresult rv;
 
     PRInt32 nameSpaceID;
-    rv = aElement->GetNameSpaceID(nameSpaceID);
+    rv = aElement->GetNameSpaceID(&nameSpaceID);
     if (NS_FAILED(rv)) return PR_FALSE;
 
     // XXXhyatt Use the XBL service to obtain a base tag.
 
     nsCOMPtr<nsIAtom> tag;
-    rv = aElement->GetTag(*getter_AddRefs(tag));
+    rv = aElement->GetTag(getter_AddRefs(tag));
     if (NS_FAILED(rv)) return PR_FALSE;
 
     if (nameSpaceID != kNameSpaceID_XUL)
@@ -1542,7 +1542,7 @@ nsXULContentBuilder::GetElementsForResource(nsIRDFResource* aResource, nsISuppor
     aResource->GetValueConst(&uri);
 
     nsCOMPtr<nsIDocument> doc;
-    mRoot->GetDocument(*getter_AddRefs(doc));
+    mRoot->GetDocument(getter_AddRefs(doc));
     NS_ASSERTION(doc != nsnull, "root element not in document");
     if (! doc)
         return NS_ERROR_FAILURE;
@@ -1561,7 +1561,7 @@ nsXULContentBuilder::CreateElement(PRInt32 aNameSpaceID,
                                     nsIContent** aResult)
 {
     nsCOMPtr<nsIDocument> doc;
-    mRoot->GetDocument(*getter_AddRefs(doc));
+    mRoot->GetDocument(getter_AddRefs(doc));
     NS_ASSERTION(doc != nsnull, "not initialized");
     if (! doc)
         return NS_ERROR_NOT_INITIALIZED;
@@ -1570,12 +1570,12 @@ nsXULContentBuilder::CreateElement(PRInt32 aNameSpaceID,
     nsCOMPtr<nsIContent> result;
 
     nsCOMPtr<nsINodeInfoManager> nodeInfoManager;
-    doc->GetNodeInfoManager(*getter_AddRefs(nodeInfoManager));
+    doc->GetNodeInfoManager(getter_AddRefs(nodeInfoManager));
     NS_ENSURE_TRUE(nodeInfoManager, NS_ERROR_NOT_INITIALIZED);
 
     nsCOMPtr<nsINodeInfo> nodeInfo;
     nodeInfoManager->GetNodeInfo(aTag, nsnull, aNameSpaceID,
-                                 *getter_AddRefs(nodeInfo));
+                                 getter_AddRefs(nodeInfo));
 
     if (aNameSpaceID == kNameSpaceID_XUL) {
         rv = nsXULElement::Create(nodeInfo, getter_AddRefs(result));
@@ -1699,7 +1699,7 @@ nsXULContentBuilder::AttributeChanged(nsIDocument* aDocument,
     // we've notified the observer, so that content is already created
     // for the frame system to walk.
     PRInt32 nameSpaceID = kNameSpaceID_Unknown;
-    aContent->GetNameSpaceID(nameSpaceID);
+    aContent->GetNameSpaceID(&nameSpaceID);
 
     if ((nameSpaceID == kNameSpaceID_XUL) && (aAttribute == nsXULAtoms::open)) {
         // We're on a XUL tag, and an ``open'' attribute changed.
@@ -1915,7 +1915,7 @@ nsXULContentBuilder::OpenContainer(nsIContent* aElement)
         // The tree widget is special, and has to be spanked every
         // time we add content to a container.
         nsCOMPtr<nsIDocument> doc;
-        mRoot->GetDocument(*getter_AddRefs(doc));
+        mRoot->GetDocument(getter_AddRefs(doc));
         NS_ASSERTION(doc != nsnull, "root element has no document");
         if (! doc)
             return NS_ERROR_UNEXPECTED;
@@ -1935,7 +1935,7 @@ nsXULContentBuilder::CloseContainer(nsIContent* aElement)
         return NS_OK;
 
     nsCOMPtr<nsIAtom> tag;
-    aElement->GetTag(*getter_AddRefs(tag));
+    aElement->GetTag(getter_AddRefs(tag));
 
     return NS_OK;
 }
@@ -1960,7 +1960,7 @@ nsXULContentBuilder::InitializeRuleNetworkForSimpleRules(InnerNode** aChildNode)
     //   (root)-->(content ^id ?a)-->(?a ^member ?b)
     //
     nsCOMPtr<nsIDocument> doc;
-    mRoot->GetDocument(*getter_AddRefs(doc));
+    mRoot->GetDocument(getter_AddRefs(doc));
     NS_ASSERTION(doc != nsnull, "root element has no document");
     if (! doc)
         return NS_ERROR_FAILURE;
@@ -2014,7 +2014,7 @@ nsXULContentBuilder::RebuildAll()
         return NS_ERROR_NOT_INITIALIZED;
 
     nsCOMPtr<nsIDocument> doc;
-    nsresult rv = mRoot->GetDocument(*getter_AddRefs(doc));
+    nsresult rv = mRoot->GetDocument(getter_AddRefs(doc));
     if (NS_FAILED(rv)) return rv;
 
     // Bail out early if we are being torn down.
@@ -2064,7 +2064,7 @@ nsXULContentBuilder::RebuildAll()
 
     if (container) {
         nsCOMPtr<nsIDocument> doc;
-        mRoot->GetDocument(*getter_AddRefs(doc));
+        mRoot->GetDocument(getter_AddRefs(doc));
         NS_ASSERTION(doc != nsnull, "root element has no document");
         if (! doc)
             return NS_ERROR_UNEXPECTED;
@@ -2147,7 +2147,7 @@ nsXULContentBuilder::CompileContentCondition(nsTemplateRule* aRule,
     }
 
     nsCOMPtr<nsIDocument> doc;
-    mRoot->GetDocument(*getter_AddRefs(doc));
+    mRoot->GetDocument(getter_AddRefs(doc));
     NS_ASSERTION(doc != nsnull, "root element has no document");
     if (! doc)
         return NS_ERROR_FAILURE;
diff --git a/content/xul/templates/src/nsXULContentUtils.cpp b/content/xul/templates/src/nsXULContentUtils.cpp
index 475b6f061c6c..3231ffa2355c 100644
--- a/content/xul/templates/src/nsXULContentUtils.cpp
+++ b/content/xul/templates/src/nsXULContentUtils.cpp
@@ -162,18 +162,18 @@ nsXULContentUtils::FindChildByTag(nsIContent* aElement,
 
     for (PRInt32 i = 0; i < count; ++i) {
         nsCOMPtr<nsIContent> kid;
-        if (NS_FAILED(rv = aElement->ChildAt(i, *getter_AddRefs(kid))))
+        if (NS_FAILED(rv = aElement->ChildAt(i, getter_AddRefs(kid))))
             return rv; // XXX fatal
 
         PRInt32 nameSpaceID;
-        if (NS_FAILED(rv = kid->GetNameSpaceID(nameSpaceID)))
+        if (NS_FAILED(rv = kid->GetNameSpaceID(&nameSpaceID)))
             return rv; // XXX fatal
 
         if (nameSpaceID != aNameSpaceID)
             continue; // wrong namespace
 
         nsCOMPtr<nsIAtom> kidTag;
-        if (NS_FAILED(rv = kid->GetTag(*getter_AddRefs(kidTag))))
+        if (NS_FAILED(rv = kid->GetTag(getter_AddRefs(kidTag))))
             return rv; // XXX fatal
 
         if (kidTag.get() != aTag)
@@ -209,7 +209,7 @@ nsXULContentUtils::GetElementResource(nsIContent* aElement, nsIRDFResource** aRe
     // Since the element will store its ID attribute as a document-relative value,
     // we may need to qualify it first...
     nsCOMPtr<nsIDocument> doc;
-    rv = aElement->GetDocument(*getter_AddRefs(doc));
+    rv = aElement->GetDocument(getter_AddRefs(doc));
     if (NS_FAILED(rv)) return rv;
 
     NS_ASSERTION(doc != nsnull, "element is not in any document");
@@ -241,7 +241,7 @@ nsXULContentUtils::GetElementRefResource(nsIContent* aElement, nsIRDFResource**
     if (rv == NS_CONTENT_ATTR_HAS_VALUE) {
         // We'll use rdf_MakeAbsolute() to translate this to a URL.
         nsCOMPtr<nsIDocument> doc;
-        rv = aElement->GetDocument(*getter_AddRefs(doc));
+        rv = aElement->GetDocument(getter_AddRefs(doc));
         if (NS_FAILED(rv)) return rv;
 
         nsCOMPtr<nsIURI> url;
@@ -350,7 +350,7 @@ nsXULContentUtils::MakeElementURI(nsIDocument* aDocument, const nsAString& aElem
         nsresult rv;
 
         nsCOMPtr<nsIURI> docURL;
-        rv = aDocument->GetBaseURL(*getter_AddRefs(docURL));
+        rv = aDocument->GetBaseURL(getter_AddRefs(docURL));
         if (NS_FAILED(rv)) return rv;
 
         // XXX Urgh. This is so broken; I'd really just like to use
@@ -409,7 +409,7 @@ nsXULContentUtils::MakeElementID(nsIDocument* aDocument, const nsAString& aURI,
     nsresult rv;
 
     nsCOMPtr<nsIURI> docURL;
-    rv = aDocument->GetBaseURL(*getter_AddRefs(docURL));
+    rv = aDocument->GetBaseURL(getter_AddRefs(docURL));
     if (NS_FAILED(rv)) return rv;
 
     nsCAutoString spec;
diff --git a/content/xul/templates/src/nsXULSortService.cpp b/content/xul/templates/src/nsXULSortService.cpp
index 6bfccc3c7999..896da034f25a 100644
--- a/content/xul/templates/src/nsXULSortService.cpp
+++ b/content/xul/templates/src/nsXULSortService.cpp
@@ -278,7 +278,7 @@ XULSortServiceImpl::FindDatabaseElement(nsIContent *aElement, nsIContent **aData
     }
     
     nsCOMPtr<nsIContent> parent;
-    content->GetParent(*getter_AddRefs(parent));
+    content->GetParent(getter_AddRefs(parent));
     content = parent;
   }
 
@@ -291,7 +291,7 @@ XULSortServiceImpl::FindSortableContainer(nsIContent *aRoot, nsIContent **aConta
   nsresult rv;
 
   nsCOMPtr<nsIAtom> tag;
-  if (NS_FAILED(rv = aRoot->GetTag(*getter_AddRefs(tag))))  return rv;
+  if (NS_FAILED(rv = aRoot->GetTag(getter_AddRefs(tag))))  return rv;
 
   if (tag == nsXULAtoms::templateAtom) // ignore content within templates
     return NS_OK;    
@@ -308,8 +308,8 @@ XULSortServiceImpl::FindSortableContainer(nsIContent *aRoot, nsIContent **aConta
 
   if (NS_FAILED(rv = aRoot->ChildCount(numChildren))) return rv;
   for (childIndex = 0; childIndex < numChildren; childIndex++) {
-    if (NS_FAILED(rv = aRoot->ChildAt(childIndex, *getter_AddRefs(child)))) return rv;
-    if (NS_FAILED(rv = child->GetNameSpaceID(nameSpaceID)))  return rv;
+    if (NS_FAILED(rv = aRoot->ChildAt(childIndex, getter_AddRefs(child)))) return rv;
+    if (NS_FAILED(rv = child->GetNameSpaceID(&nameSpaceID)))  return rv;
     if (nameSpaceID == kNameSpaceID_XUL) {
       rv = FindSortableContainer(child, aContainer);
       if (*aContainer)
@@ -363,12 +363,12 @@ XULSortServiceImpl::SetSortColumnHints(nsIContent *content, const nsAString &sor
   if (NS_FAILED(rv = content->ChildCount(numChildren))) return rv;
   
   for (childIndex = 0; childIndex < numChildren; ++childIndex) {
-    if (NS_FAILED(rv = content->ChildAt(childIndex, *getter_AddRefs(child)))) return rv;
-    if (NS_FAILED(rv = child->GetNameSpaceID(nameSpaceID))) return rv;
+    if (NS_FAILED(rv = content->ChildAt(childIndex, getter_AddRefs(child)))) return rv;
+    if (NS_FAILED(rv = child->GetNameSpaceID(&nameSpaceID))) return rv;
     
     if (nameSpaceID == kNameSpaceID_XUL) {
       nsCOMPtr<nsIAtom> tag;
-      if (NS_FAILED(rv = child->GetTag(*getter_AddRefs(tag)))) return rv;
+      if (NS_FAILED(rv = child->GetTag(getter_AddRefs(tag)))) return rv;
         
       if (tag == nsXULAtoms::treecols || tag == nsXULAtoms::listcols || tag == nsXULAtoms::listhead) {
         rv = SetSortColumnHints(child, sortResource, sortDirection);
@@ -1091,7 +1091,7 @@ XULSortServiceImpl::SortContainer(nsIContent *container, sortPtr sortInfo, PRBoo
   if (numChildren < 1) return NS_OK;
 
   nsCOMPtr<nsIDocument> doc;
-  container->GetDocument(*getter_AddRefs(doc));
+  container->GetDocument(getter_AddRefs(doc));
   if (!doc) return NS_ERROR_UNEXPECTED;
 
   // Note: This is a straight allocation (not a COMPtr) so we
@@ -1107,10 +1107,10 @@ XULSortServiceImpl::SortContainer(nsIContent *container, sortPtr sortInfo, PRBoo
   nsCOMPtr<nsIAtom> tag;
   currentElement = numChildren;
   for (childIndex = numChildren-1; childIndex >= 0; --childIndex) {
-    if (NS_FAILED(rv = container->ChildAt(childIndex, *getter_AddRefs(child)))) continue;
-    if (NS_FAILED(rv = child->GetNameSpaceID(nameSpaceID))) continue;
+    if (NS_FAILED(rv = container->ChildAt(childIndex, getter_AddRefs(child)))) continue;
+    if (NS_FAILED(rv = child->GetNameSpaceID(&nameSpaceID))) continue;
     if (nameSpaceID == kNameSpaceID_XUL) {
-      if (NS_FAILED(rv = child->GetTag(*getter_AddRefs(tag)))) continue;
+      if (NS_FAILED(rv = child->GetTag(getter_AddRefs(tag)))) continue;
       if (tag == nsXULAtoms::listitem || tag == nsXULAtoms::treeitem
           || tag == nsXULAtoms::menu || tag == nsXULAtoms::menuitem) {
         --currentElement;
@@ -1166,10 +1166,10 @@ XULSortServiceImpl::SortContainer(nsIContent *container, sortPtr sortInfo, PRBoo
 
     for (childIndex=numChildren-1; childIndex >= 0; childIndex--)
     {
-      if (NS_FAILED(rv = container->ChildAt(childIndex, *getter_AddRefs(child)))) continue;
-      if (NS_FAILED(rv = child->GetNameSpaceID(nameSpaceID))) continue;
+      if (NS_FAILED(rv = container->ChildAt(childIndex, getter_AddRefs(child)))) continue;
+      if (NS_FAILED(rv = child->GetNameSpaceID(&nameSpaceID))) continue;
       if (nameSpaceID == kNameSpaceID_XUL) {
-        if (NS_FAILED(rv = child->GetTag(*getter_AddRefs(tag)))) continue;
+        if (NS_FAILED(rv = child->GetTag(getter_AddRefs(tag)))) continue;
         if (tag == nsXULAtoms::listitem || tag == nsXULAtoms::treeitem
             || tag == nsXULAtoms::menu || tag == nsXULAtoms::menuitem) {
           // immediately remove the child node, and ignore any errors
@@ -1200,12 +1200,12 @@ XULSortServiceImpl::SortContainer(nsIContent *container, sortPtr sortInfo, PRBoo
       if (NS_FAILED(rv = parentNode->ChildCount(numChildren))) continue;
 
       for (childIndex=0; childIndex<numChildren; childIndex++) {
-        if (NS_FAILED(rv = parentNode->ChildAt(childIndex, *getter_AddRefs(child))))
+        if (NS_FAILED(rv = parentNode->ChildAt(childIndex, getter_AddRefs(child))))
           continue;
-        if (NS_FAILED(rv = child->GetNameSpaceID(nameSpaceID))) continue;
+        if (NS_FAILED(rv = child->GetNameSpaceID(&nameSpaceID))) continue;
         if (nameSpaceID != kNameSpaceID_XUL) continue;
 
-        if (NS_FAILED(rv = child->GetTag(*getter_AddRefs(tag)))) continue;
+        if (NS_FAILED(rv = child->GetTag(getter_AddRefs(tag)))) continue;
         if (tag != nsXULAtoms::treechildren && tag != nsXULAtoms::menupopup) continue;
 
         sortInfo->parentContainer = parentNode;
@@ -1370,7 +1370,7 @@ XULSortServiceImpl::InsertContainerNode(nsIRDFCompositeDataSource *db, nsRDFSort
 
     nsCOMPtr<nsIDocument> doc;
     if (NS_SUCCEEDED(rv) && parent) {
-      rv = parent->GetDocument(*getter_AddRefs(doc));
+      rv = parent->GetDocument(getter_AddRefs(doc));
       if (!doc)
         parent = nsnull;
     }
@@ -1379,7 +1379,7 @@ XULSortServiceImpl::InsertContainerNode(nsIRDFCompositeDataSource *db, nsRDFSort
       nsAutoString id;
       nsCOMPtr<nsIAtom> tag;
 
-      if (NS_FAILED(rv = trueParent->GetTag(*getter_AddRefs(tag))))
+      if (NS_FAILED(rv = trueParent->GetTag(getter_AddRefs(tag))))
         return rv;
 
       rv = trueParent->GetAttr(kNameSpaceID_None, nsXULAtoms::ref, id);
@@ -1423,7 +1423,7 @@ XULSortServiceImpl::InsertContainerNode(nsIRDFCompositeDataSource *db, nsRDFSort
       // compute the "static" XUL element count
       nsAutoString  valueStr;
       for (PRInt32 childLoop = 0; childLoop < numChildren; ++childLoop) {
-        container->ChildAt(childLoop, *getter_AddRefs(child));
+        container->ChildAt(childLoop, getter_AddRefs(child));
         if (!child) break;
 
         if (NS_SUCCEEDED(rv = child->GetAttr(kNameSpaceID_None, nsXULAtoms::templateAtom, valueStr))
@@ -1463,7 +1463,7 @@ XULSortServiceImpl::InsertContainerNode(nsIRDFCompositeDataSource *db, nsRDFSort
       // binary search insertion sort... with interpolation at either end-point.
 
       if (sortState->lastWasFirst) {
-        container->ChildAt(staticCount, *getter_AddRefs(child));
+        container->ChildAt(staticCount, getter_AddRefs(child));
         temp = child.get();
         direction = inplaceSortCallback(&node, &temp, &sortInfo);
         if (direction < 0) {
@@ -1472,7 +1472,7 @@ XULSortServiceImpl::InsertContainerNode(nsIRDFCompositeDataSource *db, nsRDFSort
         } else
           sortState->lastWasFirst = PR_FALSE;
       } else if (sortState->lastWasLast) {
-        container->ChildAt(realNumChildren-1, *getter_AddRefs(child));
+        container->ChildAt(realNumChildren-1, getter_AddRefs(child));
         temp = child.get();
         direction = inplaceSortCallback(&node, &temp, &sortInfo);
         if (direction > 0) {
@@ -1485,7 +1485,7 @@ XULSortServiceImpl::InsertContainerNode(nsIRDFCompositeDataSource *db, nsRDFSort
       PRInt32  left = staticCount+1, right = realNumChildren, x;
       while (!childAdded && right >= left) {
         x = (left + right) / 2;
-        container->ChildAt(x-1, *getter_AddRefs(child));
+        container->ChildAt(x-1, getter_AddRefs(child));
         temp = child.get();
 
         // rjc says: since cacheFirstHint is PR_TRUE, the first node passed
@@ -1630,14 +1630,14 @@ XULSortServiceImpl::Sort(nsIDOMNode* node, const nsAString& sortResource, const
 
   // start sorting the content depending on the tag
   nsCOMPtr<nsIAtom> dbNodeTag;
-  dbNode->GetTag(*getter_AddRefs(dbNodeTag));
+  dbNode->GetTag(getter_AddRefs(dbNodeTag));
   nsCOMPtr<nsIContent> container;
   if (NS_FAILED(rv = FindSortableContainer(dbNode, getter_AddRefs(container)))) return rv;
   SortContainer(container, &sortInfo, invertTreeFlag);
   
   // Now remove the db node and re-insert it to force the frames to be rebuilt.
   nsCOMPtr<nsIContent> containerParent;
-  if (NS_FAILED(rv = container->GetParent(*getter_AddRefs(containerParent))))  return rv;
+  if (NS_FAILED(rv = container->GetParent(getter_AddRefs(containerParent))))  return rv;
   PRInt32 containerIndex;
   if (NS_FAILED(rv = containerParent->IndexOf(container, containerIndex)))  return rv;
   PRInt32 childCount;
diff --git a/content/xul/templates/src/nsXULTemplateBuilder.cpp b/content/xul/templates/src/nsXULTemplateBuilder.cpp
index e3a6fddd472f..63edbeb15287 100644
--- a/content/xul/templates/src/nsXULTemplateBuilder.cpp
+++ b/content/xul/templates/src/nsXULTemplateBuilder.cpp
@@ -708,7 +708,7 @@ nsXULTemplateBuilder::LoadDataSources()
 		mDB->SetAllowNegativeAssertions(PR_FALSE);
 
     nsCOMPtr<nsIDocument> doc;
-    mRoot->GetDocument(*getter_AddRefs(doc));
+    mRoot->GetDocument(getter_AddRefs(doc));
     NS_ASSERTION(doc, "element has no document");
     if (! doc)
         return NS_ERROR_UNEXPECTED;
@@ -851,7 +851,7 @@ nsXULTemplateBuilder::InitHTMLTemplateRoot()
     nsresult rv;
 
     nsCOMPtr<nsIDocument> doc;
-    mRoot->GetDocument(*getter_AddRefs(doc));
+    mRoot->GetDocument(getter_AddRefs(doc));
     NS_ASSERTION(doc != nsnull, "no document");
     if (! doc)
         return NS_ERROR_UNEXPECTED;
@@ -1382,11 +1382,11 @@ PRBool
 nsXULTemplateBuilder::IsTemplateElement(nsIContent* aContent)
 {
     PRInt32 nameSpaceID;
-    aContent->GetNameSpaceID(nameSpaceID);
+    aContent->GetNameSpaceID(&nameSpaceID);
 
     if (nameSpaceID == kNameSpaceID_XUL) {
         nsCOMPtr<nsIAtom> tag;
-        aContent->GetTag(*getter_AddRefs(tag));
+        aContent->GetTag(getter_AddRefs(tag));
 
         if (tag.get() == nsXULAtoms::Template)
             return PR_TRUE;
@@ -1443,7 +1443,7 @@ nsXULTemplateBuilder::GetTemplateRoot(nsIContent** aResult)
 
     if (!templateID.IsEmpty()) {
         nsCOMPtr<nsIDocument> doc;
-        mRoot->GetDocument(*getter_AddRefs(doc));
+        mRoot->GetDocument(getter_AddRefs(doc));
         NS_ASSERTION(doc != nsnull, "root element has no document");
         if (! doc)
             return NS_ERROR_FAILURE;
@@ -1469,7 +1469,7 @@ nsXULTemplateBuilder::GetTemplateRoot(nsIContent** aResult)
 
         for (PRInt32 i = 0; i < count; ++i) {
             nsCOMPtr<nsIContent> child;
-            mRoot->ChildAt(i, *getter_AddRefs(child));
+            mRoot->ChildAt(i, getter_AddRefs(child));
 
             if (IsTemplateElement(child)) {
                 NS_ADDREF(*aResult = child.get());
@@ -1482,7 +1482,7 @@ nsXULTemplateBuilder::GetTemplateRoot(nsIContent** aResult)
     // If we couldn't find a real child, look through the anonymous
     // kids, too.
     nsCOMPtr<nsIDocument> doc;
-    mRoot->GetDocument(*getter_AddRefs(doc));
+    mRoot->GetDocument(getter_AddRefs(doc));
     NS_ASSERTION(doc != nsnull, "root element has no document");
     if (! doc)
         return NS_ERROR_FAILURE;
@@ -1558,18 +1558,18 @@ nsXULTemplateBuilder::CompileRules()
 
     for (PRInt32 i = 0; i < count; i++) {
         nsCOMPtr<nsIContent> rule;
-        tmpl->ChildAt(i, *getter_AddRefs(rule));
+        tmpl->ChildAt(i, getter_AddRefs(rule));
         if (! rule)
             break;
 
         PRInt32 nameSpaceID = kNameSpaceID_Unknown;
-        rule->GetNameSpaceID(nameSpaceID);
+        rule->GetNameSpaceID(&nameSpaceID);
 
         if (nameSpaceID != kNameSpaceID_XUL)
             continue;
 
         nsCOMPtr<nsIAtom> tag;
-        rule->GetTag(*getter_AddRefs(tag));
+        rule->GetTag(getter_AddRefs(tag));
 
         if (tag.get() == nsXULAtoms::rule) {
             ++nrules;
@@ -1681,7 +1681,7 @@ nsXULTemplateBuilder::CompileExtendedRule(nsIContent* aRuleElement,
 
             for (PRInt32 i = 0; i < count; ++i) {
                 nsCOMPtr<nsIContent> child;
-                next->ChildAt(i, *getter_AddRefs(child));
+                next->ChildAt(i, getter_AddRefs(child));
 
                 unvisited.AppendElement(child.get());
             }
@@ -1758,10 +1758,10 @@ nsXULTemplateBuilder::CompileConditions(nsTemplateRule* aRule,
 
     for (PRInt32 i = 0; i < count; ++i) {
         nsCOMPtr<nsIContent> condition;
-        aConditions->ChildAt(i, *getter_AddRefs(condition));
+        aConditions->ChildAt(i, getter_AddRefs(condition));
 
         nsCOMPtr<nsIAtom> tag;
-        condition->GetTag(*getter_AddRefs(tag));
+        condition->GetTag(getter_AddRefs(tag));
 
         TestNode* testnode = nsnull;
         rv = CompileCondition(tag, aRule, condition, aParentNode, &testnode);
@@ -1967,10 +1967,10 @@ nsXULTemplateBuilder::CompileBindings(nsTemplateRule* aRule, nsIContent* aBindin
 
     for (PRInt32 i = 0; i < count; ++i) {
         nsCOMPtr<nsIContent> binding;
-        aBindings->ChildAt(i, *getter_AddRefs(binding));
+        aBindings->ChildAt(i, getter_AddRefs(binding));
 
         nsCOMPtr<nsIAtom> tag;
-        binding->GetTag(*getter_AddRefs(tag));
+        binding->GetTag(getter_AddRefs(tag));
 
         if (tag.get() == nsXULAtoms::binding) {
             rv = CompileBinding(aRule, binding);
@@ -2095,9 +2095,9 @@ nsXULTemplateBuilder::CompileSimpleRule(nsIContent* aRuleElement,
     for (PRInt32 i = 0; i < count; ++i) {
         PRInt32 attrNameSpaceID;
         nsCOMPtr<nsIAtom> attr, prefix;
-        rv = aRuleElement->GetAttrNameAt(i, attrNameSpaceID,
-                                         *getter_AddRefs(attr),
-                                         *getter_AddRefs(prefix));
+        rv = aRuleElement->GetAttrNameAt(i, &attrNameSpaceID,
+                                         getter_AddRefs(attr),
+                                         getter_AddRefs(prefix));
         if (NS_FAILED(rv)) return rv;
 
         // Note: some attributes must be skipped on XUL template rule subtree
@@ -2281,8 +2281,8 @@ nsXULTemplateBuilder::AddSimpleRuleBindings(nsTemplateRule* aRule, nsIContent* a
             PRInt32 nameSpaceID;
             nsCOMPtr<nsIAtom> attr, prefix;
 
-            element->GetAttrNameAt(i, nameSpaceID, *getter_AddRefs(attr),
-                                   *getter_AddRefs(prefix));
+            element->GetAttrNameAt(i, &nameSpaceID, getter_AddRefs(attr),
+                                   getter_AddRefs(prefix));
 
             nsAutoString value;
             element->GetAttr(nameSpaceID, attr, value);
@@ -2297,7 +2297,7 @@ nsXULTemplateBuilder::AddSimpleRuleBindings(nsTemplateRule* aRule, nsIContent* a
 
         while (--count >= 0) {
             nsCOMPtr<nsIContent> child;
-            element->ChildAt(count, *getter_AddRefs(child));
+            element->ChildAt(count, getter_AddRefs(child));
             elements.AppendElement(child);
         }
     }
diff --git a/content/xul/templates/src/nsXULTreeBuilder.cpp b/content/xul/templates/src/nsXULTreeBuilder.cpp
index 87ce9f8be0b4..bb4d626194b5 100644
--- a/content/xul/templates/src/nsXULTreeBuilder.cpp
+++ b/content/xul/templates/src/nsXULTreeBuilder.cpp
@@ -449,19 +449,19 @@ nsXULTreeBuilder::Sort(nsIDOMElement* aElement)
 
     // Unset sort attribute(s) on the other columns
     nsCOMPtr<nsIContent> parentContent;
-    header->GetParent(*getter_AddRefs(parentContent));
+    header->GetParent(getter_AddRefs(parentContent));
     if (parentContent) {
         nsCOMPtr<nsIAtom> parentTag;
-        parentContent->GetTag(*getter_AddRefs(parentTag));
+        parentContent->GetTag(getter_AddRefs(parentTag));
         if (parentTag == nsXULAtoms::treecols) {
             PRInt32 numChildren;
             parentContent->ChildCount(numChildren);
             for (int i = 0; i < numChildren; ++i) {
                 nsCOMPtr<nsIContent> childContent;
                 nsCOMPtr<nsIAtom> childTag;
-                parentContent->ChildAt(i, *getter_AddRefs(childContent));
+                parentContent->ChildAt(i, getter_AddRefs(childContent));
                 if (childContent) {
-                    childContent->GetTag(*getter_AddRefs(childTag));
+                    childContent->GetTag(getter_AddRefs(childTag));
                     if (childTag == nsXULAtoms::treecol && childContent != header) {
                         childContent->UnsetAttr(kNameSpaceID_None,
                                                 nsXULAtoms::sortDirection, PR_TRUE);
@@ -801,7 +801,7 @@ nsXULTreeBuilder::SetTree(nsITreeBoxObject* tree)
     mBoxObject = tree;
 
     nsCOMPtr<nsIDocument> doc;
-    mRoot->GetDocument(*getter_AddRefs(doc));
+    mRoot->GetDocument(getter_AddRefs(doc));
     NS_ASSERTION(doc, "element has no document");
     if (!doc)
         return NS_ERROR_UNEXPECTED;
@@ -1257,9 +1257,9 @@ nsXULTreeBuilder::EnsureSortVariables()
     treecols->ChildCount(count);
     for (PRInt32 i = 0; i < count; i++) {
         nsCOMPtr<nsIContent> child;
-        treecols->ChildAt(i, *getter_AddRefs(child));
+        treecols->ChildAt(i, getter_AddRefs(child));
         nsCOMPtr<nsIAtom> tag;
-        child->GetTag(*getter_AddRefs(tag));
+        child->GetTag(getter_AddRefs(tag));
         if (tag == nsXULAtoms::treecol) {
             nsAutoString sortActive;
             child->GetAttr(kNameSpaceID_None, nsXULAtoms::sortActive, sortActive);
@@ -1335,7 +1335,7 @@ nsXULTreeBuilder::RebuildAll()
         return NS_ERROR_NOT_INITIALIZED;
 
     nsCOMPtr<nsIDocument> doc;
-    nsresult rv = mRoot->GetDocument(*getter_AddRefs(doc));
+    nsresult rv = mRoot->GetDocument(getter_AddRefs(doc));
     if (NS_FAILED(rv)) return rv;
 
     // Bail out early if we are being torn down.
@@ -1492,9 +1492,9 @@ nsXULTreeBuilder::GetTemplateActionCellFor(PRInt32 aRow,
         PRInt32 j = 0;
         for (PRInt32 i = 0; i < count; ++i) {
             nsCOMPtr<nsIContent> child;
-            row->ChildAt(i, *getter_AddRefs(child));
+            row->ChildAt(i, getter_AddRefs(child));
             nsCOMPtr<nsIAtom> tag;
-            child->GetTag(*getter_AddRefs(tag));
+            child->GetTag(getter_AddRefs(tag));
             if (tag == nsXULAtoms::treecell) {
                 nsAutoString ref;
                 child->GetAttr(kNameSpaceID_None, nsXULAtoms::ref, ref);
diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
index 724169c1dd42..46f3c218cd14 100644
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -1161,7 +1161,7 @@ nsDocShell::GetEldestPresContext(nsIPresContext** aPresContext)
         else {
             nsCOMPtr<nsIDocumentViewer> docv(do_QueryInterface(viewer));
             if (docv)
-                rv = docv->GetPresContext(*aPresContext);
+                rv = docv->GetPresContext(aPresContext);
             break;
         }
     }
@@ -1181,7 +1181,7 @@ nsDocShell::GetPresContext(nsIPresContext ** aPresContext)
         nsCOMPtr<nsIDocumentViewer> docv(do_QueryInterface(mContentViewer));
 
         if (docv) {
-            rv = docv->GetPresContext(*aPresContext);
+            rv = docv->GetPresContext(aPresContext);
         }
     }
 
@@ -2078,7 +2078,7 @@ nsDocShell::AddChild(nsIDocShellTreeItem * aChild)
     if (!docv)
         return NS_OK;
     nsCOMPtr<nsIDocument> doc;
-    res = docv->GetDocument(*getter_AddRefs(doc));
+    res = docv->GetDocument(getter_AddRefs(doc));
     if (NS_FAILED(res) || (!doc))
         return NS_OK;
     nsAutoString parentCS;
@@ -3142,7 +3142,7 @@ nsDocShell::Repaint(PRBool aForce)
     NS_ENSURE_TRUE(docViewer, NS_ERROR_FAILURE);
 
     nsCOMPtr<nsIPresContext> context;
-    docViewer->GetPresContext(*getter_AddRefs(context));
+    docViewer->GetPresContext(getter_AddRefs(context));
     NS_ENSURE_TRUE(context, NS_ERROR_FAILURE);
 
     nsCOMPtr<nsIPresShell> shell;
@@ -4788,7 +4788,7 @@ nsDocShell::SetupNewViewer(nsIContentViewer * aNewViewer)
 
         if (docviewer) {
             nsCOMPtr<nsIPresShell> shell;
-            docviewer->GetPresShell(*getter_AddRefs(shell));
+            docviewer->GetPresShell(getter_AddRefs(shell));
 
             if (shell) {
                 nsCOMPtr<nsIViewManager> vm;
@@ -4866,7 +4866,7 @@ nsDocShell::SetupNewViewer(nsIContentViewer * aNewViewer)
 
         if (docviewer) {
             nsCOMPtr<nsIPresShell> shell;
-            docviewer->GetPresShell(*getter_AddRefs(shell));
+            docviewer->GetPresShell(getter_AddRefs(shell));
 
             if (shell) {
                 nsCOMPtr<nsIViewManager> vm;
@@ -5259,7 +5259,7 @@ nsDocShell::GetCurrentDocumentOwner(nsISupports ** aOwner)
             docViewer(do_QueryInterface(mContentViewer));
         if (!docViewer)
             return NS_ERROR_FAILURE;
-        rv = docViewer->GetDocument(*getter_AddRefs(document));
+        rv = docViewer->GetDocument(getter_AddRefs(document));
     }
     else //-- If there's no document loaded yet, look at the parent (frameset)
     {
@@ -5827,7 +5827,7 @@ nsDocShell::ScrollIfAnchor(nsIURI * aURI, PRBool * aWasAnchor,
                 docv(do_QueryInterface(mContentViewer));
             NS_ENSURE_TRUE(docv, NS_ERROR_FAILURE);
             nsCOMPtr<nsIDocument> doc;
-            rv = docv->GetDocument(*getter_AddRefs(doc));
+            rv = docv->GetDocument(getter_AddRefs(doc));
             NS_ENSURE_SUCCESS(rv, NS_ERROR_FAILURE);
             nsAutoString aCharset;
             rv = doc->GetDocumentCharacterSet(aCharset);
@@ -7107,7 +7107,7 @@ nsDocShell::SetBaseUrlForWyciwyg(nsIContentViewer * aContentViewer)
     if (baseURI) {
         nsCOMPtr<nsIDocumentViewer> docViewer(do_QueryInterface(aContentViewer));
         if (docViewer) {
-            rv = docViewer->GetDocument(*getter_AddRefs(document));
+            rv = docViewer->GetDocument(getter_AddRefs(document));
             if (document)
                 rv = document->SetBaseURL(baseURI);
         }
diff --git a/docshell/base/nsWebShell.cpp b/docshell/base/nsWebShell.cpp
index 5613ffc93514..cc1659837da4 100644
--- a/docshell/base/nsWebShell.cpp
+++ b/docshell/base/nsWebShell.cpp
@@ -631,7 +631,7 @@ nsWebShell::OnLinkClickSync(nsIContent *aContent,
 
   if (isJS || isData) {
     nsCOMPtr<nsIDocument> sourceDoc;
-    aContent->GetDocument(*getter_AddRefs(sourceDoc));
+    aContent->GetDocument(getter_AddRefs(sourceDoc));
 
     if (!sourceDoc) {
       // The source is in a 'zombie' document, or not part of a
diff --git a/dom/src/base/nsDOMClassInfo.cpp b/dom/src/base/nsDOMClassInfo.cpp
index 2d3805169442..ab48b212d610 100644
--- a/dom/src/base/nsDOMClassInfo.cpp
+++ b/dom/src/base/nsDOMClassInfo.cpp
@@ -4302,7 +4302,7 @@ nsNodeSH::PreCreate(nsISupports *nativeObj, JSContext *cx, JSObject *globalObj,
   nsCOMPtr<nsIDocument> doc;
 
   if (content) {
-    content->GetDocument(*getter_AddRefs(doc));
+    content->GetDocument(getter_AddRefs(doc));
   }
 
   if (!doc) {
@@ -4357,7 +4357,7 @@ nsNodeSH::PreCreate(nsISupports *nativeObj, JSContext *cx, JSObject *globalObj,
     if (!native_parent) {
       nsCOMPtr<nsIContent> parentContent;
 
-      content->GetParent(*getter_AddRefs(parentContent));
+      content->GetParent(getter_AddRefs(parentContent));
       native_parent = parentContent;
 
       if (!native_parent) {
@@ -4596,7 +4596,7 @@ nsElementSH::PostCreate(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
 
   nsCOMPtr<nsIDocument> doc;
 
-  content->GetDocument(*getter_AddRefs(doc));
+  content->GetDocument(getter_AddRefs(doc));
 
   if (!doc) {
     // There's no baseclass that cares about this call so we just
@@ -5331,7 +5331,7 @@ nsHTMLFormElementSH::FindNamedItem(nsIForm *aForm, JSString *str,
     nsCOMPtr<nsIDOMHTMLFormElement> form_element(do_QueryInterface(aForm));
 
     nsCOMPtr<nsIDocument> doc;
-    content->GetDocument(*getter_AddRefs(doc));
+    content->GetDocument(getter_AddRefs(doc));
 
     nsCOMPtr<nsIHTMLDocument> html_doc(do_QueryInterface(doc));
 
@@ -5623,7 +5623,7 @@ nsHTMLExternalObjSH::GetPluginInstance(nsIXPConnectWrappedNative *wrapper,
 
   nsCOMPtr<nsIDocument> doc;
 
-  content->GetDocument(*getter_AddRefs(doc));
+  content->GetDocument(getter_AddRefs(doc));
 
   if (!doc) {
     // No document, no plugin.
diff --git a/dom/src/base/nsFocusController.cpp b/dom/src/base/nsFocusController.cpp
index 95cba0ab5065..67d6b773d324 100644
--- a/dom/src/base/nsFocusController.cpp
+++ b/dom/src/base/nsFocusController.cpp
@@ -222,12 +222,12 @@ nsFocusController::MoveFocus(PRBool aForward, nsIDOMElement* aElt)
   nsCOMPtr<nsIContent> content;
   if (aElt) {
     content = do_QueryInterface(aElt);
-    content->GetDocument(*getter_AddRefs(doc));
+    content->GetDocument(getter_AddRefs(doc));
   }
   else {
     if (mCurrentElement) {
       content = do_QueryInterface(mCurrentElement);
-      content->GetDocument(*getter_AddRefs(doc));
+      content->GetDocument(getter_AddRefs(doc));
       content = nsnull;
     }
     else if (mCurrentWindow) {
diff --git a/dom/src/base/nsGlobalWindow.cpp b/dom/src/base/nsGlobalWindow.cpp
index 93f6e40ebeeb..fa2ac0c42822 100644
--- a/dom/src/base/nsGlobalWindow.cpp
+++ b/dom/src/base/nsGlobalWindow.cpp
@@ -4100,7 +4100,7 @@ GlobalWindowImpl::GetPrivateParent(nsPIDOMWindow ** aParent)
       return NS_OK;             // This is ok, just means a null parent.
 
     nsCOMPtr<nsIDocument> doc;
-    chromeElement->GetDocument(*getter_AddRefs(doc));
+    chromeElement->GetDocument(getter_AddRefs(doc));
     if (!doc)
       return NS_OK;             // This is ok, just means a null parent.
 
@@ -4142,7 +4142,7 @@ GlobalWindowImpl::GetPrivateRoot(nsIDOMWindowInternal ** aParent)
   nsCOMPtr<nsIContent> chromeElement(do_QueryInterface(mChromeEventHandler));
   if (chromeElement) {
     nsCOMPtr<nsIDocument> doc;
-    chromeElement->GetDocument(*getter_AddRefs(doc));
+    chromeElement->GetDocument(getter_AddRefs(doc));
     if (doc) {
       nsCOMPtr<nsIScriptGlobalObject> globalObject;
       doc->GetScriptGlobalObject(getter_AddRefs(globalObject));
diff --git a/dom/src/base/nsLocation.cpp b/dom/src/base/nsLocation.cpp
index be2f8076fef5..559e8d98284c 100644
--- a/dom/src/base/nsLocation.cpp
+++ b/dom/src/base/nsLocation.cpp
@@ -932,7 +932,7 @@ LocationImpl::GetSourceBaseURL(JSContext* cx, nsIURI** sourceURL)
   nsCOMPtr<nsIDocument> doc;
   nsresult rv = GetSourceDocument(cx, getter_AddRefs(doc));
   if (doc) {
-    rv = doc->GetBaseURL(*sourceURL);
+    rv = doc->GetBaseURL(sourceURL);
 
     if (!*sourceURL) {
       doc->GetDocumentURL(sourceURL);
diff --git a/dom/src/base/nsScreen.cpp b/dom/src/base/nsScreen.cpp
index b595e34f377a..56ddaa1a4989 100644
--- a/dom/src/base/nsScreen.cpp
+++ b/dom/src/base/nsScreen.cpp
@@ -309,7 +309,7 @@ nsIDeviceContext* ScreenImpl::GetDeviceContext()
     return nsnull;
 
   nsCOMPtr<nsIPresContext> presContext;
-  docViewer->GetPresContext(*getter_AddRefs(presContext));
+  docViewer->GetPresContext(getter_AddRefs(presContext));
 
   nsIDeviceContext* context = nsnull;
   if(presContext)
diff --git a/editor/composer/src/nsComposeTxtSrvFilter.cpp b/editor/composer/src/nsComposeTxtSrvFilter.cpp
index e39a5a318a22..ab44d72c8183 100644
--- a/editor/composer/src/nsComposeTxtSrvFilter.cpp
+++ b/editor/composer/src/nsComposeTxtSrvFilter.cpp
@@ -67,7 +67,7 @@ nsComposeTxtSrvFilter::Skip(nsIDOMNode* aNode, PRBool *_retval)
   nsCOMPtr<nsIContent> content(do_QueryInterface(aNode));
   if (content) {
     nsCOMPtr<nsIAtom> tag;
-    content->GetTag(*getter_AddRefs(tag));
+    content->GetTag(getter_AddRefs(tag));
     if (tag) {
       if (tag == mBlockQuoteAtom) {
         if (mIsForMail) {
diff --git a/editor/libeditor/base/nsEditor.cpp b/editor/libeditor/base/nsEditor.cpp
index bdeb190f1e47..a98b45d624e3 100644
--- a/editor/libeditor/base/nsEditor.cpp
+++ b/editor/libeditor/base/nsEditor.cpp
@@ -3927,7 +3927,7 @@ nsEditor::GetTag(nsIDOMNode *aNode)
   
   nsCOMPtr<nsIContent> content = do_QueryInterface(aNode);
   if (content)
-    content->GetTag(*getter_AddRefs(atom));
+    content->GetTag(getter_AddRefs(atom));
 
   return atom;
 }
@@ -4061,7 +4061,7 @@ nsEditor::GetChildAt(nsIDOMNode *aParent, PRInt32 aOffset)
   nsCOMPtr<nsIContent> cChild;
   NS_PRECONDITION(content, "null content in nsEditor::GetChildAt");
   
-  if (NS_FAILED(content->ChildAt(aOffset, *getter_AddRefs(cChild))))
+  if (NS_FAILED(content->ChildAt(aOffset, getter_AddRefs(cChild))))
     return resultNode;
   
   resultNode = do_QueryInterface(cChild);
@@ -5244,14 +5244,15 @@ nsEditor::CreateHTMLContent(const nsAString& aTag, nsIContent** aContent)
   doc = do_QueryInterface(tempDoc);
 
   nsCOMPtr<nsINodeInfoManager> nodeInfoManager;
-  rv = doc->GetNodeInfoManager(*getter_AddRefs(nodeInfoManager));
+  rv = doc->GetNodeInfoManager(getter_AddRefs(nodeInfoManager));
   if (NS_FAILED(rv))
     return rv;
 
   NS_ENSURE_TRUE(nodeInfoManager, NS_ERROR_FAILURE);
 
   nsCOMPtr<nsINodeInfo> nodeInfo;
-  rv = nodeInfoManager->GetNodeInfo(aTag, nsnull, kNameSpaceID_None,*getter_AddRefs(nodeInfo));
+  rv = nodeInfoManager->GetNodeInfo(aTag, nsnull, kNameSpaceID_None,
+                                    getter_AddRefs(nodeInfo));
 
   if (NS_FAILED(rv))
     return rv;
diff --git a/editor/libeditor/html/nsHTMLCSSUtils.cpp b/editor/libeditor/html/nsHTMLCSSUtils.cpp
index 4a89c5e97ca1..b6225a3ef3ea 100644
--- a/editor/libeditor/html/nsHTMLCSSUtils.cpp
+++ b/editor/libeditor/html/nsHTMLCSSUtils.cpp
@@ -341,7 +341,7 @@ nsHTMLCSSUtils::IsCSSEditableProperty(nsIDOMNode * aNode,
   }
   nsCOMPtr<nsIContent> content = do_QueryInterface(node);
   nsCOMPtr<nsIAtom> tagName;
-  content->GetTag(*getter_AddRefs(tagName));
+  content->GetTag(getter_AddRefs(tagName));
 
   // html inline styles B I TT U STRIKE and COLOR/FACE on FONT
   if (nsEditProperty::b == aProperty
@@ -651,8 +651,8 @@ nsHTMLCSSUtils::RemoveCSSInlineStyle(nsIDOMNode *aNode, nsIAtom *aProperty, cons
       // incredible hack in case the only remaining attribute is a _moz_dirty...
       PRInt32 nameSpaceID;
       nsCOMPtr<nsIAtom> attrName, prefix;
-      res = content->GetAttrNameAt(0, nameSpaceID, *getter_AddRefs(attrName),
-                                   *getter_AddRefs(prefix));
+      res = content->GetAttrNameAt(0, &nameSpaceID, getter_AddRefs(attrName),
+                                   getter_AddRefs(prefix));
       if (NS_FAILED(res)) return res;
       nsAutoString attrString, tmp;
       attrName->ToString(attrString);
@@ -905,7 +905,7 @@ nsHTMLCSSUtils::GenerateCSSDeclarationsFromHTMLStyle(nsIDOMNode * aNode,
 
   nsCOMPtr<nsIContent> content = do_QueryInterface(node);
   nsCOMPtr<nsIAtom> tagName;
-  content->GetTag(*getter_AddRefs(tagName));
+  content->GetTag(getter_AddRefs(tagName));
 
   if (nsEditProperty::b == aHTMLProperty) {
     BuildCSSDeclarations(cssPropertyArray, cssValueArray, boldEquivTable, aValue, aGetOrRemoveRequest);
diff --git a/editor/libeditor/html/nsHTMLEditRules.cpp b/editor/libeditor/html/nsHTMLEditRules.cpp
index 7de3170c3bc3..b87cf792da4a 100644
--- a/editor/libeditor/html/nsHTMLEditRules.cpp
+++ b/editor/libeditor/html/nsHTMLEditRules.cpp
@@ -2610,13 +2610,13 @@ nsHTMLEditRules::JoinBlocks(nsCOMPtr<nsIDOMNode> *aLeftBlock,
       nsCOMPtr<nsIDOMNode> childToMove;
       nsCOMPtr<nsIContent> parent(do_QueryInterface(rightList)), child;
       if (!parent) return NS_ERROR_NULL_POINTER;
-      parent->ChildAt(theOffset, *getter_AddRefs(child));
+      parent->ChildAt(theOffset, getter_AddRefs(child));
       while (child)
       {
         childToMove = do_QueryInterface(child);
         res = mHTMLEditor->MoveNode(childToMove, leftList, -1);
         if (NS_FAILED(res)) return res;
-        parent->ChildAt(rightOffset, *getter_AddRefs(child));
+        parent->ChildAt(rightOffset, getter_AddRefs(child));
       }
     }
     else
diff --git a/editor/libeditor/html/nsHTMLEditor.cpp b/editor/libeditor/html/nsHTMLEditor.cpp
index 46a72a006389..ccb738765b1e 100644
--- a/editor/libeditor/html/nsHTMLEditor.cpp
+++ b/editor/libeditor/html/nsHTMLEditor.cpp
@@ -936,7 +936,7 @@ nsHTMLEditor::GetBlockSectionsForRange(nsIDOMRange *aRange,
       if (currentNode)
       {
         nsCOMPtr<nsIAtom> currentContentTag;
-        currentContent->GetTag(*getter_AddRefs(currentContentTag));
+        currentContent->GetTag(getter_AddRefs(currentContentTag));
         // <BR> divides block content ranges.  We can achieve this by nulling out lastRange
         if (nsEditProperty::br==currentContentTag)
         {
@@ -1683,7 +1683,7 @@ nsHTMLEditor::GetDOMEventReceiver(nsIDOMEventReceiver **aEventReceiver)
   if (content) 
   { 
     nsCOMPtr<nsIContent> parent; 
-    if (NS_SUCCEEDED(content->GetParent(*getter_AddRefs(parent))) && parent) 
+    if (NS_SUCCEEDED(content->GetParent(getter_AddRefs(parent))) && parent)
     { 
       PRInt32 index; 
       if (NS_FAILED(parent->IndexOf(content, index)) || index < 0 ) 
@@ -4665,7 +4665,7 @@ nsHTMLEditor::SetCaretInTableCell(nsIDOMElement* aElement)
     if (content)
     {
       nsCOMPtr<nsIAtom> atom;
-      content->GetTag(*getter_AddRefs(atom));
+      content->GetTag(getter_AddRefs(atom));
       if (atom.get() == nsEditProperty::table ||
           atom.get() == nsEditProperty::tbody ||
           atom.get() == nsEditProperty::thead ||
@@ -6007,7 +6007,7 @@ nsHTMLEditor::ParseStyleAttrIntoCSSRule(const nsAString& aString,
   if (!doc)
     return NS_ERROR_UNEXPECTED;
   nsCOMPtr <nsIURI> docURL;
-  doc->GetBaseURL(*getter_AddRefs(docURL));
+  doc->GetBaseURL(getter_AddRefs(docURL));
   nsCOMPtr<nsICSSParser> css;
   nsCOMPtr<nsIStyleRule> mRule;
   nsComponentManager::CreateInstance(kCSSParserCID,
diff --git a/editor/libeditor/html/nsHTMLEditorStyle.cpp b/editor/libeditor/html/nsHTMLEditorStyle.cpp
index ea95f8fcc1cb..1c1d5d2e6d81 100644
--- a/editor/libeditor/html/nsHTMLEditorStyle.cpp
+++ b/editor/libeditor/html/nsHTMLEditorStyle.cpp
@@ -763,8 +763,8 @@ PRBool nsHTMLEditor::IsOnlyAttribute(nsIDOMNode *aNode,
   
   for (i=0; i<attrCount; i++)
   {
-    content->GetAttrNameAt(i, nameSpaceID, *getter_AddRefs(attrName),
-                           *getter_AddRefs(prefix));
+    content->GetAttrNameAt(i, &nameSpaceID, getter_AddRefs(attrName),
+                           getter_AddRefs(prefix));
     nsAutoString attrString, tmp;
     if (!attrName) continue;  // ooops
     attrName->ToString(attrString);
diff --git a/editor/libeditor/html/nsTableEditor.cpp b/editor/libeditor/html/nsTableEditor.cpp
index b59dda1b10a6..8dcce5fba256 100644
--- a/editor/libeditor/html/nsTableEditor.cpp
+++ b/editor/libeditor/html/nsTableEditor.cpp
@@ -181,7 +181,7 @@ PRBool IsRowNode(nsIDOMNode *aNode)
   nsCOMPtr<nsIContent> content = do_QueryInterface(aNode);
   if (content)
   {
-    content->GetTag(*getter_AddRefs(atom));
+    content->GetTag(getter_AddRefs(atom));
     if (atom && atom.get() == nsEditProperty::tr)
       return PR_TRUE;
   }
@@ -282,7 +282,7 @@ nsHTMLEditor::GetFirstRow(nsIDOMElement* aTableElement, nsIDOMNode** aRowNode)
     if (content)
     {
       nsCOMPtr<nsIAtom> atom;
-      content->GetTag(*getter_AddRefs(atom));
+      content->GetTag(getter_AddRefs(atom));
       if (atom.get() == nsEditProperty::tr)
       {
         // Found a row directly under <table>
diff --git a/editor/libeditor/html/nsWSRunObject.cpp b/editor/libeditor/html/nsWSRunObject.cpp
index a2ef72aa7096..d37186d1f3b9 100644
--- a/editor/libeditor/html/nsWSRunObject.cpp
+++ b/editor/libeditor/html/nsWSRunObject.cpp
@@ -1261,7 +1261,7 @@ nsWSRunObject::GetPreviousWSNode(nsIDOMNode *aStartNode,
     }
   }
   
-  nsresult res = startContent->ChildAt(aOffset-1, *getter_AddRefs(priorContent));
+  nsresult res = startContent->ChildAt(aOffset - 1, getter_AddRefs(priorContent));
   NS_ENSURE_SUCCESS(res, res);
   if (!priorContent) 
     return NS_ERROR_NULL_POINTER;
@@ -1355,7 +1355,7 @@ nsWSRunObject::GetNextWSNode(nsIDOMNode *aStartNode,
     return GetNextWSNode(aStartNode, aBlockParent, aNextNode);
   
   nsCOMPtr<nsIContent> nextContent, startContent( do_QueryInterface(aStartNode) );
-  nsresult res = startContent->ChildAt(aOffset, *getter_AddRefs(nextContent));
+  nsresult res = startContent->ChildAt(aOffset, getter_AddRefs(nextContent));
   NS_ENSURE_SUCCESS(res, res);
   if (!nextContent)
   {
diff --git a/editor/libeditor/text/nsPlaintextEditor.cpp b/editor/libeditor/text/nsPlaintextEditor.cpp
index 3f9ea0561a0a..23ce3e473ac7 100644
--- a/editor/libeditor/text/nsPlaintextEditor.cpp
+++ b/editor/libeditor/text/nsPlaintextEditor.cpp
@@ -834,7 +834,7 @@ nsPlaintextEditor::GetDOMEventReceiver(nsIDOMEventReceiver **aEventReceiver)
   if (content) 
   { 
     nsCOMPtr<nsIContent> parent; 
-    if (NS_SUCCEEDED(content->GetParent(*getter_AddRefs(parent))) && parent) 
+    if (NS_SUCCEEDED(content->GetParent(getter_AddRefs(parent))) && parent)
     { 
       PRInt32 index; 
       if (NS_FAILED(parent->IndexOf(content, index)) || index < 0 ) 
diff --git a/editor/libeditor/text/nsTextEditRules.cpp b/editor/libeditor/text/nsTextEditRules.cpp
index 12c326765737..a8a24edde686 100644
--- a/editor/libeditor/text/nsTextEditRules.cpp
+++ b/editor/libeditor/text/nsTextEditRules.cpp
@@ -906,7 +906,7 @@ nsTextEditRules::WillDeleteSelection(nsISelection *aSelection,
       if (!content) return NS_ERROR_NULL_POINTER;
       if (aCollapsedAction == nsIEditor::ePrevious)
         --startOffset;
-      res = content->ChildAt(startOffset, *getter_AddRefs(child));
+      res = content->ChildAt(startOffset, getter_AddRefs(child));
       if (NS_FAILED(res)) return res;
       nextNode = do_QueryInterface(child);
       
@@ -928,7 +928,7 @@ nsTextEditRules::WillDeleteSelection(nsISelection *aSelection,
         if (aCollapsedAction == nsIEditor::ePrevious)
           --startOffset;
           // don't need to increment startOffset for nsIEditor::eNext
-        res = content->ChildAt(startOffset, *getter_AddRefs(child));
+        res = content->ChildAt(startOffset, getter_AddRefs(child));
         if (NS_FAILED(res)) return res;
         nextNode = do_QueryInterface(child);
       }
diff --git a/editor/txtsvc/src/nsFilteredContentIterator.cpp b/editor/txtsvc/src/nsFilteredContentIterator.cpp
index 780c0ccd8ed0..2b8bf5950350 100644
--- a/editor/txtsvc/src/nsFilteredContentIterator.cpp
+++ b/editor/txtsvc/src/nsFilteredContentIterator.cpp
@@ -229,7 +229,7 @@ ContentToParentOffset(nsIContent *aContent, nsIDOMNode **aParent, PRInt32 *aOffs
     return;
 
   nsCOMPtr<nsIContent> parent;
-  nsresult rv = aContent->GetParent(*getter_AddRefs(parent));
+  nsresult rv = aContent->GetParent(getter_AddRefs(parent));
 
   if (NS_FAILED(rv) || !parent)
     return;
diff --git a/editor/txtsvc/src/nsTextServicesDocument.cpp b/editor/txtsvc/src/nsTextServicesDocument.cpp
index 3d2186b80323..a20bdd82da8c 100644
--- a/editor/txtsvc/src/nsTextServicesDocument.cpp
+++ b/editor/txtsvc/src/nsTextServicesDocument.cpp
@@ -3208,7 +3208,7 @@ nsTextServicesDocument::IsBlockNode(nsIContent *aContent)
 {
   nsCOMPtr<nsIAtom> atom;
 
-  aContent->GetTag(*getter_AddRefs(atom));
+  aContent->GetTag(getter_AddRefs(atom));
 
   if (!atom)
     return PR_TRUE;
@@ -3251,12 +3251,12 @@ nsTextServicesDocument::HasSameBlockNodeParent(nsIContent *aContent1, nsIContent
   nsCOMPtr<nsIContent> p2;
   nsresult result;
 
-  result = aContent1->GetParent(*getter_AddRefs(p1));
+  result = aContent1->GetParent(getter_AddRefs(p1));
 
   if (NS_FAILED(result))
     return PR_FALSE;
 
-  result = aContent2->GetParent(*getter_AddRefs(p2));
+  result = aContent2->GetParent(getter_AddRefs(p2));
 
   if (NS_FAILED(result))
     return PR_FALSE;
@@ -3272,7 +3272,7 @@ nsTextServicesDocument::HasSameBlockNodeParent(nsIContent *aContent1, nsIContent
 
   while (p1 && !IsBlockNode(p1))
   {
-    result = p1->GetParent(*getter_AddRefs(tmp));
+    result = p1->GetParent(getter_AddRefs(tmp));
 
     if (NS_FAILED(result))
       return PR_FALSE;
@@ -3282,7 +3282,7 @@ nsTextServicesDocument::HasSameBlockNodeParent(nsIContent *aContent1, nsIContent
 
   while (p2 && !IsBlockNode(p2))
   {
-    result = p2->GetParent(*getter_AddRefs(tmp));
+    result = p2->GetParent(getter_AddRefs(tmp));
 
     if (NS_FAILED(result))
       return PR_FALSE;
@@ -5042,7 +5042,7 @@ nsTextServicesDocument::PrintContentNode(nsIContent *aContent)
   nsCOMPtr<nsIAtom> atom;
   nsresult result;
 
-  aContent->GetTag(*getter_AddRefs(atom));
+  aContent->GetTag(getter_AddRefs(atom));
   atom->ToString(tmpStr);
   printf("%s", NS_LossyConvertUCS2toASCII(tmpStr).get());
 
diff --git a/embedding/browser/activex/src/plugin/LegacyPlugin.cpp b/embedding/browser/activex/src/plugin/LegacyPlugin.cpp
index c3641f6936f2..1358c9b2c646 100644
--- a/embedding/browser/activex/src/plugin/LegacyPlugin.cpp
+++ b/embedding/browser/activex/src/plugin/LegacyPlugin.cpp
@@ -856,7 +856,7 @@ NewControl(const char *pluginType,
                         if (doc)
                         {
                             nsCOMPtr<nsIURI> baseURI;
-                            doc->GetBaseURL(*getter_AddRefs(baseURI));
+                            doc->GetBaseURL(getter_AddRefs(baseURI));
                             if (baseURI)
                             {
                                 nsCAutoString newURL;
diff --git a/embedding/browser/activex/src/plugin/XPCDocument.cpp b/embedding/browser/activex/src/plugin/XPCDocument.cpp
index e4e5901fbe5c..4e4ff626841f 100644
--- a/embedding/browser/activex/src/plugin/XPCDocument.cpp
+++ b/embedding/browser/activex/src/plugin/XPCDocument.cpp
@@ -1901,7 +1901,7 @@ END_COM_MAP()
         if (doc)
         {
             nsCOMPtr<nsIURI> baseURI;
-            doc->GetBaseURL(*getter_AddRefs(baseURI));
+            doc->GetBaseURL(getter_AddRefs(baseURI));
             nsCAutoString spec;
             if (baseURI &&
                 NS_SUCCEEDED(baseURI->GetSpec(spec)))
diff --git a/embedding/browser/webBrowser/nsContextMenuInfo.cpp b/embedding/browser/webBrowser/nsContextMenuInfo.cpp
index 4c021152a2fa..350ae2be6282 100644
--- a/embedding/browser/webBrowser/nsContextMenuInfo.cpp
+++ b/embedding/browser/webBrowser/nsContextMenuInfo.cpp
@@ -249,7 +249,7 @@ nsContextMenuInfo::GetBackgroundImageRequest(nsIDOMNode * aDOMNode, imgIRequest
 
   // Get Document
   nsCOMPtr<nsIDocument> document;
-  content->GetDocument(*getter_AddRefs(document));
+  content->GetDocument(getter_AddRefs(document));
   NS_ENSURE_TRUE(document, NS_ERROR_FAILURE);
   
   // Get shell
@@ -330,7 +330,7 @@ nsContextMenuInfo::GetBackgroundImageRequest(nsIDOMNode * aDOMNode, imgIRequest
 // Perhaps there is a better, pubically supported way to get the same thing done?
 ////////
 
-// nethod GetFrameForBackgroundUpdate
+// method GetFrameForBackgroundUpdate
 //
 // If the frame (aFrame) is the HTML or BODY frame then find the canvas frame and set the
 // aBGFrame param to that. This is used when we need a frame to invalidate after an asynch
@@ -353,7 +353,7 @@ nsresult nsContextMenuInfo::GetFrameForBackgroundUpdate(nsIPresContext *aPresCon
     if (pContent) {
        // make sure that this is the HTML or BODY element
       nsCOMPtr<nsIAtom> tag;
-      pContent->GetTag(*(getter_AddRefs(tag)));
+      pContent->GetTag(getter_AddRefs(tag));
       nsCOMPtr<nsIAtom> mTag_html = getter_AddRefs(NS_NewAtom("html"));
       nsCOMPtr<nsIAtom> mTag_body = getter_AddRefs(NS_NewAtom("body"));
       if (tag && 
diff --git a/embedding/browser/webBrowser/nsDocShellTreeOwner.cpp b/embedding/browser/webBrowser/nsDocShellTreeOwner.cpp
index 82d967ee8bc5..d815bca59a2c 100644
--- a/embedding/browser/webBrowser/nsDocShellTreeOwner.cpp
+++ b/embedding/browser/webBrowser/nsDocShellTreeOwner.cpp
@@ -918,7 +918,7 @@ NS_IMETHODIMP DefaultTooltipTextProvider::GetNodeText(nsIDOMNode *aNode, PRUnich
       nsCOMPtr<nsIContent> content(do_QueryInterface(currElement));
       if (content) {
         nsCOMPtr<nsIAtom> tagAtom;
-        content->GetTag(*getter_AddRefs(tagAtom));
+        content->GetTag(getter_AddRefs(tagAtom));
         if (tagAtom != mTag_dialog &&
             tagAtom != mTag_dialogheader &&
             tagAtom != mTag_window) {
diff --git a/embedding/components/find/src/nsFind.cpp b/embedding/components/find/src/nsFind.cpp
index 1344ddd1a18c..50b0f4e9d4ae 100644
--- a/embedding/components/find/src/nsFind.cpp
+++ b/embedding/components/find/src/nsFind.cpp
@@ -432,7 +432,7 @@ nsFind::NextNode(nsIDOMRange* aSearchRange,
 PRBool nsFind::IsBlockNode(nsIContent* aContent)
 {
   nsCOMPtr<nsIAtom> atom;
-  aContent->GetTag(*getter_AddRefs(atom));
+  aContent->GetTag(getter_AddRefs(atom));
 
   if (atom.get() == sImgAtom || atom.get() == sHRAtom
       || atom.get() == sThAtom || atom.get() == sTdAtom)
@@ -459,7 +459,7 @@ PRBool nsFind::IsTextNode(nsIDOMNode* aNode)
   nsCOMPtr<nsIContent> content (do_QueryInterface(aNode));
   if (!content) return PR_FALSE;
   nsCOMPtr<nsIAtom> atom;
-  content->GetTag(*getter_AddRefs(atom));
+  content->GetTag(getter_AddRefs(atom));
   if (atom.get() == sTextAtom)
     return PR_TRUE;
   return PR_FALSE;
@@ -472,7 +472,7 @@ PRBool nsFind::IsVisibleNode(nsIDOMNode *aDOMNode)
     return PR_FALSE;
 
   nsCOMPtr<nsIDocument> doc;
-  content->GetDocument(*getter_AddRefs(doc));
+  content->GetDocument(getter_AddRefs(doc));
   if (!doc)
     return PR_FALSE;
 
@@ -496,7 +496,7 @@ PRBool nsFind::SkipNode(nsIContent* aContent)
   nsCOMPtr<nsIAtom> atom;
 
 #ifdef HAVE_BIDI_ITERATOR
-  aContent->GetTag(*getter_AddRefs(atom));
+  aContent->GetTag(getter_AddRefs(atom));
   if (!atom)
     return PR_TRUE;
   nsIAtom *atomPtr = atom.get();
@@ -518,7 +518,7 @@ PRBool nsFind::SkipNode(nsIContent* aContent)
   {
     nsCOMPtr<nsIContent> content (do_QueryInterface(node));
     if (!content) return PR_FALSE;
-    content->GetTag(*getter_AddRefs(atom));
+    content->GetTag(getter_AddRefs(atom));
     if (!atom)
       return PR_FALSE;
     nsAutoString atomName;
diff --git a/embedding/components/webbrowserpersist/src/nsWebBrowserPersist.cpp b/embedding/components/webbrowserpersist/src/nsWebBrowserPersist.cpp
index 4b2dad75de6f..72d08bb972b9 100644
--- a/embedding/components/webbrowserpersist/src/nsWebBrowserPersist.cpp
+++ b/embedding/components/webbrowserpersist/src/nsWebBrowserPersist.cpp
@@ -1407,7 +1407,7 @@ nsresult nsWebBrowserPersist::SaveDocumentInternal(
     nsCOMPtr<nsIURI> oldBaseURI = mCurrentBaseURI;
 
     // Store the base URI
-    doc->GetBaseURL(*getter_AddRefs(mCurrentBaseURI));
+    doc->GetBaseURL(getter_AddRefs(mCurrentBaseURI));
 
     // Does the caller want to fixup the referenced URIs and save those too?
     if (aDataPath)
diff --git a/embedding/components/windowwatcher/src/nsWindowWatcher.cpp b/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
index 3f3cf9d26771..915b54ad1a08 100644
--- a/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
+++ b/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
@@ -696,7 +696,7 @@ nsWindowWatcher::OpenWindowJS(nsIDOMWindow *aParent,
       nsCOMPtr<nsIDocumentViewer> parentDocViewer(do_QueryInterface(parentContentViewer));
       if (parentDocViewer) {
         nsCOMPtr<nsIDocument> doc;
-        parentDocViewer->GetDocument(*getter_AddRefs(doc));
+        parentDocViewer->GetDocument(getter_AddRefs(doc));
         
         nsCOMPtr<nsIContentViewer> newContentViewer;
         newDocShell->GetContentViewer(getter_AddRefs(newContentViewer));
@@ -1140,7 +1140,7 @@ nsWindowWatcher::URIfromURL(const char *aURL,
       nsCOMPtr<nsIDocument> doc;
       doc = do_QueryInterface(domDoc);
       if (doc) {
-        doc->GetBaseURL(*getter_AddRefs(baseURI));
+        doc->GetBaseURL(getter_AddRefs(baseURI));
 
         if (!baseURI) {
           doc->GetDocumentURL(getter_AddRefs(baseURI));
diff --git a/extensions/cookie/nsImgManager.cpp b/extensions/cookie/nsImgManager.cpp
index d77169ae2fa1..24ab5bdf5ff1 100644
--- a/extensions/cookie/nsImgManager.cpp
+++ b/extensions/cookie/nsImgManager.cpp
@@ -158,16 +158,16 @@ NS_IMETHODIMP nsImgManager::ShouldLoad(PRInt32 aContentType,
     nsCOMPtr<nsIContent> content = do_QueryInterface(aContext);
     NS_ASSERTION(content, "no content available");
     if (content) {
-      rv = content->GetDocument(*getter_AddRefs(doc));
+      rv = content->GetDocument(getter_AddRefs(doc));
       if (NS_FAILED(rv) || !doc) {
-        rv = content->GetNodeInfo(*getter_AddRefs(nodeinfo));
+        rv = content->GetNodeInfo(getter_AddRefs(nodeinfo));
         if (NS_FAILED(rv) || !nodeinfo) return rv;
 
-        rv = nodeinfo->GetDocument(*getter_AddRefs(doc));
+        rv = nodeinfo->GetDocument(getter_AddRefs(doc));
         if (NS_FAILED(rv) || !doc) return rv;
       }
 
-      rv = doc->GetBaseURL(*getter_AddRefs(baseURI));
+      rv = doc->GetBaseURL(getter_AddRefs(baseURI));
       if (NS_FAILED(rv) || !baseURI) return rv;
 
       nsCOMPtr<nsIDocShell> docshell;
diff --git a/extensions/inspector/base/src/inDOMView.cpp b/extensions/inspector/base/src/inDOMView.cpp
index 48090138bf7d..d75d2de59df5 100644
--- a/extensions/inspector/base/src/inDOMView.cpp
+++ b/extensions/inspector/base/src/inDOMView.cpp
@@ -741,14 +741,19 @@ inDOMView::AttributeChanged(nsIDocument *aDocument, nsIContent* aContent, PRInt3
 }
 
 NS_IMETHODIMP
-inDOMView::ContentAppended(nsIDocument *aDocument, nsIContent* aContainer, PRInt32 aNewIndexInContainer)
+inDOMView::ContentAppended(nsIDocument *aDocument,
+                           nsIContent* aContainer,
+                           PRInt32 aNewIndexInContainer)
 {
-  if (!mTree)
+  if (!mTree) {
     return NS_ERROR_FAILURE;
+  }
 
   nsCOMPtr<nsIContent> child;
-  aContainer->ChildAt(aNewIndexInContainer, *getter_AddRefs(child));
-  return ContentInserted(aDocument, aContainer, child, aNewIndexInContainer);
+  aContainer->ChildAt(aNewIndexInContainer, getter_AddRefs(child));
+
+  return ContentInserted(aDocument, aContainer, child,
+                         aNewIndexInContainer);
 }
 
 NS_IMETHODIMP
diff --git a/extensions/inspector/base/src/inLayoutUtils.cpp b/extensions/inspector/base/src/inLayoutUtils.cpp
index 674559774ad9..142741ff99ff 100644
--- a/extensions/inspector/base/src/inLayoutUtils.cpp
+++ b/extensions/inspector/base/src/inLayoutUtils.cpp
@@ -175,7 +175,7 @@ inLayoutUtils::GetScreenOrigin(nsIDOMElement* aElement)
  
   nsCOMPtr<nsIContent> content = do_QueryInterface(aElement);
   nsCOMPtr<nsIDocument> doc;
-  content->GetDocument(*getter_AddRefs(doc));
+  content->GetDocument(getter_AddRefs(doc));
 
   if (doc) {
     // Get Presentation shell 0
@@ -262,7 +262,7 @@ inLayoutUtils::GetSubDocumentFor(nsIDOMNode* aNode)
   nsCOMPtr<nsIContent> content = do_QueryInterface(aNode);
   if (content) {
     nsCOMPtr<nsIDocument> doc;
-    content->GetDocument(*getter_AddRefs(doc));
+    content->GetDocument(getter_AddRefs(doc));
     if (doc) {
       nsCOMPtr<nsIDocument> sub_doc;
       doc->GetSubDocumentFor(content, getter_AddRefs(sub_doc));
diff --git a/extensions/transformiix/source/base/txURIUtils.cpp b/extensions/transformiix/source/base/txURIUtils.cpp
index 080f976fb014..a128ba226f99 100644
--- a/extensions/transformiix/source/base/txURIUtils.cpp
+++ b/extensions/transformiix/source/base/txURIUtils.cpp
@@ -246,10 +246,10 @@ PRBool URIUtils::CanCallerAccess(nsIDOMNode *aNode)
         if (!domDoc) {
             nsCOMPtr<nsINodeInfo> ni;
             if (content) {
-                content->GetNodeInfo(*getter_AddRefs(ni));
+                content->GetNodeInfo(getter_AddRefs(ni));
             }
             else {
-                attr->GetNodeInfo(*getter_AddRefs(ni));
+                attr->GetNodeInfo(getter_AddRefs(ni));
             }
 
             if (!ni) {
diff --git a/extensions/transformiix/source/xml/dom/mozImpl/MozillaAttr.cpp b/extensions/transformiix/source/xml/dom/mozImpl/MozillaAttr.cpp
index 359b344213e8..9d80103e2a1d 100644
--- a/extensions/transformiix/source/xml/dom/mozImpl/MozillaAttr.cpp
+++ b/extensions/transformiix/source/xml/dom/mozImpl/MozillaAttr.cpp
@@ -55,7 +55,7 @@ Attr::Attr(nsIDOMAttr* aAttr, Document* aOwner) : Node(aAttr, aOwner)
     if (!ns.IsEmpty()) {
         NS_ASSERTION(gTxNameSpaceManager,"No namespace manager");
         if (gTxNameSpaceManager) {
-            gTxNameSpaceManager->GetNameSpaceID(ns, mNamespaceID);
+            gTxNameSpaceManager->GetNameSpaceID(ns, &mNamespaceID);
         }
     }
     mNSId = mNamespaceID;
diff --git a/extensions/transformiix/source/xml/dom/mozImpl/MozillaDocument.cpp b/extensions/transformiix/source/xml/dom/mozImpl/MozillaDocument.cpp
index 992e5608adac..dd625839dbf0 100644
--- a/extensions/transformiix/source/xml/dom/mozImpl/MozillaDocument.cpp
+++ b/extensions/transformiix/source/xml/dom/mozImpl/MozillaDocument.cpp
@@ -320,7 +320,7 @@ Attr* Document::createAttribute(nsIDOMAttr* aAttr)
     if (!ns.IsEmpty()) {
         NS_ASSERTION(gTxNameSpaceManager, "No namespace manager");
         if (gTxNameSpaceManager) {
-            gTxNameSpaceManager->GetNameSpaceID(ns, namespaceID);
+            gTxNameSpaceManager->GetNameSpaceID(ns, &namespaceID);
         }
     }
 
diff --git a/extensions/transformiix/source/xml/dom/mozImpl/MozillaElement.cpp b/extensions/transformiix/source/xml/dom/mozImpl/MozillaElement.cpp
index fdf37a439dfc..40a65e0abb78 100644
--- a/extensions/transformiix/source/xml/dom/mozImpl/MozillaElement.cpp
+++ b/extensions/transformiix/source/xml/dom/mozImpl/MozillaElement.cpp
@@ -44,9 +44,9 @@ Element::Element(nsIDOMElement* aElement, Document* aOwner) :
     nsCOMPtr<nsIContent> cont(do_QueryInterface(aElement));
     NS_ASSERTION(cont, "Element doesn't implement nsIContent");
     nsCOMPtr<nsINodeInfo> nodeInfo;
-    cont->GetNodeInfo(*getter_AddRefs(nodeInfo));
+    cont->GetNodeInfo(getter_AddRefs(nodeInfo));
     NS_ASSERTION(nodeInfo, "a element without nodeinfo");
-    nodeInfo->GetNamespaceID(mNamespaceID);
+    mNamespaceID = nodeInfo->GetNamespaceID();
 }
 
 /**
@@ -116,6 +116,6 @@ MBool Element::getLocalName(nsIAtom** aLocalName)
     if (!cont) {
         return MB_FALSE;
     }
-    cont->GetTag(*aLocalName);
+    cont->GetTag(aLocalName);
     return MB_TRUE;
 }
diff --git a/extensions/transformiix/source/xml/dom/mozImpl/MozillaNode.cpp b/extensions/transformiix/source/xml/dom/mozImpl/MozillaNode.cpp
index 1abbd73a4a5f..282126d28eb8 100644
--- a/extensions/transformiix/source/xml/dom/mozImpl/MozillaNode.cpp
+++ b/extensions/transformiix/source/xml/dom/mozImpl/MozillaNode.cpp
@@ -344,7 +344,7 @@ PRInt32 Node::lookupNamespaceID(nsIAtom* aPrefix)
         }
 
         nsCOMPtr<nsIContent> temp(elem);
-        rv = temp->GetParent(*getter_AddRefs(elem));
+        rv = temp->GetParent(getter_AddRefs(elem));
         NS_ENSURE_SUCCESS(rv, kNameSpaceID_Unknown);
     }
 
@@ -466,9 +466,9 @@ Node::OrderInfo* Node::getOrderInfo()
                 nsCOMPtr<nsIAtom> attPrefix;
                 PRInt32 attNS;
                 owner->GetAttrNameAt(i,
-                                     attNS,
-                                     *getter_AddRefs(attName),
-                                     *getter_AddRefs(attPrefix));
+                                     &attNS,
+                                     getter_AddRefs(attName),
+                                     getter_AddRefs(attPrefix));
 
                 if (attName == thisName && attNS == thisNS) {
                     mOrderInfo->mOrder[lastElem] = i + kTxAttrIndexOffset;
diff --git a/extensions/transformiix/source/xslt/txMozillaStylesheetCompiler.cpp b/extensions/transformiix/source/xslt/txMozillaStylesheetCompiler.cpp
index f8009a61dcec..b30e8c8c6bae 100644
--- a/extensions/transformiix/source/xslt/txMozillaStylesheetCompiler.cpp
+++ b/extensions/transformiix/source/xslt/txMozillaStylesheetCompiler.cpp
@@ -574,13 +574,11 @@ handleNode(nsIDOMNode* aNode, txStylesheetCompiler* aCompiler)
             nsCOMPtr<nsIContent> element = do_QueryInterface(aNode);
 
             nsCOMPtr<nsINodeInfo> ni;
-            element->GetNodeInfo(*getter_AddRefs(ni));
+            element->GetNodeInfo(getter_AddRefs(ni));
 
-            PRInt32 namespaceID;
-            nsCOMPtr<nsIAtom> prefix, localname;
-            ni->GetNamespaceID(namespaceID);
-            ni->GetNameAtom(*getter_AddRefs(localname));
-            ni->GetPrefixAtom(*getter_AddRefs(prefix));
+            PRInt32 namespaceID = ni->GetNamespaceID();
+            nsCOMPtr<nsIAtom> localname = ni->GetNameAtom();
+            nsCOMPtr<nsIAtom> prefix = ni->GetPrefixAtom();
 
             PRInt32 attsCount;
             element->GetAttrCount(attsCount);
@@ -592,9 +590,9 @@ handleNode(nsIDOMNode* aNode, txStylesheetCompiler* aCompiler)
                 PRInt32 counter;
                 for (counter = 0; counter < attsCount; ++counter) {
                     txStylesheetAttr& att = atts[counter];
-                    element->GetAttrNameAt(counter, att.mNamespaceID,
-                                           *getter_AddRefs(att.mLocalName),
-                                           *getter_AddRefs(att.mPrefix));
+                    element->GetAttrNameAt(counter, &att.mNamespaceID,
+                                           getter_AddRefs(att.mLocalName),
+                                           getter_AddRefs(att.mPrefix));
                     element->GetAttr(att.mNamespaceID, att.mLocalName, att.mValue);
                 }
             }
@@ -611,7 +609,7 @@ handleNode(nsIDOMNode* aNode, txStylesheetCompiler* aCompiler)
             if (childCount > 0) {
                 PRInt32 counter = 0;
                 nsCOMPtr<nsIContent> child;
-                while (NS_SUCCEEDED(element->ChildAt(counter++, *getter_AddRefs(child))) && child) {
+                while (NS_SUCCEEDED(element->ChildAt(counter++, getter_AddRefs(child))) && child) {
                     nsCOMPtr<nsIDOMNode> childNode = do_QueryInterface(child);
                     rv = handleNode(childNode, aCompiler);
                     NS_ENSURE_SUCCESS(rv, rv);
@@ -641,7 +639,7 @@ handleNode(nsIDOMNode* aNode, txStylesheetCompiler* aCompiler)
             if (childCount > 0) {
                 PRInt32 counter = 0;
                 nsCOMPtr<nsIContent> child;
-                while (NS_SUCCEEDED(document->ChildAt(counter++, *getter_AddRefs(child))) && child) {
+                while (NS_SUCCEEDED(document->ChildAt(counter++, getter_AddRefs(child))) && child) {
                     nsCOMPtr<nsIDOMNode> childNode = do_QueryInterface(child);
                     rv = handleNode(childNode, aCompiler);
                     NS_ENSURE_SUCCESS(rv, rv);
@@ -765,7 +763,7 @@ TX_CompileStylesheet(nsIDOMNode* aNode, txStylesheet** aStylesheet)
 
     nsCOMPtr<nsIDocument> doc = do_QueryInterface(document);
     nsCOMPtr<nsIURI> uri;
-    doc->GetBaseURL(*getter_AddRefs(uri));
+    doc->GetBaseURL(getter_AddRefs(uri));
     nsCAutoString baseURI;
     uri->GetSpec(baseURI);
 
diff --git a/extensions/transformiix/source/xslt/txMozillaTextOutput.cpp b/extensions/transformiix/source/xslt/txMozillaTextOutput.cpp
index 02d263bd5d7f..1142f5c86daa 100644
--- a/extensions/transformiix/source/xslt/txMozillaTextOutput.cpp
+++ b/extensions/transformiix/source/xslt/txMozillaTextOutput.cpp
@@ -183,7 +183,7 @@ void txMozillaTextOutput::createResultDocument(nsIDOMDocument* aSourceDocument,
     }
     doc->Reset(channel, loadGroup);
     nsCOMPtr<nsIURI> baseURL;
-    sourceDoc->GetBaseURL(*getter_AddRefs(baseURL));
+    sourceDoc->GetBaseURL(getter_AddRefs(baseURL));
     doc->SetBaseURL(baseURL);
 
     // Notify the contentsink that the document is created
diff --git a/extensions/transformiix/source/xslt/txMozillaXMLOutput.cpp b/extensions/transformiix/source/xslt/txMozillaXMLOutput.cpp
index 6d244ad79ba0..cad5bd80193b 100644
--- a/extensions/transformiix/source/xslt/txMozillaXMLOutput.cpp
+++ b/extensions/transformiix/source/xslt/txMozillaXMLOutput.cpp
@@ -213,7 +213,7 @@ void txMozillaXMLOutput::endDocument()
             nsCOMPtr<nsIRefreshURI> refURI = do_QueryInterface(docShell);
             if (refURI) {
                 nsCOMPtr<nsIURI> baseURI;
-                doc->GetBaseURL(*getter_AddRefs(baseURI));
+                doc->GetBaseURL(getter_AddRefs(baseURI));
                 refURI->SetupRefreshURIFromHeader(baseURI, mRefreshString);
             }
         }
@@ -431,7 +431,7 @@ void txMozillaXMLOutput::closePrevious(PRInt8 aAction)
             PRInt32 childCount, i;
             document->GetChildCount(childCount);
             for (i = 0; i < childCount; ++i) {
-                document->ChildAt(0, *getter_AddRefs(childContent));
+                document->ChildAt(0, getter_AddRefs(childContent));
                 if (childContent == mRootContent) {
                     document->SetRootContent(nsnull);
                 }
@@ -494,7 +494,7 @@ void txMozillaXMLOutput::startHTMLElement(nsIDOMElement* aElement)
 {
     nsCOMPtr<nsIAtom> atom;
     nsCOMPtr<nsIContent> content = do_QueryInterface(aElement);
-    content->GetTag(*getter_AddRefs(atom));
+    content->GetTag(getter_AddRefs(atom));
 
     mDontAddCurrent = (atom == txHTMLAtoms::script);
 
@@ -538,7 +538,7 @@ void txMozillaXMLOutput::endHTMLElement(nsIDOMElement* aElement,
     NS_ASSERTION(content, "Can't QI to nsIContent");
 
     nsCOMPtr<nsIAtom> atom;
-    content->GetTag(*getter_AddRefs(atom));
+    content->GetTag(getter_AddRefs(atom));
 
     // add <tbody> to tables if there is none (not in xhtml)
     if (atom == txHTMLAtoms::table && !aXHTML) {
@@ -549,7 +549,7 @@ void txMozillaXMLOutput::endHTMLElement(nsIDOMElement* aElement,
 
         content->ChildCount(count);
         while (!section && (i < count)) {
-            rv = content->ChildAt(i, *getter_AddRefs(childContent));
+            rv = content->ChildAt(i, getter_AddRefs(childContent));
             NS_ASSERTION(NS_SUCCEEDED(rv), "Something went wrong while getting a child");
             section = do_QueryInterface(childContent);
             ++i;
@@ -736,7 +736,7 @@ txMozillaXMLOutput::createResultDocument(const nsAString& aName, PRInt32 aNsID,
     }
     doc->Reset(channel, loadGroup);
     nsCOMPtr<nsIURI> baseURL;
-    sourceDoc->GetBaseURL(*getter_AddRefs(baseURL));
+    sourceDoc->GetBaseURL(getter_AddRefs(baseURL));
     doc->SetBaseURL(baseURL);
 
     // Set the mime-type
diff --git a/extensions/transformiix/source/xslt/txMozillaXSLTProcessor.cpp b/extensions/transformiix/source/xslt/txMozillaXSLTProcessor.cpp
index 39b65522df09..aeb634b29fe8 100644
--- a/extensions/transformiix/source/xslt/txMozillaXSLTProcessor.cpp
+++ b/extensions/transformiix/source/xslt/txMozillaXSLTProcessor.cpp
@@ -763,7 +763,7 @@ txMozillaXSLTProcessor::notifyError()
     }
     document->Reset(channel, loadGroup);
     nsCOMPtr<nsIURI> baseURL;
-    sourceDoc->GetBaseURL(*getter_AddRefs(baseURL));
+    sourceDoc->GetBaseURL(getter_AddRefs(baseURL));
     document->SetBaseURL(baseURL);
 
     NS_NAMED_LITERAL_STRING(ns, "http://www.mozilla.org/newlayout/xml/parsererror.xml");
diff --git a/extensions/transformiix/source/xslt/txXSLTPatterns.cpp b/extensions/transformiix/source/xslt/txXSLTPatterns.cpp
index 38c8ad51682c..dad7142c8a27 100644
--- a/extensions/transformiix/source/xslt/txXSLTPatterns.cpp
+++ b/extensions/transformiix/source/xslt/txXSLTPatterns.cpp
@@ -357,7 +357,7 @@ MBool txIdPattern::matches(Node* aNode, txIMatchContext* aContext)
         return MB_FALSE;
     }
     nsCOMPtr<nsINodeInfo> ni;
-    content->GetNodeInfo(*getter_AddRefs(ni));
+    content->GetNodeInfo(getter_AddRefs(ni));
     if (!ni) {
         return MB_FALSE;
     }
diff --git a/gfx/src/gtk/nsNativeThemeGTK.cpp b/gfx/src/gtk/nsNativeThemeGTK.cpp
index 4b80259adf11..48c34a8024e0 100644
--- a/gfx/src/gtk/nsNativeThemeGTK.cpp
+++ b/gfx/src/gtk/nsNativeThemeGTK.cpp
@@ -103,7 +103,7 @@ static void GetPrimaryPresShell(nsIFrame* aFrame, nsIPresShell** aResult)
   nsCOMPtr<nsIDocument> doc;
   nsCOMPtr<nsIContent> content;
   aFrame->GetContent(getter_AddRefs(content));
-  content->GetDocument(*getter_AddRefs(doc));
+  content->GetDocument(getter_AddRefs(doc));
   if (doc)
     doc->GetShellAt(0, aResult); // Addref happens here.
 }
@@ -259,7 +259,7 @@ nsNativeThemeGTK::GetGtkWidgetAndState(PRUint8 aWidgetType, nsIFrame* aFrame,
           aFrame->GetParent(&aFrame);
         else {
           nsCOMPtr<nsIAtom> tag;
-          content->GetTag(*getter_AddRefs(tag));
+          content->GetTag(getter_AddRefs(tag));
           if (tag == mInputAtom)
             atom = mInputCheckedAtom;
         }
diff --git a/gfx/src/shared/nsNativeTheme.cpp b/gfx/src/shared/nsNativeTheme.cpp
index 7815dd91bc48..cf37375ebebd 100644
--- a/gfx/src/shared/nsNativeTheme.cpp
+++ b/gfx/src/shared/nsNativeTheme.cpp
@@ -79,7 +79,7 @@ nsNativeTheme::GetPrimaryPresShell(nsIFrame* aFrame, nsIPresShell** aResult)
   nsCOMPtr<nsIDocument> doc;
   nsCOMPtr<nsIContent> content;
   aFrame->GetContent(getter_AddRefs(content));
-  content->GetDocument(*getter_AddRefs(doc));
+  content->GetDocument(getter_AddRefs(doc));
   if (doc)
     doc->GetShellAt(0, aResult); // addrefs
 }
diff --git a/gfx/src/windows/nsNativeThemeWin.cpp b/gfx/src/windows/nsNativeThemeWin.cpp
index 6bfec9a4fa9a..ca8b8873c2ce 100644
--- a/gfx/src/windows/nsNativeThemeWin.cpp
+++ b/gfx/src/windows/nsNativeThemeWin.cpp
@@ -310,7 +310,7 @@ static void GetPrimaryPresShell(nsIFrame* aFrame, nsIPresShell** aResult)
   nsCOMPtr<nsIDocument> doc;
   nsCOMPtr<nsIContent> content;
   aFrame->GetContent(getter_AddRefs(content));
-  content->GetDocument(*getter_AddRefs(doc));
+  content->GetDocument(getter_AddRefs(doc));
   if (doc)
     doc->GetShellAt(0, aResult); // Addref happens here.
 }
diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp
index 68fd996b99a1..4c283a2f3b71 100644
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -1406,14 +1406,14 @@ nsCSSFrameConstructor::CreateGeneratedFrameFor(nsIPresContext*       aPresContex
     // XXX Check if it's an image type we can handle...
 
     nsCOMPtr<nsINodeInfoManager> nimgr;
-    nsresult rv = aDocument->GetNodeInfoManager(*getter_AddRefs(nimgr));
+    nsresult rv = aDocument->GetNodeInfoManager(getter_AddRefs(nimgr));
     NS_ENSURE_SUCCESS(rv, rv);
 
     // XXXldb We should not be creating an |image| element, because it
     // matches selectors!  See bug 109216.
     nsCOMPtr<nsINodeInfo> nodeInfo;
     nimgr->GetNodeInfo(nsHTMLAtoms::img, nsnull, kNameSpaceID_None,
-                       *getter_AddRefs(nodeInfo));
+                       getter_AddRefs(nodeInfo));
 
     nsCOMPtr<nsIElementFactory> ef(do_GetService(kHTMLElementFactoryCID,&rv));
     NS_ENSURE_SUCCESS(rv, rv);
@@ -3044,7 +3044,7 @@ nsCSSFrameConstructor::ConstructTableForeignFrame(nsIPresShell*            aPres
 
   // XXX form code needs to be fixed so that the forms can work without a frame.
   nsCOMPtr<nsIAtom> tag;
-  aContent->GetTag(*getter_AddRefs(tag));
+  aContent->GetTag(getter_AddRefs(tag));
 
   // Do not construct pseudo frames for trees 
   if (MustGeneratePseudoParent(aPresContext, aParentFrameIn, tag.get(), aContent, aStyleContext)) {
@@ -3250,7 +3250,7 @@ nsCSSFrameConstructor::TableProcessChild(nsIPresShell*            aPresShell,
       // NOT create psuedoframe for it.
       // see bug 159359
       nsCOMPtr<nsINodeInfo> parentNodeInfo, childNodeInfo;
-      aChildContent->GetNodeInfo(*getter_AddRefs(childNodeInfo));
+      aChildContent->GetNodeInfo(getter_AddRefs(childNodeInfo));
       // Sometimes aChildContent is a #text node.  In those cases it
       // does not have a nodeinfo, and in those cases we want to
       // construct a foreign frame for it in any case.  So we can just
@@ -3259,7 +3259,7 @@ nsCSSFrameConstructor::TableProcessChild(nsIPresShell*            aPresShell,
                    aChildContent->IsContentOfType(nsIContent::eTEXT),
                    "Non-#text nodes should have a nodeinfo here!");
       if (childNodeInfo) {
-        aParentContent->GetNodeInfo(*getter_AddRefs(parentNodeInfo));
+        aParentContent->GetNodeInfo(getter_AddRefs(parentNodeInfo));
         if (childNodeInfo->Equals(nsHTMLAtoms::form, kNameSpaceID_None) &&
             (parentNodeInfo->Equals(nsHTMLAtoms::table, kNameSpaceID_None) ||
              parentNodeInfo->Equals(nsHTMLAtoms::tr, kNameSpaceID_None) ||
@@ -3482,7 +3482,7 @@ nsCSSFrameConstructor::ConstructDocElementFrame(nsIPresShell*        aPresShell,
         else
 #endif 
 #ifdef MOZ_SVG
-        if (NS_SUCCEEDED(aDocElement->GetNameSpaceID(nameSpaceID)) && 
+        if (NS_SUCCEEDED(aDocElement->GetNameSpaceID(&nameSpaceID)) && 
             (nameSpaceID == kNameSpaceID_SVG)) {
           rv = NS_NewSVGOuterSVGFrame(aPresShell, aDocElement, &contentFrame);
           if (NS_FAILED(rv)) {
@@ -3794,10 +3794,10 @@ nsCSSFrameConstructor::ConstructRootFrame(nsIPresShell*        aPresShell,
       aDocElement->ChildCount(count);
       for (PRInt32 i = 0; i < count; ++i) {
         nsCOMPtr<nsIContent> kidElement;
-        aDocElement->ChildAt(i, *getter_AddRefs(kidElement));
+        aDocElement->ChildAt(i, getter_AddRefs(kidElement));
         if (kidElement){
           nsCOMPtr<nsIAtom> kidTag;
-          kidElement->GetTag(*getter_AddRefs(kidTag));
+          kidElement->GetTag(getter_AddRefs(kidTag));
           if (kidTag == nsHTMLAtoms::body) {
             bodyElement = kidElement;
             // done looking
@@ -5208,7 +5208,7 @@ nsCSSFrameConstructor::CreateAnonymousFrames(nsIPresShell*            aPresShell
       // Only cut XUL scrollbars off if they're not in a XUL document.  This allows
       // scrollbars to be styled from XUL (although not from XML or HTML).
       nsCOMPtr<nsIAtom> tag;
-      content->GetTag(*getter_AddRefs(tag));
+      content->GetTag(getter_AddRefs(tag));
       if (tag.get() == nsXULAtoms::scrollbar) {
         nsCOMPtr<nsIDOMXULDocument> xulDoc(do_QueryInterface(aDocument));
         if (xulDoc)
@@ -6299,7 +6299,7 @@ nsCSSFrameConstructor::ConstructFrameByDisplayType(nsIPresShell*            aPre
                     childItems, PR_TRUE);
 
     nsCOMPtr<nsIAtom> tag;
-    aContent->GetTag(*getter_AddRefs(tag));
+    aContent->GetTag(getter_AddRefs(tag));
     CreateAnonymousFrames(aPresShell, aPresContext, tag, aState, aContent, newFrame,
                           PR_FALSE, childItems);
 
@@ -6364,7 +6364,7 @@ nsCSSFrameConstructor::ConstructFrameByDisplayType(nsIPresShell*            aPre
                     childItems, PR_TRUE);
 
     nsCOMPtr<nsIAtom> tag;
-    aContent->GetTag(*getter_AddRefs(tag));
+    aContent->GetTag(getter_AddRefs(tag));
     CreateAnonymousFrames(aPresShell, aPresContext, tag, aState, aContent, newFrame,
                           PR_FALSE, childItems);
 
@@ -6416,7 +6416,7 @@ nsCSSFrameConstructor::ConstructFrameByDisplayType(nsIPresShell*            aPre
                     PR_TRUE, childItems, PR_TRUE);
 
     nsCOMPtr<nsIAtom> tag;
-    aContent->GetTag(*getter_AddRefs(tag));
+    aContent->GetTag(getter_AddRefs(tag));
     CreateAnonymousFrames(aPresShell, aPresContext, tag, aState, aContent, newFrame,
                           PR_FALSE, childItems);
 
@@ -6744,7 +6744,7 @@ nsCSSFrameConstructor::ResolveStyleContext(nsIPresContext*   aPresContext,
 #ifdef DEBUG
     {
       nsCOMPtr<nsIAtom> tag;
-      aContent->GetTag(*getter_AddRefs(tag));
+      aContent->GetTag(getter_AddRefs(tag));
       NS_ASSERTION(tag == nsLayoutAtoms::textTagName,
                    "shouldn't waste time creating style contexts for "
                    "comments and processing instructions");
@@ -6989,7 +6989,7 @@ nsCSSFrameConstructor::ConstructSVGFrame(nsIPresShell*            aPresShell,
                                           nsStyleContext*          aStyleContext,
                                           nsFrameItems&            aFrameItems)
 {
-  NS_ASSERTION(NS_SUCCEEDED(aContent->GetNameSpaceID(aNameSpaceID)) && 
+  NS_ASSERTION(NS_SUCCEEDED(aContent->GetNameSpaceID(&aNameSpaceID)) && 
             (aNameSpaceID == kNameSpaceID_SVG), "SVG frame constructed in wrong namespace");
 
   nsresult  rv = NS_OK;
@@ -7182,7 +7182,7 @@ nsCSSFrameConstructor::ConstructFrame(nsIPresShell*            aPresShell,
 
   // Get the element's tag
   nsCOMPtr<nsIAtom>  tag;
-  aContent->GetTag(*getter_AddRefs(tag));
+  aContent->GetTag(getter_AddRefs(tag));
 
   // never create frames for comments on PIs
   if (tag == nsLayoutAtoms::commentTagName ||
@@ -7193,7 +7193,7 @@ nsCSSFrameConstructor::ConstructFrame(nsIPresShell*            aPresShell,
   styleContext = ResolveStyleContext(aPresContext, aParentFrame, aContent);
 
   PRInt32 nameSpaceID;
-  aContent->GetNameSpaceID(nameSpaceID);
+  aContent->GetNameSpaceID(&nameSpaceID);
 
   PRBool pageBreakAfter = PR_FALSE;
   PRBool paginated;
@@ -8108,7 +8108,7 @@ ShouldIgnoreSelectChild(nsIContent* aContainer)
 {
   // Ignore options and optgroups inside a select (size > 1)
   nsCOMPtr<nsIAtom> containerTag;
-  aContainer->GetTag(*getter_AddRefs(containerTag));
+  aContainer->GetTag(getter_AddRefs(containerTag));
 
   if (containerTag == nsHTMLAtoms::optgroup ||
       containerTag == nsHTMLAtoms::select) {
@@ -8120,9 +8120,9 @@ ShouldIgnoreSelectChild(nsIContent* aContainer)
         break;
       
       tmpContent = selectContent;
-      tmpContent->GetParent(*getter_AddRefs(selectContent));
+      tmpContent->GetParent(getter_AddRefs(selectContent));
       if (selectContent)
-        selectContent->GetTag(*getter_AddRefs(containerTag));
+        selectContent->GetTag(getter_AddRefs(containerTag));
     }
     
     nsCOMPtr<nsISelectElement> selectElement = do_QueryInterface(selectContent);
@@ -8149,7 +8149,7 @@ GetAdjustedParentFrame(nsIPresContext* aPresContext,
                        PRInt32         aChildIndex)
 {
   nsCOMPtr<nsIContent> childContent;
-  aParentContent->ChildAt(aChildIndex, *getter_AddRefs(childContent));
+  aParentContent->ChildAt(aChildIndex, getter_AddRefs(childContent));
   nsIFrame* newParent = nsnull;
 
   if (nsLayoutAtoms::tableOuterFrame == aParentFrameType) {
@@ -8226,9 +8226,9 @@ nsCSSFrameConstructor::ContentAppended(nsIPresContext* aPresContext,
     nsCOMPtr<nsIBindingManager> bindingManager;
     nsCOMPtr<nsIDocument> document;
     nsCOMPtr<nsIContent> firstAppendedChild;
-    aContainer->ChildAt(aNewIndexInContainer, *getter_AddRefs(firstAppendedChild));
+    aContainer->ChildAt(aNewIndexInContainer, getter_AddRefs(firstAppendedChild));
     if (firstAppendedChild) {
-      firstAppendedChild->GetDocument(*getter_AddRefs(document));
+      firstAppendedChild->GetDocument(getter_AddRefs(document));
     }
     if (document)
       document->GetBindingManager(getter_AddRefs(bindingManager));
@@ -8272,7 +8272,7 @@ nsCSSFrameConstructor::ContentAppended(nsIPresContext* aPresContext,
       aContainer->ChildCount(containerCount);
       for (PRInt32 i = aNewIndexInContainer; i < containerCount; i++) {
         nsCOMPtr<nsIContent> child;
-        aContainer->ChildAt(i, *getter_AddRefs(child));
+        aContainer->ChildAt(i, getter_AddRefs(child));
         if (multiple) {
           // Filters are in effect, so the insertion point needs to be refetched for
           // each child.
@@ -8344,7 +8344,7 @@ nsCSSFrameConstructor::ContentAppended(nsIPresContext* aPresContext,
       // content is a block. We _could_ do better here with a little more work...
       // find out if the child is a block or inline, an inline means we don't have to reframe
       nsCOMPtr<nsIContent> child;
-      aContainer->ChildAt(aNewIndexInContainer, *getter_AddRefs(child));
+      aContainer->ChildAt(aNewIndexInContainer, getter_AddRefs(child));
       PRBool needReframe = !child;
       if (child && child->IsContentOfType(nsIContent::eELEMENT)) {
         nsRefPtr<nsStyleContext> styleContext;
@@ -8404,7 +8404,7 @@ nsCSSFrameConstructor::ContentAppended(nsIPresContext* aPresContext,
   aContainer->ChildCount(count);
   for (i = aNewIndexInContainer; i < count; i++) {
     nsCOMPtr<nsIContent> childContent;
-    aContainer->ChildAt(i, *getter_AddRefs(childContent));
+    aContainer->ChildAt(i, getter_AddRefs(childContent));
       
     // construct a child of a table frame by putting it on a temporary list and then
     // moving it into the appropriate list. This is more efficient than checking the display
@@ -8557,7 +8557,7 @@ nsCSSFrameConstructor::ContentAppended(nsIPresContext* aPresContext,
   nsCOMPtr<nsIDOMHTMLSelectElement> sel(do_QueryInterface(aContainer));
   if (sel) {
     nsCOMPtr<nsIContent> childContent;
-    aContainer->ChildAt(aNewIndexInContainer, *getter_AddRefs(childContent));
+    aContainer->ChildAt(aNewIndexInContainer, getter_AddRefs(childContent));
     if (childContent) {
       RemoveDummyFrameFromSelect(aPresContext, shell, aContainer,
                                  childContent, sel);
@@ -8815,7 +8815,7 @@ nsCSSFrameConstructor::ContentInserted(nsIPresContext*        aPresContext,
     mDocument->GetBindingManager(getter_AddRefs(bindingManager));
 
     nsCOMPtr<nsIAtom> tag;
-    aChild->GetTag(*getter_AddRefs(tag));
+    aChild->GetTag(getter_AddRefs(tag));
 
     PRBool listitem = tag && tag.get() == nsXULAtoms::listitem;
     if (listitem) {
@@ -9066,7 +9066,7 @@ nsCSSFrameConstructor::ContentInserted(nsIPresContext*        aPresContext,
       // of a block-in-inline hierarchy.
       if (IsFrameSpecial(parentFrame)) {
         nsCOMPtr<nsIContent> parentContainer;
-        blockContent->GetParent(*getter_AddRefs(parentContainer));
+        blockContent->GetParent(getter_AddRefs(parentContainer));
 #ifdef DEBUG
         if (gNoisyContentUpdates) {
           printf("nsCSSFrameConstructor::ContentInserted: parentFrame=");
@@ -9532,7 +9532,7 @@ nsCSSFrameConstructor::ContentRemoved(nsIPresContext* aPresContext,
     mDocument->GetBindingManager(getter_AddRefs(bindingManager));
 
     nsCOMPtr<nsIAtom> tag;
-    aChild->GetTag(*getter_AddRefs(tag));
+    aChild->GetTag(getter_AddRefs(tag));
 
     PRBool listitem = tag && tag.get() == nsXULAtoms::listitem;
     if (listitem) {
@@ -10114,7 +10114,7 @@ nsCSSFrameConstructor::ContentChanged(nsIPresContext* aPresContext,
           // The block has first-letter style. Use content-replaced to
           // repair the blocks frame structure properly.
           nsCOMPtr<nsIContent> container;
-          aContent->GetParent(*getter_AddRefs(container));
+          aContent->GetParent(getter_AddRefs(container));
           if (container) {
             PRInt32 ix;
             container->IndexOf(aContent, ix);
@@ -10228,7 +10228,7 @@ inline already_AddRefed<nsIContent>
 parent_of(nsIContent *aContent)
 {
   nsIContent *parent = nsnull;
-  aContent->GetParent(parent);
+  aContent->GetParent(&parent);
   return parent;
 }
 
@@ -10669,7 +10669,7 @@ nsCSSFrameConstructor::ConstructAlternateFrame(nsIPresShell*    aPresShell,
 
   // Get the alternate text to use
   nsCOMPtr<nsIAtom> tag;
-  aContent->GetTag(*getter_AddRefs(tag));
+  aContent->GetTag(getter_AddRefs(tag));
   GetAlternateTextFor(aContent, tag, altText);
 
   // Create a text content element for the alternate text
@@ -10814,8 +10814,8 @@ nsCSSFrameConstructor::CantRenderReplacedElement(nsIPresShell* aPresShell,
 
   aFrame->GetContent(getter_AddRefs(content));
   NS_ASSERTION(content, "null content object");
-  content->GetNameSpaceID(nameSpaceID);
-  content->GetTag(*getter_AddRefs(tag));
+  content->GetNameSpaceID(&nameSpaceID);
+  content->GetTag(getter_AddRefs(tag));
 
   // Get the child list name that the frame is contained in
   nsCOMPtr<nsIAtom>  listName;
@@ -11665,7 +11665,7 @@ nsCSSFrameConstructor::FindPrimaryFrameFor(nsIPresContext*  aPresContext,
   // Get the frame that corresponds to the parent content object.
   // Note that this may recurse indirectly, because the pres shell will
   // call us back if there is no mapping in the hash table
-  aContent->GetParent(*getter_AddRefs(parentContent));
+  aContent->GetParent(getter_AddRefs(parentContent));
   if (parentContent.get()) {
     aFrameManager->GetPrimaryFrameFor(parentContent, &parentFrame);
     while (parentFrame) {
@@ -11719,7 +11719,7 @@ nsCSSFrameConstructor::FindPrimaryFrameFor(nsIPresContext*  aPresContext,
   if (aHint && !*aFrame)
   { // if we had a hint, and we didn't get a frame, see if we should try the slow way
     nsCOMPtr<nsIAtom>tag;
-    aContent->GetTag(*getter_AddRefs(tag));
+    aContent->GetTag(getter_AddRefs(tag));
     if (nsLayoutAtoms::textTagName == tag.get()) 
     {
 #ifdef NOISY_FINDFRAME
@@ -11758,7 +11758,7 @@ nsCSSFrameConstructor::GetInsertionPoint(nsIPresShell* aPresShell,
     return NS_OK;
 
   nsCOMPtr<nsIDocument> document;
-  container->GetDocument(*getter_AddRefs(document));
+  container->GetDocument(getter_AddRefs(document));
   if (!document)
     return NS_OK;
 
@@ -11864,7 +11864,7 @@ nsCSSFrameConstructor::RecreateFramesForContent(nsIPresContext* aPresContext,
   // shouldn't generally be giving this method content without a document
   // anyway).
   nsCOMPtr<nsIDocument> doc;
-  aContent->GetDocument(*getter_AddRefs(doc));
+  aContent->GetDocument(getter_AddRefs(doc));
   NS_ENSURE_TRUE(doc, NS_ERROR_FAILURE);
 
   // Is the frame `special'? If so, we need to reframe the containing
@@ -11909,7 +11909,7 @@ nsCSSFrameConstructor::RecreateFramesForContent(nsIPresContext* aPresContext,
 
   nsresult rv = NS_OK;
   nsCOMPtr<nsIContent> container;
-  aContent->GetParent(*getter_AddRefs(container));
+  aContent->GetParent(getter_AddRefs(container));
   if (container) {
     PRInt32 indexInContainer;
     rv = container->IndexOf(aContent, indexInContainer);
@@ -11948,7 +11948,7 @@ nsCSSFrameConstructor::RecreateFramesForContent(nsIPresContext* aPresContext,
     // since rebuilding the frame tree can have bad effects, especially
     // if it's the frame tree for chrome (see bug 157322).
     nsCOMPtr<nsIDocument> doc;
-    aContent->GetDocument(*getter_AddRefs(doc));
+    aContent->GetDocument(getter_AddRefs(doc));
     NS_ASSERTION(doc, "received style change for content not in document");
     if (doc)
       ReconstructDocElementHierarchy(aPresContext);
@@ -13079,10 +13079,10 @@ nsCSSFrameConstructor::CreateListBoxContent(nsIPresContext* aPresContext,
     }
 
     nsCOMPtr<nsIAtom> tag;
-    aChild->GetTag(*getter_AddRefs(tag));
+    aChild->GetTag(getter_AddRefs(tag));
 
     PRInt32 namespaceID;
-    aChild->GetNameSpaceID(namespaceID);
+    aChild->GetNameSpaceID(&namespaceID);
 
     rv = ConstructFrameInternal(shell, aPresContext, state, aChild, aParentFrame, tag, namespaceID, 
                                 styleContext, frameItems, PR_FALSE);
@@ -13191,7 +13191,7 @@ nsCSSFrameConstructor::ConstructBlock(nsIPresShell*            aPresShell,
                                      PR_TRUE, childItems, PR_TRUE);
 
   nsCOMPtr<nsIAtom> tag;
-  aContent->GetTag(*getter_AddRefs(tag));
+  aContent->GetTag(getter_AddRefs(tag));
   CreateAnonymousFrames(aPresShell, aPresContext, tag, aState, aContent, aNewFrame,
                         PR_FALSE, childItems);
 
@@ -13333,7 +13333,7 @@ nsCSSFrameConstructor::ConstructInline(nsIPresShell*            aPresShell,
   if (kidsAllInline) {
     // Set the inline frame's initial child list
     nsCOMPtr<nsIAtom> tag;
-    aContent->GetTag(*getter_AddRefs(tag));
+    aContent->GetTag(getter_AddRefs(tag));
     CreateAnonymousFrames(aPresShell, aPresContext, tag, aState, aContent, aNewFrame,
                           PR_FALSE, childItems);
 
@@ -13720,7 +13720,7 @@ nsCSSFrameConstructor::WipeContainingBlock(nsIPresContext* aPresContext,
       // entire block. This is painful and definitely not optimal
       // but it will *always* get the right answer.
       nsCOMPtr<nsIContent> parentContainer;
-      aBlockContent->GetParent(*getter_AddRefs(parentContainer));
+      aBlockContent->GetParent(getter_AddRefs(parentContainer));
 #ifdef DEBUG
       if (gNoisyContentUpdates) {
         printf("nsCSSFrameConstructor::WipeContainingBlock: aBlockContent=%p parentContainer=%p\n",
@@ -14063,7 +14063,7 @@ nsCSSFrameConstructor::ReframeContainingBlock(nsIPresContext* aPresContext, nsIF
     if (blockContent) {
       // Now find the containingBlock's content's parent
       nsCOMPtr<nsIContent> parentContainer;
-      blockContent->GetParent(*getter_AddRefs(parentContainer));
+      blockContent->GetParent(getter_AddRefs(parentContainer));
       if (parentContainer) {
 #ifdef DEBUG
         if (gNoisyContentUpdates) {
diff --git a/layout/base/nsCSSRendering.cpp b/layout/base/nsCSSRendering.cpp
index 3133574599b2..422e4d0bd57a 100644
--- a/layout/base/nsCSSRendering.cpp
+++ b/layout/base/nsCSSRendering.cpp
@@ -1555,8 +1555,8 @@ PRBool GetBGColorForHTMLElement( nsIPresContext *aPresContext,
       nsIContent *pContent;
       if (NS_SUCCEEDED(doc->GetRootContent(&pContent)) && pContent) {
         // make sure that this is the HTML element
-        nsIAtom *tag = nsnull;
-        pContent->GetTag(tag);
+        nsCOMPtr<nsIAtom> tag;
+        pContent->GetTag(getter_AddRefs(tag));
         NS_ASSERTION(tag, "Tag could not be retrieved from root content element");
         if (tag) {
           if (tag == nsHTMLAtoms::html ||
@@ -1580,7 +1580,6 @@ PRBool GetBGColorForHTMLElement( nsIPresContext *aPresContext,
             printf( "Root Content is not HTML or BODY: cannot get bgColor of HTML or BODY\n");
           }
 #endif
-          NS_RELEASE(tag);
         }// if tag
         NS_RELEASE(pContent);
       }// if content
@@ -1615,7 +1614,7 @@ nsresult GetFrameForBackgroundUpdate(nsIPresContext *aPresContext,nsIFrame *aFra
     if (pContent) {
       // make sure that this is the HTML or BODY element
       nsCOMPtr<nsIAtom> tag;
-      pContent->GetTag(*(getter_AddRefs(tag)));
+      pContent->GetTag(getter_AddRefs(tag));
       if (tag) {
         if (tag.get() == nsHTMLAtoms::html ||
             tag.get() == nsHTMLAtoms::body) {
@@ -2759,7 +2758,7 @@ FindElementBackground(nsIPresContext* aPresContext,
     return PR_TRUE; // no parent to look at
   
   nsCOMPtr<nsIAtom> tag;
-  content->GetTag(*getter_AddRefs(tag));
+  content->GetTag(getter_AddRefs(tag));
   if (tag != nsHTMLAtoms::body)
     return PR_TRUE; // not frame for <BODY> element
 
@@ -2822,7 +2821,7 @@ nsCSSRendering::PaintBackground(nsIPresContext* aPresContext,
       aForFrame->GetContent(getter_AddRefs(content));
       if (content) {
         nsCOMPtr<nsIContent> parent;
-        content->GetParent(*getter_AddRefs(parent));
+        content->GetParent(getter_AddRefs(parent));
         if (parent)
           return;
         else
diff --git a/layout/base/nsChildIterator.cpp b/layout/base/nsChildIterator.cpp
index 22e5de22630f..949d39db7d63 100644
--- a/layout/base/nsChildIterator.cpp
+++ b/layout/base/nsChildIterator.cpp
@@ -54,7 +54,7 @@ ChildIterator::Init(nsIContent*    aContent,
     return NS_ERROR_NULL_POINTER;
 
   nsCOMPtr<nsIDocument> doc;
-  aContent->GetDocument(*getter_AddRefs(doc));
+  aContent->GetDocument(getter_AddRefs(doc));
   NS_ASSERTION(doc != nsnull, "element not in the document");
   if (! doc)
     return NS_ERROR_FAILURE;
diff --git a/layout/base/nsChildIterator.h b/layout/base/nsChildIterator.h
index d0f8da36358d..5ee5de1f2276 100644
--- a/layout/base/nsChildIterator.h
+++ b/layout/base/nsChildIterator.h
@@ -105,7 +105,7 @@ public:
       CallQueryInterface(node, &result);
     }
     else 
-      mContent->ChildAt(PRInt32(mIndex), result);
+      mContent->ChildAt(PRInt32(mIndex), &result);
 
     return result;
   }
diff --git a/layout/base/nsDocumentViewer.cpp b/layout/base/nsDocumentViewer.cpp
index bccdc9d4b3da..4c96da25dda2 100644
--- a/layout/base/nsDocumentViewer.cpp
+++ b/layout/base/nsDocumentViewer.cpp
@@ -339,11 +339,11 @@ public:
 
   // nsIDocumentViewer interface...
   NS_IMETHOD SetUAStyleSheet(nsIStyleSheet* aUAStyleSheet);
-  NS_IMETHOD GetDocument(nsIDocument*& aResult);
-  NS_IMETHOD GetPresShell(nsIPresShell*& aResult);
-  NS_IMETHOD GetPresContext(nsIPresContext*& aResult);
+  NS_IMETHOD GetDocument(nsIDocument** aResult);
+  NS_IMETHOD GetPresShell(nsIPresShell** aResult);
+  NS_IMETHOD GetPresContext(nsIPresContext** aResult);
   NS_IMETHOD CreateDocumentViewerUsing(nsIPresContext* aPresContext,
-                                       nsIDocumentViewer*& aResult);
+                                       nsIDocumentViewer** aResult);
 
   // nsIContentViewerEdit
   NS_DECL_NSICONTENTVIEWEREDIT
@@ -1252,26 +1252,26 @@ DocumentViewerImpl::SetUAStyleSheet(nsIStyleSheet* aUAStyleSheet)
 }
 
 NS_IMETHODIMP
-DocumentViewerImpl::GetDocument(nsIDocument*& aResult)
+DocumentViewerImpl::GetDocument(nsIDocument** aResult)
 {
-  aResult = mDocument;
-  NS_IF_ADDREF(aResult);
+  NS_IF_ADDREF(*aResult = mDocument);
+
   return NS_OK;
 }
 
 NS_IMETHODIMP
-DocumentViewerImpl::GetPresShell(nsIPresShell*& aResult)
+DocumentViewerImpl::GetPresShell(nsIPresShell** aResult)
 {
-  aResult = mPresShell;
-  NS_IF_ADDREF(aResult);
+  NS_IF_ADDREF(*aResult = mPresShell);
+
   return NS_OK;
 }
 
 NS_IMETHODIMP
-DocumentViewerImpl::GetPresContext(nsIPresContext*& aResult)
+DocumentViewerImpl::GetPresContext(nsIPresContext** aResult)
 {
-  aResult = mPresContext;
-  NS_IF_ADDREF(aResult);
+  NS_IF_ADDREF(*aResult = mPresContext);
+
   return NS_OK;
 }
 
@@ -1729,7 +1729,7 @@ DocumentViewerImpl::FindFrameSetWithIID(nsIContent * aParentContent,
   PRInt32 inx;
   for (inx = 0; inx < numChildren; ++inx) {
     nsCOMPtr<nsIContent> child;
-    if (NS_SUCCEEDED(aParentContent->ChildAt(inx, *getter_AddRefs(child))) && child) {
+    if (NS_SUCCEEDED(aParentContent->ChildAt(inx, getter_AddRefs(child))) && child) {
       nsCOMPtr<nsISupports> temp;
       if (NS_SUCCEEDED(child->QueryInterface(aIID, (void**)getter_AddRefs(temp)))) {
         return NS_OK;
@@ -1915,7 +1915,7 @@ nsresult DocumentViewerImpl::GetDocumentSelection(nsISelection **aSelection,
 
 NS_IMETHODIMP
 DocumentViewerImpl::CreateDocumentViewerUsing(nsIPresContext* aPresContext,
-                                              nsIDocumentViewer*& aResult)
+                                              nsIDocumentViewer** aResult)
 {
   if (!mDocument) {
     // XXX better error
@@ -1939,7 +1939,7 @@ DocumentViewerImpl::CreateDocumentViewerUsing(nsIPresContext* aPresContext,
   // Bind the new viewer to the old document
   nsresult rv = viewer->LoadStart(mDocument);
 
-  aResult = viewer;
+  *aResult = viewer;
 
   return rv;
 }
@@ -2207,7 +2207,7 @@ NS_IMETHODIMP DocumentViewerImpl::ScrollToNode(nsIDOMNode* aNode)
    NS_ENSURE_ARG(aNode);
    NS_ENSURE_TRUE(mDocument, NS_ERROR_NOT_AVAILABLE);
    nsCOMPtr<nsIPresShell> presShell;
-   NS_ENSURE_SUCCESS(GetPresShell(*(getter_AddRefs(presShell))), NS_ERROR_FAILURE);
+   NS_ENSURE_SUCCESS(GetPresShell(getter_AddRefs(presShell)), NS_ERROR_FAILURE);
 
    // Get the nsIContent interface, because that's what we need to
    // get the primary frame
@@ -2673,14 +2673,14 @@ NS_IMETHODIMP DocumentViewerImpl::SizeToContent()
    NS_ENSURE_TRUE(!docShellParent, NS_ERROR_FAILURE);
 
    nsCOMPtr<nsIPresShell> presShell;
-   GetPresShell(*getter_AddRefs(presShell));
+   GetPresShell(getter_AddRefs(presShell));
    NS_ENSURE_TRUE(presShell, NS_ERROR_FAILURE);
 
    NS_ENSURE_SUCCESS(presShell->ResizeReflow(NS_UNCONSTRAINEDSIZE,
       NS_UNCONSTRAINEDSIZE), NS_ERROR_FAILURE);
 
    nsCOMPtr<nsIPresContext> presContext;
-   GetPresContext(*getter_AddRefs(presContext));
+   GetPresContext(getter_AddRefs(presContext));
    NS_ENSURE_TRUE(presContext, NS_ERROR_FAILURE);
 
    nsRect  shellArea;
@@ -2744,7 +2744,7 @@ DocumentViewerImpl::GetPopupNode(nsIDOMNode** aNode)
 
   // get the document
   nsCOMPtr<nsIDocument> document;
-  rv = GetDocument(*getter_AddRefs(document));
+  rv = GetDocument(getter_AddRefs(document));
   NS_ENSURE_SUCCESS(rv, rv);
   NS_ENSURE_TRUE(document, NS_ERROR_FAILURE);
 
@@ -2939,7 +2939,7 @@ NS_IMETHODIMP nsDocViewerSelectionListener::NotifySelectionChanged(nsIDOMDocumen
   if (!mGotSelectionState || mSelectionWasCollapsed != selectionCollapsed)
   {
     nsCOMPtr<nsIDocument> theDoc;
-    mDocViewer->GetDocument(*getter_AddRefs(theDoc));
+    mDocViewer->GetDocument(getter_AddRefs(theDoc));
     if (!theDoc) return NS_ERROR_FAILURE;
 
     nsCOMPtr<nsIScriptGlobalObject> scriptGlobalObject;
@@ -2979,7 +2979,7 @@ nsDocViewerFocusListener::Focus(nsIDOMEvent* aEvent)
   if(!mDocViewer)
     return NS_ERROR_FAILURE;
 
-  nsresult result = mDocViewer->GetPresShell(*getter_AddRefs(shell));//deref once cause it take a ptr ref
+  nsresult result = mDocViewer->GetPresShell(getter_AddRefs(shell));
   if(NS_FAILED(result) || !shell)
     return result?result:NS_ERROR_FAILURE;
   nsCOMPtr<nsISelectionController> selCon;
@@ -3005,7 +3005,7 @@ nsDocViewerFocusListener::Blur(nsIDOMEvent* aEvent)
   if(!mDocViewer)
     return NS_ERROR_FAILURE;
 
-  nsresult result = mDocViewer->GetPresShell(*getter_AddRefs(shell));//deref once cause it take a ptr ref
+  nsresult result = mDocViewer->GetPresShell(getter_AddRefs(shell));
   if(NS_FAILED(result) || !shell)
     return result?result:NS_ERROR_FAILURE;
   nsCOMPtr<nsISelectionController> selCon;
diff --git a/layout/base/nsFrameManager.cpp b/layout/base/nsFrameManager.cpp
index 35b3b5ed9509..7ccd4981e2a6 100644
--- a/layout/base/nsFrameManager.cpp
+++ b/layout/base/nsFrameManager.cpp
@@ -628,7 +628,7 @@ FrameManager::GetPrimaryFrameFor(nsIContent* aContent, nsIFrame** aResult)
       // we're just trying to enhance performance here, not test for correctness
       nsFindFrameHint hint;
       nsCOMPtr<nsIContent> prevSibling, parent;
-      rv = aContent->GetParent(*getter_AddRefs(parent));
+      rv = aContent->GetParent(getter_AddRefs(parent));
       if (NS_SUCCEEDED(rv) && parent)
       {
         PRInt32 index;
@@ -637,8 +637,8 @@ FrameManager::GetPrimaryFrameFor(nsIContent* aContent, nsIFrame** aResult)
         {
           nsCOMPtr<nsIAtom> tag;
           do {
-            parent->ChildAt(--index, *getter_AddRefs(prevSibling));
-            prevSibling->GetTag(*getter_AddRefs(tag));
+            parent->ChildAt(--index, getter_AddRefs(prevSibling));
+            prevSibling->GetTag(getter_AddRefs(tag));
           } while (index &&
                    (tag == nsLayoutAtoms::textTagName ||
                     tag == nsLayoutAtoms::commentTagName ||
@@ -823,7 +823,7 @@ FrameManager::GetUndisplayedContent(nsIContent* aContent)
     return nsnull;
 
   nsCOMPtr<nsIContent> parent;
-  aContent->GetParent(*getter_AddRefs(parent));
+  aContent->GetParent(getter_AddRefs(parent));
   if (!parent)
     return nsnull;
 
@@ -852,12 +852,11 @@ FrameManager::SetUndisplayedContent(nsIContent* aContent,
     mUndisplayedMap = new UndisplayedMap;
   }
   if (mUndisplayedMap) {
-    nsIContent* parent = nsnull;
-    aContent->GetParent(parent);
+    nsCOMPtr<nsIContent> parent;
+    aContent->GetParent(getter_AddRefs(parent));
     NS_ASSERTION(parent, "undisplayed content must have a parent");
     if (parent) {
       mUndisplayedMap->AddNodeFor(parent, aContent, aStyleContext);
-      NS_RELEASE(parent);
     }
   }
 }
diff --git a/layout/base/nsIDocumentViewer.h b/layout/base/nsIDocumentViewer.h
index 058c6dc8dd9d..73027cc8fea8 100644
--- a/layout/base/nsIDocumentViewer.h
+++ b/layout/base/nsIDocumentViewer.h
@@ -59,14 +59,14 @@ public:
 
   NS_IMETHOD SetUAStyleSheet(nsIStyleSheet* aUAStyleSheet) = 0;
   
-  NS_IMETHOD GetDocument(nsIDocument*& aResult) = 0;
+  NS_IMETHOD GetDocument(nsIDocument** aResult) = 0;
   
-  NS_IMETHOD GetPresShell(nsIPresShell*& aResult) = 0;
+  NS_IMETHOD GetPresShell(nsIPresShell** aResult) = 0;
   
-  NS_IMETHOD GetPresContext(nsIPresContext*& aResult) = 0;
+  NS_IMETHOD GetPresContext(nsIPresContext** aResult) = 0;
 
   NS_IMETHOD CreateDocumentViewerUsing(nsIPresContext* aPresContext,
-                                       nsIDocumentViewer*& aResult) = 0;
+                                       nsIDocumentViewer** aResult) = 0;
 };
 
 #endif /* nsIDocumentViewer_h___ */
diff --git a/layout/base/nsPresContext.cpp b/layout/base/nsPresContext.cpp
index f4a46d55b24b..6a6761aa9c96 100644
--- a/layout/base/nsPresContext.cpp
+++ b/layout/base/nsPresContext.cpp
@@ -668,7 +668,7 @@ nsPresContext::SetShell(nsIPresShell* aShell)
     if (NS_SUCCEEDED(mShell->GetDocument(getter_AddRefs(doc)))) {
       NS_ASSERTION(doc, "expect document here");
       if (doc) {
-        doc->GetBaseURL(*getter_AddRefs(mBaseURL));
+        doc->GetBaseURL(getter_AddRefs(mBaseURL));
 
         if (mBaseURL) {
             PRBool isChrome = PR_FALSE;
@@ -829,7 +829,7 @@ void nsPresContext::SetImgAnimations(nsCOMPtr<nsIContent>& aParent, PRUint16 aMo
   aParent->ChildCount(count);
   for (PRInt32 i=0;i<count;i++) {
     nsCOMPtr<nsIContent> child;
-    aParent->ChildAt(i, *getter_AddRefs(child));
+    aParent->ChildAt(i, getter_AddRefs(child));
     if (child) {
       SetImgAnimations(child, aMode);
     }
@@ -1369,7 +1369,7 @@ nsPresContext::LoadImage(const nsString& aURL,
   if (NS_FAILED(rv)) return rv;
 
   nsCOMPtr<nsIURI> baseURI;
-  doc->GetBaseURL(*getter_AddRefs(baseURI));
+  doc->GetBaseURL(getter_AddRefs(baseURI));
 
   nsCOMPtr<nsIURI> uri;
   NS_NewURI(getter_AddRefs(uri), aURL, nsnull, baseURI);
@@ -1384,7 +1384,7 @@ nsPresContext::LoadImage(const nsString& aURL,
 
     if (content && element) {
       nsCOMPtr<nsIDocument> document;
-      rv = content->GetDocument(*getter_AddRefs(document));
+      rv = content->GetDocument(getter_AddRefs(document));
 
       // If there is no document, skip the policy check
       // XXXldb This really means the document is being destroyed, so
diff --git a/layout/base/nsPresShell.cpp b/layout/base/nsPresShell.cpp
index fdfee9675769..41e66853fc2e 100644
--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -4055,7 +4055,7 @@ PresShell::GoToAnchor(const nsAString& aAnchorName, PRBool aScroll)
         content = do_QueryInterface(node);
         if (content) {
           nsCOMPtr<nsIAtom> tag;
-          content->GetTag(*getter_AddRefs(tag));
+          content->GetTag(getter_AddRefs(tag));
           if (tag == nsHTMLAtoms::a) {
             break;
           }
@@ -4351,7 +4351,7 @@ PresShell::ScrollFrameIntoView(nsIFrame *aFrame,
   aFrame->GetContent(getter_AddRefs(content));
   if(content) {
     nsCOMPtr<nsIDocument> document;
-    content->GetDocument(*getter_AddRefs(document));
+    content->GetDocument(getter_AddRefs(document));
     if(document){
       nsCOMPtr<nsIFocusController> focusController;
       nsCOMPtr<nsIScriptGlobalObject> ourGlobal;
@@ -5455,7 +5455,7 @@ BuildFramechangeList(nsIFrame *aFrame, void *aClosure)
     nsCOMPtr<nsIContent> content;
     aFrame->GetContent(getter_AddRefs(content));
     nsCOMPtr<nsIDocument> doc;
-    content->GetDocument(*getter_AddRefs(doc));
+    content->GetDocument(getter_AddRefs(doc));
     if (doc) {
       nsCOMPtr<nsIBindingManager> bm;
       doc->GetBindingManager(getter_AddRefs(bm));
@@ -5942,7 +5942,7 @@ PresShell::GetCurrentEventFrame()
     // frame shouldn't get an event, nor should we even assume its
     // safe to try and find the frame.
     nsCOMPtr<nsIDocument> doc;
-    nsresult result = mCurrentEventContent->GetDocument(*getter_AddRefs(doc));
+    nsresult result = mCurrentEventContent->GetDocument(getter_AddRefs(doc));
     if (NS_SUCCEEDED(result) && doc) {
       GetPrimaryFrameFor(mCurrentEventContent, &mCurrentEventFrame);
     }
@@ -6009,7 +6009,7 @@ PRBool PresShell::InZombieDocument(nsIContent *aContent)
   // It might actually be in a node not attached to any document,
   // in which case there is not parent presshell to retarget it to.
   nsCOMPtr<nsIDocument> doc;
-  mCurrentEventContent->GetDocument(*getter_AddRefs(doc));
+  mCurrentEventContent->GetDocument(getter_AddRefs(doc));
   return !doc;
 }
 
@@ -6264,7 +6264,7 @@ PresShell::HandleEvent(nsIView         *aView,
           while (targetElement &&
                  !targetElement->IsContentOfType(nsIContent::eELEMENT)) {
             nsIContent* temp = targetElement;
-            temp->GetParent(*getter_AddRefs(targetElement));
+            temp->GetParent(getter_AddRefs(targetElement));
           }
 
           // If we found an element, target it.  Otherwise, target *nothing*.
diff --git a/layout/base/src/nsCopySupport.cpp b/layout/base/src/nsCopySupport.cpp
index 8ed11a31bacb..428eaf7774f2 100644
--- a/layout/base/src/nsCopySupport.cpp
+++ b/layout/base/src/nsCopySupport.cpp
@@ -358,7 +358,7 @@ nsresult nsCopySupport::IsPlainTextContext(nsISelection *aSel, nsIDocument *aDoc
   {
     // checking for selection inside a plaintext form widget
     nsCOMPtr<nsIAtom> atom;
-    selContent->GetTag(*getter_AddRefs(atom));
+    selContent->GetTag(getter_AddRefs(atom));
 
     if (atom.get() == nsHTMLAtoms::input ||
         atom.get() == nsHTMLAtoms::textarea)
@@ -381,7 +381,7 @@ nsresult nsCopySupport::IsPlainTextContext(nsISelection *aSel, nsIDocument *aDoc
         break;
       }
     }
-    selContent->GetParent(*getter_AddRefs(tmp));
+    selContent->GetParent(getter_AddRefs(tmp));
     selContent = tmp;
   }
   
diff --git a/layout/base/src/nsPresContext.cpp b/layout/base/src/nsPresContext.cpp
index f4a46d55b24b..6a6761aa9c96 100644
--- a/layout/base/src/nsPresContext.cpp
+++ b/layout/base/src/nsPresContext.cpp
@@ -668,7 +668,7 @@ nsPresContext::SetShell(nsIPresShell* aShell)
     if (NS_SUCCEEDED(mShell->GetDocument(getter_AddRefs(doc)))) {
       NS_ASSERTION(doc, "expect document here");
       if (doc) {
-        doc->GetBaseURL(*getter_AddRefs(mBaseURL));
+        doc->GetBaseURL(getter_AddRefs(mBaseURL));
 
         if (mBaseURL) {
             PRBool isChrome = PR_FALSE;
@@ -829,7 +829,7 @@ void nsPresContext::SetImgAnimations(nsCOMPtr<nsIContent>& aParent, PRUint16 aMo
   aParent->ChildCount(count);
   for (PRInt32 i=0;i<count;i++) {
     nsCOMPtr<nsIContent> child;
-    aParent->ChildAt(i, *getter_AddRefs(child));
+    aParent->ChildAt(i, getter_AddRefs(child));
     if (child) {
       SetImgAnimations(child, aMode);
     }
@@ -1369,7 +1369,7 @@ nsPresContext::LoadImage(const nsString& aURL,
   if (NS_FAILED(rv)) return rv;
 
   nsCOMPtr<nsIURI> baseURI;
-  doc->GetBaseURL(*getter_AddRefs(baseURI));
+  doc->GetBaseURL(getter_AddRefs(baseURI));
 
   nsCOMPtr<nsIURI> uri;
   NS_NewURI(getter_AddRefs(uri), aURL, nsnull, baseURI);
@@ -1384,7 +1384,7 @@ nsPresContext::LoadImage(const nsString& aURL,
 
     if (content && element) {
       nsCOMPtr<nsIDocument> document;
-      rv = content->GetDocument(*getter_AddRefs(document));
+      rv = content->GetDocument(getter_AddRefs(document));
 
       // If there is no document, skip the policy check
       // XXXldb This really means the document is being destroyed, so
diff --git a/layout/build/nsContentDLF.cpp b/layout/build/nsContentDLF.cpp
index 8837989cec59..5a01d886e475 100644
--- a/layout/build/nsContentDLF.cpp
+++ b/layout/build/nsContentDLF.cpp
@@ -334,7 +334,7 @@ nsContentDLF::CreateBlankDocument(nsILoadGroup *aLoadGroup, nsIDocument **aDocum
     rv = NS_ERROR_FAILURE;
 
     nsCOMPtr<nsINodeInfoManager> nim;
-    blankDoc->GetNodeInfoManager(*getter_AddRefs(nim));
+    blankDoc->GetNodeInfoManager(getter_AddRefs(nim));
 
     if (nim) {
       nsCOMPtr<nsINodeInfo> htmlNodeInfo;
@@ -342,19 +342,19 @@ nsContentDLF::CreateBlankDocument(nsILoadGroup *aLoadGroup, nsIDocument **aDocum
       // generate an html html element
       nsCOMPtr<nsIHTMLContent> htmlElement;
       nim->GetNodeInfo(nsHTMLAtoms::html, 0, kNameSpaceID_None,
-                      *getter_AddRefs(htmlNodeInfo));
+                      getter_AddRefs(htmlNodeInfo));
       NS_NewHTMLHtmlElement(getter_AddRefs(htmlElement), htmlNodeInfo);
 
       // generate an html head element
       nsCOMPtr<nsIHTMLContent> headElement;
       nim->GetNodeInfo(nsHTMLAtoms::head, 0, kNameSpaceID_None,
-                      *getter_AddRefs(htmlNodeInfo));
+                      getter_AddRefs(htmlNodeInfo));
       NS_NewHTMLHeadElement(getter_AddRefs(headElement), htmlNodeInfo);
 
       // generate an html body element
       nsCOMPtr<nsIHTMLContent> bodyElement;
       nim->GetNodeInfo(nsHTMLAtoms::body, 0, kNameSpaceID_None,
-                      *getter_AddRefs(htmlNodeInfo));
+                      getter_AddRefs(htmlNodeInfo));
       NS_NewHTMLBodyElement(getter_AddRefs(bodyElement), htmlNodeInfo);
 
       // blat in the structure
diff --git a/layout/forms/nsComboboxControlFrame.cpp b/layout/forms/nsComboboxControlFrame.cpp
index 68eef45f4458..36935c4cd7c8 100644
--- a/layout/forms/nsComboboxControlFrame.cpp
+++ b/layout/forms/nsComboboxControlFrame.cpp
@@ -392,7 +392,7 @@ nsComboboxControlFrame::Init(nsIPresContext*  aPresContext,
   //-------------------------------
   mGoodToGo = PR_FALSE;
   nsCOMPtr<nsIDocument> document;
-  nsresult rv = aContent->GetDocument(*getter_AddRefs(document));
+  nsresult rv = aContent->GetDocument(getter_AddRefs(document));
   if (NS_SUCCEEDED(rv) && document) {
 #ifdef MOZ_XUL
     nsCOMPtr<nsIXULDocument> xulDoc(do_QueryInterface(document));
@@ -2234,16 +2234,16 @@ nsComboboxControlFrame::CreateAnonymousContent(nsIPresContext* aPresContext,
     mDisplayContent->SetText(NS_LITERAL_STRING("X"), PR_TRUE);
 
     nsCOMPtr<nsIDocument> doc;
-    mContent->GetDocument(*getter_AddRefs(doc));
+    mContent->GetDocument(getter_AddRefs(doc));
     // mContent->AppendChildTo(labelContent, PR_FALSE, PR_FALSE);
 
     nsCOMPtr<nsINodeInfoManager> nimgr;
-    result = doc->GetNodeInfoManager(*getter_AddRefs(nimgr));
+    result = doc->GetNodeInfoManager(getter_AddRefs(nimgr));
     NS_ENSURE_SUCCESS(result, result);
 
     nsCOMPtr<nsINodeInfo> nodeInfo;
     nimgr->GetNodeInfo(nsHTMLAtoms::input, nsnull, kNameSpaceID_None,
-                       *getter_AddRefs(nodeInfo));
+                       getter_AddRefs(nodeInfo));
 
     aChildList.AppendElement(labelContent);
 
diff --git a/layout/forms/nsFileControlFrame.cpp b/layout/forms/nsFileControlFrame.cpp
index f2ca384ce156..26688458e23c 100644
--- a/layout/forms/nsFileControlFrame.cpp
+++ b/layout/forms/nsFileControlFrame.cpp
@@ -140,14 +140,14 @@ nsFileControlFrame::CreateAnonymousContent(nsIPresContext* aPresContext,
 {
   // Get the NodeInfoManager and tag necessary to create input elements
   nsCOMPtr<nsIDocument> doc;
-  mContent->GetDocument(*getter_AddRefs(doc));
+  mContent->GetDocument(getter_AddRefs(doc));
   nsCOMPtr<nsINodeInfoManager> nimgr;
-  nsresult rv = doc->GetNodeInfoManager(*getter_AddRefs(nimgr));
+  nsresult rv = doc->GetNodeInfoManager(getter_AddRefs(nimgr));
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCOMPtr<nsINodeInfo> nodeInfo;
   nimgr->GetNodeInfo(nsHTMLAtoms::input, nsnull, kNameSpaceID_None,
-                     *getter_AddRefs(nodeInfo));
+                     getter_AddRefs(nodeInfo));
 
   nsCOMPtr<nsIElementFactory> ef(do_GetService(kHTMLElementFactoryCID,&rv));
   NS_ENSURE_SUCCESS(rv, rv);
@@ -272,7 +272,7 @@ nsFileControlFrame::MouseClick(nsIDOMEvent* aMouseEvent)
     return NS_FAILED(result) ? result : NS_ERROR_FAILURE;
 
   nsCOMPtr<nsIDocument> doc;
-  result = content->GetDocument(*getter_AddRefs(doc));
+  result = content->GetDocument(getter_AddRefs(doc));
   if (!doc)
     return NS_FAILED(result) ? result : NS_ERROR_FAILURE;
 
@@ -462,7 +462,7 @@ nsFileControlFrame::GetTextControlFrame(nsIPresContext* aPresContext, nsIFrame*
     nsresult res = childFrame->GetContent(getter_AddRefs(content));
     if (NS_SUCCEEDED(res) && content) {
       nsCOMPtr<nsIAtom> atom;
-      res = content->GetTag(*getter_AddRefs(atom));
+      res = content->GetTag(getter_AddRefs(atom));
       if (NS_SUCCEEDED(res) && atom) {
         if (atom.get() == nsHTMLAtoms::input) {
 
diff --git a/layout/forms/nsGfxButtonControlFrame.cpp b/layout/forms/nsGfxButtonControlFrame.cpp
index 385868311b2f..8e9372c35361 100644
--- a/layout/forms/nsGfxButtonControlFrame.cpp
+++ b/layout/forms/nsGfxButtonControlFrame.cpp
@@ -111,10 +111,10 @@ nsGfxButtonControlFrame::IsFileBrowseButton(PRInt32 type)
     // Check to see if parent is a file input
     nsresult result;
     nsCOMPtr<nsIContent> parentContent;
-    result = mContent->GetParent(*getter_AddRefs(parentContent));
+    result = mContent->GetParent(getter_AddRefs(parentContent));
     if (NS_SUCCEEDED(result) && parentContent) {
       nsCOMPtr<nsIAtom> atom;
-      result = parentContent->GetTag(*getter_AddRefs(atom));
+      result = parentContent->GetTag(getter_AddRefs(atom));
       if (NS_SUCCEEDED(result) && atom) {
         if (atom.get() == nsHTMLAtoms::input) {
 
diff --git a/layout/forms/nsIsIndexFrame.cpp b/layout/forms/nsIsIndexFrame.cpp
index e64cb0b88e75..76c7d359e729 100644
--- a/layout/forms/nsIsIndexFrame.cpp
+++ b/layout/forms/nsIsIndexFrame.cpp
@@ -228,9 +228,9 @@ nsIsIndexFrame::CreateAnonymousContent(nsIPresContext* aPresContext,
 
   // Get the node info manager (used to create hr's and input's)
   nsCOMPtr<nsIDocument> doc;
-  mContent->GetDocument(*getter_AddRefs(doc));
+  mContent->GetDocument(getter_AddRefs(doc));
   nsCOMPtr<nsINodeInfoManager> nimgr;
-  result = doc->GetNodeInfoManager(*getter_AddRefs(nimgr));
+  result = doc->GetNodeInfoManager(getter_AddRefs(nimgr));
   NS_ENSURE_SUCCESS(result, result);
 
   nsCOMPtr<nsIElementFactory> ef(do_GetService(kHTMLElementFactoryCID,&result));
@@ -239,7 +239,7 @@ nsIsIndexFrame::CreateAnonymousContent(nsIPresContext* aPresContext,
   // Create an hr
   nsCOMPtr<nsINodeInfo> hrInfo;
   nimgr->GetNodeInfo(nsHTMLAtoms::hr, nsnull, kNameSpaceID_None,
-                     *getter_AddRefs(hrInfo));
+                     getter_AddRefs(hrInfo));
   nsCOMPtr<nsIContent> content;
   result = ef->CreateInstanceByTag(hrInfo,getter_AddRefs(content));
   NS_ENSURE_SUCCESS(result, result);
@@ -265,7 +265,7 @@ nsIsIndexFrame::CreateAnonymousContent(nsIPresContext* aPresContext,
   // Create text input field
   nsCOMPtr<nsINodeInfo> inputInfo;
   nimgr->GetNodeInfo(nsHTMLAtoms::input, nsnull, kNameSpaceID_None,
-                     *getter_AddRefs(inputInfo));
+                     getter_AddRefs(inputInfo));
 
   result = ef->CreateInstanceByTag(inputInfo,getter_AddRefs(content));
   NS_ENSURE_SUCCESS(result, result);
@@ -419,12 +419,12 @@ nsIsIndexFrame::OnSubmit(nsIPresContext* aPresContext)
     // We'll need it now to form the URL we're submitting to.
     // We'll also need it later to get the DOM window when notifying form submit observers (bug 33203)
     nsCOMPtr<nsIDocument> document;
-    mContent->GetDocument(*getter_AddRefs(document));
+    mContent->GetDocument(getter_AddRefs(document));
     if (!document) return NS_OK; // No doc means don't submit, see Bug 28988
 
     // Resolve url to an absolute url
     nsCOMPtr<nsIURI> docURL;
-    document->GetBaseURL(*getter_AddRefs(docURL));
+    document->GetBaseURL(getter_AddRefs(docURL));
     NS_ASSERTION(docURL, "No Base URL found in Form Submit!\n");
     if (!docURL) return NS_OK; // No base URL -> exit early, see Bug 30721
 
@@ -502,21 +502,18 @@ nsIsIndexFrame::OnSubmit(nsIPresContext* aPresContext)
 void nsIsIndexFrame::GetSubmitCharset(nsCString& oCharset)
 {
   oCharset.Assign(NS_LITERAL_CSTRING("UTF-8")); // default to utf-8
-  nsresult rv;
   // XXX
   // We may want to get it from the HTML 4 Accept-Charset attribute first
   // see 17.3 The FORM element in HTML 4 for details
 
   // Get the charset from document
-  nsIDocument* doc = nsnull;
-  mContent->GetDocument(doc);
-  if( nsnull != doc ) {
+  nsCOMPtr<nsIDocument> doc;
+  mContent->GetDocument(getter_AddRefs(doc));
+  if (doc) {
     nsAutoString docCharset;
-    rv = doc->GetDocumentCharacterSet(docCharset);
+    doc->GetDocumentCharacterSet(docCharset);
     CopyUCS2toASCII(docCharset, oCharset);
-    NS_RELEASE(doc);
   }
-
 }
 
 NS_IMETHODIMP nsIsIndexFrame::GetEncoder(nsIUnicodeEncoder** encoder)
diff --git a/layout/forms/nsListControlFrame.cpp b/layout/forms/nsListControlFrame.cpp
index 6221a64835ca..cb6399f291d2 100644
--- a/layout/forms/nsListControlFrame.cpp
+++ b/layout/forms/nsListControlFrame.cpp
@@ -1469,16 +1469,19 @@ nsListControlFrame::IsOptionElement(nsIContent* aContent)
 nsIContent *
 nsListControlFrame::GetOptionFromContent(nsIContent *aContent) 
 {
-  nsIContent * content = aContent;
-  NS_IF_ADDREF(content);
-  while (nsnull != content) {
+  nsCOMPtr<nsIContent> content = aContent;
+  while (content) {
     if (IsOptionElement(content)) {
-      return content;
+      nsIContent *out = content;
+      NS_ADDREF(out);
+      return out;
     }
-    nsIContent * node = content;
-    node->GetParent(content); // this add refs
-    NS_RELEASE(node);
+
+    nsCOMPtr<nsIContent> parent;
+    content->GetParent(getter_AddRefs(parent));
+    parent.swap(content);
   }
+
   return nsnull;
 }
 
@@ -3152,7 +3155,7 @@ nsListControlFrame::ScrollToFrame(nsIContent* aOptElement)
         // XXX this assume only one level of nesting of optgroups
         //   which is all the spec specifies at the moment.
         nsCOMPtr<nsIContent> parentContent;
-        aOptElement->GetParent(*getter_AddRefs(parentContent));
+        aOptElement->GetParent(getter_AddRefs(parentContent));
         nsCOMPtr<nsIDOMHTMLOptGroupElement> optGroup(do_QueryInterface(parentContent));
         nsRect optRect(0,0,0,0);
         if (optGroup) {
diff --git a/layout/forms/nsTextControlFrame.cpp b/layout/forms/nsTextControlFrame.cpp
index db31f5c32e16..310d13f55545 100644
--- a/layout/forms/nsTextControlFrame.cpp
+++ b/layout/forms/nsTextControlFrame.cpp
@@ -263,7 +263,7 @@ nsTextInputListener::NotifySelectionChanged(nsIDOMDocument* aDoc, nsISelection*
     if (content) 
     {
       nsCOMPtr<nsIDocument> doc;
-      if (NS_SUCCEEDED(content->GetDocument(*getter_AddRefs(doc)))) 
+      if (NS_SUCCEEDED(content->GetDocument(getter_AddRefs(doc))))
       {
         if (doc) 
         {
@@ -386,7 +386,7 @@ nsTextInputListener::UpdateTextInputCommands(const nsAString& commandsToUpdate)
   NS_ENSURE_TRUE(content, NS_ERROR_FAILURE);
   
   nsCOMPtr<nsIDocument> doc;
-  rv = content->GetDocument(*getter_AddRefs(doc));
+  rv = content->GetDocument(getter_AddRefs(doc));
   NS_ENSURE_TRUE(doc, NS_ERROR_FAILURE);
 
   nsCOMPtr<nsIScriptGlobalObject> scriptGlobalObject;
@@ -780,11 +780,11 @@ nsTextInputSelectionImpl::CompleteMove(PRBool aForward, PRBool aExtend)
     if (offset > 0)
     {
       nsCOMPtr<nsIContent> child;
-      result = parentDIV->ChildAt(offset - 1, *getter_AddRefs(child));
+      result = parentDIV->ChildAt(offset - 1, getter_AddRefs(child));
       if (NS_SUCCEEDED(result) && child)
       {
         nsCOMPtr<nsIAtom> tagName;
-        result = child->GetTag(*getter_AddRefs(tagName));
+        result = child->GetTag(getter_AddRefs(tagName));
         if (NS_SUCCEEDED(result) && tagName.get() == nsHTMLAtoms::br)
         {
           --offset;
@@ -1322,7 +1322,7 @@ PRBool nsTextControlFrame::IsTextArea() const
     return PR_FALSE;
 
   nsCOMPtr<nsIAtom> tag;
-  mContent->GetTag(*getter_AddRefs(tag));
+  mContent->GetTag(getter_AddRefs(tag));
 
   if (nsHTMLAtoms::textarea == tag)
     return PR_TRUE;
@@ -1655,7 +1655,7 @@ nsTextControlFrame::CreateAnonymousContent(nsIPresContext* aPresContext,
     return NS_ERROR_FAILURE;
 
   nsCOMPtr<nsINodeInfoManager> nodeInfoManager;
-  rv = doc->GetNodeInfoManager(*getter_AddRefs(nodeInfoManager));
+  rv = doc->GetNodeInfoManager(getter_AddRefs(nodeInfoManager));
 
   if (NS_FAILED(rv))
     return rv;
@@ -1665,7 +1665,7 @@ nsTextControlFrame::CreateAnonymousContent(nsIPresContext* aPresContext,
   nsCOMPtr<nsINodeInfo> nodeInfo;
   rv = nodeInfoManager->GetNodeInfo(nsHTMLAtoms::div, nsnull,
                                     kNameSpaceID_XHTML,
-                                    *getter_AddRefs(nodeInfo));
+                                    getter_AddRefs(nodeInfo));
 
   if (NS_FAILED(rv))
     return rv;
@@ -2295,10 +2295,10 @@ nsTextControlFrame::SelectAllContents()
     // We never want to place the selection after the last
     // br under the root node!
     nsCOMPtr<nsIContent> child;
-    rv = rootContent->ChildAt(numChildren - 1, *getter_AddRefs(child));
+    rv = rootContent->ChildAt(numChildren - 1, getter_AddRefs(child));
     if (NS_SUCCEEDED(rv) && child) {
       nsCOMPtr<nsIAtom> tagName;
-      rv = child->GetTag(*getter_AddRefs(tagName));
+      rv = child->GetTag(getter_AddRefs(tagName));
       if (NS_SUCCEEDED(rv) && tagName == nsHTMLAtoms::br)
         --numChildren;
     }
diff --git a/layout/generic/nsAreaFrame.cpp b/layout/generic/nsAreaFrame.cpp
index 394f978d25e6..126d572f1079 100644
--- a/layout/generic/nsAreaFrame.cpp
+++ b/layout/generic/nsAreaFrame.cpp
@@ -93,7 +93,7 @@ nsAreaFrame::RegUnregAccessKey(nsIPresContext* aPresContext,
 
   // find out what type of element this is
   nsCOMPtr<nsIAtom> atom;
-  nsresult rv = mContent->GetTag(*getter_AddRefs(atom));
+  nsresult rv = mContent->GetTag(getter_AddRefs(atom));
   if (NS_FAILED(rv))
     return rv;
 
diff --git a/layout/generic/nsBRFrame.cpp b/layout/generic/nsBRFrame.cpp
index c987e22e31f6..6fc58821c770 100644
--- a/layout/generic/nsBRFrame.cpp
+++ b/layout/generic/nsBRFrame.cpp
@@ -228,7 +228,7 @@ NS_IMETHODIMP BRFrame::GetContentAndOffsetsFromPoint(nsIPresContext* aCX,
 {
   if (!mContent)
     return NS_ERROR_NULL_POINTER;
-  nsresult result = mContent->GetParent(*aContent);
+  nsresult result = mContent->GetParent(aContent);
   if (NS_SUCCEEDED(result) && *aContent)
     result = (*aContent)->IndexOf(mContent, aOffsetBegin);
   aOffsetEnd = aOffsetBegin;
@@ -244,7 +244,7 @@ NS_IMETHODIMP BRFrame::PeekOffset(nsIPresContext* aPresContext, nsPeekOffsetStru
   nsCOMPtr<nsIContent> parentContent;
   PRInt32 offsetBegin; //offset of this content in its parents child list. base 0
 
-  nsresult result = mContent->GetParent(*getter_AddRefs(parentContent));
+  nsresult result = mContent->GetParent(getter_AddRefs(parentContent));
 
 
   if (NS_SUCCEEDED(result) && parentContent)
diff --git a/layout/generic/nsBulletFrame.cpp b/layout/generic/nsBulletFrame.cpp
index ce97fb9f4e35..441299a4a6fa 100644
--- a/layout/generic/nsBulletFrame.cpp
+++ b/layout/generic/nsBulletFrame.cpp
@@ -144,7 +144,7 @@ nsBulletFrame::Init(nsIPresContext*  aPresContext,
     nsCOMPtr<nsIURI> documentURI;
     nsCOMPtr<nsIDocument> doc;
     if (mContent) {
-      (void) mContent->GetDocument(*getter_AddRefs(doc));
+      (void) mContent->GetDocument(getter_AddRefs(doc));
       if (doc) {
         doc->GetDocumentURL(getter_AddRefs(documentURI));
       }
@@ -1636,7 +1636,7 @@ nsBulletFrame::Reflow(nsIPresContext* aPresContext,
         nsCOMPtr<nsIURI> documentURI;
         nsCOMPtr<nsIDocument> doc;
         if (mContent) {
-          (void) mContent->GetDocument(*getter_AddRefs(doc));
+          (void) mContent->GetDocument(getter_AddRefs(doc));
           if (doc) {
             doc->GetDocumentURL(getter_AddRefs(documentURI));
           }
@@ -1813,13 +1813,13 @@ nsBulletFrame::GetBaseURI(nsIURI **aURI)
   nsCOMPtr<nsIURI> baseURI;
   nsCOMPtr<nsIHTMLContent> htmlContent(do_QueryInterface(mContent, &rv));
   if (NS_SUCCEEDED(rv)) {
-    htmlContent->GetBaseURL(*getter_AddRefs(baseURI));
+    htmlContent->GetBaseURL(getter_AddRefs(baseURI));
   }
   else {
     nsCOMPtr<nsIDocument> doc;
-    mContent->GetDocument(*getter_AddRefs(doc));
+    mContent->GetDocument(getter_AddRefs(doc));
     if (doc) {
-      doc->GetBaseURL(*getter_AddRefs(baseURI));
+      doc->GetBaseURL(getter_AddRefs(baseURI));
     }
   }
   *aURI = baseURI;
diff --git a/layout/generic/nsFrame.cpp b/layout/generic/nsFrame.cpp
index 11f5b34d8cdf..5c36b76f6b3e 100644
--- a/layout/generic/nsFrame.cpp
+++ b/layout/generic/nsFrame.cpp
@@ -869,7 +869,7 @@ nsFrame::Paint(nsIPresContext*      aPresContext,
 
 
   nsCOMPtr<nsIContent> newContent;
-  result = mContent->GetParent(*getter_AddRefs(newContent));
+  result = mContent->GetParent(getter_AddRefs(newContent));
 
 //check to see if we are anonymouse content
   PRInt32 offset;
@@ -1115,7 +1115,7 @@ nsFrame::GetDataForTableSelection(nsIFrameSelection *aFrameSelection,
   if (!tableOrCellContent) return NS_ERROR_FAILURE;
 
   nsCOMPtr<nsIContent> parentContent;
-  result = tableOrCellContent->GetParent(*getter_AddRefs(parentContent));
+  result = tableOrCellContent->GetParent(getter_AddRefs(parentContent));
   if (NS_FAILED(result)) return result;
   if (!parentContent) return NS_ERROR_FAILURE;
 
@@ -1406,9 +1406,9 @@ nsFrame::HandlePress(nsIPresContext* aPresContext,
        }
   
        // now try the parent
-       nsIContent* parent;
-       content->GetParent(parent);
-       content = dont_AddRef(parent);
+       nsCOMPtr<nsIContent> parent;
+       content->GetParent(getter_AddRefs(parent));
+       content.swap(parent);
   
     } // if browser, not editor
   }
@@ -2042,7 +2042,7 @@ nsresult nsFrame::GetContentAndOffsetsFromPoint(nsIPresContext* aCX,
         if (NS_SUCCEEDED(result) && kidContent) {
           nsCOMPtr<nsIContent> content;
 
-          result = kidContent->GetParent(*getter_AddRefs(content));
+          result = kidContent->GetParent(getter_AddRefs(content));
 
           if (NS_SUCCEEDED(result) && content) {
             PRInt32 kidCount = 0;
@@ -2171,7 +2171,7 @@ nsresult nsFrame::GetContentAndOffsetsFromPoint(nsIPresContext* aCX,
   thisRect.x = offsetPoint.x;
   thisRect.y = offsetPoint.y;
 
-  result = mContent->GetParent(*aNewContent);
+  result = mContent->GetParent(aNewContent);
   if (*aNewContent){
     
     PRInt32 contentOffset(aContentOffset); //temp to hold old value in case of failure
@@ -2792,19 +2792,17 @@ NS_IMETHODIMP nsFrame::Scrolled(nsIView *aView)
 
 PRInt32 nsFrame::ContentIndexInContainer(const nsIFrame* aFrame)
 {
-  nsIContent* content;
   PRInt32     result = -1;
 
-  aFrame->GetContent(&content);
-  if (nsnull != content) {
-    nsIContent* parentContent;
+  nsCOMPtr<nsIContent> content;
+  aFrame->GetContent(getter_AddRefs(content));
+  if (content) {
+    nsCOMPtr<nsIContent> parentContent;
 
-    content->GetParent(parentContent);
-    if (nsnull != parentContent) {
+    content->GetParent(getter_AddRefs(parentContent));
+    if (parentContent) {
       parentContent->IndexOf(content, result);
-      NS_RELEASE(parentContent);
     }
-    NS_RELEASE(content);
   }
 
   return result;
@@ -2873,13 +2871,12 @@ nsFrame::MakeFrameName(const nsAString& aType, nsAString& aResult) const
 {
   aResult = aType;
   if (nsnull != mContent) {
-    nsIAtom* tag;
-    mContent->GetTag(tag);
-    if ((tag != nsnull) && (tag != nsLayoutAtoms::textTagName)) {
+    nsCOMPtr<nsIAtom> tag;
+    mContent->GetTag(getter_AddRefs(tag));
+    if (tag && tag != nsLayoutAtoms::textTagName) {
       nsAutoString buf;
       tag->ToString(buf);
       aResult.Append(NS_LITERAL_STRING("(") + buf + NS_LITERAL_STRING(")"));
-      NS_RELEASE(tag);
     }
   }
   char buf[40];
@@ -3269,7 +3266,7 @@ nsFrame::GetPointFromOffset(nsIPresContext* inPresContext, nsIRenderingContext*
   {
     nsCOMPtr<nsIContent> newContent;
     PRInt32 newOffset;
-    nsresult result = mContent->GetParent(*getter_AddRefs(newContent));
+    nsresult result = mContent->GetParent(getter_AddRefs(newContent));
     if (newContent){
       result = newContent->IndexOf(mContent, newOffset);
       if (NS_FAILED(result)) 
@@ -3474,7 +3471,7 @@ nsFrame::GetNextPrevLineFromeBlockFrame(nsIPresContext* aPresContext,
                 nsCOMPtr<nsIContent> parent;
                 if (content)
                 {
-                  content->GetParent(*getter_AddRefs(parent));
+                  content->GetParent(getter_AddRefs(parent));
                   if (parent)
                   {
                     aPos->mResultContent = parent;
@@ -3837,7 +3834,7 @@ nsFrame::PeekOffset(nsIPresContext* aPresContext, nsPeekOffsetStruct *aPos)
       {
         nsCOMPtr<nsIContent> newContent;
         PRInt32 newOffset;
-        result = mContent->GetParent(*getter_AddRefs(newContent));
+        result = mContent->GetParent(getter_AddRefs(newContent));
         if (newContent){
           aPos->mResultContent = newContent;
           result = newContent->IndexOf(mContent, newOffset);
@@ -4950,14 +4947,13 @@ GetTagName(nsFrame* aFrame, nsIContent* aContent, PRIntn aResultSize,
 {
   char namebuf[40];
   namebuf[0] = 0;
-  if (nsnull != aContent) {
-    nsIAtom* tag;
-    aContent->GetTag(tag);
-    if (nsnull != tag) {
+  if (aContent) {
+    nsCOMPtr<nsIAtom> tag;
+    aContent->GetTag(getter_AddRefs(tag));
+    if (tag) {
       nsAutoString tmp;
       tag->ToString(tmp);
       tmp.ToCString(namebuf, sizeof(namebuf));
-      NS_RELEASE(tag);
     }
   }
   PR_snprintf(aResult, aResultSize, "%s@%p", namebuf, aFrame);
diff --git a/layout/generic/nsFrameFrame.cpp b/layout/generic/nsFrameFrame.cpp
index 8986d42e9020..5c9205d17c55 100644
--- a/layout/generic/nsFrameFrame.cpp
+++ b/layout/generic/nsFrameFrame.cpp
@@ -619,7 +619,7 @@ nsHTMLFrameOuterFrame::AttributeChanged(nsIPresContext* aPresContext,
                                         PRInt32 aHint)
 {
   nsCOMPtr<nsIAtom> type;
-  aChild->GetTag(*getter_AddRefs(type));
+  aChild->GetTag(getter_AddRefs(type));
 
   if ((type != nsHTMLAtoms::object && aAttribute == nsHTMLAtoms::src) ||
       (type == nsHTMLAtoms::object && aAttribute == nsHTMLAtoms::data)) {
@@ -633,10 +633,10 @@ nsHTMLFrameOuterFrame::AttributeChanged(nsIPresContext* aPresContext,
   // If the noResize attribute changes, dis/allow frame to be resized
   else if (aAttribute == nsHTMLAtoms::noresize) {
     nsCOMPtr<nsIContent> parentContent;
-    mContent->GetParent(*getter_AddRefs(parentContent));
+    mContent->GetParent(getter_AddRefs(parentContent));
 
     nsCOMPtr<nsIAtom> parentTag;
-    parentContent->GetTag(*getter_AddRefs(parentTag));
+    parentContent->GetTag(getter_AddRefs(parentTag));
 
     if (parentTag == nsHTMLAtoms::frameset) {
       nsIFrame* parentFrame = nsnull;
@@ -768,7 +768,7 @@ PRBool nsHTMLFrameInnerFrame::GetURL(nsIContent* aContent, nsString& aResult)
 {
   aResult.SetLength(0);
   nsCOMPtr<nsIAtom> type;
-  aContent->GetTag(*getter_AddRefs(type));
+  aContent->GetTag(getter_AddRefs(type));
 
   if (type.get() == nsHTMLAtoms::object) {
     if (NS_CONTENT_ATTR_HAS_VALUE == (aContent->GetAttr(kNameSpaceID_None, nsHTMLAtoms::data, aResult)))
diff --git a/layout/generic/nsFrameSetFrame.cpp b/layout/generic/nsFrameSetFrame.cpp
index 4515b59a0e22..6046a1b0fac1 100644
--- a/layout/generic/nsFrameSetFrame.cpp
+++ b/layout/generic/nsFrameSetFrame.cpp
@@ -284,7 +284,7 @@ nsHTMLFramesetFrame::Observe(nsISupports* aObject, const char* aAction,
   nsAutoString prefName(aPrefName);
   if (prefName.Equals(NS_LITERAL_STRING(kFrameResizePref))) {
     nsCOMPtr<nsIDocument> doc;
-    mContent->GetDocument(*getter_AddRefs(doc));
+    mContent->GetDocument(getter_AddRefs(doc));
     if (doc) {
       doc->BeginUpdate();
       doc->AttributeWillChange(mContent,
@@ -402,11 +402,11 @@ nsHTMLFramesetFrame::Init(nsIPresContext*  aPresContext,
       break;
     }
     nsCOMPtr<nsIContent> child;
-    mContent->ChildAt(childX, *getter_AddRefs(child));
+    mContent->ChildAt(childX, getter_AddRefs(child));
     if (!child->IsContentOfType(nsIContent::eHTML))
       continue;
     nsCOMPtr<nsIAtom> tag;
-    child->GetTag(*getter_AddRefs(tag));
+    child->GetTag(getter_AddRefs(tag));
     if (tag == nsHTMLAtoms::frameset || tag == nsHTMLAtoms::frame) {
       nsRefPtr<nsStyleContext> kidSC;
       nsresult result;
@@ -715,14 +715,14 @@ nsHTMLFramesetFrame* nsHTMLFramesetFrame::GetFramesetParent(nsIFrame* aChild)
 
   if (content) { 
     nsCOMPtr<nsIContent> contentParent;
-    content->GetParent(*getter_AddRefs(contentParent));
+    content->GetParent(getter_AddRefs(contentParent));
 
     nsCOMPtr<nsIHTMLContent> contentParent2 =
       do_QueryInterface(contentParent);
 
     if (contentParent2) {
       nsCOMPtr<nsIAtom> tag;
-      contentParent2->GetTag(*getter_AddRefs(tag));
+      contentParent2->GetTag(getter_AddRefs(tag));
 
       if (tag == nsHTMLAtoms::frameset) {
         nsIFrame* fptr;
@@ -1358,11 +1358,11 @@ nsHTMLFramesetFrame::RecalculateBorderResize()
   mContent->ChildCount(numChildren);
   for (childIndex = 0; childIndex < numChildren; childIndex++) {
     nsCOMPtr<nsIContent> childCon;
-    mContent->ChildAt(childIndex, *getter_AddRefs(childCon));
+    mContent->ChildAt(childIndex, getter_AddRefs(childCon));
     nsCOMPtr<nsIHTMLContent> child(do_QueryInterface(childCon));
     if (child) {
       nsCOMPtr<nsIAtom> tag;
-      child->GetTag(*getter_AddRefs(tag));
+      child->GetTag(getter_AddRefs(tag));
       if (tag == nsHTMLAtoms::frameset) {
         childTypes[frameOrFramesetChildIndex++] = FRAMESET;
       } else if (tag == nsHTMLAtoms::frame) {
diff --git a/layout/generic/nsGfxScrollFrame.cpp b/layout/generic/nsGfxScrollFrame.cpp
index a80016dcc07c..9a56b92d3894 100644
--- a/layout/generic/nsGfxScrollFrame.cpp
+++ b/layout/generic/nsGfxScrollFrame.cpp
@@ -391,14 +391,14 @@ nsGfxScrollFrame::CreateAnonymousContent(nsIPresContext* aPresContext,
 
   nsCOMPtr<nsINodeInfoManager> nodeInfoManager;
   if (document)
-    document->GetNodeInfoManager(*getter_AddRefs(nodeInfoManager));
+    document->GetNodeInfoManager(getter_AddRefs(nodeInfoManager));
   NS_ENSURE_TRUE(nodeInfoManager, NS_ERROR_FAILURE);
 
   nsCOMPtr<nsINodeInfo> nodeInfo;
   nodeInfoManager->GetNodeInfo(NS_LITERAL_STRING("scrollbar"),
                                NS_LITERAL_STRING(""),
                                NS_LITERAL_STRING("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"),
-                               *getter_AddRefs(nodeInfo));
+                               getter_AddRefs(nodeInfo));
 
   ScrollbarStyles styles = GetScrollbarStyles();
   if (styles.mHorizontal == NS_STYLE_OVERFLOW_AUTO
diff --git a/layout/generic/nsHTMLReflowState.cpp b/layout/generic/nsHTMLReflowState.cpp
index 4b153341cc91..f35318c695de 100644
--- a/layout/generic/nsHTMLReflowState.cpp
+++ b/layout/generic/nsHTMLReflowState.cpp
@@ -1335,22 +1335,20 @@ nsHTMLReflowState::InitAbsoluteConstraints(nsIPresContext* aPresContext,
 static PRBool
 IsInitialContainingBlock(nsIFrame* aFrame)
 {
-  nsIContent* content;
+  nsCOMPtr<nsIContent> content;
   PRBool      result = PR_FALSE;
 
-  aFrame->GetContent(&content);
+  aFrame->GetContent(getter_AddRefs(content));
   if (content) {
-    nsIContent* parentContent;
+    nsCOMPtr<nsIContent> parentContent;
 
-    content->GetParent(parentContent);
+    content->GetParent(getter_AddRefs(parentContent));
     if (!parentContent) {
       // The containing block corresponds to the document element so it's
       // the initial containing block
       result = PR_TRUE;
     }
-    NS_IF_RELEASE(parentContent);
   }
-  NS_IF_RELEASE(content);
   return result;
 }
 
@@ -1464,14 +1462,14 @@ CalcQuirkContainingBlockHeight(const nsHTMLReflowState& aReflowState,
       if(firstBlockRS) {
         firstBlockRS->frame->GetContent(getter_AddRefs(frameContent));
         if (frameContent) {
-          frameContent->GetTag(*getter_AddRefs(contentTag));
+          frameContent->GetTag(getter_AddRefs(contentTag));
           NS_ASSERTION(contentTag.get() == nsHTMLAtoms::body, "block is not BODY");
         }
       }
       if(firstAreaRS) {
         firstAreaRS->frame->GetContent(getter_AddRefs(frameContent));
         if (frameContent) {
-          frameContent->GetTag(*getter_AddRefs(contentTag));
+          frameContent->GetTag(getter_AddRefs(contentTag));
           NS_ASSERTION(contentTag.get() == nsHTMLAtoms::html, "Area frame is not HTML element");
         }
       }
@@ -2804,7 +2802,7 @@ nsHTMLReflowState::IsBidiFormControl(nsIPresContext* aPresContext)
       if  (content->IsContentOfType(nsIContent::eHTML_FORM_CONTROL)) {
         return PR_TRUE;
       }
-      content->GetParent(*getter_AddRefs(parent));
+      content->GetParent(getter_AddRefs(parent));
       content = parent;
     }
   } else {
diff --git a/layout/generic/nsImageFrame.cpp b/layout/generic/nsImageFrame.cpp
index 591b8862b6a8..b865cb8d31ae 100644
--- a/layout/generic/nsImageFrame.cpp
+++ b/layout/generic/nsImageFrame.cpp
@@ -494,7 +494,7 @@ nsImageFrame::HandleLoadError(nsresult aStatus, nsIPresShell* aPresShell)
       // We are in quirks mode, so we can just check the tag name; no need to
       // check the namespace.
       nsCOMPtr<nsINodeInfo> nodeInfo;
-      mContent->GetNodeInfo(*getter_AddRefs(nodeInfo));
+      mContent->GetNodeInfo(getter_AddRefs(nodeInfo));
       
       if (!mContent->HasAttr(kNameSpaceID_None, nsHTMLAtoms::alt) &&
           nodeInfo &&
@@ -1218,7 +1218,7 @@ nsImageFrame::DisplayAltFeedback(nsIPresContext*      aPresContext,
 
     GetContent(getter_AddRefs(content));
     if (content) {
-      content->GetTag(*getter_AddRefs(tag));
+      content->GetTag(getter_AddRefs(tag));
       if (tag) {
         nsCSSFrameConstructor::GetAlternateTextFor(content, tag, altText);
         DisplayAltText(aPresContext, aRenderingContext, altText, inner);
@@ -1434,7 +1434,7 @@ nsImageFrame::Paint(nsIPresContext*      aPresContext,
         if (rangeCount == 1) //if not one then let code drop to nsFrame::Paint
         {
           nsCOMPtr<nsIContent> parentContent;
-          mContent->GetParent(*getter_AddRefs(parentContent));
+          mContent->GetParent(getter_AddRefs(parentContent));
           if (parentContent)
           {
             PRInt32 thisOffset;
@@ -1479,7 +1479,7 @@ nsImageFrame::GetImageMap(nsIPresContext* aPresContext)
 {
   if (!mImageMap) {
     nsCOMPtr<nsIDocument> doc;
-    mContent->GetDocument(*getter_AddRefs(doc));
+    mContent->GetDocument(getter_AddRefs(doc));
     if (!doc) {
       return nsnull;
     }
@@ -1605,7 +1605,7 @@ nsImageFrame::GetAnchorHREFAndTarget(nsString& aHref, nsString& aTarget)
 
   // Walk up the content tree, looking for an nsIDOMAnchorElement
   nsCOMPtr<nsIContent> content;
-  mContent->GetParent(*getter_AddRefs(content));
+  mContent->GetParent(getter_AddRefs(content));
   while (content) {
     nsCOMPtr<nsIDOMHTMLAnchorElement> anchor(do_QueryInterface(content));
     if (anchor) {
@@ -1617,7 +1617,7 @@ nsImageFrame::GetAnchorHREFAndTarget(nsString& aHref, nsString& aTarget)
       break;
     }
     nsCOMPtr<nsIContent> parent;
-    content->GetParent(*getter_AddRefs(parent));
+    content->GetParent(getter_AddRefs(parent));
     content = parent;
   }
   return status;
@@ -1704,10 +1704,10 @@ nsImageFrame::HandleEvent(nsIPresContext* aPresContext,
             nsAutoString src;
             if (GetAnchorHREFAndTarget(src, target)) {
               nsCOMPtr<nsINodeInfo> nodeInfo;
-              mContent->GetNodeInfo(*getter_AddRefs(nodeInfo));
+              mContent->GetNodeInfo(getter_AddRefs(nodeInfo));
               NS_ASSERTION(nodeInfo, "Image content without a nodeinfo?");
               nsCOMPtr<nsIDocument> doc;
-              nodeInfo->GetDocument(*getter_AddRefs(doc));
+              nodeInfo->GetDocument(getter_AddRefs(doc));
               nsAutoString charset;
               if (doc) {
                 doc->GetDocumentCharacterSet(charset);
@@ -1901,7 +1901,7 @@ nsImageFrame::GetDocumentCharacterSet(nsAString& aCharset) const
   nsCOMPtr<nsIHTMLContent> htmlContent(do_QueryInterface(mContent, &rv));
   if (NS_SUCCEEDED(rv)) {
     nsCOMPtr<nsIDocument> doc;
-    rv = htmlContent->GetDocument(*getter_AddRefs(doc));
+    rv = htmlContent->GetDocument(getter_AddRefs(doc));
     if (NS_SUCCEEDED(rv))
       (void) doc->GetDocumentCharacterSet(aCharset);
   }
@@ -1929,14 +1929,14 @@ nsImageFrame::GetBaseURI(nsIURI **aURI)
   nsCOMPtr<nsIURI> baseURI;
   nsCOMPtr<nsIHTMLContent> htmlContent(do_QueryInterface(mContent, &rv));
   if (NS_SUCCEEDED(rv)) {
-    htmlContent->GetBaseURL(*getter_AddRefs(baseURI));
+    htmlContent->GetBaseURL(getter_AddRefs(baseURI));
   }
   else {
     nsCOMPtr<nsIDocument> doc;
     if (mContent) {
-      rv = mContent->GetDocument(*getter_AddRefs(doc));
+      rv = mContent->GetDocument(getter_AddRefs(doc));
       if (doc) {
-        doc->GetBaseURL(*getter_AddRefs(baseURI));
+        doc->GetBaseURL(getter_AddRefs(baseURI));
       }
     }
   }
diff --git a/layout/generic/nsImageMap.cpp b/layout/generic/nsImageMap.cpp
index 3fe1a6db1892..ff993bf71970 100644
--- a/layout/generic/nsImageMap.cpp
+++ b/layout/generic/nsImageMap.cpp
@@ -449,11 +449,11 @@ void RectArea::ParseCoords(const nsAString& aSpec)
       return;
 
     nsCOMPtr<nsINodeInfo> nodeInfo;
-    mArea->GetNodeInfo(*getter_AddRefs(nodeInfo));
+    mArea->GetNodeInfo(getter_AddRefs(nodeInfo));
     NS_ASSERTION(nodeInfo, "Element with no nodeinfo");
     
     nsCOMPtr<nsIDocument> doc;
-    nodeInfo->GetDocument(*getter_AddRefs(doc));
+    nodeInfo->GetDocument(getter_AddRefs(doc));
     nsCAutoString urlSpec;
     if (doc) {
       nsCOMPtr<nsIURI> uri;
@@ -816,8 +816,8 @@ nsImageMap::Init(nsIPresShell* aPresShell, nsIFrame* aImageFrame, nsIDOMHTMLMapE
   nsresult rv;
   mMap = do_QueryInterface(aMap, &rv);
   NS_ASSERTION(mMap, "aMap is not an nsIHTMLContent!");
-  rv = mMap->GetDocument(mDocument);
-  if (NS_SUCCEEDED(rv) && (nsnull != mDocument)) {
+  rv = mMap->GetDocument(&mDocument);
+  if (NS_SUCCEEDED(rv) && mDocument) {
     mDocument->AddObserver(NS_STATIC_CAST(nsIDocumentObserver*, this));
     // mDocument is a weak reference, so release the reference we got
     nsIDocument *temp = mDocument;
@@ -838,7 +838,7 @@ nsImageMap::UpdateAreasForBlock(nsIContent* aParent, PRBool* aFoundAnchor)
   aParent->ChildCount(n);
   for (i = 0; (i < n) && NS_SUCCEEDED(rv); i++) {
     nsCOMPtr<nsIContent> child;
-    rv = aParent->ChildAt(i, *getter_AddRefs(child));
+    rv = aParent->ChildAt(i, getter_AddRefs(child));
     if (NS_SUCCEEDED(rv)) {
       nsCOMPtr<nsIDOMHTMLAnchorElement> area = do_QueryInterface(child, &rv);
       if (NS_SUCCEEDED(rv)) {
@@ -866,7 +866,7 @@ nsImageMap::UpdateAreas()
   mMap->ChildCount(n);
   for (i = 0; i < n; i++) {
     nsCOMPtr<nsIContent> child;
-    mMap->ChildAt(i, *getter_AddRefs(child));
+    mMap->ChildAt(i, getter_AddRefs(child));
 
     // Only look at elements and not text, comments, etc.
     nsCOMPtr<nsIDOMHTMLElement> element = do_QueryInterface(child);
@@ -959,7 +959,7 @@ nsImageMap::IsInside(nscoord aX, nscoord aY,
         // Set the image loader's source URL and base URL
         nsCOMPtr<nsIURI> baseUri;
 
-        mMap->GetBaseURL(*getter_AddRefs(baseUri));
+        mMap->GetBaseURL(getter_AddRefs(baseUri));
 
         if (!baseUri) {
           return PR_FALSE;
@@ -1028,7 +1028,7 @@ nsImageMap::IsAncestorOf(nsIContent* aContent,
                          nsIContent* aAncestorContent)
 {
   nsCOMPtr<nsIContent> parent;
-  aContent->GetParent(*getter_AddRefs(parent));
+  aContent->GetParent(getter_AddRefs(parent));
   if (parent) {
     return parent == aAncestorContent ||
            IsAncestorOf(parent, aAncestorContent);
@@ -1045,7 +1045,7 @@ nsImageMap::ContentChanged(nsIDocument *aDocument,
   // If the parent of the changing content node is our map then update
   // the map.
   nsCOMPtr<nsIContent> parent;
-  nsresult rv = aContent->GetParent(*getter_AddRefs(parent));
+  nsresult rv = aContent->GetParent(getter_AddRefs(parent));
   if (NS_SUCCEEDED(rv) && (nsnull != parent)) {
     if ((parent == mMap) || 
         (mContainsBlockContents && IsAncestorOf(parent, mMap))) {
@@ -1066,7 +1066,7 @@ nsImageMap::AttributeChanged(nsIDocument *aDocument,
   // If the parent of the changing content node is our map then update
   // the map.
   nsCOMPtr<nsIContent> parent;
-  aContent->GetParent(*getter_AddRefs(parent));
+  aContent->GetParent(getter_AddRefs(parent));
   if ((parent == mMap) || 
       (mContainsBlockContents && IsAncestorOf(parent, mMap))) {
     UpdateAreas();
@@ -1157,7 +1157,7 @@ nsImageMap::ChangeFocus(nsIDOMEvent* aEvent, PRBool aFocus) {
             //Now invalidate the rect
             nsCOMPtr<nsIDocument> doc;
             //This check is necessary to see if we're still attached to the doc
-            if (NS_SUCCEEDED(targetContent->GetDocument(*getter_AddRefs(doc))) && doc) {
+            if (NS_SUCCEEDED(targetContent->GetDocument(getter_AddRefs(doc))) && doc) {
               nsCOMPtr<nsIPresShell> presShell;
               doc->GetShellAt(0, getter_AddRefs(presShell));
               if (presShell) {
diff --git a/layout/generic/nsInlineFrame.cpp b/layout/generic/nsInlineFrame.cpp
index 644691fc6197..94d0e194531d 100644
--- a/layout/generic/nsInlineFrame.cpp
+++ b/layout/generic/nsInlineFrame.cpp
@@ -913,7 +913,7 @@ NS_IMETHODIMP nsInlineFrame::GetAccessible(nsIAccessible** aAccessible)
   // replaces the image or image control frame with an inline frame
   *aAccessible = nsnull;
   nsCOMPtr<nsIAtom> tagAtom;
-  mContent->GetTag(*getter_AddRefs(tagAtom));
+  mContent->GetTag(getter_AddRefs(tagAtom));
   if (tagAtom == nsHTMLAtoms::img || tagAtom == nsHTMLAtoms::input || 
      tagAtom == nsHTMLAtoms::label || tagAtom == nsHTMLAtoms::hr) {
     // Only get accessibility service if we're going to use it
diff --git a/layout/generic/nsLineLayout.cpp b/layout/generic/nsLineLayout.cpp
index bef59304ac91..743e8d5862ce 100644
--- a/layout/generic/nsLineLayout.cpp
+++ b/layout/generic/nsLineLayout.cpp
@@ -2548,7 +2548,7 @@ nsLineLayout::VerticalAlignFrames(PerSpanData* psd)
       nsresult result = mRootSpan->mFrame->mFrame->GetContent(getter_AddRefs(blockContent));
       if ( NS_SUCCEEDED(result) && blockContent) {
         nsCOMPtr<nsIAtom> blockTagAtom;
-        result = blockContent->GetTag(*(getter_AddRefs(blockTagAtom)));
+        result = blockContent->GetTag(getter_AddRefs(blockTagAtom));
         if ( NS_SUCCEEDED(result) && blockTagAtom) {
           // (2) above, if the first line of LI
           if (isFirstLine && blockTagAtom.get() == nsHTMLAtoms::li) {
@@ -2954,7 +2954,7 @@ nsLineLayout::HorizontalAlignFrames(nsRect& aLineBounds,
         psd->mFirstFrame->mFrame->GetContent(getter_AddRefs(content));
         if (content) {
           nsCOMPtr<nsIAtom> tag;
-          content->GetTag(*getter_AddRefs(tag));
+          content->GetTag(getter_AddRefs(tag));
           if (tag == nsHTMLAtoms::hr) {
             // get the alignment from the HR frame
 
diff --git a/layout/generic/nsObjectFrame.cpp b/layout/generic/nsObjectFrame.cpp
index 2ead45453078..6e1047db586d 100644
--- a/layout/generic/nsObjectFrame.cpp
+++ b/layout/generic/nsObjectFrame.cpp
@@ -481,7 +481,7 @@ PRBool nsObjectFrame::IsSupportedImage(nsIContent* aContent)
   if (!haveType) 
   {
     nsCOMPtr<nsIAtom> tag;
-    aContent->GetTag(*getter_AddRefs(tag));
+    aContent->GetTag(getter_AddRefs(tag));
     nsAutoString data;
 
     // If this is an OBJECT tag, we should look for a DATA attribute.
@@ -624,7 +624,7 @@ nsObjectFrame::Init(nsIPresContext*  aPresContext,
     }
 
     nsCOMPtr<nsIAtom> tag;
-    aContent->GetTag(*getter_AddRefs(tag));
+    aContent->GetTag(getter_AddRefs(tag));
     nsAutoString data;
     
     // If this is an OBJECT tag, we should look for a DATA attribute.
@@ -660,7 +660,7 @@ nsObjectFrame::Init(nsIPresContext*  aPresContext,
   
   // only do the following for the object tag
   nsCOMPtr<nsIAtom> tag;
-  aContent->GetTag(*getter_AddRefs(tag));
+  aContent->GetTag(getter_AddRefs(tag));
   if (tag.get() != nsHTMLAtoms::object) return rv;
 
   // for now, we should try to do the same for "document" types and create
@@ -917,7 +917,7 @@ nsObjectFrame::GetDesiredSize(nsIPresContext* aPresContext,
 
   // for EMBED and APPLET, default to 240x200 for compatibility
   nsCOMPtr<nsIAtom> atom;
-  mContent->GetTag(*getter_AddRefs(atom));
+  mContent->GetTag(getter_AddRefs(atom));
   if (atom == nsHTMLAtoms::applet || atom == nsHTMLAtoms::embed) {
     float p2t;
     aPresContext->GetScaledPixelsToTwips(&p2t);
@@ -1114,7 +1114,7 @@ nsObjectFrame::Reflow(nsIPresContext*          aPresContext,
       mInstanceOwner->SetPluginHost(pluginHost);
 
       nsCOMPtr<nsIAtom> tag;
-      mContent->GetTag(*getter_AddRefs(tag));
+      mContent->GetTag(getter_AddRefs(tag));
       if (tag.get() == nsHTMLAtoms::applet) {
         if (NS_CONTENT_ATTR_HAS_VALUE == mContent->GetAttr(kNameSpaceID_None, nsHTMLAtoms::code, src)) {
           // Create an absolute URL
@@ -1409,15 +1409,15 @@ nsObjectFrame::GetBaseURL(nsIURI* &aURL)
   nsIHTMLContent* htmlContent;
   if (NS_SUCCEEDED(mContent->QueryInterface(NS_GET_IID(nsIHTMLContent), (void**)&htmlContent))) 
   {
-    htmlContent->GetBaseURL(aURL);
+    htmlContent->GetBaseURL(&aURL);
     NS_RELEASE(htmlContent);
   }
   else 
   {
     nsCOMPtr<nsIDocument> doc;
-    mContent->GetDocument(*getter_AddRefs(doc));
+    mContent->GetDocument(getter_AddRefs(doc));
     if (doc)
-      doc->GetBaseURL(aURL);
+      doc->GetBaseURL(&aURL);
     else
       return NS_ERROR_FAILURE;
   }
@@ -1434,7 +1434,7 @@ nsObjectFrame::IsHidden(PRBool aCheckVisibilityStyle) const
   }
 
   nsCOMPtr<nsIAtom> tag;
-  mContent->GetTag(*getter_AddRefs(tag));
+  mContent->GetTag(getter_AddRefs(tag));
 
   // only <embed> tags support the HIDDEN attribute
   if (tag.get() == nsHTMLAtoms::embed) {
@@ -1624,7 +1624,7 @@ nsObjectFrame::Paint(nsIPresContext*      aPresContext,
 
     // first, we need to get the document
     nsCOMPtr<nsIDocument> doc;
-    mContent->GetDocument(*getter_AddRefs(doc));
+    mContent->GetDocument(getter_AddRefs(doc));
     NS_ENSURE_TRUE(doc, NS_ERROR_NULL_POINTER);
 
     // now we need to get the shell for the screen
@@ -1949,7 +1949,7 @@ nsObjectFrame::NotifyContentObjectWrapper()
 {
   nsCOMPtr<nsIDocument> doc;
 
-  mContent->GetDocument(*getter_AddRefs(doc));
+  mContent->GetDocument(getter_AddRefs(doc));
   NS_ENSURE_TRUE(doc, NS_ERROR_UNEXPECTED);
 
   nsCOMPtr<nsIScriptGlobalObject> sgo;
@@ -2326,7 +2326,7 @@ NS_IMETHODIMP nsPluginInstanceOwner::GetURL(const char *aURL, const char *aTarge
   nsCOMPtr<nsIDocument> doc;
   rv = GetDocument(getter_AddRefs(doc));
   if (NS_SUCCEEDED(rv) && doc) {
-    rv = doc->GetBaseURL(*getter_AddRefs(baseURL));  // gets the document's url
+    rv = doc->GetBaseURL(getter_AddRefs(baseURL));  // gets the document's url
   } else {
     mOwner->GetFullURL(*getter_AddRefs(baseURL)); // gets the plugin's content url
   }
@@ -2539,11 +2539,10 @@ NS_IMETHODIMP nsPluginInstanceOwner::GetTagType(nsPluginTagType *result)
 
     if (nsnull != cont)
     {
-      nsIAtom     *atom;
+      nsCOMPtr<nsIAtom> atom;
+      cont->GetTag(getter_AddRefs(atom));
 
-      cont->GetTag(atom);
-
-      if (nsnull != atom)
+      if (atom)
       {
         if (atom == nsHTMLAtoms::applet)
           *result = nsPluginTagType_Applet;
@@ -2553,7 +2552,6 @@ NS_IMETHODIMP nsPluginInstanceOwner::GetTagType(nsPluginTagType *result)
           *result = nsPluginTagType_Object;
 
         rv = NS_OK;
-        NS_RELEASE(atom);
       }
 
       NS_RELEASE(cont);
@@ -2660,7 +2658,7 @@ NS_IMETHODIMP nsPluginInstanceOwner::GetDocumentBase(const char* *result)
     shell->GetDocument(getter_AddRefs(doc));
 
     nsCOMPtr<nsIURI> docURL;
-    doc->GetBaseURL(*getter_AddRefs(docURL));  // should return base + doc url
+    doc->GetBaseURL(getter_AddRefs(docURL));  // should return base + doc url
 
     rv = docURL->GetSpec(mDocumentBase);
   }
@@ -2984,7 +2982,7 @@ nsresult nsPluginInstanceOwner::EnsureCachedAttrParamArrays()
   nsCOMPtr<nsIDOMNodeList> allParams; 
 
   nsCOMPtr<nsINodeInfo> ni;
-  content->GetNodeInfo(*getter_AddRefs(ni));
+  content->GetNodeInfo(getter_AddRefs(ni));
 
   if (ni->NamespaceEquals(kNameSpaceID_XHTML)) {
     // For XHTML elements we need to take the namespace URI into
@@ -3067,7 +3065,7 @@ nsresult nsPluginInstanceOwner::EnsureCachedAttrParamArrays()
   PRInt16 numRealAttrs = mNumCachedAttrs;
   nsAutoString data;
   nsCOMPtr<nsIAtom> tag;
-  content->GetTag(*getter_AddRefs(tag));
+  content->GetTag(getter_AddRefs(tag));
   if (nsHTMLAtoms::object == tag.get() 
     && !content->HasAttr(kNameSpaceID_None, nsHTMLAtoms::src)
     && NS_CONTENT_ATTR_NOT_THERE != content->GetAttr(kNameSpaceID_None, nsHTMLAtoms::data, data)) {
@@ -3086,9 +3084,9 @@ nsresult nsPluginInstanceOwner::EnsureCachedAttrParamArrays()
     PRInt32 nameSpaceID;
     nsCOMPtr<nsIAtom> atom;
     nsCOMPtr<nsIAtom> prefix;
-    content->GetAttrNameAt(index, nameSpaceID,
-                           *getter_AddRefs(atom),
-                           *getter_AddRefs(prefix));
+    content->GetAttrNameAt(index, &nameSpaceID,
+                           getter_AddRefs(atom),
+                           getter_AddRefs(prefix));
     nsAutoString value;
     if (NS_CONTENT_ATTR_NOT_THERE != content->GetAttr(nameSpaceID, atom, value)) {
       nsAutoString name;
diff --git a/layout/generic/nsSelection.cpp b/layout/generic/nsSelection.cpp
index d3a6435b17dc..a56774f1458f 100644
--- a/layout/generic/nsSelection.cpp
+++ b/layout/generic/nsSelection.cpp
@@ -764,7 +764,7 @@ IsValidSelectionPoint(nsSelection *aFrameSel, nsIContent *aContent)
     if (tLimiter && tLimiter != aContent)
     {
       nsCOMPtr<nsIContent> parent;
-      result = aContent->GetParent(*getter_AddRefs(parent));
+      result = aContent->GetParent(getter_AddRefs(parent));
       if (NS_FAILED(result))
         return PR_FALSE;
       if (tLimiter != parent) //if newfocus == the limiter. thats ok. but if not there and not parent bad
@@ -1115,7 +1115,7 @@ nsSelection::GetRootForContentSubtree(nsIContent *aContent, nsIContent **aParent
 
   while (child)
   {
-    result = child->GetParent(*getter_AddRefs(parent));
+    result = child->GetParent(getter_AddRefs(parent));
 
     if (NS_FAILED(result))
       return result;
@@ -1383,7 +1383,7 @@ nsCOMPtr<nsIAtom> GetTag(nsIDOMNode *aNode)
   
   nsCOMPtr<nsIContent> content = do_QueryInterface(aNode);
   if (content)
-    content->GetTag(*getter_AddRefs(atom));
+    content->GetTag(getter_AddRefs(atom));
 
   return atom;
 }
@@ -1398,7 +1398,7 @@ ParentOffset(nsIDOMNode *aNode, nsIDOMNode **aParent, PRInt32 *aChildOffset)
   if (NS_SUCCEEDED(result) && content)
   {
     nsCOMPtr<nsIContent> parent;
-    result = content->GetParent(*getter_AddRefs(parent));
+    result = content->GetParent(getter_AddRefs(parent));
     if (NS_SUCCEEDED(result) && parent)
     {
       result = parent->IndexOf(content, *aChildOffset);
@@ -2743,7 +2743,7 @@ nsSelection::TakeFocus(nsIContent *aNewFocus, PRUint32 aContentOffset,
   nsCOMPtr<nsIDOMNode> domNode;
   nsCOMPtr<nsIContent> parent;
   nsCOMPtr<nsIContent> parent2;
-  if (NS_FAILED(aNewFocus->GetParent(*getter_AddRefs(parent))) || !parent)
+  if (NS_FAILED(aNewFocus->GetParent(getter_AddRefs(parent))) || !parent)
     return NS_ERROR_FAILURE;
   //END HACKHACKHACK /checking for root frames/content
 
@@ -3006,7 +3006,7 @@ nsSelection::GetFrameForNodeOffset(nsIContent *aNode, PRInt32 aOffset, HINT aHin
     
     nsCOMPtr<nsIContent> childNode;
 
-    result = theNode->ChildAt(childIndex, *getter_AddRefs(childNode));
+    result = theNode->ChildAt(childIndex, getter_AddRefs(childNode));
 
     if (NS_FAILED(result))
       return result;
@@ -3338,7 +3338,7 @@ nsSelection::FrameOrParentHasSpecialSelectionStyle(nsIFrame* aFrame, PRUint8 aSe
 static PRBool IsCell(nsIContent *aContent)
 {
   nsCOMPtr<nsIAtom> tag;
-  aContent->GetTag(*getter_AddRefs(tag));
+  aContent->GetTag(getter_AddRefs(tag));
   return (tag == nsHTMLAtoms::td);
 }
 
@@ -3398,7 +3398,10 @@ nsSelection::HandleTableSelection(nsIContent *aParentContent, PRInt32 aContentOf
   if (!parentNode)  return NS_ERROR_FAILURE;
 
   nsCOMPtr<nsIContent> childContent;
-  nsresult result = aParentContent->ChildAt(aContentOffset, *getter_AddRefs(childContent));
+  nsresult result =
+      aParentContent->ChildAt(aContentOffset,
+                              getter_AddRefs(childContent));
+
   if (NS_FAILED(result)) return result;
   if (!childContent)  return NS_ERROR_FAILURE;
 
@@ -3663,7 +3666,7 @@ printf("HandleTableSelection: Unselecting mUnselectCellOnMouseUp; rangeCount=%d\
           // Be sure previous selection is a table cell
           nsCOMPtr<nsIContent> parentContent = do_QueryInterface(parent);
           nsCOMPtr<nsIContent> child;
-          result = parentContent->ChildAt(offset, *getter_AddRefs(child));
+          result = parentContent->ChildAt(offset, getter_AddRefs(child));
           if (NS_FAILED(result)) return result;
           if (child && IsCell(child))
             previousCellParent = parent;
@@ -3904,9 +3907,12 @@ nsSelection::SelectRowOrColumn(nsIContent *aCellContent, PRUint32 aTarget)
 //  but doesn't allow dragging OFF of an existing selection to unselect!
   do {
     // Loop through all cells in column or row
-    result = tableLayout->GetCellDataAt(rowIndex, colIndex, *getter_AddRefs(cellElement),
-                                        curRowIndex, curColIndex, rowSpan, colSpan, 
-                                        actualRowSpan, actualColSpan, isSelected);
+    result = tableLayout->GetCellDataAt(rowIndex, colIndex,
+                                        getter_AddRefs(cellElement),
+                                        curRowIndex, curColIndex,
+                                        rowSpan, colSpan,
+                                        actualRowSpan, actualColSpan,
+                                        isSelected);
     if (NS_FAILED(result)) return result;
     // We're done when cell is not found
     if (!cellElement) break;
@@ -3952,7 +3958,7 @@ nsSelection::GetFirstCellNodeInRange(nsIDOMRange *aRange, nsIDOMNode **aCellNode
 
   nsCOMPtr<nsIContent> parentContent = do_QueryInterface(startParent);
   nsCOMPtr<nsIContent> childContent;
-  result = parentContent->ChildAt(offset, *getter_AddRefs(childContent));
+  result = parentContent->ChildAt(offset, getter_AddRefs(childContent));
   if (NS_FAILED(result)) return result;
   if (!childContent) return NS_ERROR_NULL_POINTER;
   // Don't return node if not a cell
@@ -4097,27 +4103,29 @@ nsSelection::IsInSameTable(nsIContent *aContent1, nsIContent *aContent2, nsICont
 nsresult
 nsSelection::GetParentTable(nsIContent *aCell, nsIContent **aTable)
 {
-  if (!aCell || !aTable)
+  if (!aCell || !aTable) {
     return NS_ERROR_NULL_POINTER;
+  }
 
   nsCOMPtr<nsIContent> parent;
-  nsresult result = aCell->GetParent(*getter_AddRefs(parent));
+  aCell->GetParent(getter_AddRefs(parent));
 
-  while (NS_SUCCEEDED(result) && parent)
-  {  
-    nsIAtom *tag;
-    parent->GetTag(tag);
-    if (tag == nsHTMLAtoms::table)
-    {
+  nsCOMPtr<nsIAtom> tag;
+  while (parent) {
+    parent->GetTag(getter_AddRefs(tag));
+    if (tag == nsHTMLAtoms::table) {
       *aTable = parent;
       NS_ADDREF(*aTable);
+
       return NS_OK;
     }
+
     nsCOMPtr<nsIContent> temp;
-    result = parent->GetParent(*getter_AddRefs(temp));
+    parent->GetParent(getter_AddRefs(temp));
     parent = temp;
   }
-  return result;
+
+  return NS_OK;
 }
 
 nsresult
@@ -4174,7 +4182,7 @@ nsTypedSelection::getTableCellLocationFromRange(nsIDOMRange *aRange, PRInt32 *aS
   if (NS_FAILED(result)) return result;
 
   nsCOMPtr<nsIContent> child;
-  result = content->ChildAt(startOffset, *getter_AddRefs(child));
+  result = content->ChildAt(startOffset, getter_AddRefs(child));
   if (NS_FAILED(result)) return result;
   if (!child) return NS_ERROR_FAILURE;
 
@@ -4305,7 +4313,7 @@ nsTypedSelection::GetTableSelectionType(nsIDOMRange* aRange, PRInt32* aTableSele
     return NS_OK;
 
   nsCOMPtr<nsIAtom> atom;
-  content->GetTag(*getter_AddRefs(atom));
+  content->GetTag(getter_AddRefs(atom));
   if (!atom) return NS_ERROR_FAILURE;
 
   if (atom == nsHTMLAtoms::tr)
@@ -4315,11 +4323,11 @@ nsTypedSelection::GetTableSelectionType(nsIDOMRange* aRange, PRInt32* aTableSele
   else //check to see if we are selecting a table or row (column and all cells not done yet)
   {
     nsCOMPtr<nsIContent> child;
-    result = content->ChildAt(startOffset, *getter_AddRefs(child));
+    result = content->ChildAt(startOffset, getter_AddRefs(child));
     if (NS_FAILED(result)) return result;
     if (!child) return NS_ERROR_FAILURE;
 
-    child->GetTag(*getter_AddRefs(atom));
+    child->GetTag(getter_AddRefs(atom));
     if (!atom) return NS_ERROR_FAILURE;
 
     if (atom == nsHTMLAtoms::table)
@@ -4371,7 +4379,7 @@ nsSelection::AdjustOffsetsFromStyle(nsIFrame *aFrame, PRBool *changeSelection,
   if (selectAllContent)
   {
     nsCOMPtr<nsIContent>  parentContent;
-    rv = selectAllContent->GetParent(*getter_AddRefs(parentContent));
+    rv = selectAllContent->GetParent(getter_AddRefs(parentContent));
     if (parentContent)
     {
       PRInt32 startOffset;
@@ -4382,7 +4390,7 @@ nsSelection::AdjustOffsetsFromStyle(nsIFrame *aFrame, PRBool *changeSelection,
         // hrmm, this is probably anonymous content. Let's go up another level
         // do we need to do this if we get the right frameSelection to start with?
         nsCOMPtr<nsIContent> superParent;
-        parentContent->GetParent(*getter_AddRefs(superParent));
+        parentContent->GetParent(getter_AddRefs(superParent));
         if (superParent)
         {
           PRInt32 superStartOffset;
@@ -4952,7 +4960,7 @@ nsTypedSelection::GetPrimaryFrameForRangeEndpoint(nsIDOMNode *aNode, PRInt32 aOf
     if (aOffset >= 0)
     {
       nsCOMPtr<nsIContent> child;
-      result = content->ChildAt(aOffset, *getter_AddRefs(child));
+      result = content->ChildAt(aOffset, getter_AddRefs(child));
       if (NS_FAILED(result))
         return result;
       if (!child) //out of bounds?
@@ -6080,7 +6088,7 @@ nsTypedSelection::Collapse(nsIDOMNode* aParentNode, PRInt32 aOffset)
     if (!content)
       return NS_ERROR_FAILURE;
     nsCOMPtr<nsIAtom> tag;
-    content->GetTag(*getter_AddRefs(tag));
+    content->GetTag(getter_AddRefs(tag));
     if (tag)
     {
       nsAutoString tagString;
@@ -6870,7 +6878,7 @@ nsTypedSelection::Extend(nsIDOMNode* aParentNode, PRInt32 aOffset)
     nsCOMPtr<nsIContent>content;
     content = do_QueryInterface(aParentNode);
     nsCOMPtr<nsIAtom> tag;
-    content->GetTag(*getter_AddRefs(tag));
+    content->GetTag(getter_AddRefs(tag));
     if (tag)
     {
       nsAutoString tagString;
diff --git a/layout/generic/nsTextFrame.cpp b/layout/generic/nsTextFrame.cpp
index 1c3104f884c1..36c75a2399f3 100644
--- a/layout/generic/nsTextFrame.cpp
+++ b/layout/generic/nsTextFrame.cpp
@@ -1029,7 +1029,7 @@ DrawSelectionIterator::DrawSelectionIterator(nsIContent *aContent,
 
     if (aContent) {
       nsCOMPtr<nsIContent> parentContent;
-      aContent->GetParent(*getter_AddRefs(parentContent));
+      aContent->GetParent(getter_AddRefs(parentContent));
       nsRefPtr<nsStyleContext> sc;
       sc = aPresContext->ProbePseudoStyleContextFor(parentContent,
 						    nsCSSPseudoElements::mozSelection,
@@ -1356,7 +1356,7 @@ nsTextFrame::GetDocument(nsIPresContext* aPresContext)
 {
   nsIDocument* result = nsnull;
   if (mContent) {
-    mContent->GetDocument(result);
+    mContent->GetDocument(&result);
   }
   if (!result && aPresContext) {
     nsIPresShell* shell;
@@ -3997,7 +3997,7 @@ nsTextFrame::PeekOffset(nsIPresContext* aPresContext, nsPeekOffsetStruct *aPos)
     {
       // Transform text from content into renderable form
       nsIDocument* doc;
-      result = mContent->GetDocument(doc);
+      result = mContent->GetDocument(&doc);
       if (NS_FAILED(result) || !doc) {
         return result;
       }
@@ -4029,7 +4029,7 @@ nsTextFrame::PeekOffset(nsIPresContext* aPresContext, nsPeekOffsetStruct *aPos)
     {
       // Transform text from content into renderable form
       nsIDocument* doc;
-      result = mContent->GetDocument(doc);
+      result = mContent->GetDocument(&doc);
       if (NS_FAILED(result) || !doc) {
         return result;
       }
@@ -4175,7 +4175,7 @@ nsTextFrame::PeekOffset(nsIPresContext* aPresContext, nsPeekOffsetStruct *aPos)
     {
       // Transform text from content into renderable form
       nsIDocument* doc;
-      result = mContent->GetDocument(doc);
+      result = mContent->GetDocument(&doc);
       if (NS_FAILED(result) || !doc) {
         return result;
       }
@@ -5367,7 +5367,7 @@ nsTextFrame::Reflow(nsIPresContext*          aPresContext,
 
   // Setup text transformer to transform this frames text content
   nsCOMPtr<nsIDocument> doc;
-  mContent->GetDocument(*getter_AddRefs(doc));
+  mContent->GetDocument(getter_AddRefs(doc));
   if (!doc) {
     NS_WARNING("Content has no document.");
     return NS_ERROR_FAILURE; 
diff --git a/layout/html/base/src/nsAreaFrame.cpp b/layout/html/base/src/nsAreaFrame.cpp
index 394f978d25e6..126d572f1079 100644
--- a/layout/html/base/src/nsAreaFrame.cpp
+++ b/layout/html/base/src/nsAreaFrame.cpp
@@ -93,7 +93,7 @@ nsAreaFrame::RegUnregAccessKey(nsIPresContext* aPresContext,
 
   // find out what type of element this is
   nsCOMPtr<nsIAtom> atom;
-  nsresult rv = mContent->GetTag(*getter_AddRefs(atom));
+  nsresult rv = mContent->GetTag(getter_AddRefs(atom));
   if (NS_FAILED(rv))
     return rv;
 
diff --git a/layout/html/base/src/nsBRFrame.cpp b/layout/html/base/src/nsBRFrame.cpp
index c987e22e31f6..6fc58821c770 100644
--- a/layout/html/base/src/nsBRFrame.cpp
+++ b/layout/html/base/src/nsBRFrame.cpp
@@ -228,7 +228,7 @@ NS_IMETHODIMP BRFrame::GetContentAndOffsetsFromPoint(nsIPresContext* aCX,
 {
   if (!mContent)
     return NS_ERROR_NULL_POINTER;
-  nsresult result = mContent->GetParent(*aContent);
+  nsresult result = mContent->GetParent(aContent);
   if (NS_SUCCEEDED(result) && *aContent)
     result = (*aContent)->IndexOf(mContent, aOffsetBegin);
   aOffsetEnd = aOffsetBegin;
@@ -244,7 +244,7 @@ NS_IMETHODIMP BRFrame::PeekOffset(nsIPresContext* aPresContext, nsPeekOffsetStru
   nsCOMPtr<nsIContent> parentContent;
   PRInt32 offsetBegin; //offset of this content in its parents child list. base 0
 
-  nsresult result = mContent->GetParent(*getter_AddRefs(parentContent));
+  nsresult result = mContent->GetParent(getter_AddRefs(parentContent));
 
 
   if (NS_SUCCEEDED(result) && parentContent)
diff --git a/layout/html/base/src/nsBulletFrame.cpp b/layout/html/base/src/nsBulletFrame.cpp
index ce97fb9f4e35..441299a4a6fa 100644
--- a/layout/html/base/src/nsBulletFrame.cpp
+++ b/layout/html/base/src/nsBulletFrame.cpp
@@ -144,7 +144,7 @@ nsBulletFrame::Init(nsIPresContext*  aPresContext,
     nsCOMPtr<nsIURI> documentURI;
     nsCOMPtr<nsIDocument> doc;
     if (mContent) {
-      (void) mContent->GetDocument(*getter_AddRefs(doc));
+      (void) mContent->GetDocument(getter_AddRefs(doc));
       if (doc) {
         doc->GetDocumentURL(getter_AddRefs(documentURI));
       }
@@ -1636,7 +1636,7 @@ nsBulletFrame::Reflow(nsIPresContext* aPresContext,
         nsCOMPtr<nsIURI> documentURI;
         nsCOMPtr<nsIDocument> doc;
         if (mContent) {
-          (void) mContent->GetDocument(*getter_AddRefs(doc));
+          (void) mContent->GetDocument(getter_AddRefs(doc));
           if (doc) {
             doc->GetDocumentURL(getter_AddRefs(documentURI));
           }
@@ -1813,13 +1813,13 @@ nsBulletFrame::GetBaseURI(nsIURI **aURI)
   nsCOMPtr<nsIURI> baseURI;
   nsCOMPtr<nsIHTMLContent> htmlContent(do_QueryInterface(mContent, &rv));
   if (NS_SUCCEEDED(rv)) {
-    htmlContent->GetBaseURL(*getter_AddRefs(baseURI));
+    htmlContent->GetBaseURL(getter_AddRefs(baseURI));
   }
   else {
     nsCOMPtr<nsIDocument> doc;
-    mContent->GetDocument(*getter_AddRefs(doc));
+    mContent->GetDocument(getter_AddRefs(doc));
     if (doc) {
-      doc->GetBaseURL(*getter_AddRefs(baseURI));
+      doc->GetBaseURL(getter_AddRefs(baseURI));
     }
   }
   *aURI = baseURI;
diff --git a/layout/html/base/src/nsFrame.cpp b/layout/html/base/src/nsFrame.cpp
index 11f5b34d8cdf..5c36b76f6b3e 100644
--- a/layout/html/base/src/nsFrame.cpp
+++ b/layout/html/base/src/nsFrame.cpp
@@ -869,7 +869,7 @@ nsFrame::Paint(nsIPresContext*      aPresContext,
 
 
   nsCOMPtr<nsIContent> newContent;
-  result = mContent->GetParent(*getter_AddRefs(newContent));
+  result = mContent->GetParent(getter_AddRefs(newContent));
 
 //check to see if we are anonymouse content
   PRInt32 offset;
@@ -1115,7 +1115,7 @@ nsFrame::GetDataForTableSelection(nsIFrameSelection *aFrameSelection,
   if (!tableOrCellContent) return NS_ERROR_FAILURE;
 
   nsCOMPtr<nsIContent> parentContent;
-  result = tableOrCellContent->GetParent(*getter_AddRefs(parentContent));
+  result = tableOrCellContent->GetParent(getter_AddRefs(parentContent));
   if (NS_FAILED(result)) return result;
   if (!parentContent) return NS_ERROR_FAILURE;
 
@@ -1406,9 +1406,9 @@ nsFrame::HandlePress(nsIPresContext* aPresContext,
        }
   
        // now try the parent
-       nsIContent* parent;
-       content->GetParent(parent);
-       content = dont_AddRef(parent);
+       nsCOMPtr<nsIContent> parent;
+       content->GetParent(getter_AddRefs(parent));
+       content.swap(parent);
   
     } // if browser, not editor
   }
@@ -2042,7 +2042,7 @@ nsresult nsFrame::GetContentAndOffsetsFromPoint(nsIPresContext* aCX,
         if (NS_SUCCEEDED(result) && kidContent) {
           nsCOMPtr<nsIContent> content;
 
-          result = kidContent->GetParent(*getter_AddRefs(content));
+          result = kidContent->GetParent(getter_AddRefs(content));
 
           if (NS_SUCCEEDED(result) && content) {
             PRInt32 kidCount = 0;
@@ -2171,7 +2171,7 @@ nsresult nsFrame::GetContentAndOffsetsFromPoint(nsIPresContext* aCX,
   thisRect.x = offsetPoint.x;
   thisRect.y = offsetPoint.y;
 
-  result = mContent->GetParent(*aNewContent);
+  result = mContent->GetParent(aNewContent);
   if (*aNewContent){
     
     PRInt32 contentOffset(aContentOffset); //temp to hold old value in case of failure
@@ -2792,19 +2792,17 @@ NS_IMETHODIMP nsFrame::Scrolled(nsIView *aView)
 
 PRInt32 nsFrame::ContentIndexInContainer(const nsIFrame* aFrame)
 {
-  nsIContent* content;
   PRInt32     result = -1;
 
-  aFrame->GetContent(&content);
-  if (nsnull != content) {
-    nsIContent* parentContent;
+  nsCOMPtr<nsIContent> content;
+  aFrame->GetContent(getter_AddRefs(content));
+  if (content) {
+    nsCOMPtr<nsIContent> parentContent;
 
-    content->GetParent(parentContent);
-    if (nsnull != parentContent) {
+    content->GetParent(getter_AddRefs(parentContent));
+    if (parentContent) {
       parentContent->IndexOf(content, result);
-      NS_RELEASE(parentContent);
     }
-    NS_RELEASE(content);
   }
 
   return result;
@@ -2873,13 +2871,12 @@ nsFrame::MakeFrameName(const nsAString& aType, nsAString& aResult) const
 {
   aResult = aType;
   if (nsnull != mContent) {
-    nsIAtom* tag;
-    mContent->GetTag(tag);
-    if ((tag != nsnull) && (tag != nsLayoutAtoms::textTagName)) {
+    nsCOMPtr<nsIAtom> tag;
+    mContent->GetTag(getter_AddRefs(tag));
+    if (tag && tag != nsLayoutAtoms::textTagName) {
       nsAutoString buf;
       tag->ToString(buf);
       aResult.Append(NS_LITERAL_STRING("(") + buf + NS_LITERAL_STRING(")"));
-      NS_RELEASE(tag);
     }
   }
   char buf[40];
@@ -3269,7 +3266,7 @@ nsFrame::GetPointFromOffset(nsIPresContext* inPresContext, nsIRenderingContext*
   {
     nsCOMPtr<nsIContent> newContent;
     PRInt32 newOffset;
-    nsresult result = mContent->GetParent(*getter_AddRefs(newContent));
+    nsresult result = mContent->GetParent(getter_AddRefs(newContent));
     if (newContent){
       result = newContent->IndexOf(mContent, newOffset);
       if (NS_FAILED(result)) 
@@ -3474,7 +3471,7 @@ nsFrame::GetNextPrevLineFromeBlockFrame(nsIPresContext* aPresContext,
                 nsCOMPtr<nsIContent> parent;
                 if (content)
                 {
-                  content->GetParent(*getter_AddRefs(parent));
+                  content->GetParent(getter_AddRefs(parent));
                   if (parent)
                   {
                     aPos->mResultContent = parent;
@@ -3837,7 +3834,7 @@ nsFrame::PeekOffset(nsIPresContext* aPresContext, nsPeekOffsetStruct *aPos)
       {
         nsCOMPtr<nsIContent> newContent;
         PRInt32 newOffset;
-        result = mContent->GetParent(*getter_AddRefs(newContent));
+        result = mContent->GetParent(getter_AddRefs(newContent));
         if (newContent){
           aPos->mResultContent = newContent;
           result = newContent->IndexOf(mContent, newOffset);
@@ -4950,14 +4947,13 @@ GetTagName(nsFrame* aFrame, nsIContent* aContent, PRIntn aResultSize,
 {
   char namebuf[40];
   namebuf[0] = 0;
-  if (nsnull != aContent) {
-    nsIAtom* tag;
-    aContent->GetTag(tag);
-    if (nsnull != tag) {
+  if (aContent) {
+    nsCOMPtr<nsIAtom> tag;
+    aContent->GetTag(getter_AddRefs(tag));
+    if (tag) {
       nsAutoString tmp;
       tag->ToString(tmp);
       tmp.ToCString(namebuf, sizeof(namebuf));
-      NS_RELEASE(tag);
     }
   }
   PR_snprintf(aResult, aResultSize, "%s@%p", namebuf, aFrame);
diff --git a/layout/html/base/src/nsFrameManager.cpp b/layout/html/base/src/nsFrameManager.cpp
index 35b3b5ed9509..7ccd4981e2a6 100644
--- a/layout/html/base/src/nsFrameManager.cpp
+++ b/layout/html/base/src/nsFrameManager.cpp
@@ -628,7 +628,7 @@ FrameManager::GetPrimaryFrameFor(nsIContent* aContent, nsIFrame** aResult)
       // we're just trying to enhance performance here, not test for correctness
       nsFindFrameHint hint;
       nsCOMPtr<nsIContent> prevSibling, parent;
-      rv = aContent->GetParent(*getter_AddRefs(parent));
+      rv = aContent->GetParent(getter_AddRefs(parent));
       if (NS_SUCCEEDED(rv) && parent)
       {
         PRInt32 index;
@@ -637,8 +637,8 @@ FrameManager::GetPrimaryFrameFor(nsIContent* aContent, nsIFrame** aResult)
         {
           nsCOMPtr<nsIAtom> tag;
           do {
-            parent->ChildAt(--index, *getter_AddRefs(prevSibling));
-            prevSibling->GetTag(*getter_AddRefs(tag));
+            parent->ChildAt(--index, getter_AddRefs(prevSibling));
+            prevSibling->GetTag(getter_AddRefs(tag));
           } while (index &&
                    (tag == nsLayoutAtoms::textTagName ||
                     tag == nsLayoutAtoms::commentTagName ||
@@ -823,7 +823,7 @@ FrameManager::GetUndisplayedContent(nsIContent* aContent)
     return nsnull;
 
   nsCOMPtr<nsIContent> parent;
-  aContent->GetParent(*getter_AddRefs(parent));
+  aContent->GetParent(getter_AddRefs(parent));
   if (!parent)
     return nsnull;
 
@@ -852,12 +852,11 @@ FrameManager::SetUndisplayedContent(nsIContent* aContent,
     mUndisplayedMap = new UndisplayedMap;
   }
   if (mUndisplayedMap) {
-    nsIContent* parent = nsnull;
-    aContent->GetParent(parent);
+    nsCOMPtr<nsIContent> parent;
+    aContent->GetParent(getter_AddRefs(parent));
     NS_ASSERTION(parent, "undisplayed content must have a parent");
     if (parent) {
       mUndisplayedMap->AddNodeFor(parent, aContent, aStyleContext);
-      NS_RELEASE(parent);
     }
   }
 }
diff --git a/layout/html/base/src/nsGfxScrollFrame.cpp b/layout/html/base/src/nsGfxScrollFrame.cpp
index a80016dcc07c..9a56b92d3894 100644
--- a/layout/html/base/src/nsGfxScrollFrame.cpp
+++ b/layout/html/base/src/nsGfxScrollFrame.cpp
@@ -391,14 +391,14 @@ nsGfxScrollFrame::CreateAnonymousContent(nsIPresContext* aPresContext,
 
   nsCOMPtr<nsINodeInfoManager> nodeInfoManager;
   if (document)
-    document->GetNodeInfoManager(*getter_AddRefs(nodeInfoManager));
+    document->GetNodeInfoManager(getter_AddRefs(nodeInfoManager));
   NS_ENSURE_TRUE(nodeInfoManager, NS_ERROR_FAILURE);
 
   nsCOMPtr<nsINodeInfo> nodeInfo;
   nodeInfoManager->GetNodeInfo(NS_LITERAL_STRING("scrollbar"),
                                NS_LITERAL_STRING(""),
                                NS_LITERAL_STRING("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"),
-                               *getter_AddRefs(nodeInfo));
+                               getter_AddRefs(nodeInfo));
 
   ScrollbarStyles styles = GetScrollbarStyles();
   if (styles.mHorizontal == NS_STYLE_OVERFLOW_AUTO
diff --git a/layout/html/base/src/nsHRFrame.cpp b/layout/html/base/src/nsHRFrame.cpp
index 8e54aa109ec3..7fa42d5f6494 100644
--- a/layout/html/base/src/nsHRFrame.cpp
+++ b/layout/html/base/src/nsHRFrame.cpp
@@ -391,7 +391,7 @@ HRuleFrame::GetContentAndOffsetsFromPoint(nsIPresContext* aPresContext,
   thisRect.x = offsetPoint.x;
   thisRect.y = offsetPoint.y;
 
-  rv = mContent->GetParent(*aNewContent);
+  rv = mContent->GetParent(aNewContent);
   if (!*aNewContent) return rv;
   
   rv = (*aNewContent)->IndexOf(mContent, aContentOffset);
diff --git a/layout/html/base/src/nsHTMLReflowState.cpp b/layout/html/base/src/nsHTMLReflowState.cpp
index 4b153341cc91..f35318c695de 100644
--- a/layout/html/base/src/nsHTMLReflowState.cpp
+++ b/layout/html/base/src/nsHTMLReflowState.cpp
@@ -1335,22 +1335,20 @@ nsHTMLReflowState::InitAbsoluteConstraints(nsIPresContext* aPresContext,
 static PRBool
 IsInitialContainingBlock(nsIFrame* aFrame)
 {
-  nsIContent* content;
+  nsCOMPtr<nsIContent> content;
   PRBool      result = PR_FALSE;
 
-  aFrame->GetContent(&content);
+  aFrame->GetContent(getter_AddRefs(content));
   if (content) {
-    nsIContent* parentContent;
+    nsCOMPtr<nsIContent> parentContent;
 
-    content->GetParent(parentContent);
+    content->GetParent(getter_AddRefs(parentContent));
     if (!parentContent) {
       // The containing block corresponds to the document element so it's
       // the initial containing block
       result = PR_TRUE;
     }
-    NS_IF_RELEASE(parentContent);
   }
-  NS_IF_RELEASE(content);
   return result;
 }
 
@@ -1464,14 +1462,14 @@ CalcQuirkContainingBlockHeight(const nsHTMLReflowState& aReflowState,
       if(firstBlockRS) {
         firstBlockRS->frame->GetContent(getter_AddRefs(frameContent));
         if (frameContent) {
-          frameContent->GetTag(*getter_AddRefs(contentTag));
+          frameContent->GetTag(getter_AddRefs(contentTag));
           NS_ASSERTION(contentTag.get() == nsHTMLAtoms::body, "block is not BODY");
         }
       }
       if(firstAreaRS) {
         firstAreaRS->frame->GetContent(getter_AddRefs(frameContent));
         if (frameContent) {
-          frameContent->GetTag(*getter_AddRefs(contentTag));
+          frameContent->GetTag(getter_AddRefs(contentTag));
           NS_ASSERTION(contentTag.get() == nsHTMLAtoms::html, "Area frame is not HTML element");
         }
       }
@@ -2804,7 +2802,7 @@ nsHTMLReflowState::IsBidiFormControl(nsIPresContext* aPresContext)
       if  (content->IsContentOfType(nsIContent::eHTML_FORM_CONTROL)) {
         return PR_TRUE;
       }
-      content->GetParent(*getter_AddRefs(parent));
+      content->GetParent(getter_AddRefs(parent));
       content = parent;
     }
   } else {
diff --git a/layout/html/base/src/nsImageFrame.cpp b/layout/html/base/src/nsImageFrame.cpp
index 591b8862b6a8..b865cb8d31ae 100644
--- a/layout/html/base/src/nsImageFrame.cpp
+++ b/layout/html/base/src/nsImageFrame.cpp
@@ -494,7 +494,7 @@ nsImageFrame::HandleLoadError(nsresult aStatus, nsIPresShell* aPresShell)
       // We are in quirks mode, so we can just check the tag name; no need to
       // check the namespace.
       nsCOMPtr<nsINodeInfo> nodeInfo;
-      mContent->GetNodeInfo(*getter_AddRefs(nodeInfo));
+      mContent->GetNodeInfo(getter_AddRefs(nodeInfo));
       
       if (!mContent->HasAttr(kNameSpaceID_None, nsHTMLAtoms::alt) &&
           nodeInfo &&
@@ -1218,7 +1218,7 @@ nsImageFrame::DisplayAltFeedback(nsIPresContext*      aPresContext,
 
     GetContent(getter_AddRefs(content));
     if (content) {
-      content->GetTag(*getter_AddRefs(tag));
+      content->GetTag(getter_AddRefs(tag));
       if (tag) {
         nsCSSFrameConstructor::GetAlternateTextFor(content, tag, altText);
         DisplayAltText(aPresContext, aRenderingContext, altText, inner);
@@ -1434,7 +1434,7 @@ nsImageFrame::Paint(nsIPresContext*      aPresContext,
         if (rangeCount == 1) //if not one then let code drop to nsFrame::Paint
         {
           nsCOMPtr<nsIContent> parentContent;
-          mContent->GetParent(*getter_AddRefs(parentContent));
+          mContent->GetParent(getter_AddRefs(parentContent));
           if (parentContent)
           {
             PRInt32 thisOffset;
@@ -1479,7 +1479,7 @@ nsImageFrame::GetImageMap(nsIPresContext* aPresContext)
 {
   if (!mImageMap) {
     nsCOMPtr<nsIDocument> doc;
-    mContent->GetDocument(*getter_AddRefs(doc));
+    mContent->GetDocument(getter_AddRefs(doc));
     if (!doc) {
       return nsnull;
     }
@@ -1605,7 +1605,7 @@ nsImageFrame::GetAnchorHREFAndTarget(nsString& aHref, nsString& aTarget)
 
   // Walk up the content tree, looking for an nsIDOMAnchorElement
   nsCOMPtr<nsIContent> content;
-  mContent->GetParent(*getter_AddRefs(content));
+  mContent->GetParent(getter_AddRefs(content));
   while (content) {
     nsCOMPtr<nsIDOMHTMLAnchorElement> anchor(do_QueryInterface(content));
     if (anchor) {
@@ -1617,7 +1617,7 @@ nsImageFrame::GetAnchorHREFAndTarget(nsString& aHref, nsString& aTarget)
       break;
     }
     nsCOMPtr<nsIContent> parent;
-    content->GetParent(*getter_AddRefs(parent));
+    content->GetParent(getter_AddRefs(parent));
     content = parent;
   }
   return status;
@@ -1704,10 +1704,10 @@ nsImageFrame::HandleEvent(nsIPresContext* aPresContext,
             nsAutoString src;
             if (GetAnchorHREFAndTarget(src, target)) {
               nsCOMPtr<nsINodeInfo> nodeInfo;
-              mContent->GetNodeInfo(*getter_AddRefs(nodeInfo));
+              mContent->GetNodeInfo(getter_AddRefs(nodeInfo));
               NS_ASSERTION(nodeInfo, "Image content without a nodeinfo?");
               nsCOMPtr<nsIDocument> doc;
-              nodeInfo->GetDocument(*getter_AddRefs(doc));
+              nodeInfo->GetDocument(getter_AddRefs(doc));
               nsAutoString charset;
               if (doc) {
                 doc->GetDocumentCharacterSet(charset);
@@ -1901,7 +1901,7 @@ nsImageFrame::GetDocumentCharacterSet(nsAString& aCharset) const
   nsCOMPtr<nsIHTMLContent> htmlContent(do_QueryInterface(mContent, &rv));
   if (NS_SUCCEEDED(rv)) {
     nsCOMPtr<nsIDocument> doc;
-    rv = htmlContent->GetDocument(*getter_AddRefs(doc));
+    rv = htmlContent->GetDocument(getter_AddRefs(doc));
     if (NS_SUCCEEDED(rv))
       (void) doc->GetDocumentCharacterSet(aCharset);
   }
@@ -1929,14 +1929,14 @@ nsImageFrame::GetBaseURI(nsIURI **aURI)
   nsCOMPtr<nsIURI> baseURI;
   nsCOMPtr<nsIHTMLContent> htmlContent(do_QueryInterface(mContent, &rv));
   if (NS_SUCCEEDED(rv)) {
-    htmlContent->GetBaseURL(*getter_AddRefs(baseURI));
+    htmlContent->GetBaseURL(getter_AddRefs(baseURI));
   }
   else {
     nsCOMPtr<nsIDocument> doc;
     if (mContent) {
-      rv = mContent->GetDocument(*getter_AddRefs(doc));
+      rv = mContent->GetDocument(getter_AddRefs(doc));
       if (doc) {
-        doc->GetBaseURL(*getter_AddRefs(baseURI));
+        doc->GetBaseURL(getter_AddRefs(baseURI));
       }
     }
   }
diff --git a/layout/html/base/src/nsImageMap.cpp b/layout/html/base/src/nsImageMap.cpp
index 3fe1a6db1892..ff993bf71970 100644
--- a/layout/html/base/src/nsImageMap.cpp
+++ b/layout/html/base/src/nsImageMap.cpp
@@ -449,11 +449,11 @@ void RectArea::ParseCoords(const nsAString& aSpec)
       return;
 
     nsCOMPtr<nsINodeInfo> nodeInfo;
-    mArea->GetNodeInfo(*getter_AddRefs(nodeInfo));
+    mArea->GetNodeInfo(getter_AddRefs(nodeInfo));
     NS_ASSERTION(nodeInfo, "Element with no nodeinfo");
     
     nsCOMPtr<nsIDocument> doc;
-    nodeInfo->GetDocument(*getter_AddRefs(doc));
+    nodeInfo->GetDocument(getter_AddRefs(doc));
     nsCAutoString urlSpec;
     if (doc) {
       nsCOMPtr<nsIURI> uri;
@@ -816,8 +816,8 @@ nsImageMap::Init(nsIPresShell* aPresShell, nsIFrame* aImageFrame, nsIDOMHTMLMapE
   nsresult rv;
   mMap = do_QueryInterface(aMap, &rv);
   NS_ASSERTION(mMap, "aMap is not an nsIHTMLContent!");
-  rv = mMap->GetDocument(mDocument);
-  if (NS_SUCCEEDED(rv) && (nsnull != mDocument)) {
+  rv = mMap->GetDocument(&mDocument);
+  if (NS_SUCCEEDED(rv) && mDocument) {
     mDocument->AddObserver(NS_STATIC_CAST(nsIDocumentObserver*, this));
     // mDocument is a weak reference, so release the reference we got
     nsIDocument *temp = mDocument;
@@ -838,7 +838,7 @@ nsImageMap::UpdateAreasForBlock(nsIContent* aParent, PRBool* aFoundAnchor)
   aParent->ChildCount(n);
   for (i = 0; (i < n) && NS_SUCCEEDED(rv); i++) {
     nsCOMPtr<nsIContent> child;
-    rv = aParent->ChildAt(i, *getter_AddRefs(child));
+    rv = aParent->ChildAt(i, getter_AddRefs(child));
     if (NS_SUCCEEDED(rv)) {
       nsCOMPtr<nsIDOMHTMLAnchorElement> area = do_QueryInterface(child, &rv);
       if (NS_SUCCEEDED(rv)) {
@@ -866,7 +866,7 @@ nsImageMap::UpdateAreas()
   mMap->ChildCount(n);
   for (i = 0; i < n; i++) {
     nsCOMPtr<nsIContent> child;
-    mMap->ChildAt(i, *getter_AddRefs(child));
+    mMap->ChildAt(i, getter_AddRefs(child));
 
     // Only look at elements and not text, comments, etc.
     nsCOMPtr<nsIDOMHTMLElement> element = do_QueryInterface(child);
@@ -959,7 +959,7 @@ nsImageMap::IsInside(nscoord aX, nscoord aY,
         // Set the image loader's source URL and base URL
         nsCOMPtr<nsIURI> baseUri;
 
-        mMap->GetBaseURL(*getter_AddRefs(baseUri));
+        mMap->GetBaseURL(getter_AddRefs(baseUri));
 
         if (!baseUri) {
           return PR_FALSE;
@@ -1028,7 +1028,7 @@ nsImageMap::IsAncestorOf(nsIContent* aContent,
                          nsIContent* aAncestorContent)
 {
   nsCOMPtr<nsIContent> parent;
-  aContent->GetParent(*getter_AddRefs(parent));
+  aContent->GetParent(getter_AddRefs(parent));
   if (parent) {
     return parent == aAncestorContent ||
            IsAncestorOf(parent, aAncestorContent);
@@ -1045,7 +1045,7 @@ nsImageMap::ContentChanged(nsIDocument *aDocument,
   // If the parent of the changing content node is our map then update
   // the map.
   nsCOMPtr<nsIContent> parent;
-  nsresult rv = aContent->GetParent(*getter_AddRefs(parent));
+  nsresult rv = aContent->GetParent(getter_AddRefs(parent));
   if (NS_SUCCEEDED(rv) && (nsnull != parent)) {
     if ((parent == mMap) || 
         (mContainsBlockContents && IsAncestorOf(parent, mMap))) {
@@ -1066,7 +1066,7 @@ nsImageMap::AttributeChanged(nsIDocument *aDocument,
   // If the parent of the changing content node is our map then update
   // the map.
   nsCOMPtr<nsIContent> parent;
-  aContent->GetParent(*getter_AddRefs(parent));
+  aContent->GetParent(getter_AddRefs(parent));
   if ((parent == mMap) || 
       (mContainsBlockContents && IsAncestorOf(parent, mMap))) {
     UpdateAreas();
@@ -1157,7 +1157,7 @@ nsImageMap::ChangeFocus(nsIDOMEvent* aEvent, PRBool aFocus) {
             //Now invalidate the rect
             nsCOMPtr<nsIDocument> doc;
             //This check is necessary to see if we're still attached to the doc
-            if (NS_SUCCEEDED(targetContent->GetDocument(*getter_AddRefs(doc))) && doc) {
+            if (NS_SUCCEEDED(targetContent->GetDocument(getter_AddRefs(doc))) && doc) {
               nsCOMPtr<nsIPresShell> presShell;
               doc->GetShellAt(0, getter_AddRefs(presShell));
               if (presShell) {
diff --git a/layout/html/base/src/nsInlineFrame.cpp b/layout/html/base/src/nsInlineFrame.cpp
index 644691fc6197..94d0e194531d 100644
--- a/layout/html/base/src/nsInlineFrame.cpp
+++ b/layout/html/base/src/nsInlineFrame.cpp
@@ -913,7 +913,7 @@ NS_IMETHODIMP nsInlineFrame::GetAccessible(nsIAccessible** aAccessible)
   // replaces the image or image control frame with an inline frame
   *aAccessible = nsnull;
   nsCOMPtr<nsIAtom> tagAtom;
-  mContent->GetTag(*getter_AddRefs(tagAtom));
+  mContent->GetTag(getter_AddRefs(tagAtom));
   if (tagAtom == nsHTMLAtoms::img || tagAtom == nsHTMLAtoms::input || 
      tagAtom == nsHTMLAtoms::label || tagAtom == nsHTMLAtoms::hr) {
     // Only get accessibility service if we're going to use it
diff --git a/layout/html/base/src/nsLineLayout.cpp b/layout/html/base/src/nsLineLayout.cpp
index bef59304ac91..743e8d5862ce 100644
--- a/layout/html/base/src/nsLineLayout.cpp
+++ b/layout/html/base/src/nsLineLayout.cpp
@@ -2548,7 +2548,7 @@ nsLineLayout::VerticalAlignFrames(PerSpanData* psd)
       nsresult result = mRootSpan->mFrame->mFrame->GetContent(getter_AddRefs(blockContent));
       if ( NS_SUCCEEDED(result) && blockContent) {
         nsCOMPtr<nsIAtom> blockTagAtom;
-        result = blockContent->GetTag(*(getter_AddRefs(blockTagAtom)));
+        result = blockContent->GetTag(getter_AddRefs(blockTagAtom));
         if ( NS_SUCCEEDED(result) && blockTagAtom) {
           // (2) above, if the first line of LI
           if (isFirstLine && blockTagAtom.get() == nsHTMLAtoms::li) {
@@ -2954,7 +2954,7 @@ nsLineLayout::HorizontalAlignFrames(nsRect& aLineBounds,
         psd->mFirstFrame->mFrame->GetContent(getter_AddRefs(content));
         if (content) {
           nsCOMPtr<nsIAtom> tag;
-          content->GetTag(*getter_AddRefs(tag));
+          content->GetTag(getter_AddRefs(tag));
           if (tag == nsHTMLAtoms::hr) {
             // get the alignment from the HR frame
 
diff --git a/layout/html/base/src/nsObjectFrame.cpp b/layout/html/base/src/nsObjectFrame.cpp
index 2ead45453078..6e1047db586d 100644
--- a/layout/html/base/src/nsObjectFrame.cpp
+++ b/layout/html/base/src/nsObjectFrame.cpp
@@ -481,7 +481,7 @@ PRBool nsObjectFrame::IsSupportedImage(nsIContent* aContent)
   if (!haveType) 
   {
     nsCOMPtr<nsIAtom> tag;
-    aContent->GetTag(*getter_AddRefs(tag));
+    aContent->GetTag(getter_AddRefs(tag));
     nsAutoString data;
 
     // If this is an OBJECT tag, we should look for a DATA attribute.
@@ -624,7 +624,7 @@ nsObjectFrame::Init(nsIPresContext*  aPresContext,
     }
 
     nsCOMPtr<nsIAtom> tag;
-    aContent->GetTag(*getter_AddRefs(tag));
+    aContent->GetTag(getter_AddRefs(tag));
     nsAutoString data;
     
     // If this is an OBJECT tag, we should look for a DATA attribute.
@@ -660,7 +660,7 @@ nsObjectFrame::Init(nsIPresContext*  aPresContext,
   
   // only do the following for the object tag
   nsCOMPtr<nsIAtom> tag;
-  aContent->GetTag(*getter_AddRefs(tag));
+  aContent->GetTag(getter_AddRefs(tag));
   if (tag.get() != nsHTMLAtoms::object) return rv;
 
   // for now, we should try to do the same for "document" types and create
@@ -917,7 +917,7 @@ nsObjectFrame::GetDesiredSize(nsIPresContext* aPresContext,
 
   // for EMBED and APPLET, default to 240x200 for compatibility
   nsCOMPtr<nsIAtom> atom;
-  mContent->GetTag(*getter_AddRefs(atom));
+  mContent->GetTag(getter_AddRefs(atom));
   if (atom == nsHTMLAtoms::applet || atom == nsHTMLAtoms::embed) {
     float p2t;
     aPresContext->GetScaledPixelsToTwips(&p2t);
@@ -1114,7 +1114,7 @@ nsObjectFrame::Reflow(nsIPresContext*          aPresContext,
       mInstanceOwner->SetPluginHost(pluginHost);
 
       nsCOMPtr<nsIAtom> tag;
-      mContent->GetTag(*getter_AddRefs(tag));
+      mContent->GetTag(getter_AddRefs(tag));
       if (tag.get() == nsHTMLAtoms::applet) {
         if (NS_CONTENT_ATTR_HAS_VALUE == mContent->GetAttr(kNameSpaceID_None, nsHTMLAtoms::code, src)) {
           // Create an absolute URL
@@ -1409,15 +1409,15 @@ nsObjectFrame::GetBaseURL(nsIURI* &aURL)
   nsIHTMLContent* htmlContent;
   if (NS_SUCCEEDED(mContent->QueryInterface(NS_GET_IID(nsIHTMLContent), (void**)&htmlContent))) 
   {
-    htmlContent->GetBaseURL(aURL);
+    htmlContent->GetBaseURL(&aURL);
     NS_RELEASE(htmlContent);
   }
   else 
   {
     nsCOMPtr<nsIDocument> doc;
-    mContent->GetDocument(*getter_AddRefs(doc));
+    mContent->GetDocument(getter_AddRefs(doc));
     if (doc)
-      doc->GetBaseURL(aURL);
+      doc->GetBaseURL(&aURL);
     else
       return NS_ERROR_FAILURE;
   }
@@ -1434,7 +1434,7 @@ nsObjectFrame::IsHidden(PRBool aCheckVisibilityStyle) const
   }
 
   nsCOMPtr<nsIAtom> tag;
-  mContent->GetTag(*getter_AddRefs(tag));
+  mContent->GetTag(getter_AddRefs(tag));
 
   // only <embed> tags support the HIDDEN attribute
   if (tag.get() == nsHTMLAtoms::embed) {
@@ -1624,7 +1624,7 @@ nsObjectFrame::Paint(nsIPresContext*      aPresContext,
 
     // first, we need to get the document
     nsCOMPtr<nsIDocument> doc;
-    mContent->GetDocument(*getter_AddRefs(doc));
+    mContent->GetDocument(getter_AddRefs(doc));
     NS_ENSURE_TRUE(doc, NS_ERROR_NULL_POINTER);
 
     // now we need to get the shell for the screen
@@ -1949,7 +1949,7 @@ nsObjectFrame::NotifyContentObjectWrapper()
 {
   nsCOMPtr<nsIDocument> doc;
 
-  mContent->GetDocument(*getter_AddRefs(doc));
+  mContent->GetDocument(getter_AddRefs(doc));
   NS_ENSURE_TRUE(doc, NS_ERROR_UNEXPECTED);
 
   nsCOMPtr<nsIScriptGlobalObject> sgo;
@@ -2326,7 +2326,7 @@ NS_IMETHODIMP nsPluginInstanceOwner::GetURL(const char *aURL, const char *aTarge
   nsCOMPtr<nsIDocument> doc;
   rv = GetDocument(getter_AddRefs(doc));
   if (NS_SUCCEEDED(rv) && doc) {
-    rv = doc->GetBaseURL(*getter_AddRefs(baseURL));  // gets the document's url
+    rv = doc->GetBaseURL(getter_AddRefs(baseURL));  // gets the document's url
   } else {
     mOwner->GetFullURL(*getter_AddRefs(baseURL)); // gets the plugin's content url
   }
@@ -2539,11 +2539,10 @@ NS_IMETHODIMP nsPluginInstanceOwner::GetTagType(nsPluginTagType *result)
 
     if (nsnull != cont)
     {
-      nsIAtom     *atom;
+      nsCOMPtr<nsIAtom> atom;
+      cont->GetTag(getter_AddRefs(atom));
 
-      cont->GetTag(atom);
-
-      if (nsnull != atom)
+      if (atom)
       {
         if (atom == nsHTMLAtoms::applet)
           *result = nsPluginTagType_Applet;
@@ -2553,7 +2552,6 @@ NS_IMETHODIMP nsPluginInstanceOwner::GetTagType(nsPluginTagType *result)
           *result = nsPluginTagType_Object;
 
         rv = NS_OK;
-        NS_RELEASE(atom);
       }
 
       NS_RELEASE(cont);
@@ -2660,7 +2658,7 @@ NS_IMETHODIMP nsPluginInstanceOwner::GetDocumentBase(const char* *result)
     shell->GetDocument(getter_AddRefs(doc));
 
     nsCOMPtr<nsIURI> docURL;
-    doc->GetBaseURL(*getter_AddRefs(docURL));  // should return base + doc url
+    doc->GetBaseURL(getter_AddRefs(docURL));  // should return base + doc url
 
     rv = docURL->GetSpec(mDocumentBase);
   }
@@ -2984,7 +2982,7 @@ nsresult nsPluginInstanceOwner::EnsureCachedAttrParamArrays()
   nsCOMPtr<nsIDOMNodeList> allParams; 
 
   nsCOMPtr<nsINodeInfo> ni;
-  content->GetNodeInfo(*getter_AddRefs(ni));
+  content->GetNodeInfo(getter_AddRefs(ni));
 
   if (ni->NamespaceEquals(kNameSpaceID_XHTML)) {
     // For XHTML elements we need to take the namespace URI into
@@ -3067,7 +3065,7 @@ nsresult nsPluginInstanceOwner::EnsureCachedAttrParamArrays()
   PRInt16 numRealAttrs = mNumCachedAttrs;
   nsAutoString data;
   nsCOMPtr<nsIAtom> tag;
-  content->GetTag(*getter_AddRefs(tag));
+  content->GetTag(getter_AddRefs(tag));
   if (nsHTMLAtoms::object == tag.get() 
     && !content->HasAttr(kNameSpaceID_None, nsHTMLAtoms::src)
     && NS_CONTENT_ATTR_NOT_THERE != content->GetAttr(kNameSpaceID_None, nsHTMLAtoms::data, data)) {
@@ -3086,9 +3084,9 @@ nsresult nsPluginInstanceOwner::EnsureCachedAttrParamArrays()
     PRInt32 nameSpaceID;
     nsCOMPtr<nsIAtom> atom;
     nsCOMPtr<nsIAtom> prefix;
-    content->GetAttrNameAt(index, nameSpaceID,
-                           *getter_AddRefs(atom),
-                           *getter_AddRefs(prefix));
+    content->GetAttrNameAt(index, &nameSpaceID,
+                           getter_AddRefs(atom),
+                           getter_AddRefs(prefix));
     nsAutoString value;
     if (NS_CONTENT_ATTR_NOT_THERE != content->GetAttr(nameSpaceID, atom, value)) {
       nsAutoString name;
diff --git a/layout/html/base/src/nsPresShell.cpp b/layout/html/base/src/nsPresShell.cpp
index fdfee9675769..41e66853fc2e 100644
--- a/layout/html/base/src/nsPresShell.cpp
+++ b/layout/html/base/src/nsPresShell.cpp
@@ -4055,7 +4055,7 @@ PresShell::GoToAnchor(const nsAString& aAnchorName, PRBool aScroll)
         content = do_QueryInterface(node);
         if (content) {
           nsCOMPtr<nsIAtom> tag;
-          content->GetTag(*getter_AddRefs(tag));
+          content->GetTag(getter_AddRefs(tag));
           if (tag == nsHTMLAtoms::a) {
             break;
           }
@@ -4351,7 +4351,7 @@ PresShell::ScrollFrameIntoView(nsIFrame *aFrame,
   aFrame->GetContent(getter_AddRefs(content));
   if(content) {
     nsCOMPtr<nsIDocument> document;
-    content->GetDocument(*getter_AddRefs(document));
+    content->GetDocument(getter_AddRefs(document));
     if(document){
       nsCOMPtr<nsIFocusController> focusController;
       nsCOMPtr<nsIScriptGlobalObject> ourGlobal;
@@ -5455,7 +5455,7 @@ BuildFramechangeList(nsIFrame *aFrame, void *aClosure)
     nsCOMPtr<nsIContent> content;
     aFrame->GetContent(getter_AddRefs(content));
     nsCOMPtr<nsIDocument> doc;
-    content->GetDocument(*getter_AddRefs(doc));
+    content->GetDocument(getter_AddRefs(doc));
     if (doc) {
       nsCOMPtr<nsIBindingManager> bm;
       doc->GetBindingManager(getter_AddRefs(bm));
@@ -5942,7 +5942,7 @@ PresShell::GetCurrentEventFrame()
     // frame shouldn't get an event, nor should we even assume its
     // safe to try and find the frame.
     nsCOMPtr<nsIDocument> doc;
-    nsresult result = mCurrentEventContent->GetDocument(*getter_AddRefs(doc));
+    nsresult result = mCurrentEventContent->GetDocument(getter_AddRefs(doc));
     if (NS_SUCCEEDED(result) && doc) {
       GetPrimaryFrameFor(mCurrentEventContent, &mCurrentEventFrame);
     }
@@ -6009,7 +6009,7 @@ PRBool PresShell::InZombieDocument(nsIContent *aContent)
   // It might actually be in a node not attached to any document,
   // in which case there is not parent presshell to retarget it to.
   nsCOMPtr<nsIDocument> doc;
-  mCurrentEventContent->GetDocument(*getter_AddRefs(doc));
+  mCurrentEventContent->GetDocument(getter_AddRefs(doc));
   return !doc;
 }
 
@@ -6264,7 +6264,7 @@ PresShell::HandleEvent(nsIView         *aView,
           while (targetElement &&
                  !targetElement->IsContentOfType(nsIContent::eELEMENT)) {
             nsIContent* temp = targetElement;
-            temp->GetParent(*getter_AddRefs(targetElement));
+            temp->GetParent(getter_AddRefs(targetElement));
           }
 
           // If we found an element, target it.  Otherwise, target *nothing*.
diff --git a/layout/html/base/src/nsTextFrame.cpp b/layout/html/base/src/nsTextFrame.cpp
index 1c3104f884c1..36c75a2399f3 100644
--- a/layout/html/base/src/nsTextFrame.cpp
+++ b/layout/html/base/src/nsTextFrame.cpp
@@ -1029,7 +1029,7 @@ DrawSelectionIterator::DrawSelectionIterator(nsIContent *aContent,
 
     if (aContent) {
       nsCOMPtr<nsIContent> parentContent;
-      aContent->GetParent(*getter_AddRefs(parentContent));
+      aContent->GetParent(getter_AddRefs(parentContent));
       nsRefPtr<nsStyleContext> sc;
       sc = aPresContext->ProbePseudoStyleContextFor(parentContent,
 						    nsCSSPseudoElements::mozSelection,
@@ -1356,7 +1356,7 @@ nsTextFrame::GetDocument(nsIPresContext* aPresContext)
 {
   nsIDocument* result = nsnull;
   if (mContent) {
-    mContent->GetDocument(result);
+    mContent->GetDocument(&result);
   }
   if (!result && aPresContext) {
     nsIPresShell* shell;
@@ -3997,7 +3997,7 @@ nsTextFrame::PeekOffset(nsIPresContext* aPresContext, nsPeekOffsetStruct *aPos)
     {
       // Transform text from content into renderable form
       nsIDocument* doc;
-      result = mContent->GetDocument(doc);
+      result = mContent->GetDocument(&doc);
       if (NS_FAILED(result) || !doc) {
         return result;
       }
@@ -4029,7 +4029,7 @@ nsTextFrame::PeekOffset(nsIPresContext* aPresContext, nsPeekOffsetStruct *aPos)
     {
       // Transform text from content into renderable form
       nsIDocument* doc;
-      result = mContent->GetDocument(doc);
+      result = mContent->GetDocument(&doc);
       if (NS_FAILED(result) || !doc) {
         return result;
       }
@@ -4175,7 +4175,7 @@ nsTextFrame::PeekOffset(nsIPresContext* aPresContext, nsPeekOffsetStruct *aPos)
     {
       // Transform text from content into renderable form
       nsIDocument* doc;
-      result = mContent->GetDocument(doc);
+      result = mContent->GetDocument(&doc);
       if (NS_FAILED(result) || !doc) {
         return result;
       }
@@ -5367,7 +5367,7 @@ nsTextFrame::Reflow(nsIPresContext*          aPresContext,
 
   // Setup text transformer to transform this frames text content
   nsCOMPtr<nsIDocument> doc;
-  mContent->GetDocument(*getter_AddRefs(doc));
+  mContent->GetDocument(getter_AddRefs(doc));
   if (!doc) {
     NS_WARNING("Content has no document.");
     return NS_ERROR_FAILURE; 
diff --git a/layout/html/document/src/nsFrameFrame.cpp b/layout/html/document/src/nsFrameFrame.cpp
index 8986d42e9020..5c9205d17c55 100644
--- a/layout/html/document/src/nsFrameFrame.cpp
+++ b/layout/html/document/src/nsFrameFrame.cpp
@@ -619,7 +619,7 @@ nsHTMLFrameOuterFrame::AttributeChanged(nsIPresContext* aPresContext,
                                         PRInt32 aHint)
 {
   nsCOMPtr<nsIAtom> type;
-  aChild->GetTag(*getter_AddRefs(type));
+  aChild->GetTag(getter_AddRefs(type));
 
   if ((type != nsHTMLAtoms::object && aAttribute == nsHTMLAtoms::src) ||
       (type == nsHTMLAtoms::object && aAttribute == nsHTMLAtoms::data)) {
@@ -633,10 +633,10 @@ nsHTMLFrameOuterFrame::AttributeChanged(nsIPresContext* aPresContext,
   // If the noResize attribute changes, dis/allow frame to be resized
   else if (aAttribute == nsHTMLAtoms::noresize) {
     nsCOMPtr<nsIContent> parentContent;
-    mContent->GetParent(*getter_AddRefs(parentContent));
+    mContent->GetParent(getter_AddRefs(parentContent));
 
     nsCOMPtr<nsIAtom> parentTag;
-    parentContent->GetTag(*getter_AddRefs(parentTag));
+    parentContent->GetTag(getter_AddRefs(parentTag));
 
     if (parentTag == nsHTMLAtoms::frameset) {
       nsIFrame* parentFrame = nsnull;
@@ -768,7 +768,7 @@ PRBool nsHTMLFrameInnerFrame::GetURL(nsIContent* aContent, nsString& aResult)
 {
   aResult.SetLength(0);
   nsCOMPtr<nsIAtom> type;
-  aContent->GetTag(*getter_AddRefs(type));
+  aContent->GetTag(getter_AddRefs(type));
 
   if (type.get() == nsHTMLAtoms::object) {
     if (NS_CONTENT_ATTR_HAS_VALUE == (aContent->GetAttr(kNameSpaceID_None, nsHTMLAtoms::data, aResult)))
diff --git a/layout/html/document/src/nsFrameSetFrame.cpp b/layout/html/document/src/nsFrameSetFrame.cpp
index 4515b59a0e22..6046a1b0fac1 100644
--- a/layout/html/document/src/nsFrameSetFrame.cpp
+++ b/layout/html/document/src/nsFrameSetFrame.cpp
@@ -284,7 +284,7 @@ nsHTMLFramesetFrame::Observe(nsISupports* aObject, const char* aAction,
   nsAutoString prefName(aPrefName);
   if (prefName.Equals(NS_LITERAL_STRING(kFrameResizePref))) {
     nsCOMPtr<nsIDocument> doc;
-    mContent->GetDocument(*getter_AddRefs(doc));
+    mContent->GetDocument(getter_AddRefs(doc));
     if (doc) {
       doc->BeginUpdate();
       doc->AttributeWillChange(mContent,
@@ -402,11 +402,11 @@ nsHTMLFramesetFrame::Init(nsIPresContext*  aPresContext,
       break;
     }
     nsCOMPtr<nsIContent> child;
-    mContent->ChildAt(childX, *getter_AddRefs(child));
+    mContent->ChildAt(childX, getter_AddRefs(child));
     if (!child->IsContentOfType(nsIContent::eHTML))
       continue;
     nsCOMPtr<nsIAtom> tag;
-    child->GetTag(*getter_AddRefs(tag));
+    child->GetTag(getter_AddRefs(tag));
     if (tag == nsHTMLAtoms::frameset || tag == nsHTMLAtoms::frame) {
       nsRefPtr<nsStyleContext> kidSC;
       nsresult result;
@@ -715,14 +715,14 @@ nsHTMLFramesetFrame* nsHTMLFramesetFrame::GetFramesetParent(nsIFrame* aChild)
 
   if (content) { 
     nsCOMPtr<nsIContent> contentParent;
-    content->GetParent(*getter_AddRefs(contentParent));
+    content->GetParent(getter_AddRefs(contentParent));
 
     nsCOMPtr<nsIHTMLContent> contentParent2 =
       do_QueryInterface(contentParent);
 
     if (contentParent2) {
       nsCOMPtr<nsIAtom> tag;
-      contentParent2->GetTag(*getter_AddRefs(tag));
+      contentParent2->GetTag(getter_AddRefs(tag));
 
       if (tag == nsHTMLAtoms::frameset) {
         nsIFrame* fptr;
@@ -1358,11 +1358,11 @@ nsHTMLFramesetFrame::RecalculateBorderResize()
   mContent->ChildCount(numChildren);
   for (childIndex = 0; childIndex < numChildren; childIndex++) {
     nsCOMPtr<nsIContent> childCon;
-    mContent->ChildAt(childIndex, *getter_AddRefs(childCon));
+    mContent->ChildAt(childIndex, getter_AddRefs(childCon));
     nsCOMPtr<nsIHTMLContent> child(do_QueryInterface(childCon));
     if (child) {
       nsCOMPtr<nsIAtom> tag;
-      child->GetTag(*getter_AddRefs(tag));
+      child->GetTag(getter_AddRefs(tag));
       if (tag == nsHTMLAtoms::frameset) {
         childTypes[frameOrFramesetChildIndex++] = FRAMESET;
       } else if (tag == nsHTMLAtoms::frame) {
diff --git a/layout/html/forms/src/nsComboboxControlFrame.cpp b/layout/html/forms/src/nsComboboxControlFrame.cpp
index 68eef45f4458..36935c4cd7c8 100644
--- a/layout/html/forms/src/nsComboboxControlFrame.cpp
+++ b/layout/html/forms/src/nsComboboxControlFrame.cpp
@@ -392,7 +392,7 @@ nsComboboxControlFrame::Init(nsIPresContext*  aPresContext,
   //-------------------------------
   mGoodToGo = PR_FALSE;
   nsCOMPtr<nsIDocument> document;
-  nsresult rv = aContent->GetDocument(*getter_AddRefs(document));
+  nsresult rv = aContent->GetDocument(getter_AddRefs(document));
   if (NS_SUCCEEDED(rv) && document) {
 #ifdef MOZ_XUL
     nsCOMPtr<nsIXULDocument> xulDoc(do_QueryInterface(document));
@@ -2234,16 +2234,16 @@ nsComboboxControlFrame::CreateAnonymousContent(nsIPresContext* aPresContext,
     mDisplayContent->SetText(NS_LITERAL_STRING("X"), PR_TRUE);
 
     nsCOMPtr<nsIDocument> doc;
-    mContent->GetDocument(*getter_AddRefs(doc));
+    mContent->GetDocument(getter_AddRefs(doc));
     // mContent->AppendChildTo(labelContent, PR_FALSE, PR_FALSE);
 
     nsCOMPtr<nsINodeInfoManager> nimgr;
-    result = doc->GetNodeInfoManager(*getter_AddRefs(nimgr));
+    result = doc->GetNodeInfoManager(getter_AddRefs(nimgr));
     NS_ENSURE_SUCCESS(result, result);
 
     nsCOMPtr<nsINodeInfo> nodeInfo;
     nimgr->GetNodeInfo(nsHTMLAtoms::input, nsnull, kNameSpaceID_None,
-                       *getter_AddRefs(nodeInfo));
+                       getter_AddRefs(nodeInfo));
 
     aChildList.AppendElement(labelContent);
 
diff --git a/layout/html/forms/src/nsFileControlFrame.cpp b/layout/html/forms/src/nsFileControlFrame.cpp
index f2ca384ce156..26688458e23c 100644
--- a/layout/html/forms/src/nsFileControlFrame.cpp
+++ b/layout/html/forms/src/nsFileControlFrame.cpp
@@ -140,14 +140,14 @@ nsFileControlFrame::CreateAnonymousContent(nsIPresContext* aPresContext,
 {
   // Get the NodeInfoManager and tag necessary to create input elements
   nsCOMPtr<nsIDocument> doc;
-  mContent->GetDocument(*getter_AddRefs(doc));
+  mContent->GetDocument(getter_AddRefs(doc));
   nsCOMPtr<nsINodeInfoManager> nimgr;
-  nsresult rv = doc->GetNodeInfoManager(*getter_AddRefs(nimgr));
+  nsresult rv = doc->GetNodeInfoManager(getter_AddRefs(nimgr));
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCOMPtr<nsINodeInfo> nodeInfo;
   nimgr->GetNodeInfo(nsHTMLAtoms::input, nsnull, kNameSpaceID_None,
-                     *getter_AddRefs(nodeInfo));
+                     getter_AddRefs(nodeInfo));
 
   nsCOMPtr<nsIElementFactory> ef(do_GetService(kHTMLElementFactoryCID,&rv));
   NS_ENSURE_SUCCESS(rv, rv);
@@ -272,7 +272,7 @@ nsFileControlFrame::MouseClick(nsIDOMEvent* aMouseEvent)
     return NS_FAILED(result) ? result : NS_ERROR_FAILURE;
 
   nsCOMPtr<nsIDocument> doc;
-  result = content->GetDocument(*getter_AddRefs(doc));
+  result = content->GetDocument(getter_AddRefs(doc));
   if (!doc)
     return NS_FAILED(result) ? result : NS_ERROR_FAILURE;
 
@@ -462,7 +462,7 @@ nsFileControlFrame::GetTextControlFrame(nsIPresContext* aPresContext, nsIFrame*
     nsresult res = childFrame->GetContent(getter_AddRefs(content));
     if (NS_SUCCEEDED(res) && content) {
       nsCOMPtr<nsIAtom> atom;
-      res = content->GetTag(*getter_AddRefs(atom));
+      res = content->GetTag(getter_AddRefs(atom));
       if (NS_SUCCEEDED(res) && atom) {
         if (atom.get() == nsHTMLAtoms::input) {
 
diff --git a/layout/html/forms/src/nsGfxButtonControlFrame.cpp b/layout/html/forms/src/nsGfxButtonControlFrame.cpp
index 385868311b2f..8e9372c35361 100644
--- a/layout/html/forms/src/nsGfxButtonControlFrame.cpp
+++ b/layout/html/forms/src/nsGfxButtonControlFrame.cpp
@@ -111,10 +111,10 @@ nsGfxButtonControlFrame::IsFileBrowseButton(PRInt32 type)
     // Check to see if parent is a file input
     nsresult result;
     nsCOMPtr<nsIContent> parentContent;
-    result = mContent->GetParent(*getter_AddRefs(parentContent));
+    result = mContent->GetParent(getter_AddRefs(parentContent));
     if (NS_SUCCEEDED(result) && parentContent) {
       nsCOMPtr<nsIAtom> atom;
-      result = parentContent->GetTag(*getter_AddRefs(atom));
+      result = parentContent->GetTag(getter_AddRefs(atom));
       if (NS_SUCCEEDED(result) && atom) {
         if (atom.get() == nsHTMLAtoms::input) {
 
diff --git a/layout/html/forms/src/nsIsIndexFrame.cpp b/layout/html/forms/src/nsIsIndexFrame.cpp
index e64cb0b88e75..76c7d359e729 100644
--- a/layout/html/forms/src/nsIsIndexFrame.cpp
+++ b/layout/html/forms/src/nsIsIndexFrame.cpp
@@ -228,9 +228,9 @@ nsIsIndexFrame::CreateAnonymousContent(nsIPresContext* aPresContext,
 
   // Get the node info manager (used to create hr's and input's)
   nsCOMPtr<nsIDocument> doc;
-  mContent->GetDocument(*getter_AddRefs(doc));
+  mContent->GetDocument(getter_AddRefs(doc));
   nsCOMPtr<nsINodeInfoManager> nimgr;
-  result = doc->GetNodeInfoManager(*getter_AddRefs(nimgr));
+  result = doc->GetNodeInfoManager(getter_AddRefs(nimgr));
   NS_ENSURE_SUCCESS(result, result);
 
   nsCOMPtr<nsIElementFactory> ef(do_GetService(kHTMLElementFactoryCID,&result));
@@ -239,7 +239,7 @@ nsIsIndexFrame::CreateAnonymousContent(nsIPresContext* aPresContext,
   // Create an hr
   nsCOMPtr<nsINodeInfo> hrInfo;
   nimgr->GetNodeInfo(nsHTMLAtoms::hr, nsnull, kNameSpaceID_None,
-                     *getter_AddRefs(hrInfo));
+                     getter_AddRefs(hrInfo));
   nsCOMPtr<nsIContent> content;
   result = ef->CreateInstanceByTag(hrInfo,getter_AddRefs(content));
   NS_ENSURE_SUCCESS(result, result);
@@ -265,7 +265,7 @@ nsIsIndexFrame::CreateAnonymousContent(nsIPresContext* aPresContext,
   // Create text input field
   nsCOMPtr<nsINodeInfo> inputInfo;
   nimgr->GetNodeInfo(nsHTMLAtoms::input, nsnull, kNameSpaceID_None,
-                     *getter_AddRefs(inputInfo));
+                     getter_AddRefs(inputInfo));
 
   result = ef->CreateInstanceByTag(inputInfo,getter_AddRefs(content));
   NS_ENSURE_SUCCESS(result, result);
@@ -419,12 +419,12 @@ nsIsIndexFrame::OnSubmit(nsIPresContext* aPresContext)
     // We'll need it now to form the URL we're submitting to.
     // We'll also need it later to get the DOM window when notifying form submit observers (bug 33203)
     nsCOMPtr<nsIDocument> document;
-    mContent->GetDocument(*getter_AddRefs(document));
+    mContent->GetDocument(getter_AddRefs(document));
     if (!document) return NS_OK; // No doc means don't submit, see Bug 28988
 
     // Resolve url to an absolute url
     nsCOMPtr<nsIURI> docURL;
-    document->GetBaseURL(*getter_AddRefs(docURL));
+    document->GetBaseURL(getter_AddRefs(docURL));
     NS_ASSERTION(docURL, "No Base URL found in Form Submit!\n");
     if (!docURL) return NS_OK; // No base URL -> exit early, see Bug 30721
 
@@ -502,21 +502,18 @@ nsIsIndexFrame::OnSubmit(nsIPresContext* aPresContext)
 void nsIsIndexFrame::GetSubmitCharset(nsCString& oCharset)
 {
   oCharset.Assign(NS_LITERAL_CSTRING("UTF-8")); // default to utf-8
-  nsresult rv;
   // XXX
   // We may want to get it from the HTML 4 Accept-Charset attribute first
   // see 17.3 The FORM element in HTML 4 for details
 
   // Get the charset from document
-  nsIDocument* doc = nsnull;
-  mContent->GetDocument(doc);
-  if( nsnull != doc ) {
+  nsCOMPtr<nsIDocument> doc;
+  mContent->GetDocument(getter_AddRefs(doc));
+  if (doc) {
     nsAutoString docCharset;
-    rv = doc->GetDocumentCharacterSet(docCharset);
+    doc->GetDocumentCharacterSet(docCharset);
     CopyUCS2toASCII(docCharset, oCharset);
-    NS_RELEASE(doc);
   }
-
 }
 
 NS_IMETHODIMP nsIsIndexFrame::GetEncoder(nsIUnicodeEncoder** encoder)
diff --git a/layout/html/forms/src/nsListControlFrame.cpp b/layout/html/forms/src/nsListControlFrame.cpp
index 6221a64835ca..cb6399f291d2 100644
--- a/layout/html/forms/src/nsListControlFrame.cpp
+++ b/layout/html/forms/src/nsListControlFrame.cpp
@@ -1469,16 +1469,19 @@ nsListControlFrame::IsOptionElement(nsIContent* aContent)
 nsIContent *
 nsListControlFrame::GetOptionFromContent(nsIContent *aContent) 
 {
-  nsIContent * content = aContent;
-  NS_IF_ADDREF(content);
-  while (nsnull != content) {
+  nsCOMPtr<nsIContent> content = aContent;
+  while (content) {
     if (IsOptionElement(content)) {
-      return content;
+      nsIContent *out = content;
+      NS_ADDREF(out);
+      return out;
     }
-    nsIContent * node = content;
-    node->GetParent(content); // this add refs
-    NS_RELEASE(node);
+
+    nsCOMPtr<nsIContent> parent;
+    content->GetParent(getter_AddRefs(parent));
+    parent.swap(content);
   }
+
   return nsnull;
 }
 
@@ -3152,7 +3155,7 @@ nsListControlFrame::ScrollToFrame(nsIContent* aOptElement)
         // XXX this assume only one level of nesting of optgroups
         //   which is all the spec specifies at the moment.
         nsCOMPtr<nsIContent> parentContent;
-        aOptElement->GetParent(*getter_AddRefs(parentContent));
+        aOptElement->GetParent(getter_AddRefs(parentContent));
         nsCOMPtr<nsIDOMHTMLOptGroupElement> optGroup(do_QueryInterface(parentContent));
         nsRect optRect(0,0,0,0);
         if (optGroup) {
diff --git a/layout/html/forms/src/nsTextControlFrame.cpp b/layout/html/forms/src/nsTextControlFrame.cpp
index db31f5c32e16..310d13f55545 100644
--- a/layout/html/forms/src/nsTextControlFrame.cpp
+++ b/layout/html/forms/src/nsTextControlFrame.cpp
@@ -263,7 +263,7 @@ nsTextInputListener::NotifySelectionChanged(nsIDOMDocument* aDoc, nsISelection*
     if (content) 
     {
       nsCOMPtr<nsIDocument> doc;
-      if (NS_SUCCEEDED(content->GetDocument(*getter_AddRefs(doc)))) 
+      if (NS_SUCCEEDED(content->GetDocument(getter_AddRefs(doc))))
       {
         if (doc) 
         {
@@ -386,7 +386,7 @@ nsTextInputListener::UpdateTextInputCommands(const nsAString& commandsToUpdate)
   NS_ENSURE_TRUE(content, NS_ERROR_FAILURE);
   
   nsCOMPtr<nsIDocument> doc;
-  rv = content->GetDocument(*getter_AddRefs(doc));
+  rv = content->GetDocument(getter_AddRefs(doc));
   NS_ENSURE_TRUE(doc, NS_ERROR_FAILURE);
 
   nsCOMPtr<nsIScriptGlobalObject> scriptGlobalObject;
@@ -780,11 +780,11 @@ nsTextInputSelectionImpl::CompleteMove(PRBool aForward, PRBool aExtend)
     if (offset > 0)
     {
       nsCOMPtr<nsIContent> child;
-      result = parentDIV->ChildAt(offset - 1, *getter_AddRefs(child));
+      result = parentDIV->ChildAt(offset - 1, getter_AddRefs(child));
       if (NS_SUCCEEDED(result) && child)
       {
         nsCOMPtr<nsIAtom> tagName;
-        result = child->GetTag(*getter_AddRefs(tagName));
+        result = child->GetTag(getter_AddRefs(tagName));
         if (NS_SUCCEEDED(result) && tagName.get() == nsHTMLAtoms::br)
         {
           --offset;
@@ -1322,7 +1322,7 @@ PRBool nsTextControlFrame::IsTextArea() const
     return PR_FALSE;
 
   nsCOMPtr<nsIAtom> tag;
-  mContent->GetTag(*getter_AddRefs(tag));
+  mContent->GetTag(getter_AddRefs(tag));
 
   if (nsHTMLAtoms::textarea == tag)
     return PR_TRUE;
@@ -1655,7 +1655,7 @@ nsTextControlFrame::CreateAnonymousContent(nsIPresContext* aPresContext,
     return NS_ERROR_FAILURE;
 
   nsCOMPtr<nsINodeInfoManager> nodeInfoManager;
-  rv = doc->GetNodeInfoManager(*getter_AddRefs(nodeInfoManager));
+  rv = doc->GetNodeInfoManager(getter_AddRefs(nodeInfoManager));
 
   if (NS_FAILED(rv))
     return rv;
@@ -1665,7 +1665,7 @@ nsTextControlFrame::CreateAnonymousContent(nsIPresContext* aPresContext,
   nsCOMPtr<nsINodeInfo> nodeInfo;
   rv = nodeInfoManager->GetNodeInfo(nsHTMLAtoms::div, nsnull,
                                     kNameSpaceID_XHTML,
-                                    *getter_AddRefs(nodeInfo));
+                                    getter_AddRefs(nodeInfo));
 
   if (NS_FAILED(rv))
     return rv;
@@ -2295,10 +2295,10 @@ nsTextControlFrame::SelectAllContents()
     // We never want to place the selection after the last
     // br under the root node!
     nsCOMPtr<nsIContent> child;
-    rv = rootContent->ChildAt(numChildren - 1, *getter_AddRefs(child));
+    rv = rootContent->ChildAt(numChildren - 1, getter_AddRefs(child));
     if (NS_SUCCEEDED(rv) && child) {
       nsCOMPtr<nsIAtom> tagName;
-      rv = child->GetTag(*getter_AddRefs(tagName));
+      rv = child->GetTag(getter_AddRefs(tagName));
       if (NS_SUCCEEDED(rv) && tagName == nsHTMLAtoms::br)
         --numChildren;
     }
diff --git a/layout/html/style/src/nsCSSFrameConstructor.cpp b/layout/html/style/src/nsCSSFrameConstructor.cpp
index 68fd996b99a1..4c283a2f3b71 100644
--- a/layout/html/style/src/nsCSSFrameConstructor.cpp
+++ b/layout/html/style/src/nsCSSFrameConstructor.cpp
@@ -1406,14 +1406,14 @@ nsCSSFrameConstructor::CreateGeneratedFrameFor(nsIPresContext*       aPresContex
     // XXX Check if it's an image type we can handle...
 
     nsCOMPtr<nsINodeInfoManager> nimgr;
-    nsresult rv = aDocument->GetNodeInfoManager(*getter_AddRefs(nimgr));
+    nsresult rv = aDocument->GetNodeInfoManager(getter_AddRefs(nimgr));
     NS_ENSURE_SUCCESS(rv, rv);
 
     // XXXldb We should not be creating an |image| element, because it
     // matches selectors!  See bug 109216.
     nsCOMPtr<nsINodeInfo> nodeInfo;
     nimgr->GetNodeInfo(nsHTMLAtoms::img, nsnull, kNameSpaceID_None,
-                       *getter_AddRefs(nodeInfo));
+                       getter_AddRefs(nodeInfo));
 
     nsCOMPtr<nsIElementFactory> ef(do_GetService(kHTMLElementFactoryCID,&rv));
     NS_ENSURE_SUCCESS(rv, rv);
@@ -3044,7 +3044,7 @@ nsCSSFrameConstructor::ConstructTableForeignFrame(nsIPresShell*            aPres
 
   // XXX form code needs to be fixed so that the forms can work without a frame.
   nsCOMPtr<nsIAtom> tag;
-  aContent->GetTag(*getter_AddRefs(tag));
+  aContent->GetTag(getter_AddRefs(tag));
 
   // Do not construct pseudo frames for trees 
   if (MustGeneratePseudoParent(aPresContext, aParentFrameIn, tag.get(), aContent, aStyleContext)) {
@@ -3250,7 +3250,7 @@ nsCSSFrameConstructor::TableProcessChild(nsIPresShell*            aPresShell,
       // NOT create psuedoframe for it.
       // see bug 159359
       nsCOMPtr<nsINodeInfo> parentNodeInfo, childNodeInfo;
-      aChildContent->GetNodeInfo(*getter_AddRefs(childNodeInfo));
+      aChildContent->GetNodeInfo(getter_AddRefs(childNodeInfo));
       // Sometimes aChildContent is a #text node.  In those cases it
       // does not have a nodeinfo, and in those cases we want to
       // construct a foreign frame for it in any case.  So we can just
@@ -3259,7 +3259,7 @@ nsCSSFrameConstructor::TableProcessChild(nsIPresShell*            aPresShell,
                    aChildContent->IsContentOfType(nsIContent::eTEXT),
                    "Non-#text nodes should have a nodeinfo here!");
       if (childNodeInfo) {
-        aParentContent->GetNodeInfo(*getter_AddRefs(parentNodeInfo));
+        aParentContent->GetNodeInfo(getter_AddRefs(parentNodeInfo));
         if (childNodeInfo->Equals(nsHTMLAtoms::form, kNameSpaceID_None) &&
             (parentNodeInfo->Equals(nsHTMLAtoms::table, kNameSpaceID_None) ||
              parentNodeInfo->Equals(nsHTMLAtoms::tr, kNameSpaceID_None) ||
@@ -3482,7 +3482,7 @@ nsCSSFrameConstructor::ConstructDocElementFrame(nsIPresShell*        aPresShell,
         else
 #endif 
 #ifdef MOZ_SVG
-        if (NS_SUCCEEDED(aDocElement->GetNameSpaceID(nameSpaceID)) && 
+        if (NS_SUCCEEDED(aDocElement->GetNameSpaceID(&nameSpaceID)) && 
             (nameSpaceID == kNameSpaceID_SVG)) {
           rv = NS_NewSVGOuterSVGFrame(aPresShell, aDocElement, &contentFrame);
           if (NS_FAILED(rv)) {
@@ -3794,10 +3794,10 @@ nsCSSFrameConstructor::ConstructRootFrame(nsIPresShell*        aPresShell,
       aDocElement->ChildCount(count);
       for (PRInt32 i = 0; i < count; ++i) {
         nsCOMPtr<nsIContent> kidElement;
-        aDocElement->ChildAt(i, *getter_AddRefs(kidElement));
+        aDocElement->ChildAt(i, getter_AddRefs(kidElement));
         if (kidElement){
           nsCOMPtr<nsIAtom> kidTag;
-          kidElement->GetTag(*getter_AddRefs(kidTag));
+          kidElement->GetTag(getter_AddRefs(kidTag));
           if (kidTag == nsHTMLAtoms::body) {
             bodyElement = kidElement;
             // done looking
@@ -5208,7 +5208,7 @@ nsCSSFrameConstructor::CreateAnonymousFrames(nsIPresShell*            aPresShell
       // Only cut XUL scrollbars off if they're not in a XUL document.  This allows
       // scrollbars to be styled from XUL (although not from XML or HTML).
       nsCOMPtr<nsIAtom> tag;
-      content->GetTag(*getter_AddRefs(tag));
+      content->GetTag(getter_AddRefs(tag));
       if (tag.get() == nsXULAtoms::scrollbar) {
         nsCOMPtr<nsIDOMXULDocument> xulDoc(do_QueryInterface(aDocument));
         if (xulDoc)
@@ -6299,7 +6299,7 @@ nsCSSFrameConstructor::ConstructFrameByDisplayType(nsIPresShell*            aPre
                     childItems, PR_TRUE);
 
     nsCOMPtr<nsIAtom> tag;
-    aContent->GetTag(*getter_AddRefs(tag));
+    aContent->GetTag(getter_AddRefs(tag));
     CreateAnonymousFrames(aPresShell, aPresContext, tag, aState, aContent, newFrame,
                           PR_FALSE, childItems);
 
@@ -6364,7 +6364,7 @@ nsCSSFrameConstructor::ConstructFrameByDisplayType(nsIPresShell*            aPre
                     childItems, PR_TRUE);
 
     nsCOMPtr<nsIAtom> tag;
-    aContent->GetTag(*getter_AddRefs(tag));
+    aContent->GetTag(getter_AddRefs(tag));
     CreateAnonymousFrames(aPresShell, aPresContext, tag, aState, aContent, newFrame,
                           PR_FALSE, childItems);
 
@@ -6416,7 +6416,7 @@ nsCSSFrameConstructor::ConstructFrameByDisplayType(nsIPresShell*            aPre
                     PR_TRUE, childItems, PR_TRUE);
 
     nsCOMPtr<nsIAtom> tag;
-    aContent->GetTag(*getter_AddRefs(tag));
+    aContent->GetTag(getter_AddRefs(tag));
     CreateAnonymousFrames(aPresShell, aPresContext, tag, aState, aContent, newFrame,
                           PR_FALSE, childItems);
 
@@ -6744,7 +6744,7 @@ nsCSSFrameConstructor::ResolveStyleContext(nsIPresContext*   aPresContext,
 #ifdef DEBUG
     {
       nsCOMPtr<nsIAtom> tag;
-      aContent->GetTag(*getter_AddRefs(tag));
+      aContent->GetTag(getter_AddRefs(tag));
       NS_ASSERTION(tag == nsLayoutAtoms::textTagName,
                    "shouldn't waste time creating style contexts for "
                    "comments and processing instructions");
@@ -6989,7 +6989,7 @@ nsCSSFrameConstructor::ConstructSVGFrame(nsIPresShell*            aPresShell,
                                           nsStyleContext*          aStyleContext,
                                           nsFrameItems&            aFrameItems)
 {
-  NS_ASSERTION(NS_SUCCEEDED(aContent->GetNameSpaceID(aNameSpaceID)) && 
+  NS_ASSERTION(NS_SUCCEEDED(aContent->GetNameSpaceID(&aNameSpaceID)) && 
             (aNameSpaceID == kNameSpaceID_SVG), "SVG frame constructed in wrong namespace");
 
   nsresult  rv = NS_OK;
@@ -7182,7 +7182,7 @@ nsCSSFrameConstructor::ConstructFrame(nsIPresShell*            aPresShell,
 
   // Get the element's tag
   nsCOMPtr<nsIAtom>  tag;
-  aContent->GetTag(*getter_AddRefs(tag));
+  aContent->GetTag(getter_AddRefs(tag));
 
   // never create frames for comments on PIs
   if (tag == nsLayoutAtoms::commentTagName ||
@@ -7193,7 +7193,7 @@ nsCSSFrameConstructor::ConstructFrame(nsIPresShell*            aPresShell,
   styleContext = ResolveStyleContext(aPresContext, aParentFrame, aContent);
 
   PRInt32 nameSpaceID;
-  aContent->GetNameSpaceID(nameSpaceID);
+  aContent->GetNameSpaceID(&nameSpaceID);
 
   PRBool pageBreakAfter = PR_FALSE;
   PRBool paginated;
@@ -8108,7 +8108,7 @@ ShouldIgnoreSelectChild(nsIContent* aContainer)
 {
   // Ignore options and optgroups inside a select (size > 1)
   nsCOMPtr<nsIAtom> containerTag;
-  aContainer->GetTag(*getter_AddRefs(containerTag));
+  aContainer->GetTag(getter_AddRefs(containerTag));
 
   if (containerTag == nsHTMLAtoms::optgroup ||
       containerTag == nsHTMLAtoms::select) {
@@ -8120,9 +8120,9 @@ ShouldIgnoreSelectChild(nsIContent* aContainer)
         break;
       
       tmpContent = selectContent;
-      tmpContent->GetParent(*getter_AddRefs(selectContent));
+      tmpContent->GetParent(getter_AddRefs(selectContent));
       if (selectContent)
-        selectContent->GetTag(*getter_AddRefs(containerTag));
+        selectContent->GetTag(getter_AddRefs(containerTag));
     }
     
     nsCOMPtr<nsISelectElement> selectElement = do_QueryInterface(selectContent);
@@ -8149,7 +8149,7 @@ GetAdjustedParentFrame(nsIPresContext* aPresContext,
                        PRInt32         aChildIndex)
 {
   nsCOMPtr<nsIContent> childContent;
-  aParentContent->ChildAt(aChildIndex, *getter_AddRefs(childContent));
+  aParentContent->ChildAt(aChildIndex, getter_AddRefs(childContent));
   nsIFrame* newParent = nsnull;
 
   if (nsLayoutAtoms::tableOuterFrame == aParentFrameType) {
@@ -8226,9 +8226,9 @@ nsCSSFrameConstructor::ContentAppended(nsIPresContext* aPresContext,
     nsCOMPtr<nsIBindingManager> bindingManager;
     nsCOMPtr<nsIDocument> document;
     nsCOMPtr<nsIContent> firstAppendedChild;
-    aContainer->ChildAt(aNewIndexInContainer, *getter_AddRefs(firstAppendedChild));
+    aContainer->ChildAt(aNewIndexInContainer, getter_AddRefs(firstAppendedChild));
     if (firstAppendedChild) {
-      firstAppendedChild->GetDocument(*getter_AddRefs(document));
+      firstAppendedChild->GetDocument(getter_AddRefs(document));
     }
     if (document)
       document->GetBindingManager(getter_AddRefs(bindingManager));
@@ -8272,7 +8272,7 @@ nsCSSFrameConstructor::ContentAppended(nsIPresContext* aPresContext,
       aContainer->ChildCount(containerCount);
       for (PRInt32 i = aNewIndexInContainer; i < containerCount; i++) {
         nsCOMPtr<nsIContent> child;
-        aContainer->ChildAt(i, *getter_AddRefs(child));
+        aContainer->ChildAt(i, getter_AddRefs(child));
         if (multiple) {
           // Filters are in effect, so the insertion point needs to be refetched for
           // each child.
@@ -8344,7 +8344,7 @@ nsCSSFrameConstructor::ContentAppended(nsIPresContext* aPresContext,
       // content is a block. We _could_ do better here with a little more work...
       // find out if the child is a block or inline, an inline means we don't have to reframe
       nsCOMPtr<nsIContent> child;
-      aContainer->ChildAt(aNewIndexInContainer, *getter_AddRefs(child));
+      aContainer->ChildAt(aNewIndexInContainer, getter_AddRefs(child));
       PRBool needReframe = !child;
       if (child && child->IsContentOfType(nsIContent::eELEMENT)) {
         nsRefPtr<nsStyleContext> styleContext;
@@ -8404,7 +8404,7 @@ nsCSSFrameConstructor::ContentAppended(nsIPresContext* aPresContext,
   aContainer->ChildCount(count);
   for (i = aNewIndexInContainer; i < count; i++) {
     nsCOMPtr<nsIContent> childContent;
-    aContainer->ChildAt(i, *getter_AddRefs(childContent));
+    aContainer->ChildAt(i, getter_AddRefs(childContent));
       
     // construct a child of a table frame by putting it on a temporary list and then
     // moving it into the appropriate list. This is more efficient than checking the display
@@ -8557,7 +8557,7 @@ nsCSSFrameConstructor::ContentAppended(nsIPresContext* aPresContext,
   nsCOMPtr<nsIDOMHTMLSelectElement> sel(do_QueryInterface(aContainer));
   if (sel) {
     nsCOMPtr<nsIContent> childContent;
-    aContainer->ChildAt(aNewIndexInContainer, *getter_AddRefs(childContent));
+    aContainer->ChildAt(aNewIndexInContainer, getter_AddRefs(childContent));
     if (childContent) {
       RemoveDummyFrameFromSelect(aPresContext, shell, aContainer,
                                  childContent, sel);
@@ -8815,7 +8815,7 @@ nsCSSFrameConstructor::ContentInserted(nsIPresContext*        aPresContext,
     mDocument->GetBindingManager(getter_AddRefs(bindingManager));
 
     nsCOMPtr<nsIAtom> tag;
-    aChild->GetTag(*getter_AddRefs(tag));
+    aChild->GetTag(getter_AddRefs(tag));
 
     PRBool listitem = tag && tag.get() == nsXULAtoms::listitem;
     if (listitem) {
@@ -9066,7 +9066,7 @@ nsCSSFrameConstructor::ContentInserted(nsIPresContext*        aPresContext,
       // of a block-in-inline hierarchy.
       if (IsFrameSpecial(parentFrame)) {
         nsCOMPtr<nsIContent> parentContainer;
-        blockContent->GetParent(*getter_AddRefs(parentContainer));
+        blockContent->GetParent(getter_AddRefs(parentContainer));
 #ifdef DEBUG
         if (gNoisyContentUpdates) {
           printf("nsCSSFrameConstructor::ContentInserted: parentFrame=");
@@ -9532,7 +9532,7 @@ nsCSSFrameConstructor::ContentRemoved(nsIPresContext* aPresContext,
     mDocument->GetBindingManager(getter_AddRefs(bindingManager));
 
     nsCOMPtr<nsIAtom> tag;
-    aChild->GetTag(*getter_AddRefs(tag));
+    aChild->GetTag(getter_AddRefs(tag));
 
     PRBool listitem = tag && tag.get() == nsXULAtoms::listitem;
     if (listitem) {
@@ -10114,7 +10114,7 @@ nsCSSFrameConstructor::ContentChanged(nsIPresContext* aPresContext,
           // The block has first-letter style. Use content-replaced to
           // repair the blocks frame structure properly.
           nsCOMPtr<nsIContent> container;
-          aContent->GetParent(*getter_AddRefs(container));
+          aContent->GetParent(getter_AddRefs(container));
           if (container) {
             PRInt32 ix;
             container->IndexOf(aContent, ix);
@@ -10228,7 +10228,7 @@ inline already_AddRefed<nsIContent>
 parent_of(nsIContent *aContent)
 {
   nsIContent *parent = nsnull;
-  aContent->GetParent(parent);
+  aContent->GetParent(&parent);
   return parent;
 }
 
@@ -10669,7 +10669,7 @@ nsCSSFrameConstructor::ConstructAlternateFrame(nsIPresShell*    aPresShell,
 
   // Get the alternate text to use
   nsCOMPtr<nsIAtom> tag;
-  aContent->GetTag(*getter_AddRefs(tag));
+  aContent->GetTag(getter_AddRefs(tag));
   GetAlternateTextFor(aContent, tag, altText);
 
   // Create a text content element for the alternate text
@@ -10814,8 +10814,8 @@ nsCSSFrameConstructor::CantRenderReplacedElement(nsIPresShell* aPresShell,
 
   aFrame->GetContent(getter_AddRefs(content));
   NS_ASSERTION(content, "null content object");
-  content->GetNameSpaceID(nameSpaceID);
-  content->GetTag(*getter_AddRefs(tag));
+  content->GetNameSpaceID(&nameSpaceID);
+  content->GetTag(getter_AddRefs(tag));
 
   // Get the child list name that the frame is contained in
   nsCOMPtr<nsIAtom>  listName;
@@ -11665,7 +11665,7 @@ nsCSSFrameConstructor::FindPrimaryFrameFor(nsIPresContext*  aPresContext,
   // Get the frame that corresponds to the parent content object.
   // Note that this may recurse indirectly, because the pres shell will
   // call us back if there is no mapping in the hash table
-  aContent->GetParent(*getter_AddRefs(parentContent));
+  aContent->GetParent(getter_AddRefs(parentContent));
   if (parentContent.get()) {
     aFrameManager->GetPrimaryFrameFor(parentContent, &parentFrame);
     while (parentFrame) {
@@ -11719,7 +11719,7 @@ nsCSSFrameConstructor::FindPrimaryFrameFor(nsIPresContext*  aPresContext,
   if (aHint && !*aFrame)
   { // if we had a hint, and we didn't get a frame, see if we should try the slow way
     nsCOMPtr<nsIAtom>tag;
-    aContent->GetTag(*getter_AddRefs(tag));
+    aContent->GetTag(getter_AddRefs(tag));
     if (nsLayoutAtoms::textTagName == tag.get()) 
     {
 #ifdef NOISY_FINDFRAME
@@ -11758,7 +11758,7 @@ nsCSSFrameConstructor::GetInsertionPoint(nsIPresShell* aPresShell,
     return NS_OK;
 
   nsCOMPtr<nsIDocument> document;
-  container->GetDocument(*getter_AddRefs(document));
+  container->GetDocument(getter_AddRefs(document));
   if (!document)
     return NS_OK;
 
@@ -11864,7 +11864,7 @@ nsCSSFrameConstructor::RecreateFramesForContent(nsIPresContext* aPresContext,
   // shouldn't generally be giving this method content without a document
   // anyway).
   nsCOMPtr<nsIDocument> doc;
-  aContent->GetDocument(*getter_AddRefs(doc));
+  aContent->GetDocument(getter_AddRefs(doc));
   NS_ENSURE_TRUE(doc, NS_ERROR_FAILURE);
 
   // Is the frame `special'? If so, we need to reframe the containing
@@ -11909,7 +11909,7 @@ nsCSSFrameConstructor::RecreateFramesForContent(nsIPresContext* aPresContext,
 
   nsresult rv = NS_OK;
   nsCOMPtr<nsIContent> container;
-  aContent->GetParent(*getter_AddRefs(container));
+  aContent->GetParent(getter_AddRefs(container));
   if (container) {
     PRInt32 indexInContainer;
     rv = container->IndexOf(aContent, indexInContainer);
@@ -11948,7 +11948,7 @@ nsCSSFrameConstructor::RecreateFramesForContent(nsIPresContext* aPresContext,
     // since rebuilding the frame tree can have bad effects, especially
     // if it's the frame tree for chrome (see bug 157322).
     nsCOMPtr<nsIDocument> doc;
-    aContent->GetDocument(*getter_AddRefs(doc));
+    aContent->GetDocument(getter_AddRefs(doc));
     NS_ASSERTION(doc, "received style change for content not in document");
     if (doc)
       ReconstructDocElementHierarchy(aPresContext);
@@ -13079,10 +13079,10 @@ nsCSSFrameConstructor::CreateListBoxContent(nsIPresContext* aPresContext,
     }
 
     nsCOMPtr<nsIAtom> tag;
-    aChild->GetTag(*getter_AddRefs(tag));
+    aChild->GetTag(getter_AddRefs(tag));
 
     PRInt32 namespaceID;
-    aChild->GetNameSpaceID(namespaceID);
+    aChild->GetNameSpaceID(&namespaceID);
 
     rv = ConstructFrameInternal(shell, aPresContext, state, aChild, aParentFrame, tag, namespaceID, 
                                 styleContext, frameItems, PR_FALSE);
@@ -13191,7 +13191,7 @@ nsCSSFrameConstructor::ConstructBlock(nsIPresShell*            aPresShell,
                                      PR_TRUE, childItems, PR_TRUE);
 
   nsCOMPtr<nsIAtom> tag;
-  aContent->GetTag(*getter_AddRefs(tag));
+  aContent->GetTag(getter_AddRefs(tag));
   CreateAnonymousFrames(aPresShell, aPresContext, tag, aState, aContent, aNewFrame,
                         PR_FALSE, childItems);
 
@@ -13333,7 +13333,7 @@ nsCSSFrameConstructor::ConstructInline(nsIPresShell*            aPresShell,
   if (kidsAllInline) {
     // Set the inline frame's initial child list
     nsCOMPtr<nsIAtom> tag;
-    aContent->GetTag(*getter_AddRefs(tag));
+    aContent->GetTag(getter_AddRefs(tag));
     CreateAnonymousFrames(aPresShell, aPresContext, tag, aState, aContent, aNewFrame,
                           PR_FALSE, childItems);
 
@@ -13720,7 +13720,7 @@ nsCSSFrameConstructor::WipeContainingBlock(nsIPresContext* aPresContext,
       // entire block. This is painful and definitely not optimal
       // but it will *always* get the right answer.
       nsCOMPtr<nsIContent> parentContainer;
-      aBlockContent->GetParent(*getter_AddRefs(parentContainer));
+      aBlockContent->GetParent(getter_AddRefs(parentContainer));
 #ifdef DEBUG
       if (gNoisyContentUpdates) {
         printf("nsCSSFrameConstructor::WipeContainingBlock: aBlockContent=%p parentContainer=%p\n",
@@ -14063,7 +14063,7 @@ nsCSSFrameConstructor::ReframeContainingBlock(nsIPresContext* aPresContext, nsIF
     if (blockContent) {
       // Now find the containingBlock's content's parent
       nsCOMPtr<nsIContent> parentContainer;
-      blockContent->GetParent(*getter_AddRefs(parentContainer));
+      blockContent->GetParent(getter_AddRefs(parentContainer));
       if (parentContainer) {
 #ifdef DEBUG
         if (gNoisyContentUpdates) {
diff --git a/layout/html/style/src/nsCSSRendering.cpp b/layout/html/style/src/nsCSSRendering.cpp
index 3133574599b2..422e4d0bd57a 100644
--- a/layout/html/style/src/nsCSSRendering.cpp
+++ b/layout/html/style/src/nsCSSRendering.cpp
@@ -1555,8 +1555,8 @@ PRBool GetBGColorForHTMLElement( nsIPresContext *aPresContext,
       nsIContent *pContent;
       if (NS_SUCCEEDED(doc->GetRootContent(&pContent)) && pContent) {
         // make sure that this is the HTML element
-        nsIAtom *tag = nsnull;
-        pContent->GetTag(tag);
+        nsCOMPtr<nsIAtom> tag;
+        pContent->GetTag(getter_AddRefs(tag));
         NS_ASSERTION(tag, "Tag could not be retrieved from root content element");
         if (tag) {
           if (tag == nsHTMLAtoms::html ||
@@ -1580,7 +1580,6 @@ PRBool GetBGColorForHTMLElement( nsIPresContext *aPresContext,
             printf( "Root Content is not HTML or BODY: cannot get bgColor of HTML or BODY\n");
           }
 #endif
-          NS_RELEASE(tag);
         }// if tag
         NS_RELEASE(pContent);
       }// if content
@@ -1615,7 +1614,7 @@ nsresult GetFrameForBackgroundUpdate(nsIPresContext *aPresContext,nsIFrame *aFra
     if (pContent) {
       // make sure that this is the HTML or BODY element
       nsCOMPtr<nsIAtom> tag;
-      pContent->GetTag(*(getter_AddRefs(tag)));
+      pContent->GetTag(getter_AddRefs(tag));
       if (tag) {
         if (tag.get() == nsHTMLAtoms::html ||
             tag.get() == nsHTMLAtoms::body) {
@@ -2759,7 +2758,7 @@ FindElementBackground(nsIPresContext* aPresContext,
     return PR_TRUE; // no parent to look at
   
   nsCOMPtr<nsIAtom> tag;
-  content->GetTag(*getter_AddRefs(tag));
+  content->GetTag(getter_AddRefs(tag));
   if (tag != nsHTMLAtoms::body)
     return PR_TRUE; // not frame for <BODY> element
 
@@ -2822,7 +2821,7 @@ nsCSSRendering::PaintBackground(nsIPresContext* aPresContext,
       aForFrame->GetContent(getter_AddRefs(content));
       if (content) {
         nsCOMPtr<nsIContent> parent;
-        content->GetParent(*getter_AddRefs(parent));
+        content->GetParent(getter_AddRefs(parent));
         if (parent)
           return;
         else
diff --git a/layout/html/style/src/nsChildIterator.cpp b/layout/html/style/src/nsChildIterator.cpp
index 22e5de22630f..949d39db7d63 100644
--- a/layout/html/style/src/nsChildIterator.cpp
+++ b/layout/html/style/src/nsChildIterator.cpp
@@ -54,7 +54,7 @@ ChildIterator::Init(nsIContent*    aContent,
     return NS_ERROR_NULL_POINTER;
 
   nsCOMPtr<nsIDocument> doc;
-  aContent->GetDocument(*getter_AddRefs(doc));
+  aContent->GetDocument(getter_AddRefs(doc));
   NS_ASSERTION(doc != nsnull, "element not in the document");
   if (! doc)
     return NS_ERROR_FAILURE;
diff --git a/layout/html/style/src/nsChildIterator.h b/layout/html/style/src/nsChildIterator.h
index d0f8da36358d..5ee5de1f2276 100644
--- a/layout/html/style/src/nsChildIterator.h
+++ b/layout/html/style/src/nsChildIterator.h
@@ -105,7 +105,7 @@ public:
       CallQueryInterface(node, &result);
     }
     else 
-      mContent->ChildAt(PRInt32(mIndex), result);
+      mContent->ChildAt(PRInt32(mIndex), &result);
 
     return result;
   }
diff --git a/layout/html/tests/TestAttributes.cpp b/layout/html/tests/TestAttributes.cpp
index 4a335d28217b..39c69b934ceb 100644
--- a/layout/html/tests/TestAttributes.cpp
+++ b/layout/html/tests/TestAttributes.cpp
@@ -301,7 +301,7 @@ int main(int argc, char** argv)
 
   nsCOMPtr<nsINodeInfoManager> nimgr;
   nsCOMPtr<nsINodeInfo> ni;
-  myDoc->GetNodeInfoManager(*getter_AddRefs(nimgr));
+  myDoc->GetNodeInfoManager(getter_AddRefs(nimgr));
   nimgr->GetNodeInfo(li, nsnull, kNameSpaceID_None, *getter_AddRefs(ni));
 
   rv = NS_NewHTMLLIElement(&container,ni);
diff --git a/layout/mathml/base/src/nsMathMLContainerFrame.cpp b/layout/mathml/base/src/nsMathMLContainerFrame.cpp
index 2045e2a94b90..bafe73725b3a 100644
--- a/layout/mathml/base/src/nsMathMLContainerFrame.cpp
+++ b/layout/mathml/base/src/nsMathMLContainerFrame.cpp
@@ -887,7 +887,7 @@ nsMathMLContainerFrame::ReLayoutChildren(nsIPresContext* aPresContext,
     NS_ASSERTION(content, "dangling frame without a content node");
     if (!content)
       return NS_ERROR_FAILURE;
-    content->GetTag(*getter_AddRefs(tag));
+    content->GetTag(getter_AddRefs(tag));
     if (tag.get() == nsMathMLAtoms::math) {
       break;
     }
@@ -1332,7 +1332,7 @@ nsMathMLContainerFrame::Place(nsIPresContext*      aPresContext,
       // update to include the left correction
       // but leave <msqrt> alone because the sqrt glyph itself is there first
       nsCOMPtr<nsIAtom> tag;
-      mContent->GetTag(*getter_AddRefs(tag));
+      mContent->GetTag(getter_AddRefs(tag));
       if (tag.get() == nsMathMLAtoms::msqrt_)
         leftCorrection = 0;
       else
@@ -1390,7 +1390,7 @@ nsMathMLContainerFrame::Place(nsIPresContext*      aPresContext,
       if (0 == count) {
         // for <msqrt>, the sqrt glyph itself is there first
         nsCOMPtr<nsIAtom> tag;
-        mContent->GetTag(*getter_AddRefs(tag));
+        mContent->GetTag(getter_AddRefs(tag));
         if (tag.get() == nsMathMLAtoms::msqrt_)
           leftCorrection = 0;
       }
@@ -1461,7 +1461,7 @@ nsMathMLContainerFrame::FixInterFrameSpacing(nsIPresContext*      aPresContext,
   nsCOMPtr<nsIAtom> parentTag;
   nsCOMPtr<nsIContent> parentContent;
   mParent->GetContent(getter_AddRefs(parentContent));
-  parentContent->GetTag(*getter_AddRefs(parentTag));
+  parentContent->GetTag(getter_AddRefs(parentTag));
   if (parentTag == nsMathMLAtoms::math ||
       parentTag == nsMathMLAtoms::mtd_) {
     nscoord gap = GetInterFrameSpacingFor(aPresContext,
diff --git a/layout/mathml/base/src/nsMathMLFrame.cpp b/layout/mathml/base/src/nsMathMLFrame.cpp
index 96dcd56251d7..cd8cc08bb9a1 100644
--- a/layout/mathml/base/src/nsMathMLFrame.cpp
+++ b/layout/mathml/base/src/nsMathMLFrame.cpp
@@ -174,7 +174,7 @@ nsMathMLFrame::GetPresentationDataFrom(nsIFrame*           aFrame,
     NS_ASSERTION(content, "dangling frame without a content node");
     if (!content)
       break;
-    content->GetTag(*getter_AddRefs(tag));
+    content->GetTag(getter_AddRefs(tag));
     if (tag.get() == nsMathMLAtoms::math) {
       const nsStyleDisplay* display = frame->GetStyleDisplay();
       if (display->mDisplay == NS_STYLE_DISPLAY_BLOCK) {
@@ -597,7 +597,9 @@ nsMathMLFrame::MapAttributesIntoCSS(nsIPresContext* aPresContext,
   nsCOMPtr<nsIAtom> attrAtom;
   PRInt32 ruleCount = 0;
   for (PRInt32 i = 0; i < attrCount; ++i) {
-    aContent->GetAttrNameAt(i, nameSpaceID, *getter_AddRefs(attrAtom), *getter_AddRefs(prefix));
+    aContent->GetAttrNameAt(i, &nameSpaceID,
+                            getter_AddRefs(attrAtom),
+                            getter_AddRefs(prefix));
 
     // lookup the equivalent CSS property
     const nsCSSMapping* map = kCSSMappingTable;
@@ -638,7 +640,7 @@ nsMathMLFrame::MapAttributesIntoCSS(nsIPresContext* aPresContext,
     if (!sheet) {
       // first time... we do this to defer the lookup up to the
       // point where we encounter attributes that actually matter
-      aContent->GetDocument(*getter_AddRefs(doc));
+      aContent->GetDocument(getter_AddRefs(doc));
       if (!doc) 
         return 0;
       GetMathMLAttributeStyleSheet(aPresContext, getter_AddRefs(sheet));
diff --git a/layout/mathml/base/src/nsMathMLTokenFrame.cpp b/layout/mathml/base/src/nsMathMLTokenFrame.cpp
index 670bc51a281b..483b478683b6 100644
--- a/layout/mathml/base/src/nsMathMLTokenFrame.cpp
+++ b/layout/mathml/base/src/nsMathMLTokenFrame.cpp
@@ -75,7 +75,7 @@ CompressWhitespace(nsIContent* aContent)
   aContent->ChildCount(numKids);
   for (PRInt32 kid = 0; kid < numKids; kid++) {
     nsCOMPtr<nsIContent> kidContent;
-    aContent->ChildAt(kid, *getter_AddRefs(kidContent));
+    aContent->ChildAt(kid, getter_AddRefs(kidContent));
     if (kidContent) {       
       nsCOMPtr<nsIDOMText> kidText(do_QueryInterface(kidContent));
       if (kidText) {
@@ -290,7 +290,7 @@ void
 nsMathMLTokenFrame::SetTextStyle(nsIPresContext* aPresContext)
 {
   nsCOMPtr<nsIAtom> tag;
-  mContent->GetTag(*getter_AddRefs(tag));
+  mContent->GetTag(getter_AddRefs(tag));
   if (tag != nsMathMLAtoms::mi_)
     return;
 
@@ -305,7 +305,7 @@ nsMathMLTokenFrame::SetTextStyle(nsIPresContext* aPresContext)
   mContent->ChildCount(numKids);
   for (PRInt32 kid = 0; kid < numKids; kid++) {
     nsCOMPtr<nsIContent> kidContent;
-    mContent->ChildAt(kid, *getter_AddRefs(kidContent));
+    mContent->ChildAt(kid, getter_AddRefs(kidContent));
     if (kidContent) {
       nsCOMPtr<nsIDOMText> kidText(do_QueryInterface(kidContent));
       if (kidText) {
@@ -418,7 +418,7 @@ void
 nsMathMLTokenFrame::SetQuotes(nsIPresContext* aPresContext)
 {
   nsCOMPtr<nsIAtom> tag;
-  mContent->GetTag(*getter_AddRefs(tag));
+  mContent->GetTag(getter_AddRefs(tag));
   if (tag != nsMathMLAtoms::ms_)
     return;
 
diff --git a/layout/mathml/base/src/nsMathMLmmultiscriptsFrame.cpp b/layout/mathml/base/src/nsMathMLmmultiscriptsFrame.cpp
index db0104039f00..ad688274a990 100644
--- a/layout/mathml/base/src/nsMathMLmmultiscriptsFrame.cpp
+++ b/layout/mathml/base/src/nsMathMLmmultiscriptsFrame.cpp
@@ -85,7 +85,7 @@ nsMathMLmmultiscriptsFrame::TransmitAutomaticData(nsIPresContext* aPresContext)
     nsCOMPtr<nsIContent> childContent;
     nsCOMPtr<nsIAtom> childTag;
     childFrame->GetContent(getter_AddRefs(childContent));
-    childContent->GetTag(*getter_AddRefs(childTag));
+    childContent->GetTag(getter_AddRefs(childTag));
     if (childTag.get() == nsMathMLAtoms::mprescripts_) {
       // mprescripts frame
     }
@@ -263,7 +263,7 @@ nsMathMLmmultiscriptsFrame::Place(nsIPresContext*      aPresContext,
     nsCOMPtr<nsIContent> childContent;
     nsCOMPtr<nsIAtom> childTag;
     childFrame->GetContent(getter_AddRefs(childContent));
-    childContent->GetTag(*getter_AddRefs(childTag));
+    childContent->GetTag(getter_AddRefs(childTag));
 
     if (childTag.get() == nsMathMLAtoms::mprescripts_) {
       if (mprescriptsFrame) {
diff --git a/layout/mathml/base/src/nsMathMLmoFrame.cpp b/layout/mathml/base/src/nsMathMLmoFrame.cpp
index f1ef97c1048b..cd7e44bcedb7 100644
--- a/layout/mathml/base/src/nsMathMLmoFrame.cpp
+++ b/layout/mathml/base/src/nsMathMLmoFrame.cpp
@@ -207,7 +207,7 @@ nsMathMLmoFrame::ProcessTextData(nsIPresContext* aPresContext)
   mContent->ChildCount(numKids);
   for (PRInt32 kid=0; kid<numKids; kid++) {
     nsCOMPtr<nsIContent> kidContent;
-    mContent->ChildAt(kid, *getter_AddRefs(kidContent));
+    mContent->ChildAt(kid, getter_AddRefs(kidContent));
     if (kidContent.get()) {
       nsCOMPtr<nsIDOMText> kidText(do_QueryInterface(kidContent));
       if (kidText.get()) {
diff --git a/layout/printing/nsPrintEngine.cpp b/layout/printing/nsPrintEngine.cpp
index 8f3eab353e39..1d5db12d734f 100644
--- a/layout/printing/nsPrintEngine.cpp
+++ b/layout/printing/nsPrintEngine.cpp
@@ -1966,7 +1966,7 @@ nsPrintEngine::MapContentForPO(nsPrintObject*   aRootObject,
   NS_ASSERTION(aContent, "Pointer is null!");
 
   nsCOMPtr<nsIDocument> doc;
-  aContent->GetDocument(*getter_AddRefs(doc));
+  aContent->GetDocument(getter_AddRefs(doc));
 
   if (!doc) {
     NS_ERROR("No document!");
@@ -2025,9 +2025,9 @@ nsPrintEngine::MapContentForPO(nsPrintObject*   aRootObject,
   // walk children content
   PRInt32 count;
   aContent->ChildCount(count);
-  for (PRInt32 i=0;i<count;i++) {
-    nsIContent* child;
-    aContent->ChildAt(i, child);
+  nsCOMPtr<nsIContent> child;
+  for (PRInt32 i = 0; i < count; ++i) {
+    aContent->ChildAt(i, getter_AddRefs(child));
     MapContentForPO(aRootObject, aPresShell, child);
   }
 }
@@ -2757,7 +2757,8 @@ nsPrintEngine::ReflowPrintObject(nsPrintObject * aPO, PRBool aDoCalcShrink)
   // get the old history
   nsCOMPtr<nsIPresShell> presShell;
   nsCOMPtr<nsILayoutHistoryState>  layoutState;
-  NS_ENSURE_SUCCESS(mDocViewer->GetPresShell(*(getter_AddRefs(presShell))), NS_ERROR_FAILURE);
+  rv = mDocViewer->GetPresShell(getter_AddRefs(presShell));
+  NS_ENSURE_SUCCESS(rv, rv);
   presShell->CaptureHistoryState(getter_AddRefs(layoutState), PR_TRUE);
 
   // set it on the new pres shell
@@ -3707,7 +3708,7 @@ nsPrintEngine::FindFrameByType(nsIPresContext* aPresContext,
     child->GetContent(getter_AddRefs(content));
     if (content) {
       nsCOMPtr<nsIAtom> type;
-      content->GetTag(*getter_AddRefs(type));
+      content->GetTag(getter_AddRefs(type));
       if (type.get() == aType) {
         nsRect r;
         child->GetRect(r);
@@ -4000,7 +4001,7 @@ nsPrintEngine::FindFocusedDOMWindowInternal()
   nsCOMPtr<nsIFocusController>    focusController;
   nsIDOMWindowInternal *          domWin = nsnull;
 
-  mDocViewer->GetDocument(*getter_AddRefs(theDoc));
+  mDocViewer->GetDocument(getter_AddRefs(theDoc));
   if(theDoc){
     theDoc->GetScriptGlobalObject(getter_AddRefs(theSGO));
     if(theSGO){
diff --git a/layout/style/nsCSSLoader.cpp b/layout/style/nsCSSLoader.cpp
index ce3ad3dcfbc2..0e1727cdb8fc 100644
--- a/layout/style/nsCSSLoader.cpp
+++ b/layout/style/nsCSSLoader.cpp
@@ -1059,7 +1059,7 @@ CSSLoaderImpl::CreateSheet(nsIURI* aURI,
       // Inline style.  Use the document's base URL so that @import in
       // the inline sheet picks up the right base.
       NS_ASSERTION(mDocument, "How did we get in here without a document?");
-      mDocument->GetBaseURL(*getter_AddRefs(sheetURI));
+      mDocument->GetBaseURL(getter_AddRefs(sheetURI));
     }
 
     rv = NS_NewCSSStyleSheet(aSheet, sheetURI);
diff --git a/layout/style/nsCSSParser.cpp b/layout/style/nsCSSParser.cpp
index adeb2d402d9d..ce7e445ad1c6 100644
--- a/layout/style/nsCSSParser.cpp
+++ b/layout/style/nsCSSParser.cpp
@@ -1841,13 +1841,12 @@ void CSSParserImpl::ParseTypeOrUniversalSelector(PRInt32&  aDataMask,
     else {  // was universal element selector
       aSelector.SetNameSpace(kNameSpaceID_Unknown); // wildcard
       if (mNameSpace) { // look for default namespace
-        nsINameSpace* defaultNameSpace = nsnull;
-        mNameSpace->FindNameSpace(nsnull, defaultNameSpace);
+        nsCOMPtr<nsINameSpace> defaultNameSpace;
+        mNameSpace->FindNameSpace(nsnull, getter_AddRefs(defaultNameSpace));
         if (defaultNameSpace) {
           PRInt32 defaultID;
-          defaultNameSpace->GetNameSpaceID(defaultID);
+          defaultNameSpace->GetNameSpaceID(&defaultID);
           aSelector.SetNameSpace(defaultID);
-          NS_RELEASE(defaultNameSpace);
         }
       }
       aDataMask |= SEL_MASK_ELEM;
@@ -1867,7 +1866,7 @@ void CSSParserImpl::ParseTypeOrUniversalSelector(PRInt32&  aDataMask,
       if (mNameSpace) {
         ToLowerCase(buffer); // always case insensitive, since stays within CSS
         nsCOMPtr<nsIAtom> prefix = do_GetAtom(buffer);
-        mNameSpace->FindNameSpaceID(prefix, nameSpaceID);
+        mNameSpace->FindNameSpaceID(prefix, &nameSpaceID);
       } // else, no declared namespaces
       if (kNameSpaceID_Unknown == nameSpaceID) {  // unknown prefix, dump it
         REPORT_UNEXPECTED(NS_LITERAL_STRING("Unknown namespace prefix '") +
@@ -1907,13 +1906,12 @@ void CSSParserImpl::ParseTypeOrUniversalSelector(PRInt32&  aDataMask,
     else {  // was element name
       aSelector.SetNameSpace(kNameSpaceID_Unknown); // wildcard
       if (mNameSpace) { // look for default namespace
-        nsINameSpace* defaultNameSpace = nsnull;
-        mNameSpace->FindNameSpace(nsnull, defaultNameSpace);
+        nsCOMPtr<nsINameSpace> defaultNameSpace;
+        mNameSpace->FindNameSpace(nsnull, getter_AddRefs(defaultNameSpace));
         if (defaultNameSpace) {
           PRInt32 defaultID;
-          defaultNameSpace->GetNameSpaceID(defaultID);
+          defaultNameSpace->GetNameSpaceID(&defaultID);
           aSelector.SetNameSpace(defaultID);
-          NS_RELEASE(defaultNameSpace);
         }
       }
       if (mCaseSensitive) {
@@ -1971,13 +1969,12 @@ void CSSParserImpl::ParseTypeOrUniversalSelector(PRInt32&  aDataMask,
     // set namespace to unknown since it is not specified
     aSelector.SetNameSpace(kNameSpaceID_Unknown); // wildcard
     if (mNameSpace) { // look for default namespace
-      nsINameSpace* defaultNameSpace = nsnull;
-      mNameSpace->FindNameSpace(nsnull, defaultNameSpace);
+      nsCOMPtr<nsINameSpace> defaultNameSpace;
+      mNameSpace->FindNameSpace(nsnull, getter_AddRefs(defaultNameSpace));
       if (defaultNameSpace) {
         PRInt32 defaultID;
-        defaultNameSpace->GetNameSpaceID(defaultID);
+        defaultNameSpace->GetNameSpaceID(&defaultID);
         aSelector.SetNameSpace(defaultID);
-        NS_RELEASE(defaultNameSpace);
       }
     }
   }
@@ -2054,7 +2051,7 @@ void CSSParserImpl::ParseAttributeSelector(PRInt32&  aDataMask,
       if (mNameSpace) {
         ToLowerCase(attr); // always case insensitive, since stays within CSS
         nsCOMPtr<nsIAtom> prefix = do_GetAtom(attr);
-        mNameSpace->FindNameSpaceID(prefix, nameSpaceID);
+        mNameSpace->FindNameSpaceID(prefix, &nameSpaceID);
       } // else, no declared namespaces
       if (kNameSpaceID_Unknown == nameSpaceID) {  // unknown prefix, dump it
         REPORT_UNEXPECTED(NS_LITERAL_STRING("Unknown namespace prefix '") +
@@ -3536,7 +3533,7 @@ PRBool CSSParserImpl::ParseAttr(PRInt32& aErrorCode, nsCSSValue& aValue)
           if (mNameSpace) {
             ToLowerCase(holdIdent); // always case insensitive, since stays within CSS
             nsCOMPtr<nsIAtom> prefix = do_GetAtom(holdIdent);
-            mNameSpace->FindNameSpaceID(prefix, nameSpaceID);
+            mNameSpace->FindNameSpaceID(prefix, &nameSpaceID);
           } // else, no declared namespaces
           if (kNameSpaceID_Unknown == nameSpaceID) {  // unknown prefix, dump it
             return PR_FALSE;
diff --git a/layout/style/nsCSSStyleRule.cpp b/layout/style/nsCSSStyleRule.cpp
index 426197f10a58..10caf433d4e8 100644
--- a/layout/style/nsCSSStyleRule.cpp
+++ b/layout/style/nsCSSStyleRule.cpp
@@ -565,7 +565,7 @@ nsresult nsCSSSelector::ToString( nsAString& aString, nsICSSStyleSheet* aSheet,
     aSheet->GetNameSpace(*getter_AddRefs(sheetNS));
     nsCOMPtr<nsIAtom> prefixAtom;
     // will return null if namespace was the default
-    sheetNS->FindNameSpacePrefix(mNameSpace, *getter_AddRefs(prefixAtom));
+    sheetNS->FindNameSpacePrefix(mNameSpace, getter_AddRefs(prefixAtom));
     if (prefixAtom) {
       nsAutoString prefix;
       prefixAtom->ToString(prefix);
@@ -627,7 +627,8 @@ nsresult nsCSSSelector::ToString( nsAString& aString, nsICSSStyleSheet* aSheet,
         aSheet->GetNameSpace(*getter_AddRefs(sheetNS));
         nsCOMPtr<nsIAtom> prefixAtom;
         // will return null if namespace was the default
-        sheetNS->FindNameSpacePrefix(list->mNameSpace, *getter_AddRefs(prefixAtom));
+        sheetNS->FindNameSpacePrefix(list->mNameSpace,
+                                     getter_AddRefs(prefixAtom));
         if (prefixAtom) { 
           nsAutoString prefix;
           prefixAtom->ToString(prefix);
diff --git a/layout/style/nsCSSStyleSheet.cpp b/layout/style/nsCSSStyleSheet.cpp
index b9c6ac39a470..d5ab04818315 100644
--- a/layout/style/nsCSSStyleSheet.cpp
+++ b/layout/style/nsCSSStyleSheet.cpp
@@ -1549,7 +1549,7 @@ CreateNameSpace(nsISupports* aRule, void* aNameSpacePtr)
     nsAutoString  urlSpec;
     nameSpaceRule->GetPrefix(prefix);
     nameSpaceRule->GetURLSpec(urlSpec);
-    lastNameSpace->CreateChildNameSpace(prefix, urlSpec, newNameSpace);
+    lastNameSpace->CreateChildNameSpace(prefix, urlSpec, &newNameSpace);
     NS_IF_RELEASE(prefix);
     if (newNameSpace) {
       NS_RELEASE(lastNameSpace);
@@ -1566,11 +1566,12 @@ CreateNameSpace(nsISupports* aRule, void* aNameSpacePtr)
 void 
 CSSStyleSheetInner::RebuildNameSpaces(void)
 {
-  nsContentUtils::GetNSManagerWeakRef()->CreateRootNameSpace(*getter_AddRefs(mNameSpace));
+  nsContentUtils::GetNSManagerWeakRef()->
+      CreateRootNameSpace(getter_AddRefs(mNameSpace));
   if (kNameSpaceID_Unknown != mDefaultNameSpaceID) {
     nsCOMPtr<nsINameSpace> defaultNameSpace;
     mNameSpace->CreateChildNameSpace(nsnull, mDefaultNameSpaceID,
-                                     *getter_AddRefs(defaultNameSpace));
+                                     getter_AddRefs(defaultNameSpace));
     if (defaultNameSpace) {
       mNameSpace = defaultNameSpace;
     }
@@ -2115,7 +2116,8 @@ CSSStyleSheetImpl::AppendStyleRule(nsICSSRule* aRule)
       aRule->GetType(type);
       if (nsICSSRule::NAMESPACE_RULE == type) {
         if (! mInner->mNameSpace) {
-          nsContentUtils::GetNSManagerWeakRef()->CreateRootNameSpace(*getter_AddRefs(mInner->mNameSpace));
+          nsContentUtils::GetNSManagerWeakRef()->
+              CreateRootNameSpace(getter_AddRefs(mInner->mNameSpace));
         }
 
         if (mInner->mNameSpace) {
@@ -2126,8 +2128,9 @@ CSSStyleSheetImpl::AppendStyleRule(nsICSSRule* aRule)
           nsAutoString  urlSpec;
           nameSpaceRule->GetPrefix(*getter_AddRefs(prefix));
           nameSpaceRule->GetURLSpec(urlSpec);
-          mInner->mNameSpace->CreateChildNameSpace(prefix, urlSpec,
-                                                   *getter_AddRefs(newNameSpace));
+          mInner->mNameSpace->
+              CreateChildNameSpace(prefix, urlSpec,
+                                   getter_AddRefs(newNameSpace));
           if (newNameSpace) {
             mInner->mNameSpace = newNameSpace;
           }
@@ -2720,7 +2723,8 @@ CSSStyleSheetImpl::InsertRule(const nsAString& aRule,
     cssRule->GetType(type);
     if (type == nsICSSRule::NAMESPACE_RULE) {
       if (! mInner->mNameSpace) {
-        nsContentUtils::GetNSManagerWeakRef()->CreateRootNameSpace(*getter_AddRefs(mInner->mNameSpace));
+        nsContentUtils::GetNSManagerWeakRef()->
+            CreateRootNameSpace(getter_AddRefs(mInner->mNameSpace));
       }
 
       NS_ENSURE_TRUE(mInner->mNameSpace, NS_ERROR_FAILURE);
@@ -2733,7 +2737,7 @@ CSSStyleSheetImpl::InsertRule(const nsAString& aRule,
       nameSpaceRule->GetPrefix(*getter_AddRefs(prefix));
       nameSpaceRule->GetURLSpec(urlSpec);
       mInner->mNameSpace->CreateChildNameSpace(prefix, urlSpec,
-                                               *getter_AddRefs(newNameSpace));
+                                               getter_AddRefs(newNameSpace));
       if (newNameSpace) {
         mInner->mNameSpace = newNameSpace;
       }
@@ -3151,11 +3155,11 @@ RuleProcessorData::RuleProcessorData(nsIPresContext* aPresContext,
     mContent = aContent;
 
     // get the namespace
-    aContent->GetNameSpaceID(mNameSpaceID);
+    aContent->GetNameSpaceID(&mNameSpaceID);
 
     // get the tag and parent
-    aContent->GetTag(mContentTag);
-    aContent->GetParent(mParentContent);
+    aContent->GetTag(&mContentTag);
+    aContent->GetParent(&mParentContent);
 
     // get the event state
     nsIEventStateManager* eventStateManager = nsnull;
@@ -3168,7 +3172,7 @@ RuleProcessorData::RuleProcessorData(nsIPresContext* aPresContext,
     // get the styledcontent interface and the ID
     if (NS_SUCCEEDED(aContent->QueryInterface(NS_GET_IID(nsIStyledContent), (void**)&mStyledContent))) {
       NS_ASSERTION(mStyledContent, "Succeeded but returned null");
-      mStyledContent->GetID(mContentID);
+      mStyledContent->GetID(&mContentID);
     }
 
     // see if there are attributes for the content
@@ -3255,9 +3259,10 @@ const nsString* RuleProcessorData::GetLang(void)
           break;
         }
       }
-      nsIContent *parent;
-      content->GetParent(parent);
-      content = dont_AddRef(parent);
+
+      nsCOMPtr<nsIContent> parent;
+      content->GetParent(getter_AddRefs(parent));
+      content = parent;
     }
   }
   return mLanguage;
@@ -3339,14 +3344,14 @@ inline PRBool IsQuirkEventSensitive(nsIAtom *aContentTag)
 
 static PRBool IsSignificantChild(nsIContent* aChild, PRBool aAcceptNonWhitespaceText)
 {
-  nsIAtom* tag;
-  aChild->GetTag(tag); // skip text & comments
+  nsCOMPtr<nsIAtom> tag;
+  aChild->GetTag(getter_AddRefs(tag)); // skip text & comments
   if ((tag != nsLayoutAtoms::textTagName) && 
       (tag != nsLayoutAtoms::commentTagName) &&
       (tag != nsLayoutAtoms::processingInstructionTagName)) {
-    NS_IF_RELEASE(tag);
     return PR_TRUE;
   }
+
   if (aAcceptNonWhitespaceText) {
     if (tag == nsLayoutAtoms::textTagName) {  // skip only whitespace text
       nsITextContent* text = nsnull;
@@ -3355,13 +3360,12 @@ static PRBool IsSignificantChild(nsIContent* aChild, PRBool aAcceptNonWhitespace
         text->IsOnlyWhitespace(&isWhite);
         NS_RELEASE(text);
         if (! isWhite) {
-          NS_RELEASE(tag);
           return PR_TRUE;
         }
       }
     }
   }
-  NS_IF_RELEASE(tag);
+
   return PR_FALSE;
 }
 
@@ -3446,17 +3450,16 @@ static PRBool SelectorMatches(RuleProcessorData &data,
     while (result && (nsnull != pseudoClass)) {
       if ((nsCSSPseudoClasses::firstChild == pseudoClass->mAtom) ||
           (nsCSSPseudoClasses::firstNode == pseudoClass->mAtom) ) {
-        nsIContent* firstChild = nsnull;
-        nsIContent* parent = data.mParentContent;
+        nsCOMPtr<nsIContent> firstChild;
+        nsCOMPtr<nsIContent> parent = data.mParentContent;
         if (parent) {
           PRInt32 index = -1;
           do {
-            parent->ChildAt(++index, firstChild);
+            parent->ChildAt(++index, getter_AddRefs(firstChild));
             if (firstChild) { // stop at first non-comment and non-whitespace node (and non-text node for firstChild)
               if (IsSignificantChild(firstChild, (nsCSSPseudoClasses::firstNode == pseudoClass->mAtom))) {
                 break;
               }
-              NS_RELEASE(firstChild);
             }
             else {
               break;
@@ -3464,22 +3467,20 @@ static PRBool SelectorMatches(RuleProcessorData &data,
           } while (1 == 1);
         }
         result = PRBool(localTrue == (data.mContent == firstChild));
-        NS_IF_RELEASE(firstChild);
       }
       else if ((nsCSSPseudoClasses::lastChild == pseudoClass->mAtom) ||
                (nsCSSPseudoClasses::lastNode == pseudoClass->mAtom)) {
-        nsIContent* lastChild = nsnull;
-        nsIContent* parent = data.mParentContent;
+        nsCOMPtr<nsIContent> lastChild;
+        nsCOMPtr<nsIContent> parent = data.mParentContent;
         if (parent) {
           PRInt32 index;
           parent->ChildCount(index);
           do {
-            parent->ChildAt(--index, lastChild);
+            parent->ChildAt(--index, getter_AddRefs(lastChild));
             if (lastChild) { // stop at first non-comment and non-whitespace node (and non-text node for lastChild)
               if (IsSignificantChild(lastChild, (nsCSSPseudoClasses::lastNode == pseudoClass->mAtom))) {
                 break;
               }
-              NS_RELEASE(lastChild);
             }
             else {
               break;
@@ -3487,26 +3488,23 @@ static PRBool SelectorMatches(RuleProcessorData &data,
           } while (1 == 1);
         }
         result = PRBool(localTrue == (data.mContent == lastChild));
-        NS_IF_RELEASE(lastChild);
       }
       else if (nsCSSPseudoClasses::empty == pseudoClass->mAtom) {
-        nsIContent* child = nsnull;
-        nsIContent* element = data.mContent;
+        nsCOMPtr<nsIContent> child;
+        nsCOMPtr<nsIContent> element = data.mContent;
         PRInt32 index = -1;
         do {
-          element->ChildAt(++index, child);
+          element->ChildAt(++index, getter_AddRefs(child));
           if (child) { // stop at first non-comment and non-whitespace node
             if (IsSignificantChild(child, PR_TRUE)) {
               break;
             }
-            NS_RELEASE(child);
           }
           else {
             break;
           }
         } while (1 == 1);
         result = PRBool(localTrue == (child == nsnull));
-        NS_IF_RELEASE(child);
       }
       else if (nsCSSPseudoClasses::root == pseudoClass->mAtom) {
         if (data.mParentContent) {
@@ -3535,7 +3533,7 @@ static PRBool SelectorMatches(RuleProcessorData &data,
           }
           else {
             nsCOMPtr<nsIDocument> doc;
-            data.mContent->GetDocument(*getter_AddRefs(doc));
+            data.mContent->GetDocument(getter_AddRefs(doc));
             if (doc) {
               // Try to get the language from the HTTP header or if this
               // is missing as well from the preferences.
@@ -3798,18 +3796,17 @@ static PRBool SelectorMatchesTree(RuleProcessorData &data,
       if (PRUnichar('+') == selector->mOperator) {
         newdata = curdata->mPreviousSiblingData;
         if (!newdata) {
-          nsIContent* parent;
+          nsCOMPtr<nsIContent> parent;
           PRInt32 index;
-          lastContent->GetParent(parent);
+          lastContent->GetParent(getter_AddRefs(parent));
           if (parent) {
             parent->IndexOf(lastContent, index);
             while (0 <= --index) {  // skip text & comment nodes
-              parent->ChildAt(index, content);
-              nsIAtom* tag;
-              content->GetTag(tag);
+              parent->ChildAt(index, &content);
+              nsCOMPtr<nsIAtom> tag;
+              content->GetTag(getter_AddRefs(tag));
               if ((tag != nsLayoutAtoms::textTagName) && 
                   (tag != nsLayoutAtoms::commentTagName)) {
-                NS_IF_RELEASE(tag);
                 newdata =
                     new (curdata->mPresContext) RuleProcessorData(curdata->mPresContext, content,
                                                                     curdata->mRuleWalker, &compat);
@@ -3817,9 +3814,7 @@ static PRBool SelectorMatchesTree(RuleProcessorData &data,
                 break;
               }
               NS_RELEASE(content);
-              NS_IF_RELEASE(tag);
             }
-            NS_RELEASE(parent);
           }
         } else {
           content = newdata->mContent;
@@ -3831,7 +3826,7 @@ static PRBool SelectorMatchesTree(RuleProcessorData &data,
       else {
         newdata = curdata->mParentData;
         if (!newdata) {
-          lastContent->GetParent(content);
+          lastContent->GetParent(&content);
           if (content) {
             newdata = new (curdata->mPresContext) RuleProcessorData(curdata->mPresContext, content,
                                                                       curdata->mRuleWalker, &compat);
diff --git a/layout/style/nsComputedDOMStyle.cpp b/layout/style/nsComputedDOMStyle.cpp
index 230bd9685997..c4708d402eda 100644
--- a/layout/style/nsComputedDOMStyle.cpp
+++ b/layout/style/nsComputedDOMStyle.cpp
@@ -2974,7 +2974,7 @@ nsComputedDOMStyle::FlushPendingReflows()
 {
   // Flush all pending notifications so that our frames are up to date
   nsCOMPtr<nsIDocument> document;
-  mContent->GetDocument(*getter_AddRefs(document));
+  mContent->GetDocument(getter_AddRefs(document));
   if (document) {
     document->FlushPendingNotifications();
   }
diff --git a/layout/style/nsDOMCSSAttrDeclaration.cpp b/layout/style/nsDOMCSSAttrDeclaration.cpp
index 225e4fafa5e2..5d0e37a2ea05 100644
--- a/layout/style/nsDOMCSSAttrDeclaration.cpp
+++ b/layout/style/nsDOMCSSAttrDeclaration.cpp
@@ -181,18 +181,18 @@ nsDOMCSSAttributeDeclaration::GetCSSParsingEnvironment(nsIContent* aContent,
   *aCSSParser = nsnull;
   
   nsCOMPtr<nsINodeInfo> nodeInfo;
-  nsresult result = aContent->GetNodeInfo(*getter_AddRefs(nodeInfo));
+  nsresult result = aContent->GetNodeInfo(getter_AddRefs(nodeInfo));
   if (NS_FAILED(result)) {
     return result;
   }
   nsCOMPtr<nsIDocument> doc;
-  result = nodeInfo->GetDocument(*getter_AddRefs(doc));
+  result = nodeInfo->GetDocument(getter_AddRefs(doc));
   if (NS_FAILED(result)) {
     return result;
   }
   
   if (doc) {
-    doc->GetBaseURL(*aBaseURI);
+    doc->GetBaseURL(aBaseURI);
     nsCOMPtr<nsIHTMLContentContainer> htmlContainer(do_QueryInterface(doc));
     if (htmlContainer) {
       htmlContainer->GetCSSLoader(*aCSSLoader);
diff --git a/layout/style/nsInspectorCSSUtils.cpp b/layout/style/nsInspectorCSSUtils.cpp
index 4ecb91a0a4c7..9d4a2e01ecae 100644
--- a/layout/style/nsInspectorCSSUtils.cpp
+++ b/layout/style/nsInspectorCSSUtils.cpp
@@ -151,7 +151,7 @@ nsInspectorCSSUtils::GetStyleContextForContent(nsIContent* aContent,
     // No frame has been created, so resolve the style ourselves
     nsRefPtr<nsStyleContext> parentContext;
     nsCOMPtr<nsIContent> parent;
-    aContent->GetParent(*getter_AddRefs(parent));
+    aContent->GetParent(getter_AddRefs(parent));
     if (parent)
         parentContext = GetStyleContextForContent(parent, aPresShell);
 
@@ -173,7 +173,7 @@ nsInspectorCSSUtils::GetRuleNodeForContent(nsIContent* aContent,
     *aRuleNode = nsnull;
 
     nsCOMPtr<nsIDocument> doc;
-    aContent->GetDocument(*getter_AddRefs(doc));
+    aContent->GetDocument(getter_AddRefs(doc));
     NS_ENSURE_TRUE(doc, NS_ERROR_UNEXPECTED);
 
     nsCOMPtr<nsIPresShell> presShell;
diff --git a/layout/style/nsStyleUtil.cpp b/layout/style/nsStyleUtil.cpp
index 94b25514a808..072173ea1b9b 100644
--- a/layout/style/nsStyleUtil.cpp
+++ b/layout/style/nsStyleUtil.cpp
@@ -655,13 +655,13 @@ PRBool nsStyleUtil::IsSimpleXlink(nsIContent *aContent, nsIPresContext *aPresCon
           // XXX why do this? will nsIHTMLContent's
           // GetBaseURL() may return something different
           // than the URL of the document it lives in?
-          htmlContent->GetBaseURL(*getter_AddRefs(baseURI));
+          htmlContent->GetBaseURL(getter_AddRefs(baseURI));
         }
         else {
           nsCOMPtr<nsIDocument> doc;
-          aContent->GetDocument(*getter_AddRefs(doc));
+          aContent->GetDocument(getter_AddRefs(doc));
           if (doc) {
-            doc->GetBaseURL(*getter_AddRefs(baseURI));
+            doc->GetBaseURL(getter_AddRefs(baseURI));
           }
         }
 
diff --git a/layout/xul/base/src/nsBox.cpp b/layout/xul/base/src/nsBox.cpp
index 4b50a70a19d2..edab94feefb7 100644
--- a/layout/xul/base/src/nsBox.cpp
+++ b/layout/xul/base/src/nsBox.cpp
@@ -674,7 +674,7 @@ nsBox::GetBorder(nsMargin& aMargin)
     frame->GetContent(getter_AddRefs(content));
     if (content) {
       nsCOMPtr<nsIDocument> doc;
-      content->GetDocument(*getter_AddRefs(doc));    
+      content->GetDocument(getter_AddRefs(doc));
       if (doc) {
         nsCOMPtr<nsIPresShell> shell;
         doc->GetShellAt(0, getter_AddRefs(shell));
diff --git a/layout/xul/base/src/nsBoxFrame.cpp b/layout/xul/base/src/nsBoxFrame.cpp
index 6e77c1abd642..7c83c008b248 100644
--- a/layout/xul/base/src/nsBoxFrame.cpp
+++ b/layout/xul/base/src/nsBoxFrame.cpp
@@ -2616,7 +2616,7 @@ nsBoxFrame::RegUnregAccessKey(nsIPresContext* aPresContext, PRBool aDoReg)
 
   // find out what type of element this is
   nsCOMPtr<nsIAtom> atom;
-  nsresult rv = mContent->GetTag(*getter_AddRefs(atom));
+  nsresult rv = mContent->GetTag(getter_AddRefs(atom));
   if (NS_FAILED(rv))
     return rv;
 
diff --git a/layout/xul/base/src/nsBoxObject.cpp b/layout/xul/base/src/nsBoxObject.cpp
index fcb8a2ace424..c4de84059d1a 100644
--- a/layout/xul/base/src/nsBoxObject.cpp
+++ b/layout/xul/base/src/nsBoxObject.cpp
@@ -180,7 +180,7 @@ nsBoxObject::GetOffsetRect(nsRect& aRect)
   aRect.Empty();
  
   nsCOMPtr<nsIDocument> doc;
-  mContent->GetDocument(*getter_AddRefs(doc));
+  mContent->GetDocument(getter_AddRefs(doc));
 
   if (doc) {
     // Get Presentation shell 0
@@ -285,7 +285,7 @@ nsBoxObject::GetScreenRect(nsRect& aRect)
   aRect.Empty();
  
   nsCOMPtr<nsIDocument> doc;
-  mContent->GetDocument(*getter_AddRefs(doc));
+  mContent->GetDocument(getter_AddRefs(doc));
 
   if (doc) {
     // Get Presentation shell 0
diff --git a/layout/xul/base/src/nsDocElementBoxFrame.cpp b/layout/xul/base/src/nsDocElementBoxFrame.cpp
index a66ba9055199..75ea1bdde84c 100644
--- a/layout/xul/base/src/nsDocElementBoxFrame.cpp
+++ b/layout/xul/base/src/nsDocElementBoxFrame.cpp
@@ -125,25 +125,29 @@ nsDocElementBoxFrame::CreateAnonymousContent(nsIPresContext* aPresContext,
 
   nsCOMPtr<nsINodeInfoManager> nodeInfoManager;
   nsCOMPtr<nsIDocument> doc;
-  mContent->GetDocument(*getter_AddRefs(doc));
+  mContent->GetDocument(getter_AddRefs(doc));
   if (!doc)
     // The page is currently being torn down.  Why bother.
     return NS_ERROR_FAILURE;
-  doc->GetNodeInfoManager(*getter_AddRefs(nodeInfoManager));
+  doc->GetNodeInfoManager(getter_AddRefs(nodeInfoManager));
   NS_ENSURE_TRUE(nodeInfoManager, NS_ERROR_FAILURE);
 
   // create the top-secret popupgroup node. shhhhh!
   nsCOMPtr<nsINodeInfo> nodeInfo;
-  nodeInfoManager->GetNodeInfo(NS_LITERAL_STRING("popupgroup"), NS_LITERAL_STRING(""), NS_LITERAL_STRING("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"),
-    *getter_AddRefs(nodeInfo));
+  nodeInfoManager->GetNodeInfo(NS_LITERAL_STRING("popupgroup"),
+                               NS_LITERAL_STRING(""),
+                               NS_LITERAL_STRING("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"),
+                               getter_AddRefs(nodeInfo));
 
   nsCOMPtr<nsIContent> content;
   elementFactory->CreateInstanceByTag(nodeInfo, getter_AddRefs(content));
   aAnonymousItems.AppendElement(content);
 
   // create the top-secret default tooltip node. shhhhh!
-  nodeInfoManager->GetNodeInfo(NS_LITERAL_STRING("tooltip"), NS_LITERAL_STRING(""), NS_LITERAL_STRING("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"),
-    *getter_AddRefs(nodeInfo));
+  nodeInfoManager->GetNodeInfo(NS_LITERAL_STRING("tooltip"),
+                               NS_LITERAL_STRING(""),
+                               NS_LITERAL_STRING("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"),
+                               getter_AddRefs(nodeInfo));
   elementFactory->CreateInstanceByTag(nodeInfo, getter_AddRefs(content));
   content->SetAttr(nsnull, nsXULAtoms::defaultz, NS_LITERAL_STRING("true"), PR_FALSE);
   aAnonymousItems.AppendElement(content);
diff --git a/layout/xul/base/src/nsFrameNavigator.cpp b/layout/xul/base/src/nsFrameNavigator.cpp
index 5b3b707f4f24..1c3a69822fe3 100644
--- a/layout/xul/base/src/nsFrameNavigator.cpp
+++ b/layout/xul/base/src/nsFrameNavigator.cpp
@@ -56,7 +56,7 @@ nsFrameNavigator::GetTag(nsIBox* aBox, nsCOMPtr<nsIAtom>& aAtom)
    nsCOMPtr<nsIContent> content;
    frame->GetContent(getter_AddRefs(content));
    if (content) {
-     content->GetTag(*getter_AddRefs(aAtom));
+     content->GetTag(getter_AddRefs(aAtom));
      return; 
    }
 
diff --git a/layout/xul/base/src/nsImageBoxFrame.cpp b/layout/xul/base/src/nsImageBoxFrame.cpp
index 38139fa673b6..e9a7ddb7b8bf 100644
--- a/layout/xul/base/src/nsImageBoxFrame.cpp
+++ b/layout/xul/base/src/nsImageBoxFrame.cpp
@@ -475,7 +475,7 @@ nsImageBoxFrame::UpdateImage(nsIPresContext*  aPresContext, PRBool& aResize)
   nsCOMPtr<nsIURI> documentURI;
   nsCOMPtr<nsIDocument> doc;
   if (mContent) {
-    (void) mContent->GetDocument(*getter_AddRefs(doc));
+    (void) mContent->GetDocument(getter_AddRefs(doc));
     if (doc) {
       doc->GetDocumentURL(getter_AddRefs(documentURI));
     }
@@ -717,13 +717,13 @@ nsImageBoxFrame::GetBaseURI(nsIURI **uri)
   nsCOMPtr<nsIURI> baseURI;
   nsCOMPtr<nsIHTMLContent> htmlContent(do_QueryInterface(mContent, &rv));
   if (NS_SUCCEEDED(rv)) {
-    htmlContent->GetBaseURL(*getter_AddRefs(baseURI));
+    htmlContent->GetBaseURL(getter_AddRefs(baseURI));
   }
   else {
     nsCOMPtr<nsIDocument> doc;
-    mContent->GetDocument(*getter_AddRefs(doc));
+    mContent->GetDocument(getter_AddRefs(doc));
     if (doc) {
-      doc->GetBaseURL(*getter_AddRefs(baseURI));
+      doc->GetBaseURL(getter_AddRefs(baseURI));
     }
   }
   *uri = baseURI;
diff --git a/layout/xul/base/src/nsListBoxBodyFrame.cpp b/layout/xul/base/src/nsListBoxBodyFrame.cpp
index 6a58ef994f73..e3f390111925 100644
--- a/layout/xul/base/src/nsListBoxBodyFrame.cpp
+++ b/layout/xul/base/src/nsListBoxBodyFrame.cpp
@@ -600,10 +600,10 @@ nsListBoxBodyFrame::GetIndexOfItem(nsIDOMElement* aItem, PRInt32* _retval)
 
   for (PRInt32 childIndex = 0; childIndex < childCount; childIndex++) {
     nsCOMPtr<nsIContent> child;
-    listbox->ChildAt(childIndex, *getter_AddRefs(child));
+    listbox->ChildAt(childIndex, getter_AddRefs(child));
     
     nsCOMPtr<nsIAtom> childTag;
-    child->GetTag(*getter_AddRefs(childTag));
+    child->GetTag(getter_AddRefs(childTag));
 
     // we hit a treerow, count it
     if (childTag == nsXULAtoms::listitem) {
@@ -634,10 +634,10 @@ nsListBoxBodyFrame::GetItemAtIndex(PRInt32 aIndex, nsIDOMElement** _retval)
   PRInt32 itemCount = 0;
   for (PRInt32 childIndex = 0; childIndex < childCount; childIndex++) {
     nsCOMPtr<nsIContent> child;
-    listbox->ChildAt(childIndex, *getter_AddRefs(child));
+    listbox->ChildAt(childIndex, getter_AddRefs(child));
     
     nsCOMPtr<nsIAtom> childTag;
-    child->GetTag(*getter_AddRefs(childTag));
+    child->GetTag(getter_AddRefs(childTag));
 
     // we hit a treerow, count it
     if (childTag == nsXULAtoms::listitem) {
@@ -771,10 +771,10 @@ nsListBoxBodyFrame::ComputeIntrinsicWidth(nsBoxLayoutState& aBoxLayoutState)
 
     nsCOMPtr<nsIContent> child;
     for (PRInt32 i = 0; i < childCount && i < 100; ++i) {
-      listbox->ChildAt(i, *getter_AddRefs(child));
+      listbox->ChildAt(i, getter_AddRefs(child));
 
       nsCOMPtr<nsIAtom> tag;
-      child->GetTag(*getter_AddRefs(tag));
+      child->GetTag(getter_AddRefs(tag));
       if (tag == nsXULAtoms::listitem) {
         nsIPresContext* presContext = aBoxLayoutState.GetPresContext();
         nsIRenderingContext* rendContext = aBoxLayoutState.GetReflowState()->rendContext;
@@ -784,7 +784,7 @@ nsListBoxBodyFrame::ComputeIntrinsicWidth(nsBoxLayoutState& aBoxLayoutState)
           PRInt32 textCount;
           child->ChildCount(textCount);
           for (PRInt32 j = 0; j < textCount; ++j) {
-            child->ChildAt(j, *getter_AddRefs(textChild));
+            child->ChildAt(j, getter_AddRefs(textChild));
             nsCOMPtr<nsIDOMText> text(do_QueryInterface(textChild));
             if (text) {
               nsAutoString data;
@@ -825,9 +825,9 @@ nsListBoxBodyFrame::ComputeTotalRowCount()
   mRowCount = 0;
   for (PRInt32 i = 0; i < childCount; i++) {
     nsCOMPtr<nsIContent> childContent;
-    listbox->ChildAt(i, *getter_AddRefs(childContent));
+    listbox->ChildAt(i, getter_AddRefs(childContent));
     nsCOMPtr<nsIAtom> tag;
-    childContent->GetTag(*getter_AddRefs(tag));
+    childContent->GetTag(getter_AddRefs(tag));
     if (tag == nsXULAtoms::listitem)
       ++mRowCount;
   }
@@ -870,7 +870,7 @@ nsListBoxBodyFrame::DoScrollToIndex(PRInt32 aRowIndex, PRBool aForceDestruct)
   // This change has to happen immediately.
   // Flush any pending reflow commands.
   nsCOMPtr<nsIDocument> doc;
-  mContent->GetDocument(*getter_AddRefs(doc));
+  mContent->GetDocument(getter_AddRefs(doc));
   doc->FlushPendingNotifications();
 
   return NS_OK;
@@ -1161,13 +1161,14 @@ nsListBoxBodyFrame::GetFirstItemBox(PRInt32 aOffset, PRBool* aCreated)
     nsCOMPtr<nsIContent> topContent;
     mTopFrame->GetContent(getter_AddRefs(topContent));
     nsCOMPtr<nsIContent> topParent;
-    topContent->GetParent(*getter_AddRefs(topParent));
+    topContent->GetParent(getter_AddRefs(topParent));
     PRInt32 contentIndex;
     topParent->IndexOf(topContent, contentIndex);
     contentIndex -= aOffset;
     if (contentIndex < 0)
       return nsnull;
-    topParent->ChildAt(contentIndex-mRowsToPrepend, *getter_AddRefs(startContent));
+    topParent->ChildAt(contentIndex - mRowsToPrepend,
+                       getter_AddRefs(startContent));
   } else {
     // This will be the first item frame we create.  Use the content
     // at the current index, which is the first index scrolled into view
@@ -1219,13 +1220,13 @@ nsListBoxBodyFrame::GetNextItemBox(nsIBox* aBox, PRInt32 aOffset, PRBool* aCreat
     nsCOMPtr<nsIContent> prevContent;
     frame->GetContent(getter_AddRefs(prevContent));
     nsCOMPtr<nsIContent> parentContent;
-    prevContent->GetParent(*getter_AddRefs(parentContent));
+    prevContent->GetParent(getter_AddRefs(parentContent));
     parentContent->IndexOf(prevContent, i);
     parentContent->ChildCount(childCount);
     if (i+aOffset+1 < childCount) {
       // There is a content node that wants a frame.
       nsCOMPtr<nsIContent> nextContent;
-      parentContent->ChildAt(i+aOffset+1, *getter_AddRefs(nextContent));
+      parentContent->ChildAt(i + aOffset + 1, getter_AddRefs(nextContent));
 
       // Either append the new frame, or insert it after the current frame
       PRBool isAppend = result != mLinkupFrame && mRowsToPrepend <= 0;
@@ -1371,7 +1372,7 @@ nsListBoxBodyFrame::OnContentRemoved(nsIPresContext* aPresContext, nsIFrame* aCh
     nsCOMPtr<nsIContent> listboxContent;
     mContent->GetBindingParent(getter_AddRefs(listboxContent));
     nsCOMPtr<nsIContent> oldNextSiblingContent;
-    listboxContent->ChildAt(aIndex, *getter_AddRefs(oldNextSiblingContent));
+    listboxContent->ChildAt(aIndex, getter_AddRefs(oldNextSiblingContent));
     PRInt32 siblingIndex = -1;
     if (oldNextSiblingContent) {
       nsCOMPtr<nsIContent> nextSiblingContent;
@@ -1400,7 +1401,7 @@ nsListBoxBodyFrame::OnContentRemoved(nsIPresContext* aPresContext, nsIFrame* aCh
     listBoxContent->ChildCount(childCount);
     if (childCount > 0) {
       nsCOMPtr<nsIContent> lastChild;
-      listBoxContent->ChildAt(childCount-1, *getter_AddRefs(lastChild));
+      listBoxContent->ChildAt(childCount - 1, getter_AddRefs(lastChild));
       nsCOMPtr<nsIPresShell> shell;
       aPresContext->GetShell(getter_AddRefs(shell));
       nsIFrame* lastChildFrame = nsnull;
@@ -1446,9 +1447,9 @@ nsListBoxBodyFrame::GetListItemContentAt(PRInt32 aIndex, nsIContent** aContent)
   PRInt32 itemsFound = 0;
   for (PRInt32 i = 0; i < childCount; ++i) {
     nsCOMPtr<nsIContent> kid;
-    listboxContent->ChildAt(i, *getter_AddRefs(kid));
+    listboxContent->ChildAt(i, getter_AddRefs(kid));
     nsCOMPtr<nsIAtom> tag;
-    kid->GetTag(*getter_AddRefs(tag));
+    kid->GetTag(getter_AddRefs(tag));
     if (tag.get() == nsXULAtoms::listitem) {
       ++itemsFound;
       if (itemsFound-1 == aIndex) {
@@ -1474,9 +1475,9 @@ nsListBoxBodyFrame::GetListItemNextSibling(nsIContent* aListItem, nsIContent** a
   nsCOMPtr<nsIContent> prevKid;
   for (PRInt32 i = 0; i < childCount; ++i) {
     nsCOMPtr<nsIContent> kid;
-    listboxContent->ChildAt(i, *getter_AddRefs(kid));
+    listboxContent->ChildAt(i, getter_AddRefs(kid));
     nsCOMPtr<nsIAtom> tag;
-    kid->GetTag(*getter_AddRefs(tag));
+    kid->GetTag(getter_AddRefs(tag));
     if (tag.get() == nsXULAtoms::listitem) {
       ++aSiblingIndex;
       if (prevKid.get() == aListItem) {
diff --git a/layout/xul/base/src/nsListBoxObject.cpp b/layout/xul/base/src/nsListBoxObject.cpp
index 221ef5ed9972..de35fdc4bbb5 100644
--- a/layout/xul/base/src/nsListBoxObject.cpp
+++ b/layout/xul/base/src/nsListBoxObject.cpp
@@ -180,14 +180,14 @@ static void
 FindBodyContent(nsIContent* aParent, nsIContent** aResult)
 {
   nsCOMPtr<nsIAtom> tag;
-  aParent->GetTag(*getter_AddRefs(tag));
+  aParent->GetTag(getter_AddRefs(tag));
   if (tag.get() == nsXULAtoms::listboxbody) {
     *aResult = aParent;
     NS_IF_ADDREF(*aResult);
   }
   else {
     nsCOMPtr<nsIDocument> doc;
-    aParent->GetDocument(*getter_AddRefs(doc));
+    aParent->GetDocument(getter_AddRefs(doc));
     nsCOMPtr<nsIBindingManager> bindingManager;
     doc->GetBindingManager(getter_AddRefs(bindingManager));
     nsCOMPtr<nsIDOMNodeList> kids;
diff --git a/layout/xul/base/src/nsMenuBarFrame.cpp b/layout/xul/base/src/nsMenuBarFrame.cpp
index a1ccd6cf3ba4..031125a491ec 100644
--- a/layout/xul/base/src/nsMenuBarFrame.cpp
+++ b/layout/xul/base/src/nsMenuBarFrame.cpp
@@ -154,7 +154,7 @@ nsMenuBarFrame::Init(nsIPresContext*  aPresContext,
   // Hook up the menu bar as a key listener on the whole document.  It will see every
   // key press that occurs, but after everyone else does.
   nsCOMPtr<nsIDocument> doc;
-  aContent->GetDocument(*getter_AddRefs(doc));
+  aContent->GetDocument(getter_AddRefs(doc));
   nsCOMPtr<nsIDOMEventReceiver> target = do_QueryInterface(doc);
   
   mTarget = target;
@@ -797,7 +797,7 @@ PRBool
 nsMenuBarFrame::IsValidItem(nsIContent* aContent)
 {
   nsCOMPtr<nsIAtom> tag;
-  aContent->GetTag(*getter_AddRefs(tag));
+  aContent->GetTag(getter_AddRefs(tag));
   if (tag && (tag.get() == nsXULAtoms::menu ||
               tag.get() == nsXULAtoms::menuitem) &&
       !IsDisabled(aContent))
diff --git a/layout/xul/base/src/nsMenuFrame.cpp b/layout/xul/base/src/nsMenuFrame.cpp
index 81b2f68b026e..a83da1c2767e 100644
--- a/layout/xul/base/src/nsMenuFrame.cpp
+++ b/layout/xul/base/src/nsMenuFrame.cpp
@@ -948,7 +948,7 @@ nsMenuFrame::GetMenuChildrenElement(nsIContent** aResult)
 
   for (PRInt32 i = 0; i < count; i++) {
     nsCOMPtr<nsIContent> child;
-    mContent->ChildAt(i, *getter_AddRefs(child));
+    mContent->ChildAt(i, getter_AddRefs(child));
     nsCOMPtr<nsIAtom> tag;
     xblService->ResolveTag(child, &dummy, getter_AddRefs(tag));
     if (tag && tag.get() == nsXULAtoms::menupopup) {
@@ -963,7 +963,7 @@ PRBool
 nsMenuFrame::IsSizedToPopup(nsIContent* aContent, PRBool aRequireAlways)
 {
   nsCOMPtr<nsIAtom> tag;
-  aContent->GetTag(*getter_AddRefs(tag));
+  aContent->GetTag(getter_AddRefs(tag));
   PRBool sizeToPopup;
   if (tag == nsHTMLAtoms::select)
     sizeToPopup = PR_TRUE;
@@ -1518,7 +1518,7 @@ nsMenuFrame::BuildAcceleratorText()
     return;
 
   nsCOMPtr<nsIDocument> document;
-  mContent->GetDocument(*getter_AddRefs(document));
+  mContent->GetDocument(getter_AddRefs(document));
 
   // Turn the document into a DOM document so we can use getElementById
   nsCOMPtr<nsIDOMDocument> domDocument(do_QueryInterface(document));
@@ -1716,7 +1716,7 @@ nsMenuFrame::Execute(nsGUIEvent *aEvent)
   // XXX HACK. Just gracefully exit if the node has been removed, e.g., window.close()
   // was executed.
   nsCOMPtr<nsIDocument> doc;
-  content->GetDocument(*getter_AddRefs(doc));
+  content->GetDocument(getter_AddRefs(doc));
 
   nsIFrame* primary = nsnull;
   if (shell) shell->GetPrimaryFrameFor(content, &primary);
@@ -1770,16 +1770,16 @@ nsMenuFrame::OnCreate()
   // potentially be updated.
   if (child) {
     nsCOMPtr<nsIDocument> doc;
-    child->GetDocument(*getter_AddRefs(doc));
+    child->GetDocument(getter_AddRefs(doc));
     nsCOMPtr<nsIDOMDocument> domDoc(do_QueryInterface(doc));
 
     PRInt32 count;
     child->ChildCount(count);
     for (PRInt32 i = 0; i < count; i++) {
       nsCOMPtr<nsIContent> grandChild;
-      child->ChildAt(i, *getter_AddRefs(grandChild));
+      child->ChildAt(i, getter_AddRefs(grandChild));
       nsCOMPtr<nsIAtom> tag;
-      grandChild->GetTag(*getter_AddRefs(tag));
+      grandChild->GetTag(getter_AddRefs(tag));
       if (tag.get() == nsXULAtoms::menuitem) {
         // See if we have a command attribute.
         nsAutoString command;
diff --git a/layout/xul/base/src/nsMenuPopupFrame.cpp b/layout/xul/base/src/nsMenuPopupFrame.cpp
index eaac0523ceb3..cf36154c629e 100644
--- a/layout/xul/base/src/nsMenuPopupFrame.cpp
+++ b/layout/xul/base/src/nsMenuPopupFrame.cpp
@@ -224,10 +224,10 @@ nsMenuPopupFrame::Init(nsIPresContext*  aPresContext,
   widgetData.clipSiblings = PR_TRUE;
 
   nsCOMPtr<nsIContent> parentContent;
-  aContent->GetParent(*getter_AddRefs(parentContent));
+  aContent->GetParent(getter_AddRefs(parentContent));
   nsCOMPtr<nsIAtom> tag;
   if (parentContent)
-    parentContent->GetTag(*getter_AddRefs(tag));
+    parentContent->GetTag(getter_AddRefs(tag));
   widgetData.mDropShadow = !(tag && tag == nsXULAtoms::menulist);
   
   // XXX make sure we are hidden (shouldn't this be done automatically?)
@@ -622,7 +622,7 @@ nsMenuPopupFrame::AdjustClientXYForNestedDocuments ( nsIDOMXULDocument* inPopupD
   // nsXULPopupListener).
 
   nsCOMPtr<nsIAtom> tag;
-  mContent->GetTag(*getter_AddRefs(tag));
+  mContent->GetTag(getter_AddRefs(tag));
   nsCOMPtr<nsIDOMNode> targetNode;
   if (tag == nsXULAtoms::tooltip)
     inPopupDoc->GetTooltipNode(getter_AddRefs(targetNode));
@@ -634,7 +634,7 @@ nsMenuPopupFrame::AdjustClientXYForNestedDocuments ( nsIDOMXULDocument* inPopupD
   nsCOMPtr<nsIWidget> targetDocumentWidget;
   if ( targetAsContent ) {
     nsCOMPtr<nsIDocument> targetDocument;
-    targetAsContent->GetDocument(*getter_AddRefs(targetDocument));
+    targetAsContent->GetDocument(getter_AddRefs(targetDocument));
     if (targetDocument) {
       nsCOMPtr<nsIPresShell> shell;
       targetDocument->GetShellAt(0, getter_AddRefs(shell));
@@ -981,7 +981,7 @@ nsMenuPopupFrame::SyncViewWithFrame(nsIPresContext* aPresContext,
   nsCOMPtr<nsIContent> parentContent;
   aFrame->GetContent(getter_AddRefs(parentContent));
   nsCOMPtr<nsIAtom> tag;
-  mContent->GetTag(*getter_AddRefs(tag));
+  mContent->GetTag(getter_AddRefs(tag));
   PRBool sizedToPopup = (tag != nsXULAtoms::tooltip)
                         && (nsMenuFrame::IsSizedToPopup(parentContent, PR_FALSE));
   
@@ -1459,11 +1459,11 @@ NS_IMETHODIMP nsMenuPopupFrame::ConsumeOutsideClicks(PRBool& aConsumeOutsideClic
   aConsumeOutsideClicks = PR_TRUE;
 
   nsCOMPtr<nsIContent> parentContent;
-  mContent->GetParent(*getter_AddRefs(parentContent));
+  mContent->GetParent(getter_AddRefs(parentContent));
 
   if (parentContent) {
     nsCOMPtr<nsIAtom> parentTag;
-    parentContent->GetTag(*getter_AddRefs(parentTag));
+    parentContent->GetTag(getter_AddRefs(parentTag));
     if (parentTag == nsXULAtoms::menulist)
       return NS_OK;  // Consume outside clicks for combo boxes on all platforms
     if (parentTag == nsXULAtoms::menu || parentTag == nsXULAtoms::popupset) {
@@ -1705,10 +1705,10 @@ nsMenuPopupFrame::FindMenuWithShortcut(nsIDOMKeyEvent* aKeyEvent, PRBool& doActi
   nsIMenuFrame* frameShortcut = nsnull;
 
   nsCOMPtr<nsIContent> parentContent;
-  mContent->GetParent(*getter_AddRefs(parentContent));
+  mContent->GetParent(getter_AddRefs(parentContent));
   if (parentContent) {
     nsCOMPtr<nsIAtom> tag;
-    parentContent->GetTag(*getter_AddRefs(tag));
+    parentContent->GetTag(getter_AddRefs(tag));
     if (tag != nsXULAtoms::menulist)
       isMenu = PR_TRUE;
   }
@@ -2092,7 +2092,7 @@ nsMenuPopupFrame::InstallKeyboardNavigator()
     return NS_OK;
 
   nsCOMPtr<nsIDocument> doc;
-  mContent->GetDocument(*getter_AddRefs(doc));
+  mContent->GetDocument(getter_AddRefs(doc));
   nsCOMPtr<nsIDOMEventReceiver> target = do_QueryInterface(doc);
   
   mTarget = target;
@@ -2127,7 +2127,7 @@ PRBool
 nsMenuPopupFrame::IsValidItem(nsIContent* aContent)
 {
   nsCOMPtr<nsIAtom> tag;
-  aContent->GetTag(*getter_AddRefs(tag));
+  aContent->GetTag(getter_AddRefs(tag));
   if (tag && (tag.get() == nsXULAtoms::menu ||
               tag.get() == nsXULAtoms::menuitem ||
               tag.get() == nsHTMLAtoms::option))
diff --git a/layout/xul/base/src/nsNativeScrollbarFrame.cpp b/layout/xul/base/src/nsNativeScrollbarFrame.cpp
index 8a8266afbfbf..5bf6785f2b1d 100644
--- a/layout/xul/base/src/nsNativeScrollbarFrame.cpp
+++ b/layout/xul/base/src/nsNativeScrollbarFrame.cpp
@@ -158,7 +158,7 @@ nsNativeScrollbarFrame::FindScrollbar(nsIFrame* start, nsIFrame** outFrame, nsIC
       start->GetContent(getter_AddRefs(currContent));
 
       nsCOMPtr<nsIAtom> atom;
-      if (currContent && currContent->GetTag(*getter_AddRefs(atom)) == NS_OK && atom.get() == nsXULAtoms::scrollbar) {
+      if (currContent && currContent->GetTag(getter_AddRefs(atom)) == NS_OK && atom.get() == nsXULAtoms::scrollbar) {
         *outContent = currContent.get();
         *outFrame = start;
         NS_IF_ADDREF(*outContent);
diff --git a/layout/xul/base/src/nsPopupSetFrame.cpp b/layout/xul/base/src/nsPopupSetFrame.cpp
index f7c9695440da..f80164713fac 100644
--- a/layout/xul/base/src/nsPopupSetFrame.cpp
+++ b/layout/xul/base/src/nsPopupSetFrame.cpp
@@ -416,7 +416,7 @@ nsPopupSetFrame::HidePopup(nsIFrame* aPopup)
     // If we are a context menu, and if we are attached to a menupopup, then hiding us
     // should also hide the parent menu popup.
     nsCOMPtr<nsIAtom> tag;
-    entry->mElementContent->GetTag(*getter_AddRefs(tag));
+    entry->mElementContent->GetTag(getter_AddRefs(tag));
     if (tag && tag.get() == nsXULAtoms::menupopup) {
       nsIFrame* popupFrame = nsnull;
       nsCOMPtr<nsIPresShell> presShell;
@@ -449,7 +449,7 @@ nsPopupSetFrame::DestroyPopup(nsIFrame* aPopup, PRBool aDestroyEntireChain)
       // If we are a context menu, and if we are attached to a menupopup, then destroying us
       // should also dismiss the parent menu popup.
       nsCOMPtr<nsIAtom> tag;
-      entry->mElementContent->GetTag(*getter_AddRefs(tag));
+      entry->mElementContent->GetTag(getter_AddRefs(tag));
       if (tag && tag.get() == nsXULAtoms::menupopup) {
         nsIFrame* popupFrame = nsnull;
         nsCOMPtr<nsIPresShell> presShell;
@@ -560,7 +560,7 @@ nsPopupSetFrame::ActivatePopup(nsPopupFrameList* aEntry, PRBool aActivateFlag)
       // processes the reflows before we get to call DestroyChain(). Processing the
       // reflow will cause the popup to show itself again. (bug 71219)
       nsCOMPtr<nsIDocument> doc;
-      aEntry->mPopupContent->GetDocument(*getter_AddRefs(doc));
+      aEntry->mPopupContent->GetDocument(getter_AddRefs(doc));
       if (doc)
         doc->FlushPendingNotifications();
          
@@ -616,16 +616,16 @@ nsPopupSetFrame::OnCreate(PRInt32 aX, PRInt32 aY, nsIContent* aPopupContent)
     // potentially be updated.
  
     nsCOMPtr<nsIDocument> doc;
-    aPopupContent->GetDocument(*getter_AddRefs(doc));
+    aPopupContent->GetDocument(getter_AddRefs(doc));
     nsCOMPtr<nsIDOMDocument> domDoc(do_QueryInterface(doc));
 
     PRInt32 count;
     aPopupContent->ChildCount(count);
     for (PRInt32 i = 0; i < count; i++) {
       nsCOMPtr<nsIContent> grandChild;
-      aPopupContent->ChildAt(i, *getter_AddRefs(grandChild));
+      aPopupContent->ChildAt(i, getter_AddRefs(grandChild));
       nsCOMPtr<nsIAtom> tag;
-      grandChild->GetTag(*getter_AddRefs(tag));
+      grandChild->GetTag(getter_AddRefs(tag));
       if (tag.get() == nsXULAtoms::menuitem) {
         // See if we have a command attribute.
         nsAutoString command;
diff --git a/layout/xul/base/src/nsScrollbarButtonFrame.cpp b/layout/xul/base/src/nsScrollbarButtonFrame.cpp
index 4ef3ce5220e0..ac350654b2f6 100644
--- a/layout/xul/base/src/nsScrollbarButtonFrame.cpp
+++ b/layout/xul/base/src/nsScrollbarButtonFrame.cpp
@@ -227,7 +227,7 @@ nsScrollbarButtonFrame::GetChildWithTag(nsIPresContext* aPresContext,
     if (child) {
       // see if it is the child
        nsCOMPtr<nsIAtom> tag;
-       child->GetTag(*getter_AddRefs(tag));
+       child->GetTag(getter_AddRefs(tag));
        if (atom == tag.get())
        {
          result = childFrame;
@@ -261,7 +261,7 @@ nsScrollbarButtonFrame::GetParentWithTag(nsIAtom* toFind, nsIFrame* start, nsIFr
         start->GetContent(getter_AddRefs(child));
 
         nsCOMPtr<nsIAtom> atom;
-        if (child && child->GetTag(*getter_AddRefs(atom)) == NS_OK && atom.get() == toFind) {
+        if (child && child->GetTag(getter_AddRefs(atom)) == NS_OK && atom.get() == toFind) {
            result = start;
            return NS_OK;
         }
diff --git a/layout/xul/base/src/nsSplitterFrame.cpp b/layout/xul/base/src/nsSplitterFrame.cpp
index bb47b921ff6f..adba2a200246 100644
--- a/layout/xul/base/src/nsSplitterFrame.cpp
+++ b/layout/xul/base/src/nsSplitterFrame.cpp
@@ -830,7 +830,7 @@ nsSplitterFrameInner::MouseDown(nsIDOMEvent* aMouseEvent)
       PRInt32 dummy;
       xblService->ResolveTag(content, &dummy, getter_AddRefs(atom));
     } else
-      content->GetTag(*getter_AddRefs(atom));
+      content->GetTag(getter_AddRefs(atom));
 
     // skip over any splitters
     if (atom.get() != nsXULAtoms::splitter) { 
diff --git a/layout/xul/base/src/nsXULTooltipListener.cpp b/layout/xul/base/src/nsXULTooltipListener.cpp
index 32db4e922bc7..4724e8714bfa 100644
--- a/layout/xul/base/src/nsXULTooltipListener.cpp
+++ b/layout/xul/base/src/nsXULTooltipListener.cpp
@@ -140,7 +140,7 @@ nsXULTooltipListener::MouseOut(nsIDOMEvent* aMouseEvent)
 
     // which node is our tooltip on?
     nsCOMPtr<nsIDocument> doc;
-    mCurrentTooltip->GetDocument(*getter_AddRefs(doc));
+    mCurrentTooltip->GetDocument(getter_AddRefs(doc));
     nsCOMPtr<nsIDOMXULDocument> xulDoc(do_QueryInterface(doc));
     if (!doc)        // remotely possible someone could have 
       return NS_OK;  // removed tooltip from dom while it was open
@@ -290,7 +290,7 @@ nsXULTooltipListener::Init(nsIContent* aSourceNode, nsIRootBox* aRootBox)
   // if the target is an treechildren, we may have some special
   // case handling to do
   nsCOMPtr<nsIAtom> tag;
-  mSourceNode->GetTag(*getter_AddRefs(tag));
+  mSourceNode->GetTag(getter_AddRefs(tag));
   mIsSourceTree = tag == nsXULAtoms::treechildren;
 #endif
 
@@ -388,13 +388,13 @@ nsXULTooltipListener::ShowTooltip()
 
   // set the node in the document that triggered the tooltip and show it
   nsCOMPtr<nsIDocument> doc;
-  mCurrentTooltip->GetDocument(*getter_AddRefs(doc));
+  mCurrentTooltip->GetDocument(getter_AddRefs(doc));
   nsCOMPtr<nsIDOMXULDocument> xulDoc(do_QueryInterface(doc));
   if (xulDoc) {
     // Make sure the target node is still attached to some document. 
     // It might have been deleted.
     nsCOMPtr<nsIDocument> targetDoc;
-    mSourceNode->GetDocument(*getter_AddRefs(targetDoc));
+    mSourceNode->GetDocument(getter_AddRefs(targetDoc));
     if (targetDoc) {
 #ifdef MOZ_XUL
       if (!mIsSourceTree) {
@@ -427,7 +427,7 @@ nsXULTooltipListener::ShowTooltip()
 
       // listen for mousedown,keydown, and DOMMouseScroll events at document level
       nsCOMPtr<nsIDocument> doc;
-      mSourceNode->GetDocument(*getter_AddRefs(doc));
+      mSourceNode->GetDocument(getter_AddRefs(doc));
       if (doc) {
         evtTarget = do_QueryInterface(doc);
         evtTarget->AddEventListener(NS_LITERAL_STRING("DOMMouseScroll"), 
@@ -544,9 +544,9 @@ GetImmediateChild(nsIContent* aContent, nsIAtom *aTag, nsIContent** aResult)
   aContent->ChildCount(childCount);
   for (PRInt32 i = 0; i < childCount; i++) {
     nsCOMPtr<nsIContent> child;
-    aContent->ChildAt(i, *getter_AddRefs(child));
+    aContent->ChildAt(i, getter_AddRefs(child));
     nsCOMPtr<nsIAtom> tag;
-    child->GetTag(*getter_AddRefs(tag));
+    child->GetTag(getter_AddRefs(tag));
     if (aTag == tag.get()) {
       *aResult = child;
       return;
@@ -568,7 +568,7 @@ nsXULTooltipListener::GetTooltipFor(nsIContent* aTarget, nsIContent** aTooltip)
 
   // before we go on, make sure that target node still has a window
   nsCOMPtr<nsIDocument> document;
-  if (NS_FAILED(aTarget->GetDocument(*getter_AddRefs(document))) || !document) {
+  if (NS_FAILED(aTarget->GetDocument(getter_AddRefs(document))) || !document) {
     NS_ERROR("Unable to retrieve the tooltip node document.");
     return NS_ERROR_FAILURE;
   }
@@ -646,7 +646,7 @@ nsXULTooltipListener::DestroyTooltip()
   if (mCurrentTooltip) {
     // clear out the tooltip node on the document
     nsCOMPtr<nsIDocument> doc;
-    mCurrentTooltip->GetDocument(*getter_AddRefs(doc));
+    mCurrentTooltip->GetDocument(getter_AddRefs(doc));
     if (doc) {
       nsCOMPtr<nsIDOMXULDocument> xulDoc(do_QueryInterface(doc));
       if (xulDoc)
@@ -727,7 +727,7 @@ nsXULTooltipListener::GetSourceTreeBoxObject(nsITreeBoxObject** aBoxObject)
 
   if (mIsSourceTree && mSourceNode) {
     nsCOMPtr<nsIContent> treeParent;
-    mSourceNode->GetParent(*getter_AddRefs(treeParent));
+    mSourceNode->GetParent(getter_AddRefs(treeParent));
     nsCOMPtr<nsIDOMXULElement> xulEl(do_QueryInterface(treeParent));
     if (xulEl) {
       nsCOMPtr<nsIBoxObject> bx;
diff --git a/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp b/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp
index 541e5fb75423..a08449655f05 100644
--- a/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp
+++ b/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp
@@ -266,15 +266,15 @@ nsTreeColumn::nsTreeColumn(nsIContent* aColElement, nsIFrame* aFrame)
   // Cache our index.
   mColIndex = -1;
   nsCOMPtr<nsIContent> parent;
-  mColElement->GetParent(*getter_AddRefs(parent));
+  mColElement->GetParent(getter_AddRefs(parent));
   PRInt32 count;
   parent->ChildCount(count);
   PRInt32 j = 0;
   for (PRInt32 i = 0; i < count; i++) {
     nsCOMPtr<nsIContent> child;
-    parent->ChildAt(i, *getter_AddRefs(child));
+    parent->ChildAt(i, getter_AddRefs(child));
     nsCOMPtr<nsIAtom> tag;
-    child->GetTag(*getter_AddRefs(tag));
+    child->GetTag(getter_AddRefs(tag));
     if (tag == nsXULAtoms::treecol) {
       if (child == mColElement) {
         mColIndex = j;
@@ -426,7 +426,7 @@ nsTreeBodyFrame::GetMinSize(nsBoxLayoutState& aBoxLayoutState, nsSize& aSize)
   nsCOMPtr<nsIContent> baseElement;
   GetBaseElement(getter_AddRefs(baseElement));
   nsCOMPtr<nsIAtom> tag;
-  baseElement->GetTag(*getter_AddRefs(tag));
+  baseElement->GetTag(getter_AddRefs(tag));
 
   PRInt32 desiredRows;
   if (tag == nsHTMLAtoms::select) {
@@ -557,7 +557,7 @@ nsTreeBodyFrame::EnsureBoxObject()
 
     if (parent) {
       nsCOMPtr<nsIDocument> parentDoc;
-      parent->GetDocument(*getter_AddRefs(parentDoc));
+      parent->GetDocument(getter_AddRefs(parentDoc));
       if (!parentDoc) // there may be no document, if we're called from Destroy()
         return;
       
@@ -610,7 +610,7 @@ nsTreeBodyFrame::EnsureView()
       // look for a XULTreeBuilder or create a content view.
       
       nsCOMPtr<nsIContent> parent;
-      mContent->GetParent(*getter_AddRefs(parent));
+      mContent->GetParent(getter_AddRefs(parent));
       nsCOMPtr<nsIDOMXULElement> xulele = do_QueryInterface(parent);
       if (xulele) {
         nsCOMPtr<nsITreeView> view;
@@ -1115,7 +1115,7 @@ nsTreeBodyFrame::AdjustEventCoordsToBoxCoordSpace (PRInt32 aX, PRInt32 aY, PRInt
   
   // Get our box object.
   nsCOMPtr<nsIDocument> doc;
-  mContent->GetDocument(*getter_AddRefs(doc));
+  mContent->GetDocument(getter_AddRefs(doc));
   nsCOMPtr<nsIDOMNSDocument> nsDoc(do_QueryInterface(doc));
   nsCOMPtr<nsIDOMElement> elt(do_QueryInterface(mContent));
   
@@ -1663,7 +1663,7 @@ nsTreeBodyFrame::MarkDirtyIfSelect()
   nsCOMPtr<nsIContent> baseElement;
   GetBaseElement(getter_AddRefs(baseElement));
   nsCOMPtr<nsIAtom> tag;
-  baseElement->GetTag(*getter_AddRefs(tag));
+  baseElement->GetTag(getter_AddRefs(tag));
   if (tag == nsHTMLAtoms::select) {
     // If we are an intrinsically sized select widget, we may need to
     // resize, if the widest item was removed or a new item was added.
@@ -1955,11 +1955,11 @@ nsTreeBodyFrame::GetImage(PRInt32 aRowIndex, const PRUnichar* aColID, PRBool aUs
 
     nsCOMPtr<nsIURI> baseURI;
     nsCOMPtr<nsIDocument> doc;
-    mContent->GetDocument(*getter_AddRefs(doc));
+    mContent->GetDocument(getter_AddRefs(doc));
     if (!doc)
       // The page is currently being torn down.  Why bother.
       return NS_ERROR_FAILURE;
-    doc->GetBaseURL(*getter_AddRefs(baseURI));
+    doc->GetBaseURL(getter_AddRefs(baseURI));
 
     nsCOMPtr<nsIURI> srcURI;
     NS_NewURI(getter_AddRefs(srcURI), *imagePtr, nsnull, baseURI);
@@ -3464,7 +3464,7 @@ nsTreeBodyFrame::EnsureColumns()
     // Note: this is dependent on the anonymous content for select
     // defined in select.xml
     nsCOMPtr<nsIAtom> parentTag;
-    parent->GetTag(*getter_AddRefs(parentTag));
+    parent->GetTag(getter_AddRefs(parentTag));
     if (parentTag == nsHTMLAtoms::select) {
       // We can avoid crawling the content nodes in this case, since we know
       // that we have a single column, and we know where it's at.
@@ -3473,7 +3473,7 @@ nsTreeBodyFrame::EnsureColumns()
       ChildIterator::Init(parent, &iter, &last);
       nsCOMPtr<nsIContent> treeCols = *iter;
       nsCOMPtr<nsIContent> column;
-      treeCols->ChildAt(0, *getter_AddRefs(column));
+      treeCols->ChildAt(0, getter_AddRefs(column));
 
       nsIFrame* colFrame = nsnull;
       shell->GetPrimaryFrameFor(column, &colFrame);
@@ -3505,7 +3505,7 @@ nsTreeBodyFrame::EnsureColumns()
       nsCOMPtr<nsIContent> content;
       frame->GetContent(getter_AddRefs(content));
       nsCOMPtr<nsIAtom> tag;
-      content->GetTag(*getter_AddRefs(tag));
+      content->GetTag(getter_AddRefs(tag));
       if (tag == nsXULAtoms::treecol) {
         // Create a new column structure.
         nsTreeColumn* col = new nsTreeColumn(content, frame);
@@ -3534,10 +3534,10 @@ nsTreeBodyFrame::GetBaseElement(nsIContent** aContent)
   nsCOMPtr<nsIAtom> tag;
   nsCOMPtr<nsIContent> temp;
 
-  while (parent && NS_SUCCEEDED(parent->GetTag(*getter_AddRefs(tag)))
+  while (parent && NS_SUCCEEDED(parent->GetTag(getter_AddRefs(tag)))
          && tag != nsXULAtoms::tree && tag != nsHTMLAtoms::select) {
     temp = parent;
-    temp->GetParent(*getter_AddRefs(parent));
+    temp->GetParent(getter_AddRefs(parent));
   }
 
   *aContent = parent;
diff --git a/layout/xul/base/src/tree/src/nsTreeBoxObject.cpp b/layout/xul/base/src/tree/src/nsTreeBoxObject.cpp
index 3fadcfcac227..f5eb2c7fb884 100644
--- a/layout/xul/base/src/tree/src/nsTreeBoxObject.cpp
+++ b/layout/xul/base/src/tree/src/nsTreeBoxObject.cpp
@@ -119,7 +119,7 @@ static void FindBodyElement(nsIContent* aParent, nsIContent** aResult)
   for (ChildIterator::Init(aParent, &iter, &last); iter != last; ++iter) {
     nsCOMPtr<nsIContent> content = *iter;
     nsCOMPtr<nsIAtom> tag;
-    content->GetTag(*getter_AddRefs(tag));
+    content->GetTag(getter_AddRefs(tag));
     if (tag.get() == nsXULAtoms::treechildren) {
       *aResult = content;
       NS_ADDREF(*aResult);
diff --git a/layout/xul/base/src/tree/src/nsTreeColFrame.cpp b/layout/xul/base/src/tree/src/nsTreeColFrame.cpp
index 0d2b89302ca9..82829078b619 100644
--- a/layout/xul/base/src/tree/src/nsTreeColFrame.cpp
+++ b/layout/xul/base/src/tree/src/nsTreeColFrame.cpp
@@ -144,7 +144,7 @@ nsTreeColFrame::GetFrameForPoint(nsIPresContext* aPresContext,
     nsCOMPtr<nsIContent> content;
     if (child) {
       child->GetContent(getter_AddRefs(content));
-      content->GetTag(*getter_AddRefs(tag));
+      content->GetTag(getter_AddRefs(tag));
       if (tag.get() == nsXULAtoms::splitter) {
         *aFrame = child;
         return NS_OK;
@@ -202,12 +202,12 @@ nsTreeColFrame::EnsureTree()
   if (!mTree && mContent) {
     // Get our parent node.
     nsCOMPtr<nsIContent> parent;
-    mContent->GetParent(*getter_AddRefs(parent));
+    mContent->GetParent(getter_AddRefs(parent));
     if (parent) {
       nsCOMPtr<nsIContent> grandParent;
-      parent->GetParent(*getter_AddRefs(grandParent));
+      parent->GetParent(getter_AddRefs(grandParent));
       nsCOMPtr<nsIDocument> doc;
-      mContent->GetDocument(*getter_AddRefs(doc));
+      mContent->GetDocument(getter_AddRefs(doc));
       nsCOMPtr<nsIDOMNSDocument> nsDoc(do_QueryInterface(doc));
       nsCOMPtr<nsIDOMElement> elt(do_QueryInterface(grandParent));
 
diff --git a/layout/xul/base/src/tree/src/nsTreeContentView.cpp b/layout/xul/base/src/tree/src/nsTreeContentView.cpp
index 55f1f5d8e6c8..93cd72ee1d1d 100644
--- a/layout/xul/base/src/tree/src/nsTreeContentView.cpp
+++ b/layout/xul/base/src/tree/src/nsTreeContentView.cpp
@@ -150,7 +150,7 @@ nsTreeContentView::nsTreeContentView(void) :
 
 nsTreeContentView::~nsTreeContentView(void)
 {
-  // Remove ourselfs from document's observers.
+  // Remove ourselves from mDocument's observers.
   if (mDocument)
     mDocument->RemoveObserver(this);
 }
@@ -514,7 +514,7 @@ nsTreeContentView::GetCellText(PRInt32 aRow, const PRUnichar* aColID, nsAString&
     return NS_OK;
 
   nsCOMPtr<nsIAtom> rowTag;
-  row->mContent->GetTag(*getter_AddRefs(rowTag));
+  row->mContent->GetTag(getter_AddRefs(rowTag));
   if (rowTag == nsHTMLAtoms::option) {
     // Use the text node child as the label
     nsCOMPtr<nsIDOMHTMLOptionElement> elem = do_QueryInterface(row->mContent);
@@ -550,9 +550,9 @@ nsTreeContentView::SetTree(nsITreeBoxObject* aTree)
 
     mRoot = do_QueryInterface(element);
 
-    // Add ourselfs to document's observers.
+    // Add ourselves to document's observers.
     nsCOMPtr<nsIDocument> document;
-    mRoot->GetDocument(*getter_AddRefs(document));
+    mRoot->GetDocument(getter_AddRefs(document));
     if (document) {
       document->AddObserver(this);
       mDocument = document;
@@ -581,7 +581,7 @@ nsTreeContentView::ToggleOpenState(PRInt32 aIndex)
   // lazily.
   Row* row = (Row*)mRows[aIndex];
   nsCOMPtr<nsIAtom> contentTag;
-  row->mContent->GetTag(*getter_AddRefs(contentTag));
+  row->mContent->GetTag(getter_AddRefs(contentTag));
   if (contentTag == nsHTMLAtoms::optgroup) {
     // we don't use an attribute for optgroup's open state
     PRBool wasOpen = row->IsOpen();
@@ -719,7 +719,7 @@ nsTreeContentView::ContentStatesChanged(nsIDocument* aDocument,
     return NS_OK;
         
   nsCOMPtr<nsIAtom> contentTag;
-  aContent1->GetTag(*getter_AddRefs(contentTag));   
+  aContent1->GetTag(getter_AddRefs(contentTag));   
   if (contentTag == nsHTMLAtoms::option) {
     // update the selected state for this node
     PRInt32 index = FindContent(aContent1);
@@ -741,7 +741,7 @@ nsTreeContentView::AttributeChanged(nsIDocument *aDocument,
   // Make sure this notification concerns us.
   // First check the tag to see if it's one that we care about.
   nsCOMPtr<nsIAtom> tag;
-  aContent->GetTag(*getter_AddRefs(tag));
+  aContent->GetTag(getter_AddRefs(tag));
 
   if (aContent->IsContentOfType(nsIContent::eXUL)) {
     if (tag != nsXULAtoms::treecol &&
@@ -759,9 +759,9 @@ nsTreeContentView::AttributeChanged(nsIDocument *aDocument,
   nsCOMPtr<nsIAtom> parentTag;
   do {
     nsCOMPtr<nsIContent> temp = parent;
-    temp->GetParent(*getter_AddRefs(parent));
+    temp->GetParent(getter_AddRefs(parent));
     if (parent)
-      parent->GetTag(*getter_AddRefs(parentTag));
+      parent->GetTag(getter_AddRefs(parentTag));
   } while (parent && parentTag != nsXULAtoms::tree);
   if (parent != mRoot) {
     // This is not for us, we can bail out.
@@ -785,10 +785,10 @@ nsTreeContentView::AttributeChanged(nsIDocument *aDocument,
     else if (!hidden && index < 0) {
       // Show this row along with its children.
       nsCOMPtr<nsIContent> container;
-      aContent->GetParent(*getter_AddRefs(container));
+      aContent->GetParent(getter_AddRefs(container));
       if (container) {
         nsCOMPtr<nsIContent> parent;
-        container->GetParent(*getter_AddRefs(parent));
+        container->GetParent(getter_AddRefs(parent));
         if (parent)
           InsertRowFor(parent, container, aContent);
       }
@@ -845,7 +845,7 @@ nsTreeContentView::AttributeChanged(nsIDocument *aDocument,
   else if (tag == nsXULAtoms::treerow) {
     if (aAttribute == nsXULAtoms::properties) {
       nsCOMPtr<nsIContent> parent;
-      aContent->GetParent(*getter_AddRefs(parent));
+      aContent->GetParent(getter_AddRefs(parent));
       if (parent) {
         PRInt32 index = FindContent(parent);
         if (index >= 0) {
@@ -861,10 +861,10 @@ nsTreeContentView::AttributeChanged(nsIDocument *aDocument,
         aAttribute == nsHTMLAtoms::value ||
         aAttribute == nsHTMLAtoms::label) {
       nsCOMPtr<nsIContent> parent;
-      aContent->GetParent(*getter_AddRefs(parent));
+      aContent->GetParent(getter_AddRefs(parent));
       if (parent) {
         nsCOMPtr<nsIContent> grandParent;
-        parent->GetParent(*getter_AddRefs(grandParent));
+        parent->GetParent(getter_AddRefs(grandParent));
         if (grandParent) {
           PRInt32 index = FindContent(grandParent);
           if (index >= 0) {
@@ -881,11 +881,11 @@ nsTreeContentView::AttributeChanged(nsIDocument *aDocument,
 
 NS_IMETHODIMP
 nsTreeContentView::ContentAppended(nsIDocument *aDocument,
-                                      nsIContent* aContainer,
-                                      PRInt32     aNewIndexInContainer)
+                                   nsIContent* aContainer,
+                                   PRInt32     aNewIndexInContainer)
 {
   nsCOMPtr<nsIContent> child;
-  aContainer->ChildAt(aNewIndexInContainer, *getter_AddRefs(child));
+  aContainer->ChildAt(aNewIndexInContainer, getter_AddRefs(child));
   ContentInserted(aDocument, aContainer, child, aNewIndexInContainer);
 
   return NS_OK;
@@ -902,7 +902,7 @@ nsTreeContentView::ContentInserted(nsIDocument *aDocument,
   // Make sure this notification concerns us.
   // First check the tag to see if it's one that we care about.
   nsCOMPtr<nsIAtom> childTag;
-  aChild->GetTag(*getter_AddRefs(childTag));
+  aChild->GetTag(getter_AddRefs(childTag));
 
   if (aChild->IsContentOfType(nsIContent::eHTML)) {
     if (childTag != nsHTMLAtoms::option &&
@@ -924,7 +924,7 @@ nsTreeContentView::ContentInserted(nsIDocument *aDocument,
   nsCOMPtr<nsIAtom> parentTag;
   
   while (element) {
-    element->GetTag(*getter_AddRefs(parentTag));
+    element->GetTag(getter_AddRefs(parentTag));
     if ((element->IsContentOfType(nsIContent::eXUL) && parentTag == nsXULAtoms::tree) ||
         (element->IsContentOfType(nsIContent::eHTML) && parentTag == nsHTMLAtoms::select))
       if (element == mRoot) // this is for us, stop looking
@@ -932,13 +932,13 @@ nsTreeContentView::ContentInserted(nsIDocument *aDocument,
       else // this is not for us, we can bail out
         return NS_OK;
     nsCOMPtr<nsIContent> temp = element;
-    temp->GetParent(*getter_AddRefs(element));
+    temp->GetParent(getter_AddRefs(element));
   }
 
   if (childTag == nsXULAtoms::treeitem ||
       childTag == nsXULAtoms::treeseparator) {
     nsCOMPtr<nsIContent> parent;
-    aContainer->GetParent(*getter_AddRefs(parent));
+    aContainer->GetParent(getter_AddRefs(parent));
     if (parent)
       InsertRowFor(parent, aContainer, aChild);
   }
@@ -971,7 +971,7 @@ nsTreeContentView::ContentInserted(nsIDocument *aDocument,
   }
   else if (childTag == nsXULAtoms::treecell) {
     nsCOMPtr<nsIContent> parent;
-    aContainer->GetParent(*getter_AddRefs(parent));
+    aContainer->GetParent(getter_AddRefs(parent));
     if (parent) {
       PRInt32 index = FindContent(parent);
       if (index >= 0)
@@ -1006,7 +1006,7 @@ nsTreeContentView::ContentRemoved(nsIDocument *aDocument,
   // Make sure this notification concerns us.
   // First check the tag to see if it's one that we care about.
   nsCOMPtr<nsIAtom> tag;
-  aChild->GetTag(*getter_AddRefs(tag));
+  aChild->GetTag(getter_AddRefs(tag));
 
   if (aChild->IsContentOfType(nsIContent::eHTML)) {
     if (tag != nsHTMLAtoms::option &&
@@ -1028,7 +1028,7 @@ nsTreeContentView::ContentRemoved(nsIDocument *aDocument,
   nsCOMPtr<nsIAtom> parentTag;
   
   while (element) {
-    element->GetTag(*getter_AddRefs(parentTag));
+    element->GetTag(getter_AddRefs(parentTag));
     if ((element->IsContentOfType(nsIContent::eXUL) && parentTag == nsXULAtoms::tree) || 
         (element->IsContentOfType(nsIContent::eHTML) && parentTag == nsHTMLAtoms::select))
       if (element == mRoot) // this is for us, stop looking
@@ -1036,7 +1036,7 @@ nsTreeContentView::ContentRemoved(nsIDocument *aDocument,
       else // this is not for us, we can bail out
         return NS_OK;
     nsCOMPtr<nsIContent> temp = element;
-    temp->GetParent(*getter_AddRefs(element));
+    temp->GetParent(getter_AddRefs(element));
   }
 
   if (tag == nsXULAtoms::treeitem ||
@@ -1062,7 +1062,7 @@ nsTreeContentView::ContentRemoved(nsIDocument *aDocument,
       mBoxObject->RowCountChanged(index + 1, -count);
     } else {
       nsCOMPtr<nsIAtom> containerTag;
-      aContainer->GetTag(*getter_AddRefs(containerTag));
+      aContainer->GetTag(getter_AddRefs(containerTag));
       if (containerTag == nsXULAtoms::tree ) {
         ClearRows();
         mBoxObject->Invalidate();
@@ -1076,7 +1076,7 @@ nsTreeContentView::ContentRemoved(nsIDocument *aDocument,
   }
   else if (tag == nsXULAtoms::treecell) {
     nsCOMPtr<nsIContent> parent;
-    aContainer->GetParent(*getter_AddRefs(parent));
+    aContainer->GetParent(getter_AddRefs(parent));
     if (parent) {
       PRInt32 index = FindContent(parent);
       if (index >= 0)
@@ -1090,7 +1090,7 @@ nsTreeContentView::ContentRemoved(nsIDocument *aDocument,
 NS_IMETHODIMP
 nsTreeContentView::DocumentWillBeDestroyed(nsIDocument *aDocument)
 {
-  // Remove ourselfs from document's observers.
+  // Remove ourselves from mDocument's observers.
   if (mDocument) {
     mDocument->RemoveObserver(this);
     mDocument = nsnull;
@@ -1110,7 +1110,7 @@ nsTreeContentView::Serialize(nsIContent* aContent, PRInt32 aParentIndex, PRInt32
   for (ChildIterator::Init(aContent, &iter, &last); iter != last; ++iter) {
     nsCOMPtr<nsIContent> content = *iter;
     nsCOMPtr<nsIAtom> tag;
-    content->GetTag(*getter_AddRefs(tag));
+    content->GetTag(getter_AddRefs(tag));
     PRInt32 count = aRows.Count();
     if (content->IsContentOfType(nsIContent::eXUL)) {
       if (tag == nsXULAtoms::treeitem)
@@ -1225,13 +1225,13 @@ nsTreeContentView::GetIndexInSubtree(nsIContent* aContainer, nsIContent* aConten
   aContainer->ChildCount(childCount);
   for (PRInt32 i = 0; i < childCount; i++) {
     nsCOMPtr<nsIContent> content;
-    aContainer->ChildAt(i, *getter_AddRefs(content));
+    aContainer->ChildAt(i, getter_AddRefs(content));
 
     if (content == aContent)
       break;
 
     nsCOMPtr<nsIAtom> tag;
-    content->GetTag(*getter_AddRefs(tag));
+    content->GetTag(getter_AddRefs(tag));
     if (tag == nsXULAtoms::treeitem) {
       nsAutoString hidden;
       content->GetAttr(kNameSpaceID_None, nsHTMLAtoms::hidden, hidden);
@@ -1271,7 +1271,7 @@ nsTreeContentView::EnsureSubtree(PRInt32 aIndex, PRInt32* aCount)
 {
   Row* row = (Row*)mRows[aIndex];
   nsCOMPtr<nsIAtom> contentTag;
-  row->mContent->GetTag(*getter_AddRefs(contentTag));
+  row->mContent->GetTag(getter_AddRefs(contentTag));
 
   nsCOMPtr<nsIContent> child;
   if (contentTag == nsHTMLAtoms::optgroup)
@@ -1327,7 +1327,7 @@ nsTreeContentView::InsertRowFor(nsIContent* aParent, nsIContent* aContainer, nsI
   PRBool insertRow = PR_FALSE;
 
   nsCOMPtr<nsIAtom> parentTag;
-  aParent->GetTag(*getter_AddRefs(parentTag));
+  aParent->GetTag(getter_AddRefs(parentTag));
   if ((aParent->IsContentOfType(nsIContent::eXUL) && parentTag == nsXULAtoms::tree) ||
       (aParent->IsContentOfType(nsIContent::eHTML) && parentTag == nsHTMLAtoms::select)) {
     // Allow insertion to the outermost container.
@@ -1361,7 +1361,7 @@ nsTreeContentView::InsertRow(PRInt32 aParentIndex, PRInt32 aIndex, nsIContent* a
 {
   nsAutoVoidArray rows;
   nsCOMPtr<nsIAtom> tag;
-  aContent->GetTag(*getter_AddRefs(tag));
+  aContent->GetTag(getter_AddRefs(tag));
   if (tag == nsXULAtoms::treeitem)
     SerializeItem(aContent, aParentIndex, &aIndex, rows);
   else if (tag == nsXULAtoms::treeseparator)
@@ -1483,7 +1483,7 @@ nsTreeContentView::GetNamedCell(nsIContent* aContainer, const PRUnichar* aColID,
   for (ChildIterator::Init(aContainer, &iter, &last); iter != last; ++iter) {
     nsCOMPtr<nsIContent> cell = *iter;
     nsCOMPtr<nsIAtom> tag;
-    cell->GetTag(*getter_AddRefs(tag));
+    cell->GetTag(getter_AddRefs(tag));
     if (tag == nsXULAtoms::treecell) {
       nsAutoString ref;
       cell->GetAttr(kNameSpaceID_None, nsXULAtoms::ref, ref);
diff --git a/layout/xul/base/src/tree/src/nsTreeSelection.cpp b/layout/xul/base/src/tree/src/nsTreeSelection.cpp
index 167123229bce..80dd3bad4375 100644
--- a/layout/xul/base/src/tree/src/nsTreeSelection.cpp
+++ b/layout/xul/base/src/tree/src/nsTreeSelection.cpp
@@ -737,7 +737,7 @@ nsTreeSelection::FireOnSelectHandler()
 
   nsCOMPtr<nsIContent> content(do_QueryInterface(elt));
   nsCOMPtr<nsIDocument> document;
-  content->GetDocument(*getter_AddRefs(document));
+  content->GetDocument(getter_AddRefs(document));
   
   // we might be firing on a delay, so it's possible in rare cases that
   // the document may have been destroyed by the time it fires
diff --git a/layout/xul/base/src/tree/src/nsTreeUtils.cpp b/layout/xul/base/src/tree/src/nsTreeUtils.cpp
index 391f24faf2fc..a7a4961ca740 100644
--- a/layout/xul/base/src/tree/src/nsTreeUtils.cpp
+++ b/layout/xul/base/src/tree/src/nsTreeUtils.cpp
@@ -90,7 +90,7 @@ nsTreeUtils::GetImmediateChild(nsIContent* aContainer, nsIAtom* aTag, nsIContent
   for (ChildIterator::Init(aContainer, &iter, &last); iter != last; ++iter) {
     nsCOMPtr<nsIContent> child = *iter;
     nsCOMPtr<nsIAtom> tag;
-    child->GetTag(*getter_AddRefs(tag));
+    child->GetTag(getter_AddRefs(tag));
     if (tag == aTag) {
       NS_ADDREF(*aResult = child);
       return NS_OK;
diff --git a/modules/plugin/base/src/nsPluginHostImpl.cpp b/modules/plugin/base/src/nsPluginHostImpl.cpp
index 2dd2c679ad34..acfebeb03150 100644
--- a/modules/plugin/base/src/nsPluginHostImpl.cpp
+++ b/modules/plugin/base/src/nsPluginHostImpl.cpp
@@ -5614,7 +5614,7 @@ NS_IMETHODIMP nsPluginHostImpl::NewPluginURLStream(const nsString& aURL,
       if (NS_SUCCEEDED(rv) && doc)
       {
         nsCOMPtr<nsIURI> docURL;
-        doc->GetBaseURL(*getter_AddRefs(docURL));
+        doc->GetBaseURL(getter_AddRefs(docURL));
  
         // Create an absolute URL
         rv = NS_MakeAbsoluteURI(absUrl, aURL, docURL);
@@ -5748,7 +5748,7 @@ nsPluginHostImpl::DoURLLoadSecurityCheck(nsIPluginInstance *aInstance,
 
   // Create an absolute URL for the target in case the target is relative
   nsCOMPtr<nsIURI> docBaseURL;
-  doc->GetBaseURL(*getter_AddRefs(docBaseURL));
+  doc->GetBaseURL(getter_AddRefs(docBaseURL));
 
   nsCOMPtr<nsIURI> targetURL;
   rv = NS_NewURI(getter_AddRefs(targetURL), aURL, docBaseURL);
@@ -5920,7 +5920,7 @@ nsresult nsPluginHostImpl::NewEmbededPluginStream(nsIURI* aURL,
       nsCOMPtr<nsIHttpChannel> httpChannel(do_QueryInterface(channel));
       if (httpChannel && doc) {
         nsCOMPtr<nsIURI> referrerURL;
-        if (NS_SUCCEEDED(doc->GetBaseURL(*getter_AddRefs(referrerURL))))
+        if (NS_SUCCEEDED(doc->GetBaseURL(getter_AddRefs(referrerURL))))
           httpChannel->SetReferrer(referrerURL);
       }
 
diff --git a/rdf/chrome/src/nsChromeRegistry.cpp b/rdf/chrome/src/nsChromeRegistry.cpp
index ec09a3881e8a..3a3eb4d6f6a6 100644
--- a/rdf/chrome/src/nsChromeRegistry.cpp
+++ b/rdf/chrome/src/nsChromeRegistry.cpp
@@ -3109,7 +3109,7 @@ nsChromeRegistry::GetAgentSheets(nsIDocShell* aDocShell, nsISupportsArray **aRes
         while (token) {
           nsCOMPtr<nsIContent> content(do_QueryInterface(elt));
           nsCOMPtr<nsIDocument> doc;
-          content->GetDocument(*getter_AddRefs(doc));
+          content->GetDocument(getter_AddRefs(doc));
           nsCOMPtr<nsIURI> docURL;
           doc->GetDocumentURL(getter_AddRefs(docURL));
           nsCOMPtr<nsIURI> url;
diff --git a/security/manager/boot/src/nsSecureBrowserUIImpl.cpp b/security/manager/boot/src/nsSecureBrowserUIImpl.cpp
index 731fe346782b..5354183fcf55 100644
--- a/security/manager/boot/src/nsSecureBrowserUIImpl.cpp
+++ b/security/manager/boot/src/nsSecureBrowserUIImpl.cpp
@@ -326,11 +326,11 @@ nsSecureBrowserUIImpl::Notify(nsIContent* formNode,
     return NS_OK;
   
   nsCOMPtr<nsIDocument> document;
-  formNode->GetDocument(*getter_AddRefs(document));
+  formNode->GetDocument(getter_AddRefs(document));
   if (!document) return NS_OK;
 
   nsCOMPtr<nsIURI> formURL;
-  document->GetBaseURL(*getter_AddRefs(formURL));
+  document->GetBaseURL(getter_AddRefs(formURL));
   
   nsCOMPtr<nsIScriptGlobalObject> globalObject;
   document->GetScriptGlobalObject(getter_AddRefs(globalObject));
diff --git a/webshell/tests/viewer/nsBrowserWindow.cpp b/webshell/tests/viewer/nsBrowserWindow.cpp
index 3a1250bb8c55..dd7e9a90bec9 100644
--- a/webshell/tests/viewer/nsBrowserWindow.cpp
+++ b/webshell/tests/viewer/nsBrowserWindow.cpp
@@ -479,11 +479,10 @@ GetPresShellFor(nsIDocShell* aDocShell)
       nsIDocumentViewer* docv = nsnull;
       cv->QueryInterface(kIDocumentViewerIID, (void**) &docv);
       if (nsnull != docv) {
-        nsIPresContext* cx;
-        docv->GetPresContext(cx);
+        nsCOMPtr<nsIPresContext> cx;
+        docv->GetPresContext(getter_AddRefs(cx));
         if (nsnull != cx) {
           cx->GetShell(&shell);
-          NS_RELEASE(cx);
         }
         NS_RELEASE(docv);
       }
@@ -1552,15 +1551,14 @@ nsnull, r.x, r.y, r.width, r.height);
 
 
   // Create a document viewer and bind it to the webshell
-  nsIDocumentViewer* docv;
-  aDocumentViewer->CreateDocumentViewerUsing(aPresContext, docv);
+  nsCOMPtr<nsIDocumentViewer> docv;
+  aDocumentViewer->CreateDocumentViewerUsing(aPresContext,
+                                             getter_AddRefs(docv));
   docv->SetContainer(mWebBrowser);
   nsCOMPtr<nsIContentViewerContainer> cvContainer = do_QueryInterface(mDocShell);
   cvContainer->Embed(docv, "duh", nsnull);
 
-
   webBrowserWin->SetVisibility(PR_TRUE);
-  NS_RELEASE(docv);
 
   return NS_OK;
 }
@@ -2241,12 +2239,10 @@ nsIDOMDocument* nsBrowserWindow::GetDOMDocument(nsIDocShell *aDocShell)
     if (nsnull != mCViewer) {
       nsIDocumentViewer* mDViewer;
       if (NS_OK == mCViewer->QueryInterface(kIDocumentViewerIID, (void**) &mDViewer)) {
-        nsIDocument* mDoc;
-        mDViewer->GetDocument(mDoc);
+        nsCOMPtr<nsIDocument> mDoc;
+        mDViewer->GetDocument(getter_AddRefs(mDoc));
         if (nsnull != mDoc) {
-          if (NS_OK == mDoc->QueryInterface(kIDOMDocumentIID, (void**) &domDoc)) {
-          }
-          NS_RELEASE(mDoc);
+          mDoc->QueryInterface(kIDOMDocumentIID, (void**) &domDoc);
         }
         NS_RELEASE(mDViewer);
       }
@@ -2347,8 +2343,8 @@ nsBrowserWindow::DoEditorMode(nsIDocShell *aDocShell)
       nsIDocumentViewer* mDViewer;
       if (NS_OK == mCViewer->QueryInterface(kIDocumentViewerIID, (void**) &mDViewer)) 
       {
-        nsIDocument* mDoc;
-        mDViewer->GetDocument(mDoc);
+        nsCOMPtr<nsIDocument> mDoc;
+        mDViewer->GetDocument(getter_AddRefs(mDoc));
         if (nsnull != mDoc) {
           nsIDOMDocument* mDOMDoc;
           if (NS_OK == mDoc->QueryInterface(kIDOMDocumentIID, (void**) &mDOMDoc)) 
@@ -2358,7 +2354,6 @@ nsBrowserWindow::DoEditorMode(nsIDocShell *aDocShell)
             NS_RELEASE(mDOMDoc);
             NS_IF_RELEASE(shell);
           }
-          NS_RELEASE(mDoc);
         }
         NS_RELEASE(mDViewer);
       }
@@ -2387,8 +2382,8 @@ nsBrowserWindow::DoEditorTest(nsIDocShell *aDocShell, PRInt32 aCommandID)
       nsIDocumentViewer* mDViewer;
       if (NS_OK == mCViewer->QueryInterface(kIDocumentViewerIID, (void**) &mDViewer)) 
       {
-        nsIDocument* mDoc;
-        mDViewer->GetDocument(mDoc);
+        nsCOMPtr<nsIDocument> mDoc;
+        mDViewer->GetDocument(getter_AddRefs(mDoc));
         if (nsnull != mDoc) {
           nsIDOMDocument* mDOMDoc;
           if (NS_OK == mDoc->QueryInterface(kIDOMDocumentIID, (void**) &mDOMDoc)) 
@@ -2396,7 +2391,6 @@ nsBrowserWindow::DoEditorTest(nsIDocShell *aDocShell, PRInt32 aCommandID)
             NS_DoEditorTest(aCommandID);
             NS_RELEASE(mDOMDoc);
           }
-          NS_RELEASE(mDoc);
         }
         NS_RELEASE(mDViewer);
       }
diff --git a/webshell/tests/viewer/nsWebCrawler.cpp b/webshell/tests/viewer/nsWebCrawler.cpp
index e665583eae5b..d0515e156638 100644
--- a/webshell/tests/viewer/nsWebCrawler.cpp
+++ b/webshell/tests/viewer/nsWebCrawler.cpp
@@ -758,7 +758,7 @@ void
 nsWebCrawler::FindURLsIn(nsIDocument* aDocument, nsIContent* aNode)
 {
   nsCOMPtr<nsIAtom> atom;
-  aNode->GetTag(*getter_AddRefs(atom));
+  aNode->GetTag(getter_AddRefs(atom));
   if ((atom == mLinkTag) || (atom == mFrameTag) || (atom == mIFrameTag)) {
     // Get absolute url that tag targets
     nsAutoString base, src, absURLSpec;
@@ -809,11 +809,10 @@ nsWebCrawler::FindURLsIn(nsIDocument* aDocument, nsIContent* aNode)
     PRInt32 i, n;
     aNode->ChildCount(n);
     for (i = 0; i < n; i++) {
-      nsIContent* kid;
-      aNode->ChildAt(i, kid);
+      nsCOMPtr<nsIContent> kid;
+      aNode->ChildAt(i, getter_AddRefs(kid));
       if (nsnull != kid) {
         FindURLsIn(aDocument, kid);
-        NS_RELEASE(kid);
       }
     }
   }
@@ -833,7 +832,7 @@ nsWebCrawler::FindMoreURLs()
       nsCOMPtr<nsIDocumentViewer> docv = do_QueryInterface(cv);
       if (docv) {
         nsCOMPtr<nsIDocument> doc;
-        docv->GetDocument(*getter_AddRefs(doc));
+        docv->GetDocument(getter_AddRefs(doc));
         if (doc) {
           nsCOMPtr<nsIContent> root;
           doc->GetRootContent(getter_AddRefs(root));
@@ -923,11 +922,10 @@ nsWebCrawler::GetPresShell(nsIWebShell* aWebShell)
       nsIDocumentViewer* docv = nsnull;
       cv->QueryInterface(NS_GET_IID(nsIDocumentViewer), (void**) &docv);
       if (nsnull != docv) {
-        nsIPresContext* cx;
-        docv->GetPresContext(cx);
+        nsCOMPtr<nsIPresContext> cx;
+        docv->GetPresContext(getter_AddRefs(cx));
         if (nsnull != cx) {
           cx->GetShell(&shell);
-          NS_RELEASE(cx);
         }
         NS_RELEASE(docv);
       }
diff --git a/webshell/tests/viewer/nsXPBaseWindow.cpp b/webshell/tests/viewer/nsXPBaseWindow.cpp
index aa638c4c6185..398477cf97ce 100644
--- a/webshell/tests/viewer/nsXPBaseWindow.cpp
+++ b/webshell/tests/viewer/nsXPBaseWindow.cpp
@@ -584,12 +584,11 @@ NS_IMETHODIMP nsXPBaseWindow::GetPresShell(nsIPresShell*& aPresShell)
       nsIDocumentViewer* docv = nsnull;
       cv->QueryInterface(kIDocumentViewerIID, (void**) &docv);
       if (nsnull != docv) {
-        nsIPresContext* cx;
-        docv->GetPresContext(cx);
+        nsCOMPtr<nsIPresContext> cx;
+        docv->GetPresContext(getter_AddRefs(cx));
         if (nsnull != cx) {
           cx->GetShell(&shell); // does an add ref
           aPresShell = shell;
-          NS_RELEASE(cx);
         }
         NS_RELEASE(docv);
       }
diff --git a/widget/src/cocoa/nsMenuBarX.cpp b/widget/src/cocoa/nsMenuBarX.cpp
index b683b8ec926a..c379613529f9 100644
--- a/widget/src/cocoa/nsMenuBarX.cpp
+++ b/widget/src/cocoa/nsMenuBarX.cpp
@@ -213,7 +213,7 @@ nsMenuBarX :: GetDocument ( nsIWebShell* inWebShell, nsIDocument** outDocument )
       nsCOMPtr<nsIDocumentViewer> docv(do_QueryInterface(cv));
       if (!docv)
         return;
-      docv->GetDocument(*outDocument);    // addrefs
+      docv->GetDocument(outDocument);    // addrefs
     }
   }
 }
@@ -621,7 +621,7 @@ nsMenuBarX :: CreateAppleMenu ( nsIMenu* inMenu )
     inMenu->GetMenuContent(getter_AddRefs(menu));
     if (menu) {
       nsCOMPtr<nsIDocument> doc;
-      menu->GetDocument(*getter_AddRefs(doc));
+      menu->GetDocument(getter_AddRefs(doc));
       if (doc) {
         nsCOMPtr<nsIDOMDocument> domdoc ( do_QueryInterface(doc) );
         if ( domdoc ) {
@@ -762,7 +762,7 @@ nsMenuBarX::ContentAppended( nsIDocument * aDocument, nsIContent  * aContainer,
       obs->ContentInserted ( aDocument, aContainer, aNewIndexInContainer );
     else {
       nsCOMPtr<nsIContent> parent;
-      aContainer->GetParent(*getter_AddRefs(parent));
+      aContainer->GetParent(getter_AddRefs(parent));
       if(parent) {
         Lookup ( parent, getter_AddRefs(obs) );
         if ( obs )
@@ -816,7 +816,7 @@ nsMenuBarX::ContentRemoved( nsIDocument * aDocument, nsIContent * aContainer,
       obs->ContentRemoved ( aDocument, aChild, aIndexInContainer );
     else {
       nsCOMPtr<nsIContent> parent;
-      aContainer->GetParent(*getter_AddRefs(parent));
+      aContainer->GetParent(getter_AddRefs(parent));
       if(parent) {
         Lookup ( parent, getter_AddRefs(obs) );
         if ( obs )
@@ -842,7 +842,7 @@ nsMenuBarX::ContentInserted( nsIDocument * aDocument, nsIContent * aContainer,
       obs->ContentInserted ( aDocument, aChild, aIndexInContainer );
     else {
       nsCOMPtr<nsIContent> parent;
-      aContainer->GetParent(*getter_AddRefs(parent));
+      aContainer->GetParent(getter_AddRefs(parent));
       if(parent) {
         Lookup ( parent, getter_AddRefs(obs) );
         if ( obs )
diff --git a/widget/src/cocoa/nsMenuItemX.cpp b/widget/src/cocoa/nsMenuItemX.cpp
index ffcdd53b0093..5292f99dde22 100644
--- a/widget/src/cocoa/nsMenuItemX.cpp
+++ b/widget/src/cocoa/nsMenuItemX.cpp
@@ -273,7 +273,7 @@ NS_METHOD nsMenuItemX::DoCommand()
   mContent->GetAttr(kNameSpaceID_None, nsWidgetAtoms::command, command);
   if (!command.IsEmpty()) {
     nsCOMPtr<nsIDocument> doc;
-    mContent->GetDocument(*getter_AddRefs(doc));
+    mContent->GetDocument(getter_AddRefs(doc));
     nsCOMPtr<nsIDOMDocument> domDoc(do_QueryInterface(doc));
     nsCOMPtr<nsIDOMElement> commandElt;
     domDoc->GetElementById(command, getter_AddRefs(commandElt));
@@ -336,7 +336,7 @@ nsMenuItemX :: UncheckRadioSiblings(nsIContent* inCheckedContent)
     return;
   
   nsCOMPtr<nsIContent> parent;
-  inCheckedContent->GetParent(*getter_AddRefs(parent));
+  inCheckedContent->GetParent(getter_AddRefs(parent));
   if ( !parent )
     return;
 
diff --git a/widget/src/cocoa/nsMenuX.cpp b/widget/src/cocoa/nsMenuX.cpp
index 4931f749092a..f846e450644e 100644
--- a/widget/src/cocoa/nsMenuX.cpp
+++ b/widget/src/cocoa/nsMenuX.cpp
@@ -872,7 +872,7 @@ void nsMenuX::LoadMenuItem( nsIMenu* inParentMenu, nsIContent* inMenuItemContent
 
     // Try to find the key node. Get the document so we can do |GetElementByID|
     nsCOMPtr<nsIDocument> document;
-    inMenuItemContent->GetDocument(*getter_AddRefs(document));
+    inMenuItemContent->GetDocument(getter_AddRefs(document));
     if ( !document ) 
       return;
     nsCOMPtr<nsIDOMDocument> domDocument = do_QueryInterface(document);
@@ -1021,7 +1021,7 @@ nsMenuX::OnCreate()
   // be updated.
   if (popupContent) {
     nsCOMPtr<nsIDocument> doc;
-    popupContent->GetDocument(*getter_AddRefs(doc));
+    popupContent->GetDocument(getter_AddRefs(doc));
     nsCOMPtr<nsIDOMDocument> domDoc(do_QueryInterface(doc));
 
     PRInt32 count;
@@ -1030,7 +1030,7 @@ nsMenuX::OnCreate()
       nsCOMPtr<nsIContent> grandChild;
       popupContent->ChildAt(i, *getter_AddRefs(grandChild));
       nsCOMPtr<nsIAtom> tag;
-      grandChild->GetTag(*getter_AddRefs(tag));
+      grandChild->GetTag(getter_AddRefs(tag));
       if (tag.get() == nsWidgetAtoms::menuitem) {
         // See if we have a command attribute.
         nsAutoString command;
diff --git a/widget/src/mac/nsMenu.cpp b/widget/src/mac/nsMenu.cpp
index 14bfc9bd9099..beb7a8e1df4f 100644
--- a/widget/src/mac/nsMenu.cpp
+++ b/widget/src/mac/nsMenu.cpp
@@ -556,7 +556,7 @@ nsEventStatus nsMenu::MenuItemSelected(const nsMenuEvent & aMenuEvent)
 	    if (!mMenuContent)
       	return nsEventStatus_eConsumeNoDefault;
 	    nsCOMPtr<nsIDocument> doc; 
-	    mMenuContent->GetDocument(*getter_AddRefs(doc));
+	    mMenuContent->GetDocument(getter_AddRefs(doc));
 	    if (!doc)
       	return nsEventStatus_eConsumeNoDefault;
 	    nsCOMPtr<nsIDOMDocument> domDoc = do_QueryInterface(doc);
@@ -1065,7 +1065,7 @@ nsMenu::LoadMenuItem( nsIMenu* inParentMenu, nsIContent* inMenuItemContent )
 
     // Try to find the key node. Get the document so we can do |GetElementByID|
     nsCOMPtr<nsIDocument> document;
-    inMenuItemContent->GetDocument(*getter_AddRefs(document));
+    inMenuItemContent->GetDocument(getter_AddRefs(document));
     if ( !document ) 
       return;
     nsCOMPtr<nsIDOMDocument> domDocument = do_QueryInterface(document);
@@ -1213,7 +1213,7 @@ nsMenu::OnCreate()
   // be updated.
   if (popupContent) {
     nsCOMPtr<nsIDocument> doc;
-    popupContent->GetDocument(*getter_AddRefs(doc));
+    popupContent->GetDocument(getter_AddRefs(doc));
     nsCOMPtr<nsIDOMDocument> domDoc(do_QueryInterface(doc));
 
     PRInt32 count;
@@ -1222,7 +1222,7 @@ nsMenu::OnCreate()
       nsCOMPtr<nsIContent> grandChild;
       popupContent->ChildAt(i, *getter_AddRefs(grandChild));
       nsCOMPtr<nsIAtom> tag;
-      grandChild->GetTag(*getter_AddRefs(tag));
+      grandChild->GetTag(getter_AddRefs(tag));
       if (tag.get() == nsWidgetAtoms::menuitem) {
         // See if we have a command attribute.
         nsAutoString command;
diff --git a/widget/src/mac/nsMenuBar.cpp b/widget/src/mac/nsMenuBar.cpp
index 40ce5eb5d263..75f301518858 100644
--- a/widget/src/mac/nsMenuBar.cpp
+++ b/widget/src/mac/nsMenuBar.cpp
@@ -267,7 +267,7 @@ nsMenuBar :: GetDocument ( nsIWebShell* inWebShell, nsIDocument** outDocument )
       nsCOMPtr<nsIDocumentViewer> docv(do_QueryInterface(cv));
       if (!docv)
         return;
-      docv->GetDocument(*outDocument);    // addrefs
+      docv->GetDocument(outDocument);    // addrefs
     }
   }
 }
@@ -480,7 +480,7 @@ NS_METHOD nsMenuBar::AddMenu(nsIMenu * aMenu)
       aMenu->GetMenuContent(getter_AddRefs(menu));
       if (menu) {
         nsCOMPtr<nsIDocument> doc;
-        menu->GetDocument(*getter_AddRefs(doc));
+        menu->GetDocument(getter_AddRefs(doc));
         if (doc) {
           nsCOMPtr<nsIDOMDocument> domdoc ( do_QueryInterface(doc) );
           if ( domdoc ) {
@@ -657,7 +657,7 @@ nsMenuBar::ContentAppended( nsIDocument * aDocument, nsIContent  * aContainer,
       obs->ContentInserted ( aDocument, aContainer, aNewIndexInContainer );
     else {
       nsCOMPtr<nsIContent> parent;
-      aContainer->GetParent(*getter_AddRefs(parent));
+      aContainer->GetParent(getter_AddRefs(parent));
       if(parent) {
         Lookup ( parent, getter_AddRefs(obs) );
         if ( obs )
@@ -711,7 +711,7 @@ nsMenuBar::ContentRemoved( nsIDocument * aDocument, nsIContent * aContainer,
       obs->ContentRemoved ( aDocument, aChild, aIndexInContainer );
     else {
       nsCOMPtr<nsIContent> parent;
-      aContainer->GetParent(*getter_AddRefs(parent));
+      aContainer->GetParent(getter_AddRefs(parent));
       if(parent) {
         Lookup ( parent, getter_AddRefs(obs) );
         if ( obs )
@@ -737,7 +737,7 @@ nsMenuBar::ContentInserted( nsIDocument * aDocument, nsIContent * aContainer,
       obs->ContentInserted ( aDocument, aChild, aIndexInContainer );
     else {
       nsCOMPtr<nsIContent> parent;
-      aContainer->GetParent(*getter_AddRefs(parent));
+      aContainer->GetParent(getter_AddRefs(parent));
       if(parent) {
         Lookup ( parent, getter_AddRefs(obs) );
         if ( obs )
diff --git a/widget/src/mac/nsMenuBarX.cpp b/widget/src/mac/nsMenuBarX.cpp
index 33e3cb7a5374..56f2452c76f7 100644
--- a/widget/src/mac/nsMenuBarX.cpp
+++ b/widget/src/mac/nsMenuBarX.cpp
@@ -218,7 +218,7 @@ nsMenuBarX :: GetDocument ( nsIWebShell* inWebShell, nsIDocument** outDocument )
       nsCOMPtr<nsIDocumentViewer> docv(do_QueryInterface(cv));
       if (!docv)
         return;
-      docv->GetDocument(*outDocument);    // addrefs
+      docv->GetDocument(outDocument);    // addrefs
     }
   }
 }
@@ -631,7 +631,7 @@ nsMenuBarX :: CreateAppleMenu ( nsIMenu* inMenu )
     inMenu->GetMenuContent(getter_AddRefs(menu));
     if (menu) {
       nsCOMPtr<nsIDocument> doc;
-      menu->GetDocument(*getter_AddRefs(doc));
+      menu->GetDocument(getter_AddRefs(doc));
       if (doc) {
         nsCOMPtr<nsIDOMDocument> domdoc ( do_QueryInterface(doc) );
         if ( domdoc ) {
@@ -772,7 +772,7 @@ nsMenuBarX::ContentAppended( nsIDocument * aDocument, nsIContent  * aContainer,
       obs->ContentInserted ( aDocument, aContainer, aNewIndexInContainer );
     else {
       nsCOMPtr<nsIContent> parent;
-      aContainer->GetParent(*getter_AddRefs(parent));
+      aContainer->GetParent(getter_AddRefs(parent));
       if(parent) {
         Lookup ( parent, getter_AddRefs(obs) );
         if ( obs )
@@ -826,7 +826,7 @@ nsMenuBarX::ContentRemoved( nsIDocument * aDocument, nsIContent * aContainer,
       obs->ContentRemoved ( aDocument, aChild, aIndexInContainer );
     else {
       nsCOMPtr<nsIContent> parent;
-      aContainer->GetParent(*getter_AddRefs(parent));
+      aContainer->GetParent(getter_AddRefs(parent));
       if(parent) {
         Lookup ( parent, getter_AddRefs(obs) );
         if ( obs )
@@ -852,7 +852,7 @@ nsMenuBarX::ContentInserted( nsIDocument * aDocument, nsIContent * aContainer,
       obs->ContentInserted ( aDocument, aChild, aIndexInContainer );
     else {
       nsCOMPtr<nsIContent> parent;
-      aContainer->GetParent(*getter_AddRefs(parent));
+      aContainer->GetParent(getter_AddRefs(parent));
       if(parent) {
         Lookup ( parent, getter_AddRefs(obs) );
         if ( obs )
@@ -1016,7 +1016,7 @@ MenuHelpersX::DispatchCommandTo(nsIWeakReference* aWebShellWeakRef,
   aTargetContent->GetAttr(kNameSpaceID_None, nsWidgetAtoms::command, command);
   if (!command.IsEmpty()) {
     nsCOMPtr<nsIDocument> doc;
-    aTargetContent->GetDocument(*getter_AddRefs(doc));
+    aTargetContent->GetDocument(getter_AddRefs(doc));
     nsCOMPtr<nsIDOMDocument> domDoc(do_QueryInterface(doc));
     nsCOMPtr<nsIDOMElement> commandElt;
     domDoc->GetElementById(command, getter_AddRefs(commandElt));
diff --git a/widget/src/mac/nsMenuItem.cpp b/widget/src/mac/nsMenuItem.cpp
index 5779bf6745e0..666b4150762d 100644
--- a/widget/src/mac/nsMenuItem.cpp
+++ b/widget/src/mac/nsMenuItem.cpp
@@ -299,7 +299,7 @@ NS_METHOD nsMenuItem::DoCommand()
   mContent->GetAttr(kNameSpaceID_None, nsWidgetAtoms::command, command);
   if (!command.IsEmpty()) {
     nsCOMPtr<nsIDocument> doc;
-    mContent->GetDocument(*getter_AddRefs(doc));
+    mContent->GetDocument(getter_AddRefs(doc));
     nsCOMPtr<nsIDOMDocument> domDoc(do_QueryInterface(doc));
     nsCOMPtr<nsIDOMElement> commandElt;
     domDoc->GetElementById(command, getter_AddRefs(commandElt));
@@ -362,7 +362,7 @@ nsMenuItem :: UncheckRadioSiblings ( nsIContent* inCheckedContent )
     return;
   
   nsCOMPtr<nsIContent> parent;
-  inCheckedContent->GetParent(*getter_AddRefs(parent));
+  inCheckedContent->GetParent(getter_AddRefs(parent));
   if ( !parent )
     return;
 
diff --git a/widget/src/mac/nsMenuItemX.cpp b/widget/src/mac/nsMenuItemX.cpp
index bd89311ccd52..b6e5e1be5c1b 100644
--- a/widget/src/mac/nsMenuItemX.cpp
+++ b/widget/src/mac/nsMenuItemX.cpp
@@ -307,7 +307,7 @@ nsMenuItemX :: UncheckRadioSiblings(nsIContent* inCheckedContent)
     return;
   
   nsCOMPtr<nsIContent> parent;
-  inCheckedContent->GetParent(*getter_AddRefs(parent));
+  inCheckedContent->GetParent(getter_AddRefs(parent));
   if ( !parent )
     return;
 
diff --git a/widget/src/mac/nsMenuX.cpp b/widget/src/mac/nsMenuX.cpp
index 5ff5ba0ab108..318f8de97437 100644
--- a/widget/src/mac/nsMenuX.cpp
+++ b/widget/src/mac/nsMenuX.cpp
@@ -878,7 +878,7 @@ void nsMenuX::LoadMenuItem( nsIMenu* inParentMenu, nsIContent* inMenuItemContent
 
     // Try to find the key node. Get the document so we can do |GetElementByID|
     nsCOMPtr<nsIDocument> document;
-    inMenuItemContent->GetDocument(*getter_AddRefs(document));
+    inMenuItemContent->GetDocument(getter_AddRefs(document));
     if ( !document ) 
       return;
     nsCOMPtr<nsIDOMDocument> domDocument = do_QueryInterface(document);
@@ -1027,7 +1027,7 @@ nsMenuX::OnCreate()
   // be updated.
   if (popupContent) {
     nsCOMPtr<nsIDocument> doc;
-    popupContent->GetDocument(*getter_AddRefs(doc));
+    popupContent->GetDocument(getter_AddRefs(doc));
     nsCOMPtr<nsIDOMDocument> domDoc(do_QueryInterface(doc));
 
     PRInt32 count;
@@ -1036,7 +1036,7 @@ nsMenuX::OnCreate()
       nsCOMPtr<nsIContent> grandChild;
       popupContent->ChildAt(i, *getter_AddRefs(grandChild));
       nsCOMPtr<nsIAtom> tag;
-      grandChild->GetTag(*getter_AddRefs(tag));
+      grandChild->GetTag(getter_AddRefs(tag));
       if (tag.get() == nsWidgetAtoms::menuitem) {
         // See if we have a command attribute.
         nsAutoString command;
diff --git a/widget/src/xpwidgets/nsBaseDragService.cpp b/widget/src/xpwidgets/nsBaseDragService.cpp
index d26b4c79eece..80f22c277588 100644
--- a/widget/src/xpwidgets/nsBaseDragService.cpp
+++ b/widget/src/xpwidgets/nsBaseDragService.cpp
@@ -261,7 +261,7 @@ nsBaseDragService :: GetFrameFromNode ( nsIDOMNode* inNode, nsIFrame** outFrame,
   nsCOMPtr<nsIDocument>	doc;
   nsCOMPtr<nsIContent> contentNode = do_QueryInterface(inNode);
   if (contentNode) {
-    contentNode->GetDocument(*getter_AddRefs(doc));
+    contentNode->GetDocument(getter_AddRefs(doc));
     if (doc) {
       nsCOMPtr<nsIPresShell> presShell;
       doc->GetShellAt(0, getter_AddRefs(presShell));
diff --git a/xpfe/appshell/src/nsAppShellWindowEnumerator.cpp b/xpfe/appshell/src/nsAppShellWindowEnumerator.cpp
index 84bf7e9b26c0..78fb5669dc40 100644
--- a/xpfe/appshell/src/nsAppShellWindowEnumerator.cpp
+++ b/xpfe/appshell/src/nsAppShellWindowEnumerator.cpp
@@ -84,7 +84,7 @@ nsCOMPtr<nsIDOMNode> GetDOMNodeFromDocShell(nsIDocShell *aShell)
     nsCOMPtr<nsIDocumentViewer> docv(do_QueryInterface(cv));
     if (docv) {
       nsCOMPtr<nsIDocument> doc;
-      docv->GetDocument(*getter_AddRefs(doc));
+      docv->GetDocument(getter_AddRefs(doc));
       if (doc) {
         nsCOMPtr<nsIDOMDocument> domdoc(do_QueryInterface(doc));
         if (domdoc) {
diff --git a/xpfe/appshell/src/nsWebShellWindow.cpp b/xpfe/appshell/src/nsWebShellWindow.cpp
index cfc73323116c..fdc6ade754d9 100644
--- a/xpfe/appshell/src/nsWebShellWindow.cpp
+++ b/xpfe/appshell/src/nsWebShellWindow.cpp
@@ -722,7 +722,7 @@ NS_IMETHODIMP nsWebShellWindow::LoadMenuItem(
     // Try to find the key node.
     nsCOMPtr<nsIDocument> document;
     nsCOMPtr<nsIContent> content = do_QueryInterface(domElement);
-    if (NS_FAILED(rv = content->GetDocument(*getter_AddRefs(document)))) {
+    if (NS_FAILED(rv = content->GetDocument(getter_AddRefs(document)))) {
       NS_ERROR("Unable to retrieve the document.");
       return rv;
     }
@@ -957,7 +957,7 @@ void nsWebShellWindow::DynamicLoadMenus(nsIDOMDocument * aDOMDoc, nsIWidget * aP
       }
 
       nsCOMPtr<nsIPresContext> presContext;
-      if (NS_FAILED(rv = docViewer->GetPresContext(*getter_AddRefs(presContext)))) {
+      if (NS_FAILED(rv = docViewer->GetPresContext(getter_AddRefs(presContext)))) {
           NS_ERROR("Unable to retrieve the doc viewer's presentation context.");
           return;
       }
@@ -1256,7 +1256,7 @@ nsWebShellWindow::OnStateChange(nsIWebProgress *aProgress,
       return NS_OK;
 
     nsCOMPtr<nsIDocument> doc;
-    docv->GetDocument(*getter_AddRefs(doc));
+    docv->GetDocument(getter_AddRefs(doc));
     if (!doc)
       return NS_OK;
 
@@ -1383,7 +1383,7 @@ nsCOMPtr<nsIDOMDocument> nsWebShellWindow::GetNamedDOMDoc(const nsAString & aWeb
     return domDoc;
 
   nsCOMPtr<nsIDocument> doc;
-  docv->GetDocument(*getter_AddRefs(doc));
+  docv->GetDocument(getter_AddRefs(doc));
   if (doc)
     return nsCOMPtr<nsIDOMDocument>(do_QueryInterface(doc));
 
@@ -1407,7 +1407,7 @@ void nsWebShellWindow::LoadContentAreas() {
     nsCOMPtr<nsIDocumentViewer> docViewer = do_QueryInterface(contentViewer);
     if (docViewer) {
       nsCOMPtr<nsIDocument> doc;
-      docViewer->GetDocument(*getter_AddRefs(doc));
+      docViewer->GetDocument(getter_AddRefs(doc));
       nsCOMPtr<nsIURI> mainURL;
       doc->GetDocumentURL(getter_AddRefs(mainURL));
       if (mainURL) {
@@ -1491,7 +1491,7 @@ PRBool nsWebShellWindow::ExecuteCloseHandler()
         nsCOMPtr<nsIDocumentViewer> docViewer;
         nsCOMPtr<nsIPresContext> presContext;
         docViewer = do_QueryInterface(contentViewer);
-        if (docViewer && NS_SUCCEEDED(docViewer->GetPresContext(*getter_AddRefs(presContext)))) {
+        if (docViewer && NS_SUCCEEDED(docViewer->GetPresContext(getter_AddRefs(presContext)))) {
           nsEventStatus status = nsEventStatus_eIgnore;
           nsMouseEvent event;
           event.eventStructType = NS_EVENT;
@@ -1641,7 +1641,7 @@ NS_IMETHODIMP nsWebShellWindow::Destroy()
    if(docv)
       {
       nsCOMPtr<nsIDocument> doc;
-      docv->GetDocument(*getter_AddRefs(doc));
+      docv->GetDocument(getter_AddRefs(doc));
       if(doc)
          doc->RemoveObserver(NS_STATIC_CAST(nsIDocumentObserver*, this));
       }
diff --git a/xpfe/appshell/src/nsXULWindow.cpp b/xpfe/appshell/src/nsXULWindow.cpp
index 4561a9377317..89abb06597fa 100644
--- a/xpfe/appshell/src/nsXULWindow.cpp
+++ b/xpfe/appshell/src/nsXULWindow.cpp
@@ -367,7 +367,7 @@ NS_IMETHODIMP nsXULWindow::Destroy()
    if(docv)
       {
       nsCOMPtr<nsIDocument> doc;
-      docv->GetDocument(*getter_AddRefs(doc));
+      docv->GetDocument(getter_AddRefs(doc));
 /*      if(doc)
          doc->RemoveObserver(NS_STATIC_CAST(nsIDocumentObserver*, this));  */
       }
@@ -1402,7 +1402,7 @@ NS_IMETHODIMP nsXULWindow::GetWindowDOMElement(nsIDOMElement** aDOMElement)
       return NS_ERROR_FAILURE;
 
    nsCOMPtr<nsIDocument> doc;
-   docv->GetDocument(*getter_AddRefs(doc));
+   docv->GetDocument(getter_AddRefs(doc));
    nsCOMPtr<nsIDOMDocument> domdoc(do_QueryInterface(doc));
    if(!domdoc) 
       return NS_ERROR_FAILURE;
@@ -1432,7 +1432,7 @@ NS_IMETHODIMP nsXULWindow::GetDOMElementById(char* aID, nsIDOMElement** aDOMElem
       return NS_ERROR_FAILURE;
 
    nsCOMPtr<nsIDocument> doc;
-   docv->GetDocument(*getter_AddRefs(doc));
+   docv->GetDocument(getter_AddRefs(doc));
    nsCOMPtr<nsIDOMDocument> domdoc(do_QueryInterface(doc));
    if(!domdoc) 
       return NS_ERROR_FAILURE;