diff --git a/mozilla/layout/base/nsDisplayList.cpp b/mozilla/layout/base/nsDisplayList.cpp
index bf8441f813a..f1ab0431ff7 100644
--- a/mozilla/layout/base/nsDisplayList.cpp
+++ b/mozilla/layout/base/nsDisplayList.cpp
@@ -459,12 +459,12 @@ nsDisplayBorder::Paint(nsDisplayListBuilder* aBuilder,
 }
 
 nsDisplayWrapList::nsDisplayWrapList(nsIFrame* aFrame, nsDisplayList* aList)
-  : mFrame(aFrame) {
+  : nsDisplayItem(aFrame) {
   mList.AppendToTop(aList);
 }
 
 nsDisplayWrapList::nsDisplayWrapList(nsIFrame* aFrame, nsDisplayItem* aItem)
-  : mFrame(aFrame) {
+  : nsDisplayItem(aFrame) {
   mList.AppendToTop(aItem);
 }
 
diff --git a/mozilla/layout/base/nsDisplayList.h b/mozilla/layout/base/nsDisplayList.h
index 1b9c9e03c8a..612549ce517 100644
--- a/mozilla/layout/base/nsDisplayList.h
+++ b/mozilla/layout/base/nsDisplayList.h
@@ -242,7 +242,7 @@ class nsDisplayItemLink {
   // This is never instantiated directly, so no need to count constructors and
   // destructors.
 protected:
-  nsDisplayItemLink() {}
+  nsDisplayItemLink() : mAbove(nsnull) {}
   nsDisplayItem* mAbove;  
   
   friend class nsDisplayList;
@@ -267,6 +267,7 @@ class nsDisplayItem : public nsDisplayItemLink {
 public:
   // This is never instantiated directly (it has pure virtual methods), so no
   // need to count constructors and destructors.
+  nsDisplayItem(nsIFrame* aFrame) : mFrame(aFrame) {}
   virtual ~nsDisplayItem() {}
   
   void* operator new(size_t aSize,
@@ -306,7 +307,7 @@ public:
    * that wrap item lists, this could return nsnull because there is no single
    * underlying frame; for leaf items it will never return nsnull.
    */
-  virtual nsIFrame* GetUnderlyingFrame() = 0;
+  inline nsIFrame* GetUnderlyingFrame() { return mFrame; }
   /**
    * The default bounds is the frame border rect.
    * @return a rectangle relative to aBuilder->ReferenceFrame() that
@@ -389,6 +390,8 @@ protected:
   
   static PRBool ComputeVisibilityFromBounds(nsIFrame* aFrame,
       const nsRect& aRect, nsRegion& aCovered, PRBool aIsOpaque);
+
+  nsIFrame* mFrame;
 };
 
 /**
@@ -715,7 +718,7 @@ public:
                                  const nsRect& aDirtyRect, nsPoint aFramePt);
 
   nsDisplayGeneric(nsIFrame* aFrame, PaintCallback aPaint, const char* aName)
-    : mFrame(aFrame), mPaint(aPaint)
+    : nsDisplayItem(aFrame), mPaint(aPaint)
 #ifdef DEBUG
       , mName(aName)
 #endif
@@ -728,14 +731,12 @@ public:
   }
 #endif
   
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsIRenderingContext* aCtx,
      const nsRect& aDirtyRect) {
     mPaint(mFrame, aCtx, aDirtyRect, aBuilder->ToReferenceFrame(mFrame));
   }
   NS_DISPLAY_DECL_NAME(mName)
 protected:
-  nsIFrame*     mFrame;
   PaintCallback mPaint;
 #ifdef DEBUG
   const char*   mName;
@@ -748,7 +749,7 @@ protected:
 MOZ_DECL_CTOR_COUNTER(nsDisplayBorder)
 class nsDisplayBorder : public nsDisplayItem {
 public:
-  nsDisplayBorder(nsIFrame* aFrame) : mFrame(aFrame) {
+  nsDisplayBorder(nsIFrame* aFrame) : nsDisplayItem(aFrame) {
     MOZ_COUNT_CTOR(nsDisplayBorder);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
@@ -757,12 +758,9 @@ public:
   }
 #endif
 
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsIRenderingContext* aCtx,
      const nsRect& aDirtyRect);
   NS_DISPLAY_DECL_NAME("Border")
-private:
-  nsIFrame* mFrame;
 };
 
 /**
@@ -771,7 +769,7 @@ private:
 MOZ_DECL_CTOR_COUNTER(nsDisplayBackground)
 class nsDisplayBackground : public nsDisplayItem {
 public:
-  nsDisplayBackground(nsIFrame* aFrame) : mFrame(aFrame) {
+  nsDisplayBackground(nsIFrame* aFrame) : nsDisplayItem(aFrame) {
     MOZ_COUNT_CTOR(nsDisplayBackground);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
@@ -781,7 +779,6 @@ public:
 #endif
 
   virtual nsIFrame* HitTest(nsDisplayListBuilder* aBuilder, nsPoint aPt) { return mFrame; }
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   virtual PRBool IsOpaque(nsDisplayListBuilder* aBuilder);
   virtual PRBool IsVaryingRelativeToFrame(nsDisplayListBuilder* aBuilder,
                                           nsIFrame* aAncestorFrame);
@@ -789,8 +786,6 @@ public:
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsIRenderingContext* aCtx,
      const nsRect& aDirtyRect);
   NS_DISPLAY_DECL_NAME("Background")
-private:
-  nsIFrame* mFrame;
 };
 
 /**
@@ -799,7 +794,7 @@ private:
 MOZ_DECL_CTOR_COUNTER(nsDisplayOutline)
 class nsDisplayOutline : public nsDisplayItem {
 public:
-  nsDisplayOutline(nsIFrame* aFrame) : mFrame(aFrame) {
+  nsDisplayOutline(nsIFrame* aFrame) : nsDisplayItem(aFrame) {
     MOZ_COUNT_CTOR(nsDisplayOutline);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
@@ -809,13 +804,10 @@ public:
 #endif
 
   virtual Type GetType() { return TYPE_OUTLINE; }
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder);
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsIRenderingContext* aCtx,
      const nsRect& aDirtyRect);
   NS_DISPLAY_DECL_NAME("Outline")
-private:
-  nsIFrame* mFrame;
 };
 
 /**
@@ -824,7 +816,7 @@ private:
 MOZ_DECL_CTOR_COUNTER(nsDisplayEventReceiver)
 class nsDisplayEventReceiver : public nsDisplayItem {
 public:
-  nsDisplayEventReceiver(nsIFrame* aFrame) : mFrame(aFrame) {
+  nsDisplayEventReceiver(nsIFrame* aFrame) : nsDisplayItem(aFrame) {
     MOZ_COUNT_CTOR(nsDisplayEventReceiver);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
@@ -834,10 +826,7 @@ public:
 #endif
 
   virtual nsIFrame* HitTest(nsDisplayListBuilder* aBuilder, nsPoint aPt) { return mFrame; }
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   NS_DISPLAY_DECL_NAME("EventReceiver")
-private:
-  nsIFrame* mFrame;
 };
 
 /**
@@ -867,7 +856,6 @@ public:
   virtual ~nsDisplayWrapList();
   virtual Type GetType() { return TYPE_WRAPLIST; }
   virtual nsIFrame* HitTest(nsDisplayListBuilder* aBuilder, nsPoint aPt);
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder);
   virtual PRBool IsOpaque(nsDisplayListBuilder* aBuilder);
   virtual PRBool IsUniform(nsDisplayListBuilder* aBuilder);
@@ -901,7 +889,6 @@ protected:
   nsDisplayWrapList() {}
   
   nsDisplayList mList;
-  nsIFrame*     mFrame;
 };
 
 /**
diff --git a/mozilla/layout/base/nsLayoutUtils.cpp b/mozilla/layout/base/nsLayoutUtils.cpp
index 6a2b099b112..750716f7252 100644
--- a/mozilla/layout/base/nsLayoutUtils.cpp
+++ b/mozilla/layout/base/nsLayoutUtils.cpp
@@ -643,7 +643,7 @@ MOZ_DECL_CTOR_COUNTER(nsDisplaySolidColor)
 class nsDisplaySolidColor : public nsDisplayItem {
 public:
   nsDisplaySolidColor(nsIFrame* aFrame, nscolor aColor)
-    : mFrame(aFrame), mColor(aColor) {
+    : nsDisplayItem(aFrame), mColor(aColor) {
     MOZ_COUNT_CTOR(nsDisplaySolidColor);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
@@ -652,12 +652,10 @@ public:
   }
 #endif
 
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsIRenderingContext* aCtx,
      const nsRect& aDirtyRect);
   NS_DISPLAY_DECL_NAME("SolidColor")
 private:
-  nsIFrame* mFrame;
   nscolor   mColor;
 };
 
diff --git a/mozilla/layout/forms/nsButtonFrameRenderer.cpp b/mozilla/layout/forms/nsButtonFrameRenderer.cpp
index a6f64e4fb64..0f350c9108b 100644
--- a/mozilla/layout/forms/nsButtonFrameRenderer.cpp
+++ b/mozilla/layout/forms/nsButtonFrameRenderer.cpp
@@ -97,7 +97,7 @@ MOZ_DECL_CTOR_COUNTER(nsDisplayButtonBorderBackground)
 class nsDisplayButtonBorderBackground : public nsDisplayItem {
 public:
   nsDisplayButtonBorderBackground(nsButtonFrameRenderer* aRenderer)
-    : mBFR(aRenderer) {
+    : nsDisplayItem(aRenderer->GetFrame()), mBFR(aRenderer) {
     MOZ_COUNT_CTOR(nsDisplayButtonBorderBackground);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
@@ -106,9 +106,8 @@ public:
   }
 #endif  
   
-  virtual nsIFrame* GetUnderlyingFrame() { return mBFR->GetFrame(); }
   virtual nsIFrame* HitTest(nsDisplayListBuilder* aBuilder, nsPoint aPt) {
-    return mBFR->GetFrame();
+    return mFrame;
   }
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsIRenderingContext* aCtx,
      const nsRect& aDirtyRect);
@@ -121,7 +120,7 @@ MOZ_DECL_CTOR_COUNTER(nsDisplayButtonForeground)
 class nsDisplayButtonForeground : public nsDisplayItem {
 public:
   nsDisplayButtonForeground(nsButtonFrameRenderer* aRenderer)
-    : mBFR(aRenderer) {
+    : nsDisplayItem(aRenderer->GetFrame()), mBFR(aRenderer) {
     MOZ_COUNT_CTOR(nsDisplayButtonForeground);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
@@ -130,7 +129,6 @@ public:
   }
 #endif  
 
-  virtual nsIFrame* GetUnderlyingFrame() { return mBFR->GetFrame(); }
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsIRenderingContext* aCtx,
      const nsRect& aDirtyRect);
   NS_DISPLAY_DECL_NAME("ButtonForeground")
@@ -142,10 +140,9 @@ void nsDisplayButtonBorderBackground::Paint(nsDisplayListBuilder* aBuilder,
                                             nsIRenderingContext* aCtx,
                                             const nsRect& aDirtyRect)
 {
-  nsIFrame* f = mBFR->GetFrame();
-  NS_ASSERTION(f, "No frame?");
-  nsPresContext* pc = f->GetPresContext();
-  nsRect r = nsRect(aBuilder->ToReferenceFrame(f), f->GetSize());
+  NS_ASSERTION(mFrame, "No frame?");
+  nsPresContext* pc = mFrame->GetPresContext();
+  nsRect r = nsRect(aBuilder->ToReferenceFrame(mFrame), mFrame->GetSize());
   
   // draw the border and background inside the focus and outline borders
   mBFR->PaintBorderAndBackground(pc, *aCtx, aDirtyRect, r);
@@ -155,10 +152,9 @@ void nsDisplayButtonForeground::Paint(nsDisplayListBuilder* aBuilder,
                                       nsIRenderingContext* aCtx,
                                       const nsRect& aDirtyRect)
 {
-  nsIFrame* f = mBFR->GetFrame();
-  NS_ASSERTION(f, "No frame?");
-  nsPresContext* pc = f->GetPresContext();
-  nsRect r = nsRect(aBuilder->ToReferenceFrame(f), f->GetSize());
+  NS_ASSERTION(mFrame, "No frame?");
+  nsPresContext* pc = mFrame->GetPresContext();
+  nsRect r = nsRect(aBuilder->ToReferenceFrame(mFrame), mFrame->GetSize());
   
   // draw the focus and outline borders
   mBFR->PaintOutlineAndFocusBorders(pc, *aCtx, aDirtyRect, r);
diff --git a/mozilla/layout/forms/nsComboboxControlFrame.cpp b/mozilla/layout/forms/nsComboboxControlFrame.cpp
index aaf69e70248..db7ddb52165 100644
--- a/mozilla/layout/forms/nsComboboxControlFrame.cpp
+++ b/mozilla/layout/forms/nsComboboxControlFrame.cpp
@@ -69,7 +69,6 @@
 #include "nsXPCOM.h"
 #include "nsISupportsPrimitives.h"
 #include "nsIComponentManager.h"
-#include "nsContentUtils.h"
 #include "nsITextContent.h"
 #include "nsTextFragment.h"
 #include "nsCSSFrameConstructor.h"
@@ -406,6 +405,20 @@ NS_IMETHODIMP nsComboboxControlFrame::GetAccessible(nsIAccessible** aAccessible)
 }
 #endif
 
+
+
+NS_IMETHODIMP
+nsComboboxControlFrame::Init(nsPresContext*  aPresContext,
+              nsIContent*      aContent,
+              nsIFrame*        aParent,
+              nsStyleContext*  aContext,
+              nsIFrame*        aPrevInFlow)
+{
+  mEventQueueService = do_GetService(kEventQueueServiceCID);
+  
+  return nsAreaFrame::Init(aPresContext, aContent, aParent, aContext, aPrevInFlow);
+}
+
 void 
 nsComboboxControlFrame::SetFocus(PRBool aOn, PRBool aRepaint)
 {
@@ -1588,13 +1601,12 @@ nsComboboxControlFrame::RedisplayText(PRInt32 aIndex)
 
   // Send reflow command because the new text maybe larger
   nsresult rv = NS_OK;
-  if (mDisplayContent) {
+  if (mDisplayContent && mEventQueueService) {
     // Don't call ActuallyDisplayText(PR_TRUE) directly here since that
     // could cause recursive frame construction. See bug 283117 and the comment in
     // HandleRedisplayTextEvent() below.
     nsCOMPtr<nsIEventQueue> eventQueue;
-    rv = nsContentUtils::EventQueueService()->
-            GetSpecialEventQueue(nsIEventQueueService::UI_THREAD_EVENT_QUEUE,
+    rv = mEventQueueService->GetSpecialEventQueue(nsIEventQueueService::UI_THREAD_EVENT_QUEUE,
                                                   getter_AddRefs(eventQueue));
     if (eventQueue) {
       RedisplayTextEvent* event = new RedisplayTextEvent(this);
@@ -1942,12 +1954,13 @@ NS_IMETHODIMP
 nsComboboxControlFrame::Destroy(nsPresContext* aPresContext)
 {
   // Revoke queued RedisplayTextEvents
-  nsCOMPtr<nsIEventQueue> eventQueue;
-  nsContentUtils::EventQueueService()->
-    GetSpecialEventQueue(nsIEventQueueService::UI_THREAD_EVENT_QUEUE,
-                                            getter_AddRefs(eventQueue));
-  if (eventQueue) {
-    eventQueue->RevokeEvents(this);
+  if (mEventQueueService) {
+    nsCOMPtr<nsIEventQueue> eventQueue;
+    mEventQueueService->GetSpecialEventQueue(nsIEventQueueService::UI_THREAD_EVENT_QUEUE,
+                                             getter_AddRefs(eventQueue));
+    if (eventQueue) {
+      eventQueue->RevokeEvents(this);
+    }
   }
 
   nsFormControlFrame::RegUnRegAccessKey(GetPresContext(), NS_STATIC_CAST(nsIFrame*, this), PR_FALSE);
@@ -2059,7 +2072,7 @@ MOZ_DECL_CTOR_COUNTER(nsDisplayComboboxFocus)
 class nsDisplayComboboxFocus : public nsDisplayItem {
 public:
   nsDisplayComboboxFocus(nsComboboxControlFrame* aFrame)
-    : mFrame(aFrame) {
+    : nsDisplayItem(aFrame) {
     MOZ_COUNT_CTOR(nsDisplayComboboxFocus);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
@@ -2068,18 +2081,16 @@ public:
   }
 #endif
 
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsIRenderingContext* aCtx,
      const nsRect& aDirtyRect);
   NS_DISPLAY_DECL_NAME("ComboboxFocus")
-private:
-  nsComboboxControlFrame* mFrame;
 };
 
 void nsDisplayComboboxFocus::Paint(nsDisplayListBuilder* aBuilder,
      nsIRenderingContext* aCtx, const nsRect& aDirtyRect)
 {
-  mFrame->PaintFocus(*aCtx, aBuilder->ToReferenceFrame(mFrame));
+  NS_STATIC_CAST(nsComboboxControlFrame*, mFrame)->
+    PaintFocus(*aCtx, aBuilder->ToReferenceFrame(mFrame));
 }
 
 NS_IMETHODIMP
diff --git a/mozilla/layout/forms/nsFieldSetFrame.cpp b/mozilla/layout/forms/nsFieldSetFrame.cpp
index bb3b333f4e4..83e0cff8fcd 100644
--- a/mozilla/layout/forms/nsFieldSetFrame.cpp
+++ b/mozilla/layout/forms/nsFieldSetFrame.cpp
@@ -167,7 +167,7 @@ MOZ_DECL_CTOR_COUNTER(nsDisplayFieldSetBorderBackground)
 class nsDisplayFieldSetBorderBackground : public nsDisplayItem {
 public:
   nsDisplayFieldSetBorderBackground(nsFieldSetFrame* aFrame)
-    : mFrame(aFrame) {
+    : nsDisplayItem(aFrame) {
     MOZ_COUNT_CTOR(nsDisplayFieldSetBorderBackground);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
@@ -176,13 +176,10 @@ public:
   }
 #endif
 
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   virtual nsIFrame* HitTest(nsDisplayListBuilder* aBuilder, nsPoint aPt);
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsIRenderingContext* aCtx,
      const nsRect& aDirtyRect);
   NS_DISPLAY_DECL_NAME("FieldSetBorderBackground")
-private:
-  nsFieldSetFrame* mFrame;
 };
 
 nsIFrame* nsDisplayFieldSetBorderBackground::HitTest(nsDisplayListBuilder* aBuilder,
@@ -198,8 +195,8 @@ void
 nsDisplayFieldSetBorderBackground::Paint(nsDisplayListBuilder* aBuilder,
      nsIRenderingContext* aCtx, const nsRect& aDirtyRect)
 {
-  mFrame->PaintBorderBackground(*aCtx, aBuilder->ToReferenceFrame(mFrame),
-                                aDirtyRect);
+  NS_STATIC_CAST(nsFieldSetFrame*, mFrame)->
+    PaintBorderBackground(*aCtx, aBuilder->ToReferenceFrame(mFrame), aDirtyRect);
 }
 
 NS_IMETHODIMP
diff --git a/mozilla/layout/forms/nsGfxCheckboxControlFrame.cpp b/mozilla/layout/forms/nsGfxCheckboxControlFrame.cpp
index 8b2b3b04845..1e85f0b4e6f 100644
--- a/mozilla/layout/forms/nsGfxCheckboxControlFrame.cpp
+++ b/mozilla/layout/forms/nsGfxCheckboxControlFrame.cpp
@@ -171,7 +171,7 @@ MOZ_DECL_CTOR_COUNTER(nsDisplayCheckMark)
 class nsDisplayCheckMark : public nsDisplayItem {
 public:
   nsDisplayCheckMark(nsGfxCheckboxControlFrame* aFrame)
-    : mFrame(aFrame) {
+    : nsDisplayItem(aFrame) {
     MOZ_COUNT_CTOR(nsDisplayCheckMark);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
@@ -180,19 +180,16 @@ public:
   }
 #endif
 
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsIRenderingContext* aCtx,
      const nsRect& aDirtyRect);
   NS_DISPLAY_DECL_NAME("CheckMark")
-private:
-  nsGfxCheckboxControlFrame* mFrame;
 };
 
 void
 nsDisplayCheckMark::Paint(nsDisplayListBuilder* aBuilder,
      nsIRenderingContext* aCtx, const nsRect& aDirtyRect) {
-  mFrame->PaintCheckBox(*aCtx, aBuilder->ToReferenceFrame(mFrame),
-                        aDirtyRect);
+  NS_STATIC_CAST(nsGfxCheckboxControlFrame*, mFrame)->
+    PaintCheckBox(*aCtx, aBuilder->ToReferenceFrame(mFrame), aDirtyRect);
 }
 
 
diff --git a/mozilla/layout/forms/nsGfxRadioControlFrame.cpp b/mozilla/layout/forms/nsGfxRadioControlFrame.cpp
index 53b5cba9464..362dcd19c6a 100644
--- a/mozilla/layout/forms/nsGfxRadioControlFrame.cpp
+++ b/mozilla/layout/forms/nsGfxRadioControlFrame.cpp
@@ -178,7 +178,7 @@ MOZ_DECL_CTOR_COUNTER(nsDisplayRadioButtonFromStyle)
 class nsDisplayRadioButtonFromStyle : public nsDisplayItem {
 public:
   nsDisplayRadioButtonFromStyle(nsGfxRadioControlFrame* aFrame)
-    : mFrame(aFrame) {
+    : nsDisplayItem(aFrame) {
     MOZ_COUNT_CTOR(nsDisplayRadioButtonFromStyle);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
@@ -187,19 +187,16 @@ public:
   }
 #endif
   
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsIRenderingContext* aCtx,
      const nsRect& aDirtyRect);
   NS_DISPLAY_DECL_NAME("RadioButton")
-private:
-  nsGfxRadioControlFrame* mFrame;
 };
 
 void
 nsDisplayRadioButtonFromStyle::Paint(nsDisplayListBuilder* aBuilder,
      nsIRenderingContext* aCtx, const nsRect& aDirtyRect) {
-  mFrame->PaintRadioButtonFromStyle(*aCtx, aBuilder->ToReferenceFrame(mFrame),
-                                    aDirtyRect);
+  NS_STATIC_CAST(nsGfxRadioControlFrame*, mFrame)->
+    PaintRadioButtonFromStyle(*aCtx, aBuilder->ToReferenceFrame(mFrame), aDirtyRect);
 }
 
 //--------------------------------------------------------------
diff --git a/mozilla/layout/generic/nsBulletFrame.cpp b/mozilla/layout/generic/nsBulletFrame.cpp
index 2379f5c1cd2..d9e199d0d23 100644
--- a/mozilla/layout/generic/nsBulletFrame.cpp
+++ b/mozilla/layout/generic/nsBulletFrame.cpp
@@ -177,7 +177,7 @@ nsBulletFrame::DidSetStyleContext()
 MOZ_DECL_CTOR_COUNTER(nsDisplayBullet)
 class nsDisplayBullet : public nsDisplayItem {
 public:
-  nsDisplayBullet(nsBulletFrame* aFrame) : mFrame(aFrame) {
+  nsDisplayBullet(nsBulletFrame* aFrame) : nsDisplayItem(aFrame) {
     MOZ_COUNT_CTOR(nsDisplayBullet);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
@@ -186,18 +186,16 @@ public:
   }
 #endif
 
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsIRenderingContext* aCtx,
      const nsRect& aDirtyRect);
   NS_DISPLAY_DECL_NAME("Bullet")
-private:
-  nsBulletFrame* mFrame;
 };
 
 void nsDisplayBullet::Paint(nsDisplayListBuilder* aBuilder,
      nsIRenderingContext* aCtx, const nsRect& aDirtyRect)
 {
-  mFrame->PaintBullet(*aCtx, aBuilder->ToReferenceFrame(mFrame));
+  NS_STATIC_CAST(nsBulletFrame*, mFrame)->
+    PaintBullet(*aCtx, aBuilder->ToReferenceFrame(mFrame));
 }
 
 NS_IMETHODIMP
diff --git a/mozilla/layout/generic/nsFrame.cpp b/mozilla/layout/generic/nsFrame.cpp
index b2d104a39b1..534e9a4d564 100644
--- a/mozilla/layout/generic/nsFrame.cpp
+++ b/mozilla/layout/generic/nsFrame.cpp
@@ -766,7 +766,7 @@ MOZ_DECL_CTOR_COUNTER(nsDisplaySelectionOverlay)
 class nsDisplaySelectionOverlay : public nsDisplayItem {
 public:
   nsDisplaySelectionOverlay(nsFrame* aFrame, PRInt16 aSelectionValue)
-    : mFrame(aFrame), mSelectionValue(aSelectionValue) {
+    : nsDisplayItem(aFrame), mSelectionValue(aSelectionValue) {
     MOZ_COUNT_CTOR(nsDisplaySelectionOverlay);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
@@ -775,12 +775,10 @@ public:
   }
 #endif
 
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsIRenderingContext* aCtx,
      const nsRect& aDirtyRect);
   NS_DISPLAY_DECL_NAME("SelectionOverlay")
 private:
-  nsFrame* mFrame;
   PRInt16 mSelectionValue;
 };
 
diff --git a/mozilla/layout/generic/nsFrameSetFrame.cpp b/mozilla/layout/generic/nsFrameSetFrame.cpp
index 830ebc4bc37..0a96b6626c1 100644
--- a/mozilla/layout/generic/nsFrameSetFrame.cpp
+++ b/mozilla/layout/generic/nsFrameSetFrame.cpp
@@ -1621,7 +1621,8 @@ nsHTMLFramesetBorderFrame::Reflow(nsPresContext*          aPresContext,
 MOZ_DECL_CTOR_COUNTER(nsDisplayFramesetBorder)
 class nsDisplayFramesetBorder : public nsDisplayItem {
 public:
-  nsDisplayFramesetBorder(nsHTMLFramesetBorderFrame* aFrame) : mFrame(aFrame) {
+  nsDisplayFramesetBorder(nsHTMLFramesetBorderFrame* aFrame)
+    : nsDisplayItem(aFrame) {
     MOZ_COUNT_CTOR(nsDisplayFramesetBorder);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
@@ -1630,21 +1631,19 @@ public:
   }
 #endif
 
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   // REVIEW: see old GetFrameForPoint
   // Receives events in its bounds
   virtual nsIFrame* HitTest(nsDisplayListBuilder* aBuilder, nsPoint aPt) { return mFrame; }
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsIRenderingContext* aCtx,
      const nsRect& aDirtyRect);
   NS_DISPLAY_DECL_NAME("FramesetBorder")
-private:
-  nsHTMLFramesetBorderFrame* mFrame;
 };
 
 void nsDisplayFramesetBorder::Paint(nsDisplayListBuilder* aBuilder,
      nsIRenderingContext* aCtx, const nsRect& aDirtyRect)
 {
-  mFrame->PaintBorder(*aCtx, aBuilder->ToReferenceFrame(mFrame));
+  NS_STATIC_CAST(nsHTMLFramesetBorderFrame*, mFrame)->
+    PaintBorder(*aCtx, aBuilder->ToReferenceFrame(mFrame));
 }
 
 NS_IMETHODIMP
@@ -1824,7 +1823,7 @@ nsHTMLFramesetBlankFrame::Reflow(nsPresContext*          aPresContext,
 MOZ_DECL_CTOR_COUNTER(nsDisplayFramesetBlank)
 class nsDisplayFramesetBlank : public nsDisplayItem {
 public:
-  nsDisplayFramesetBlank(nsIFrame* aFrame) : mFrame(aFrame) {
+  nsDisplayFramesetBlank(nsIFrame* aFrame) : nsDisplayItem(aFrame) {
     MOZ_COUNT_CTOR(nsDisplayFramesetBlank);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
@@ -1833,14 +1832,10 @@ public:
   }
 #endif
 
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsIRenderingContext* aCtx,
      const nsRect& aDirtyRect);
   NS_DISPLAY_DECL_NAME("FramesetBlank")
-private:
-  nsIFrame* mFrame;
 };
-
 void nsDisplayFramesetBlank::Paint(nsDisplayListBuilder* aBuilder,
      nsIRenderingContext* aCtx, const nsRect& aDirtyRect)
 {
diff --git a/mozilla/layout/generic/nsHTMLContainerFrame.cpp b/mozilla/layout/generic/nsHTMLContainerFrame.cpp
index ca0ddcccbeb..6ff0df1091a 100644
--- a/mozilla/layout/generic/nsHTMLContainerFrame.cpp
+++ b/mozilla/layout/generic/nsHTMLContainerFrame.cpp
@@ -71,7 +71,8 @@ class nsDisplayTextDecoration : public nsDisplayItem {
 public:
   nsDisplayTextDecoration(nsHTMLContainerFrame* aFrame, PRUint8 aDecoration,
                           nscolor aColor, nsLineBox* aLine)
-    : mFrame(aFrame), mLine(aLine), mColor(aColor), mDecoration(aDecoration) {
+    : nsDisplayItem(aFrame), mLine(aLine), mColor(aColor),
+      mDecoration(aDecoration) {
     MOZ_COUNT_CTOR(nsDisplayTextDecoration);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
@@ -80,12 +81,10 @@ public:
   }
 #endif
 
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsIRenderingContext* aCtx,
      const nsRect& aDirtyRect);
   NS_DISPLAY_DECL_NAME("TextDecoration")
 private:
-  nsHTMLContainerFrame* mFrame;
   nsLineBox*            mLine;
   nscolor               mColor;
   PRUint8               mDecoration;
@@ -103,7 +102,7 @@ nsDisplayTextDecoration::Paint(nsDisplayListBuilder* aBuilder,
   nsCOMPtr<nsIDeviceContext> deviceContext;
   aCtx->GetDeviceContext(*getter_AddRefs(deviceContext));
   nsCOMPtr<nsIFontMetrics> normalFont;
-  const nsStyleVisibility* visibility = mFrame->GetStyleVisibility();      
+  const nsStyleVisibility* visibility = mFrame->GetStyleVisibility();
   nsCOMPtr<nsIFontMetrics> fm;
   deviceContext->GetMetricsFor(font->mFont, visibility->mLangGroup,
       *getter_AddRefs(fm));
@@ -112,17 +111,18 @@ nsDisplayTextDecoration::Paint(nsDisplayListBuilder* aBuilder,
 
   // REVIEW: From nsHTMLContainerFrame::PaintTextDecorations
   nscoord ascent, offset, size;
+  nsHTMLContainerFrame* f = NS_STATIC_CAST(nsHTMLContainerFrame*, mFrame);
   fm->GetMaxAscent(ascent);
   if (mDecoration != NS_STYLE_TEXT_DECORATION_LINE_THROUGH) {
     fm->GetUnderline(offset, size);
     if (mDecoration == NS_STYLE_TEXT_DECORATION_UNDERLINE) {
-      mFrame->PaintTextDecorationLine(*aCtx, pt, mLine, mColor, offset, ascent, size);
+      f->PaintTextDecorationLine(*aCtx, pt, mLine, mColor, offset, ascent, size);
     } else if (mDecoration == NS_STYLE_TEXT_DECORATION_OVERLINE) {
-      mFrame->PaintTextDecorationLine(*aCtx, pt, mLine, mColor, ascent, ascent, size);
+      f->PaintTextDecorationLine(*aCtx, pt, mLine, mColor, ascent, ascent, size);
     }
   } else {
     fm->GetStrikeout(offset, size);
-    mFrame->PaintTextDecorationLine(*aCtx, pt, mLine, mColor, offset, ascent, size);
+    f->PaintTextDecorationLine(*aCtx, pt, mLine, mColor, offset, ascent, size);
   }
 }
 
diff --git a/mozilla/layout/generic/nsImageFrame.cpp b/mozilla/layout/generic/nsImageFrame.cpp
index 79539c34b0f..5d6546442d1 100644
--- a/mozilla/layout/generic/nsImageFrame.cpp
+++ b/mozilla/layout/generic/nsImageFrame.cpp
@@ -1263,26 +1263,24 @@ MOZ_DECL_CTOR_COUNTER(nsDisplayImage)
 class nsDisplayImage : public nsDisplayItem {
 public:
   nsDisplayImage(nsImageFrame* aFrame, imgIContainer* aImage)
-    : mFrame(aFrame), mImage(aImage) {
+    : nsDisplayItem(aFrame), mImage(aImage) {
     MOZ_COUNT_CTOR(nsDisplayImage);
   }
   virtual ~nsDisplayImage() {
     MOZ_COUNT_DTOR(nsDisplayImage);
   }
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsIRenderingContext* aCtx,
      const nsRect& aDirtyRect);
   NS_DISPLAY_DECL_NAME("Image")
 private:
-  nsImageFrame*           mFrame;
   nsCOMPtr<imgIContainer> mImage;
 };
 
 void
 nsDisplayImage::Paint(nsDisplayListBuilder* aBuilder,
      nsIRenderingContext* aCtx, const nsRect& aDirtyRect) {
-  mFrame->PaintImage(*aCtx, aBuilder->ToReferenceFrame(mFrame), aDirtyRect,
-                     mImage);
+  NS_STATIC_CAST(nsImageFrame*, mFrame)->
+    PaintImage(*aCtx, aBuilder->ToReferenceFrame(mFrame), aDirtyRect, mImage);
 }
 
 void
diff --git a/mozilla/layout/generic/nsTextFrame.cpp b/mozilla/layout/generic/nsTextFrame.cpp
index ff0706eff87..1cc92460611 100644
--- a/mozilla/layout/generic/nsTextFrame.cpp
+++ b/mozilla/layout/generic/nsTextFrame.cpp
@@ -1957,7 +1957,7 @@ nsTextFrame::CharacterDataChanged(nsPresContext* aPresContext,
 MOZ_DECL_CTOR_COUNTER(nsDisplayText)
 class nsDisplayText : public nsDisplayItem {
 public:
-  nsDisplayText(nsTextFrame* aFrame) : mFrame(aFrame) {
+  nsDisplayText(nsTextFrame* aFrame) : nsDisplayItem(aFrame) {
     MOZ_COUNT_CTOR(nsDisplayText);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
@@ -1966,19 +1966,17 @@ public:
   }
 #endif
 
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   virtual nsIFrame* HitTest(nsDisplayListBuilder* aBuilder, nsPoint aPt) { return mFrame; }
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsIRenderingContext* aCtx,
      const nsRect& aDirtyRect);
   NS_DISPLAY_DECL_NAME("Text")
-private:
-  nsTextFrame* mFrame;
 };
 
 void
 nsDisplayText::Paint(nsDisplayListBuilder* aBuilder,
      nsIRenderingContext* aCtx, const nsRect& aDirtyRect) {
-  mFrame->PaintText(*aCtx, aBuilder->ToReferenceFrame(mFrame));
+  NS_STATIC_CAST(nsTextFrame*, mFrame)->
+    PaintText(*aCtx, aBuilder->ToReferenceFrame(mFrame));
 }
 
 NS_IMETHODIMP
diff --git a/mozilla/layout/mathml/base/src/nsMathMLChar.cpp b/mozilla/layout/mathml/base/src/nsMathMLChar.cpp
index 5c42b703525..9bcdf01bba9 100644
--- a/mozilla/layout/mathml/base/src/nsMathMLChar.cpp
+++ b/mozilla/layout/mathml/base/src/nsMathMLChar.cpp
@@ -1927,7 +1927,7 @@ MOZ_DECL_CTOR_COUNTER(nsDisplayMathMLSelectionRect)
 class nsDisplayMathMLSelectionRect : public nsDisplayItem {
 public:
   nsDisplayMathMLSelectionRect(nsIFrame* aFrame, const nsRect& aRect)
-    : mFrame(aFrame), mRect(aRect) {
+    : nsDisplayItem(aFrame), mRect(aRect) {
     MOZ_COUNT_CTOR(nsDisplayMathMLSelectionRect);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
@@ -1936,12 +1936,10 @@ public:
   }
 #endif
 
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsIRenderingContext* aCtx,
      const nsRect& aDirtyRect);
   NS_DISPLAY_DECL_NAME("MathMLSelectionRect")
 private:
-  nsIFrame* mFrame;
   nsRect    mRect;
 };
 
@@ -1961,7 +1959,7 @@ class nsDisplayMathMLCharBackground : public nsDisplayItem {
 public:
   nsDisplayMathMLCharBackground(nsIFrame* aFrame, const nsRect& aRect,
       nsStyleContext* aStyleContext)
-    : mFrame(aFrame), mStyleContext(aStyleContext), mRect(aRect) {
+    : nsDisplayItem(aFrame), mStyleContext(aStyleContext), mRect(aRect) {
     MOZ_COUNT_CTOR(nsDisplayMathMLCharBackground);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
@@ -1970,12 +1968,10 @@ public:
   }
 #endif
 
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsIRenderingContext* aCtx,
      const nsRect& aDirtyRect);
   NS_DISPLAY_DECL_NAME("MathMLCharBackground")
 private:
-  nsIFrame*       mFrame;
   nsStyleContext* mStyleContext;
   nsRect          mRect;
 };
@@ -1998,7 +1994,7 @@ class nsDisplayMathMLCharForeground : public nsDisplayItem {
 public:
   nsDisplayMathMLCharForeground(nsIFrame* aFrame, nsMathMLChar* aChar,
 				PRBool aIsSelected)
-    : mFrame(aFrame), mChar(aChar), mIsSelected(aIsSelected) {
+    : nsDisplayItem(aFrame), mChar(aChar), mIsSelected(aIsSelected) {
     MOZ_COUNT_CTOR(nsDisplayMathMLCharForeground);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
@@ -2007,12 +2003,10 @@ public:
   }
 #endif
 
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsIRenderingContext* aCtx,
      const nsRect& aDirtyRect);
   NS_DISPLAY_DECL_NAME("MathMLCharForeground")
 private:
-  nsIFrame*     mFrame;
   nsMathMLChar* mChar;
   PRPackedBool  mIsSelected;
 };
@@ -2029,7 +2023,7 @@ MOZ_DECL_CTOR_COUNTER(nsDisplayMathMLCharDebug)
 class nsDisplayMathMLCharDebug : public nsDisplayItem {
 public:
   nsDisplayMathMLCharDebug(nsIFrame* aFrame, const nsRect& aRect)
-    : mFrame(aFrame), mRect(aRect) {
+    : nsDisplayItem(aFrame), mRect(aRect) {
     MOZ_COUNT_CTOR(nsDisplayMathMLCharDebug);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
@@ -2038,12 +2032,10 @@ public:
   }
 #endif
 
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsIRenderingContext* aCtx,
      const nsRect& aDirtyRect);
   NS_DISPLAY_DECL_NAME("MathMLCharDebug")
 private:
-  nsIFrame* mFrame;
   nsRect    mRect;
 };
 
diff --git a/mozilla/layout/mathml/base/src/nsMathMLContainerFrame.cpp b/mozilla/layout/mathml/base/src/nsMathMLContainerFrame.cpp
index 987e20463c5..43aeee1c207 100644
--- a/mozilla/layout/mathml/base/src/nsMathMLContainerFrame.cpp
+++ b/mozilla/layout/mathml/base/src/nsMathMLContainerFrame.cpp
@@ -130,7 +130,7 @@ MOZ_DECL_CTOR_COUNTER(nsDisplayMathMLError)
 class nsDisplayMathMLError : public nsDisplayItem {
 public:
   nsDisplayMathMLError(nsIFrame* aFrame)
-    : mFrame(aFrame) {
+    : nsDisplayItem(aFrame) {
     MOZ_COUNT_CTOR(nsDisplayMathMLError);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
@@ -139,12 +139,9 @@ public:
   }
 #endif
 
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsIRenderingContext* aCtx,
      const nsRect& aDirtyRect);
   NS_DISPLAY_DECL_NAME("MathMLError")
-private:
-  nsIFrame* mFrame;
 };
 
 void nsDisplayMathMLError::Paint(nsDisplayListBuilder* aBuilder,
diff --git a/mozilla/layout/mathml/base/src/nsMathMLFrame.cpp b/mozilla/layout/mathml/base/src/nsMathMLFrame.cpp
index e92fb609f0d..a15f142e4e5 100644
--- a/mozilla/layout/mathml/base/src/nsMathMLFrame.cpp
+++ b/mozilla/layout/mathml/base/src/nsMathMLFrame.cpp
@@ -732,7 +732,7 @@ MOZ_DECL_CTOR_COUNTER(nsDisplayMathMLBoundingMetrics)
 class nsDisplayMathMLBoundingMetrics : public nsDisplayItem {
 public:
   nsDisplayMathMLBoundingMetrics(nsIFrame* aFrame, const nsRect& aRect)
-    : mFrame(aFrame), mRect(aRect) {
+    : nsDisplayItem(aFrame), mRect(aRect) {
     MOZ_COUNT_CTOR(nsDisplayMathMLBoundingMetrics);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
@@ -741,12 +741,10 @@ public:
   }
 #endif
 
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsIRenderingContext* aCtx,
      const nsRect& aDirtyRect);
   NS_DISPLAY_DECL_NAME("MathMLBoundingMetrics")
 private:
-  nsIFrame* mFrame;
   nsRect    mRect;
 };
 
@@ -779,7 +777,7 @@ MOZ_DECL_CTOR_COUNTER(nsDisplayMathMLBar)
 class nsDisplayMathMLBar : public nsDisplayItem {
 public:
   nsDisplayMathMLBar(nsIFrame* aFrame, const nsRect& aRect)
-    : mFrame(aFrame), mRect(aRect) {
+    : nsDisplayItem(aFrame), mRect(aRect) {
     MOZ_COUNT_CTOR(nsDisplayMathMLBar);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
@@ -788,12 +786,10 @@ public:
   }
 #endif
 
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsIRenderingContext* aCtx,
      const nsRect& aDirtyRect);
   NS_DISPLAY_DECL_NAME("MathMLBar")
 private:
-  nsIFrame* mFrame;
   nsRect    mRect;
 };
 
diff --git a/mozilla/layout/svg/base/src/nsSVGOuterSVGFrame.cpp b/mozilla/layout/svg/base/src/nsSVGOuterSVGFrame.cpp
index 1f9f8415b75..33400706dca 100644
--- a/mozilla/layout/svg/base/src/nsSVGOuterSVGFrame.cpp
+++ b/mozilla/layout/svg/base/src/nsSVGOuterSVGFrame.cpp
@@ -602,7 +602,7 @@ nsSVGOuterSVGFrame::RemoveFrame(nsIAtom*        aListName,
 MOZ_DECL_CTOR_COUNTER(nsDisplaySVG)
 class nsDisplaySVG : public nsDisplayItem {
 public:
-  nsDisplaySVG(nsSVGOuterSVGFrame* aFrame) : mFrame(aFrame) {
+  nsDisplaySVG(nsSVGOuterSVGFrame* aFrame) : nsDisplayItem(aFrame) {
     MOZ_COUNT_CTOR(nsDisplaySVG);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
@@ -612,25 +612,24 @@ public:
 #endif
 
   virtual nsIFrame* HitTest(nsDisplayListBuilder* aBuilder, nsPoint aPt);
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsIRenderingContext* aCtx,
      const nsRect& aDirtyRect);
   NS_DISPLAY_DECL_NAME("SVGEventReceiver")
-private:
-  nsSVGOuterSVGFrame* mFrame;
 };
 
 nsIFrame*
 nsDisplaySVG::HitTest(nsDisplayListBuilder* aBuilder, nsPoint aPt)
 {
-  return mFrame->GetFrameForPoint(aPt - aBuilder->ToReferenceFrame(mFrame));
+  return NS_STATIC_CAST(nsSVGOuterSVGFrame*, mFrame)->
+    GetFrameForPoint(aPt - aBuilder->ToReferenceFrame(mFrame));
 }
 
 void
 nsDisplaySVG::Paint(nsDisplayListBuilder* aBuilder, nsIRenderingContext* aCtx,
      const nsRect& aDirtyRect)
 {
-  mFrame->Paint(*aCtx, aDirtyRect, aBuilder->ToReferenceFrame(mFrame));
+  NS_STATIC_CAST(nsSVGOuterSVGFrame*, mFrame)->
+    Paint(*aCtx, aDirtyRect, aBuilder->ToReferenceFrame(mFrame));
 }
 
 nsIFrame*
diff --git a/mozilla/layout/tables/nsTableCellFrame.cpp b/mozilla/layout/tables/nsTableCellFrame.cpp
index df9d3b97224..fbded270a05 100644
--- a/mozilla/layout/tables/nsTableCellFrame.cpp
+++ b/mozilla/layout/tables/nsTableCellFrame.cpp
@@ -357,7 +357,7 @@ nsTableCellFrame::PaintCellBackground(nsIRenderingContext& aRenderingContext,
 MOZ_DECL_CTOR_COUNTER(nsDisplayTableCellBackground)
 class nsDisplayTableCellBackground : public nsDisplayItem {
 public:
-  nsDisplayTableCellBackground(nsTableCellFrame* aFrame) : mFrame(aFrame) {
+  nsDisplayTableCellBackground(nsTableCellFrame* aFrame) : nsDisplayItem(aFrame) {
     MOZ_COUNT_CTOR(nsDisplayTableCellBackground);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
@@ -366,19 +366,17 @@ public:
   }
 #endif
 
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   virtual nsIFrame* HitTest(nsDisplayListBuilder* aBuilder, nsPoint aPt) { return mFrame; }
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsIRenderingContext* aCtx,
      const nsRect& aDirtyRect);
   NS_DISPLAY_DECL_NAME("TableCellBackground")
-private:
-  nsTableCellFrame* mFrame;
 };
 
 void nsDisplayTableCellBackground::Paint(nsDisplayListBuilder* aBuilder,
      nsIRenderingContext* aCtx, const nsRect& aDirtyRect)
 {
-  mFrame->PaintBackground(*aCtx, aDirtyRect, aBuilder->ToReferenceFrame(mFrame));
+  NS_STATIC_CAST(nsTableCellFrame*, mFrame)->
+    PaintBackground(*aCtx, aDirtyRect, aBuilder->ToReferenceFrame(mFrame));
 }
 
 static void
diff --git a/mozilla/layout/tables/nsTableFrame.cpp b/mozilla/layout/tables/nsTableFrame.cpp
index 15d43d7055b..fa88682ba85 100644
--- a/mozilla/layout/tables/nsTableFrame.cpp
+++ b/mozilla/layout/tables/nsTableFrame.cpp
@@ -1342,7 +1342,7 @@ nsTableFrame::GetAdditionalChildListName(PRInt32 aIndex) const
 MOZ_DECL_CTOR_COUNTER(nsDisplayTableBorderBackground)
 class nsDisplayTableBorderBackground : public nsDisplayItem {
 public:
-  nsDisplayTableBorderBackground(nsTableFrame* aFrame) : mFrame(aFrame) {
+  nsDisplayTableBorderBackground(nsTableFrame* aFrame) : nsDisplayItem(aFrame) {
     MOZ_COUNT_CTOR(nsDisplayTableBorderBackground);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
@@ -1351,26 +1351,25 @@ public:
   }
 #endif
 
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsIRenderingContext* aCtx,
      const nsRect& aDirtyRect);
   // With collapsed borders, parts of the collapsed border can extend outside
   // the table frame, so allow this display element to blow out to our
   // overflow rect.
   virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder) {
-    return mFrame->GetOverflowRect() + aBuilder->ToReferenceFrame(mFrame);
+    return NS_STATIC_CAST(nsTableFrame*, mFrame)->GetOverflowRect() +
+      aBuilder->ToReferenceFrame(mFrame);
   }
   NS_DISPLAY_DECL_NAME("TableBorderBackground")
-private:
-  nsTableFrame* mFrame;
 };
 
 void
 nsDisplayTableBorderBackground::Paint(nsDisplayListBuilder* aBuilder,
     nsIRenderingContext* aCtx, const nsRect& aDirtyRect)
 {
-  mFrame->PaintTableBorderBackground(*aCtx, aDirtyRect, 
-                                     aBuilder->ToReferenceFrame(mFrame));
+  NS_STATIC_CAST(nsTableFrame*, mFrame)->
+    PaintTableBorderBackground(*aCtx, aDirtyRect,
+                               aBuilder->ToReferenceFrame(mFrame));
 }
 
 /* static */ nsresult
diff --git a/mozilla/layout/tables/nsTableRowFrame.cpp b/mozilla/layout/tables/nsTableRowFrame.cpp
index ba0d09ee612..8f2fa5446ea 100644
--- a/mozilla/layout/tables/nsTableRowFrame.cpp
+++ b/mozilla/layout/tables/nsTableRowFrame.cpp
@@ -558,7 +558,7 @@ nsTableRowFrame::CalcHeight(const nsHTMLReflowState& aReflowState)
 MOZ_DECL_CTOR_COUNTER(nsDisplayTableRowBackground)
 class nsDisplayTableRowBackground : public nsDisplayItem {
 public:
-  nsDisplayTableRowBackground(nsTableRowFrame* aFrame) : mFrame(aFrame) {
+  nsDisplayTableRowBackground(nsTableRowFrame* aFrame) : nsDisplayItem(aFrame) {
     MOZ_COUNT_CTOR(nsDisplayTableRowBackground);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
@@ -571,14 +571,12 @@ public:
     // the overflow rect contains any row-spanning cells, so it contains
     // our background. Note that this means we may not be opaque even if
     // the background style is a solid color.
-    return mFrame->GetOverflowRect() + aBuilder->ToReferenceFrame(mFrame);
+    return NS_STATIC_CAST(nsTableRowFrame*, mFrame)->GetOverflowRect() +
+      aBuilder->ToReferenceFrame(mFrame);
   }
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsIRenderingContext* aCtx,
      const nsRect& aDirtyRect);
   NS_DISPLAY_DECL_NAME("TableRowBackground")
-private:
-  nsTableRowFrame* mFrame;
 };
 
 void
@@ -593,7 +591,7 @@ nsDisplayTableRowBackground::Paint(nsDisplayListBuilder* aBuilder,
                                  TableBackgroundPainter::eOrigin_TableRow,
                                  mFrame->GetPresContext(), *aCtx,
                                  aDirtyRect - pt);
-  painter.PaintRow(mFrame);
+  painter.PaintRow(NS_STATIC_CAST(nsTableRowFrame*, mFrame));
 }
 
 NS_IMETHODIMP
diff --git a/mozilla/layout/xul/base/src/nsBoxFrame.cpp b/mozilla/layout/xul/base/src/nsBoxFrame.cpp
index 7cdf60b1bf5..f1626f6d08b 100644
--- a/mozilla/layout/xul/base/src/nsBoxFrame.cpp
+++ b/mozilla/layout/xul/base/src/nsBoxFrame.cpp
@@ -1361,7 +1361,7 @@ nsBoxFrame::GetDebugPref(nsPresContext* aPresContext)
 MOZ_DECL_CTOR_COUNTER(nsDisplayXULDebug)
 class nsDisplayXULDebug : public nsDisplayItem {
 public:
-  nsDisplayXULDebug(nsComboboxControlFrame* aFrame) : mFrame(aFrame) {
+  nsDisplayXULDebug(nsIFrame* aFrame) : nsDisplayItem(aFrame) {
     MOZ_COUNT_CTOR(nsDisplayXULDebug);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
@@ -1370,23 +1370,22 @@ public:
   }
 #endif
 
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   virtual nsIFrame* HitTest(nsDisplayListBuilder* aBuilder, nsPoint aPt) {
-    mFrame->DisplayDebugInfoFor(this, aPt - aBuilder->ToReferenceFrame(mFrame));
+    NS_STATIC_CAST(nsBoxFrame*, mFrame)->
+      DisplayDebugInfoFor(this, aPt - aBuilder->ToReferenceFrame(mFrame));
     return PR_TRUE;
   }
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsIRenderingContext* aCtx,
      const nsRect& aDirtyRect);
   NS_DISPLAY_DECL_NAME("ComboboxFocus")
-private:
-  nsBoxFrame* mFrame;
 };
 
 void
 nsDisplayXULDebug::Paint(nsDisplayListBuilder* aBuilder,
      nsIRenderingContext* aCtx, const nsRect& aDirtyRect)
 {
-  mFrame->PaintXULDebugOverlay(*aCtx, aBuilder->ToReferenceFrame(mFrame));
+  NS_STATIC_CAST(nsBoxFrame*, mFrame)->
+    PaintXULDebugOverlay(*aCtx, aBuilder->ToReferenceFrame(mFrame));
 }
 
 static void
@@ -2438,7 +2437,6 @@ public:
                               nsIFrame* aTargetFrame)
     : nsDisplayWrapList(aFrame, aList), mTargetFrame(aTargetFrame) {}
   virtual nsIFrame* HitTest(nsDisplayListBuilder* aBuilder, nsPoint aPt);
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   NS_DISPLAY_DECL_NAME("XULEventRedirector")
 private:
   nsIFrame* mTargetFrame;
diff --git a/mozilla/layout/xul/base/src/nsGroupBoxFrame.cpp b/mozilla/layout/xul/base/src/nsGroupBoxFrame.cpp
index 2a7741f5821..d0c22249d5e 100644
--- a/mozilla/layout/xul/base/src/nsGroupBoxFrame.cpp
+++ b/mozilla/layout/xul/base/src/nsGroupBoxFrame.cpp
@@ -105,7 +105,7 @@ nsGroupBoxFrame::nsGroupBoxFrame(nsIPresShell* aShell):nsBoxFrame(aShell)
 MOZ_DECL_CTOR_COUNTER(nsDisplayXULGroupBackground)
 class nsDisplayXULGroupBackground : public nsDisplayItem {
 public:
-  nsDisplayXULGroupBackground(nsGroupBoxFrame* aFrame) : mFrame(aFrame) {
+  nsDisplayXULGroupBackground(nsGroupBoxFrame* aFrame) : nsDisplayItem(aFrame) {
     MOZ_COUNT_CTOR(nsDisplayXULGroupBackground);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
@@ -114,21 +114,18 @@ public:
   }
 #endif
 
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   virtual nsIFrame* HitTest(nsDisplayListBuilder* aBuilder, nsPoint aPt) { return mFrame; }
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsIRenderingContext* aCtx,
      const nsRect& aDirtyRect);
   NS_DISPLAY_DECL_NAME("XULGroupBackground")
-private:
-  nsGroupBoxFrame* mFrame;
 };
 
 void
 nsDisplayXULGroupBackground::Paint(nsDisplayListBuilder* aBuilder,
      nsIRenderingContext* aCtx, const nsRect& aDirtyRect)
 {
-  mFrame->PaintBorderBackground(*aCtx, aBuilder->ToReferenceFrame(mFrame),
-                                aDirtyRect);
+  NS_STATIC_CAST(nsGroupBoxFrame*, mFrame)->
+    PaintBorderBackground(*aCtx, aBuilder->ToReferenceFrame(mFrame), aDirtyRect);
 }
 
 NS_IMETHODIMP
diff --git a/mozilla/layout/xul/base/src/nsImageBoxFrame.cpp b/mozilla/layout/xul/base/src/nsImageBoxFrame.cpp
index b643c0a1057..1977424f6f1 100644
--- a/mozilla/layout/xul/base/src/nsImageBoxFrame.cpp
+++ b/mozilla/layout/xul/base/src/nsImageBoxFrame.cpp
@@ -390,7 +390,7 @@ nsImageBoxFrame::UpdateLoadFlags()
 MOZ_DECL_CTOR_COUNTER(nsDisplayXULImage)
 class nsDisplayXULImage : public nsDisplayItem {
 public:
-  nsDisplayXULImage(nsImageBoxFrame* aFrame) : mFrame(aFrame) {
+  nsDisplayXULImage(nsImageBoxFrame* aFrame) : nsDisplayItem(aFrame) {
     MOZ_COUNT_CTOR(nsDisplayXULImage);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
@@ -399,20 +399,18 @@ public:
   }
 #endif
 
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   // Doesn't handle HitTest because nsLeafBoxFrame already creates an
   // event receiver for us
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsIRenderingContext* aCtx,
      const nsRect& aDirtyRect);
   NS_DISPLAY_DECL_NAME("XULImage")
-private:
-  nsImageBoxFrame* mFrame;
 };
 
 void nsDisplayXULImage::Paint(nsDisplayListBuilder* aBuilder,
      nsIRenderingContext* aCtx, const nsRect& aDirtyRect)
 {
-  mFrame->PaintImage(*aCtx, aDirtyRect, aBuilder->ToReferenceFrame(mFrame));
+  NS_STATIC_CAST(nsImageBoxFrame*, mFrame)->
+    PaintImage(*aCtx, aDirtyRect, aBuilder->ToReferenceFrame(mFrame));
 }
 
 NS_IMETHODIMP
diff --git a/mozilla/layout/xul/base/src/nsTextBoxFrame.cpp b/mozilla/layout/xul/base/src/nsTextBoxFrame.cpp
index 55887f693cf..e2e8cb3d5bc 100644
--- a/mozilla/layout/xul/base/src/nsTextBoxFrame.cpp
+++ b/mozilla/layout/xul/base/src/nsTextBoxFrame.cpp
@@ -278,7 +278,7 @@ nsTextBoxFrame::UpdateAttributes(nsPresContext*  aPresContext,
 MOZ_DECL_CTOR_COUNTER(nsDisplayXULTextBox)
 class nsDisplayXULTextBox : public nsDisplayItem {
 public:
-  nsDisplayXULTextBox(nsTextBoxFrame* aFrame) : mFrame(aFrame) {
+  nsDisplayXULTextBox(nsTextBoxFrame* aFrame) : nsDisplayItem(aFrame) {
       MOZ_COUNT_CTOR(nsDisplayXULTextBox);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
@@ -287,18 +287,16 @@ public:
   }
 #endif
 
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsIRenderingContext* aCtx,
      const nsRect& aDirtyRect);
   NS_DISPLAY_DECL_NAME("XULTextBox")
-private:
-  nsTextBoxFrame* mFrame;
 };
 
 void nsDisplayXULTextBox::Paint(nsDisplayListBuilder* aBuilder,
      nsIRenderingContext* aCtx, const nsRect& aDirtyRect)
 {
-  mFrame->PaintTitle(*aCtx, aDirtyRect, aBuilder->ToReferenceFrame(mFrame));
+  NS_STATIC_CAST(nsTextBoxFrame*, mFrame)->
+    PaintTitle(*aCtx, aDirtyRect, aBuilder->ToReferenceFrame(mFrame));
 }
 
 NS_IMETHODIMP
diff --git a/mozilla/layout/xul/base/src/tree/src/nsTreeColFrame.cpp b/mozilla/layout/xul/base/src/tree/src/nsTreeColFrame.cpp
index 08eecf58446..4ebe3a2216b 100644
--- a/mozilla/layout/xul/base/src/tree/src/nsTreeColFrame.cpp
+++ b/mozilla/layout/xul/base/src/tree/src/nsTreeColFrame.cpp
@@ -116,7 +116,7 @@ nsTreeColFrame::Destroy(nsPresContext* aPresContext)
 MOZ_DECL_CTOR_COUNTER(nsDisplayXULTreeColSplitterTarget)
 class nsDisplayXULTreeColSplitterTarget : public nsDisplayItem {
 public:
-  nsDisplayXULTreeColSplitterTarget(nsIFrame* aFrame) : mFrame(aFrame) {
+  nsDisplayXULTreeColSplitterTarget(nsIFrame* aFrame) : nsDisplayItem(aFrame) {
     MOZ_COUNT_CTOR(nsDisplayXULTreeColSplitterTarget);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
@@ -126,10 +126,7 @@ public:
 #endif
 
   virtual nsIFrame* HitTest(nsDisplayListBuilder* aBuilder, nsPoint aPt);
-  virtual nsIFrame* GetUnderlyingFrame() { return mFrame; }
   NS_DISPLAY_DECL_NAME("XULTreeColSplitterTarget")
-private:
-  nsIFrame* mFrame;
 };
 
 nsIFrame*