Bug 1423167: Move most attribute-related methods from nsIContent to Element. r=bz

MozReview-Commit-ID: 6WXqNiODttD

accessible/base/ARIAMap.cpp

@@ -1386,7 +1386,7 @@ bool
 AttrIterator::Next(nsAString& aAttrName, nsAString& aAttrValue)
 {
   while (mAttrIdx < mAttrCount) {
-    const nsAttrName* attr = mContent->GetAttrNameAt(mAttrIdx);
+    const nsAttrName* attr = mElement->GetAttrNameAt(mAttrIdx);
     mAttrIdx++;
     if (attr->NamespaceEquals(kNameSpaceID_None)) {
       nsAtom* attrAtom = attr->Atom();
@@ -1399,17 +1399,17 @@ AttrIterator::Next(nsAString& aAttrName, nsAString& aAttrValue)
         continue; // No need to handle exposing as obj attribute here
 
       if ((attrFlags & ATTR_VALTOKEN) &&
-           !nsAccUtils::HasDefinedARIAToken(mContent, attrAtom))
+           !nsAccUtils::HasDefinedARIAToken(mElement, attrAtom))
         continue; // only expose token based attributes if they are defined
 
       if ((attrFlags & ATTR_BYPASSOBJ_IF_FALSE) &&
-          mContent->AttrValueIs(kNameSpaceID_None, attrAtom,
+          mElement->AttrValueIs(kNameSpaceID_None, attrAtom,
                                 nsGkAtoms::_false, eCaseMatters)) {
         continue; // only expose token based attribute if value is not 'false'.
       }
 
       nsAutoString value;
-      if (mContent->GetAttr(kNameSpaceID_None, attrAtom, value)) {
+      if (mElement->GetAttr(kNameSpaceID_None, attrAtom, value)) {
         aAttrName.Assign(Substring(attrStr, 5));
         aAttrValue.Assign(value);
         return true;

accessible/base/ARIAMap.h

@@ -14,6 +14,7 @@
 
 #include "nsAtom.h"
 #include "nsIContent.h"
+#include "mozilla/dom/Element.h"
 
 class nsINode;
 
@@ -288,10 +289,11 @@ bool HasDefinedARIAHidden(nsIContent* aContent);
 class AttrIterator
 {
 public:
-  explicit AttrIterator(nsIContent* aContent) :
+  explicit AttrIterator(nsIContent* aContent)
-    mContent(aContent), mAttrIdx(0)
+    : mElement(aContent->IsElement() ? aContent->AsElement() : nullptr)
+    , mAttrIdx(0)
   {
-    mAttrCount = mContent->GetAttrCount();
+    mAttrCount = mElement ? mElement->GetAttrCount() : 0;
   }
 
   bool Next(nsAString& aAttrName, nsAString& aAttrValue);
@@ -301,7 +303,7 @@ private:
   AttrIterator(const AttrIterator&) = delete;
   AttrIterator& operator= (const AttrIterator&) = delete;
 
-  nsIContent* mContent;
+  dom::Element* mElement;
   uint32_t mAttrIdx;
   uint32_t mAttrCount;
 };

accessible/base/nsAccessibilityService.cpp

@@ -114,20 +114,22 @@ MustBeAccessible(nsIContent* aContent, DocAccessible* aDocument)
   if (aContent->GetPrimaryFrame()->IsFocusable())
     return true;
 
-  uint32_t attrCount = aContent->GetAttrCount();
+  if (aContent->IsElement()) {
-  for (uint32_t attrIdx = 0; attrIdx < attrCount; attrIdx++) {
+    uint32_t attrCount = aContent->AsElement()->GetAttrCount();
-    const nsAttrName* attr = aContent->GetAttrNameAt(attrIdx);
+    for (uint32_t attrIdx = 0; attrIdx < attrCount; attrIdx++) {
-    if (attr->NamespaceEquals(kNameSpaceID_None)) {
+      const nsAttrName* attr = aContent->AsElement()->GetAttrNameAt(attrIdx);
-      nsAtom* attrAtom = attr->Atom();
+      if (attr->NamespaceEquals(kNameSpaceID_None)) {
-      nsDependentAtomString attrStr(attrAtom);
+        nsAtom* attrAtom = attr->Atom();
-      if (!StringBeginsWith(attrStr, NS_LITERAL_STRING("aria-")))
+        nsDependentAtomString attrStr(attrAtom);
-        continue; // not ARIA
+        if (!StringBeginsWith(attrStr, NS_LITERAL_STRING("aria-")))
+          continue; // not ARIA
 
-      // A global state or a property and in case of token defined.
+        // A global state or a property and in case of token defined.
-      uint8_t attrFlags = aria::AttrCharacteristicsFor(attrAtom);
+        uint8_t attrFlags = aria::AttrCharacteristicsFor(attrAtom);
-      if ((attrFlags & ATTR_GLOBAL) && (!(attrFlags & ATTR_VALTOKEN) ||
+        if ((attrFlags & ATTR_GLOBAL) && (!(attrFlags & ATTR_VALTOKEN) ||
-           nsAccUtils::HasDefinedARIAToken(aContent, attrAtom))) {
+             nsAccUtils::HasDefinedARIAToken(aContent, attrAtom))) {
-        return true;
+          return true;
+        }
       }
     }
   }

accessible/generic/ARIAGridAccessible.cpp

@@ -465,16 +465,18 @@ ARIAGridAccessible::SetARIASelected(Accessible* aAccessible,
   if (IsARIARole(nsGkAtoms::table))
     return NS_OK;
 
-  nsIContent *content = aAccessible->GetContent();
+  nsIContent* content = aAccessible->GetContent();
   NS_ENSURE_STATE(content);
 
   nsresult rv = NS_OK;
-  if (aIsSelected)
+  if (content->IsElement()) {
-    rv = content->SetAttr(kNameSpaceID_None, nsGkAtoms::aria_selected,
+    if (aIsSelected)
-                          NS_LITERAL_STRING("true"), aNotify);
+      rv = content->AsElement()->SetAttr(kNameSpaceID_None, nsGkAtoms::aria_selected,
-  else
+                                         NS_LITERAL_STRING("true"), aNotify);
-    rv = content->SetAttr(kNameSpaceID_None, nsGkAtoms::aria_selected,
+    else
-                          NS_LITERAL_STRING("false"), aNotify);
+      rv = content->AsElement()->SetAttr(kNameSpaceID_None, nsGkAtoms::aria_selected,
+                                         NS_LITERAL_STRING("false"), aNotify);
+  }
 
   NS_ENSURE_SUCCESS(rv, rv);
 

accessible/generic/Accessible.cpp

@@ -704,12 +704,14 @@ Accessible::SetSelected(bool aSelect)
   Accessible* select = nsAccUtils::GetSelectableContainer(this, State());
   if (select) {
     if (select->State() & states::MULTISELECTABLE) {
-      if (ARIARoleMap()) {
+      if (mContent->IsElement() && ARIARoleMap()) {
         if (aSelect) {
-          mContent->SetAttr(kNameSpaceID_None, nsGkAtoms::aria_selected,
+          mContent->AsElement()->SetAttr(kNameSpaceID_None,
-                            NS_LITERAL_STRING("true"), true);
+                                         nsGkAtoms::aria_selected,
+                                         NS_LITERAL_STRING("true"), true);
         } else {
-          mContent->UnsetAttr(kNameSpaceID_None, nsGkAtoms::aria_selected, true);
+          mContent->AsElement()->UnsetAttr(kNameSpaceID_None,
+                                           nsGkAtoms::aria_selected, true);
         }
       }
       return;
@@ -1416,8 +1418,12 @@ Accessible::SetCurValue(double aValue)
   nsAutoString strValue;
   strValue.AppendFloat(aValue);
 
+  if (!mContent->IsElement())
+    return true;
+
   return NS_SUCCEEDED(
-    mContent->SetAttr(kNameSpaceID_None, nsGkAtoms::aria_valuenow, strValue, true));
+    mContent->AsElement()->SetAttr(kNameSpaceID_None, nsGkAtoms::aria_valuenow,
+                                   strValue, true));
 }
 
 role
@@ -2570,8 +2576,10 @@ Accessible::SetCurrentItem(Accessible* aItem)
   if (id) {
     nsAutoString idStr;
     id->ToString(idStr);
-    mContent->SetAttr(kNameSpaceID_None,
+    mContent->AsElement()->SetAttr(kNameSpaceID_None,
-                      nsGkAtoms::aria_activedescendant, idStr, true);
+                                   nsGkAtoms::aria_activedescendant,
+                                   idStr,
+                                   true);
   }
 }
 

accessible/html/HTMLSelectAccessible.cpp

@@ -110,9 +110,13 @@ HTMLSelectListAccessible::CurrentItem()
 void
 HTMLSelectListAccessible::SetCurrentItem(Accessible* aItem)
 {
-  aItem->GetContent()->SetAttr(kNameSpaceID_None,
+  if (!aItem->GetContent()->IsElement())
-                               nsGkAtoms::selected, NS_LITERAL_STRING("true"),
+    return;
-                               true);
+
+  aItem->GetContent()->AsElement()->SetAttr(kNameSpaceID_None,
+                                            nsGkAtoms::selected,
+                                            NS_LITERAL_STRING("true"),
+                                            true);
 }
 
 bool

accessible/xul/XULSliderAccessible.cpp

@@ -13,7 +13,8 @@
 #include "mozilla/dom/Element.h"
 #include "mozilla/FloatingPoint.h"
 
-using namespace mozilla::a11y;
+namespace mozilla {
+namespace a11y {
 
 ////////////////////////////////////////////////////////////////////////////////
 // XULSliderAccessible
@@ -40,7 +41,7 @@ XULSliderAccessible::NativeInteractiveState() const
   if (NativelyUnavailable())
     return states::UNAVAILABLE;
 
-  nsIContent* sliderElm = GetSliderElement();
+  dom::Element* sliderElm = GetSliderElement();
   if (sliderElm) {
     nsIFrame* frame = sliderElm->GetPrimaryFrame();
     if (frame && frame->IsFocusable())
@@ -83,7 +84,7 @@ XULSliderAccessible::DoAction(uint8_t aIndex)
   if (aIndex != 0)
     return false;
 
-  nsIContent* sliderElm = GetSliderElement();
+  dom::Element* sliderElm = GetSliderElement();
   if (sliderElm)
     DoCommand(sliderElm);
 
@@ -129,17 +130,17 @@ XULSliderAccessible::SetCurValue(double aValue)
 
 // Utils
 
-nsIContent*
+dom::Element*
 XULSliderAccessible::GetSliderElement() const
 {
-  if (!mSliderNode) {
+  if (!mSliderElement) {
     // XXX: we depend on anonymous content.
-    mSliderNode = mContent->OwnerDoc()->
+    mSliderElement = mContent->OwnerDoc()->
       GetAnonymousElementByAttribute(mContent, nsGkAtoms::anonid,
                                      NS_LITERAL_STRING("slider"));
   }
 
-  return mSliderNode;
+  return mSliderElement;
 }
 
 nsresult
@@ -163,8 +164,7 @@ XULSliderAccessible::SetSliderAttr(nsAtom* aName, const nsAString& aValue)
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  nsIContent* sliderElm = GetSliderElement();
+  if (dom::Element* sliderElm = GetSliderElement())
-  if (sliderElm)
     sliderElm->SetAttr(kNameSpaceID_None, aName, aValue, true);
 
   return NS_OK;
@@ -212,3 +212,5 @@ XULThumbAccessible::NativeRole()
   return roles::INDICATOR;
 }
 
+}
+}

accessible/xul/XULSliderAccessible.h

@@ -43,7 +43,7 @@ protected:
   /**
    * Return anonymous slider element.
    */
-  nsIContent* GetSliderElement() const;
+  dom::Element* GetSliderElement() const;
 
   nsresult GetSliderAttr(nsAtom *aName, nsAString& aValue) const;
   nsresult SetSliderAttr(nsAtom *aName, const nsAString& aValue);
@@ -52,7 +52,7 @@ protected:
   bool SetSliderAttr(nsAtom *aName, double aValue);
 
 private:
-  mutable nsCOMPtr<nsIContent> mSliderNode;
+  mutable RefPtr<dom::Element> mSliderElement;
 };
 
 

dom/base/DocumentFragment.h

@@ -69,33 +69,6 @@ public:
 
   virtual JSObject* WrapNode(JSContext *aCx, JS::Handle<JSObject*> aGivenProto) override;
 
-  // nsIContent
-  using nsIContent::SetAttr;
-  virtual nsresult SetAttr(int32_t aNameSpaceID, nsAtom* aName,
-                           nsAtom* aPrefix, const nsAString& aValue,
-                           nsIPrincipal* aSubjectPrincipal,
-                           bool aNotify) override
-  {
-    return NS_OK;
-  }
-  virtual nsresult UnsetAttr(int32_t aNameSpaceID, nsAtom* aAttribute,
-                             bool aNotify) override
-  {
-    return NS_OK;
-  }
-  virtual const nsAttrName* GetAttrNameAt(uint32_t aIndex) const override
-  {
-    return nullptr;
-  }
-  virtual BorrowedAttrInfo GetAttrInfoAt(uint32_t aIndex) const override
-  {
-    return BorrowedAttrInfo(nullptr, nullptr);
-  }
-  virtual uint32_t GetAttrCount() const override
-  {
-    return 0;
-  }
-
   virtual bool IsNodeOfType(uint32_t aFlags) const override;
 
   virtual nsIDOMNode* AsDOMNode() override { return this; }

dom/base/Element.h

@@ -430,6 +430,11 @@ public:
   virtual nsChangeHint GetAttributeChangeHint(const nsAtom* aAttribute,
                                               int32_t aModType) const;
 
+  NS_IMETHOD WalkContentStyleRules(nsRuleWalker* aRuleWalker)
+  {
+    return NS_OK;
+  }
+
   inline Directionality GetDirectionality() const {
     if (HasFlag(NODE_HAS_DIRECTION_RTL)) {
       return eDir_RTL;
@@ -697,8 +702,6 @@ public:
   already_AddRefed<mozilla::dom::NodeInfo>
   GetExistingAttrNameFromQName(const nsAString& aStr) const;
 
-  using nsIContent::SetAttr;
-
   /**
    * Helper for SetAttr/SetParsedAttr. This method will return true if aNotify
    * is true or there are mutation listeners that must be triggered, the
@@ -758,9 +761,6 @@ public:
    */
   nsresult SetSingleClassFromParser(nsAtom* aSingleClassName);
 
-  virtual nsresult SetAttr(int32_t aNameSpaceID, nsAtom* aName, nsAtom* aPrefix,
-                           const nsAString& aValue, nsIPrincipal* aSubjectPrincipal,
-                           bool aNotify) override;
   // aParsedValue receives the old value of the attribute. That's useful if
   // either the input or output value of aParsedValue is StoresOwnData.
   nsresult SetParsedAttr(int32_t aNameSpaceID, nsAtom* aName, nsAtom* aPrefix,
@@ -777,19 +777,97 @@ public:
   inline bool AttrValueIs(int32_t aNameSpaceID, nsAtom* aName,
                           nsAtom* aValue,
                           nsCaseTreatment aCaseSensitive) const;
-  virtual int32_t FindAttrValueIn(int32_t aNameSpaceID,
+  int32_t FindAttrValueIn(int32_t aNameSpaceID,
-                                  nsAtom* aName,
+                          nsAtom* aName,
-                                  AttrValuesArray* aValues,
+                          AttrValuesArray* aValues,
-                                  nsCaseTreatment aCaseSensitive) const override;
+                          nsCaseTreatment aCaseSensitive) const override;
-  virtual nsresult UnsetAttr(int32_t aNameSpaceID, nsAtom* aAttribute,
-                             bool aNotify) override;
 
-  virtual const nsAttrName* GetAttrNameAt(uint32_t aIndex) const final override
+  /**
+   * Set attribute values. All attribute values are assumed to have a
+   * canonical string representation that can be used for these
+   * methods. The SetAttr method is assumed to perform a translation
+   * of the canonical form into the underlying content specific
+   * form.
+   *
+   * @param aNameSpaceID the namespace of the attribute
+   * @param aName the name of the attribute
+   * @param aValue the value to set
+   * @param aNotify specifies how whether or not the document should be
+   *        notified of the attribute change.
+   */
+  nsresult SetAttr(int32_t aNameSpaceID, nsAtom* aName,
+                   const nsAString& aValue, bool aNotify)
+  {
+    return SetAttr(aNameSpaceID, aName, nullptr, aValue, aNotify);
+  }
+  nsresult SetAttr(int32_t aNameSpaceID, nsAtom* aName, nsAtom* aPrefix,
+                   const nsAString& aValue, bool aNotify)
+  {
+    return SetAttr(aNameSpaceID, aName, aPrefix, aValue, nullptr, aNotify);
+  }
+  nsresult SetAttr(int32_t aNameSpaceID, nsAtom* aName, const nsAString& aValue,
+                   nsIPrincipal* aTriggeringPrincipal, bool aNotify)
+  {
+    return SetAttr(aNameSpaceID, aName, nullptr, aValue, aTriggeringPrincipal, aNotify);
+  }
+
+  /**
+   * Set attribute values. All attribute values are assumed to have a
+   * canonical String representation that can be used for these
+   * methods. The SetAttr method is assumed to perform a translation
+   * of the canonical form into the underlying content specific
+   * form.
+   *
+   * @param aNameSpaceID the namespace of the attribute
+   * @param aName the name of the attribute
+   * @param aPrefix the prefix of the attribute
+   * @param aValue the value to set
+   * @param aMaybeScriptedPrincipal the principal of the scripted caller responsible
+   *        for setting the attribute, or null if no scripted caller can be
+   *        determined. A null value here does not guarantee that there is no
+   *        scripted caller, but a non-null value does guarantee that a scripted
+   *        caller with the given principal is directly responsible for the
+   *        attribute change.
+   * @param aNotify specifies how whether or not the document should be
+   *        notified of the attribute change.
+   */
+  virtual nsresult SetAttr(int32_t aNameSpaceID, nsAtom* aName,
+                           nsAtom* aPrefix, const nsAString& aValue,
+                           nsIPrincipal* aMaybeScriptedPrincipal,
+                           bool aNotify);
+
+  /**
+   * Remove an attribute so that it is no longer explicitly specified.
+   *
+   * @param aNameSpaceID the namespace id of the attribute
+   * @param aAttr the name of the attribute to unset
+   * @param aNotify specifies whether or not the document should be
+   * notified of the attribute change
+   */
+  virtual nsresult UnsetAttr(int32_t aNameSpaceID,
+                             nsAtom* aAttribute,
+                             bool aNotify);
+
+  /**
+   * Get the namespace / name / prefix of a given attribute.
+   *
+   * @param   aIndex the index of the attribute name
+   * @returns The name at the given index, or null if the index is
+   *          out-of-bounds.
+   * @note    The document returned by NodeInfo()->GetDocument() (if one is
+   *          present) is *not* necessarily the owner document of the element.
+   * @note    The pointer returned by this function is only valid until the
+   *          next call of either GetAttrNameAt or SetAttr on the element.
+   */
+  const nsAttrName* GetAttrNameAt(uint32_t aIndex) const
   {
     return mAttrsAndChildren.GetSafeAttrNameAt(aIndex);
   }
 
-  virtual BorrowedAttrInfo GetAttrInfoAt(uint32_t aIndex) const final override
+  /**
+   * Gets the attribute info (name and value) for this element at a given index.
+   */
+  BorrowedAttrInfo GetAttrInfoAt(uint32_t aIndex) const
   {
     if (aIndex >= mAttrsAndChildren.AttrCount()) {
       return BorrowedAttrInfo(nullptr, nullptr);
@@ -798,7 +876,12 @@ public:
     return mAttrsAndChildren.AttrInfoAt(aIndex);
   }
 
-  virtual uint32_t GetAttrCount() const final override
+  /**
+   * Get the number of all specified attributes.
+   *
+   * @return the number of attributes
+   */
+  uint32_t GetAttrCount() const
   {
     return mAttrsAndChildren.AttrCount();
   }
@@ -1466,7 +1549,7 @@ public:
 
   void SetAttr(nsAtom* aAttr, const nsAString& aValue, nsIPrincipal& aTriggeringPrincipal, ErrorResult& aError)
   {
-    aError = nsIContent::SetAttr(kNameSpaceID_None, aAttr, aValue, &aTriggeringPrincipal, true);
+    aError = SetAttr(kNameSpaceID_None, aAttr, aValue, &aTriggeringPrincipal, true);
   }
 
   /**

dom/base/FragmentOrElement.cpp

@@ -391,7 +391,8 @@ nsIContent::LookupNamespaceURIInternal(const nsAString& aNamespacePrefix,
   // declaration that declares aNamespacePrefix.
   const nsIContent* content = this;
   do {
-    if (content->GetAttr(kNameSpaceID_XMLNS, name, aNamespaceURI))
+    if (content->IsElement() &&
+        content->AsElement()->GetAttr(kNameSpaceID_XMLNS, name, aNamespaceURI))
       return NS_OK;
   } while ((content = content->GetParent()));
   return NS_ERROR_FAILURE;
@@ -401,11 +402,14 @@ nsAtom*
 nsIContent::GetLang() const
 {
   for (const auto* content = this; content; content = content->GetParent()) {
-    if (!content->GetAttrCount() || !content->IsElement()) {
+    if (!content->IsElement()) {
       continue;
     }
 
     auto* element = content->AsElement();
+    if (!element->GetAttrCount()) {
+      continue;
+    }
 
     // xml:lang has precedence over lang on HTML elements (see
     // XHTML1 section C.7).
@@ -1179,12 +1183,6 @@ nsIContent::IsFocusableInternal(int32_t* aTabIndex, bool aWithMouse)
   return false;
 }
 
-NS_IMETHODIMP
-FragmentOrElement::WalkContentStyleRules(nsRuleWalker* aRuleWalker)
-{
-  return NS_OK;
-}
-
 bool
 FragmentOrElement::IsLink(nsIURI** aURI) const
 {
@@ -2241,8 +2239,8 @@ FragmentOrElement::CopyInnerTo(FragmentOrElement* aDst,
     const nsAttrValue* value = mAttrsAndChildren.AttrAt(i);
     nsAutoString valStr;
     value->ToString(valStr);
-    rv = aDst->SetAttr(name->NamespaceID(), name->LocalName(),
+    rv = aDst->AsElement()->SetAttr(name->NamespaceID(), name->LocalName(),
-                                name->GetPrefix(), valStr, false);
+                                    name->GetPrefix(), valStr, false);
     NS_ENSURE_SUCCESS(rv, rv);
   }
 

dom/base/FragmentOrElement.h

@@ -165,8 +165,6 @@ public:
   virtual void DestroyContent() override;
   virtual void SaveSubtreeState() override;
 
-  NS_IMETHOD WalkContentStyleRules(nsRuleWalker* aRuleWalker) override;
-
   nsIHTMLCollection* Children();
   uint32_t ChildElementCount()
   {

dom/base/nsContentCreatorFunctions.h

@@ -63,7 +63,7 @@ NS_NewXULElement(mozilla::dom::Element** aResult,
                  mozilla::dom::FromParser aFromParser);
 
 void
-NS_TrustedNewXULElement(nsIContent** aResult,
+NS_TrustedNewXULElement(mozilla::dom::Element** aResult,
                         already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo);
 #endif
 

dom/base/nsContentUtils.cpp

@@ -5058,13 +5058,13 @@ nsContentUtils::CreateContextualFragment(nsINode* aContextNode,
     tagName = content->NodeInfo()->QualifiedName();
 
     // see if we need to add xmlns declarations
-    uint32_t count = content->GetAttrCount();
+    uint32_t count = content->AsElement()->GetAttrCount();
     bool setDefaultNamespace = false;
     if (count > 0) {
       uint32_t index;
 
       for (index = 0; index < count; index++) {
-        const BorrowedAttrInfo info = content->GetAttrInfoAt(index);
+        const BorrowedAttrInfo info = content->AsElement()->GetAttrInfoAt(index);
         const nsAttrName* name = info.mName;
         if (name->NamespaceEquals(kNameSpaceID_XMLNS)) {
           info.mValue->ToString(uriStr);

dom/base/nsDocument.cpp

@@ -421,10 +421,10 @@ nsIdentifierMapEntry::GetImageIdElement()
 }
 
 void
-nsIdentifierMapEntry::AppendAllIdContent(nsCOMArray<nsIContent>* aElements)
+nsIdentifierMapEntry::AppendAllIdContent(nsCOMArray<Element>* aElements)
 {
-  for (size_t i = 0; i < mIdContentList.Length(); ++i) {
+  for (Element* element : mIdContentList) {
-    aElements->AppendObject(mIdContentList[i]);
+    aElements->AppendObject(element);
   }
 }
 

dom/base/nsGenericDOMDataNode.cpp

@@ -637,40 +637,6 @@ nsGenericDOMDataNode::GetChildren(uint32_t aFilter)
   return nullptr;
 }
 
-nsresult
-nsGenericDOMDataNode::SetAttr(int32_t aNameSpaceID, nsAtom* aAttr,
-                              nsAtom* aPrefix, const nsAString& aValue,
-                              nsIPrincipal* aContentPrincipal,
-                              bool aNotify)
-{
-  return NS_OK;
-}
-
-nsresult
-nsGenericDOMDataNode::UnsetAttr(int32_t aNameSpaceID, nsAtom* aAttr,
-                                bool aNotify)
-{
-  return NS_OK;
-}
-
-const nsAttrName*
-nsGenericDOMDataNode::GetAttrNameAt(uint32_t aIndex) const
-{
-  return nullptr;
-}
-
-BorrowedAttrInfo
-nsGenericDOMDataNode::GetAttrInfoAt(uint32_t aIndex) const
-{
-  return BorrowedAttrInfo(nullptr, nullptr);
-}
-
-uint32_t
-nsGenericDOMDataNode::GetAttrCount() const
-{
-  return 0;
-}
-
 uint32_t
 nsGenericDOMDataNode::GetChildCount() const
 {
@@ -683,6 +649,7 @@ nsGenericDOMDataNode::GetChildAt(uint32_t aIndex) const
   return nullptr;
 }
 
+
 int32_t
 nsGenericDOMDataNode::IndexOf(const nsINode* aPossibleChild) const
 {
@@ -1123,26 +1090,6 @@ nsGenericDOMDataNode::GetCurrentValueAtom()
   return NS_Atomize(val);
 }
 
-NS_IMETHODIMP
-nsGenericDOMDataNode::WalkContentStyleRules(nsRuleWalker* aRuleWalker)
-{
-  return NS_OK;
-}
-
-NS_IMETHODIMP_(bool)
-nsGenericDOMDataNode::IsAttributeMapped(const nsAtom* aAttribute) const
-{
-  return false;
-}
-
-nsChangeHint
-nsGenericDOMDataNode::GetAttributeChangeHint(const nsAtom* aAttribute,
-                                             int32_t aModType) const
-{
-  NS_NOTREACHED("Shouldn't be calling this!");
-  return nsChangeHint(0);
-}
-
 void
 nsGenericDOMDataNode::AddSizeOfExcludingThis(nsWindowSizes& aSizes,
                                              size_t* aNodeSize) const

dom/base/nsGenericDOMDataNode.h

@@ -133,17 +133,6 @@ public:
 
   virtual already_AddRefed<nsINodeList> GetChildren(uint32_t aFilter) override;
 
-
-  using nsIContent::SetAttr;
-  virtual nsresult SetAttr(int32_t aNameSpaceID, nsAtom* aAttribute,
-                           nsAtom* aPrefix, const nsAString& aValue,
-                           nsIPrincipal* aSubjectPrincipal,
-                           bool aNotify) override;
-  virtual nsresult UnsetAttr(int32_t aNameSpaceID, nsAtom* aAttribute,
-                             bool aNotify) override;
-  virtual const nsAttrName* GetAttrNameAt(uint32_t aIndex) const override;
-  virtual mozilla::dom::BorrowedAttrInfo GetAttrInfoAt(uint32_t aIndex) const override;
-  virtual uint32_t GetAttrCount() const override;
   virtual const nsTextFragment *GetText() override;
   virtual uint32_t TextLength() const override;
   virtual nsresult SetText(const char16_t* aBuffer, uint32_t aLength,
@@ -184,11 +173,6 @@ public:
   virtual bool IsNodeOfType(uint32_t aFlags) const override;
   virtual bool IsLink(nsIURI** aURI) const override;
 
-  NS_IMETHOD WalkContentStyleRules(nsRuleWalker* aRuleWalker) override;
-  NS_IMETHOD_(bool) IsAttributeMapped(const nsAtom* aAttribute) const;
-  virtual nsChangeHint GetAttributeChangeHint(const nsAtom* aAttribute,
-                                              int32_t aModType) const;
-
   virtual nsresult Clone(mozilla::dom::NodeInfo *aNodeInfo, nsINode **aResult,
                          bool aPreallocateChildren) const override
   {

dom/base/nsHTMLContentSerializer.cpp

@@ -64,15 +64,15 @@ nsHTMLContentSerializer::AppendDocumentStart(nsIDocument *aDocument,
 }
 
 bool
-nsHTMLContentSerializer::SerializeHTMLAttributes(nsIContent* aContent,
+nsHTMLContentSerializer::SerializeHTMLAttributes(Element* aElement,
-                                                 nsIContent *aOriginalElement,
+                                                 Element* aOriginalElement,
                                                  nsAString& aTagPrefix,
                                                  const nsAString& aTagNamespaceURI,
                                                  nsAtom* aTagName,
                                                  int32_t aNamespace,
                                                  nsAString& aStr)
 {
-  int32_t count = aContent->GetAttrCount();
+  int32_t count = aElement->GetAttrCount();
   if (!count)
     return true;
 
@@ -81,7 +81,7 @@ nsHTMLContentSerializer::SerializeHTMLAttributes(nsIContent* aContent,
   NS_NAMED_LITERAL_STRING(_mozStr, "_moz");
 
   for (int32_t index = 0; index < count; index++) {
-    const nsAttrName* name = aContent->GetAttrNameAt(index);
+    const nsAttrName* name = aElement->GetAttrNameAt(index);
     int32_t namespaceID = name->NamespaceID();
     nsAtom* attrName = name->LocalName();
 
@@ -91,7 +91,7 @@ nsHTMLContentSerializer::SerializeHTMLAttributes(nsIContent* aContent,
         StringBeginsWith(attrNameStr, NS_LITERAL_STRING("-moz"))) {
       continue;
     }
-    aContent->GetAttr(namespaceID, attrName, valueStr);
+    aElement->GetAttr(namespaceID, attrName, valueStr);
 
     //
     // Filter out special case of <br type="_moz"> or <br _moz*>,
@@ -109,7 +109,7 @@ nsHTMLContentSerializer::SerializeHTMLAttributes(nsIContent* aContent,
       // This is handled separately in SerializeLIValueAttribute()
       continue;
     }
-    bool isJS = IsJavaScript(aContent, attrName, namespaceID, valueStr);
+    bool isJS = IsJavaScript(aElement, attrName, namespaceID, valueStr);
 
     if (((attrName == nsGkAtoms::href &&
           (namespaceID == kNameSpaceID_None ||
@@ -120,7 +120,7 @@ nsHTMLContentSerializer::SerializeHTMLAttributes(nsIContent* aContent,
         // Would be nice to handle OBJECT tags, but that gets more complicated
         // since we have to search the tag list for CODEBASE as well. For now,
         // just leave them relative.
-        nsCOMPtr<nsIURI> uri = aContent->GetBaseURI();
+        nsCOMPtr<nsIURI> uri = aElement->GetBaseURI();
         if (uri) {
           nsAutoString absURI;
           rv = NS_MakeAbsoluteURI(absURI, valueStr, uri);
@@ -137,7 +137,7 @@ nsHTMLContentSerializer::SerializeHTMLAttributes(nsIContent* aContent,
       // If we're serializing a <meta http-equiv="content-type">,
       // use the proper value, rather than what's in the document.
       nsAutoString header;
-      aContent->GetAttr(kNameSpaceID_None, nsGkAtoms::httpEquiv, header);
+      aElement->GetAttr(kNameSpaceID_None, nsGkAtoms::httpEquiv, header);
       if (header.LowerCaseEqualsLiteral("content-type")) {
         valueStr = NS_LITERAL_STRING("text/html; charset=") +
           NS_ConvertASCIItoUTF16(mCharset);
@@ -173,22 +173,20 @@ nsHTMLContentSerializer::AppendElementStart(Element* aElement,
 {
   NS_ENSURE_ARG(aElement);
 
-  nsIContent* content = aElement;
-
   bool forceFormat = false;
   nsresult rv = NS_OK;
-  if (!CheckElementStart(content, forceFormat, aStr, rv)) {
+  if (!CheckElementStart(aElement, forceFormat, aStr, rv)) {
     // When we go to AppendElementEnd for this element, we're going to
     // MaybeLeaveFromPreContent().  So make sure to MaybeEnterInPreContent()
     // now, so our PreLevel() doesn't get confused.
-    MaybeEnterInPreContent(content);
+    MaybeEnterInPreContent(aElement);
     return rv;
   }
 
   NS_ENSURE_SUCCESS(rv, rv);
 
-  nsAtom *name = content->NodeInfo()->NameAtom();
+  nsAtom *name = aElement->NodeInfo()->NameAtom();
-  int32_t ns = content->GetNameSpaceID();
+  int32_t ns = aElement->GetNameSpaceID();
 
   bool lineBreakBeforeOpen = LineBreakBeforeOpen(ns, name);
 
@@ -224,7 +222,7 @@ nsHTMLContentSerializer::AppendElementStart(Element* aElement,
 
   NS_ENSURE_TRUE(AppendToString(nsDependentAtomString(name), aStr), NS_ERROR_OUT_OF_MEMORY);
 
-  MaybeEnterInPreContent(content);
+  MaybeEnterInPreContent(aElement);
 
   // for block elements, we increase the indentation
   if ((mDoFormat || forceFormat) && !mDoRaw && !PreLevel())
@@ -264,7 +262,7 @@ nsHTMLContentSerializer::AppendElementStart(Element* aElement,
   // Even LI passed above have to go through this
   // for serializing attributes other than "value".
   nsAutoString dummyPrefix;
-  NS_ENSURE_TRUE(SerializeHTMLAttributes(content,
+  NS_ENSURE_TRUE(SerializeHTMLAttributes(aElement,
                                          aOriginalElement,
                                          dummyPrefix,
                                          EmptyString(),
@@ -287,21 +285,18 @@ nsHTMLContentSerializer::AppendElementStart(Element* aElement,
     NS_ENSURE_TRUE(AppendNewLineToString(aStr), NS_ERROR_OUT_OF_MEMORY);
   }
 
-  NS_ENSURE_TRUE(AfterElementStart(content, aOriginalElement, aStr), NS_ERROR_OUT_OF_MEMORY);
+  NS_ENSURE_TRUE(AfterElementStart(aElement, aOriginalElement, aStr), NS_ERROR_OUT_OF_MEMORY);
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsHTMLContentSerializer::AppendElementEnd(Element* aElement,
+nsHTMLContentSerializer::AppendElementEnd(Element* aElement, nsAString& aStr)
-                                          nsAString& aStr)
 {
   NS_ENSURE_ARG(aElement);
 
-  nsIContent* content = aElement;
+  nsAtom *name = aElement->NodeInfo()->NameAtom();
-
+  int32_t ns = aElement->GetNameSpaceID();
-  nsAtom *name = content->NodeInfo()->NameAtom();
-  int32_t ns = content->GetNameSpaceID();
 
   if (ns == kNameSpaceID_XHTML &&
       (name == nsGkAtoms::script ||
@@ -312,7 +307,7 @@ nsHTMLContentSerializer::AppendElementEnd(Element* aElement,
   }
 
   bool forceFormat = !(mFlags & nsIDocumentEncoder::OutputIgnoreMozDirty) &&
-                     content->HasAttr(kNameSpaceID_None, nsGkAtoms::mozdirty);
+                     aElement->HasAttr(kNameSpaceID_None, nsGkAtoms::mozdirty);
 
   if ((mDoFormat || forceFormat) && !mDoRaw && !PreLevel()) {
     DecrIndentation(name);
@@ -344,7 +339,7 @@ nsHTMLContentSerializer::AppendElementEnd(Element* aElement,
     if (!isContainer) {
       // Keep this in sync with the cleanup at the end of this method.
       MOZ_ASSERT(name != nsGkAtoms::body);
-      MaybeLeaveFromPreContent(content);
+      MaybeLeaveFromPreContent(aElement);
       return NS_OK;
     }
   }
@@ -376,7 +371,7 @@ nsHTMLContentSerializer::AppendElementEnd(Element* aElement,
   NS_ENSURE_TRUE(AppendToString(kGreaterThan, aStr), NS_ERROR_OUT_OF_MEMORY);
 
   // Keep this cleanup in sync with the IsContainer() early return above.
-  MaybeLeaveFromPreContent(content);
+  MaybeLeaveFromPreContent(aElement);
 
   if ((mDoFormat || forceFormat)&& !mDoRaw  && !PreLevel()
       && LineBreakAfterClose(ns, name)) {

dom/base/nsHTMLContentSerializer.h

@@ -17,7 +17,6 @@
 #include "nsXHTMLContentSerializer.h"
 #include "nsString.h"
 
-class nsIContent;
 class nsAtom;
 
 class nsHTMLContentSerializer final : public nsXHTMLContentSerializer {
@@ -37,8 +36,8 @@ class nsHTMLContentSerializer final : public nsXHTMLContentSerializer {
  protected:
 
   MOZ_MUST_USE
-  virtual bool SerializeHTMLAttributes(nsIContent* aContent,
+  virtual bool SerializeHTMLAttributes(mozilla::dom::Element* aContent,
-                                       nsIContent *aOriginalElement,
+                                       mozilla::dom::Element* aOriginalElement,
                                        nsAString& aTagPrefix,
                                        const nsAString& aTagNamespaceURI,
                                        nsAtom* aTagName,

dom/base/nsIContent.h

@@ -15,7 +15,6 @@
 // Forward declarations
 class nsAtom;
 class nsIURI;
-class nsRuleWalker;
 class nsAttrValue;
 class nsAttrName;
 class nsTextFragment;
@@ -356,60 +355,6 @@ public:
            mNodeInfo->NameAtom() == nsGkAtoms::mozgeneratedcontentafter;
   }
 
-  /**
-   * Set attribute values. All attribute values are assumed to have a
-   * canonical string representation that can be used for these
-   * methods. The SetAttr method is assumed to perform a translation
-   * of the canonical form into the underlying content specific
-   * form.
-   *
-   * @param aNameSpaceID the namespace of the attribute
-   * @param aName the name of the attribute
-   * @param aValue the value to set
-   * @param aNotify specifies how whether or not the document should be
-   *        notified of the attribute change.
-   */
-  nsresult SetAttr(int32_t aNameSpaceID, nsAtom* aName,
-                   const nsAString& aValue, bool aNotify)
-  {
-    return SetAttr(aNameSpaceID, aName, nullptr, aValue, aNotify);
-  }
-  nsresult SetAttr(int32_t aNameSpaceID, nsAtom* aName, nsAtom* aPrefix,
-                   const nsAString& aValue, bool aNotify)
-  {
-    return SetAttr(aNameSpaceID, aName, aPrefix, aValue, nullptr, aNotify);
-  }
-  nsresult SetAttr(int32_t aNameSpaceID, nsAtom* aName, const nsAString& aValue,
-                   nsIPrincipal* aTriggeringPrincipal, bool aNotify)
-  {
-    return SetAttr(aNameSpaceID, aName, nullptr, aValue, aTriggeringPrincipal, aNotify);
-  }
-
-  /**
-   * Set attribute values. All attribute values are assumed to have a
-   * canonical String representation that can be used for these
-   * methods. The SetAttr method is assumed to perform a translation
-   * of the canonical form into the underlying content specific
-   * form.
-   *
-   * @param aNameSpaceID the namespace of the attribute
-   * @param aName the name of the attribute
-   * @param aPrefix the prefix of the attribute
-   * @param aValue the value to set
-   * @param aMaybeScriptedPrincipal the principal of the scripted caller responsible
-   *        for setting the attribute, or null if no scripted caller can be
-   *        determined. A null value here does not guarantee that there is no
-   *        scripted caller, but a non-null value does guarantee that a scripted
-   *        caller with the given principal is directly responsible for the
-   *        attribute change.
-   * @param aNotify specifies how whether or not the document should be
-   *        notified of the attribute change.
-   */
-  virtual nsresult SetAttr(int32_t aNameSpaceID, nsAtom* aName,
-                           nsAtom* aPrefix, const nsAString& aValue,
-                           nsIPrincipal* aMaybeScriptedPrincipal,
-                           bool aNotify) = 0;
-
   /**
    * Get the current value of the attribute. This returns a form that is
    * suitable for passing back into SetAttr.
@@ -419,6 +364,8 @@ public:
    * @param aResult the value (may legitimately be the empty string) [OUT]
    * @returns true if the attribute was set (even when set to empty string)
    *          false when not set.
+   *
+   * FIXME(emilio): Move to Element.
    */
   bool GetAttr(int32_t aNameSpaceID, nsAtom* aName,
                nsAString& aResult) const;
@@ -492,43 +439,6 @@ public:
     return ATTR_MISSING;
   }
 
-  /**
-   * Remove an attribute so that it is no longer explicitly specified.
-   *
-   * @param aNameSpaceID the namespace id of the attribute
-   * @param aAttr the name of the attribute to unset
-   * @param aNotify specifies whether or not the document should be
-   * notified of the attribute change
-   */
-  virtual nsresult UnsetAttr(int32_t aNameSpaceID, nsAtom* aAttr,
-                             bool aNotify) = 0;
-
-
-  /**
-   * Get the namespace / name / prefix of a given attribute.
-   *
-   * @param   aIndex the index of the attribute name
-   * @returns The name at the given index, or null if the index is
-   *          out-of-bounds.
-   * @note    The document returned by NodeInfo()->GetDocument() (if one is
-   *          present) is *not* necessarily the owner document of the element.
-   * @note    The pointer returned by this function is only valid until the
-   *          next call of either GetAttrNameAt or SetAttr on the element.
-   */
-  virtual const nsAttrName* GetAttrNameAt(uint32_t aIndex) const = 0;
-
-  /**
-   * Gets the attribute info (name and value) for this content at a given index.
-   */
-  virtual mozilla::dom::BorrowedAttrInfo GetAttrInfoAt(uint32_t aIndex) const = 0;
-
-  /**
-   * Get the number of all specified attributes.
-   *
-   * @return the number of attributes
-   */
-  virtual uint32_t GetAttrCount() const = 0;
-
   /**
    * Get direct access (but read only) to the text in the text content.
    * NOTE: For elements this is *not* the concatenation of all text children,
@@ -925,12 +835,6 @@ public:
     return nullptr;
   }
 
-  /**
-   * Walk aRuleWalker over the content style rules (presentational
-   * hint rules) for this content node.
-   */
-  NS_IMETHOD WalkContentStyleRules(nsRuleWalker* aRuleWalker) = 0;
-
   /**
    * Should be called when the node can become editable or when it can stop
    * being editable (for example when its contentEditable attribute changes,

dom/base/nsINode.cpp

@@ -778,17 +778,22 @@ nsINode::LookupPrefix(const nsAString& aNamespaceURI, nsAString& aPrefix)
     // return the prefix (i.e. the attribute localName).
     for (nsIContent* content = element; content;
          content = content->GetParent()) {
-      uint32_t attrCount = content->GetAttrCount();
+      if (!content->IsElement()) {
+        continue;
+      }
+
+      Element* element = content->AsElement();
+      uint32_t attrCount = element->GetAttrCount();
 
       for (uint32_t i = 0; i < attrCount; ++i) {
-        const nsAttrName* name = content->GetAttrNameAt(i);
+        const nsAttrName* name = element->GetAttrNameAt(i);
 
         if (name->NamespaceEquals(kNameSpaceID_XMLNS) &&
-            content->AttrValueIs(kNameSpaceID_XMLNS, name->LocalName(),
+            element->AttrValueIs(kNameSpaceID_XMLNS, name->LocalName(),
                                  aNamespaceURI, eCaseMatters)) {
           // If the localName is "xmlns", the prefix we output should be
           // null.
-          nsAtom *localName = name->LocalName();
+          nsAtom* localName = name->LocalName();
 
           if (localName != nsGkAtoms::xmlns) {
             localName->ToString(aPrefix);

dom/base/nsIdentifierMapEntry.h

@@ -152,7 +152,7 @@ public:
   /**
    * Append all the elements with this id to aElements
    */
-  void AppendAllIdContent(nsCOMArray<nsIContent>* aElements);
+  void AppendAllIdContent(nsCOMArray<Element>* aElements);
   /**
    * This can fire ID change callbacks.
    * @return true if the content could be added, false if we failed due

dom/base/nsObjectLoadingContent.cpp

@@ -924,14 +924,14 @@ nsObjectLoadingContent::BuildParametersArray()
     return NS_OK;
   }
 
-  nsCOMPtr<nsIContent> content =
+  nsCOMPtr<Element> element =
     do_QueryInterface(static_cast<nsIImageLoadingContent*>(this));
 
-  for (uint32_t i = 0; i != content->GetAttrCount(); i += 1) {
+  for (uint32_t i = 0; i != element->GetAttrCount(); i += 1) {
     MozPluginParameter param;
-    const nsAttrName* attrName = content->GetAttrNameAt(i);
+    const nsAttrName* attrName = element->GetAttrNameAt(i);
     nsAtom* atom = attrName->LocalName();
-    content->GetAttr(attrName->NamespaceID(), atom, param.mValue);
+    element->GetAttr(attrName->NamespaceID(), atom, param.mValue);
     atom->ToString(param.mName);
     mCachedAttributes.AppendElement(param);
   }
@@ -958,10 +958,10 @@ nsObjectLoadingContent::BuildParametersArray()
   // Nav 4.x would simply replace the "data" with "src". Because some plugins correctly
   // look for "data", lets instead copy the "data" attribute and add another entry
   // to the bottom of the array if there isn't already a "src" specified.
-  if (content->IsHTMLElement(nsGkAtoms::object) &&
+  if (element->IsHTMLElement(nsGkAtoms::object) &&
-      !content->HasAttr(kNameSpaceID_None, nsGkAtoms::src)) {
+      !element->HasAttr(kNameSpaceID_None, nsGkAtoms::src)) {
     MozPluginParameter param;
-    content->GetAttr(kNameSpaceID_None, nsGkAtoms::data, param.mValue);
+    element->GetAttr(kNameSpaceID_None, nsGkAtoms::data, param.mValue);
     if (!param.mValue.IsEmpty()) {
       param.mName = NS_LITERAL_STRING("SRC");
       mCachedAttributes.AppendElement(param);

dom/base/nsTreeSanitizer.cpp

@@ -1401,10 +1401,12 @@ nsTreeSanitizer::SanitizeChildren(nsINode* aRoot)
       int32_t ns = nodeInfo->NamespaceID();
 
       if (MustPrune(ns, localName, elt)) {
-        RemoveAllAttributes(node);
+        RemoveAllAttributes(elt);
         nsIContent* descendant = node;
         while ((descendant = descendant->GetNextNode(node))) {
-          RemoveAllAttributes(descendant);
+          if (descendant->IsElement()) {
+            RemoveAllAttributes(descendant->AsElement());
+          }
         }
         nsIContent* next = node->GetNextNonChildNode(aRoot);
         node->RemoveFromParent();
@@ -1450,7 +1452,7 @@ nsTreeSanitizer::SanitizeChildren(nsINode* aRoot)
         continue;
       }
       if (MustFlatten(ns, localName)) {
-        RemoveAllAttributes(node);
+        RemoveAllAttributes(elt);
         nsCOMPtr<nsIContent> next = node->GetNextNode(aRoot);
         nsCOMPtr<nsIContent> parent = node->GetParent();
         nsCOMPtr<nsIContent> child; // Must keep the child alive during move
@@ -1505,7 +1507,7 @@ nsTreeSanitizer::SanitizeChildren(nsINode* aRoot)
 }
 
 void
-nsTreeSanitizer::RemoveAllAttributes(nsIContent* aElement)
+nsTreeSanitizer::RemoveAllAttributes(Element* aElement)
 {
   const nsAttrName* attrName;
   while ((attrName = aElement->GetAttrNameAt(0))) {

dom/base/nsTreeSanitizer.h

@@ -146,8 +146,8 @@ class MOZ_STACK_CLASS nsTreeSanitizer {
      * @return true if the attribute was removed and false otherwise
      */
     bool SanitizeURL(mozilla::dom::Element* aElement,
-                       int32_t aNamespace,
+                     int32_t aNamespace,
-                       nsAtom* aLocalName);
+                     nsAtom* aLocalName);
 
     /**
      * Checks a style rule for the presence of the 'binding' CSS property and
@@ -178,7 +178,7 @@ class MOZ_STACK_CLASS nsTreeSanitizer {
     /**
      * Removes all attributes from an element node.
      */
-    void RemoveAllAttributes(nsIContent* aElement);
+    void RemoveAllAttributes(mozilla::dom::Element* aElement);
 
     /**
      * The whitelist of HTML elements.

dom/base/nsXHTMLContentSerializer.cpp

@@ -156,8 +156,8 @@ nsXHTMLContentSerializer::AppendText(nsIContent* aText,
 }
 
 bool
-nsXHTMLContentSerializer::SerializeAttributes(nsIContent* aContent,
+nsXHTMLContentSerializer::SerializeAttributes(Element* aElement,
-                                              nsIContent *aOriginalElement,
+                                              Element* aOriginalElement,
                                               nsAString& aTagPrefix,
                                               const nsAString& aTagNamespaceURI,
                                               nsAtom* aTagName,
@@ -171,7 +171,7 @@ nsXHTMLContentSerializer::SerializeAttributes(nsIContent* aContent,
   nsAutoString xmlnsStr;
   xmlnsStr.AssignLiteral(kXMLNS);
 
-  int32_t contentNamespaceID = aContent->GetNameSpaceID();
+  int32_t contentNamespaceID = aElement->GetNameSpaceID();
 
   // this method is not called by nsHTMLContentSerializer
   // so we don't have to check HTML element, just XHTML
@@ -185,7 +185,7 @@ nsXHTMLContentSerializer::SerializeAttributes(nsIContent* aContent,
       // Store its start attribute value in olState->startVal.
       nsAutoString start;
       int32_t startAttrVal = 0;
-      aContent->GetAttr(kNameSpaceID_None, nsGkAtoms::start, start);
+      aElement->GetAttr(kNameSpaceID_None, nsGkAtoms::start, start);
       if (!start.IsEmpty()) {
         nsresult rv = NS_OK;
         startAttrVal = start.ToInteger(&rv);
@@ -204,7 +204,7 @@ nsXHTMLContentSerializer::SerializeAttributes(nsIContent* aContent,
       mIsFirstChildOfOL = IsFirstChildOfOL(aOriginalElement);
       if (mIsFirstChildOfOL) {
         // If OL is parent of this LI, serialize attributes in different manner.
-        NS_ENSURE_TRUE(SerializeLIValueAttribute(aContent, aStr), false);
+        NS_ENSURE_TRUE(SerializeLIValueAttribute(aElement, aStr), false);
       }
     }
   }
@@ -228,7 +228,7 @@ nsXHTMLContentSerializer::SerializeAttributes(nsIContent* aContent,
 
   NS_NAMED_LITERAL_STRING(_mozStr, "_moz");
 
-  count = aContent->GetAttrCount();
+  count = aElement->GetAttrCount();
 
   // Now serialize each of the attributes
   // XXX Unfortunately we need a namespace manager to get
@@ -239,7 +239,7 @@ nsXHTMLContentSerializer::SerializeAttributes(nsIContent* aContent,
         continue;
     }
 
-    mozilla::dom::BorrowedAttrInfo info = aContent->GetAttrInfoAt(index);
+    mozilla::dom::BorrowedAttrInfo info = aElement->GetAttrInfoAt(index);
     const nsAttrName* name = info.mName;
 
     int32_t namespaceID = name->NamespaceID();
@@ -287,7 +287,7 @@ nsXHTMLContentSerializer::SerializeAttributes(nsIContent* aContent,
         continue;
       }
 
-      isJS = IsJavaScript(aContent, attrName, namespaceID, valueStr);
+      isJS = IsJavaScript(aElement, attrName, namespaceID, valueStr);
 
       if (namespaceID == kNameSpaceID_None &&
           ((attrName == nsGkAtoms::href) ||
@@ -298,7 +298,7 @@ nsXHTMLContentSerializer::SerializeAttributes(nsIContent* aContent,
           // but that gets more complicated since we have to
           // search the tag list for CODEBASE as well.
           // For now, just leave them relative.
-          nsCOMPtr<nsIURI> uri = aContent->GetBaseURI();
+          nsCOMPtr<nsIURI> uri = aElement->GetBaseURI();
           if (uri) {
             nsAutoString absURI;
             rv = NS_MakeAbsoluteURI(absURI, valueStr, uri);
@@ -314,7 +314,7 @@ nsXHTMLContentSerializer::SerializeAttributes(nsIContent* aContent,
         // If we're serializing a <meta http-equiv="content-type">,
         // use the proper value, rather than what's in the document.
         nsAutoString header;
-        aContent->GetAttr(kNameSpaceID_None, nsGkAtoms::httpEquiv, header);
+        aElement->GetAttr(kNameSpaceID_None, nsGkAtoms::httpEquiv, header);
         if (header.LowerCaseEqualsLiteral("content-type")) {
           valueStr = NS_LITERAL_STRING("text/html; charset=") +
             NS_ConvertASCIItoUTF16(mCharset);
@@ -327,7 +327,7 @@ nsXHTMLContentSerializer::SerializeAttributes(nsIContent* aContent,
       }
     }
     else {
-      isJS = IsJavaScript(aContent, attrName, namespaceID, valueStr);
+      isJS = IsJavaScript(aElement, attrName, namespaceID, valueStr);
     }
 
     NS_ENSURE_TRUE(SerializeAttr(prefixStr, nameStr, valueStr, aStr, !isJS), false);
@@ -414,8 +414,8 @@ nsXHTMLContentSerializer::AppendDocumentStart(nsIDocument *aDocument,
 }
 
 bool
-nsXHTMLContentSerializer::CheckElementStart(nsIContent * aContent,
+nsXHTMLContentSerializer::CheckElementStart(Element* aElement,
-                                            bool & aForceFormat,
+                                            bool& aForceFormat,
                                             nsAString& aStr,
                                             nsresult& aResult)
 {
@@ -425,16 +425,16 @@ nsXHTMLContentSerializer::CheckElementStart(nsIContent * aContent,
   // indicate that this element should be pretty printed
   // even if we're not in pretty printing mode
   aForceFormat = !(mFlags & nsIDocumentEncoder::OutputIgnoreMozDirty) &&
-                 aContent->HasAttr(kNameSpaceID_None, nsGkAtoms::mozdirty);
+                 aElement->HasAttr(kNameSpaceID_None, nsGkAtoms::mozdirty);
 
-  if (aContent->IsHTMLElement(nsGkAtoms::br) &&
+  if (aElement->IsHTMLElement(nsGkAtoms::br) &&
       (mFlags & nsIDocumentEncoder::OutputNoFormattingInPre) &&
       PreLevel() > 0) {
     aResult = AppendNewLineToString(aStr) ? NS_OK : NS_ERROR_OUT_OF_MEMORY;
     return false;
   }
 
-  if (aContent->IsHTMLElement(nsGkAtoms::body)) {
+  if (aElement->IsHTMLElement(nsGkAtoms::body)) {
     ++mInBody;
   }
 
@@ -834,7 +834,7 @@ nsXHTMLContentSerializer::IsFirstChildOfOL(nsIContent* aElement)
 }
 
 bool
-nsXHTMLContentSerializer::HasNoChildren(nsIContent * aContent) {
+nsXHTMLContentSerializer::HasNoChildren(nsIContent* aContent) {
 
   for (nsIContent* child = aContent->GetFirstChild();
        child;

dom/base/nsXHTMLContentSerializer.h

@@ -48,10 +48,10 @@ class nsXHTMLContentSerializer : public nsXMLContentSerializer {
  protected:
 
 
-  virtual bool CheckElementStart(nsIContent * aContent,
+  virtual bool CheckElementStart(mozilla::dom::Element* aElement,
-                          bool & aForceFormat,
+                                 bool& aForceFormat,
-                          nsAString& aStr,
+                                 nsAString& aStr,
-                          nsresult& aResult) override;
+                                 nsresult& aResult) override;
 
   MOZ_MUST_USE
   virtual bool AfterElementStart(nsIContent* aContent,
@@ -77,14 +77,14 @@ class nsXHTMLContentSerializer : public nsXMLContentSerializer {
   virtual void MaybeLeaveFromPreContent(nsIContent* aNode) override;
 
   MOZ_MUST_USE
-  virtual bool SerializeAttributes(nsIContent* aContent,
+  virtual bool SerializeAttributes(mozilla::dom::Element* aContent,
-                           nsIContent *aOriginalElement,
+                                   mozilla::dom::Element* aOriginalElement,
-                           nsAString& aTagPrefix,
+                                   nsAString& aTagPrefix,
-                           const nsAString& aTagNamespaceURI,
+                                   const nsAString& aTagNamespaceURI,
-                           nsAtom* aTagName,
+                                   nsAtom* aTagName,
-                           nsAString& aStr,
+                                   nsAString& aStr,
-                           uint32_t aSkipAttr,
+                                   uint32_t aSkipAttr,
-                           bool aAddNSAttr) override;
+                                   bool aAddNSAttr) override;
 
   bool IsFirstChildOfOL(nsIContent* aElement);
 

dom/base/nsXMLContentSerializer.cpp

@@ -712,20 +712,20 @@ nsXMLContentSerializer::SerializeAttr(const nsAString& aPrefix,
 }
 
 uint32_t
-nsXMLContentSerializer::ScanNamespaceDeclarations(nsIContent* aContent,
+nsXMLContentSerializer::ScanNamespaceDeclarations(Element* aElement,
-                                                  nsIContent *aOriginalElement,
+                                                  Element* aOriginalElement,
                                                   const nsAString& aTagNamespaceURI)
 {
   uint32_t index, count;
   nsAutoString uriStr, valueStr;
 
-  count = aContent->GetAttrCount();
+  count = aElement->GetAttrCount();
 
   // First scan for namespace declarations, pushing each on the stack
   uint32_t skipAttr = count;
   for (index = 0; index < count; index++) {
 
-    const BorrowedAttrInfo info = aContent->GetAttrInfoAt(index);
+    const BorrowedAttrInfo info = aElement->GetAttrInfoAt(index);
     const nsAttrName* name = info.mName;
 
     int32_t namespaceID = name->NamespaceID();
@@ -799,8 +799,8 @@ nsXMLContentSerializer::IsJavaScript(nsIContent * aContent, nsAtom* aAttrNameAto
 
 
 bool
-nsXMLContentSerializer::SerializeAttributes(nsIContent* aContent,
+nsXMLContentSerializer::SerializeAttributes(Element* aElement,
-                                            nsIContent *aOriginalElement,
+                                            Element* aOriginalElement,
                                             nsAString& aTagPrefix,
                                             const nsAString& aTagNamespaceURI,
                                             nsAtom* aTagName,
@@ -828,7 +828,7 @@ nsXMLContentSerializer::SerializeAttributes(nsIContent* aContent,
     PushNameSpaceDecl(aTagPrefix, aTagNamespaceURI, aOriginalElement);
   }
 
-  count = aContent->GetAttrCount();
+  count = aElement->GetAttrCount();
 
   // Now serialize each of the attributes
   // XXX Unfortunately we need a namespace manager to get
@@ -838,7 +838,7 @@ nsXMLContentSerializer::SerializeAttributes(nsIContent* aContent,
         continue;
     }
 
-    const nsAttrName* name = aContent->GetAttrNameAt(index);
+    const nsAttrName* name = aElement->GetAttrNameAt(index);
     int32_t namespaceID = name->NamespaceID();
     nsAtom* attrName = name->LocalName();
     nsAtom* attrPrefix = name->GetPrefix();
@@ -863,10 +863,10 @@ nsXMLContentSerializer::SerializeAttributes(nsIContent* aContent,
       addNSAttr = ConfirmPrefix(prefixStr, uriStr, aOriginalElement, true);
     }
 
-    aContent->GetAttr(namespaceID, attrName, valueStr);
+    aElement->GetAttr(namespaceID, attrName, valueStr);
 
     nsDependentAtomString nameStr(attrName);
-    bool isJS = IsJavaScript(aContent, attrName, namespaceID, valueStr);
+    bool isJS = IsJavaScript(aElement, attrName, namespaceID, valueStr);
 
     NS_ENSURE_TRUE(SerializeAttr(prefixStr, nameStr, valueStr, aStr, !isJS), false);
 
@@ -888,15 +888,13 @@ nsXMLContentSerializer::AppendElementStart(Element* aElement,
 {
   NS_ENSURE_ARG(aElement);
 
-  nsIContent* content = aElement;
-
   bool forceFormat = false;
   nsresult rv = NS_OK;
-  if (!CheckElementStart(content, forceFormat, aStr, rv)) {
+  if (!CheckElementStart(aElement, forceFormat, aStr, rv)) {
     // When we go to AppendElementEnd for this element, we're going to
     // MaybeLeaveFromPreContent().  So make sure to MaybeEnterInPreContent()
     // now, so our PreLevel() doesn't get confused.
-    MaybeEnterInPreContent(content);
+    MaybeEnterInPreContent(aElement);
     return rv;
   }
 
@@ -907,11 +905,12 @@ nsXMLContentSerializer::AppendElementStart(Element* aElement,
   aElement->NodeInfo()->GetName(tagLocalName);
   aElement->NodeInfo()->GetNamespaceURI(tagNamespaceURI);
 
-  uint32_t skipAttr = ScanNamespaceDeclarations(content,
+  uint32_t skipAttr =
-                          aOriginalElement, tagNamespaceURI);
+    ScanNamespaceDeclarations(aElement, aOriginalElement, tagNamespaceURI);
 
-  nsAtom *name = content->NodeInfo()->NameAtom();
+  nsAtom *name = aElement->NodeInfo()->NameAtom();
-  bool lineBreakBeforeOpen = LineBreakBeforeOpen(content->GetNameSpaceID(), name);
+  bool lineBreakBeforeOpen =
+    LineBreakBeforeOpen(aElement->GetNameSpaceID(), name);
 
   if ((mDoFormat || forceFormat) && !mDoRaw && !PreLevel()) {
     if (mColPos && lineBreakBeforeOpen) {
@@ -952,25 +951,26 @@ nsXMLContentSerializer::AppendElementStart(Element* aElement,
   }
   NS_ENSURE_TRUE(AppendToString(tagLocalName, aStr), NS_ERROR_OUT_OF_MEMORY);
 
-  MaybeEnterInPreContent(content);
+  MaybeEnterInPreContent(aElement);
 
   if ((mDoFormat || forceFormat) && !mDoRaw && !PreLevel()) {
     NS_ENSURE_TRUE(IncrIndentation(name), NS_ERROR_OUT_OF_MEMORY);
   }
 
-  NS_ENSURE_TRUE(SerializeAttributes(content, aOriginalElement, tagPrefix, tagNamespaceURI,
+  NS_ENSURE_TRUE(SerializeAttributes(aElement, aOriginalElement, tagPrefix,
-                                     name, aStr, skipAttr, addNSAttr),
+                                     tagNamespaceURI, name, aStr, skipAttr,
+                                     addNSAttr),
                  NS_ERROR_OUT_OF_MEMORY);
 
   NS_ENSURE_TRUE(AppendEndOfElementStart(aElement, aOriginalElement, aStr),
                  NS_ERROR_OUT_OF_MEMORY);
 
   if ((mDoFormat || forceFormat) && !mDoRaw && !PreLevel()
-    && LineBreakAfterOpen(content->GetNameSpaceID(), name)) {
+    && LineBreakAfterOpen(aElement->GetNameSpaceID(), name)) {
     NS_ENSURE_TRUE(AppendNewLineToString(aStr), NS_ERROR_OUT_OF_MEMORY);
   }
 
-  NS_ENSURE_TRUE(AfterElementStart(content, aOriginalElement, aStr), NS_ERROR_OUT_OF_MEMORY);
+  NS_ENSURE_TRUE(AfterElementStart(aElement, aOriginalElement, aStr), NS_ERROR_OUT_OF_MEMORY);
 
   return NS_OK;
 }
@@ -1145,8 +1145,8 @@ nsXMLContentSerializer::AppendDocumentStart(nsIDocument *aDocument,
 }
 
 bool
-nsXMLContentSerializer::CheckElementStart(nsIContent * aContent,
+nsXMLContentSerializer::CheckElementStart(Element*,
-                                          bool & aForceFormat,
+                                          bool& aForceFormat,
                                           nsAString& aStr,
                                           nsresult& aResult)
 {

dom/base/nsXMLContentSerializer.h

@@ -209,13 +209,13 @@ class nsXMLContentSerializer : public nsIContentSerializer {
    */
   void GenerateNewPrefix(nsAString& aPrefix);
 
-  uint32_t ScanNamespaceDeclarations(nsIContent* aContent,
+  uint32_t ScanNamespaceDeclarations(mozilla::dom::Element* aContent,
-                                     nsIContent *aOriginalElement,
+                                     mozilla::dom::Element* aOriginalElement,
                                      const nsAString& aTagNamespaceURI);
 
   MOZ_MUST_USE
-  virtual bool SerializeAttributes(nsIContent* aContent,
+  virtual bool SerializeAttributes(mozilla::dom::Element* aContent,
-                                   nsIContent *aOriginalElement,
+                                   mozilla::dom::Element* aOriginalElement,
                                    nsAString& aTagPrefix,
                                    const nsAString& aTagNamespaceURI,
                                    nsAtom* aTagName,
@@ -243,10 +243,10 @@ class nsXMLContentSerializer : public nsIContentSerializer {
    * by setting aForceFormat to true.
    * @return boolean  true if the element can be output
    */
-  virtual bool CheckElementStart(nsIContent * aContent,
+  virtual bool CheckElementStart(Element* aElement,
-                                   bool & aForceFormat,
+                                 bool & aForceFormat,
-                                   nsAString& aStr,
+                                 nsAString& aStr,
-                                   nsresult& aResult);
+                                 nsresult& aResult);
 
   /**
    * This method is responsible for appending the '>' at the end of the start

dom/svg/SVGAElement.h

@@ -56,7 +56,7 @@ public:
   virtual void GetLinkTarget(nsAString& aTarget) override;
   virtual already_AddRefed<nsIURI> GetHrefURI() const override;
   virtual EventStates IntrinsicState() const override;
-  using nsIContent::SetAttr;
+  using Element::SetAttr;
   virtual nsresult SetAttr(int32_t aNameSpaceID, nsAtom* aName,
                            nsAtom* aPrefix, const nsAString& aValue,
                            nsIPrincipal* aSubjectPrincipal,

dom/svg/SVGStyleElement.h

@@ -44,7 +44,7 @@ public:
                               bool aCompileEventHandlers) override;
   virtual void UnbindFromTree(bool aDeep = true,
                               bool aNullParent = true) override;
-  using nsIContent::SetAttr;
+  using Element::SetAttr;
   virtual nsresult SetAttr(int32_t aNameSpaceID, nsAtom* aName,
                            nsAtom* aPrefix, const nsAString& aValue,
                            nsIPrincipal* aSubjectPrincipal,

dom/xbl/nsXBLBinding.cpp

@@ -262,7 +262,7 @@ nsXBLBinding::UnbindAnonymousContent(nsIDocument* aDocument,
 }
 
 void
-nsXBLBinding::SetBoundElement(nsIContent* aElement)
+nsXBLBinding::SetBoundElement(Element* aElement)
 {
   mBoundElement = aElement;
   if (mNextBinding)
@@ -301,7 +301,7 @@ nsXBLBinding::GenerateAnonymousContent()
                "Someone forgot a script blocker");
 
   // Fetch the content element for this binding.
-  nsIContent* content =
+  Element* content =
     mPrototypeBinding->GetImmediateChild(nsGkAtoms::content);
 
   if (!content) {
@@ -417,8 +417,12 @@ nsXBLBinding::GenerateAnonymousContent()
     }
 
     // Conserve space by wiping the attributes off the clone.
+    //
+    // FIXME(emilio): It'd be nice to make `mContent` a `RefPtr<Element>`, but
+    // as of right now it can also be a ShadowRoot (we don't enter in this
+    // codepath though). Move Shadow DOM outside XBL and then fix that.
     if (mContent)
-      mContent->UnsetAttr(namespaceID, name, false);
+      mContent->AsElement()->UnsetAttr(namespaceID, name, false);
   }
 }
 

dom/xbl/nsXBLBinding.h

@@ -64,8 +64,8 @@ public:
   nsXBLBinding* GetBaseBinding() const { return mNextBinding; }
   void SetBaseBinding(nsXBLBinding *aBinding);
 
-  nsIContent* GetBoundElement() { return mBoundElement; }
+  mozilla::dom::Element* GetBoundElement() { return mBoundElement; }
-  void SetBoundElement(nsIContent *aElement);
+  void SetBoundElement(mozilla::dom::Element* aElement);
 
   /*
    * Does a lookup for a method or attribute provided by one of the bindings'
@@ -173,7 +173,7 @@ protected:
   nsCOMPtr<nsIContent> mContent; // Strong. Our anonymous content stays around with us.
   RefPtr<nsXBLBinding> mNextBinding; // Strong. The derived binding owns the base class bindings.
 
-  nsIContent* mBoundElement; // [WEAK] We have a reference, but we don't own it.
+  mozilla::dom::Element* mBoundElement; // [WEAK] We have a reference, but we don't own it.
 
   // The <xbl:children> elements that we found in our <xbl:content> when we
   // processed this binding. The default insertion point has no includes

dom/xbl/nsXBLContentSink.cpp

@@ -535,7 +535,8 @@ nsXBLContentSink::OnOpenContainer(const char16_t **aAtts,
 nsresult
 nsXBLContentSink::ConstructBinding(uint32_t aLineNumber)
 {
-  nsCOMPtr<nsIContent> binding = GetCurrentContent();
+  // This is only called from HandleStartElement, so it'd better be an element.
+  RefPtr<Element> binding = GetCurrentContent()->AsElement();
   binding->GetAttr(kNameSpaceID_None, nsGkAtoms::id, mCurrentBindingID);
   NS_ConvertUTF16toUTF8 cid(mCurrentBindingID);
 
@@ -880,13 +881,12 @@ nsXBLContentSink::CreateElement(const char16_t** aAtts, uint32_t aAttsCount,
 }
 
 nsresult
-nsXBLContentSink::AddAttributes(const char16_t** aAtts,
+nsXBLContentSink::AddAttributes(const char16_t** aAtts, Element* aElement)
-                                nsIContent* aContent)
 {
-  if (aContent->IsXULElement())
+  if (aElement->IsXULElement())
     return NS_OK; // Nothing to do, since the proto already has the attrs.
 
-  return nsXMLContentSink::AddAttributes(aAtts, aContent);
+  return nsXMLContentSink::AddAttributes(aAtts, aElement);
 }
 
 #ifdef MOZ_XUL

dom/xbl/nsXBLContentSink.h

@@ -92,8 +92,7 @@ protected:
                            nsIContent** aResult, bool* aAppendContent,
                            mozilla::dom::FromParser aFromParser) override;
 
-    nsresult AddAttributes(const char16_t** aAtts,
+    nsresult AddAttributes(const char16_t** aAtts, Element* aElement) override;
-                           nsIContent* aContent) override;
 
 #ifdef MOZ_XUL
     nsresult AddAttributesToXULPrototype(const char16_t **aAtts,

dom/xbl/nsXBLPrototypeBinding.cpp

@@ -62,8 +62,8 @@ using namespace mozilla::dom;
 class nsXBLAttributeEntry {
 public:
   nsXBLAttributeEntry(nsAtom* aSrcAtom, nsAtom* aDstAtom,
-                      int32_t aDstNameSpace, nsIContent* aContent)
+                      int32_t aDstNameSpace, Element* aElement)
-    : mElement(aContent),
+    : mElement(aElement),
       mSrcAttribute(aSrcAtom),
       mDstAttribute(aDstAtom),
       mDstNameSpace(aDstNameSpace),
@@ -77,13 +77,13 @@ public:
   nsAtom* GetDstAttribute() { return mDstAttribute; }
   int32_t GetDstNameSpace() { return mDstNameSpace; }
 
-  nsIContent* GetElement() { return mElement; }
+  Element* GetElement() { return mElement; }
 
   nsXBLAttributeEntry* GetNext() { return mNext; }
   void SetNext(nsXBLAttributeEntry* aEntry) { mNext = aEntry; }
 
 protected:
-  nsIContent* mElement;
+  Element* mElement;
 
   RefPtr<nsAtom> mSrcAttribute;
   RefPtr<nsAtom> mDstAttribute;
@@ -113,7 +113,7 @@ nsXBLPrototypeBinding::nsXBLPrototypeBinding()
 nsresult
 nsXBLPrototypeBinding::Init(const nsACString& aID,
                             nsXBLDocumentInfo* aInfo,
-                            nsIContent* aElement,
+                            Element* aElement,
                             bool aFirstBinding)
 {
   nsresult rv = aInfo->DocumentURI()->Clone(getter_AddRefs(mBindingURI));
@@ -180,8 +180,7 @@ nsXBLPrototypeBinding::Trace(const TraceCallbacks& aCallbacks, void *aClosure) c
 void
 nsXBLPrototypeBinding::Initialize()
 {
-  nsIContent* content = GetImmediateChild(nsGkAtoms::content);
+  if (Element* content = GetImmediateChild(nsGkAtoms::content)) {
-  if (content) {
     ConstructAttributeTable(content);
   }
 }
@@ -207,7 +206,7 @@ nsXBLPrototypeBinding::SetBasePrototype(nsXBLPrototypeBinding* aBinding)
 }
 
 void
-nsXBLPrototypeBinding::SetBindingElement(nsIContent* aElement)
+nsXBLPrototypeBinding::SetBindingElement(Element* aElement)
 {
   mBinding = aElement;
   if (mBinding->AttrValueIs(kNameSpaceID_None, nsGkAtoms::inheritstyle,
@@ -323,7 +322,7 @@ void
 nsXBLPrototypeBinding::AttributeChanged(nsAtom* aAttribute,
                                         int32_t aNameSpaceID,
                                         bool aRemoveFlag,
-                                        nsIContent* aChangedElement,
+                                        Element* aChangedElement,
                                         nsIContent* aAnonymousContent,
                                         bool aNotify)
 {
@@ -339,13 +338,12 @@ nsXBLPrototypeBinding::AttributeChanged(nsAtom* aAttribute,
     return;
 
   // Iterate over the elements in the array.
-  nsCOMPtr<nsIContent> content = GetImmediateChild(nsGkAtoms::content);
+  RefPtr<Element> content = GetImmediateChild(nsGkAtoms::content);
   while (xblAttr) {
-    nsIContent* element = xblAttr->GetElement();
+    Element* element = xblAttr->GetElement();
 
-    nsCOMPtr<nsIContent> realElement = LocateInstance(aChangedElement, content,
+    RefPtr<Element> realElement =
-                                                      aAnonymousContent,
+      LocateInstance(aChangedElement, content, aAnonymousContent, element);
-                                                      element);
 
     if (realElement) {
       // Hold a strong reference here so that the atom doesn't go away during
@@ -436,14 +434,14 @@ nsXBLPrototypeBinding::ImplementsInterface(REFNSIID aIID) const
 
 // Internal helpers ///////////////////////////////////////////////////////////////////////
 
-nsIContent*
+Element*
 nsXBLPrototypeBinding::GetImmediateChild(nsAtom* aTag)
 {
   for (nsIContent* child = mBinding->GetFirstChild();
        child;
        child = child->GetNextSibling()) {
     if (child->NodeInfo()->Equals(aTag, kNameSpaceID_XBL)) {
-      return child;
+      return child->AsElement();
     }
   }
 
@@ -461,18 +459,18 @@ nsXBLPrototypeBinding::InitClass(const nsString& aClassName,
                                      aClassName, this, aClassObject, aNew);
 }
 
-nsIContent*
+Element*
-nsXBLPrototypeBinding::LocateInstance(nsIContent* aBoundElement,
+nsXBLPrototypeBinding::LocateInstance(Element* aBoundElement,
                                       nsIContent* aTemplRoot,
                                       nsIContent* aCopyRoot,
-                                      nsIContent* aTemplChild)
+                                      Element* aTemplChild)
 {
   // XXX We will get in trouble if the binding instantiation deviates from the template
   // in the prototype.
   if (aTemplChild == aTemplRoot || !aTemplChild)
     return nullptr;
 
-  nsIContent* templParent = aTemplChild->GetParent();
+  Element* templParent = aTemplChild->GetParentElement();
 
   // We may be disconnected from our parent during cycle collection.
   if (!templParent)
@@ -485,11 +483,17 @@ nsXBLPrototypeBinding::LocateInstance(nsIContent* aBoundElement,
   if (!copyParent)
     return nullptr;
 
-  return copyParent->GetChildAt(templParent->IndexOf(aTemplChild));
+  nsIContent* child = copyParent->GetChildAt(templParent->IndexOf(aTemplChild));
+  if (child && child->IsElement()) {
+    return child->AsElement();
+  }
+  return nullptr;
 }
 
 void
-nsXBLPrototypeBinding::SetInitialAttributes(nsIContent* aBoundElement, nsIContent* aAnonymousContent)
+nsXBLPrototypeBinding::SetInitialAttributes(
+    Element* aBoundElement,
+    nsIContent* aAnonymousContent)
 {
   if (!mAttributeTable) {
     return;
@@ -528,9 +532,9 @@ nsXBLPrototypeBinding::SetInitialAttributes(nsIContent* aBoundElement, nsIConten
           while (curr) {
             nsAtom* dst = curr->GetDstAttribute();
             int32_t dstNs = curr->GetDstNameSpace();
-            nsIContent* element = curr->GetElement();
+            Element* element = curr->GetElement();
 
-            nsIContent* realElement =
+            Element* realElement =
               LocateInstance(aBoundElement, content,
                              aAnonymousContent, element);
 
@@ -595,7 +599,7 @@ nsXBLPrototypeBinding::EnsureAttributeTable()
 void
 nsXBLPrototypeBinding::AddToAttributeTable(int32_t aSourceNamespaceID, nsAtom* aSourceTag,
                                            int32_t aDestNamespaceID, nsAtom* aDestTag,
-                                           nsIContent* aContent)
+                                           Element* aElement)
 {
     InnerAttributeTable* attributesNS = mAttributeTable->Get(aSourceNamespaceID);
     if (!attributesNS) {
@@ -604,7 +608,7 @@ nsXBLPrototypeBinding::AddToAttributeTable(int32_t aSourceNamespaceID, nsAtom* a
     }
 
     nsXBLAttributeEntry* xblAttr =
-      new nsXBLAttributeEntry(aSourceTag, aDestTag, aDestNamespaceID, aContent);
+      new nsXBLAttributeEntry(aSourceTag, aDestTag, aDestNamespaceID, aElement);
 
     nsXBLAttributeEntry* entry = attributesNS->Get(aSourceTag);
     if (!entry) {
@@ -617,7 +621,7 @@ nsXBLPrototypeBinding::AddToAttributeTable(int32_t aSourceNamespaceID, nsAtom* a
 }
 
 void
-nsXBLPrototypeBinding::ConstructAttributeTable(nsIContent* aElement)
+nsXBLPrototypeBinding::ConstructAttributeTable(Element* aElement)
 {
   // Don't add entries for <children> elements, since those will get
   // removed from the DOM when we construct the insertion point table.
@@ -692,7 +696,9 @@ nsXBLPrototypeBinding::ConstructAttributeTable(nsIContent* aElement)
   for (nsIContent* child = aElement->GetFirstChild();
        child;
        child = child->GetNextSibling()) {
-    ConstructAttributeTable(child);
+    if (child->IsElement()) {
+      ConstructAttributeTable(child->AsElement());
+    }
   }
 }
 
@@ -1195,12 +1201,11 @@ nsXBLPrototypeBinding::ReadContentNode(nsIObjectInputStream* aStream,
   if (namespaceID == XBLBinding_Serialize_NoContent)
     return NS_OK;
 
-  nsCOMPtr<nsIContent> content;
-
   // If this is a text type, just read the string and return.
   if (namespaceID == XBLBinding_Serialize_TextNode ||
       namespaceID == XBLBinding_Serialize_CDATANode ||
       namespaceID == XBLBinding_Serialize_CommentNode) {
+    nsCOMPtr<nsIContent> content;
     switch (namespaceID) {
       case XBLBinding_Serialize_TextNode:
         content = new nsTextNode(aNim);
@@ -1244,6 +1249,7 @@ nsXBLPrototypeBinding::ReadContentNode(nsIObjectInputStream* aStream,
   rv = aStream->Read32(&attrCount);
   NS_ENSURE_SUCCESS(rv, rv);
 
+  RefPtr<Element> element;
   // Create XUL prototype elements, or regular elements for other namespaces.
   // This needs to match the code in nsXBLContentSink::CreateElement.
 #ifdef MOZ_XUL
@@ -1293,17 +1299,12 @@ nsXBLPrototypeBinding::ReadContentNode(nsIObjectInputStream* aStream,
       NS_ENSURE_SUCCESS(rv, rv);
     }
 
-    nsCOMPtr<Element> result;
     nsresult rv =
-      nsXULElement::Create(prototype, aDocument, false, false, getter_AddRefs(result));
+      nsXULElement::Create(prototype, aDocument, false, false, getter_AddRefs(element));
     NS_ENSURE_SUCCESS(rv, rv);
-    content = result;
+  } else {
-  }
-  else {
 #endif
-    nsCOMPtr<Element> element;
     NS_NewElement(getter_AddRefs(element), nodeInfo.forget(), NOT_FROM_PARSER);
-    content = element;
 
     for (uint32_t i = 0; i < attrCount; i++) {
       rv = ReadNamespace(aStream, namespaceID);
@@ -1322,7 +1323,7 @@ nsXBLPrototypeBinding::ReadContentNode(nsIObjectInputStream* aStream,
         prefixAtom = NS_Atomize(prefix);
 
       RefPtr<nsAtom> nameAtom = NS_Atomize(name);
-      content->SetAttr(namespaceID, nameAtom, prefixAtom, val, false);
+      element->SetAttr(namespaceID, nameAtom, prefixAtom, val, false);
     }
 
 #ifdef MOZ_XUL
@@ -1348,7 +1349,7 @@ nsXBLPrototypeBinding::ReadContentNode(nsIObjectInputStream* aStream,
     RefPtr<nsAtom> destAtom = NS_Atomize(destAttribute);
 
     EnsureAttributeTable();
-    AddToAttributeTable(srcNamespaceID, srcAtom, destNamespaceID, destAtom, content);
+    AddToAttributeTable(srcNamespaceID, srcAtom, destNamespaceID, destAtom, element);
 
     rv = ReadNamespace(aStream, srcNamespaceID);
     NS_ENSURE_SUCCESS(rv, rv);
@@ -1365,11 +1366,11 @@ nsXBLPrototypeBinding::ReadContentNode(nsIObjectInputStream* aStream,
 
     // Child may be null if this was a comment for example and can just be ignored.
     if (child) {
-      content->AppendChildTo(child, false);
+      element->AppendChildTo(child, false);
     }
   }
 
-  content.swap(*aContent);
+  element.forget(aContent);
   return NS_OK;
 }
 
@@ -1405,21 +1406,22 @@ nsXBLPrototypeBinding::WriteContentNode(nsIObjectOutputStream* aStream,
   }
 
   // Otherwise, this is an element.
+  Element* element = aNode->AsElement();
 
   // Write the namespace id followed by the tag name
-  rv = WriteNamespace(aStream, aNode->GetNameSpaceID());
+  rv = WriteNamespace(aStream, element->GetNameSpaceID());
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsAutoString prefixStr;
-  aNode->NodeInfo()->GetPrefix(prefixStr);
+  element->NodeInfo()->GetPrefix(prefixStr);
   rv = aStream->WriteWStringZ(prefixStr.get());
   NS_ENSURE_SUCCESS(rv, rv);
 
-  rv = aStream->WriteWStringZ(nsDependentAtomString(aNode->NodeInfo()->NameAtom()).get());
+  rv = aStream->WriteWStringZ(nsDependentAtomString(element->NodeInfo()->NameAtom()).get());
   NS_ENSURE_SUCCESS(rv, rv);
 
   // Write attributes
-  uint32_t count = aNode->GetAttrCount();
+  uint32_t count = element->GetAttrCount();
   rv = aStream->Write32(count);
   NS_ENSURE_SUCCESS(rv, rv);
 
@@ -1428,7 +1430,7 @@ nsXBLPrototypeBinding::WriteContentNode(nsIObjectOutputStream* aStream,
     // Write out the namespace id, the namespace prefix, the local tag name,
     // and the value, in that order.
 
-    const BorrowedAttrInfo attrInfo = aNode->GetAttrInfoAt(i);
+    const BorrowedAttrInfo attrInfo = element->GetAttrInfoAt(i);
     const nsAttrName* name = attrInfo.mName;
 
     // XXXndeakin don't write out xbl:inherits?
@@ -1462,7 +1464,7 @@ nsXBLPrototypeBinding::WriteContentNode(nsIObjectOutputStream* aStream,
         nsXBLAttributeEntry* entry = iter2.UserData();
 
         do {
-          if (entry->GetElement() == aNode) {
+          if (entry->GetElement() == element) {
             WriteNamespace(aStream, srcNamespace);
             aStream->WriteWStringZ(
               nsDependentAtomString(entry->GetSrcAttribute()).get());
@@ -1480,12 +1482,12 @@ nsXBLPrototypeBinding::WriteContentNode(nsIObjectOutputStream* aStream,
   NS_ENSURE_SUCCESS(rv, rv);
 
   // Finally, write out the child nodes.
-  count = aNode->GetChildCount();
+  count = element->GetChildCount();
   rv = aStream->Write32(count);
   NS_ENSURE_SUCCESS(rv, rv);
 
   for (i = 0; i < count; i++) {
-    rv = WriteContentNode(aStream, aNode->GetChildAt(i));
+    rv = WriteContentNode(aStream, element->GetChildAt(i));
     NS_ENSURE_SUCCESS(rv, rv);
   }
 

dom/xbl/nsXBLPrototypeBinding.h

@@ -41,8 +41,8 @@ class nsXBLPrototypeBinding final :
 public:
   MOZ_DECLARE_WEAKREFERENCE_TYPENAME(nsXBLPrototypeBinding)
 
-  nsIContent* GetBindingElement() const { return mBinding; }
+  mozilla::dom::Element* GetBindingElement() const { return mBinding; }
-  void SetBindingElement(nsIContent* aElement);
+  void SetBindingElement(mozilla::dom::Element* aElement);
 
   nsIURI* BindingURI() const { return mBindingURI; }
   nsIURI* AlternateBindingURI() const { return mAlternateBindingURI; }
@@ -111,7 +111,8 @@ public:
   bool HasImplementation() const { return mImplementation != nullptr; }
 
   void AttributeChanged(nsAtom* aAttribute, int32_t aNameSpaceID,
-                        bool aRemoveFlag, nsIContent* aChangedElement,
+                        bool aRemoveFlag,
+                        mozilla::dom::Element* aChangedElement,
                         nsIContent* aAnonymousContent, bool aNotify);
 
   void SetBasePrototype(nsXBLPrototypeBinding* aBinding);
@@ -120,7 +121,8 @@ public:
   nsXBLDocumentInfo* XBLDocumentInfo() const { return mXBLDocInfoWeak; }
   bool IsChrome() { return mXBLDocInfoWeak->IsChrome(); }
 
-  void SetInitialAttributes(nsIContent* aBoundElement, nsIContent* aAnonymousContent);
+  void SetInitialAttributes(mozilla::dom::Element* aBoundElement,
+                            nsIContent* aAnonymousContent);
 
   void AppendStyleSheet(mozilla::StyleSheet* aSheet);
   void RemoveStyleSheet(mozilla::StyleSheet* aSheet);
@@ -246,7 +248,7 @@ public:
   // binding's handlers, properties, etc are all set.
   nsresult Init(const nsACString& aRef,
                 nsXBLDocumentInfo* aInfo,
-                nsIContent* aElement,
+                mozilla::dom::Element* aElement,
                 bool aFirstBinding = false);
 
   void Traverse(nsCycleCollectionTraversalCallback &cb) const;
@@ -259,11 +261,11 @@ public:
    * GetImmediateChild locates the immediate child of our binding element which
    * has the localname given by aTag and is in the XBL namespace.
    */
-  nsIContent* GetImmediateChild(nsAtom* aTag);
+  mozilla::dom::Element* GetImmediateChild(nsAtom* aTag);
-  nsIContent* LocateInstance(nsIContent* aBoundElt,
+  mozilla::dom::Element* LocateInstance(mozilla::dom::Element* aBoundElt,
-                             nsIContent* aTemplRoot,
+                                        nsIContent* aTemplRoot,
-                             nsIContent* aCopyRoot,
+                                        nsIContent* aCopyRoot,
-                             nsIContent* aTemplChild);
+                                        mozilla::dom::Element* aTemplChild);
 
   bool ChromeOnlyContent() { return mChromeOnlyContent; }
   bool BindToUntrustedContent() { return mBindToUntrustedContent; }
@@ -276,8 +278,8 @@ protected:
   // Ad an entry to the attribute table
   void AddToAttributeTable(int32_t aSourceNamespaceID, nsAtom* aSourceTag,
                            int32_t aDestNamespaceID, nsAtom* aDestTag,
-                           nsIContent* aContent);
+                           mozilla::dom::Element* aContent);
-  void ConstructAttributeTable(nsIContent* aElement);
+  void ConstructAttributeTable(mozilla::dom::Element* aElement);
   void CreateKeyHandlers();
 
 private:
@@ -287,7 +289,7 @@ private:
 protected:
   nsCOMPtr<nsIURI> mBindingURI;
   nsCOMPtr<nsIURI> mAlternateBindingURI; // Alternate id-less URI that is only non-null on the first binding.
-  nsCOMPtr<nsIContent> mBinding; // Strong. We own a ref to our content element in the binding doc.
+  RefPtr<mozilla::dom::Element> mBinding; // Strong. We own a ref to our content element in the binding doc.
   nsAutoPtr<nsXBLPrototypeHandler> mPrototypeHandler; // Strong. DocInfo owns us, and we own the handlers.
 
   // the url of the base binding

dom/xbl/nsXBLService.cpp

@@ -479,7 +479,7 @@ private:
 // This function loads a particular XBL file and installs all of the bindings
 // onto the element.
 nsresult
-nsXBLService::LoadBindings(nsIContent* aContent, nsIURI* aURL,
+nsXBLService::LoadBindings(Element* aElement, nsIURI* aURL,
                            nsIPrincipal* aOriginPrincipal,
                            nsXBLBinding** aBinding, bool* aResolveStyle)
 {
@@ -488,20 +488,20 @@ nsXBLService::LoadBindings(nsIContent* aContent, nsIURI* aURL,
   *aBinding = nullptr;
   *aResolveStyle = false;
 
-  AutoEnsureSubtreeStyled subtreeStyled(aContent->AsElement());
+  AutoEnsureSubtreeStyled subtreeStyled(aElement);
 
   if (MOZ_UNLIKELY(!aURL)) {
     return NS_OK;
   }
 
   // Easy case: The binding was already loaded.
-  nsXBLBinding* binding = aContent->GetXBLBinding();
+  nsXBLBinding* binding = aElement->GetXBLBinding();
   if (binding && !binding->MarkedForDeath() &&
       binding->PrototypeBinding()->CompareBindingURI(aURL)) {
     return NS_OK;
   }
 
-  nsCOMPtr<nsIDocument> document = aContent->OwnerDoc();
+  nsCOMPtr<nsIDocument> document = aElement->OwnerDoc();
 
   nsAutoCString urlspec;
   nsresult rv;
@@ -518,13 +518,13 @@ nsXBLService::LoadBindings(nsIContent* aContent, nsIURI* aURL,
   }
 
   if (binding) {
-    FlushStyleBindings(aContent);
+    FlushStyleBindings(aElement);
     binding = nullptr;
   }
 
   bool ready;
   RefPtr<nsXBLBinding> newBinding;
-  if (NS_FAILED(rv = GetBinding(aContent, aURL, false, aOriginPrincipal,
+  if (NS_FAILED(rv = GetBinding(aElement, aURL, false, aOriginPrincipal,
                                 &ready, getter_AddRefs(newBinding)))) {
     return rv;
   }
@@ -537,21 +537,21 @@ nsXBLService::LoadBindings(nsIContent* aContent, nsIURI* aURL,
     return NS_OK;
   }
 
-  if (::IsAncestorBinding(document, aURL, aContent)) {
+  if (::IsAncestorBinding(document, aURL, aElement)) {
     return NS_ERROR_ILLEGAL_VALUE;
   }
 
-  AutoStyleElement styleElement(aContent->AsElement(), aResolveStyle);
+  AutoStyleElement styleElement(aElement, aResolveStyle);
 
   // We loaded a style binding.  It goes on the end.
   // Install the binding on the content node.
-  aContent->SetXBLBinding(newBinding);
+  aElement->SetXBLBinding(newBinding);
 
   {
     nsAutoScriptBlocker scriptBlocker;
 
     // Set the binding's bound element.
-    newBinding->SetBoundElement(aContent);
+    newBinding->SetBoundElement(aElement);
 
     // Tell the binding to build the anonymous content.
     newBinding->GenerateAnonymousContent();
@@ -572,20 +572,18 @@ nsXBLService::LoadBindings(nsIContent* aContent, nsIURI* aURL,
   return NS_OK;
 }
 
-nsresult
+void
-nsXBLService::FlushStyleBindings(nsIContent* aContent)
+nsXBLService::FlushStyleBindings(Element* aElement)
 {
-  nsCOMPtr<nsIDocument> document = aContent->OwnerDoc();
+  nsCOMPtr<nsIDocument> document = aElement->OwnerDoc();
 
-  nsXBLBinding *binding = aContent->GetXBLBinding();
+  nsXBLBinding* binding = aElement->GetXBLBinding();
   if (binding) {
     // Clear out the script references.
     binding->ChangeDocument(document, nullptr);
 
-    aContent->SetXBLBinding(nullptr); // Flush old style bindings
+    aElement->SetXBLBinding(nullptr); // Flush old style bindings
   }
-
-  return NS_OK;
 }
 
 //

dom/xbl/nsXBLService.h

@@ -46,7 +46,7 @@ class nsXBLService final : public nsSupportsWeakReference
 
   // This function loads a particular XBL file and installs all of the bindings
   // onto the element.  aOriginPrincipal must not be null here.
-  nsresult LoadBindings(nsIContent* aContent, nsIURI* aURL,
+  nsresult LoadBindings(mozilla::dom::Element* aElement, nsIURI* aURL,
                         nsIPrincipal* aOriginPrincipal,
                         nsXBLBinding** aBinding, bool* aResolveStyle);
 
@@ -72,8 +72,8 @@ private:
   virtual ~nsXBLService();
 
 protected:
-  // This function clears out the bindings on a given content node.
+  // This function clears out the bindings on a given element.
-  nsresult FlushStyleBindings(nsIContent* aContent);
+  void FlushStyleBindings(mozilla::dom::Element*);
 
   // This method synchronously loads and parses an XBL file.
   nsresult FetchBindingDocument(nsIContent* aBoundElement, nsIDocument* aBoundDocument,

dom/xml/nsXMLContentSink.cpp

@@ -980,7 +980,7 @@ nsXMLContentSink::HandleStartElement(const char16_t *aName,
   NS_ENSURE_SUCCESS(result, result);
 
   // Set the attributes on the new content element
-  result = AddAttributes(aAtts, content);
+  result = AddAttributes(aAtts, content->AsElement());
 
   if (NS_OK == result) {
     // Store the element
@@ -1413,7 +1413,7 @@ nsXMLContentSink::ReportError(const char16_t* aErrorText,
 
 nsresult
 nsXMLContentSink::AddAttributes(const char16_t** aAtts,
-                                nsIContent* aContent)
+                                Element* aContent)
 {
   // Add tag attributes to the content attributes
   RefPtr<nsAtom> prefix, localName;

dom/xml/nsXMLContentSink.h

@@ -99,7 +99,7 @@ protected:
   // stylesheets are all done loading.
   virtual void MaybeStartLayout(bool aIgnorePendingSheets);
 
-  virtual nsresult AddAttributes(const char16_t** aNode, nsIContent* aContent);
+  virtual nsresult AddAttributes(const char16_t** aNode, Element* aElement);
   nsresult AddText(const char16_t* aString, int32_t aLength);
 
   virtual bool OnOpenContainer(const char16_t **aAtts,

dom/xml/nsXMLPrettyPrinter.cpp

@@ -144,8 +144,8 @@ nsXMLPrettyPrinter::PrettyPrint(nsIDocument* aDocument,
     NS_ENSURE_SUCCESS(rv, rv);
 
     // Compute the bound element.
-    nsCOMPtr<nsIContent> rootCont = aDocument->GetRootElement();
+    RefPtr<Element> rootElement = aDocument->GetRootElement();
-    NS_ENSURE_TRUE(rootCont, NS_ERROR_UNEXPECTED);
+    NS_ENSURE_TRUE(rootElement, NS_ERROR_UNEXPECTED);
 
     // Grab the system principal.
     nsCOMPtr<nsIPrincipal> sysPrincipal;
@@ -154,20 +154,20 @@ nsXMLPrettyPrinter::PrettyPrint(nsIDocument* aDocument,
 
     // Destroy any existing frames before we unbind anonymous content.
     // Note that the shell might be Destroy'ed by now (see bug 1415541).
-    if (!shell->IsDestroying() && rootCont->IsElement()) {
+    if (!shell->IsDestroying()) {
-        shell->DestroyFramesForAndRestyle(rootCont->AsElement());
+        shell->DestroyFramesForAndRestyle(rootElement);
     }
 
     // Load the bindings.
     RefPtr<nsXBLBinding> unused;
     bool ignored;
-    rv = xblService->LoadBindings(rootCont, bindingUri, sysPrincipal,
+    rv = xblService->LoadBindings(rootElement, bindingUri, sysPrincipal,
                                   getter_AddRefs(unused), &ignored);
     NS_ENSURE_SUCCESS(rv, rv);
 
     // Fire an event at the bound element to pass it |resultFragment|.
     RefPtr<CustomEvent> event =
-      NS_NewDOMCustomEvent(rootCont, nullptr, nullptr);
+      NS_NewDOMCustomEvent(rootElement, nullptr, nullptr);
     MOZ_ASSERT(event);
     nsCOMPtr<nsIWritableVariant> resultFragmentVariant = new nsVariant();
     rv = resultFragmentVariant->SetAsISupports(resultFragment);
@@ -178,7 +178,7 @@ nsXMLPrettyPrinter::PrettyPrint(nsIDocument* aDocument,
     NS_ENSURE_SUCCESS(rv, rv);
     event->SetTrusted(true);
     bool dummy;
-    rv = rootCont->DispatchEvent(event, &dummy);
+    rv = rootElement->DispatchEvent(event, &dummy);
     NS_ENSURE_SUCCESS(rv, rv);
 
     // Observe the document so we know when to switch to "normal" view

dom/xslt/xpath/txMozillaXPathTreeWalker.cpp

@@ -120,14 +120,19 @@ txXPathTreeWalker::moveToValidAttribute(uint32_t aStartIndex)
 {
     NS_ASSERTION(!mPosition.isDocument(), "documents doesn't have attrs");
 
-    uint32_t total = mPosition.Content()->GetAttrCount();
+    if (!mPosition.Content()->IsElement()) {
+      return false;
+    }
+
+    Element* element = mPosition.Content()->AsElement();
+    uint32_t total = element->GetAttrCount();
     if (aStartIndex >= total) {
         return false;
     }
 
     uint32_t index;
     for (index = aStartIndex; index < total; ++index) {
-        const nsAttrName* name = mPosition.Content()->GetAttrNameAt(index);
+        const nsAttrName* name = element->GetAttrNameAt(index);
 
         // We need to ignore XMLNS attributes.
         if (name->NamespaceID() != kNameSpaceID_XMLNS) {
@@ -142,13 +147,15 @@ txXPathTreeWalker::moveToValidAttribute(uint32_t aStartIndex)
 bool
 txXPathTreeWalker::moveToNamedAttribute(nsAtom* aLocalName, int32_t aNSID)
 {
-    if (!mPosition.isContent()) {
+    if (!mPosition.isContent() || !mPosition.Content()->IsElement()) {
         return false;
     }
 
+    Element* element = mPosition.Content()->AsElement();
+
     const nsAttrName* name;
     uint32_t i;
-    for (i = 0; (name = mPosition.Content()->GetAttrNameAt(i)); ++i) {
+    for (i = 0; (name = element->GetAttrNameAt(i)); ++i) {
         if (name->Equals(aLocalName, aNSID)) {
             mPosition.mIndex = i;
 
@@ -310,8 +317,9 @@ txXPathNodeUtils::getLocalName(const txXPathNode& aNode)
         return nullptr;
     }
 
-    RefPtr<nsAtom> localName = aNode.Content()->
+    // This is an attribute node, so we necessarily come from an element.
-        GetAttrNameAt(aNode.mIndex)->LocalName();
+    RefPtr<nsAtom> localName =
+      aNode.Content()->AsElement()->GetAttrNameAt(aNode.mIndex)->LocalName();
 
     return localName.forget();
 }
@@ -329,7 +337,7 @@ txXPathNodeUtils::getPrefix(const txXPathNode& aNode)
         return aNode.Content()->NodeInfo()->GetPrefixAtom();
     }
 
-    return aNode.Content()->GetAttrNameAt(aNode.mIndex)->GetPrefix();
+    return aNode.Content()->AsElement()->GetAttrNameAt(aNode.mIndex)->GetPrefix();
 }
 
 /* static */
@@ -362,7 +370,7 @@ txXPathNodeUtils::getLocalName(const txXPathNode& aNode, nsAString& aLocalName)
         return;
     }
 
-    aNode.Content()->GetAttrNameAt(aNode.mIndex)->LocalName()->
+    aNode.Content()->AsElement()->GetAttrNameAt(aNode.mIndex)->LocalName()->
       ToString(aLocalName);
 
     // Check for html
@@ -396,7 +404,7 @@ txXPathNodeUtils::getNodeName(const txXPathNode& aNode, nsAString& aName)
         return;
     }
 
-    aNode.Content()->GetAttrNameAt(aNode.mIndex)->GetQualifiedName(aName);
+    aNode.Content()->AsElement()->GetAttrNameAt(aNode.mIndex)->GetQualifiedName(aName);
 }
 
 /* static */
@@ -411,7 +419,7 @@ txXPathNodeUtils::getNamespaceID(const txXPathNode& aNode)
         return aNode.Content()->GetNameSpaceID();
     }
 
-    return aNode.Content()->GetAttrNameAt(aNode.mIndex)->NamespaceID();
+    return aNode.Content()->AsElement()->GetAttrNameAt(aNode.mIndex)->NamespaceID();
 }
 
 /* static */
@@ -441,7 +449,7 @@ void
 txXPathNodeUtils::appendNodeValue(const txXPathNode& aNode, nsAString& aResult)
 {
     if (aNode.isAttribute()) {
-        const nsAttrName* name = aNode.Content()->GetAttrNameAt(aNode.mIndex);
+        const nsAttrName* name = aNode.Content()->AsElement()->GetAttrNameAt(aNode.mIndex);
 
         if (aResult.IsEmpty()) {
             aNode.Content()->GetAttr(name->NamespaceID(), name->LocalName(),
@@ -692,7 +700,8 @@ txXPathNativeNode::getNode(const txXPathNode& aNode)
         return aNode.mNode;
     }
 
-    const nsAttrName* name = aNode.Content()->GetAttrNameAt(aNode.mIndex);
+    const nsAttrName* name =
+      aNode.Content()->AsElement()->GetAttrNameAt(aNode.mIndex);
 
     nsAutoString namespaceURI;
     nsContentUtils::NameSpaceManager()->GetNameSpaceURI(name->NamespaceID(), namespaceURI);

dom/xslt/xslt/txMozillaTextOutput.cpp

@@ -20,6 +20,7 @@
 #include "nsTextNode.h"
 #include "nsNameSpaceManager.h"
 
+using namespace mozilla;
 using namespace mozilla::dom;
 
 txMozillaTextOutput::txMozillaTextOutput(nsITransformObserver* aObserver)
@@ -196,7 +197,7 @@ txMozillaTextOutput::createResultDocument(nsIDocument* aSourceDocument,
         NS_ENSURE_SUCCESS(rv, rv);
     }
     else {
-        nsCOMPtr<nsIContent> html, head, body;
+        RefPtr<Element> html, head, body;
         rv = createXHTMLElement(nsGkAtoms::html, getter_AddRefs(html));
         NS_ENSURE_SUCCESS(rv, rv);
 
@@ -212,12 +213,17 @@ txMozillaTextOutput::createResultDocument(nsIDocument* aSourceDocument,
         rv = html->AppendChildTo(body, false);
         NS_ENSURE_SUCCESS(rv, rv);
 
-        rv = createXHTMLElement(nsGkAtoms::pre, getter_AddRefs(mTextParent));
+        {
-        NS_ENSURE_SUCCESS(rv, rv);
+          RefPtr<Element> textParent;
+          rv = createXHTMLElement(nsGkAtoms::pre, getter_AddRefs(textParent));
+          NS_ENSURE_SUCCESS(rv, rv);
+          mTextParent = textParent.forget();
+        }
 
-        rv = mTextParent->SetAttr(kNameSpaceID_None, nsGkAtoms::id,
+        rv = mTextParent->AsElement()->SetAttr(kNameSpaceID_None,
-                                  NS_LITERAL_STRING("transformiixResult"),
+                                               nsGkAtoms::id,
-                                  false);
+                                               NS_LITERAL_STRING("transformiixResult"),
+                                               false);
         NS_ENSURE_SUCCESS(rv, rv);
 
         rv = body->AppendChildTo(mTextParent, false);
@@ -250,8 +256,7 @@ void txMozillaTextOutput::getOutputDocument(nsIDOMDocument** aDocument)
 }
 
 nsresult
-txMozillaTextOutput::createXHTMLElement(nsAtom* aName,
+txMozillaTextOutput::createXHTMLElement(nsAtom* aName, Element** aResult)
-                                        nsIContent** aResult)
 {
     nsCOMPtr<Element> element = mDocument->CreateHTMLElement(aName);
     element.forget(aResult);

dom/xslt/xslt/txMozillaTextOutput.h

@@ -16,6 +16,12 @@ class nsITransformObserver;
 class nsIDocument;
 class nsIContent;
 
+namespace mozilla {
+namespace dom {
+class Element;
+}
+}
+
 class txMozillaTextOutput : public txAOutputXMLEventHandler
 {
 public:
@@ -30,7 +36,7 @@ public:
                                   bool aLoadedAsData);
 
 private:
-    nsresult createXHTMLElement(nsAtom* aName, nsIContent** aResult);
+    nsresult createXHTMLElement(nsAtom* aName, mozilla::dom::Element** aResult);
 
     nsCOMPtr<nsIContent> mTextParent;
     nsWeakPtr mObserver;

dom/xslt/xslt/txMozillaXMLOutput.cpp

@@ -688,7 +688,7 @@ txMozillaXMLOutput::startHTMLElement(nsIContent* aElement, bool aIsHTML)
     }
     else if (aElement->IsHTMLElement(nsGkAtoms::tr) && aIsHTML &&
              NS_PTR_TO_INT32(mTableStateStack.peek()) == TABLE) {
-        nsCOMPtr<nsIContent> tbody;
+        RefPtr<Element> tbody;
         rv = createHTMLElement(nsGkAtoms::tbody, getter_AddRefs(tbody));
         NS_ENSURE_SUCCESS(rv, rv);
 
@@ -708,7 +708,7 @@ txMozillaXMLOutput::startHTMLElement(nsIContent* aElement, bool aIsHTML)
              mOutputFormat.mMethod == eHTMLOutput) {
         // Insert META tag, according to spec, 16.2, like
         // <META http-equiv="Content-Type" content="text/html; charset=EUC-JP">
-        nsCOMPtr<nsIContent> meta;
+        RefPtr<Element> meta;
         rv = createHTMLElement(nsGkAtoms::meta, getter_AddRefs(meta));
         NS_ENSURE_SUCCESS(rv, rv);
 
@@ -915,8 +915,7 @@ txMozillaXMLOutput::createResultDocument(const nsAString& aName, int32_t aNsID,
 }
 
 nsresult
-txMozillaXMLOutput::createHTMLElement(nsAtom* aName,
+txMozillaXMLOutput::createHTMLElement(nsAtom* aName, Element** aResult)
-                                      nsIContent** aResult)
 {
     NS_ASSERTION(mOutputFormat.mMethod == eHTMLOutput,
                  "need to adjust createHTMLElement");

dom/xslt/xslt/txMozillaXMLOutput.h

@@ -82,7 +82,7 @@ private:
     nsresult endHTMLElement(nsIContent* aElement);
     void processHTTPEquiv(nsAtom* aHeader, const nsString& aValue);
     nsresult createHTMLElement(nsAtom* aName,
-                               nsIContent** aResult);
+                               mozilla::dom::Element** aResult);
 
     nsresult attributeInternal(nsAtom* aPrefix, nsAtom* aLocalName,
                                int32_t aNsID, const nsString& aValue);

dom/xul/XULDocument.cpp

@@ -158,7 +158,7 @@ nsRefMapEntry::GetFirstElement()
 }
 
 void
-nsRefMapEntry::AppendAll(nsCOMArray<nsIContent>* aElements)
+nsRefMapEntry::AppendAll(nsCOMArray<Element>* aElements)
 {
     for (size_t i = 0; i < mRefContentList.Length(); ++i) {
         aElements->AppendObject(mRefContentList[i]);
@@ -1098,7 +1098,7 @@ XULDocument::ContentRemoved(nsIDocument* aDocument,
 
 void
 XULDocument::GetElementsForID(const nsAString& aID,
-                              nsCOMArray<nsIContent>& aElements)
+                              nsCOMArray<Element>& aElements)
 {
     aElements.Clear();
 
@@ -2059,7 +2059,7 @@ XULDocument::ApplyPersistentAttributes()
 nsresult
 XULDocument::ApplyPersistentAttributesInternal()
 {
-    nsCOMArray<nsIContent> elements;
+    nsCOMArray<Element> elements;
 
     nsAutoCString utf8uri;
     nsresult rv = mDocumentURI->GetSpec(utf8uri);
@@ -2107,7 +2107,7 @@ XULDocument::ApplyPersistentAttributesInternal()
 
 nsresult
 XULDocument::ApplyPersistentAttributesToElements(const nsAString &aID,
-                                                 nsCOMArray<nsIContent>& aElements)
+                                                 nsCOMArray<Element>& aElements)
 {
     nsAutoCString utf8uri;
     nsresult rv = mDocumentURI->GetSpec(utf8uri);
@@ -2147,12 +2147,12 @@ XULDocument::ApplyPersistentAttributesToElements(const nsAString &aID,
         uint32_t cnt = aElements.Count();
 
         for (int32_t i = int32_t(cnt) - 1; i >= 0; --i) {
-            nsCOMPtr<nsIContent> element = aElements.SafeObjectAt(i);
+            RefPtr<Element> element = aElements.SafeObjectAt(i);
             if (!element) {
                  continue;
             }
 
-            rv = element->SetAttr(kNameSpaceID_None, attr, value, PR_TRUE);
+            Unused << element->SetAttr(kNameSpaceID_None, attr, value, true);
         }
     }
 
@@ -3153,7 +3153,7 @@ XULDocument::MaybeBroadcast()
             for (uint32_t i = 0; i < mDelayedAttrChangeBroadcasts.Length(); ++i) {
                 nsAtom* attrName = mDelayedAttrChangeBroadcasts[i].mAttrName;
                 if (mDelayedAttrChangeBroadcasts[i].mNeedsAttrChange) {
-                    nsCOMPtr<nsIContent> listener =
+                    nsCOMPtr<Element> listener =
                         do_QueryInterface(mDelayedAttrChangeBroadcasts[i].mListener);
                     const nsString& value = mDelayedAttrChangeBroadcasts[i].mAttr;
                     if (mDelayedAttrChangeBroadcasts[i].mSetAttr) {
@@ -3610,7 +3610,7 @@ XULDocument::CreateOverlayElement(nsXULPrototypeElement* aPrototype,
 
 nsresult
 XULDocument::AddAttributes(nsXULPrototypeElement* aPrototype,
-                           nsIContent* aElement)
+                           Element* aElement)
 {
     nsresult rv;
 
@@ -3694,12 +3694,12 @@ XULDocument::CreateTemplateBuilder(Element* aElement)
 
         // Create a <treechildren> if one isn't there already.
         // XXXvarga what about attributes?
-        nsCOMPtr<nsIContent> bodyContent;
+        RefPtr<Element> bodyContent;
         nsXULContentUtils::FindChildByTag(aElement, kNameSpaceID_XUL,
                                           nsGkAtoms::treechildren,
                                           getter_AddRefs(bodyContent));
 
-        if (! bodyContent) {
+        if (!bodyContent) {
             bodyContent =
                 document->CreateElem(nsDependentAtomString(nsGkAtoms::treechildren),
                                      nullptr, kNameSpaceID_XUL);
@@ -3760,7 +3760,7 @@ XULDocument::OverlayForwardReference::Resolve()
     // Resolve a forward reference from an overlay element; attempt to
     // hook it up into the main document.
     nsresult rv;
-    nsCOMPtr<nsIContent> target;
+    RefPtr<Element> target;
 
     nsIPresShell *shell = mDocument->GetShell();
     bool notify = shell && shell->DidInitialize();
@@ -3818,23 +3818,23 @@ XULDocument::OverlayForwardReference::Resolve()
 
 
 nsresult
-XULDocument::OverlayForwardReference::Merge(nsIContent* aTargetNode,
+XULDocument::OverlayForwardReference::Merge(Element* aTargetElement,
-                                            nsIContent* aOverlayNode,
+                                            Element* aOverlayElement,
                                             bool aNotify)
 {
     // This function is given:
-    // aTargetNode:  the node in the document whose 'id' attribute
+    // aTargetElement:  the element in the document whose 'id' attribute
-    //               matches a toplevel node in our overlay.
+    //                  matches a toplevel node in our overlay.
-    // aOverlayNode: the node in the overlay document that matches
+    // aOverlayElement: the element in the overlay document that matches
-    //               a node in the actual document.
+    //                  an element in the actual document.
-    // aNotify:      whether or not content manipulation methods should
+    // aNotify:         whether or not content manipulation methods should
-    //               use the aNotify parameter. After the initial
+    //                  use the aNotify parameter. After the initial
-    //               reflow (i.e. in the dynamic overlay merge case),
+    //                  reflow (i.e. in the dynamic overlay merge case),
-    //               we want all the content manipulation methods we
+    //                  we want all the content manipulation methods we
-    //               call to notify so that frames are constructed
+    //                  call to notify so that frames are constructed
-    //               etc. Otherwise do not, since that's during initial
+    //                  etc. Otherwise do not, since that's during initial
-    //               document construction before StartLayout has been
+    //                  document construction before StartLayout has been
-    //               called which will do everything for us.
+    //                  called which will do everything for us.
     //
     // This function merges the tree from the overlay into the tree in
     // the document, overwriting attributes and appending child content
@@ -3846,27 +3846,27 @@ XULDocument::OverlayForwardReference::Merge(nsIContent* aTargetNode,
     // actual document.
     uint32_t i;
     const nsAttrName* name;
-    for (i = 0; (name = aOverlayNode->GetAttrNameAt(i)); ++i) {
+    for (i = 0; (name = aOverlayElement->GetAttrNameAt(i)); ++i) {
         // We don't want to swap IDs, they should be the same.
         if (name->Equals(nsGkAtoms::id))
             continue;
 
         // In certain cases merging command or observes is unsafe, so don't.
         if (!aNotify) {
-            if (aTargetNode->NodeInfo()->Equals(nsGkAtoms::observes,
+            if (aTargetElement->NodeInfo()->Equals(nsGkAtoms::observes,
-                                                kNameSpaceID_XUL))
+                                                   kNameSpaceID_XUL))
                 continue;
 
             if (name->Equals(nsGkAtoms::observes) &&
-                aTargetNode->HasAttr(kNameSpaceID_None, nsGkAtoms::observes))
+                aTargetElement->HasAttr(kNameSpaceID_None, nsGkAtoms::observes))
                 continue;
 
             if (name->Equals(nsGkAtoms::command) &&
-                aTargetNode->HasAttr(kNameSpaceID_None, nsGkAtoms::command) &&
+                aTargetElement->HasAttr(kNameSpaceID_None, nsGkAtoms::command) &&
-                !aTargetNode->NodeInfo()->Equals(nsGkAtoms::key,
+                !aTargetElement->NodeInfo()->Equals(nsGkAtoms::key,
-                                                 kNameSpaceID_XUL) &&
+                                                    kNameSpaceID_XUL) &&
-                !aTargetNode->NodeInfo()->Equals(nsGkAtoms::menuitem,
+                !aTargetElement->NodeInfo()->Equals(nsGkAtoms::menuitem,
-                                                 kNameSpaceID_XUL))
+                                                   kNameSpaceID_XUL))
                 continue;
         }
 
@@ -3875,27 +3875,23 @@ XULDocument::OverlayForwardReference::Merge(nsIContent* aTargetNode,
         nsAtom* prefix = name->GetPrefix();
 
         nsAutoString value;
-        aOverlayNode->GetAttr(nameSpaceID, attr, value);
+        aOverlayElement->GetAttr(nameSpaceID, attr, value);
 
         // Element in the overlay has the 'removeelement' attribute set
         // so remove it from the actual document.
-        if (attr == nsGkAtoms::removeelement &&
+        if (attr == nsGkAtoms::removeelement && value.EqualsLiteral("true")) {
-            value.EqualsLiteral("true")) {
+            nsCOMPtr<nsINode> parent = aTargetElement->GetParentNode();
-
-            nsCOMPtr<nsINode> parent = aTargetNode->GetParentNode();
             if (!parent) return NS_ERROR_FAILURE;
-            rv = RemoveElement(parent, aTargetNode);
+            rv = RemoveElement(parent, aTargetElement);
             if (NS_FAILED(rv)) return rv;
-
             return NS_OK;
         }
 
-        rv = aTargetNode->SetAttr(nameSpaceID, attr, prefix, value, aNotify);
+        rv = aTargetElement->SetAttr(nameSpaceID, attr, prefix, value, aNotify);
-        if (!NS_FAILED(rv) && !aNotify)
+        if (!NS_FAILED(rv) && !aNotify) {
-            rv = mDocument->BroadcastAttributeChangeFromOverlay(aTargetNode,
+            rv = mDocument->BroadcastAttributeChangeFromOverlay(
-                                                                nameSpaceID,
+                    aTargetElement, nameSpaceID, attr, prefix, value);
-                                                                attr, prefix,
+        }
-                                                                value);
         if (NS_FAILED(rv)) return rv;
     }
 
@@ -3907,23 +3903,23 @@ XULDocument::OverlayForwardReference::Merge(nsIContent* aTargetNode,
     // to merge inside that subtree. If not, we just append the tree to
     // the parent like any other.
 
-    uint32_t childCount = aOverlayNode->GetChildCount();
+    uint32_t childCount = aOverlayElement->GetChildCount();
 
     // This must be a strong reference since it will be the only
     // reference to a content object during part of this loop.
     nsCOMPtr<nsIContent> currContent;
 
     for (i = 0; i < childCount; ++i) {
-        currContent = aOverlayNode->GetFirstChild();
+        currContent = aOverlayElement->GetFirstChild();
 
         nsAtom *idAtom = currContent->GetID();
 
-        nsIContent *elementInDocument = nullptr;
+        Element* elementInDocument = nullptr;
         if (idAtom) {
             nsDependentAtomString id(idAtom);
 
             if (!id.IsEmpty()) {
-                nsIDocument *doc = aTargetNode->GetUncomposedDoc();
+                nsIDocument *doc = aTargetElement->GetUncomposedDoc();
                 //XXXsmaug should we use ShadowRoot::GetElementById()
                 //         if doc is null?
                 if (!doc) return NS_ERROR_FAILURE;
@@ -3938,30 +3934,31 @@ XULDocument::OverlayForwardReference::Merge(nsIContent* aTargetNode,
         // node. Otherwise, we just do an append as if the element had
         // no id attribute.
         if (elementInDocument) {
-            // Given two parents, aTargetNode and aOverlayNode, we want
+            // Given two parents, aTargetElement and aOverlayElement, we want
             // to call merge on currContent if we find an associated
             // node in the document with the same id as currContent that
             // also has aTargetNode as its parent.
 
-            nsIContent *elementParent = elementInDocument->GetParent();
+            nsIContent* elementParent = elementInDocument->GetParent();
 
             nsAtom *parentID = elementParent->GetID();
-            if (parentID &&
+            if (parentID && aTargetElement->GetID() == parentID) {
-                aTargetNode->AttrValueIs(kNameSpaceID_None, nsGkAtoms::id,
-                                         nsDependentAtomString(parentID),
-                                         eCaseMatters)) {
                 // The element matches. "Go Deep!"
-                rv = Merge(elementInDocument, currContent, aNotify);
+                //
+                // Note that currContent is necessarily an element, because
+                // elementInDocument can only be non-null when currContent has a
+                // non-null ID.
+                rv = Merge(elementInDocument, currContent->AsElement(), aNotify);
                 if (NS_FAILED(rv)) return rv;
-                aOverlayNode->RemoveChildAt(0, false);
+                aOverlayElement->RemoveChildAt(0, false);
 
                 continue;
             }
         }
 
-        aOverlayNode->RemoveChildAt(0, false);
+        aOverlayElement->RemoveChildAt(0, false);
 
-        rv = InsertElement(aTargetNode, currContent, aNotify);
+        rv = InsertElement(aTargetElement, currContent, aNotify);
         if (NS_FAILED(rv)) return rv;
     }
 
@@ -4092,7 +4089,7 @@ XULDocument::BroadcastAttributeChangeFromOverlay(nsIContent* aNode,
             (bl->mAttribute != nsGkAtoms::_asterisk))
             continue;
 
-        nsCOMPtr<nsIContent> l = do_QueryReferent(bl->mListener);
+        nsCOMPtr<Element> l = do_QueryReferent(bl->mListener);
         if (l) {
             rv = l->SetAttr(aNameSpaceID, aAttribute,
                             aPrefix, aValue, false);
@@ -4255,8 +4252,7 @@ XULDocument::CheckBroadcasterHookup(Element* aElement,
 }
 
 nsresult
-XULDocument::InsertElement(nsINode* aParent, nsIContent* aChild,
+XULDocument::InsertElement(nsINode* aParent, nsIContent* aChild, bool aNotify)
-                           bool aNotify)
 {
     // Insert aChild appropriately into aParent, accounting for a
     // 'pos' attribute set on aChild.
@@ -4306,7 +4302,6 @@ XULDocument::InsertElement(nsINode* aParent, nsIContent* aChild,
     }
 
     if (!wasInserted) {
-
         aChild->GetAttr(kNameSpaceID_None, nsGkAtoms::position, posStr);
         if (!posStr.IsEmpty()) {
             nsresult rv;

dom/xul/XULDocument.h

@@ -64,7 +64,7 @@ public:
   }
 
   mozilla::dom::Element* GetFirstElement();
-  void AppendAll(nsCOMArray<nsIContent>* aElements);
+  void AppendAll(nsCOMArray<mozilla::dom::Element>* aElements);
   /**
    * @return true if aElement was added, false if we failed due to OOM
    */
@@ -126,7 +126,7 @@ public:
 
     // nsIXULDocument interface
     virtual void GetElementsForID(const nsAString& aID,
-                                  nsCOMArray<nsIContent>& aElements) override;
+                                  nsCOMArray<mozilla::dom::Element>& aElements) override;
 
     NS_IMETHOD AddSubtreeToDocument(nsIContent* aContent) override;
     NS_IMETHOD RemoveSubtreeFromDocument(nsIContent* aContent) override;
@@ -262,7 +262,7 @@ protected:
     nsresult ApplyPersistentAttributes();
     nsresult ApplyPersistentAttributesInternal();
     nsresult ApplyPersistentAttributesToElements(const nsAString &aID,
-                                                 nsCOMArray<nsIContent>& aElements);
+                                                 nsCOMArray<Element>& aElements);
 
     nsresult
     AddElementToDocumentPre(Element* aElement);
@@ -440,7 +440,7 @@ protected:
     /**
      * Add attributes from the prototype to the element.
      */
-    nsresult AddAttributes(nsXULPrototypeElement* aPrototype, nsIContent* aElement);
+    nsresult AddAttributes(nsXULPrototypeElement* aPrototype, Element* aElement);
 
     /**
      * The prototype-script of the current transcluded script that is being
@@ -545,13 +545,13 @@ protected:
     {
     protected:
         XULDocument* mDocument;      // [WEAK]
-        nsCOMPtr<nsIContent> mOverlay; // [OWNER]
+        nsCOMPtr<Element> mOverlay; // [OWNER]
         bool mResolved;
 
-        nsresult Merge(nsIContent* aTargetNode, nsIContent* aOverlayNode, bool aNotify);
+        nsresult Merge(Element* aTargetNode, Element* aOverlayNode, bool aNotify);
 
     public:
-        OverlayForwardReference(XULDocument* aDocument, nsIContent* aOverlay)
+        OverlayForwardReference(XULDocument* aDocument, Element* aOverlay)
             : mDocument(aDocument), mOverlay(aOverlay), mResolved(false) {}
 
         virtual ~OverlayForwardReference();
@@ -598,6 +598,8 @@ protected:
                                  Element *aListener,
                                  const nsAString &aAttr);
 
+    // FIXME: This should probably be renamed, there's nothing guaranteeing that
+    // aChild is an Element as far as I can tell!
     static
     nsresult
     InsertElement(nsINode* aParent, nsIContent* aChild, bool aNotify);

dom/xul/nsIXULDocument.h

@@ -13,6 +13,12 @@
 class nsIXULTemplateBuilder;
 class nsIContent;
 
+namespace mozilla {
+namespace dom {
+class Element;
+}
+}
+
 
 // 81ba4be5-6cc5-478a-9b08-b3e7ed524455
 #define NS_IXULDOCUMENT_IID \
@@ -34,7 +40,8 @@ public:
    * or 'ref' is aID. The nsCOMArray will be truncated and filled in with
    * nsIContent pointers.
    */
-  virtual void GetElementsForID(const nsAString& aID, nsCOMArray<nsIContent>& aElements) = 0;
+  virtual void GetElementsForID(const nsAString& aID,
+                                nsCOMArray<mozilla::dom::Element>& aElements) = 0;
 
   /**
    * Notify the XUL document that a subtree has been added

dom/xul/nsXULElement.cpp

@@ -280,7 +280,7 @@ NS_NewXULElement(Element** aResult, already_AddRefed<mozilla::dom::NodeInfo>&& a
 }
 
 void
-NS_TrustedNewXULElement(nsIContent** aResult,
+NS_TrustedNewXULElement(Element** aResult,
                         already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo)
 {
     RefPtr<mozilla::dom::NodeInfo> ni = aNodeInfo;

dom/xul/nsXULElement.h

@@ -803,7 +803,7 @@ protected:
     NS_NewXULElement(mozilla::dom::Element** aResult, mozilla::dom::NodeInfo *aNodeInfo,
                      mozilla::dom::FromParser aFromParser, const nsAString* aIs);
     friend void
-    NS_TrustedNewXULElement(nsIContent** aResult, mozilla::dom::NodeInfo *aNodeInfo);
+    NS_TrustedNewXULElement(mozilla::dom::Element** aResult, mozilla::dom::NodeInfo *aNodeInfo);
 
     static already_AddRefed<nsXULElement>
     Create(nsXULPrototypeElement* aPrototype, mozilla::dom::NodeInfo *aNodeInfo,

dom/xul/templates/nsIXULTemplateBuilder.idl

@@ -18,6 +18,7 @@ interface nsIDOMDataTransfer;
 class nsAtom;
 %}
 [ptr] native nsAtomPtr(nsAtom);
+[ptr] native Element (mozilla::dom::Element);
 
 /**
  * A template builder, given an input source of data, a template, and a
@@ -293,7 +294,7 @@ interface nsIXULTemplateBuilder : nsISupports
      * generated even if it is closed. If false, the element will only
      * generate its contents if it is open. This behaviour is used with menus.
      */
-    [noscript] void createContents(in nsIContent aElement,
+    [noscript] void createContents(in Element aElement,
                                    in boolean aForceCreation);
 
     /**

dom/xul/templates/nsXULContentBuilder.cpp

@@ -72,7 +72,7 @@ class nsXULContentBuilder : public nsXULTemplateBuilder
 {
 public:
     // nsIXULTemplateBuilder interface
-    NS_IMETHOD CreateContents(nsIContent* aElement, bool aForceCreation) override;
+    NS_IMETHOD CreateContents(Element* aElement, bool aForceCreation) override;
 
     using nsIXULTemplateBuilder::HasGeneratedContent;
     bool HasGeneratedContent(nsIRDFResource* aResource,
@@ -101,10 +101,10 @@ protected:
 
     // Implementation methods
     nsresult
-    OpenContainer(nsIContent* aElement);
+    OpenContainer(Element* aElement);
 
     nsresult
-    CloseContainer(nsIContent* aElement);
+    CloseContainer(Element* aElement);
 
     /**
      * Build content from a template for a given result. This will be called
@@ -114,27 +114,27 @@ protected:
     nsresult
     BuildContentFromTemplate(nsIContent *aTemplateNode,
                              nsIContent *aResourceNode,
-                             nsIContent *aRealNode,
+                             Element* aRealElement,
                              bool aIsUnique,
                              bool aIsSelfReference,
                              nsIXULTemplateResult* aChild,
                              bool aNotify,
                              nsTemplateMatch* aMatch,
-                             nsIContent** aContainer,
+                             Element** aContainer,
                              int32_t* aNewIndexInContainer);
 
     /**
      * Copy the attributes from the template node to the node generated
      * from it, performing any substitutions.
      *
-     * @param aTemplateNode node within template
+     * @param aTemplateElement element within template
-     * @param aRealNode generated node to set attibutes upon
+     * @param aRealElement generated element to set attibutes upon
      * @param aResult result to look up variable->value bindings in
      * @param aNotify true to notify of DOM changes
      */
     nsresult
-    CopyAttributesToElement(nsIContent* aTemplateNode,
+    CopyAttributesToElement(Element* aTemplateElement,
-                            nsIContent* aRealNode,
+                            Element* aRealElement,
                             nsIXULTemplateResult* aResult,
                             bool aNotify);
 
@@ -147,9 +147,9 @@ protected:
      * @param aResult result to look up variable->value bindings in
      */
     nsresult
-    AddPersistentAttributes(Element* aTemplateNode,
+    AddPersistentAttributes(Element* aTemplateElement,
                             nsIXULTemplateResult* aResult,
-                            nsIContent* aRealNode);
+                            Element* aRealElement);
 
     /**
      * Recalculate any attributes that have variable references. This will
@@ -182,7 +182,7 @@ protected:
      * @param aForceCreation true to force creation for closed items such as menus
      */
     nsresult
-    CreateTemplateAndContainerContents(nsIContent* aElement,
+    CreateTemplateAndContainerContents(Element* aElement,
                                        bool aForceCreation);
 
     /**
@@ -196,7 +196,7 @@ protected:
      * @param aNotifyAtEnd notify at the end of all DOM changes
      */
     nsresult
-    CreateContainerContents(nsIContent* aElement,
+    CreateContainerContents(Element* aElement,
                             nsIXULTemplateResult* aResult,
                             bool aForceCreation,
                             bool aNotify,
@@ -212,11 +212,11 @@ protected:
      * @param aNewIndexInContainer index with container in which content was added
      */
     nsresult
-    CreateContainerContentsForQuerySet(nsIContent* aElement,
+    CreateContainerContentsForQuerySet(Element* aElement,
                                        nsIXULTemplateResult* aResult,
                                        bool aNotify,
                                        nsTemplateQuerySet* aQuerySet,
-                                       nsIContent** aContainer,
+                                       Element** aContainer,
                                        int32_t* aNewIndexInContainer);
 
     /**
@@ -231,11 +231,11 @@ protected:
      * @param aResult set to the found or created node.
      */
     nsresult
-    EnsureElementHasGenericChild(nsIContent* aParent,
+    EnsureElementHasGenericChild(Element* aParent,
                                  int32_t aNameSpaceID,
                                  nsAtom* aTag,
                                  bool aNotify,
-                                 nsIContent** aResult);
+                                 Element** aResult);
 
     bool
     IsOpen(nsIContent* aElement);
@@ -245,7 +245,7 @@ protected:
 
     nsresult
     GetElementsForResult(nsIXULTemplateResult* aResult,
-                         nsCOMArray<nsIContent>& aElements);
+                         nsCOMArray<Element>& aElements);
 
     nsresult
     CreateElement(int32_t aNameSpaceID,
@@ -264,7 +264,7 @@ protected:
      * @param aNotify true to notify of DOM changes
      */
     nsresult
-    SetContainerAttrs(nsIContent *aElement,
+    SetContainerAttrs(Element* aElement,
                       nsIXULTemplateResult* aResult,
                       bool aIgnoreNonContainers,
                       bool aNotify);
@@ -282,7 +282,7 @@ protected:
      */
     virtual bool
     GetInsertionLocations(nsIXULTemplateResult* aOldResult,
-                          nsCOMArray<nsIContent>** aLocations) override;
+                          nsCOMArray<Element>** aLocations) override;
 
     /**
      * Remove the content associated with aOldResult which no longer matches,
@@ -292,7 +292,7 @@ protected:
     ReplaceMatch(nsIXULTemplateResult* aOldResult,
                  nsTemplateMatch* aNewMatch,
                  nsTemplateRule* aNewMatchRule,
-                 void *aContext) override;
+                 Element* aContext) override;
 
     /**
      * Synchronize a result bindings with the generated content for that
@@ -317,7 +317,7 @@ protected:
      * the result for the generated node.
      */
     nsresult
-    InsertSortedNode(nsIContent* aContainer,
+    InsertSortedNode(Element* aContainer,
                      nsIContent* aNode,
                      nsIXULTemplateResult* aResult,
                      bool aNotify);
@@ -378,13 +378,13 @@ nsXULContentBuilder::Uninit(bool aIsFinal)
 nsresult
 nsXULContentBuilder::BuildContentFromTemplate(nsIContent *aTemplateNode,
                                               nsIContent *aResourceNode,
-                                              nsIContent *aRealNode,
+                                              Element* aRealElement,
                                               bool aIsUnique,
                                               bool aIsSelfReference,
                                               nsIXULTemplateResult* aChild,
                                               bool aNotify,
                                               nsTemplateMatch* aMatch,
-                                              nsIContent** aContainer,
+                                              Element** aContainer,
                                               int32_t* aNewIndexInContainer)
 {
     // This is the mother lode. Here is where we grovel through an
@@ -401,7 +401,7 @@ nsXULContentBuilder::BuildContentFromTemplate(nsIContent *aTemplateNode,
     //   not directly used here, but rather passed down to the XUL
     //   sort service to perform container-level sort.
     //
-    //   |aRealNode| is the element in the "real" content tree to which
+    //   |aRealElement| is the element in the "real" content tree to which
     //   the new elements will be copied.
     //
     //   |aIsUnique| is set to "true" so long as content has been
@@ -448,7 +448,7 @@ nsXULContentBuilder::BuildContentFromTemplate(nsIContent *aTemplateNode,
                ("Tags: [Template: %s  Resource: %s  Real: %s] for id %s",
                 nsAtomCString(aTemplateNode->NodeInfo()->NameAtom()).get(),
                 nsAtomCString(aResourceNode->NodeInfo()->NameAtom()).get(),
-                nsAtomCString(aRealNode->NodeInfo()->NameAtom()).get(), NS_ConvertUTF16toUTF8(id).get()));
+                nsAtomCString(aRealElement->NodeInfo()->NameAtom()).get(), NS_ConvertUTF16toUTF8(id).get()));
     }
 
     // Iterate through all of the template children, constructing
@@ -456,7 +456,6 @@ nsXULContentBuilder::BuildContentFromTemplate(nsIContent *aTemplateNode,
     for (nsIContent* tmplKid = aTemplateNode->GetFirstChild();
          tmplKid;
          tmplKid = tmplKid->GetNextSibling()) {
-
         int32_t nameSpaceID = tmplKid->GetNameSpaceID();
 
         // Check whether this element is the generation element. The generation
@@ -511,7 +510,7 @@ nsXULContentBuilder::BuildContentFromTemplate(nsIContent *aTemplateNode,
 
         MOZ_ASSERT_IF(isGenerationElement, tmplKid->IsElement());
 
-        nsAtom *tag = tmplKid->NodeInfo()->NameAtom();
+        nsAtom* tag = tmplKid->NodeInfo()->NameAtom();
 
         if (MOZ_LOG_TEST(gXULTemplateLog, LogLevel::Debug)) {
             MOZ_LOG(gXULTemplateLog, LogLevel::Debug,
@@ -525,29 +524,41 @@ nsXULContentBuilder::BuildContentFromTemplate(nsIContent *aTemplateNode,
         // already existed in the content model.
         bool realKidAlreadyExisted = false;
 
-        nsCOMPtr<nsIContent> realKid;
+        RefPtr<Element> realKid;
         if (isUnique) {
             // The content is "unique"; that is, we haven't descended
             // far enough into the template to hit the generation
             // element yet. |EnsureElementHasGenericChild()| will
             // conditionally create the element iff it isn't there
             // already.
-            rv = EnsureElementHasGenericChild(aRealNode, nameSpaceID, tag, aNotify, getter_AddRefs(realKid));
+            //
-            if (NS_FAILED(rv))
+            // FIXME(emilio): The code below doesn't really make much sense if
-                return rv;
+            // tmplKid is not an element. If it ever wasn't, we'd either find a
+            // child by tag, which doesn't really make sense, and event worse...
+            // If we didn't find it, we'd create an actual element with a text
+            // node tag for it.
+            //
+            // Both are completely bogus in tons of ways, so just avoid calling
+            // into EnsureElementHasGenericChild for non-elements, assuming the
+            // node is already there.
+            rv = NS_ELEMENT_WAS_THERE;
+            if (tmplKid->IsElement()) {
+              rv = EnsureElementHasGenericChild(aRealElement, nameSpaceID, tag, aNotify, getter_AddRefs(realKid));
+              if (NS_FAILED(rv))
+                  return rv;
+            }
 
             if (rv == NS_ELEMENT_WAS_THERE) {
                 realKidAlreadyExisted = true;
-            }
+            } else {
-            else {
                 // Potentially remember the index of this element as the first
                 // element that we've generated. Note that we remember
                 // this -before- we recurse!
                 if (aContainer && !*aContainer) {
-                    *aContainer = aRealNode;
+                    *aContainer = aRealElement;
                     NS_ADDREF(*aContainer);
 
-                    uint32_t indx = aRealNode->GetChildCount();
+                    uint32_t indx = aRealElement->GetChildCount();
 
                     // Since EnsureElementHasGenericChild() added us, make
                     // sure to subtract one for our real index.
@@ -566,8 +577,7 @@ nsXULContentBuilder::BuildContentFromTemplate(nsIContent *aTemplateNode,
 
             if (NS_FAILED(rv))
                 return rv;
-        }
+        } else if (isGenerationElement) {
-        else if (isGenerationElement) {
             // It's the "resource" element. Create a new element using
             // the namespace ID and tag from the template element.
             nsCOMPtr<Element> element;
@@ -592,9 +602,8 @@ nsXULContentBuilder::BuildContentFromTemplate(nsIContent *aTemplateNode,
 
             // Set up the element's 'container' and 'empty' attributes.
             SetContainerAttrs(realKid, aChild, true, false);
-        }
+        } else if (tag == nsGkAtoms::textnode &&
-        else if (tag == nsGkAtoms::textnode &&
+                   nameSpaceID == kNameSpaceID_XUL) {
-                 nameSpaceID == kNameSpaceID_XUL) {
             // <xul:text value="..."> is replaced by text of the
             // actual value of the 'rdf:resource' attribute for the
             // given node.
@@ -612,14 +621,13 @@ nsXULContentBuilder::BuildContentFromTemplate(nsIContent *aTemplateNode,
 
                 content->SetText(value, false);
 
-                rv = aRealNode->AppendChildTo(content, aNotify);
+                rv = aRealElement->AppendChildTo(content, aNotify);
                 if (NS_FAILED(rv)) return rv;
 
                 // XXX Don't bother remembering text nodes as the
                 // first element we've generated?
             }
-        }
+        } else if (tmplKid->IsNodeOfType(nsINode::eTEXT)) {
-        else if (tmplKid->IsNodeOfType(nsINode::eTEXT)) {
             nsCOMPtr<nsIDOMNode> tmplTextNode = do_QueryInterface(tmplKid);
             if (!tmplTextNode) {
                 NS_ERROR("textnode not implementing nsIDOMNode??");
@@ -632,10 +640,9 @@ nsXULContentBuilder::BuildContentFromTemplate(nsIContent *aTemplateNode,
                 NS_ERROR("failed to clone textnode");
                 return NS_ERROR_FAILURE;
             }
-            rv = aRealNode->AppendChildTo(clonedContent, aNotify);
+            rv = aRealElement->AppendChildTo(clonedContent, aNotify);
             if (NS_FAILED(rv)) return rv;
-        }
+        } else {
-        else {
             // It's just a generic element. Create it!
             nsCOMPtr<Element> element;
             rv = CreateElement(nameSpaceID, tag, getter_AddRefs(element));
@@ -647,10 +654,10 @@ nsXULContentBuilder::BuildContentFromTemplate(nsIContent *aTemplateNode,
             // Potentially remember the index of this element as the
             // first element that we've generated.
             if (aContainer && !*aContainer) {
-                *aContainer = aRealNode;
+                *aContainer = aRealElement;
                 NS_ADDREF(*aContainer);
 
-                uint32_t indx = aRealNode->GetChildCount();
+                uint32_t indx = aRealElement->GetChildCount();
 
                 // Since we haven't inserted any content yet, our new
                 // index in the container will be the current count of
@@ -663,7 +670,9 @@ nsXULContentBuilder::BuildContentFromTemplate(nsIContent *aTemplateNode,
             // template to incrementally build content.
             mTemplateMap.Put(realKid, tmplKid);
 
-            rv = CopyAttributesToElement(tmplKid, realKid, aChild, false);
+            rv = CopyAttributesToElement(tmplKid->AsElement(),
+                                         realKid, aChild,
+                                         false);
             if (NS_FAILED(rv)) return rv;
 
             // Add any persistent attributes
@@ -703,10 +712,10 @@ nsXULContentBuilder::BuildContentFromTemplate(nsIContent *aTemplateNode,
                 rv = NS_ERROR_UNEXPECTED;
 
                 if (isGenerationElement)
-                    rv = InsertSortedNode(aRealNode, realKid, aChild, aNotify);
+                    rv = InsertSortedNode(aRealElement, realKid, aChild, aNotify);
 
                 if (NS_FAILED(rv)) {
-                    rv = aRealNode->AppendChildTo(realKid, aNotify);
+                    rv = aRealElement->AppendChildTo(realKid, aNotify);
                     NS_ASSERTION(NS_SUCCEEDED(rv), "unable to insert element");
                 }
             }
@@ -717,18 +726,18 @@ nsXULContentBuilder::BuildContentFromTemplate(nsIContent *aTemplateNode,
 }
 
 nsresult
-nsXULContentBuilder::CopyAttributesToElement(nsIContent* aTemplateNode,
+nsXULContentBuilder::CopyAttributesToElement(Element* aTemplateElement,
-                                             nsIContent* aRealNode,
+                                             Element* aRealElement,
                                              nsIXULTemplateResult* aResult,
                                              bool aNotify)
 {
     nsresult rv;
 
     // Copy all attributes from the template to the new element
-    uint32_t numAttribs = aTemplateNode->GetAttrCount();
+    uint32_t numAttribs = aTemplateElement->GetAttrCount();
 
     for (uint32_t attr = 0; attr < numAttribs; attr++) {
-        const nsAttrName* name = aTemplateNode->GetAttrNameAt(attr);
+        const nsAttrName* name = aTemplateElement->GetAttrNameAt(attr);
         int32_t attribNameSpaceID = name->NamespaceID();
         // Hold a strong reference here so that the atom doesn't go away
         // during UnsetAttr.
@@ -737,7 +746,7 @@ nsXULContentBuilder::CopyAttributesToElement(nsIContent* aTemplateNode,
         // XXXndeakin ignore namespaces until bug 321182 is fixed
         if (attribName != nsGkAtoms::id && attribName != nsGkAtoms::uri) {
             nsAutoString attribValue;
-            aTemplateNode->GetAttr(attribNameSpaceID, attribName, attribValue);
+            aTemplateElement->GetAttr(attribNameSpaceID, attribName, attribValue);
             if (!attribValue.IsEmpty()) {
                 nsAutoString value;
                 rv = SubstituteText(aResult, attribValue, value);
@@ -747,14 +756,14 @@ nsXULContentBuilder::CopyAttributesToElement(nsIContent* aTemplateNode,
                 // if the string is empty after substitutions, remove the
                 // attribute
                 if (!value.IsEmpty()) {
-                    rv = aRealNode->SetAttr(attribNameSpaceID,
+                    rv = aRealElement->SetAttr(attribNameSpaceID,
                                             attribName,
                                             name->GetPrefix(),
                                             value,
                                             aNotify);
                 }
                 else {
-                    rv = aRealNode->UnsetAttr(attribNameSpaceID,
+                    rv = aRealElement->UnsetAttr(attribNameSpaceID,
                                               attribName,
                                               aNotify);
                 }
@@ -771,7 +780,7 @@ nsXULContentBuilder::CopyAttributesToElement(nsIContent* aTemplateNode,
 nsresult
 nsXULContentBuilder::AddPersistentAttributes(Element* aTemplateNode,
                                              nsIXULTemplateResult* aResult,
-                                             nsIContent* aRealNode)
+                                             Element* aRealElement)
 {
     if (!mRoot)
         return NS_OK;
@@ -837,8 +846,8 @@ nsXULContentBuilder::AddPersistentAttributes(Element* aTemplateNode,
         rv = value->GetValueConst(&valueStr);
         NS_ENSURE_SUCCESS(rv, rv);
 
-        rv = aRealNode->SetAttr(nameSpaceID, tag, nsDependentString(valueStr),
+        rv = aRealElement->SetAttr(nameSpaceID, tag, nsDependentString(valueStr),
-                                false);
+                                   false);
         NS_ENSURE_SUCCESS(rv, rv);
     }
 
@@ -847,15 +856,17 @@ nsXULContentBuilder::AddPersistentAttributes(Element* aTemplateNode,
 
 nsresult
 nsXULContentBuilder::SynchronizeUsingTemplate(nsIContent* aTemplateNode,
-                                              nsIContent* aRealElement,
+                                              nsIContent* aRealNode,
                                               nsIXULTemplateResult* aResult)
 {
     // check all attributes on the template node; if they reference a resource,
     // update the equivalent attribute on the content node
     nsresult rv;
-    rv = CopyAttributesToElement(aTemplateNode, aRealElement, aResult, true);
+    if (aTemplateNode->IsElement() && aRealNode->IsElement()) {
-    if (NS_FAILED(rv))
+        rv = CopyAttributesToElement(aTemplateNode->AsElement(), aRealNode->AsElement(), aResult, true);
-        return rv;
+        if (NS_FAILED(rv))
+            return rv;
+    }
 
     uint32_t count = aTemplateNode->GetChildCount();
 
@@ -865,7 +876,7 @@ nsXULContentBuilder::SynchronizeUsingTemplate(nsIContent* aTemplateNode,
         if (! tmplKid)
             break;
 
-        nsIContent *realKid = aRealElement->GetChildAt(loop);
+        nsIContent *realKid = aRealNode->GetChildAt(loop);
         if (! realKid)
             break;
 
@@ -916,7 +927,7 @@ nsXULContentBuilder::RemoveMember(nsIContent* aContent)
 }
 
 nsresult
-nsXULContentBuilder::CreateTemplateAndContainerContents(nsIContent* aElement,
+nsXULContentBuilder::CreateTemplateAndContainerContents(Element* aElement,
                                                         bool aForceCreation)
 {
     // Generate both 1) the template content for the current element,
@@ -966,7 +977,7 @@ nsXULContentBuilder::CreateTemplateAndContainerContents(nsIContent* aElement,
 }
 
 nsresult
-nsXULContentBuilder::CreateContainerContents(nsIContent* aElement,
+nsXULContentBuilder::CreateContainerContents(Element* aElement,
                                              nsIXULTemplateResult* aResult,
                                              bool aForceCreation,
                                              bool aNotify,
@@ -1021,7 +1032,7 @@ nsXULContentBuilder::CreateContainerContents(nsIContent* aElement,
     }
 
     int32_t newIndexInContainer = -1;
-    nsIContent* container = nullptr;
+    Element* container = nullptr;
 
     int32_t querySetCount = mQuerySets.Length();
 
@@ -1049,11 +1060,11 @@ nsXULContentBuilder::CreateContainerContents(nsIContent* aElement,
 }
 
 nsresult
-nsXULContentBuilder::CreateContainerContentsForQuerySet(nsIContent* aElement,
+nsXULContentBuilder::CreateContainerContentsForQuerySet(Element* aElement,
                                                         nsIXULTemplateResult* aResult,
                                                         bool aNotify,
                                                         nsTemplateQuerySet* aQuerySet,
-                                                        nsIContent** aContainer,
+                                                        Element** aContainer,
                                                         int32_t* aNewIndexInContainer)
 {
     if (MOZ_LOG_TEST(gXULTemplateLog, LogLevel::Debug)) {
@@ -1202,11 +1213,11 @@ nsXULContentBuilder::CreateContainerContentsForQuerySet(nsIContent* aElement,
 }
 
 nsresult
-nsXULContentBuilder::EnsureElementHasGenericChild(nsIContent* parent,
+nsXULContentBuilder::EnsureElementHasGenericChild(Element* parent,
                                                   int32_t nameSpaceID,
                                                   nsAtom* tag,
                                                   bool aNotify,
-                                                  nsIContent** result)
+                                                  Element** result)
 {
     nsresult rv;
 
@@ -1311,7 +1322,7 @@ nsXULContentBuilder::RemoveGeneratedContent(nsIContent* aElement)
 
 nsresult
 nsXULContentBuilder::GetElementsForResult(nsIXULTemplateResult* aResult,
-                                          nsCOMArray<nsIContent>& aElements)
+                                          nsCOMArray<Element>& aElements)
 {
     // if the root has been removed from the document, just return
     // since there won't be any generated content any more
@@ -1345,7 +1356,7 @@ nsXULContentBuilder::CreateElement(int32_t aNameSpaceID,
 }
 
 nsresult
-nsXULContentBuilder::SetContainerAttrs(nsIContent *aElement,
+nsXULContentBuilder::SetContainerAttrs(Element* aElement,
                                        nsIXULTemplateResult* aResult,
                                        bool aIgnoreNonContainers,
                                        bool aNotify)
@@ -1390,7 +1401,7 @@ nsXULContentBuilder::SetContainerAttrs(nsIContent *aElement,
 //
 
 NS_IMETHODIMP
-nsXULContentBuilder::CreateContents(nsIContent* aElement, bool aForceCreation)
+nsXULContentBuilder::CreateContents(Element* aElement, bool aForceCreation)
 {
     NS_PRECONDITION(aElement != nullptr, "null ptr");
     if (! aElement)
@@ -1436,7 +1447,7 @@ nsXULContentBuilder::HasGeneratedContent(nsIRDFResource* aResource,
         return false;
     }
 
-    nsCOMArray<nsIContent> elements;
+    nsCOMArray<Element> elements;
     xuldoc->GetElementsForID(refID, elements);
 
     uint32_t cnt = elements.Count();
@@ -1529,7 +1540,7 @@ nsXULContentBuilder::NodeWillBeDestroyed(const nsINode* aNode)
 
 bool
 nsXULContentBuilder::GetInsertionLocations(nsIXULTemplateResult* aResult,
-                                           nsCOMArray<nsIContent>** aLocations)
+                                           nsCOMArray<Element>** aLocations)
 {
     *aLocations = nullptr;
 
@@ -1542,7 +1553,7 @@ nsXULContentBuilder::GetInsertionLocations(nsIXULTemplateResult* aResult,
     if (! xuldoc)
         return false;
 
-    *aLocations = new nsCOMArray<nsIContent>;
+    *aLocations = new nsCOMArray<Element>;
     NS_ENSURE_TRUE(*aLocations, false);
 
     xuldoc->GetElementsForID(ref, **aLocations);
@@ -1578,14 +1589,13 @@ nsresult
 nsXULContentBuilder::ReplaceMatch(nsIXULTemplateResult* aOldResult,
                                   nsTemplateMatch* aNewMatch,
                                   nsTemplateRule* aNewMatchRule,
-                                  void *aContext)
+                                  Element* aContext)
 
 {
     nsresult rv;
-    nsIContent* content = static_cast<nsIContent*>(aContext);
 
     // update the container attributes for the match
-    if (content) {
+    if (aContext) {
         nsAutoString ref;
         if (aNewMatch)
             rv = aNewMatch->mResult->GetBindingFor(mRefVariable, ref);
@@ -1601,12 +1611,12 @@ nsXULContentBuilder::ReplaceMatch(nsIXULTemplateResult* aOldResult,
                 return rv;
 
             if (refResult)
-                SetContainerAttrs(content, refResult, false, true);
+                SetContainerAttrs(aContext, refResult, false, true);
         }
     }
 
     if (aOldResult) {
-        nsCOMArray<nsIContent> elements;
+        nsCOMArray<Element> elements;
         rv = GetElementsForResult(aOldResult, elements);
         if (NS_FAILED(rv))
             return rv;
@@ -1618,7 +1628,7 @@ nsXULContentBuilder::ReplaceMatch(nsIXULTemplateResult* aOldResult,
 
             nsTemplateMatch* match;
             if (mContentSupportMap.Get(child, &match)) {
-                if (content == match->GetContainer())
+                if (aContext == match->GetContainer())
                     RemoveMember(child);
             }
         }
@@ -1626,7 +1636,7 @@ nsXULContentBuilder::ReplaceMatch(nsIXULTemplateResult* aOldResult,
 
     if (aNewMatch) {
         nsCOMPtr<nsIContent> action = aNewMatchRule->GetAction();
-        return BuildContentFromTemplate(action, content, content, true,
+        return BuildContentFromTemplate(action, aContext, aContext, true,
                                         mRefVariable == aNewMatchRule->GetMemberVariable(),
                                         aNewMatch->mResult, true, aNewMatch,
                                         nullptr, nullptr);
@@ -1639,13 +1649,13 @@ nsXULContentBuilder::ReplaceMatch(nsIXULTemplateResult* aOldResult,
 nsresult
 nsXULContentBuilder::SynchronizeResult(nsIXULTemplateResult* aResult)
 {
-    nsCOMArray<nsIContent> elements;
+    nsCOMArray<Element> elements;
     GetElementsForResult(aResult, elements);
 
     uint32_t cnt = elements.Count();
 
     for (int32_t i = int32_t(cnt) - 1; i >= 0; --i) {
-        nsCOMPtr<nsIContent> element = elements.SafeObjectAt(i);
+        nsCOMPtr<Element> element = elements.SafeObjectAt(i);
 
         nsTemplateMatch* match;
         if (! mContentSupportMap.Get(element, &match))
@@ -1671,7 +1681,7 @@ nsXULContentBuilder::SynchronizeResult(nsIXULTemplateResult* aResult)
 //
 
 nsresult
-nsXULContentBuilder::OpenContainer(nsIContent* aElement)
+nsXULContentBuilder::OpenContainer(Element* aElement)
 {
     if (aElement != mRoot) {
         if (mFlags & eDontRecurse)
@@ -1707,7 +1717,7 @@ nsXULContentBuilder::OpenContainer(nsIContent* aElement)
 }
 
 nsresult
-nsXULContentBuilder::CloseContainer(nsIContent* aElement)
+nsXULContentBuilder::CloseContainer(Element* aElement)
 {
     return NS_OK;
 }
@@ -1793,7 +1803,7 @@ nsXULContentBuilder::CompareResultToNode(nsIXULTemplateResult* aResult,
 }
 
 nsresult
-nsXULContentBuilder::InsertSortedNode(nsIContent* aContainer,
+nsXULContentBuilder::InsertSortedNode(Element* aContainer,
                                       nsIContent* aNode,
                                       nsIXULTemplateResult* aResult,
                                       bool aNotify)

dom/xul/templates/nsXULContentUtils.cpp

@@ -126,15 +126,15 @@ nsresult
 nsXULContentUtils::FindChildByTag(nsIContent* aElement,
                                   int32_t aNameSpaceID,
                                   nsAtom* aTag,
-                                  nsIContent** aResult)
+                                  Element** aResult)
 {
     for (nsIContent* child = aElement->GetFirstChild();
          child;
          child = child->GetNextSibling()) {
 
-        if (child->NodeInfo()->Equals(aTag, aNameSpaceID)) {
+        if (child->IsElement() &&
-            NS_ADDREF(*aResult = child);
+            child->NodeInfo()->Equals(aTag, aNameSpaceID)) {
-
+            NS_ADDREF(*aResult = child->AsElement());
             return NS_OK;
         }
     }

dom/xul/templates/nsXULContentUtils.h

@@ -23,6 +23,12 @@ class nsIRDFLiteral;
 class nsIRDFService;
 class nsICollation;
 
+namespace mozilla {
+namespace dom {
+class Element;
+}
+}
+
 // errors to pass to LogTemplateError
 #define ERROR_TEMPLATE_INVALID_QUERYPROCESSOR                           \
         "querytype attribute doesn't specify a valid query processor"
@@ -103,7 +109,7 @@ public:
     FindChildByTag(nsIContent *aElement,
                    int32_t aNameSpaceID,
                    nsAtom* aTag,
-                   nsIContent **aResult);
+                   mozilla::dom::Element** aResult);
 
     static nsresult
     FindChildByResource(nsIContent* aElement,

dom/xul/templates/nsXULSortService.cpp

@@ -28,26 +28,26 @@
 NS_IMPL_ISUPPORTS(XULSortServiceImpl, nsIXULSortService)
 
 void
-XULSortServiceImpl::SetSortHints(nsIContent *aNode, nsSortState* aSortState)
+XULSortServiceImpl::SetSortHints(Element* aElement, nsSortState* aSortState)
 {
   // set sort and sortDirection attributes when is sort is done
-  aNode->SetAttr(kNameSpaceID_None, nsGkAtoms::sort,
+  aElement->SetAttr(kNameSpaceID_None, nsGkAtoms::sort,
-                 aSortState->sort, true);
+                    aSortState->sort, true);
 
   nsAutoString direction;
   if (aSortState->direction == nsSortState_descending)
     direction.AssignLiteral("descending");
   else if (aSortState->direction == nsSortState_ascending)
     direction.AssignLiteral("ascending");
-  aNode->SetAttr(kNameSpaceID_None, nsGkAtoms::sortDirection,
+  aElement->SetAttr(kNameSpaceID_None, nsGkAtoms::sortDirection,
-                 direction, true);
+                    direction, true);
 
   // for trees, also set the sort info on the currently sorted column
-  if (aNode->NodeInfo()->Equals(nsGkAtoms::tree, kNameSpaceID_XUL)) {
+  if (aElement->NodeInfo()->Equals(nsGkAtoms::tree, kNameSpaceID_XUL)) {
     if (aSortState->sortKeys.Length() >= 1) {
       nsAutoString sortkey;
       aSortState->sortKeys[0]->ToString(sortkey);
-      SetSortColumnHints(aNode, sortkey, direction);
+      SetSortColumnHints(aElement, sortkey, direction);
     }
   }
 }
@@ -71,17 +71,18 @@ XULSortServiceImpl::SetSortColumnHints(nsIContent *content,
       if (value.IsEmpty())
         child->GetAttr(kNameSpaceID_None, nsGkAtoms::resource, value);
       if (value == sortResource) {
-        child->SetAttr(kNameSpaceID_None, nsGkAtoms::sortActive,
+        child->AsElement()->SetAttr(kNameSpaceID_None, nsGkAtoms::sortActive,
-                       NS_LITERAL_STRING("true"), true);
+                                    NS_LITERAL_STRING("true"), true);
-        child->SetAttr(kNameSpaceID_None, nsGkAtoms::sortDirection,
+
-                       sortDirection, true);
+        child->AsElement()->SetAttr(kNameSpaceID_None, nsGkAtoms::sortDirection,
+                                    sortDirection, true);
         // Note: don't break out of loop; want to set/unset
         // attribs on ALL sort columns
       } else if (!value.IsEmpty()) {
-        child->UnsetAttr(kNameSpaceID_None, nsGkAtoms::sortActive,
+        child->AsElement()->UnsetAttr(kNameSpaceID_None, nsGkAtoms::sortActive,
-                         true);
+                                      true);
-        child->UnsetAttr(kNameSpaceID_None, nsGkAtoms::sortDirection,
+        child->AsElement()->UnsetAttr(kNameSpaceID_None,
-                         true);
+                                      nsGkAtoms::sortDirection, true);
       }
     }
   }
@@ -109,7 +110,7 @@ XULSortServiceImpl::GetItemsToSort(nsIContent *aContainer,
 
   // if there is no template builder, just get the children. For trees,
   // get the treechildren element as use that as the parent
-  nsCOMPtr<nsIContent> treechildren;
+  RefPtr<Element> treechildren;
   if (aContainer->NodeInfo()->Equals(nsGkAtoms::tree, kNameSpaceID_XUL)) {
     nsXULContentUtils::FindChildByTag(aContainer,
                                       kNameSpaceID_XUL,
@@ -323,8 +324,8 @@ XULSortServiceImpl::InvertSortInfo(nsTArray<contentSortInfo>& aData,
 }
 
 nsresult
-XULSortServiceImpl::InitializeSortState(nsIContent* aRootElement,
+XULSortServiceImpl::InitializeSortState(Element* aRootElement,
-                                        nsIContent* aContainer,
+                                        Element* aContainer,
                                         const nsAString& aSortKey,
                                         const nsAString& aSortHints,
                                         nsSortState* aSortState)
@@ -467,7 +468,7 @@ XULSortServiceImpl::Sort(nsIDOMNode* aNode,
                          const nsAString& aSortHints)
 {
   // get root content node
-  nsCOMPtr<nsIContent> sortNode = do_QueryInterface(aNode);
+  nsCOMPtr<Element> sortNode = do_QueryInterface(aNode);
   if (!sortNode)
     return NS_ERROR_FAILURE;
 

dom/xul/templates/nsXULSortService.h

@@ -96,7 +96,7 @@ public:
    * Set sort and sortDirection attributes when a sort is done.
    */
   void
-  SetSortHints(nsIContent *aNode, nsSortState* aSortState);
+  SetSortHints(mozilla::dom::Element* aElement, nsSortState* aSortState);
 
   /**
    * Set sortActive and sortDirection attributes on a tree column when a sort
@@ -156,8 +156,8 @@ public:
    * @param aSortState structure filled in with sort data
    */
   static nsresult
-  InitializeSortState(nsIContent* aRootElement,
+  InitializeSortState(mozilla::dom::Element* aRootElement,
-                      nsIContent* aContainer,
+                      mozilla::dom::Element* aContainer,
                       const nsAString& aSortKey,
                       const nsAString& aSortDirection,
                       nsSortState* aSortState);

dom/xul/templates/nsXULTemplateBuilder.cpp

@@ -476,7 +476,7 @@ nsXULTemplateBuilder::Init()
 }
 
 NS_IMETHODIMP
-nsXULTemplateBuilder::CreateContents(nsIContent* aElement, bool aForceCreation)
+nsXULTemplateBuilder::CreateContents(Element* aElement, bool aForceCreation)
 {
     return NS_OK;
 }
@@ -575,7 +575,7 @@ nsXULTemplateBuilder::UpdateResult(nsIXULTemplateResult* aOldResult,
     // will be false if the result applies to content that is in a closed menu
     // or treeitem for example.
 
-    nsAutoPtr<nsCOMArray<nsIContent> > insertionPoints;
+    nsAutoPtr<nsCOMArray<Element> > insertionPoints;
     bool mayReplace = GetInsertionLocations(aOldResult ? aOldResult : aNewResult,
                                               getter_Transfers(insertionPoints));
     if (! mayReplace)
@@ -632,7 +632,7 @@ nsXULTemplateBuilder::UpdateResult(nsIXULTemplateResult* aOldResult,
         // that container
         uint32_t count = insertionPoints->Count();
         for (uint32_t t = 0; t < count; t++) {
-            nsCOMPtr<nsIContent> insertionPoint = insertionPoints->SafeObjectAt(t);
+            nsCOMPtr<Element> insertionPoint = insertionPoints->SafeObjectAt(t);
             if (insertionPoint) {
                 rv = UpdateResultInContainer(aOldResult, aNewResult, queryset,
                                              oldId, newId, insertionPoint);
@@ -657,7 +657,7 @@ nsXULTemplateBuilder::UpdateResultInContainer(nsIXULTemplateResult* aOldResult,
                                               nsTemplateQuerySet* aQuerySet,
                                               nsIRDFResource* aOldId,
                                               nsIRDFResource* aNewId,
-                                              nsIContent* aInsertionPoint)
+                                              Element* aInsertionPoint)
 {
     // This method takes a result that no longer applies (aOldResult) and
     // replaces it with a new result (aNewResult). Either may be null
@@ -1704,12 +1704,11 @@ nsXULTemplateBuilder::SubstituteTextReplaceVariable(nsXULTemplateBuilder* aThis,
 bool
 nsXULTemplateBuilder::IsTemplateElement(nsIContent* aContent)
 {
-    return aContent->NodeInfo()->Equals(nsGkAtoms::_template,
+    return aContent->NodeInfo()->Equals(nsGkAtoms::_template, kNameSpaceID_XUL);
-                                        kNameSpaceID_XUL);
 }
 
 nsresult
-nsXULTemplateBuilder::GetTemplateRoot(nsIContent** aResult)
+nsXULTemplateBuilder::GetTemplateRoot(Element** aResult)
 {
     NS_PRECONDITION(mRoot != nullptr, "not initialized");
     if (! mRoot)
@@ -1735,7 +1734,7 @@ nsXULTemplateBuilder::GetTemplateRoot(nsIContent** aResult)
         domDoc->GetElementById(templateID, getter_AddRefs(domElement));
 
         if (domElement) {
-            nsCOMPtr<nsIContent> content = do_QueryInterface(domElement);
+            nsCOMPtr<Element> content = do_QueryInterface(domElement);
             NS_ENSURE_STATE(content &&
                             !nsContentUtils::ContentIsDescendantOf(mRoot,
                                                                    content));
@@ -1751,7 +1750,7 @@ nsXULTemplateBuilder::GetTemplateRoot(nsIContent** aResult)
          child = child->GetNextSibling()) {
 
         if (IsTemplateElement(child)) {
-            NS_ADDREF(*aResult = child);
+            NS_ADDREF(*aResult = child->AsElement());
             return NS_OK;
         }
     }
@@ -1764,7 +1763,7 @@ nsXULTemplateBuilder::GetTemplateRoot(nsIContent** aResult)
     FlattenedChildIterator iter(mRoot);
     for (nsIContent* child = iter.GetNextChild(); child; child = iter.GetNextChild()) {
         if (IsTemplateElement(child)) {
-            NS_ADDREF(*aResult = child);
+            NS_ADDREF(*aResult = child->AsElement());
             return NS_OK;
         }
     }
@@ -1776,7 +1775,7 @@ nsXULTemplateBuilder::GetTemplateRoot(nsIContent** aResult)
 nsresult
 nsXULTemplateBuilder::CompileQueries()
 {
-    nsCOMPtr<nsIContent> tmpl;
+    nsCOMPtr<Element> tmpl;
     GetTemplateRoot(getter_AddRefs(tmpl));
     if (! tmpl)
         return NS_OK;
@@ -1867,7 +1866,7 @@ nsXULTemplateBuilder::CompileQueries()
 }
 
 nsresult
-nsXULTemplateBuilder::CompileTemplate(nsIContent* aTemplate,
+nsXULTemplateBuilder::CompileTemplate(Element* aTemplate,
                                       nsTemplateQuerySet* aQuerySet,
                                       bool aIsQuerySet,
                                       int32_t* aPriority,
@@ -1915,7 +1914,9 @@ nsXULTemplateBuilder::CompileTemplate(nsIContent* aTemplate,
 
             hasQuerySet = true;
 
-            rv = CompileTemplate(rulenode, aQuerySet, true, aPriority, aCanUseTemplate);
+            // Known to be a <xul:queryset>.
+            rv = CompileTemplate(rulenode->AsElement(), aQuerySet, true,
+                                 aPriority, aCanUseTemplate);
             if (NS_FAILED(rv))
                 return rv;
         }
@@ -1925,7 +1926,7 @@ nsXULTemplateBuilder::CompileTemplate(nsIContent* aTemplate,
             continue;
 
         if (ni->Equals(nsGkAtoms::rule, kNameSpaceID_XUL)) {
-            nsCOMPtr<nsIContent> action;
+            RefPtr<Element> action;
             nsXULContentUtils::FindChildByTag(rulenode,
                                               kNameSpaceID_XUL,
                                               nsGkAtoms::action,
@@ -1959,20 +1960,22 @@ nsXULTemplateBuilder::CompileTemplate(nsIContent* aTemplate,
                     }
 
                     if (aQuerySet->mCompiledQuery) {
-                        rv = CompileExtendedQuery(rulenode, action, memberVariable,
+                        // It's an element (we test it for <xul:rule>, plus it
+                        // has `action` as a kid).
+                        rv = CompileExtendedQuery(rulenode->AsElement(),
+                                                  action, memberVariable,
                                                   aQuerySet);
                         if (NS_FAILED(rv))
                             return rv;
 
                         *aCanUseTemplate = true;
                     }
-                }
+                } else {
-                else {
                     // backwards-compatible RDF template syntax where there is
                     // an <action> node but no <query> node. In this case,
                     // use the conditions as if it was the query.
 
-                    nsCOMPtr<nsIContent> conditions;
+                    RefPtr<Element> conditions;
                     nsXULContentUtils::FindChildByTag(rulenode,
                                                       kNameSpaceID_XUL,
                                                       nsGkAtoms::conditions,
@@ -2006,7 +2009,10 @@ nsXULTemplateBuilder::CompileTemplate(nsIContent* aTemplate,
                             return rv;
 
                         if (aQuerySet->mCompiledQuery) {
-                            rv = CompileExtendedQuery(rulenode, action, memberVariable,
+                            // Known to be a <xul:rule>, plus known to have
+                            // kids.
+                            rv = CompileExtendedQuery(rulenode->AsElement(),
+                                                      action, memberVariable,
                                                       aQuerySet);
                             if (NS_FAILED(rv))
                                 return rv;
@@ -2015,8 +2021,7 @@ nsXULTemplateBuilder::CompileTemplate(nsIContent* aTemplate,
                         }
                     }
                 }
-            }
+            } else {
-            else {
                 if (hasQuery)
                     continue;
 
@@ -2031,21 +2036,21 @@ nsXULTemplateBuilder::CompileTemplate(nsIContent* aTemplate,
 
                 hasQuerySet = true;
 
-                rv = CompileSimpleQuery(rulenode, aQuerySet, aCanUseTemplate);
+                // Known to be a <xul:rule>.
+                rv = CompileSimpleQuery(rulenode->AsElement(), aQuerySet,
+                                        aCanUseTemplate);
                 if (NS_FAILED(rv))
                     return rv;
             }
 
             hasRule = true;
-        }
+        } else if (ni->Equals(nsGkAtoms::query, kNameSpaceID_XUL)) {
-        else if (ni->Equals(nsGkAtoms::query, kNameSpaceID_XUL)) {
             if (hasQuery)
               continue;
 
             aQuerySet->mQueryNode = rulenode;
             hasQuery = true;
-        }
+        } else if (ni->Equals(nsGkAtoms::action, kNameSpaceID_XUL)) {
-        else if (ni->Equals(nsGkAtoms::action, kNameSpaceID_XUL)) {
             // the query must appear before the action
             if (! hasQuery)
                 continue;
@@ -2094,7 +2099,7 @@ nsXULTemplateBuilder::CompileTemplate(nsIContent* aTemplate,
 }
 
 nsresult
-nsXULTemplateBuilder::CompileExtendedQuery(nsIContent* aRuleElement,
+nsXULTemplateBuilder::CompileExtendedQuery(Element* aRuleElement,
                                            nsIContent* aActionElement,
                                            nsAtom* aMemberVariable,
                                            nsTemplateQuerySet* aQuerySet)
@@ -2107,7 +2112,7 @@ nsXULTemplateBuilder::CompileExtendedQuery(nsIContent* aRuleElement,
     if (! rule)
          return NS_ERROR_OUT_OF_MEMORY;
 
-    nsCOMPtr<nsIContent> conditions;
+    RefPtr<Element> conditions;
     nsXULContentUtils::FindChildByTag(aRuleElement,
                                       kNameSpaceID_XUL,
                                       nsGkAtoms::conditions,
@@ -2127,7 +2132,7 @@ nsXULTemplateBuilder::CompileExtendedQuery(nsIContent* aRuleElement,
     rule->SetVars(mRefVariable, aMemberVariable);
 
     // If we've got bindings, add 'em.
-    nsCOMPtr<nsIContent> bindings;
+    RefPtr<Element> bindings;
     nsXULContentUtils::FindChildByTag(aRuleElement,
                                       kNameSpaceID_XUL,
                                       nsGkAtoms::bindings,
@@ -2170,7 +2175,7 @@ void
 nsXULTemplateBuilder::DetermineRDFQueryRef(nsIContent* aQueryElement, nsAtom** aTag)
 {
     // check for a tag
-    nsCOMPtr<nsIContent> content;
+    RefPtr<Element> content;
     nsXULContentUtils::FindChildByTag(aQueryElement,
                                       kNameSpaceID_XUL,
                                       nsGkAtoms::content,
@@ -2200,7 +2205,7 @@ nsXULTemplateBuilder::DetermineRDFQueryRef(nsIContent* aQueryElement, nsAtom** a
 }
 
 nsresult
-nsXULTemplateBuilder::CompileSimpleQuery(nsIContent* aRuleElement,
+nsXULTemplateBuilder::CompileSimpleQuery(Element* aRuleElement,
                                          nsTemplateQuerySet* aQuerySet,
                                          bool* aCanUseTemplate)
 {
@@ -2457,12 +2462,12 @@ nsXULTemplateBuilder::CompileBinding(nsTemplateRule* aRule,
 
 nsresult
 nsXULTemplateBuilder::AddSimpleRuleBindings(nsTemplateRule* aRule,
-                                            nsIContent* aElement)
+                                            Element* aElement)
 {
     // Crawl the content tree of a "simple" rule, adding a variable
     // assignment for any attribute whose value is "rdf:".
 
-    AutoTArray<nsIContent*, 8> elements;
+    AutoTArray<Element*, 8> elements;
 
     if (elements.AppendElement(aElement) == nullptr)
         return NS_ERROR_OUT_OF_MEMORY;
@@ -2470,7 +2475,7 @@ nsXULTemplateBuilder::AddSimpleRuleBindings(nsTemplateRule* aRule,
     while (elements.Length()) {
         // Pop the next element off the stack
         uint32_t i = elements.Length() - 1;
-        nsIContent* element = elements[i];
+        Element* element = elements[i];
         elements.RemoveElementAt(i);
 
         // Iterate through its attributes, looking for substitutions
@@ -2495,8 +2500,10 @@ nsXULTemplateBuilder::AddSimpleRuleBindings(nsTemplateRule* aRule,
         for (nsIContent* child = element->GetLastChild();
              child;
              child = child->GetPreviousSibling()) {
+            if (!child->IsElement())
+                continue;
 
-            if (!elements.AppendElement(child))
+            if (!elements.AppendElement(child->AsElement()))
                 return NS_ERROR_OUT_OF_MEMORY;
         }
     }

dom/xul/templates/nsXULTemplateBuilder.h

@@ -159,7 +159,7 @@ public:
                             nsTemplateQuerySet* aQuerySet,
                             nsIRDFResource* aOldId,
                             nsIRDFResource* aNewId,
-                            nsIContent* aInsertionPoint);
+                            Element* aInsertionPoint);
 
     nsresult
     ComputeContainmentProperties();
@@ -193,7 +193,7 @@ public:
      * Find the <template> tag that applies for this builder
      */
     nsresult
-    GetTemplateRoot(nsIContent** aResult);
+    GetTemplateRoot(Element** aResult);
 
     /**
      * Compile the template's queries
@@ -218,7 +218,7 @@ public:
      * @param aCanUseTemplate true if template is valid
      */
     nsresult
-    CompileTemplate(nsIContent* aTemplate,
+    CompileTemplate(Element* aTemplate,
                     nsTemplateQuerySet* aQuerySet,
                     bool aIsQuerySet,
                     int32_t* aPriority,
@@ -234,7 +234,7 @@ public:
      * @param aQuerySet the queryset
      */
     nsresult
-    CompileExtendedQuery(nsIContent* aRuleElement,
+    CompileExtendedQuery(Element* aRuleElement,
                          nsIContent* aActionElement,
                          nsAtom* aMemberVariable,
                          nsTemplateQuerySet* aQuerySet);
@@ -260,7 +260,7 @@ public:
      * @param aCanUseTemplate true if the query is valid
      */
     nsresult
-    CompileSimpleQuery(nsIContent* aRuleElement,
+    CompileSimpleQuery(Element* aRuleElement,
                        nsTemplateQuerySet* aQuerySet,
                        bool* aCanUseTemplate);
 
@@ -304,7 +304,7 @@ public:
      * Add automatic bindings for simple rules
      */
     nsresult
-    AddSimpleRuleBindings(nsTemplateRule* aRule, nsIContent* aElement);
+    AddSimpleRuleBindings(nsTemplateRule* aRule, Element* aElement);
 
     static void
     AddBindingsFor(nsXULTemplateBuilder* aSelf,
@@ -494,7 +494,7 @@ protected:
      */
     virtual bool
     GetInsertionLocations(nsIXULTemplateResult* aResult,
-                          nsCOMArray<nsIContent>** aLocations) = 0;
+                          nsCOMArray<Element>** aLocations) = 0;
 
     /**
      * Must be implemented by subclasses. Handle removing the generated
@@ -506,7 +506,7 @@ protected:
     ReplaceMatch(nsIXULTemplateResult* aOldResult,
                  nsTemplateMatch* aNewMatch,
                  nsTemplateRule* aNewMatchRule,
-                 void *aContext) = 0;
+                 Element* aContext) = 0;
 
     /**
      * Must be implemented by subclasses. Handle change in bound

dom/xul/templates/nsXULTemplateQueryProcessorRDF.cpp

@@ -364,14 +364,14 @@ nsXULTemplateQueryProcessorRDF::CompileQuery(nsIXULTemplateBuilder* aBuilder,
         NS_ASSERTION(!mSimpleRuleMemberTest,
                      "CompileQuery called twice with the same template");
         if (!mSimpleRuleMemberTest)
-            rv = CompileSimpleQuery(query, content, &lastnode);
+            rv = CompileSimpleQuery(query, content->AsElement(), &lastnode);
         else
             rv = NS_ERROR_FAILURE;
     }
     else if (content->NodeInfo()->Equals(nsGkAtoms::rule, kNameSpaceID_XUL)) {
         // simplified syntax with at least one rule
         query->SetSimple();
-        rv = CompileSimpleQuery(query, content, &lastnode);
+        rv = CompileSimpleQuery(query, content->AsElement(), &lastnode);
     }
     else {
         rv = CompileExtendedQuery(query, content, &lastnode);
@@ -1481,7 +1481,7 @@ nsXULTemplateQueryProcessorRDF::AddDefaultSimpleRules(nsRDFQuery* aQuery,
 
 nsresult
 nsXULTemplateQueryProcessorRDF::CompileSimpleQuery(nsRDFQuery* aQuery,
-                                                   nsIContent* aQueryElement,
+                                                   Element* aQueryElement,
                                                    TestNode** aLastNode)
 {
     // Compile a "simple" (or old-school style) <template> query.

dom/xul/templates/nsXULTemplateQueryProcessorRDF.h

@@ -34,6 +34,12 @@ extern mozilla::LazyLogModule gXULTemplateLog;
 class nsIContent;
 class nsXULTemplateResultRDF;
 
+namespace mozilla {
+namespace dom {
+class Element;
+}
+}
+
 /**
  * An object that generates results from a query on an RDF graph
  */
@@ -183,8 +189,8 @@ public:
      */
     nsresult
     CompileSimpleQuery(nsRDFQuery* aQuery,
-                      nsIContent* aQueryElement,
+                       mozilla::dom::Element* aQueryElement,
-                      TestNode** aLastNode);
+                       TestNode** aLastNode);
 
     RDFBindingSet*
     GetBindingsForRule(nsIDOMNode* aRule);

dom/xul/templates/nsXULTreeBuilder.cpp

@@ -280,7 +280,7 @@ nsXULTreeBuilder::GetRowProperties(int32_t aRow, nsAString& aProperties,
         return;
     }
 
-    nsCOMPtr<nsIContent> row;
+    nsCOMPtr<Element> row;
     GetTemplateActionRowFor(aRow, getter_AddRefs(row));
     if (row) {
         nsAutoString raw;
@@ -1046,7 +1046,7 @@ nsXULTreeBuilder::HasGeneratedContent(nsIRDFResource* aResource,
 
 bool
 nsXULTreeBuilder::GetInsertionLocations(nsIXULTemplateResult* aResult,
-                                        nsCOMArray<nsIContent>** aLocations)
+                                        nsCOMArray<Element>** aLocations)
 {
     *aLocations = nullptr;
 
@@ -1089,7 +1089,7 @@ nsresult
 nsXULTreeBuilder::ReplaceMatch(nsIXULTemplateResult* aOldResult,
                                nsTemplateMatch* aNewMatch,
                                nsTemplateRule* aNewMatchRule,
-                               void *aLocation)
+                               Element*)
 {
     if (! mBoxObject)
         return NS_OK;
@@ -1250,7 +1250,7 @@ nsXULTreeBuilder::EnsureSortVariables()
 {
     // Grovel through <treecols> kids to find the <treecol>
     // with the sort attributes.
-    nsCOMPtr<nsIContent> treecols;
+    nsCOMPtr<Element> treecols;
 
     nsXULContentUtils::FindChildByTag(mRoot, kNameSpaceID_XUL,
                                       nsGkAtoms::treecols,
@@ -1344,7 +1344,7 @@ nsXULTreeBuilder::RebuildAll()
 }
 
 nsresult
-nsXULTreeBuilder::GetTemplateActionRowFor(int32_t aRow, nsIContent** aResult)
+nsXULTreeBuilder::GetTemplateActionRowFor(int32_t aRow, Element** aResult)
 {
     // Get the template in the DOM from which we're supposed to
     // generate text
@@ -1358,12 +1358,12 @@ nsXULTreeBuilder::GetTemplateActionRowFor(int32_t aRow, nsIContent** aResult)
         nsTemplateQuerySet* qs = mQuerySets[row.mMatch->QuerySetPriority()];
         nsTemplateRule* rule = qs->GetRuleAt(ruleindex);
         if (rule) {
-            nsCOMPtr<nsIContent> children;
+            nsCOMPtr<Element> children;
             nsXULContentUtils::FindChildByTag(rule->GetAction(), kNameSpaceID_XUL,
                                               nsGkAtoms::treechildren,
                                               getter_AddRefs(children));
             if (children) {
-                nsCOMPtr<nsIContent> item;
+                nsCOMPtr<Element> item;
                 nsXULContentUtils::FindChildByTag(children, kNameSpaceID_XUL,
                                                   nsGkAtoms::treeitem,
                                                   getter_AddRefs(item));
@@ -1383,7 +1383,7 @@ nsXULTreeBuilder::GetTemplateActionRowFor(int32_t aRow, nsIContent** aResult)
 nsIContent*
 nsXULTreeBuilder::GetTemplateActionCellFor(int32_t aRow, nsTreeColumn& aCol)
 {
-    nsCOMPtr<nsIContent> row;
+    RefPtr<Element> row;
     GetTemplateActionRowFor(aRow, getter_AddRefs(row));
     if (!row) {
         return nullptr;

dom/xul/templates/nsXULTreeBuilder.h

@@ -161,7 +161,7 @@ protected:
      * <treerow> in the rule's <action>.
      */
     nsresult
-    GetTemplateActionRowFor(int32_t aRow, nsIContent** aResult);
+    GetTemplateActionRowFor(int32_t aRow, mozilla::dom::Element** aResult);
 
     /**
      * Given a row and a column ID, use the row's match to figure out
@@ -248,7 +248,7 @@ protected:
      */
     bool
     GetInsertionLocations(nsIXULTemplateResult* aResult,
-                          nsCOMArray<nsIContent>** aLocations) override;
+                          nsCOMArray<Element>** aLocations) override;
 
     /**
      * Implement result replacement
@@ -257,7 +257,7 @@ protected:
     ReplaceMatch(nsIXULTemplateResult* aOldResult,
                  nsTemplateMatch* aNewMatch,
                  nsTemplateRule* aNewMatchRule,
-                 void* aContext) override;
+                 Element* aContext) override;
 
     /**
      * Implement match synchronization

editor/libeditor/EditorBase.cpp

@@ -5348,7 +5348,7 @@ NS_IMETHODIMP
 EditorBase::SwitchTextDirection()
 {
   // Get the current root direction from its frame
-  nsIContent* rootElement = GetExposedRoot();
+  Element* rootElement = GetExposedRoot();
 
   nsresult rv = DetermineCurrentDirection();
   NS_ENSURE_SUCCESS(rv, rv);
@@ -5379,7 +5379,7 @@ void
 EditorBase::SwitchTextDirectionTo(uint32_t aDirection)
 {
   // Get the current root direction from its frame
-  nsIContent* rootElement = GetExposedRoot();
+  Element* rootElement = GetExposedRoot();
 
   nsresult rv = DetermineCurrentDirection();
   NS_ENSURE_SUCCESS_VOID(rv);

editor/libeditor/HTMLEditor.h

@@ -755,7 +755,7 @@ protected:
   bool NodeIsProperty(nsINode& aNode);
   bool IsAtFrontOfNode(nsINode& aNode, int32_t aOffset);
   bool IsAtEndOfNode(nsINode& aNode, int32_t aOffset);
-  bool IsOnlyAttribute(const nsIContent* aElement, const nsAString& aAttribute);
+  bool IsOnlyAttribute(const Element* aElement, const nsAString& aAttribute);
 
   nsresult RemoveBlockContainer(nsIContent& aNode);
 

editor/libeditor/HTMLStyleEditor.cpp

@@ -731,21 +731,19 @@ HTMLEditor::RemoveStyleInside(nsIContent& aNode,
       }
       nsresult rv = RemoveContainer(&aNode);
       NS_ENSURE_SUCCESS(rv, rv);
-    } else {
+    } else if (aNode.IsElement()) {
       // otherwise we just want to eliminate the attribute
       RefPtr<nsAtom> attribute = NS_Atomize(*aAttribute);
-      if (aNode.HasAttr(kNameSpaceID_None, attribute)) {
+      if (aNode.AsElement()->HasAttr(kNameSpaceID_None, attribute)) {
         // if this matching attribute is the ONLY one on the node,
         // then remove the whole node.  Otherwise just nix the attribute.
-        if (IsOnlyAttribute(&aNode, *aAttribute)) {
+        if (IsOnlyAttribute(aNode.AsElement(), *aAttribute)) {
           nsresult rv = RemoveContainer(&aNode);
           if (NS_WARN_IF(NS_FAILED(rv))) {
             return rv;
           }
         } else {
-          nsCOMPtr<nsIDOMElement> elem = do_QueryInterface(&aNode);
+          nsresult rv = RemoveAttribute(aNode.AsElement(), attribute);
-          NS_ENSURE_TRUE(elem, NS_ERROR_NULL_POINTER);
-          nsresult rv = RemoveAttribute(elem, *aAttribute);
           if (NS_WARN_IF(NS_FAILED(rv))) {
             return rv;
           }
@@ -796,14 +794,14 @@ HTMLEditor::RemoveStyleInside(nsIContent& aNode,
 }
 
 bool
-HTMLEditor::IsOnlyAttribute(const nsIContent* aContent,
+HTMLEditor::IsOnlyAttribute(const Element* aElement,
                             const nsAString& aAttribute)
 {
-  MOZ_ASSERT(aContent);
+  MOZ_ASSERT(aElement);
 
-  uint32_t attrCount = aContent->GetAttrCount();
+  uint32_t attrCount = aElement->GetAttrCount();
   for (uint32_t i = 0; i < attrCount; ++i) {
-    const nsAttrName* name = aContent->GetAttrNameAt(i);
+    const nsAttrName* name = aElement->GetAttrNameAt(i);
     if (!name->NamespaceEquals(kNameSpaceID_None)) {
       return false;
     }

editor/libeditor/TextEditRules.cpp

@@ -1385,9 +1385,12 @@ TextEditRules::CreateTrailingBRIfNeeded()
   }
 
   // Morph it back to a mozBR
-  lastChild->UnsetAttr(kNameSpaceID_None, kMOZEditorBogusNodeAttrAtom, false);
+  lastChild->AsElement()->UnsetAttr(kNameSpaceID_None,
-  lastChild->SetAttr(kNameSpaceID_None, nsGkAtoms::type,
+                                    kMOZEditorBogusNodeAttrAtom,
-                     NS_LITERAL_STRING("_moz"), true);
+                                    false);
+  lastChild->AsElement()->SetAttr(kNameSpaceID_None, nsGkAtoms::type,
+                                  NS_LITERAL_STRING("_moz"),
+                                  true);
   return NS_OK;
 }
 

layout/base/nsCSSFrameConstructor.cpp

@@ -5889,7 +5889,7 @@ nsCSSFrameConstructor::AddFrameConstructionItemsInternal(nsFrameConstructorState
       nsAutoPtr<PendingBinding> newPendingBinding(new PendingBinding());
 
       nsresult rv = xblService->LoadBindings(
-        aContent, display->mBinding->GetURI(),
+        aContent->AsElement(), display->mBinding->GetURI(),
         display->mBinding->mExtraData->GetPrincipal(),
         getter_AddRefs(newPendingBinding->mBinding), &resolveStyle);
       if (NS_FAILED(rv) && rv != NS_ERROR_XBL_BLOCKED)

layout/base/nsLayoutUtils.cpp

@@ -8478,47 +8478,47 @@ nsLayoutUtils::PostRestyleEvent(Element* aElement,
   }
 }
 
-nsSetAttrRunnable::nsSetAttrRunnable(nsIContent* aContent,
+nsSetAttrRunnable::nsSetAttrRunnable(Element* aElement,
                                      nsAtom* aAttrName,
                                      const nsAString& aValue)
   : mozilla::Runnable("nsSetAttrRunnable")
-  , mContent(aContent)
+  , mElement(aElement)
   , mAttrName(aAttrName)
   , mValue(aValue)
 {
-  NS_ASSERTION(aContent && aAttrName, "Missing stuff, prepare to crash");
+  NS_ASSERTION(aElement && aAttrName, "Missing stuff, prepare to crash");
 }
 
-nsSetAttrRunnable::nsSetAttrRunnable(nsIContent* aContent,
+nsSetAttrRunnable::nsSetAttrRunnable(Element* aElement,
                                      nsAtom* aAttrName,
                                      int32_t aValue)
   : mozilla::Runnable("nsSetAttrRunnable")
-  , mContent(aContent)
+  , mElement(aElement)
   , mAttrName(aAttrName)
 {
-  NS_ASSERTION(aContent && aAttrName, "Missing stuff, prepare to crash");
+  NS_ASSERTION(aElement && aAttrName, "Missing stuff, prepare to crash");
   mValue.AppendInt(aValue);
 }
 
 NS_IMETHODIMP
 nsSetAttrRunnable::Run()
 {
-  return mContent->SetAttr(kNameSpaceID_None, mAttrName, mValue, true);
+  return mElement->SetAttr(kNameSpaceID_None, mAttrName, mValue, true);
 }
 
-nsUnsetAttrRunnable::nsUnsetAttrRunnable(nsIContent* aContent,
+nsUnsetAttrRunnable::nsUnsetAttrRunnable(Element* aElement,
                                          nsAtom* aAttrName)
   : mozilla::Runnable("nsUnsetAttrRunnable")
-  , mContent(aContent)
+  , mElement(aElement)
   , mAttrName(aAttrName)
 {
-  NS_ASSERTION(aContent && aAttrName, "Missing stuff, prepare to crash");
+  NS_ASSERTION(aElement && aAttrName, "Missing stuff, prepare to crash");
 }
 
 NS_IMETHODIMP
 nsUnsetAttrRunnable::Run()
 {
-  return mContent->UnsetAttr(kNameSpaceID_None, mAttrName, true);
+  return mElement->UnsetAttr(kNameSpaceID_None, mAttrName, true);
 }
 
 /**

layout/base/nsLayoutUtils.h

@@ -3257,14 +3257,14 @@ void StrokeLineWithSnapping(const nsPoint& aP1, const nsPoint& aP2,
 class nsSetAttrRunnable : public mozilla::Runnable
 {
 public:
-  nsSetAttrRunnable(nsIContent* aContent, nsAtom* aAttrName,
+  nsSetAttrRunnable(mozilla::dom::Element* aElement, nsAtom* aAttrName,
                     const nsAString& aValue);
-  nsSetAttrRunnable(nsIContent* aContent, nsAtom* aAttrName,
+  nsSetAttrRunnable(mozilla::dom::Element* aElement, nsAtom* aAttrName,
                     int32_t aValue);
 
   NS_DECL_NSIRUNNABLE
 
-  nsCOMPtr<nsIContent> mContent;
+  RefPtr<Element> mElement;
   RefPtr<nsAtom> mAttrName;
   nsAutoString mValue;
 };
@@ -3272,11 +3272,11 @@ public:
 class nsUnsetAttrRunnable : public mozilla::Runnable
 {
 public:
-  nsUnsetAttrRunnable(nsIContent* aContent, nsAtom* aAttrName);
+  nsUnsetAttrRunnable(mozilla::dom::Element* aElement, nsAtom* aAttrName);
 
   NS_DECL_NSIRUNNABLE
 
-  nsCOMPtr<nsIContent> mContent;
+  RefPtr<Element> mElement;
   RefPtr<nsAtom> mAttrName;
 };
 

layout/forms/nsButtonFrameRenderer.cpp

@@ -60,13 +60,14 @@ nsButtonFrameRenderer::GetFrame()
 }
 
 void
-nsButtonFrameRenderer::SetDisabled(bool aDisabled, bool notify)
+nsButtonFrameRenderer::SetDisabled(bool aDisabled, bool aNotify)
 {
+  Element* element = mFrame->GetContent()->AsElement();
   if (aDisabled)
-    mFrame->GetContent()->SetAttr(kNameSpaceID_None, nsGkAtoms::disabled, EmptyString(),
+    element->SetAttr(kNameSpaceID_None, nsGkAtoms::disabled, EmptyString(),
-                                  notify);
+                     aNotify);
   else
-    mFrame->GetContent()->UnsetAttr(kNameSpaceID_None, nsGkAtoms::disabled, notify);
+    element->UnsetAttr(kNameSpaceID_None, nsGkAtoms::disabled, aNotify);
 }
 
 bool

layout/forms/nsComboboxControlFrame.h

@@ -284,7 +284,7 @@ private:
 protected:
   nsFrameList              mPopupFrames;             // additional named child list
   nsCOMPtr<nsIContent>     mDisplayContent;          // Anonymous content used to display the current selection
-  nsCOMPtr<nsIContent>     mButtonContent;           // Anonymous content for the button
+  RefPtr<Element>     mButtonContent;                // Anonymous content for the button
   nsContainerFrame*        mDisplayFrame;            // frame to display selection
   nsIFrame*                mButtonFrame;             // button frame
   nsIFrame*                mDropdownFrame;           // dropdown list frame

layout/forms/nsDateTimeControlFrame.h

@@ -114,7 +114,7 @@ private:
 
   // Anonymous child which is bound via XBL to an element that wraps the input
   // area and reset button.
-  nsCOMPtr<nsIContent> mInputAreaContent;
+  RefPtr<mozilla::dom::Element> mInputAreaContent;
 };
 
 #endif // nsDateTimeControlFrame_h__

layout/forms/nsFileControlFrame.h

@@ -136,12 +136,12 @@ protected:
    * The text box input.
    * @see nsFileControlFrame::CreateAnonymousContent
    */
-  nsCOMPtr<nsIContent> mTextContent;
+  RefPtr<Element> mTextContent;
   /**
    * The button to open a file or directory picker.
    * @see nsFileControlFrame::CreateAnonymousContent
    */
-  nsCOMPtr<nsIContent> mBrowseFilesOrDirs;
+  RefPtr<Element> mBrowseFilesOrDirs;
 
   /**
    * Drag and drop mouse listener.

layout/forms/nsHTMLButtonControlFrame.cpp

@@ -376,8 +376,8 @@ nsHTMLButtonControlFrame::GetNaturalBaselineBOffset(mozilla::WritingMode aWM,
 nsresult nsHTMLButtonControlFrame::SetFormProperty(nsAtom* aName, const nsAString& aValue)
 {
   if (nsGkAtoms::value == aName) {
-    return mContent->SetAttr(kNameSpaceID_None, nsGkAtoms::value,
+    return mContent->AsElement()->SetAttr(kNameSpaceID_None, nsGkAtoms::value,
-                             aValue, true);
+                                          aValue, true);
   }
   return NS_OK;
 }

layout/generic/ScrollbarActivity.cpp

@@ -16,6 +16,7 @@
 #include "nsQueryFrame.h"
 #include "nsComponentManagerUtils.h"
 #include "nsStyledElement.h"
+#include "mozilla/dom/Element.h"
 #include "mozilla/LookAndFeel.h"
 #include "mozilla/Preferences.h"
 
@@ -159,7 +160,7 @@ ScrollbarActivity::IsStillFading(TimeStamp aTime)
 void
 ScrollbarActivity::HandleEventForScrollbar(const nsAString& aType,
                                            nsIContent* aTarget,
-                                           nsIContent* aScrollbar,
+                                           Element* aScrollbar,
                                            bool* aStoredHoverState)
 {
   if (!aTarget || !aScrollbar ||
@@ -323,14 +324,14 @@ ScrollbarActivity::UnregisterFromRefreshDriver()
 }
 
 static void
-SetBooleanAttribute(nsIContent* aContent, nsAtom* aAttribute, bool aValue)
+SetBooleanAttribute(Element* aElement, nsAtom* aAttribute, bool aValue)
 {
-  if (aContent) {
+  if (aElement) {
     if (aValue) {
-      aContent->SetAttr(kNameSpaceID_None, aAttribute,
+      aElement->SetAttr(kNameSpaceID_None, aAttribute,
                         NS_LITERAL_STRING("true"), true);
     } else {
-      aContent->UnsetAttr(kNameSpaceID_None, aAttribute, true);
+      aElement->UnsetAttr(kNameSpaceID_None, aAttribute, true);
     }
   }
 }
@@ -445,7 +446,7 @@ ScrollbarActivity::CancelFadeBeginTimer()
 }
 
 void
-ScrollbarActivity::HoveredScrollbar(nsIContent* aScrollbar)
+ScrollbarActivity::HoveredScrollbar(Element* aScrollbar)
 {
   SetBooleanAttribute(GetHorizontalScrollbar(), nsGkAtoms::hover, false);
   SetBooleanAttribute(GetVerticalScrollbar(), nsGkAtoms::hover, false);
@@ -459,11 +460,11 @@ ScrollbarActivity::GetRefreshDriver()
   return scrollableFrame->PresContext()->RefreshDriver();
 }
 
-nsIContent*
+Element*
 ScrollbarActivity::GetScrollbarContent(bool aVertical)
 {
   nsIFrame* box = mScrollableFrame->GetScrollbarBox(aVertical);
-  return box ? box->GetContent() : nullptr;
+  return box ? box->GetContent()->AsElement() : nullptr;
 }
 
 } // namespace layout

layout/generic/ScrollbarActivity.h

@@ -102,7 +102,7 @@ protected:
 
   void HandleEventForScrollbar(const nsAString& aType,
                                nsIContent* aTarget,
-                               nsIContent* aScrollbar,
+                               dom::Element* aScrollbar,
                                bool* aStoredHoverState);
 
   void SetIsActive(bool aNewActive);
@@ -125,12 +125,12 @@ protected:
   void UnregisterFromRefreshDriver();
 
   bool UpdateOpacity(TimeStamp aTime); // returns false if 'this' was destroyed
-  void HoveredScrollbar(nsIContent* aScrollbar);
+  void HoveredScrollbar(dom::Element* aScrollbar);
 
   nsRefreshDriver* GetRefreshDriver();
-  nsIContent* GetScrollbarContent(bool aVertical);
+  dom::Element* GetScrollbarContent(bool aVertical);
-  nsIContent* GetHorizontalScrollbar() { return GetScrollbarContent(false); }
+  dom::Element* GetHorizontalScrollbar() { return GetScrollbarContent(false); }
-  nsIContent* GetVerticalScrollbar() { return GetScrollbarContent(true); }
+  dom::Element* GetVerticalScrollbar() { return GetScrollbarContent(true); }
 
   const TimeDuration FadeDuration() {
     return TimeDuration::FromMilliseconds(mScrollbarFadeDuration);

layout/generic/nsFrameSetFrame.cpp

@@ -1263,7 +1263,8 @@ nsHTMLFramesetFrame::MouseDrag(nsPresContext* aPresContext,
       GenerateRowCol(aPresContext, width, mNumCols, colSpecs, mColSizes.get(),
                      newColAttr);
       // Setting the attr will trigger a reflow
-      mContent->SetAttr(kNameSpaceID_None, nsGkAtoms::cols, newColAttr, true);
+      mContent->AsElement()->SetAttr(kNameSpaceID_None, nsGkAtoms::cols,
+                                     newColAttr, true);
     }
   } else {
     change = aPresContext->DevPixelsToAppUnits(
@@ -1287,7 +1288,8 @@ nsHTMLFramesetFrame::MouseDrag(nsPresContext* aPresContext,
       GenerateRowCol(aPresContext, height, mNumRows, rowSpecs, mRowSizes.get(),
                      newRowAttr);
       // Setting the attr will trigger a reflow
-      mContent->SetAttr(kNameSpaceID_None, nsGkAtoms::rows, newRowAttr, true);
+      mContent->AsElement()->SetAttr(kNameSpaceID_None, nsGkAtoms::rows,
+                                     newRowAttr, true);
     }
   }
 

layout/generic/nsGfxScrollFrame.cpp

@@ -4775,14 +4775,14 @@ ScrollFrameHelper::UpdateScrollbarPosition()
 
   nsPoint pt = GetScrollPosition();
   if (mVScrollbarBox) {
-    SetCoordAttribute(mVScrollbarBox->GetContent(), nsGkAtoms::curpos,
+    SetCoordAttribute(mVScrollbarBox->GetContent()->AsElement(),
-                      pt.y - GetScrolledRect().y);
+                      nsGkAtoms::curpos, pt.y - GetScrolledRect().y);
     if (!weakFrame.IsAlive()) {
       return;
     }
   }
   if (mHScrollbarBox) {
-    SetCoordAttribute(mHScrollbarBox->GetContent(), nsGkAtoms::curpos,
+    SetCoordAttribute(mHScrollbarBox->GetContent()->AsElement(), nsGkAtoms::curpos,
                       pt.x - GetScrolledRect().x);
     if (!weakFrame.IsAlive()) {
       return;
@@ -5451,18 +5451,18 @@ nsXULScrollFrame::XULLayout(nsBoxLayoutState& aState)
 }
 
 void
-ScrollFrameHelper::FinishReflowForScrollbar(nsIContent* aContent,
+ScrollFrameHelper::FinishReflowForScrollbar(Element* aElement,
-                                                nscoord aMinXY, nscoord aMaxXY,
+                                            nscoord aMinXY, nscoord aMaxXY,
-                                                nscoord aCurPosXY,
+                                            nscoord aCurPosXY,
-                                                nscoord aPageIncrement,
+                                            nscoord aPageIncrement,
-                                                nscoord aIncrement)
+                                            nscoord aIncrement)
 {
   // Scrollbars assume zero is the minimum position, so translate for them.
-  SetCoordAttribute(aContent, nsGkAtoms::curpos, aCurPosXY - aMinXY);
+  SetCoordAttribute(aElement, nsGkAtoms::curpos, aCurPosXY - aMinXY);
-  SetScrollbarEnabled(aContent, aMaxXY - aMinXY);
+  SetScrollbarEnabled(aElement, aMaxXY - aMinXY);
-  SetCoordAttribute(aContent, nsGkAtoms::maxpos, aMaxXY - aMinXY);
+  SetCoordAttribute(aElement, nsGkAtoms::maxpos, aMaxXY - aMinXY);
-  SetCoordAttribute(aContent, nsGkAtoms::pageincrement, aPageIncrement);
+  SetCoordAttribute(aElement, nsGkAtoms::pageincrement, aPageIncrement);
-  SetCoordAttribute(aContent, nsGkAtoms::increment, aIncrement);
+  SetCoordAttribute(aElement, nsGkAtoms::increment, aIncrement);
 }
 
 bool
@@ -5526,10 +5526,11 @@ ScrollFrameHelper::ReflowFinished()
   NS_ASSERTION(!mFrameIsUpdatingScrollbar, "We shouldn't be reentering here");
   mFrameIsUpdatingScrollbar = true;
 
-  nsCOMPtr<nsIContent> vScroll =
+  // FIXME(emilio): Why this instead of mHScrollbarContent / mVScrollbarContent?
-    mVScrollbarBox ? mVScrollbarBox->GetContent() : nullptr;
+  RefPtr<Element> vScroll =
-  nsCOMPtr<nsIContent> hScroll =
+    mVScrollbarBox ? mVScrollbarBox->GetContent()->AsElement() : nullptr;
-    mHScrollbarBox ? mHScrollbarBox->GetContent() : nullptr;
+  RefPtr<Element> hScroll =
+    mHScrollbarBox ? mHScrollbarBox->GetContent()->AsElement() : nullptr;
 
   // Note, in some cases mOuter may get deleted while finishing reflow
   // for scrollbars. XXXmats is this still true now that we have a script
@@ -5871,22 +5872,22 @@ static bool ShellIsAlive(nsWeakPtr& aWeakPtr)
 #endif
 
 void
-ScrollFrameHelper::SetScrollbarEnabled(nsIContent* aContent, nscoord aMaxPos)
+ScrollFrameHelper::SetScrollbarEnabled(Element* aElement, nscoord aMaxPos)
 {
   DebugOnly<nsWeakPtr> weakShell(
     do_GetWeakReference(mOuter->PresShell()));
   if (aMaxPos) {
-    aContent->UnsetAttr(kNameSpaceID_None, nsGkAtoms::disabled, true);
+    aElement->UnsetAttr(kNameSpaceID_None, nsGkAtoms::disabled, true);
   } else {
-    aContent->SetAttr(kNameSpaceID_None, nsGkAtoms::disabled,
+    aElement->SetAttr(kNameSpaceID_None, nsGkAtoms::disabled,
                       NS_LITERAL_STRING("true"), true);
   }
   MOZ_ASSERT(ShellIsAlive(weakShell), "pres shell was destroyed by scrolling");
 }
 
 void
-ScrollFrameHelper::SetCoordAttribute(nsIContent* aContent, nsAtom* aAtom,
+ScrollFrameHelper::SetCoordAttribute(Element* aElement, nsAtom* aAtom,
-                                         nscoord aSize)
+                                     nscoord aSize)
 {
   DebugOnly<nsWeakPtr> weakShell(
     do_GetWeakReference(mOuter->PresShell()));
@@ -5898,13 +5899,13 @@ ScrollFrameHelper::SetCoordAttribute(nsIContent* aContent, nsAtom* aAtom,
   nsAutoString newValue;
   newValue.AppendInt(pixelSize);
 
-  if (aContent->AttrValueIs(kNameSpaceID_None, aAtom, newValue, eCaseMatters)) {
+  if (aElement->AttrValueIs(kNameSpaceID_None, aAtom, newValue, eCaseMatters)) {
     return;
   }
 
   AutoWeakFrame weakFrame(mOuter);
-  nsCOMPtr<nsIContent> kungFuDeathGrip = aContent;
+  RefPtr<Element> kungFuDeathGrip = aElement;
-  aContent->SetAttr(kNameSpaceID_None, aAtom, newValue, true);
+  aElement->SetAttr(kNameSpaceID_None, aAtom, newValue, true);
   MOZ_ASSERT(ShellIsAlive(weakShell), "pres shell was destroyed by scrolling");
   if (!weakFrame.IsAlive()) {
     return;

layout/generic/nsGfxScrollFrame.h

@@ -170,18 +170,20 @@ public:
   /**
    * @note This method might destroy the frame, pres shell and other objects.
    */
-  void FinishReflowForScrollbar(nsIContent* aContent, nscoord aMinXY,
+  void FinishReflowForScrollbar(mozilla::dom::Element* aElement,
-                                nscoord aMaxXY, nscoord aCurPosXY,
+                                nscoord aMinXY, nscoord aMaxXY,
-                                nscoord aPageIncrement,
+                                nscoord aCurPosXY, nscoord aPageIncrement,
                                 nscoord aIncrement);
   /**
    * @note This method might destroy the frame, pres shell and other objects.
    */
-  void SetScrollbarEnabled(nsIContent* aContent, nscoord aMaxPos);
+  void SetScrollbarEnabled(mozilla::dom::Element* aElement, nscoord aMaxPos);
   /**
    * @note This method might destroy the frame, pres shell and other objects.
    */
-  void SetCoordAttribute(nsIContent* aContent, nsAtom* aAtom, nscoord aSize);
+  void SetCoordAttribute(mozilla::dom::Element* aElement,
+                         nsAtom* aAtom,
+                         nscoord aSize);
 
   nscoord GetCoordAttribute(nsIFrame* aFrame, nsAtom* aAtom, nscoord aDefaultValue,
                             nscoord* aRangeStart, nscoord* aRangeLength);
@@ -500,10 +502,10 @@ public:
   bool IsRootScrollFrameOfDocument() const { return mIsRoot; }
 
   // owning references to the nsIAnonymousContentCreator-built content
-  nsCOMPtr<nsIContent> mHScrollbarContent;
+  nsCOMPtr<mozilla::dom::Element> mHScrollbarContent;
-  nsCOMPtr<nsIContent> mVScrollbarContent;
+  nsCOMPtr<mozilla::dom::Element> mVScrollbarContent;
-  nsCOMPtr<nsIContent> mScrollCornerContent;
+  nsCOMPtr<mozilla::dom::Element> mScrollCornerContent;
-  nsCOMPtr<nsIContent> mResizerContent;
+  nsCOMPtr<mozilla::dom::Element> mResizerContent;
 
   RefPtr<ScrollEvent> mScrollEvent;
   RefPtr<ScrollEndEvent> mScrollEndEvent;

layout/generic/nsVideoFrame.cpp

@@ -93,7 +93,6 @@ nsVideoFrame::CreateAnonymousContent(nsTArray<ContentInfo>& aElements)
 {
   nsNodeInfoManager *nodeInfoManager = GetContent()->GetComposedDoc()->NodeInfoManager();
   RefPtr<NodeInfo> nodeInfo;
-  Element *element;
 
   if (HasVideoElement()) {
     // Create an anonymous image element as a child to hold the poster
@@ -104,8 +103,7 @@ nsVideoFrame::CreateAnonymousContent(nsTArray<ContentInfo>& aElements)
                                             kNameSpaceID_XHTML,
                                             nsIDOMNode::ELEMENT_NODE);
     NS_ENSURE_TRUE(nodeInfo, NS_ERROR_OUT_OF_MEMORY);
-    element = NS_NewHTMLImageElement(nodeInfo.forget());
+    mPosterImage = NS_NewHTMLImageElement(nodeInfo.forget());
-    mPosterImage = element;
     NS_ENSURE_TRUE(mPosterImage, NS_ERROR_OUT_OF_MEMORY);
 
     // Set the nsImageLoadingContent::ImageState() to 0. This means that the
@@ -117,7 +115,7 @@ nsVideoFrame::CreateAnonymousContent(nsTArray<ContentInfo>& aElements)
 
     imgContent->ForceImageState(true, 0);
     // And now have it update its internal state
-    element->UpdateState(false);
+    mPosterImage->UpdateState(false);
 
     UpdatePosterSource(false);
 

layout/generic/nsVideoFrame.h

@@ -88,7 +88,7 @@ public:
   void AppendAnonymousContentTo(nsTArray<nsIContent*>& aElements,
                                 uint32_t aFilters) override;
 
-  nsIContent* GetPosterImage() { return mPosterImage; }
+  mozilla::dom::Element* GetPosterImage() { return mPosterImage; }
 
   // Returns true if we should display the poster. Note that once we show
   // a video frame, the poster will never be displayed again.
@@ -129,10 +129,10 @@ protected:
   virtual ~nsVideoFrame();
 
   // Anonymous child which is bound via XBL to the video controls.
-  nsCOMPtr<nsIContent> mVideoControls;
+  RefPtr<mozilla::dom::Element> mVideoControls;
 
   // Anonymous child which is the image element of the poster frame.
-  nsCOMPtr<nsIContent> mPosterImage;
+  RefPtr<mozilla::dom::Element> mPosterImage;
 
   // Anonymous child which is the text track caption display div.
   nsCOMPtr<nsIContent> mCaptionDiv;

layout/mathml/nsMathMLmactionFrame.cpp

@@ -330,7 +330,8 @@ nsMathMLmactionFrame::MouseClick()
       nsAutoString value;
       value.AppendInt(selection);
       bool notify = false; // don't yet notify the document
-      mContent->SetAttr(kNameSpaceID_None, nsGkAtoms::selection_, value, notify);
+      mContent->AsElement()->SetAttr(kNameSpaceID_None, nsGkAtoms::selection_,
+                                     value, notify);
 
       // Now trigger a content-changed reflow...
       PresShell()->

layout/xul/PopupBoxObject.cpp

@@ -161,15 +161,15 @@ PopupBoxObject::SizeTo(int32_t aWidth, int32_t aHeight)
   width.AppendInt(aWidth);
   height.AppendInt(aHeight);
 
-  nsCOMPtr<nsIContent> content = mContent;
+  RefPtr<Element> element = mContent->AsElement();
 
   // We only want to pass aNotify=true to SetAttr once, but must make sure
   // we pass it when a value is being changed.  Thus, we check if the height
   // is the same and if so, pass true when setting the width.
-  bool heightSame = content->AttrValueIs(kNameSpaceID_None, nsGkAtoms::height, height, eCaseMatters);
+  bool heightSame = element->AttrValueIs(kNameSpaceID_None, nsGkAtoms::height, height, eCaseMatters);
 
-  content->SetAttr(kNameSpaceID_None, nsGkAtoms::width, width, heightSame);
+  element->SetAttr(kNameSpaceID_None, nsGkAtoms::width, width, heightSame);
-  content->SetAttr(kNameSpaceID_None, nsGkAtoms::height, height, true);
+  element->SetAttr(kNameSpaceID_None, nsGkAtoms::height, height, true);
 }
 
 bool
@@ -214,10 +214,11 @@ PopupBoxObject::EnableKeyboardNavigator(bool aEnableKeyboardNavigator)
 
   // Use ignorekeys="true" on the popup instead of using this function.
   if (aEnableKeyboardNavigator)
-    mContent->UnsetAttr(kNameSpaceID_None, nsGkAtoms::ignorekeys, true);
+    mContent->AsElement()->UnsetAttr(kNameSpaceID_None, nsGkAtoms::ignorekeys,
+                                     true);
   else
-    mContent->SetAttr(kNameSpaceID_None, nsGkAtoms::ignorekeys,
+    mContent->AsElement()->SetAttr(kNameSpaceID_None, nsGkAtoms::ignorekeys,
-                      NS_LITERAL_STRING("true"), true);
+                                   NS_LITERAL_STRING("true"), true);
 }
 
 void

layout/xul/nsDeckFrame.cpp

@@ -178,7 +178,7 @@ nsDeckFrame::RemoveFrame(ChildListID aListID,
       // This is going to cause us to handle the index change in IndexedChanged,
       // but since the new index will match mIndex, it's essentially a noop.
       nsContentUtils::AddScriptRunner(new nsSetAttrRunnable(
-        mContent, nsGkAtoms::selectedIndex, mIndex));
+        mContent->AsElement(), nsGkAtoms::selectedIndex, mIndex));
     }
   }
   nsBoxFrame::RemoveFrame(aListID, aOldFrame);

layout/xul/nsIRootBox.h

@@ -10,8 +10,14 @@
 
 #include "nsQueryFrame.h"
 class nsPopupSetFrame;
-class nsIContent;
 class nsIPresShell;
+class nsIContent;
+
+namespace mozilla {
+namespace dom {
+class Element;
+}
+}
 
 class nsIRootBox
 {
@@ -21,8 +27,8 @@ public:
   virtual nsPopupSetFrame* GetPopupSetFrame() = 0;
   virtual void SetPopupSetFrame(nsPopupSetFrame* aPopupSet) = 0;
 
-  virtual nsIContent* GetDefaultTooltip() = 0;
+  virtual mozilla::dom::Element* GetDefaultTooltip() = 0;
-  virtual void SetDefaultTooltip(nsIContent* aTooltip) = 0;
+  virtual void SetDefaultTooltip(mozilla::dom::Element* aTooltip) = 0;
 
   virtual nsresult AddTooltipSupport(nsIContent* aNode) = 0;
   virtual nsresult RemoveTooltipSupport(nsIContent* aNode) = 0;

layout/xul/nsMenuFrame.cpp

@@ -69,7 +69,7 @@ const int32_t kBlinkDelay = 67; // milliseconds
 class nsMenuActivateEvent : public Runnable
 {
 public:
-  nsMenuActivateEvent(nsIContent* aMenu,
+  nsMenuActivateEvent(Element* aMenu,
                       nsPresContext* aPresContext,
                       bool aIsActivate)
     : mozilla::Runnable("nsMenuActivateEvent")
@@ -109,7 +109,7 @@ public:
   }
 
 private:
-  nsCOMPtr<nsIContent> mMenu;
+  RefPtr<Element> mMenu;
   RefPtr<nsPresContext> mPresContext;
   bool mIsActivate;
 };
@@ -337,7 +337,8 @@ nsMenuFrame::DestroyFrom(nsIFrame* aDestructRoot, PostDestroyData& aPostDestroyD
 
   // if the menu content is just being hidden, it may be made visible again
   // later, so make sure to clear the highlighting.
-  mContent->UnsetAttr(kNameSpaceID_None, nsGkAtoms::menuactive, false);
+  mContent->AsElement()->UnsetAttr(kNameSpaceID_None, nsGkAtoms::menuactive,
+                                   false);
 
   // are we our menu parent's current menu item?
   nsMenuParent* menuParent = GetMenuParent();
@@ -553,8 +554,8 @@ nsMenuFrame::PopupOpened()
   gMenuJustOpenedOrClosed = true;
 
   AutoWeakFrame weakFrame(this);
-  mContent->SetAttr(kNameSpaceID_None, nsGkAtoms::open,
+  mContent->AsElement()->SetAttr(kNameSpaceID_None, nsGkAtoms::open,
-                    NS_LITERAL_STRING("true"), true);
+                                 NS_LITERAL_STRING("true"), true);
   if (!weakFrame.IsAlive())
     return;
 
@@ -572,7 +573,7 @@ nsMenuFrame::PopupClosed(bool aDeselectMenu)
 {
   AutoWeakFrame weakFrame(this);
   nsContentUtils::AddScriptRunner(
-    new nsUnsetAttrRunnable(mContent, nsGkAtoms::open));
+    new nsUnsetAttrRunnable(mContent->AsElement(), nsGkAtoms::open));
   if (!weakFrame.IsAlive())
     return;
 
@@ -604,7 +605,7 @@ nsMenuFrame::PopupClosed(bool aDeselectMenu)
         }
 
         nsCOMPtr<nsIRunnable> event =
-          new nsMenuActivateEvent(current->GetContent(),
+          new nsMenuActivateEvent(current->GetContent()->AsElement(),
                                   PresContext(), true);
         mContent->OwnerDoc()->Dispatch(TaskCategory::Other,
                                        event.forget());
@@ -655,7 +656,7 @@ nsMenuFrame::SelectMenu(bool aActivateFlag)
     }
 
     nsCOMPtr<nsIRunnable> event =
-      new nsMenuActivateEvent(mContent, PresContext(), aActivateFlag);
+      new nsMenuActivateEvent(mContent->AsElement(), PresContext(), aActivateFlag);
     mContent->OwnerDoc()->Dispatch(TaskCategory::Other,
                                    event.forget());
   }
@@ -906,8 +907,9 @@ nsMenuFrame::Notify(nsITimer* aTimer)
         {
           // Turn the highlight back on and wait for a while before closing the menu.
           AutoWeakFrame weakFrame(this);
-          mContent->SetAttr(kNameSpaceID_None, nsGkAtoms::menuactive,
+          mContent->AsElement()->SetAttr(kNameSpaceID_None,
-                            NS_LITERAL_STRING("true"), true);
+                                         nsGkAtoms::menuactive,
+                                         NS_LITERAL_STRING("true"), true);
           if (weakFrame.IsAlive()) {
             aTimer->InitWithCallback(mTimerMediator, kBlinkDelay, nsITimer::TYPE_ONE_SHOT);
           }
@@ -951,8 +953,8 @@ nsMenuFrame::UpdateMenuType()
     default:
       if (mType != eMenuType_Normal) {
         AutoWeakFrame weakFrame(this);
-        mContent->UnsetAttr(kNameSpaceID_None, nsGkAtoms::checked,
+        mContent->AsElement()->UnsetAttr(kNameSpaceID_None, nsGkAtoms::checked,
-                            true);
+                                         true);
         ENSURE_TRUE(weakFrame.IsAlive());
       }
       mType = eMenuType_Normal;
@@ -1015,8 +1017,8 @@ nsMenuFrame::UpdateMenuSpecialState()
       if (menu && menu->GetMenuType() == eMenuType_Radio &&
           menu->IsChecked() && menu->GetRadioGroupName() == mGroupName) {
         /* uncheck the old item */
-        sib->GetContent()->UnsetAttr(kNameSpaceID_None, nsGkAtoms::checked,
+        sib->GetContent()->AsElement()->UnsetAttr(
-                                     true);
+            kNameSpaceID_None, nsGkAtoms::checked, true);
         /* XXX in DEBUG, check to make sure that there aren't two checked items */
         return;
       }
@@ -1045,7 +1047,7 @@ nsMenuFrame::BuildAcceleratorText(bool aNotify)
 
   // If anything below fails, just leave the accelerator text blank.
   AutoWeakFrame weakFrame(this);
-  mContent->UnsetAttr(kNameSpaceID_None, nsGkAtoms::acceltext, aNotify);
+  mContent->AsElement()->UnsetAttr(kNameSpaceID_None, nsGkAtoms::acceltext, aNotify);
   ENSURE_TRUE(weakFrame.IsAlive());
 
   // See if we have a key node and use that instead.
@@ -1180,7 +1182,8 @@ nsMenuFrame::BuildAcceleratorText(bool aNotify)
   accelText += accelString;
 
   mIgnoreAccelTextChange = true;
-  mContent->SetAttr(kNameSpaceID_None, nsGkAtoms::acceltext, accelText, aNotify);
+  mContent->AsElement()->SetAttr(kNameSpaceID_None, nsGkAtoms::acceltext,
+                                 accelText, aNotify);
   ENSURE_TRUE(weakFrame.IsAlive());
 
   mIgnoreAccelTextChange = false;
@@ -1231,7 +1234,7 @@ nsMenuFrame::StartBlinking(WidgetGUIEvent* aEvent, bool aFlipChecked)
 
   // Blink off.
   AutoWeakFrame weakFrame(this);
-  mContent->UnsetAttr(kNameSpaceID_None, nsGkAtoms::menuactive, true);
+  mContent->AsElement()->UnsetAttr(kNameSpaceID_None, nsGkAtoms::menuactive, true);
   if (!weakFrame.IsAlive())
     return;
 
@@ -1283,8 +1286,8 @@ nsMenuFrame::CreateMenuCommandEvent(WidgetGUIEvent* aEvent, bool aFlipChecked)
   bool userinput = EventStateManager::IsHandlingUserInput();
 
   mDelayedMenuCommandEvent =
-    new nsXULMenuCommandEvent(mContent, isTrusted, shift, control, alt, meta,
+    new nsXULMenuCommandEvent(mContent->AsElement(), isTrusted, shift, control,
-                              userinput, aFlipChecked);
+                              alt, meta, userinput, aFlipChecked);
 }
 
 void

layout/xul/nsMenuPopupFrame.cpp

@@ -184,7 +184,7 @@ nsMenuPopupFrame::Init(nsIContent*       aContent,
     nsIRootBox* rootBox =
       nsIRootBox::GetRootBox(PresContext()->GetPresShell());
     if (rootBox) {
-      rootBox->SetDefaultTooltip(aContent);
+      rootBox->SetDefaultTooltip(aContent->AsElement());
     }
   }
 
@@ -2347,7 +2347,7 @@ nsMenuPopupFrame::DestroyFrom(nsIFrame* aDestructRoot, PostDestroyData& aPostDes
   if (menu) {
     // clear the open attribute on the parent menu
     nsContentUtils::AddScriptRunner(
-      new nsUnsetAttrRunnable(menu->GetContent(), nsGkAtoms::open));
+      new nsUnsetAttrRunnable(menu->GetContent()->AsElement(), nsGkAtoms::open));
   }
 
   ClearPopupShownDispatcher();
@@ -2397,7 +2397,7 @@ nsMenuPopupFrame::MoveTo(const CSSIntPoint& aPos, bool aUpdateAttrs)
 
   SetPopupPosition(nullptr, true, false, true);
 
-  nsCOMPtr<nsIContent> popup = mContent;
+  RefPtr<Element> popup = mContent->AsElement();
   if (aUpdateAttrs && (popup->HasAttr(kNameSpaceID_None, nsGkAtoms::left) ||
                        popup->HasAttr(kNameSpaceID_None, nsGkAtoms::top)))
   {

layout/xul/nsProgressMeterFrame.cpp

@@ -139,11 +139,11 @@ nsProgressMeterFrame::AttributeChanged(int32_t aNameSpaceID,
       (!undetermined &&
        (nsGkAtoms::value == aAttribute || nsGkAtoms::max == aAttribute))) {
     nsIFrame* barChild = PrincipalChildList().FirstChild();
-    if (!barChild) return NS_OK;
+    if (!barChild || !barChild->GetContent()->IsElement()) return NS_OK;
     nsIFrame* remainderChild = barChild->GetNextSibling();
     if (!remainderChild) return NS_OK;
     nsCOMPtr<nsIContent> remainderContent = remainderChild->GetContent();
-    if (!remainderContent) return NS_OK;
+    if (!remainderContent->IsElement()) return NS_OK;
 
     int32_t flex = 1, maxFlex = 1;
     if (!undetermined) {
@@ -169,9 +169,9 @@ nsProgressMeterFrame::AttributeChanged(int32_t aNameSpaceID,
     }
 
     nsContentUtils::AddScriptRunner(new nsSetAttrRunnable(
-      barChild->GetContent(), nsGkAtoms::flex, flex));
+      barChild->GetContent()->AsElement(), nsGkAtoms::flex, flex));
     nsContentUtils::AddScriptRunner(new nsSetAttrRunnable(
-      remainderContent, nsGkAtoms::flex, maxFlex - flex));
+      remainderContent->AsElement(), nsGkAtoms::flex, maxFlex - flex));
     nsContentUtils::AddScriptRunner(new nsReflowFrameRunnable(
       this, nsIPresShell::eTreeChange, NS_FRAME_IS_DIRTY));
   }

layout/xul/nsResizerFrame.cpp

@@ -416,13 +416,14 @@ nsResizerFrame::ResizeContent(nsIContent* aContent, const Direction& aDirection,
     }
     // only set the property if the element could have changed in that direction
     if (aDirection.mHorizontal) {
-      aContent->SetAttr(kNameSpaceID_None, nsGkAtoms::width, aSizeInfo.width, true);
+      aContent->AsElement()->SetAttr(kNameSpaceID_None, nsGkAtoms::width,
+                                     aSizeInfo.width, true);
     }
     if (aDirection.mVertical) {
-      aContent->SetAttr(kNameSpaceID_None, nsGkAtoms::height, aSizeInfo.height, true);
+      aContent->AsElement()->SetAttr(kNameSpaceID_None, nsGkAtoms::height,
+                                     aSizeInfo.height, true);
     }
-  }
+  } else {
-  else {
     nsCOMPtr<nsStyledElement> inlineStyleContent =
       do_QueryInterface(aContent);
     if (inlineStyleContent) {

layout/xul/nsRootBoxFrame.cpp

@@ -55,8 +55,8 @@ public:
 
   virtual nsPopupSetFrame* GetPopupSetFrame() override;
   virtual void SetPopupSetFrame(nsPopupSetFrame* aPopupSet) override;
-  virtual nsIContent* GetDefaultTooltip() override;
+  virtual Element* GetDefaultTooltip() override;
-  virtual void SetDefaultTooltip(nsIContent* aTooltip) override;
+  virtual void SetDefaultTooltip(Element* aTooltip) override;
   virtual nsresult AddTooltipSupport(nsIContent* aNode) override;
   virtual nsresult RemoveTooltipSupport(nsIContent* aNode) override;
 
@@ -94,7 +94,7 @@ public:
   nsPopupSetFrame* mPopupSetFrame;
 
 protected:
-  nsIContent* mDefaultTooltip;
+  Element* mDefaultTooltip;
 };
 
 //----------------------------------------------------------------------
@@ -231,14 +231,14 @@ nsRootBoxFrame::SetPopupSetFrame(nsPopupSetFrame* aPopupSet)
   }
 }
 
-nsIContent*
+Element*
 nsRootBoxFrame::GetDefaultTooltip()
 {
   return mDefaultTooltip;
 }
 
 void
-nsRootBoxFrame::SetDefaultTooltip(nsIContent* aTooltip)
+nsRootBoxFrame::SetDefaultTooltip(Element* aTooltip)
 {
   mDefaultTooltip = aTooltip;
 }

layout/xul/nsScrollbarButtonFrame.cpp

@@ -118,9 +118,9 @@ nsScrollbarButtonFrame::HandleButtonPress(nsPresContext* aPresContext,
   static nsIContent::AttrValuesArray strings[] = { &nsGkAtoms::increment,
                                                    &nsGkAtoms::decrement,
                                                    nullptr };
-  int32_t index = mContent->FindAttrValueIn(kNameSpaceID_None,
+  int32_t index = mContent->AsElement()->FindAttrValueIn(kNameSpaceID_None,
-                                            nsGkAtoms::type,
+                                                         nsGkAtoms::type,
-                                            strings, eCaseMatters);
+                                                         strings, eCaseMatters);
   int32_t direction;
   if (index == 0)
     direction = 1;
@@ -132,7 +132,8 @@ nsScrollbarButtonFrame::HandleButtonPress(nsPresContext* aPresContext,
   bool repeat = pressedButtonAction != 2;
   // set this attribute so we can style it later
   AutoWeakFrame weakFrame(this);
-  mContent->SetAttr(kNameSpaceID_None, nsGkAtoms::active, NS_LITERAL_STRING("true"), true);
+  mContent->AsElement()->SetAttr(kNameSpaceID_None, nsGkAtoms::active,
+                                 NS_LITERAL_STRING("true"), true);
 
   nsIPresShell::SetCapturingContent(mContent, CAPTURE_IGNOREALLOWED);
 
@@ -195,7 +196,7 @@ nsScrollbarButtonFrame::HandleRelease(nsPresContext* aPresContext,
 {
   nsIPresShell::SetCapturingContent(nullptr, 0);
   // we're not active anymore
-  mContent->UnsetAttr(kNameSpaceID_None, nsGkAtoms::active, true);
+  mContent->AsElement()->UnsetAttr(kNameSpaceID_None, nsGkAtoms::active, true);
   StopRepeat();
   nsIFrame* scrollbar;
   GetParentWithTag(nsGkAtoms::scrollbar, this, scrollbar);

layout/xul/nsScrollbarFrame.cpp

@@ -237,7 +237,7 @@ int32_t
 nsScrollbarFrame::MoveToNewPosition()
 {
   // get the scrollbar's content node
-  nsCOMPtr<nsIContent> content = GetContent();
+  RefPtr<Element> content = GetContent()->AsElement();
 
   // get the current pos
   int32_t curpos = nsSliderFrame::GetCurrentPosition(content);

layout/xul/nsSliderFrame.cpp

@@ -263,8 +263,7 @@ nsSliderFrame::AttributeChanged(int32_t aNameSpaceID,
       // bounds check it.
 
       nsIFrame* scrollbarBox = GetScrollbar();
-      nsCOMPtr<nsIContent> scrollbar;
+      nsCOMPtr<nsIContent> scrollbar = GetContentOfBox(scrollbarBox);
-      scrollbar = GetContentOfBox(scrollbarBox);
       int32_t current = GetCurrentPosition(scrollbar);
       int32_t min = GetMinPosition(scrollbar);
       int32_t max = GetMaxPosition(scrollbar);
@@ -304,7 +303,7 @@ nsSliderFrame::AttributeChanged(int32_t aNameSpaceID,
         // 'this' might be destroyed here
 
         nsContentUtils::AddScriptRunner(
-          new nsSetAttrRunnable(scrollbar, nsGkAtoms::curpos, current));
+          new nsSetAttrRunnable(scrollbar->AsElement(), nsGkAtoms::curpos, current));
       }
   }
 
@@ -505,8 +504,7 @@ nsSliderFrame::DoXULLayout(nsBoxLayoutState& aState)
 
   // get the scrollbar
   nsIFrame* scrollbarBox = GetScrollbar();
-  nsCOMPtr<nsIContent> scrollbar;
+  nsCOMPtr<nsIContent> scrollbar = GetContentOfBox(scrollbarBox);
-  scrollbar = GetContentOfBox(scrollbarBox);
 
   // get the thumb's pref size
   nsSize thumbSize = thumbBox->GetXULPrefSize(aState);
@@ -702,7 +700,7 @@ nsSliderFrame::HandleEvent(nsPresContext* aPresContext,
     DragThumb(true);
 
 #ifdef MOZ_WIDGET_GTK
-    nsCOMPtr<nsIContent> thumb = thumbFrame->GetContent();
+    RefPtr<Element> thumb = thumbFrame->GetContent()->AsElement();
     thumb->SetAttr(kNameSpaceID_None, nsGkAtoms::active, NS_LITERAL_STRING("true"), true);
 #endif
 
@@ -816,8 +814,7 @@ void
 nsSliderFrame::CurrentPositionChanged()
 {
   nsIFrame* scrollbarBox = GetScrollbar();
-  nsCOMPtr<nsIContent> scrollbar;
+  nsCOMPtr<nsIContent> scrollbar = GetContentOfBox(scrollbarBox);
-  scrollbar = GetContentOfBox(scrollbarBox);
 
   // get the current position
   int32_t curPos = GetCurrentPosition(scrollbar);
@@ -890,7 +887,7 @@ nsSliderFrame::CurrentPositionChanged()
   }
 }
 
-static void UpdateAttribute(nsIContent* aScrollbar, nscoord aNewPos, bool aNotify, bool aIsSmooth) {
+static void UpdateAttribute(Element* aScrollbar, nscoord aNewPos, bool aNotify, bool aIsSmooth) {
   nsAutoString str;
   str.AppendInt(aNewPos);
 
@@ -976,14 +973,14 @@ nsSliderFrame::SetCurrentPositionInternal(nsIContent* aScrollbar, int32_t aNewPo
       if (!weakFrame.IsAlive()) {
         return;
       }
-      UpdateAttribute(scrollbar, aNewPos, /* aNotify */false, aIsSmooth);
+      UpdateAttribute(scrollbar->AsElement(), aNewPos, /* aNotify */false, aIsSmooth);
       CurrentPositionChanged();
       mUserChanged = false;
       return;
     }
   }
 
-  UpdateAttribute(scrollbar, aNewPos, true, aIsSmooth);
+  UpdateAttribute(scrollbar->AsElement(), aNewPos, true, aIsSmooth);
   if (!weakFrame.IsAlive()) {
     return;
   }
@@ -1221,7 +1218,7 @@ nsSliderFrame::StartDrag(nsIDOMEvent* aEvent)
   }
 
 #ifdef MOZ_WIDGET_GTK
-  nsCOMPtr<nsIContent> thumb = thumbFrame->GetContent();
+  RefPtr<Element> thumb = thumbFrame->GetContent()->AsElement();
   thumb->SetAttr(kNameSpaceID_None, nsGkAtoms::active, NS_LITERAL_STRING("true"), true);
 #endif
 
@@ -1259,7 +1256,7 @@ nsSliderFrame::StopDrag()
 #ifdef MOZ_WIDGET_GTK
   nsIFrame* thumbFrame = mFrames.FirstChild();
   if (thumbFrame) {
-    nsCOMPtr<nsIContent> thumb = thumbFrame->GetContent();
+    RefPtr<Element> thumb = thumbFrame->GetContent()->AsElement();
     thumb->UnsetAttr(kNameSpaceID_None, nsGkAtoms::active, true);
   }
 #endif

layout/xul/nsSplitterFrame.cpp

@@ -284,8 +284,8 @@ nsSplitterFrame::Init(nsIContent*       aContent,
     if (!aParent->IsXULHorizontal()) {
       if (!nsContentUtils::HasNonEmptyAttr(aContent, kNameSpaceID_None,
                                            nsGkAtoms::orient)) {
-        aContent->SetAttr(kNameSpaceID_None, nsGkAtoms::orient,
+        aContent->AsElement()->SetAttr(kNameSpaceID_None, nsGkAtoms::orient,
-                          NS_LITERAL_STRING("vertical"), false);
+                                       NS_LITERAL_STRING("vertical"), false);
         if (StyleContext()->IsGecko()) {
           // FIXME(emilio): Even if we did this in Servo, this just won't
           // work, and we'd need a specific "really re-resolve the style" API...
@@ -422,8 +422,11 @@ nsSplitterFrameInner::MouseUp(nsPresContext* aPresContext,
     mDragging = false;
     State newState = GetState();
     // if the state is dragging then make it Open.
-    if (newState == Dragging)
+    if (newState == Dragging) {
-      mOuter->mContent->SetAttr(kNameSpaceID_None, nsGkAtoms::state, EmptyString(), true);
+      mOuter->mContent->AsElement()->SetAttr(kNameSpaceID_None,
+                                             nsGkAtoms::state, EmptyString(),
+                                             true);
+    }
 
     mPressed = false;
 
@@ -513,7 +516,7 @@ nsSplitterFrameInner::MouseDrag(nsPresContext* aPresContext,
           //printf("Collapse right\n");
           if (supportsAfter)
           {
-            nsCOMPtr<nsIContent> outer = mOuter->mContent;
+            RefPtr<Element> outer = mOuter->mContent->AsElement();
             outer->SetAttr(kNameSpaceID_None, nsGkAtoms::substate,
                            NS_LITERAL_STRING("after"),
                            true);
@@ -527,7 +530,7 @@ nsSplitterFrameInner::MouseDrag(nsPresContext* aPresContext,
           //printf("Collapse left\n");
           if (supportsBefore)
           {
-            nsCOMPtr<nsIContent> outer = mOuter->mContent;
+            RefPtr<Element> outer = mOuter->mContent->AsElement();
             outer->SetAttr(kNameSpaceID_None, nsGkAtoms::substate,
                            NS_LITERAL_STRING("before"),
                            true);
@@ -540,8 +543,12 @@ nsSplitterFrameInner::MouseDrag(nsPresContext* aPresContext,
     } else {
       // if we are not in a collapsed position and we are not dragging make sure
       // we are dragging.
-      if (currentState != Dragging)
+      if (currentState != Dragging) {
-        mOuter->mContent->SetAttr(kNameSpaceID_None, nsGkAtoms::state, NS_LITERAL_STRING("dragging"), true);
+        mOuter->mContent->AsElement()->SetAttr(kNameSpaceID_None,
+                                               nsGkAtoms::state,
+                                               NS_LITERAL_STRING("dragging"),
+                                               true);
+      }
       AdjustChildren(aPresContext);
     }
 
@@ -693,10 +700,11 @@ nsSplitterFrameInner::MouseDown(nsIDOMEvent* aMouseEvent)
 
         // We need to check for hidden attribute too, since treecols with
         // the hidden="true" attribute are not really hidden, just collapsed
-        if (!content->AttrValueIs(kNameSpaceID_None, nsGkAtoms::fixed,
+        if (!content->IsElement() ||
-                                  nsGkAtoms::_true, eCaseMatters) &&
+            (!content->AttrValueIs(kNameSpaceID_None, nsGkAtoms::fixed,
-            !content->AttrValueIs(kNameSpaceID_None, nsGkAtoms::hidden,
+                                   nsGkAtoms::_true, eCaseMatters) &&
-                                  nsGkAtoms::_true, eCaseMatters)) {
+             !content->AttrValueIs(kNameSpaceID_None, nsGkAtoms::hidden,
+                                   nsGkAtoms::_true, eCaseMatters))) {
             if (count < childIndex && (resizeBefore != Flex || flex > 0)) {
                 mChildInfosBefore[mChildInfosBeforeCount].childElem = content;
                 mChildInfosBefore[mChildInfosBeforeCount].min     = isHorizontal ? minSize.width : minSize.height;
@@ -780,8 +788,8 @@ nsSplitterFrameInner::MouseMove(nsIDOMEvent* aMouseEvent)
     return NS_OK;
 
   nsCOMPtr<nsIDOMEventListener> kungfuDeathGrip(this);
-  mOuter->mContent->SetAttr(kNameSpaceID_None, nsGkAtoms::state,
+  mOuter->mContent->AsElement()->SetAttr(kNameSpaceID_None, nsGkAtoms::state,
-                            NS_LITERAL_STRING("dragging"), true);
+                                         NS_LITERAL_STRING("dragging"), true);
 
   RemoveListener();
   mDragging = true;
@@ -857,21 +865,21 @@ nsSplitterFrameInner::UpdateState()
 
     if (splitterSibling) {
       nsCOMPtr<nsIContent> sibling = splitterSibling->GetContent();
-      if (sibling) {
+      if (sibling && sibling->IsElement()) {
         if (mState == CollapsedBefore || mState == CollapsedAfter) {
           // CollapsedBefore -> Open
           // CollapsedBefore -> Dragging
           // CollapsedAfter -> Open
           // CollapsedAfter -> Dragging
           nsContentUtils::AddScriptRunner(
-            new nsUnsetAttrRunnable(sibling, nsGkAtoms::collapsed));
+            new nsUnsetAttrRunnable(sibling->AsElement(), nsGkAtoms::collapsed));
         } else if ((mState == Open || mState == Dragging)
                    && (newState == CollapsedBefore ||
                        newState == CollapsedAfter)) {
           // Open -> CollapsedBefore / CollapsedAfter
           // Dragging -> CollapsedBefore / CollapsedAfter
           nsContentUtils::AddScriptRunner(
-            new nsSetAttrRunnable(sibling, nsGkAtoms::collapsed,
+            new nsSetAttrRunnable(sibling->AsElement(), nsGkAtoms::collapsed,
                                   NS_LITERAL_STRING("true")));
         }
       }
@@ -974,16 +982,20 @@ nsSplitterFrameInner::SetPreferredSize(nsBoxLayoutState& aState, nsIFrame* aChil
   }
 
   nsIContent* content = aChildBox->GetContent();
+  if (!content->IsElement()) {
+    return;
+  }
 
   // set its preferred size.
   nsAutoString prefValue;
   prefValue.AppendInt(pref/aOnePixel);
   if (content->AttrValueIs(kNameSpaceID_None, attribute,
-                           prefValue, eCaseMatters))
+                           prefValue, eCaseMatters)) {
      return;
+  }
 
   AutoWeakFrame weakBox(aChildBox);
-  content->SetAttr(kNameSpaceID_None, attribute, prefValue, true);
+  content->AsElement()->SetAttr(kNameSpaceID_None, attribute, prefValue, true);
   ENSURE_TRUE(weakBox.IsAlive());
   aState.PresShell()->FrameNeedsReflow(aChildBox, nsIPresShell::eStyleChange,
                                        NS_FRAME_IS_DIRTY);

layout/xul/nsXULPopupManager.cpp

@@ -548,7 +548,7 @@ nsXULPopupManager::PopupResized(nsIFrame* aFrame, LayoutDeviceIntSize aSize)
   if (curDevSize.width == aSize.width && curDevSize.height == aSize.height)
     return;
 
-  nsIContent* popup = menuPopupFrame->GetContent();
+  Element* popup = menuPopupFrame->GetContent()->AsElement();
 
   // Only set the width and height if the popup already has these attributes.
   if (!popup->HasAttr(kNameSpaceID_None, nsGkAtoms::width) ||
@@ -710,7 +710,7 @@ nsXULPopupManager::ShowMenu(nsIContent *aMenu,
       if (xulelem) {
         nsCOMPtr<nsIXULTemplateBuilder> builder = xulelem->GetBuilder();
         if (builder) {
-          builder->CreateContents(aMenu, true);
+          builder->CreateContents(aMenu->AsElement(), true);
           break;
         }
       }
@@ -1999,8 +1999,9 @@ nsXULPopupManager::UpdateMenuItems(nsIContent* aPopup)
     }
     if (grandChild->IsXULElement(nsGkAtoms::menuitem)) {
       // See if we have a command attribute.
+      Element* grandChildElement = grandChild->AsElement();
       nsAutoString command;
-      grandChild->GetAttr(kNameSpaceID_None, nsGkAtoms::command, command);
+      grandChildElement->GetAttr(kNameSpaceID_None, nsGkAtoms::command, command);
       if (!command.IsEmpty()) {
         // We do! Look it up in our document
         RefPtr<dom::Element> commandElement =
@@ -2009,24 +2010,24 @@ nsXULPopupManager::UpdateMenuItems(nsIContent* aPopup)
           nsAutoString commandValue;
           // The menu's disabled state needs to be updated to match the command.
           if (commandElement->GetAttr(kNameSpaceID_None, nsGkAtoms::disabled, commandValue))
-            grandChild->SetAttr(kNameSpaceID_None, nsGkAtoms::disabled, commandValue, true);
+            grandChildElement->SetAttr(kNameSpaceID_None, nsGkAtoms::disabled, commandValue, true);
           else
-            grandChild->UnsetAttr(kNameSpaceID_None, nsGkAtoms::disabled, true);
+            grandChildElement->UnsetAttr(kNameSpaceID_None, nsGkAtoms::disabled, true);
 
           // The menu's label, accesskey checked and hidden states need to be updated
           // to match the command. Note that unlike the disabled state if the
           // command has *no* value, we assume the menu is supplying its own.
           if (commandElement->GetAttr(kNameSpaceID_None, nsGkAtoms::label, commandValue))
-            grandChild->SetAttr(kNameSpaceID_None, nsGkAtoms::label, commandValue, true);
+            grandChildElement->SetAttr(kNameSpaceID_None, nsGkAtoms::label, commandValue, true);
 
           if (commandElement->GetAttr(kNameSpaceID_None, nsGkAtoms::accesskey, commandValue))
-            grandChild->SetAttr(kNameSpaceID_None, nsGkAtoms::accesskey, commandValue, true);
+            grandChildElement->SetAttr(kNameSpaceID_None, nsGkAtoms::accesskey, commandValue, true);
 
           if (commandElement->GetAttr(kNameSpaceID_None, nsGkAtoms::checked, commandValue))
-            grandChild->SetAttr(kNameSpaceID_None, nsGkAtoms::checked, commandValue, true);
+            grandChildElement->SetAttr(kNameSpaceID_None, nsGkAtoms::checked, commandValue, true);
 
           if (commandElement->GetAttr(kNameSpaceID_None, nsGkAtoms::hidden, commandValue))
-            grandChild->SetAttr(kNameSpaceID_None, nsGkAtoms::hidden, commandValue, true);
+            grandChildElement->SetAttr(kNameSpaceID_None, nsGkAtoms::hidden, commandValue, true);
         }
       }
     }

layout/xul/nsXULPopupManager.h

@@ -289,7 +289,7 @@ private:
 class nsXULMenuCommandEvent : public mozilla::Runnable
 {
 public:
-  nsXULMenuCommandEvent(nsIContent* aMenu,
+  nsXULMenuCommandEvent(mozilla::dom::Element* aMenu,
                         bool aIsTrusted,
                         bool aShift,
                         bool aControl,
@@ -316,7 +316,7 @@ public:
   void SetCloseMenuMode(CloseMenuMode aCloseMenuMode) { mCloseMenuMode = aCloseMenuMode; }
 
 private:
-  nsCOMPtr<nsIContent> mMenu;
+  RefPtr<mozilla::dom::Element> mMenu;
   bool mIsTrusted;
   bool mShift;
   bool mControl;

layout/xul/nsXULTooltipListener.cpp

@@ -477,7 +477,7 @@ GetTreeCellCoords(nsITreeBoxObject* aTreeBox, nsIContent* aSourceNode,
 #endif
 
 static void
-SetTitletipLabel(nsITreeBoxObject* aTreeBox, nsIContent* aTooltip,
+SetTitletipLabel(nsITreeBoxObject* aTreeBox, Element* aTooltip,
                  int32_t aRow, nsITreeColumn* aCol)
 {
   nsCOMPtr<nsITreeView> view;
@@ -497,7 +497,7 @@ SetTitletipLabel(nsITreeBoxObject* aTreeBox, nsIContent* aTooltip,
 void
 nsXULTooltipListener::LaunchTooltip()
 {
-  nsCOMPtr<nsIContent> currentTooltip = do_QueryReferent(mCurrentTooltip);
+  nsCOMPtr<Element> currentTooltip = do_QueryReferent(mCurrentTooltip);
   if (!currentTooltip)
     return;
 
@@ -592,10 +592,9 @@ nsXULTooltipListener::FindTooltip(nsIContent* aTarget, nsIContent** aTooltip)
     // specifying tooltiptext means we will always use the default tooltip
     nsIRootBox* rootBox = nsIRootBox::GetRootBox(document->GetShell());
     NS_ENSURE_STATE(rootBox);
-    *aTooltip = rootBox->GetDefaultTooltip();
+    if (RefPtr<Element> tooltip = rootBox->GetDefaultTooltip()) {
-    if (*aTooltip) {
+      tooltip->SetAttr(kNameSpaceID_None, nsGkAtoms::label, tooltipText, true);
-      NS_ADDREF(*aTooltip);
+      tooltip.forget(aTooltip);
-      (*aTooltip)->SetAttr(kNameSpaceID_None, nsGkAtoms::label, tooltipText, true);
     }
     return NS_OK;
   }

layout/xul/tree/nsTreeBodyFrame.cpp

@@ -836,12 +836,12 @@ nsTreeBodyFrame::ScrollParts nsTreeBodyFrame::GetScrollParts()
     if (result.mHScrollbar) {
       result.mHScrollbar->SetScrollbarMediatorContent(GetContent());
       nsIFrame* f = do_QueryFrame(result.mHScrollbar);
-      result.mHScrollbarContent = f->GetContent();
+      result.mHScrollbarContent = f->GetContent()->AsElement();
     }
     if (result.mVScrollbar) {
       result.mVScrollbar->SetScrollbarMediatorContent(GetContent());
       nsIFrame* f = do_QueryFrame(result.mVScrollbar);
-      result.mVScrollbarContent = f->GetContent();
+      result.mVScrollbarContent = f->GetContent()->AsElement();
     }
   }
   return result;