diff --git a/editor/libeditor/html/nsWSRunObject.cpp b/editor/libeditor/html/nsWSRunObject.cpp
index e3b4b54966b..b77210d6552 100644
--- a/editor/libeditor/html/nsWSRunObject.cpp
+++ b/editor/libeditor/html/nsWSRunObject.cpp
@@ -405,7 +405,7 @@ nsWSRunObject::DeleteWSBackward()
   // Caller's job to ensure that previous char is really ws.  If it is normal
   // ws, we need to delete the whole run.
   if (nsCRT::IsAsciiSpace(point.mChar)) {
-    nsCOMPtr<nsIContent> startNodeText, endNodeText;
+    nsRefPtr<Text> startNodeText, endNodeText;
     int32_t startOffset, endOffset;
     GetAsciiWSBounds(eBoth, point.mTextNode, point.mOffset + 1,
                      getter_AddRefs(startNodeText), &startOffset,
@@ -456,7 +456,7 @@ nsWSRunObject::DeleteWSForward()
   // Caller's job to ensure that next char is really ws.  If it is normal ws,
   // we need to delete the whole run.
   if (nsCRT::IsAsciiSpace(point.mChar)) {
-    nsCOMPtr<nsIContent> startNodeText, endNodeText;
+    nsRefPtr<Text> startNodeText, endNodeText;
     int32_t startOffset, endOffset;
     GetAsciiWSBounds(eBoth, point.mTextNode, point.mOffset + 1,
                      getter_AddRefs(startNodeText), &startOffset,
@@ -628,11 +628,11 @@ nsWSRunObject::GetWSNodes()
   nsCOMPtr<nsINode> wsBoundingParent = GetWSBoundingParent();
 
   // first look backwards to find preceding ws nodes
-  if (mNode->NodeType() == nsIDOMNode::TEXT_NODE) {
-    nsCOMPtr<nsIContent> textNode(do_QueryInterface(mNode));
+  if (mNode->IsNodeOfType(nsINode::eTEXT)) {
+    nsRefPtr<Text> textNode(static_cast<Text*>(mNode.get()));
     const nsTextFragment* textFrag = textNode->GetText();
     
-    mNodeArray.InsertElementAt(0, static_cast<Text*>(mNode.get()));
+    mNodeArray.InsertElementAt(0, textNode);
     if (mOffset) {
       for (int32_t pos = mOffset - 1; pos >= 0; pos--) {
         // sanity bounds check the char position.  bug 136165
@@ -643,22 +643,22 @@ nsWSRunObject::GetWSNodes()
         char16_t theChar = textFrag->CharAt(pos);
         if (!nsCRT::IsAsciiSpace(theChar)) {
           if (theChar != nbsp) {
-            mStartNode = mNode;
+            mStartNode = textNode;
             mStartOffset = pos + 1;
             mStartReason = WSType::text;
-            mStartReasonNode = mNode;
+            mStartReasonNode = textNode;
             break;
           }
           // as we look backwards update our earliest found nbsp
-          mFirstNBSPNode = mNode;
+          mFirstNBSPNode = textNode;
           mFirstNBSPOffset = pos;
           // also keep track of latest nbsp so far
           if (!mLastNBSPNode) {
-            mLastNBSPNode = mNode;
+            mLastNBSPNode = textNode;
             mLastNBSPOffset = pos;
           }
         }
-        start.node = mNode;
+        start.node = textNode;
         start.offset = pos;
       }
     }
@@ -675,11 +675,9 @@ nsWSRunObject::GetWSNodes()
         mStartOffset = start.offset;
         mStartReason = WSType::otherBlock;
         mStartReasonNode = priorNode;
-      }
-      else if (priorNode->NodeType() == nsIDOMNode::TEXT_NODE) {
-        mNodeArray.InsertElementAt(0, static_cast<Text*>(priorNode.get()));
-        NS_ENSURE_SUCCESS(res, res);
-        nsCOMPtr<nsIContent> textNode(do_QueryInterface(priorNode));
+      } else if (priorNode->IsNodeOfType(nsINode::eTEXT)) {
+        nsRefPtr<Text> textNode(static_cast<Text*>(priorNode.get()));
+        mNodeArray.InsertElementAt(0, textNode);
         const nsTextFragment *textFrag;
         if (!textNode || !(textFrag = textNode->GetText())) {
           return NS_ERROR_NULL_POINTER;
@@ -700,22 +698,22 @@ nsWSRunObject::GetWSNodes()
             char16_t theChar = textFrag->CharAt(pos);
             if (!nsCRT::IsAsciiSpace(theChar)) {
               if (theChar != nbsp) {
-                mStartNode = priorNode;
+                mStartNode = textNode;
                 mStartOffset = pos + 1;
                 mStartReason = WSType::text;
-                mStartReasonNode = priorNode;
+                mStartReasonNode = textNode;
                 break;
               }
               // as we look backwards update our earliest found nbsp
-              mFirstNBSPNode = priorNode;
+              mFirstNBSPNode = textNode;
               mFirstNBSPOffset = pos;
               // also keep track of latest nbsp so far
               if (!mLastNBSPNode) {
-                mLastNBSPNode = priorNode;
+                mLastNBSPNode = textNode;
                 mLastNBSPOffset = pos;
               }
             }
-            start.SetPoint(priorNode, pos);
+            start.SetPoint(textNode, pos);
           }
         }
       } else {
@@ -740,9 +738,9 @@ nsWSRunObject::GetWSNodes()
   }
   
   // then look ahead to find following ws nodes
-  if (mNode->NodeType() == nsIDOMNode::TEXT_NODE) {
+  if (mNode->IsNodeOfType(nsINode::eTEXT)) {
     // don't need to put it on list. it already is from code above
-    nsCOMPtr<nsIContent> textNode(do_QueryInterface(mNode));
+    nsRefPtr<Text> textNode(static_cast<Text*>(mNode.get()));
     const nsTextFragment *textFrag = textNode->GetText();
 
     uint32_t len = textNode->TextLength();
@@ -756,22 +754,22 @@ nsWSRunObject::GetWSNodes()
         char16_t theChar = textFrag->CharAt(pos);
         if (!nsCRT::IsAsciiSpace(theChar)) {
           if (theChar != nbsp) {
-            mEndNode = mNode;
+            mEndNode = textNode;
             mEndOffset = pos;
             mEndReason = WSType::text;
-            mEndReasonNode = mNode;
+            mEndReasonNode = textNode;
             break;
           }
           // as we look forwards update our latest found nbsp
-          mLastNBSPNode = mNode;
+          mLastNBSPNode = textNode;
           mLastNBSPOffset = pos;
           // also keep track of earliest nbsp so far
           if (!mFirstNBSPNode) {
-            mFirstNBSPNode = mNode;
+            mFirstNBSPNode = textNode;
             mFirstNBSPOffset = pos;
           }
         }
-        end.SetPoint(mNode, pos + 1);
+        end.SetPoint(textNode, pos + 1);
       }
     }
   }
@@ -788,9 +786,9 @@ nsWSRunObject::GetWSNodes()
         mEndOffset = end.offset;
         mEndReason = WSType::otherBlock;
         mEndReasonNode = nextNode;
-      } else if (mHTMLEditor->IsTextNode(nextNode)) {
-        mNodeArray.AppendElement(static_cast<Text*>(nextNode.get()));
-        nsCOMPtr<nsIContent> textNode(do_QueryInterface(nextNode));
+      } else if (nextNode->IsNodeOfType(nsINode::eTEXT)) {
+        nsRefPtr<Text> textNode(static_cast<Text*>(nextNode.get()));
+        mNodeArray.AppendElement(textNode);
         const nsTextFragment *textFrag;
         if (!textNode || !(textFrag = textNode->GetText())) {
           return NS_ERROR_NULL_POINTER;
@@ -800,7 +798,7 @@ nsWSRunObject::GetWSNodes()
         if (len < 1) {
           // Zero length text node. Set end point to it
           // so we can get past it!
-          end.SetPoint(nextNode,0);
+          end.SetPoint(textNode, 0);
         } else {
           for (uint32_t pos = 0; pos < len; pos++) {
             // sanity bounds check the char position.  bug 136165
@@ -811,22 +809,22 @@ nsWSRunObject::GetWSNodes()
             char16_t theChar = textFrag->CharAt(pos);
             if (!nsCRT::IsAsciiSpace(theChar)) {
               if (theChar != nbsp) {
-                mEndNode = nextNode;
+                mEndNode = textNode;
                 mEndOffset = pos;
                 mEndReason = WSType::text;
-                mEndReasonNode = nextNode;
+                mEndReasonNode = textNode;
                 break;
               }
               // as we look forwards update our latest found nbsp
-              mLastNBSPNode = nextNode;
+              mLastNBSPNode = textNode;
               mLastNBSPOffset = pos;
               // also keep track of earliest nbsp so far
               if (!mFirstNBSPNode) {
-                mFirstNBSPNode = nextNode;
+                mFirstNBSPNode = textNode;
                 mFirstNBSPOffset = pos;
               }
             }
-            end.SetPoint(nextNode, pos + 1);
+            end.SetPoint(textNode, pos + 1);
           }
         }
       } else {
@@ -1249,7 +1247,7 @@ nsWSRunObject::PrepareToDeleteRangePriv(nsWSRunObject* aEndObject)
       WSPoint point = GetCharBefore(mNode, mOffset);
       if (point.mTextNode && nsCRT::IsAsciiSpace(point.mChar))
       {
-        nsCOMPtr<nsIContent> wsStartNode, wsEndNode;
+        nsRefPtr<Text> wsStartNode, wsEndNode;
         int32_t wsStartOffset, wsEndOffset;
         GetAsciiWSBounds(eBoth, mNode, mOffset,
                          getter_AddRefs(wsStartNode), &wsStartOffset,
@@ -1294,7 +1292,7 @@ nsWSRunObject::PrepareToSplitAcrossBlocksPriv()
     WSPoint point = GetCharBefore(mNode, mOffset);
     if (point.mTextNode && nsCRT::IsAsciiSpace(point.mChar))
     {
-      nsCOMPtr<nsIContent> wsStartNode, wsEndNode;
+      nsRefPtr<Text> wsStartNode, wsEndNode;
       int32_t wsStartOffset, wsEndOffset;
       GetAsciiWSBounds(eBoth, mNode, mOffset,
                        getter_AddRefs(wsStartNode), &wsStartOffset,
@@ -1406,7 +1404,7 @@ nsWSRunObject::GetCharAfter(nsINode* aNode, int32_t aOffset)
     return GetWSPointAfter(aNode, aOffset);
   } else {
     // Use WSPoint version of GetCharAfter()
-    return GetCharAfter(WSPoint(static_cast<Text*>(aNode), aOffset, 0));
+    return GetCharAfter(WSPoint(mNodeArray[idx], aOffset, 0));
   }
 }
 
@@ -1421,7 +1419,7 @@ nsWSRunObject::GetCharBefore(nsINode* aNode, int32_t aOffset)
     return GetWSPointBefore(aNode, aOffset);
   } else {
     // Use WSPoint version of GetCharBefore()
-    return GetCharBefore(WSPoint(static_cast<Text*>(aNode), aOffset, 0));
+    return GetCharBefore(WSPoint(mNodeArray[idx], aOffset, 0));
   }
 }
 
@@ -1511,7 +1509,7 @@ nsWSRunObject::ConvertToNBSP(WSPoint aPoint, AreaRestriction aAR)
   NS_ENSURE_SUCCESS(res, res);
 
   // Next, find range of ws it will replace
-  nsCOMPtr<nsIContent> startNode, endNode;
+  nsRefPtr<Text> startNode, endNode;
   int32_t startOffset = 0, endOffset = 0;
 
   GetAsciiWSBounds(eAfter, aPoint.mTextNode, aPoint.mOffset + 1,
@@ -1529,13 +1527,13 @@ nsWSRunObject::ConvertToNBSP(WSPoint aPoint, AreaRestriction aAR)
 
 void
 nsWSRunObject::GetAsciiWSBounds(int16_t aDir, nsINode* aNode, int32_t aOffset,
-                                nsIContent** outStartNode, int32_t* outStartOffset,
-                                nsIContent** outEndNode, int32_t* outEndOffset)
+                                Text** outStartNode, int32_t* outStartOffset,
+                                Text** outEndNode, int32_t* outEndOffset)
 {
   MOZ_ASSERT(aNode && outStartNode && outStartOffset && outEndNode &&
              outEndOffset);
 
-  nsCOMPtr<nsIContent> startNode, endNode;
+  nsRefPtr<Text> startNode, endNode;
   int32_t startOffset = 0, endOffset = 0;
 
   if (aDir & eAfter) {
@@ -1632,7 +1630,7 @@ nsWSRunObject::FindRun(nsINode* aNode, int32_t aOffset, WSFragment** outRun,
 }
 
 char16_t 
-nsWSRunObject::GetCharAt(nsIContent *aTextNode, int32_t aOffset)
+nsWSRunObject::GetCharAt(Text* aTextNode, int32_t aOffset)
 {
   // return 0 if we can't get a char, for whatever reason
   NS_ENSURE_TRUE(aTextNode, 0);
@@ -1838,7 +1836,7 @@ nsWSRunObject::CheckTrailingNBSPOfRun(WSFragment *aRun)
       // editor softwraps at this point, the spaces won't be split across lines,
       // which looks ugly and is bad for the moose.
 
-      nsCOMPtr<nsIContent> startNode, endNode;
+      nsRefPtr<Text> startNode, endNode;
       int32_t startOffset, endOffset;
       GetAsciiWSBounds(eBoth, prevPoint.mTextNode, prevPoint.mOffset + 1,
                        getter_AddRefs(startNode), &startOffset,
diff --git a/editor/libeditor/html/nsWSRunObject.h b/editor/libeditor/html/nsWSRunObject.h
index bc6e37b4f08..c942bcf2939 100644
--- a/editor/libeditor/html/nsWSRunObject.h
+++ b/editor/libeditor/html/nsWSRunObject.h
@@ -282,16 +282,11 @@ class MOZ_STACK_CLASS nsWSRunObject
     // stored in the struct.
     struct MOZ_STACK_CLASS WSPoint
     {
-      nsCOMPtr<nsIContent> mTextNode;
+      nsRefPtr<mozilla::dom::Text> mTextNode;
       uint32_t mOffset;
       char16_t mChar;
 
       WSPoint() : mTextNode(0),mOffset(0),mChar(0) {}
-      WSPoint(nsIContent* aNode, int32_t aOffset, char16_t aChar) :
-                     mTextNode(aNode),mOffset(aOffset),mChar(aChar)
-      {
-        MOZ_ASSERT(mTextNode->IsNodeOfType(nsINode::eTEXT));
-      }
       WSPoint(mozilla::dom::Text* aTextNode, int32_t aOffset, char16_t aChar) :
                      mTextNode(aTextNode),mOffset(aOffset),mChar(aChar) {}
     };    
@@ -333,13 +328,13 @@ class MOZ_STACK_CLASS nsWSRunObject
     nsresult ConvertToNBSP(WSPoint aPoint,
                            AreaRestriction aAR = eAnywhere);
     void     GetAsciiWSBounds(int16_t aDir, nsINode* aNode, int32_t aOffset,
-                              nsIContent** outStartNode,
+                              mozilla::dom::Text** outStartNode,
                               int32_t* outStartOffset,
-                              nsIContent** outEndNode,
+                              mozilla::dom::Text** outEndNode,
                               int32_t* outEndOffset);
     void     FindRun(nsINode* aNode, int32_t aOffset, WSFragment** outRun,
                      bool after);
-    char16_t GetCharAt(nsIContent *aTextNode, int32_t aOffset);
+    char16_t GetCharAt(mozilla::dom::Text* aTextNode, int32_t aOffset);
     WSPoint  GetWSPointAfter(nsINode* aNode, int32_t aOffset);
     WSPoint  GetWSPointBefore(nsINode* aNode, int32_t aOffset);
     nsresult CheckTrailingNBSPOfRun(WSFragment *aRun);
@@ -371,10 +366,10 @@ class MOZ_STACK_CLASS nsWSRunObject
     WSType mEndReason;                 // reason why ws ends (eText, eOtherBlock, etc)
     nsCOMPtr<nsINode> mEndReasonNode;  // the node that implicated by end reason
     
-    nsCOMPtr<nsINode> mFirstNBSPNode;  // location of first nbsp in ws run, if any
+    nsRefPtr<mozilla::dom::Text> mFirstNBSPNode; // location of first nbsp in ws run, if any
     int32_t mFirstNBSPOffset;          // ...
     
-    nsCOMPtr<nsINode> mLastNBSPNode;   // location of last nbsp in ws run, if any
+    nsRefPtr<mozilla::dom::Text> mLastNBSPNode; // location of last nbsp in ws run, if any
     int32_t mLastNBSPOffset;           // ...
     
     // the list of nodes containing ws in this run
diff --git a/editor/libeditor/nsEditor.cpp b/editor/libeditor/nsEditor.cpp
index 379956878ce..e754d99c877 100644
--- a/editor/libeditor/nsEditor.cpp
+++ b/editor/libeditor/nsEditor.cpp
@@ -2446,7 +2446,7 @@ nsEditor::InsertTextImpl(const nsAString& aStringToInsert,
 
 
 nsresult nsEditor::InsertTextIntoTextNodeImpl(const nsAString& aStringToInsert,
-                                              nsINode* aTextNode,
+                                              Text* aTextNode,
                                               int32_t aOffset,
                                               bool aSuppressIME)
 {
diff --git a/editor/libeditor/nsEditor.h b/editor/libeditor/nsEditor.h
index d9cb0d2d085..9a2b687823e 100644
--- a/editor/libeditor/nsEditor.h
+++ b/editor/libeditor/nsEditor.h
@@ -208,7 +208,7 @@ public:
                                int32_t *aInOutOffset,
                                nsIDOMDocument *aDoc);
   nsresult InsertTextIntoTextNodeImpl(const nsAString& aStringToInsert,
-                                      nsINode* aTextNode,
+                                      mozilla::dom::Text* aTextNode,
                                       int32_t aOffset,
                                       bool aSuppressIME = false);
   nsresult InsertTextIntoTextNodeImpl(const nsAString& aStringToInsert,