diff --git a/accessible/src/html/nsHTMLImageAccessible.cpp b/accessible/src/html/nsHTMLImageAccessible.cpp
index c8348a36039..00e6413e246 100644
--- a/accessible/src/html/nsHTMLImageAccessible.cpp
+++ b/accessible/src/html/nsHTMLImageAccessible.cpp
@@ -284,9 +284,9 @@ nsHTMLImageAccessible::GetURI(PRInt32 aIndex, nsIURI **aURI)
   if (!domNode)
     return NS_ERROR_INVALID_ARG;
 
-  nsCOMPtr<nsILink> link(do_QueryInterface(domNode));
+  nsCOMPtr<nsIContent> link(do_QueryInterface(domNode));
   if (link)
-    link->GetHrefURI(aURI);
+    *aURI = link->GetHrefURI().get();
 
   return NS_OK;
 }
diff --git a/accessible/src/html/nsHTMLLinkAccessible.cpp b/accessible/src/html/nsHTMLLinkAccessible.cpp
index d90ef2625d5..4d0b2759cac 100644
--- a/accessible/src/html/nsHTMLLinkAccessible.cpp
+++ b/accessible/src/html/nsHTMLLinkAccessible.cpp
@@ -82,11 +82,7 @@ nsHTMLLinkAccessible::GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState)
     *aState |= nsIAccessibleStates::STATE_SELECTABLE;
   }
 
-  nsCOMPtr<nsILink> link = do_QueryInterface(mDOMNode);
-  NS_ENSURE_STATE(link);
-
-  nsLinkState linkState;
-  link->GetLinkState(linkState);
+  nsLinkState linkState = content->GetLinkState();
   if (linkState == eLinkState_NotLink || linkState == eLinkState_Unknown) {
     // This is a either named anchor (a link with also a name attribute) or
     // it doesn't have any attributes. Check if 'click' event handler is
@@ -180,10 +176,11 @@ nsHTMLLinkAccessible::GetURI(PRInt32 aIndex, nsIURI **aURI)
   if (aIndex != 0)
     return NS_ERROR_INVALID_ARG;
 
-  nsCOMPtr<nsILink> link(do_QueryInterface(mDOMNode));
+  nsCOMPtr<nsIContent> link(do_QueryInterface(mDOMNode));
   NS_ENSURE_STATE(link);
 
-  return link->GetHrefURI(aURI);
+  *aURI = link->GetHrefURI().get();
+  return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -192,13 +189,11 @@ nsHTMLLinkAccessible::GetURI(PRInt32 aIndex, nsIURI **aURI)
 PRBool
 nsHTMLLinkAccessible::IsLinked()
 {
-  nsCOMPtr<nsILink> link(do_QueryInterface(mDOMNode));
+  nsCOMPtr<nsIContent> link(do_QueryInterface(mDOMNode));
   if (!link)
     return PR_FALSE;
 
-  nsLinkState linkState;
-  nsresult rv = link->GetLinkState(linkState);
+  nsLinkState linkState = link->GetLinkState();
 
-  return NS_SUCCEEDED(rv) && linkState != eLinkState_NotLink &&
-         linkState != eLinkState_Unknown;
+  return linkState != eLinkState_NotLink && linkState != eLinkState_Unknown;
 }
diff --git a/browser/base/content/pageinfo/pageInfo.xul b/browser/base/content/pageinfo/pageInfo.xul
index 4a1e8528f31..c89419f0e19 100644
--- a/browser/base/content/pageinfo/pageInfo.xul
+++ b/browser/base/content/pageinfo/pageInfo.xul
@@ -318,8 +318,8 @@
 
       <vbox id="permList" flex="1">
         <vbox>
-          <label value="&permImage;" control="permImageGroup imageRadioGroup"/>
-          <hbox id="permImageGroup" role="group">
+          <label id="permImageLabel" value="&permImage;" control="imageRadioGroup"/>
+          <hbox role="group" aria-labelledby="permImageLabel">
             <checkbox id="imageDef" command="cmd_imageDef" label="&permUseDefault;"/>
             <spacer flex="1"/>
             <radiogroup id="imageRadioGroup" orient="horizontal">
@@ -329,8 +329,8 @@
           </hbox>
         </vbox>
         <vbox>
-          <label value="&permPopup;" control="permPopupGroup popupRadioGroup"/>
-          <hbox id="permPopupGroup" role="group">
+          <label id="permPopupLabel" value="&permPopup;" control="popupRadioGroup"/>
+          <hbox role="group" aria-labelledby="permPopupLabel">
             <checkbox id="popupDef" command="cmd_popupDef" label="&permUseDefault;"/>
             <spacer flex="1"/>
             <radiogroup id="popupRadioGroup" orient="horizontal">
@@ -340,8 +340,8 @@
           </hbox>
         </vbox>
         <vbox>
-          <label value="&permCookie;" control="permCookieGroup cookieRadioGroup"/>
-          <hbox id="permCookieGroup" role="group">
+          <label id="permCookieLabel" value="&permCookie;" control="cookieRadioGroup"/>
+          <hbox role="group" aria-labelledby="permCookieLabel">
             <checkbox id="cookieDef" command="cmd_cookieDef" label="&permUseDefault;"/>
             <spacer flex="1"/>
             <radiogroup id="cookieRadioGroup" orient="horizontal">
@@ -352,8 +352,8 @@
           </hbox>
         </vbox>
         <vbox>
-          <label value="&permInstall;" control="permInstallGroup installRadioGroup"/>
-          <hbox id="permInstallGroup" role="group">
+          <label id="permInstallLabel" value="&permInstall;" control="installRadioGroup"/>
+          <hbox role="group" aria-labelledby="permInstallLabel">
             <checkbox id="installDef" command="cmd_installDef" label="&permUseDefault;"/>
             <spacer flex="1"/>
             <radiogroup id="installRadioGroup" orient="horizontal">
@@ -364,8 +364,8 @@
         </vbox>
 
         <vbox>
-          <label value="&permGeo;" control="permGeoGroup geoRadioGroup"/>
-          <hbox id="permGeoGroup" role="group">
+          <label id="permGeoLabel" value="&permGeo;" control="geoRadioGroup"/>
+          <hbox role="group" aria-labelledby="permGeoLabel">
             <checkbox id="geoDef" command="cmd_geoDef" label="&permAskAlways;"/>
             <spacer flex="1"/>
             <radiogroup id="geoRadioGroup" orient="horizontal">
diff --git a/content/base/public/nsIContent.h b/content/base/public/nsIContent.h
index f592c7fcfbf..44ec61d3680 100644
--- a/content/base/public/nsIContent.h
+++ b/content/base/public/nsIContent.h
@@ -61,10 +61,17 @@ class nsIDocShell;
 class nsISMILAttr;
 #endif // MOZ_SMIL
 
+enum nsLinkState {
+  eLinkState_Unknown    = 0,
+  eLinkState_Unvisited  = 1,
+  eLinkState_Visited    = 2, 
+  eLinkState_NotLink    = 3
+};
+
 // IID for the nsIContent interface
 #define NS_ICONTENT_IID       \
-{ 0x08dadcc4, 0x057a, 0x4b8d, \
-  { 0x89, 0x43, 0x30, 0x0e, 0x61, 0xc6, 0x9d, 0x36 } }
+{ 0x4aaa38b8, 0x6bc1, 0x4d01, \
+  { 0xb6, 0x3d, 0xcd, 0x11, 0xc0, 0x84, 0x56, 0x9e } }
 
 /**
  * A node of content in a document's content model. This interface
@@ -598,6 +605,40 @@ public:
    */
   virtual PRBool IsLink(nsIURI** aURI) const = 0;
 
+  /**
+   * Get the cached state of the link.  If the state is unknown, 
+   * return eLinkState_Unknown.
+   *
+   * @return The cached link state of the link.
+   */
+  virtual nsLinkState GetLinkState() const
+  {
+    return eLinkState_NotLink;
+  }
+
+  /**
+   * Set the cached state of the link.
+   *
+   * @param aState The cached link state of the link.
+   */
+  virtual void SetLinkState(nsLinkState aState)
+  {
+    NS_ASSERTION(aState == eLinkState_NotLink,
+                 "Need to override SetLinkState?");
+  }
+
+  /**
+    * Get a pointer to the full href URI (fully resolved and canonicalized,
+    * since it's an nsIURI object) for link elements.
+    *
+    * @return A pointer to the URI or null if the element is not a link or it
+    *         has no HREF attribute.
+    */
+  virtual already_AddRefed<nsIURI> GetHrefURI() const
+  {
+    return nsnull;
+  }
+
   /**
    * Give this element a chance to fire links that should be fired
    * automatically when loaded. If the element was an autoloading link
diff --git a/content/base/src/nsDocument.cpp b/content/base/src/nsDocument.cpp
index 6ff87df4e87..cc8fe7b608d 100644
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -7305,10 +7305,7 @@ public:
 
     // Throw away the cached link state so it gets refetched by the style
     // system      
-    nsCOMPtr<nsILink> link = do_QueryInterface(aContent);
-    if (link) {
-      link->SetLinkState(eLinkState_Unknown);
-    }
+    aContent->SetLinkState(eLinkState_Unknown);
     contentVisited.AppendObject(aContent);
   }
 };
diff --git a/content/base/test/test_bug409380.html b/content/base/test/test_bug409380.html
index 038ec49f264..885a8ec54b4 100644
--- a/content/base/test/test_bug409380.html
+++ b/content/base/test/test_bug409380.html
@@ -41,7 +41,7 @@ function runRangeTest()
      "It should be possible to select text node even if the node is not in DOM.");
   hadException = false;
   try {
-    r.insertNode(document.createTextNode('5'));
+    range.insertNode(document.createTextNode('5'));
   } catch (ex) {
     hadException = true;
   }
diff --git a/content/html/content/public/nsILink.h b/content/html/content/public/nsILink.h
index 842b5fbccb5..e53e0e8506d 100644
--- a/content/html/content/public/nsILink.h
+++ b/content/html/content/public/nsILink.h
@@ -45,8 +45,8 @@ class nsIURI;
 
 // IID for the nsILink interface
 #define NS_ILINK_IID    \
-{ 0x0c212bc4, 0xfcd7, 0x479d,  \
-  { 0x8c, 0x3f, 0x3b, 0xe8, 0xe6, 0x78, 0x74, 0x50 } }
+{ 0x6f374a11, 0x212d, 0x47d6, \
+  { 0x94, 0xd1, 0xe6, 0x7c, 0x23, 0x4d, 0x34, 0x99 } }
 
 /**
  * This interface allows SelectorMatches to get the canonical
@@ -60,31 +60,9 @@ public:
   NS_DECLARE_STATIC_IID_ACCESSOR(NS_ILINK_IID)
 
   /**
-   * Get the cached state of the link.  If the state is unknown, 
-   * return eLinkState_Unknown.
-   *
-   * @param aState [out] The cached link state of the link.
-   * @return NS_OK
+   * GetLinkState/SetLinkState/GetHrefURI were moved to nsIContent.
+   * @see nsIContent
    */
-  NS_IMETHOD GetLinkState(nsLinkState &aState) = 0;
-
-  /**
-   * Set the cached state of the link.
-   *
-   * @param aState The cached link state of the link.
-   * @return NS_OK
-   */
-  NS_IMETHOD SetLinkState(nsLinkState aState) = 0;
-
-  /**
-    * Get a pointer to the fully href URI (fully resolved and canonicalized,
-    * since it's an nsIURI object).
-    *
-    * @param aURI [out] A pointer to be filled in with a pointer to the URI
-    *             If the element has no HREF attribute, it is set to nsnull.
-    * @return NS_OK if the out pointer is filled in (possibly with nsnull)
-    */
-  NS_IMETHOD GetHrefURI(nsIURI** aURI) = 0;
 
   /**
    * Dispatch a LinkAdded event to the chrome event handler for this document.
diff --git a/content/html/content/src/nsGenericHTMLElement.cpp b/content/html/content/src/nsGenericHTMLElement.cpp
index 665f16b33eb..1ceacbbe41e 100644
--- a/content/html/content/src/nsGenericHTMLElement.cpp
+++ b/content/html/content/src/nsGenericHTMLElement.cpp
@@ -1013,13 +1013,13 @@ nsGenericHTMLElement::IsHTMLLink(nsIURI** aURI) const
 {
   NS_PRECONDITION(aURI, "Must provide aURI out param");
 
-  GetHrefURIForAnchors(aURI);
+  *aURI = GetHrefURIForAnchors().get();
   // We promise out param is non-null if we return true, so base rv on it
   return *aURI != nsnull;
 }
 
-nsresult
-nsGenericHTMLElement::GetHrefURIForAnchors(nsIURI** aURI) const
+already_AddRefed<nsIURI>
+nsGenericHTMLElement::GetHrefURIForAnchors() const
 {
   // This is used by the three nsILink implementations and
   // nsHTMLStyleElement.
@@ -1027,9 +1027,10 @@ nsGenericHTMLElement::GetHrefURIForAnchors(nsIURI** aURI) const
   // Get href= attribute (relative URI).
 
   // We use the nsAttrValue's copy of the URI string to avoid copying.
-  GetURIAttr(nsGkAtoms::href, nsnull, PR_FALSE, aURI);
+  nsCOMPtr<nsIURI> uri;
+  GetURIAttr(nsGkAtoms::href, nsnull, PR_FALSE, getter_AddRefs(uri));
 
-  return NS_OK;
+  return uri.forget();
 }
 
 void
@@ -3194,8 +3195,7 @@ nsGenericHTMLElement::SetPortInHrefURI(const nsAString &aPort)
 nsresult
 nsGenericHTMLElement::GetProtocolFromHrefURI(nsAString& aProtocol)
 {
-  nsCOMPtr<nsIURI> uri;
-  GetHrefURIForAnchors(getter_AddRefs(uri));
+  nsCOMPtr<nsIURI> uri = GetHrefURIForAnchors();
 
   if (!uri) {
     aProtocol.AssignLiteral("http");
@@ -3213,8 +3213,7 @@ nsGenericHTMLElement::GetHostFromHrefURI(nsAString& aHost)
 {
   aHost.Truncate();
 
-  nsCOMPtr<nsIURI> uri;
-  GetHrefURIForAnchors(getter_AddRefs(uri));
+  nsCOMPtr<nsIURI> uri = GetHrefURIForAnchors();
   if (!uri) {
     // Don't throw from these methods!  Not a valid URI means return
     // empty string.
@@ -3238,8 +3237,7 @@ nsresult
 nsGenericHTMLElement::GetHostnameFromHrefURI(nsAString& aHostname)
 {
   aHostname.Truncate();
-  nsCOMPtr<nsIURI> uri;
-  GetHrefURIForAnchors(getter_AddRefs(uri));
+  nsCOMPtr<nsIURI> uri = GetHrefURIForAnchors();
   if (!uri) {
     // Don't throw from these methods!  Not a valid URI means return
     // empty string.
@@ -3264,8 +3262,7 @@ nsGenericHTMLElement::GetPathnameFromHrefURI(nsAString& aPathname)
 {
   aPathname.Truncate();
 
-  nsCOMPtr<nsIURI> uri;
-  GetHrefURIForAnchors(getter_AddRefs(uri));
+  nsCOMPtr<nsIURI> uri = GetHrefURIForAnchors();
   if (!uri) {
     // Don't throw from these methods!  Not a valid URI means return
     // empty string.
@@ -3294,8 +3291,7 @@ nsresult
 nsGenericHTMLElement::GetSearchFromHrefURI(nsAString& aSearch)
 {
   aSearch.Truncate();
-  nsCOMPtr<nsIURI> uri;
-  GetHrefURIForAnchors(getter_AddRefs(uri));
+  nsCOMPtr<nsIURI> uri = GetHrefURIForAnchors();
   nsCOMPtr<nsIURL> url(do_QueryInterface(uri));
   if (!url) {
     // Don't throw from these methods!  Not a valid URI means return
@@ -3319,8 +3315,7 @@ nsresult
 nsGenericHTMLElement::GetPortFromHrefURI(nsAString& aPort)
 {
   aPort.Truncate();
-  nsCOMPtr<nsIURI> uri;
-  GetHrefURIForAnchors(getter_AddRefs(uri));
+  nsCOMPtr<nsIURI> uri = GetHrefURIForAnchors();
   if (!uri) {
     // Don't throw from these methods!  Not a valid URI means return
     // empty string.
@@ -3350,8 +3345,7 @@ nsresult
 nsGenericHTMLElement::GetHashFromHrefURI(nsAString& aHash)
 {
   aHash.Truncate();
-  nsCOMPtr<nsIURI> uri;
-  GetHrefURIForAnchors(getter_AddRefs(uri));
+  nsCOMPtr<nsIURI> uri = GetHrefURIForAnchors();
   nsCOMPtr<nsIURL> url(do_QueryInterface(uri));
   if (!url) {
     // Don't throw from these methods!  Not a valid URI means return
diff --git a/content/html/content/src/nsGenericHTMLElement.h b/content/html/content/src/nsGenericHTMLElement.h
index 612b2921eaa..66925509a7c 100644
--- a/content/html/content/src/nsGenericHTMLElement.h
+++ b/content/html/content/src/nsGenericHTMLElement.h
@@ -196,7 +196,7 @@ public:
   PRBool IsHTMLLink(nsIURI** aURI) const;
 
   // Used by A, AREA, LINK, and STYLE.
-  nsresult GetHrefURIForAnchors(nsIURI** aURI) const;
+  already_AddRefed<nsIURI> GetHrefURIForAnchors() const;
 
   // As above, but makes sure to return a URI object that we can mutate with
   // impunity without changing our current URI.  That is, if the URI is cached
diff --git a/content/html/content/src/nsHTMLAnchorElement.cpp b/content/html/content/src/nsHTMLAnchorElement.cpp
index 7c619cfba76..f69b67b2445 100644
--- a/content/html/content/src/nsHTMLAnchorElement.cpp
+++ b/content/html/content/src/nsHTMLAnchorElement.cpp
@@ -99,9 +99,6 @@ public:
   NS_DECL_NSIDOMNSHTMLANCHORELEMENT2
 
   // nsILink
-  NS_IMETHOD GetLinkState(nsLinkState &aState);
-  NS_IMETHOD SetLinkState(nsLinkState aState);
-  NS_IMETHOD GetHrefURI(nsIURI** aURI);
   NS_IMETHOD LinkAdded() { return NS_OK; }
   NS_IMETHOD LinkRemoved() { return NS_OK; }
 
@@ -119,6 +116,9 @@ public:
   virtual nsresult PostHandleEvent(nsEventChainPostVisitor& aVisitor);
   virtual PRBool IsLink(nsIURI** aURI) const;
   virtual void GetLinkTarget(nsAString& aTarget);
+  virtual nsLinkState GetLinkState() const;
+  virtual void SetLinkState(nsLinkState aState);
+  virtual already_AddRefed<nsIURI> GetHrefURI() const;
 
   nsresult SetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
                    const nsAString& aValue, PRBool aNotify)
@@ -422,24 +422,22 @@ nsHTMLAnchorElement::SetPing(const nsAString& aValue)
   return SetAttr(kNameSpaceID_None, nsGkAtoms::ping, aValue, PR_TRUE);
 }
 
-NS_IMETHODIMP
-nsHTMLAnchorElement::GetLinkState(nsLinkState &aState)
+nsLinkState
+nsHTMLAnchorElement::GetLinkState() const
 {
-  aState = mLinkState;
-  return NS_OK;
+  return mLinkState;
 }
 
-NS_IMETHODIMP
+void
 nsHTMLAnchorElement::SetLinkState(nsLinkState aState)
 {
   mLinkState = aState;
-  return NS_OK;
 }
 
-NS_IMETHODIMP
-nsHTMLAnchorElement::GetHrefURI(nsIURI** aURI)
+already_AddRefed<nsIURI>
+nsHTMLAnchorElement::GetHrefURI() const
 {
-  return GetHrefURIForAnchors(aURI);
+  return GetHrefURIForAnchors();
 }
 
 nsresult
diff --git a/content/html/content/src/nsHTMLAreaElement.cpp b/content/html/content/src/nsHTMLAreaElement.cpp
index fe9ade6ba93..33eaa22ad06 100644
--- a/content/html/content/src/nsHTMLAreaElement.cpp
+++ b/content/html/content/src/nsHTMLAreaElement.cpp
@@ -81,9 +81,6 @@ public:
   NS_DECL_NSIDOMNSHTMLAREAELEMENT2
 
   // nsILink
-  NS_IMETHOD GetLinkState(nsLinkState &aState);
-  NS_IMETHOD SetLinkState(nsLinkState aState);
-  NS_IMETHOD GetHrefURI(nsIURI** aURI);
   NS_IMETHOD LinkAdded() { return NS_OK; }
   NS_IMETHOD LinkRemoved() { return NS_OK; }
 
@@ -91,6 +88,9 @@ public:
   virtual nsresult PostHandleEvent(nsEventChainPostVisitor& aVisitor);
   virtual PRBool IsLink(nsIURI** aURI) const;
   virtual void GetLinkTarget(nsAString& aTarget);
+  virtual nsLinkState GetLinkState() const;
+  virtual void SetLinkState(nsLinkState aState);
+  virtual already_AddRefed<nsIURI> GetHrefURI() const;
 
   virtual nsresult BindToTree(nsIDocument* aDocument, nsIContent* aParent,
                               nsIContent* aBindingParent,
@@ -320,22 +320,20 @@ nsHTMLAreaElement::SetPing(const nsAString& aValue)
   return SetAttr(kNameSpaceID_None, nsGkAtoms::ping, aValue, PR_TRUE);
 }
 
-NS_IMETHODIMP
-nsHTMLAreaElement::GetLinkState(nsLinkState &aState)
+nsLinkState
+nsHTMLAreaElement::GetLinkState() const
 {
-  aState = mLinkState;
-  return NS_OK;
+  return mLinkState;
 }
 
-NS_IMETHODIMP
+void
 nsHTMLAreaElement::SetLinkState(nsLinkState aState)
 {
   mLinkState = aState;
-  return NS_OK;
 }
 
-NS_IMETHODIMP
-nsHTMLAreaElement::GetHrefURI(nsIURI** aURI)
+already_AddRefed<nsIURI>
+nsHTMLAreaElement::GetHrefURI() const
 {
-  return GetHrefURIForAnchors(aURI);
+  return GetHrefURIForAnchors();
 }
diff --git a/content/html/content/src/nsHTMLDNSPrefetch.cpp b/content/html/content/src/nsHTMLDNSPrefetch.cpp
index 96054d09444..f82b63e157d 100644
--- a/content/html/content/src/nsHTMLDNSPrefetch.cpp
+++ b/content/html/content/src/nsHTMLDNSPrefetch.cpp
@@ -260,7 +260,7 @@ nsHTMLDNSPrefetch::nsDeferrals::SubmitQueue()
 
     if (mEntries[mTail].mElement->GetOwnerDoc()) {
       nsCOMPtr<nsIURI> hrefURI;
-      mEntries[mTail].mElement->GetHrefURIForAnchors(getter_AddRefs(hrefURI));
+      hrefURI = mEntries[mTail].mElement->GetHrefURIForAnchors();
       if (hrefURI)
         hrefURI->GetAsciiHost(hostName);
       
diff --git a/content/html/content/src/nsHTMLLinkElement.cpp b/content/html/content/src/nsHTMLLinkElement.cpp
index 03c7d91ae8a..bf68000fe7d 100644
--- a/content/html/content/src/nsHTMLLinkElement.cpp
+++ b/content/html/content/src/nsHTMLLinkElement.cpp
@@ -85,9 +85,6 @@ public:
   NS_DECL_NSIDOMHTMLLINKELEMENT
 
   // nsILink
-  NS_IMETHOD    GetLinkState(nsLinkState &aState);
-  NS_IMETHOD    SetLinkState(nsLinkState aState);
-  NS_IMETHOD    GetHrefURI(nsIURI** aURI);
   NS_IMETHOD    LinkAdded();
   NS_IMETHOD    LinkRemoved();
 
@@ -112,6 +109,9 @@ public:
   virtual nsresult PostHandleEvent(nsEventChainPostVisitor& aVisitor);
   virtual PRBool IsLink(nsIURI** aURI) const;
   virtual void GetLinkTarget(nsAString& aTarget);
+  virtual nsLinkState GetLinkState() const;
+  virtual void SetLinkState(nsLinkState aState);
+  virtual already_AddRefed<nsIURI> GetHrefURI() const;
 
   virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
 
@@ -377,24 +377,22 @@ nsHTMLLinkElement::GetLinkTarget(nsAString& aTarget)
   }
 }
 
-NS_IMETHODIMP
-nsHTMLLinkElement::GetLinkState(nsLinkState &aState)
+nsLinkState
+nsHTMLLinkElement::GetLinkState() const
 {
-  aState = mLinkState;
-  return NS_OK;
+  return mLinkState;
 }
 
-NS_IMETHODIMP
+void
 nsHTMLLinkElement::SetLinkState(nsLinkState aState)
 {
   mLinkState = aState;
-  return NS_OK;
 }
 
-NS_IMETHODIMP
-nsHTMLLinkElement::GetHrefURI(nsIURI** aURI)
+already_AddRefed<nsIURI>
+nsHTMLLinkElement::GetHrefURI() const
 {
-  return GetHrefURIForAnchors(aURI);
+  return GetHrefURIForAnchors();
 }
 
 void
@@ -402,7 +400,7 @@ nsHTMLLinkElement::GetStyleSheetURL(PRBool* aIsInline,
                                     nsIURI** aURI)
 {
   *aIsInline = PR_FALSE;
-  GetHrefURIForAnchors(aURI);
+  *aURI = GetHrefURIForAnchors().get();
   return;
 }
 
diff --git a/content/html/content/src/nsHTMLMediaElement.cpp b/content/html/content/src/nsHTMLMediaElement.cpp
index 525a83db5d4..4894a38b667 100644
--- a/content/html/content/src/nsHTMLMediaElement.cpp
+++ b/content/html/content/src/nsHTMLMediaElement.cpp
@@ -1145,7 +1145,7 @@ NS_IMETHODIMP
 nsHTMLMediaElement::CanPlayType(const nsAString& aType, nsAString& aResult)
 {
   switch (GetCanPlay(aType)) {
-  case CANPLAY_NO: aResult.AssignLiteral("no"); break;
+  case CANPLAY_NO: aResult.AssignLiteral(""); break;
   case CANPLAY_YES: aResult.AssignLiteral("probably"); break;
   default:
   case CANPLAY_MAYBE: aResult.AssignLiteral("maybe"); break;
diff --git a/content/html/content/src/nsHTMLStyleElement.cpp b/content/html/content/src/nsHTMLStyleElement.cpp
index 0e0a4d9f7a5..2a606cb13e4 100644
--- a/content/html/content/src/nsHTMLStyleElement.cpp
+++ b/content/html/content/src/nsHTMLStyleElement.cpp
@@ -328,7 +328,7 @@ nsHTMLStyleElement::GetStyleSheetURL(PRBool* aIsInline,
     return;
   }
 
-  GetHrefURIForAnchors(aURI);
+  *aURI = GetHrefURIForAnchors().get();
   return;
 }
 
diff --git a/content/media/test/can_play_type_ogg.js b/content/media/test/can_play_type_ogg.js
index 01813626cca..67e34e22f7c 100644
--- a/content/media/test/can_play_type_ogg.js
+++ b/content/media/test/can_play_type_ogg.js
@@ -16,7 +16,7 @@ function check_ogg(v, enabled) {
   check("video/ogg; codecs=theora", "probably");
 
   // Unsupported Ogg codecs
-  check("video/ogg; codecs=xyz", "no");
-  check("video/ogg; codecs=xyz,vorbis", "no");
-  check("video/ogg; codecs=vorbis,xyz", "no");
+  check("video/ogg; codecs=xyz", "");
+  check("video/ogg; codecs=xyz,vorbis", "");
+  check("video/ogg; codecs=vorbis,xyz", "");
 }
diff --git a/content/media/test/can_play_type_wave.js b/content/media/test/can_play_type_wave.js
index 8253a89f008..3a5f05017ae 100644
--- a/content/media/test/can_play_type_wave.js
+++ b/content/media/test/can_play_type_wave.js
@@ -20,11 +20,11 @@ function check_wave(v, enabled) {
   check("audio/wave; codecs=\"0, 1\"", "maybe");
 
   // Unsupported Wave codecs
-  check("audio/wave; codecs=2", "no");
-  check("audio/wave; codecs=xyz,0", "no");
-  check("audio/wave; codecs=0,xyz", "no");
-  check("audio/wave; codecs=\"xyz, 1\"", "no");
+  check("audio/wave; codecs=2", "");
+  check("audio/wave; codecs=xyz,0", "");
+  check("audio/wave; codecs=0,xyz", "");
+  check("audio/wave; codecs=\"xyz, 1\"", "");
   // empty codec names
-  check("audio/wave; codecs=,", "no");
-  check("audio/wave; codecs=\"0, 1,\"", "no");
+  check("audio/wave; codecs=,", "");
+  check("audio/wave; codecs=\"0, 1,\"", "");
 }
diff --git a/content/media/test/test_audio1.html b/content/media/test/test_audio1.html
index 004717d6561..ca8ddb32a59 100644
--- a/content/media/test/test_audio1.html
+++ b/content/media/test/test_audio1.html
@@ -16,7 +16,7 @@ var testsWaiting = 0;
 for (var i = 0; i < gAudioTests.length; ++i) {
   var test = gAudioTests[i];
   var a1 = new Audio();
-  if (a1.canPlayType(test.type) == "no")
+  if (!a1.canPlayType(test.type))
     continue;
 
   a1.setAttribute("autobuffer", "");
diff --git a/content/media/test/test_audio2.html b/content/media/test/test_audio2.html
index 4a1904feb80..450f90f5ca2 100644
--- a/content/media/test/test_audio2.html
+++ b/content/media/test/test_audio2.html
@@ -16,7 +16,7 @@ var testsWaiting = 0;
 var tmpAudio = new Audio();
 for (var i = 0; i < gAudioTests.length; ++i) {
   var test = gAudioTests[i];
-  if (tmpAudio.canPlayType(test.type) == "no")
+  if (!tmpAudio.canPlayType(test.type))
     continue;
 
   var a1 = new Audio(test.name);
diff --git a/content/media/test/test_can_play_type.html b/content/media/test/test_can_play_type.html
index 249acb7fbff..6001c528d35 100644
--- a/content/media/test/test_can_play_type.html
+++ b/content/media/test/test_can_play_type.html
@@ -28,9 +28,9 @@ function check(type, expected) {
 }
 
 // Invalid types
-check("foo/bar", "no");
-check("", "no");
-check("!!!", "no");
+check("foo/bar", "");
+check("", "");
+check("!!!", "");
 
 </script>
 </pre>
diff --git a/content/media/test/test_load.html b/content/media/test/test_load.html
index 0a7b058d9c2..afcefa19867 100644
--- a/content/media/test/test_load.html
+++ b/content/media/test/test_load.html
@@ -174,7 +174,7 @@ function nextTest() {
   gTestNum++;
   
   createMedia(type.match(/^audio\//) ? "audio" : "video");
-  if (gMedia.canPlayType(type) == "no") {
+  if (!gMedia.canPlayType(type)) {
     // Unsupported type, skip to next test
     nextTest();
     return;
diff --git a/content/media/test/test_media_selection.html b/content/media/test/test_media_selection.html
index 9c3faff4a17..193283acc3d 100644
--- a/content/media/test/test_media_selection.html
+++ b/content/media/test/test_media_selection.html
@@ -99,7 +99,7 @@ for (var i = 0; i < gSmallTests.length; ++i) {
   var src = test.name;
   var type = test.type;
 
-  if (tmpVid.canPlayType(type) == "no")
+  if (!tmpVid.canPlayType(type))
     continue;
 
   // The following nested function hack is to ensure that 'test' is correctly
diff --git a/content/media/test/test_playback.html b/content/media/test/test_playback.html
index 27c85d2a6a6..f31800b420d 100644
--- a/content/media/test/test_playback.html
+++ b/content/media/test/test_playback.html
@@ -34,7 +34,7 @@ function startTests() {
     var v = document.createElement('video');
     var test = gPlayTests[testIndex];
     ++testIndex;
-    if (v.canPlayType(test.type) == "no")
+    if (!v.canPlayType(test.type))
       continue;
 
     v.src = test.name;
diff --git a/content/media/test/test_playback_errors.html b/content/media/test/test_playback_errors.html
index f5bcfde1b1f..0de035479b1 100644
--- a/content/media/test/test_playback_errors.html
+++ b/content/media/test/test_playback_errors.html
@@ -34,7 +34,7 @@ function startTests() {
     var v = document.createElement('video');
     var test = gErrorTests[testIndex];
     ++testIndex;
-    if (v.canPlayType(test.type) == "no")
+    if (!v.canPlayType(test.type))
       continue;
 
     v.src = test.name;
diff --git a/content/media/test/test_seek.html b/content/media/test/test_seek.html
index 36a040b3ffd..e55f36e402b 100644
--- a/content/media/test/test_seek.html
+++ b/content/media/test/test_seek.html
@@ -33,7 +33,7 @@ function doNextFile() {
   var test = gSeekTests[testNum];
   ++testNum;
 
-  if (tmpVid.canPlayType(test.type) == "no") {
+  if (!tmpVid.canPlayType(test.type)) {
     doNextFile();
     return;
   }
diff --git a/content/svg/content/src/nsSVGAElement.cpp b/content/svg/content/src/nsSVGAElement.cpp
index a3403d039a2..408846d8c0c 100644
--- a/content/svg/content/src/nsSVGAElement.cpp
+++ b/content/svg/content/src/nsSVGAElement.cpp
@@ -120,33 +120,27 @@ nsSVGAElement::GetTarget(nsIDOMSVGAnimatedString * *aTarget)
 
 
 //----------------------------------------------------------------------
-// nsILink methods
+// nsIContent methods
 
-NS_IMETHODIMP
-nsSVGAElement::GetLinkState(nsLinkState &aState)
+nsLinkState
+nsSVGAElement::GetLinkState() const
 {
-  aState = mLinkState;
-  return NS_OK;
+  return mLinkState;
 }
 
-NS_IMETHODIMP
+void
 nsSVGAElement::SetLinkState(nsLinkState aState)
 {
   mLinkState = aState;
-  return NS_OK;
 }
 
-NS_IMETHODIMP
-nsSVGAElement::GetHrefURI(nsIURI** aURI)
+already_AddRefed<nsIURI>
+nsSVGAElement::GetHrefURI() const
 {
-  *aURI = nsnull;
-  return NS_OK; // XXX GetHrefURIForAnchors(aURI);
+  return nsnull; // XXX GetHrefURIForAnchors();
 }
 
 
-//----------------------------------------------------------------------
-// nsIContent methods
-
 PRBool
 nsSVGAElement::IsFocusable(PRInt32 *aTabIndex)
 {
diff --git a/content/svg/content/src/nsSVGAElement.h b/content/svg/content/src/nsSVGAElement.h
index 5dc24cd5b17..5a9b607d3e8 100644
--- a/content/svg/content/src/nsSVGAElement.h
+++ b/content/svg/content/src/nsSVGAElement.h
@@ -71,9 +71,6 @@ public:
   virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
 
   // nsILink
-  NS_IMETHOD GetLinkState(nsLinkState &aState);
-  NS_IMETHOD SetLinkState(nsLinkState aState);
-  NS_IMETHOD GetHrefURI(nsIURI** aURI);
   NS_IMETHOD LinkAdded() { return NS_OK; }
   NS_IMETHOD LinkRemoved() { return NS_OK; }
 
@@ -81,6 +78,9 @@ public:
   virtual PRBool IsFocusable(PRInt32 *aTabIndex = nsnull);
   virtual PRBool IsLink(nsIURI** aURI) const;
   virtual void GetLinkTarget(nsAString& aTarget);
+  virtual nsLinkState GetLinkState() const;
+  virtual void SetLinkState(nsLinkState aState);
+  virtual already_AddRefed<nsIURI> GetHrefURI() const;
 
 protected:
 
diff --git a/js/src/xpconnect/src/qsgen.py b/js/src/xpconnect/src/qsgen.py
index 48110f1e806..081bcd776f1 100644
--- a/js/src/xpconnect/src/qsgen.py
+++ b/js/src/xpconnect/src/qsgen.py
@@ -1139,7 +1139,7 @@ def writeAttrStubs(f, customMethodCalls, attr):
                   + header.attributeNativeName(attr, True))
     writeQuickStub(f, customMethodCalls, attr, getterName)
     if attr.readonly:
-        setterName = 'xpc_qsReadOnlySetter'
+        setterName = 'js_GetterOnlyPropertyStub'
     else:
         setterName = (attr.iface.name + '_'
                       + header.attributeNativeName(attr, False))
diff --git a/js/src/xpconnect/src/xpcconvert.cpp b/js/src/xpconnect/src/xpcconvert.cpp
index b0400b22018..b6a966ef20b 100644
--- a/js/src/xpconnect/src/xpcconvert.cpp
+++ b/js/src/xpconnect/src/xpcconvert.cpp
@@ -330,12 +330,11 @@ XPCConvert::NativeData2JS(XPCCallContext& ccx, jsval* d, const void* s,
                     break;
 
                 if(!p->IsVoid()) {
-                    JSString *str =
-                        XPCStringConvert::ReadableToJSString(cx, *p);
+                    jsval str = XPCStringConvert::ReadableToJSVal(cx, *p);
                     if(!str)
                         return JS_FALSE;
 
-                    *d = STRING_TO_JSVAL(str);
+                    *d = str;
                 }
 
                 // *d is defaulted to JSVAL_NULL so no need to set it
diff --git a/js/src/xpconnect/src/xpcprivate.h b/js/src/xpconnect/src/xpcprivate.h
index 7c00577ad8d..d5ffb46b984 100644
--- a/js/src/xpconnect/src/xpcprivate.h
+++ b/js/src/xpconnect/src/xpcprivate.h
@@ -2935,8 +2935,7 @@ class XPCStringConvert
 {
 public:
 
-    static JSString *ReadableToJSString(JSContext *cx,
-                                        const nsAString &readable);
+    static jsval ReadableToJSVal(JSContext *cx, const nsAString &readable);
 
     static XPCReadableJSStringWrapper *JSStringToReadable(XPCCallContext& ccx,
                                                           JSString *str);
diff --git a/js/src/xpconnect/src/xpcquickstubs.cpp b/js/src/xpconnect/src/xpcquickstubs.cpp
index f1c8ee4d240..a9f50be8ad5 100644
--- a/js/src/xpconnect/src/xpcquickstubs.cpp
+++ b/js/src/xpconnect/src/xpcquickstubs.cpp
@@ -1081,10 +1081,10 @@ xpc_qsStringToJsval(JSContext *cx, const nsAString &str, jsval *rval)
         return JS_TRUE;
     }
 
-    JSString *jsstr = XPCStringConvert::ReadableToJSString(cx, str);
+    jsval jsstr = XPCStringConvert::ReadableToJSVal(cx, str);
     if(!jsstr)
         return JS_FALSE;
-    *rval = STRING_TO_JSVAL(jsstr);
+    *rval = jsstr;
     return JS_TRUE;
 }
 
@@ -1152,14 +1152,6 @@ xpc_qsVariantToJsval(XPCCallContext &ccx,
     return JS_TRUE;
 }
 
-JSBool
-xpc_qsReadOnlySetter(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
-{
-    JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
-                         JSMSG_GETTER_ONLY, NULL);
-    return JS_FALSE;
-}
-
 #ifdef DEBUG
 void
 xpc_qsAssertContextOK(JSContext *cx)
diff --git a/js/src/xpconnect/src/xpcquickstubs.h b/js/src/xpconnect/src/xpcquickstubs.h
index 0e31d8d1a98..5f7d5c12eb4 100644
--- a/js/src/xpconnect/src/xpcquickstubs.h
+++ b/js/src/xpconnect/src/xpcquickstubs.h
@@ -442,16 +442,6 @@ xpc_qsVariantToJsval(XPCCallContext &ccx,
                      uintN paramNum,
                      jsval *rval);
 
-/**
- * Use this as the setter for readonly attributes. (The IDL readonly
- * keyword does not map to JSPROP_READONLY. Semantic mismatch.)
- *
- * Always fails, with the same error as setting a property that has
- * JSPROP_GETTER but not JSPROP_SETTER.
- */
-JSBool
-xpc_qsReadOnlySetter(JSContext *cx, JSObject *obj, jsval id, jsval *vp);
-
 #ifdef DEBUG
 void
 xpc_qsAssertContextOK(JSContext *cx);
diff --git a/js/src/xpconnect/src/xpcstring.cpp b/js/src/xpconnect/src/xpcstring.cpp
index 17fb93f4d7b..f5a86846bab 100644
--- a/js/src/xpconnect/src/xpcstring.cpp
+++ b/js/src/xpconnect/src/xpcstring.cpp
@@ -75,14 +75,21 @@ XPCStringConvert::ShutdownDOMStringFinalizer()
 
 // convert a readable to a JSString, copying string data
 // static
-JSString *
-XPCStringConvert::ReadableToJSString(JSContext *cx,
-                                     const nsAString &readable)
+jsval
+XPCStringConvert::ReadableToJSVal(JSContext *cx,
+                                  const nsAString &readable)
 {
     JSString *str;
 
     PRUint32 length = readable.Length();
 
+    JSAtom *atom;
+    if (length == 0 && (atom = cx->runtime->atomState.emptyAtom))
+    {
+        NS_ASSERTION(ATOM_IS_STRING(atom), "What kind of atom is this?");
+        return ATOM_KEY(atom);
+    }
+
     nsStringBuffer *buf = nsStringBuffer::FromString(readable);
     if (buf)
     {
@@ -93,7 +100,7 @@ XPCStringConvert::ReadableToJSString(JSContext *cx,
             sDOMStringFinalizerIndex =
                     JS_AddExternalStringFinalizer(DOMStringFinalizer);
             if (sDOMStringFinalizerIndex == -1)
-                return NULL;
+                return JSVAL_NULL;
         }
 
         str = JS_NewExternalString(cx, 
@@ -111,14 +118,14 @@ XPCStringConvert::ReadableToJSString(JSContext *cx,
                                         (JS_malloc(cx, (length + 1) *
                                                       sizeof(jschar)));
         if (!chars)
-            return NULL;
+            return JSVAL_NULL;
 
         if (length && !CopyUnicodeTo(readable, 0,
                                      reinterpret_cast<PRUnichar *>(chars),
                                      length))
         {
             JS_free(cx, chars);
-            return NULL;
+            return JSVAL_NULL;
         }
 
         chars[length] = 0;
@@ -127,7 +134,7 @@ XPCStringConvert::ReadableToJSString(JSContext *cx,
         if (!str)
             JS_free(cx, chars);
     }
-    return str;
+    return STRING_TO_JSVAL(str);
 }
 
 // static
diff --git a/js/src/xpconnect/src/xpcwrappedjs.cpp b/js/src/xpconnect/src/xpcwrappedjs.cpp
index 4a5b22e19a6..0a715d2e593 100644
--- a/js/src/xpconnect/src/xpcwrappedjs.cpp
+++ b/js/src/xpconnect/src/xpcwrappedjs.cpp
@@ -620,12 +620,12 @@ nsXPCWrappedJS::GetProperty(const nsAString & name, nsIVariant **_retval)
     if(!ccx.IsValid())
         return NS_ERROR_UNEXPECTED;
 
-    JSString* jsstr = XPCStringConvert::ReadableToJSString(ccx, name);
+    jsval jsstr = XPCStringConvert::ReadableToJSVal(ccx, name);
     if(!jsstr)
         return NS_ERROR_OUT_OF_MEMORY;
 
     return nsXPCWrappedJSClass::
-        GetNamedPropertyAsVariant(ccx, mJSObj, STRING_TO_JSVAL(jsstr), _retval);
+        GetNamedPropertyAsVariant(ccx, mJSObj, jsstr, _retval);
 }
 
 /***************************************************************************/
diff --git a/layout/generic/nsImageFrame.cpp b/layout/generic/nsImageFrame.cpp
index 0980710e983..246e6da3f6d 100644
--- a/layout/generic/nsImageFrame.cpp
+++ b/layout/generic/nsImageFrame.cpp
@@ -1380,7 +1380,7 @@ nsImageFrame::GetAnchorHREFTargetAndNode(nsIURI** aHref, nsString& aTarget,
        content; content = content->GetParent()) {
     nsCOMPtr<nsILink> link(do_QueryInterface(content));
     if (link) {
-      link->GetHrefURI(aHref);
+      *aHref = content->GetHrefURI().get();
       status = (*aHref != nsnull);
 
       nsCOMPtr<nsIDOMHTMLAnchorElement> anchor(do_QueryInterface(content));
diff --git a/layout/style/nsCSSRuleProcessor.cpp b/layout/style/nsCSSRuleProcessor.cpp
index 80c1a470740..30323316a7f 100644
--- a/layout/style/nsCSSRuleProcessor.cpp
+++ b/layout/style/nsCSSRuleProcessor.cpp
@@ -909,8 +909,7 @@ RuleProcessorData::RuleProcessorData(nsPresContext* aPresContext,
       mPresContext ? mPresContext->GetLinkHandler() : nsnull;
     if (mIsHTMLContent && mHasAttributes) {
       // check if it is an HTML Link
-      if(nsStyleUtil::IsHTMLLink(aContent, mContentTag, linkHandler,
-                                 &mLinkState)) {
+      if(nsStyleUtil::IsHTMLLink(aContent, linkHandler, &mLinkState)) {
         mIsLink = PR_TRUE;
       }
     } 
diff --git a/layout/style/nsIStyleRuleProcessor.h b/layout/style/nsIStyleRuleProcessor.h
index e5b7b82fd91..4588b949948 100644
--- a/layout/style/nsIStyleRuleProcessor.h
+++ b/layout/style/nsIStyleRuleProcessor.h
@@ -49,13 +49,12 @@
 
 #include "nsISupports.h"
 #include "nsPresContext.h" // for nsCompatability
-#include "nsILinkHandler.h"
 #include "nsString.h"
 #include "nsChangeHint.h"
+#include "nsIContent.h"
 
 class nsIStyleSheet;
 class nsPresContext;
-class nsIContent;
 class nsIAtom;
 class nsICSSPseudoComparator;
 class nsRuleWalker;
diff --git a/layout/style/nsStyleUtil.cpp b/layout/style/nsStyleUtil.cpp
index caeb357b9fb..4a967c50074 100644
--- a/layout/style/nsStyleUtil.cpp
+++ b/layout/style/nsStyleUtil.cpp
@@ -42,7 +42,6 @@
 
 #include "nsGkAtoms.h"
 #include "nsILinkHandler.h"
-#include "nsILink.h"
 #include "nsIContent.h"
 #include "nsIDocument.h"
 #include "nsINameSpaceManager.h"
@@ -429,55 +428,40 @@ GetLinkStateFromURI(nsIURI* aURI, nsIContent* aContent,
 }
 
 /*static*/
-PRBool nsStyleUtil::IsHTMLLink(nsIContent *aContent, nsIAtom *aTag,
+PRBool nsStyleUtil::IsHTMLLink(nsIContent *aContent,
                                nsILinkHandler *aLinkHandler,
                                nsLinkState *aState)
 {
-  NS_ASSERTION(aContent && aState, "null arg in IsHTMLLink");
+  NS_ASSERTION(aContent->IsNodeOfType(nsINode::eHTML),
+               "Only use this function with HTML elements");
+  NS_ASSERTION(aState, "null arg in IsHTMLLink");
 
-  // check for:
-  //  - HTML ANCHOR with valid HREF
-  //  - HTML LINK with valid HREF
-  //  - HTML AREA with valid HREF
+  nsLinkState linkState = aContent->GetLinkState();
+  if (linkState == eLinkState_Unknown) {
+    // if it is an anchor, area or link then check the href attribute
+    // make sure this anchor has a link even if we are not testing state
+    // if there is no link, then this anchor is not really a linkpseudo.
+    // bug=23209
 
-  PRBool result = PR_FALSE;
+    nsCOMPtr<nsIURI> hrefURI = aContent->GetHrefURI();
 
-  if ((aTag == nsGkAtoms::a) ||
-      (aTag == nsGkAtoms::link) ||
-      (aTag == nsGkAtoms::area)) {
-
-    nsCOMPtr<nsILink> link( do_QueryInterface(aContent) );
-    // In XML documents, this can be null.
-    if (link) {
-      nsLinkState linkState;
-      link->GetLinkState(linkState);
-      if (linkState == eLinkState_Unknown) {
-        // if it is an anchor, area or link then check the href attribute
-        // make sure this anchor has a link even if we are not testing state
-        // if there is no link, then this anchor is not really a linkpseudo.
-        // bug=23209
-
-        nsCOMPtr<nsIURI> hrefURI;
-        link->GetHrefURI(getter_AddRefs(hrefURI));
-
-        if (hrefURI) {
-          linkState = GetLinkStateFromURI(hrefURI, aContent, aLinkHandler);
-        } else {
-          linkState = eLinkState_NotLink;
-        }
-        if (linkState != eLinkState_NotLink && aContent->IsInDoc()) {
-          aContent->GetCurrentDoc()->AddStyleRelevantLink(aContent, hrefURI);
-        }
-        link->SetLinkState(linkState);
-      }
-      if (linkState != eLinkState_NotLink) {
-        *aState = linkState;
-        result = PR_TRUE;
-      }
+    if (hrefURI) {
+      linkState = GetLinkStateFromURI(hrefURI, aContent, aLinkHandler);
+    } else {
+      linkState = eLinkState_NotLink;
     }
+    if (linkState != eLinkState_NotLink && aContent->IsInDoc()) {
+      aContent->GetCurrentDoc()->AddStyleRelevantLink(aContent, hrefURI);
+    }
+    aContent->SetLinkState(linkState);
+  }
+  if (linkState == eLinkState_NotLink) {
+    return PR_FALSE;
   }
 
-  return result;
+  *aState = linkState;
+
+  return PR_TRUE;
 }
 
 /*static*/
diff --git a/layout/style/nsStyleUtil.h b/layout/style/nsStyleUtil.h
index 5f7d76179c1..62f474148fb 100644
--- a/layout/style/nsStyleUtil.h
+++ b/layout/style/nsStyleUtil.h
@@ -69,8 +69,7 @@ public:
 
   static PRInt32 ConstrainFontWeight(PRInt32 aWeight);
 
-  static PRBool IsHTMLLink(nsIContent *aContent, nsIAtom *aTag,
-                           nsILinkHandler *aLinkHandler,
+  static PRBool IsHTMLLink(nsIContent *aContent, nsILinkHandler *aLinkHandler,
                            nsLinkState *aState);
   static PRBool IsLink(nsIContent *aContent, nsILinkHandler *aLinkHandler,
                        nsLinkState *aState);
diff --git a/webshell/public/nsILinkHandler.h b/webshell/public/nsILinkHandler.h
index 913da51b18d..b860cd34b4c 100644
--- a/webshell/public/nsILinkHandler.h
+++ b/webshell/public/nsILinkHandler.h
@@ -38,11 +38,11 @@
 #define nsILinkHandler_h___
 
 #include "nsISupports.h"
+#include "nsIContent.h"
 
 class nsIInputStream;
 class nsIDocShell;
 class nsIRequest;
-class nsIContent;
 class nsString;
 class nsGUIEvent;
 
@@ -50,13 +50,6 @@ class nsGUIEvent;
 #define NS_ILINKHANDLER_IID \
  { 0x514bc565, 0x8d38, 0x4dde,{0xb4, 0xeb, 0xe7, 0xb5, 0x01, 0x2b, 0xf4, 0x64}}
 
-enum nsLinkState {
-  eLinkState_Unknown    = 0,
-  eLinkState_Unvisited  = 1,
-  eLinkState_Visited    = 2, 
-  eLinkState_NotLink    = 3
-};
-
 /**
  * Interface used for handling clicks on links
  */
diff --git a/widget/src/cocoa/nsChildView.mm b/widget/src/cocoa/nsChildView.mm
index 725e15c53dc..148b0559c44 100644
--- a/widget/src/cocoa/nsChildView.mm
+++ b/widget/src/cocoa/nsChildView.mm
@@ -810,12 +810,22 @@ void* nsChildView::GetNativeData(PRUint32 aDataType)
       if ([mView isKindOfClass:[ChildView class]])
         [(ChildView*)mView setIsPluginView:YES];
 
-      mPluginPort.cgPort.context = (CGContextRef)[[NSGraphicsContext currentContext] graphicsPort];
-
       NSWindow* window = [mView nativeWindow];
       if (window) {
+        // [NSGraphicsContext currentContext] is supposed to "return the
+        // current graphics context of the current thread."  But sometimes
+        // (when called while mView isn't focused for drawing) it returns a
+        // graphics context for the wrong window.  [window graphicsContext]
+        // (which "provides the graphics context associated with the window
+        // for the current thread") seems always to return the "right"
+        // graphics context.  See bug 500130.
+        mPluginPort.cgPort.context = (CGContextRef)
+          [[window graphicsContext] graphicsPort];
         WindowRef topLevelWindow = (WindowRef)[window windowRef];
         mPluginPort.cgPort.window = topLevelWindow;
+      } else {
+        mPluginPort.cgPort.context = nil;
+        mPluginPort.cgPort.window = nil;
       }
 
       retVal = (void*)&mPluginPort;