diff --git a/mozilla/content/events/src/nsEventListenerManager.cpp b/mozilla/content/events/src/nsEventListenerManager.cpp
index 6ed9df1e23c..1837889fcb1 100644
--- a/mozilla/content/events/src/nsEventListenerManager.cpp
+++ b/mozilla/content/events/src/nsEventListenerManager.cpp
@@ -2299,7 +2299,6 @@ nsEventListenerManager::PrepareToUseCaretPosition(nsIWidget* aEventWidget,
   // <textarea> or text <input>, we need to get the outer frame
   // note: frames are not refcounted
   nsIFrame* frame = nsnull; // may be NULL
-  nsITextControlFrame* tcFrame = nsnull; // may be NULL
   nsCOMPtr<nsIDOMNode> node;
   rv = domSelection->GetFocusNode(getter_AddRefs(node));
   NS_ENSURE_SUCCESS(rv, PR_FALSE);
@@ -2307,10 +2306,7 @@ nsEventListenerManager::PrepareToUseCaretPosition(nsIWidget* aEventWidget,
   for ( ; content; content = content->GetParent()) {
     if (!content->IsNativeAnonymous()) {
       frame = aShell->GetPrimaryFrameFor(content);
-      if (frame) {
-        // not refcounted, will be NULL for some elements
-        CallQueryInterface(frame, &tcFrame);
-      }
+      NS_ASSERTION(frame, "No frame for focused content?");
       break;
     }
   }
@@ -2340,8 +2336,9 @@ nsEventListenerManager::PrepareToUseCaretPosition(nsIWidget* aEventWidget,
   // Be easy about errors, and just don't scroll in those cases. Better to have
   // the correct menu at a weird place than the wrong menu.
   nsCOMPtr<nsISelectionController> selCon;
-  if (tcFrame)
-    tcFrame->GetSelectionContr(getter_AddRefs(selCon));
+  if (frame)
+    frame->GetSelectionController(aShell->GetPresContext(),
+                                  getter_AddRefs(selCon));
   else
     selCon = do_QueryInterface(aShell);
   if (selCon) {
diff --git a/mozilla/content/events/src/nsEventStateManager.cpp b/mozilla/content/events/src/nsEventStateManager.cpp
index f58b4e8e93a..816e978e391 100644
--- a/mozilla/content/events/src/nsEventStateManager.cpp
+++ b/mozilla/content/events/src/nsEventStateManager.cpp
@@ -1408,29 +1408,13 @@ nsEventStateManager::GetSelection(nsIFrame* inFrame,
                                   nsPresContext* inPresContext,
                                   nsIFrameSelection** outSelection)
 {
-  *outSelection = nsnull;
-
-  if (inFrame) {
-    nsCOMPtr<nsISelectionController> selCon;
-    nsresult rv = inFrame->GetSelectionController(inPresContext, getter_AddRefs(selCon));
-
-    if (NS_SUCCEEDED(rv) && selCon) {
-      nsCOMPtr<nsIFrameSelection> frameSel;
-
-      frameSel = do_QueryInterface(selCon);
-
-      if (! frameSel) {
-        nsIPresShell *shell = inPresContext->GetPresShell();
-        if (shell)
-          frameSel = shell->FrameSelection();
-      }
-
-      *outSelection = frameSel.get();
-      NS_IF_ADDREF(*outSelection);
-    }
+  if (!inFrame || !outSelection) {
+    NS_ERROR("Invalid call");
+    return;
   }
-
-} // GetSelection
+  *outSelection = inFrame->GetFrameSelection();
+  NS_IF_ADDREF(*outSelection);
+}
 
 void
 nsEventStateManager::FillInEventFromGestureDown(nsMouseEvent* aEvent)
diff --git a/mozilla/embedding/components/find/src/nsWebBrowserFind.cpp b/mozilla/embedding/components/find/src/nsWebBrowserFind.cpp
index a299eb22c43..fbbe55e9e0f 100644
--- a/mozilla/embedding/components/find/src/nsWebBrowserFind.cpp
+++ b/mozilla/embedding/components/find/src/nsWebBrowserFind.cpp
@@ -426,19 +426,14 @@ void nsWebBrowserFind::SetSelectionAndScroll(nsIDOMWindow* aWindow,
       if (!frame)
         return;
       CallQueryInterface(frame, &tcFrame);
-
       break;
     }
   }
 
   nsCOMPtr<nsISelection> selection;
   nsCOMPtr<nsISelectionController> selCon;
-  if (!tcFrame) {
-    selCon = do_QueryInterface(presShell);
-  }
-  else {
-    tcFrame->GetSelectionContr(getter_AddRefs(selCon));
-  }
+  frame->GetSelectionController(presShell->GetPresContext(),
+                                getter_AddRefs(selCon));
 
   selCon->SetDisplaySelection(nsISelectionController::SELECTION_ON);
   selCon->GetSelection(nsISelectionController::SELECTION_NORMAL,
diff --git a/mozilla/layout/forms/nsITextControlFrame.h b/mozilla/layout/forms/nsITextControlFrame.h
index efc353516bb..1ae11d23275 100644
--- a/mozilla/layout/forms/nsITextControlFrame.h
+++ b/mozilla/layout/forms/nsITextControlFrame.h
@@ -87,7 +87,8 @@ public:
   NS_IMETHOD    SetSelectionRange(PRInt32 aSelectionStart, PRInt32 aSelectionEnd) = 0;
   NS_IMETHOD    GetSelectionRange(PRInt32* aSelectionStart, PRInt32* aSelectionEnd) = 0;
 
-  NS_IMETHOD    GetSelectionContr(nsISelectionController **aSelCon) = 0;
+  virtual nsISelectionController* GetOwnedSelectionController() = 0;
+  virtual nsIFrameSelection* GetOwnedFrameSelection() = 0;
 };
 
 NS_DEFINE_STATIC_IID_ACCESSOR(nsITextControlFrame,
diff --git a/mozilla/layout/forms/nsTextControlFrame.cpp b/mozilla/layout/forms/nsTextControlFrame.cpp
index ef24bce2140..2355556a9cf 100644
--- a/mozilla/layout/forms/nsTextControlFrame.cpp
+++ b/mozilla/layout/forms/nsTextControlFrame.cpp
@@ -126,11 +126,6 @@
 #include "nsINativeKeyBindings.h"
 #include "nsIJSContextStack.h"
 
-#ifdef IBMBIDI
-#include "nsIBidiKeyboard.h"
-#include "nsWidgetsCID.h"
-#endif // IBMBIDI
-
 #define DEFAULT_COLUMN_WIDTH 20
 
 #define PREF_DEFAULT_SPELLCHECK "layout.spellcheckDefault"
@@ -534,11 +529,8 @@ nsTextInputListener::GetKeyBindings()
 
 // END nsTextInputListener
 
-#ifdef XP_MAC
-#pragma mark -
-#endif
-  
-class nsTextInputSelectionImpl : public nsSupportsWeakReference, public nsISelectionController, public nsIFrameSelection
+class nsTextInputSelectionImpl : public nsSupportsWeakReference
+                               , public nsISelectionController
 {
 public:
   NS_DECL_ISUPPORTS
@@ -546,7 +538,6 @@ public:
   nsTextInputSelectionImpl(nsIFrameSelection *aSel, nsIPresShell *aShell, nsIContent *aLimiter);
   ~nsTextInputSelectionImpl(){}
 
-  
   //NSISELECTIONCONTROLLER INTERFACES
   NS_IMETHOD SetDisplaySelection(PRInt16 toggle);
   NS_IMETHOD GetDisplaySelection(PRInt16 *_retval);
@@ -573,66 +564,14 @@ public:
   NS_IMETHOD SelectAll(void);
   NS_IMETHOD CheckVisibility(nsIDOMNode *node, PRInt16 startOffset, PRInt16 EndOffset, PRBool *_retval);
 
-  // NSIFRAMESELECTION INTERFACES
-  NS_IMETHOD Init(nsIPresShell *aShell, nsIContent *aLimiter) ;
-  NS_IMETHOD ShutDown() ;
-  NS_IMETHOD HandleTextEvent(nsGUIEvent *aGuiEvent) ;
-  NS_IMETHOD HandleKeyEvent(nsPresContext* aPresContext, nsGUIEvent *aGuiEvent);
-  NS_IMETHOD HandleClick(nsIContent *aNewFocus, PRUint32 aContentOffset, PRUint32 aContentEndOffset , 
-                       PRBool aContinueSelection, PRBool aMultipleSelection, PRBool aHint); 
-  NS_IMETHOD HandleDrag(nsPresContext *aPresContext, nsIFrame *aFrame, nsPoint& aPoint);
-  NS_IMETHOD HandleTableSelection(nsIContent *aParentContent, PRInt32 aContentOffset, PRInt32 aTarget, nsMouseEvent *aMouseEvent);
-  NS_IMETHOD StartAutoScrollTimer(nsPresContext *aPresContext, nsIView* aView, nsPoint& aPoint, PRUint32 aDelay);
-  NS_IMETHOD StopAutoScrollTimer();
-  NS_IMETHOD EnableFrameNotification(PRBool aEnable);
-  NS_IMETHOD LookUpSelection(nsIContent *aContent, PRInt32 aContentOffset, PRInt32 aContentLength,
-                             SelectionDetails **aReturnDetails, PRBool aSlowCheck);
-  NS_IMETHOD SetMouseDownState(PRBool aState);
-  NS_IMETHOD GetMouseDownState(PRBool *aState);
-  NS_IMETHOD SetDelayCaretOverExistingSelection(PRBool aDelay);
-  NS_IMETHOD GetDelayCaretOverExistingSelection(PRBool *aDelay);
-  NS_IMETHOD SetDelayedCaretData(nsMouseEvent *aMouseEvent);
-  NS_IMETHOD GetDelayedCaretData(nsMouseEvent **aMouseEvent);
-  NS_IMETHOD GetLimiter(nsIContent **aLimiterContent);
-  NS_IMETHOD GetTableCellSelection(PRBool *aState);
-  NS_IMETHOD GetFrameForNodeOffset(nsIContent *aNode, PRInt32 aOffset, HINT aHint, nsIFrame **aReturnFrame, PRInt32 *aReturnOffset);
-  NS_IMETHOD GetHint(nsIFrameSelection::HINT *aHint);
-  NS_IMETHOD SetHint(nsIFrameSelection::HINT aHint);
-  NS_IMETHOD SetScrollableView(nsIScrollableView *aScrollableView);
-  NS_IMETHOD GetScrollableView(nsIScrollableView **aScrollableView);
-  NS_IMETHOD CommonPageMove(PRBool aForward, PRBool aExtend, nsIScrollableView *aScrollableView, nsIFrameSelection *aFrameSel);
-  NS_IMETHOD SetMouseDoubleDown(PRBool aDoubleDown);
-  NS_IMETHOD GetMouseDoubleDown(PRBool *aDoubleDown);
-  NS_IMETHOD MaintainSelection();
-#ifdef IBMBIDI
-  NS_IMETHOD GetPrevNextBidiLevels(nsPresContext *aPresContext,
-                                   nsIContent *aNode,
-                                   PRUint32 aContentOffset,
-                                   nsIFrame **aPrevFrame,
-                                   nsIFrame **aNextFrame,
-                                   PRUint8 *aPrevLevel,
-                                   PRUint8 *aNextLevel);
-  NS_IMETHOD GetFrameFromLevel(nsPresContext *aPresContext,
-                               nsIFrame *aFrameIn,
-                               nsDirection aDirection,
-                               PRUint8 aBidiLevel,
-                               nsIFrame **aFrameOut);
-#endif
-  //END INTERFACES
-
-
-  nsWeakPtr &GetPresShell(){return mPresShellWeak;}
 private:
   nsCOMPtr<nsIFrameSelection> mFrameSelection;
   nsCOMPtr<nsIContent>        mLimiter;
   nsWeakPtr mPresShellWeak;
-#ifdef IBMBIDI
-  nsCOMPtr<nsIBidiKeyboard> mBidiKeyboard;
-#endif
 };
 
 // Implement our nsISupports methods
-NS_IMPL_ISUPPORTS3(nsTextInputSelectionImpl, nsISelectionController, nsISupportsWeakReference, nsIFrameSelection)
+NS_IMPL_ISUPPORTS2(nsTextInputSelectionImpl, nsISelectionController, nsISupportsWeakReference)
 
 
 // BEGIN nsTextInputSelectionImpl
@@ -645,9 +584,6 @@ nsTextInputSelectionImpl::nsTextInputSelectionImpl(nsIFrameSelection *aSel, nsIP
     mLimiter = aLimiter;
     mFrameSelection->Init(aShell, mLimiter);
     mPresShellWeak = do_GetWeakReference(aShell);
-#ifdef IBMBIDI
-    mBidiKeyboard = do_GetService("@mozilla.org/widget/bidikeyboard;1");
-#endif
   }
 }
 
@@ -695,7 +631,7 @@ nsTextInputSelectionImpl::ScrollSelectionIntoView(PRInt16 aType, PRInt16 aRegion
     nsresult rv = mFrameSelection->ScrollSelectionIntoView(aType, aRegion, aIsSynchronous);
 
     nsIScrollableView* scrollableView = nsnull;
-    GetScrollableView(&scrollableView);
+    mFrameSelection->GetScrollableView(&scrollableView);
     if (!scrollableView) {
       return rv;
     }
@@ -875,11 +811,12 @@ nsTextInputSelectionImpl::PageMove(PRBool aForward, PRBool aExtend)
 
     //get the scroll view
     nsIScrollableView *scrollableView;
-    nsresult result = GetScrollableView(&scrollableView);
+    nsresult result = mFrameSelection->GetScrollableView(&scrollableView);
     if (NS_FAILED(result))
       return result;
 
-    CommonPageMove(aForward, aExtend, scrollableView, this);
+    // XXX A WTF moment; why does it need a pointer to itself?
+    mFrameSelection->CommonPageMove(aForward, aExtend, scrollableView, mFrameSelection);
   }
   return ScrollSelectionIntoView(nsISelectionController::SELECTION_NORMAL, nsISelectionController::SELECTION_FOCUS_REGION, PR_TRUE);
 }
@@ -889,7 +826,7 @@ nsTextInputSelectionImpl::CompleteScroll(PRBool aForward)
 {
   nsIScrollableView *scrollableView;
   nsresult result;
-  result = GetScrollableView(&scrollableView);
+  result = mFrameSelection->GetScrollableView(&scrollableView);
   if (NS_FAILED(result))
     return result;
   if (!scrollableView)
@@ -904,7 +841,7 @@ nsTextInputSelectionImpl::CompleteMove(PRBool aForward, PRBool aExtend)
   // grab the parent / root DIV for this text widget
   nsresult result;
   nsCOMPtr<nsIContent> parentDIV;
-  result = GetLimiter(getter_AddRefs(parentDIV));
+  result = mFrameSelection->GetLimiter(getter_AddRefs(parentDIV));
   if (NS_FAILED(result))
     return result;
   if (!parentDIV)
@@ -912,7 +849,7 @@ nsTextInputSelectionImpl::CompleteMove(PRBool aForward, PRBool aExtend)
 
   // make the caret be either at the very beginning (0) or the very end
   PRInt32 offset = 0;
-  HINT hint = HINTLEFT;
+  nsIFrameSelection::HINT hint = nsIFrameSelection::HINTLEFT;
   if (aForward)
   {
     offset = parentDIV->GetChildCount();
@@ -927,12 +864,13 @@ nsTextInputSelectionImpl::CompleteMove(PRBool aForward, PRBool aExtend)
       if (child->Tag() == nsHTMLAtoms::br)
       {
         --offset;
-        hint = HINTRIGHT; // for Bug 106855
+        hint = nsIFrameSelection::HINTRIGHT; // for Bug 106855
       }
     }
   }
 
-  result = mFrameSelection->HandleClick(parentDIV, offset, offset, aExtend, PR_FALSE, hint);
+  mFrameSelection->HandleClick(parentDIV, offset, offset, aExtend,
+                               PR_FALSE, hint);
 
   // if we got this far, attempt to scroll no matter what the above result is
   return CompleteScroll(aForward);
@@ -943,7 +881,7 @@ nsTextInputSelectionImpl::ScrollPage(PRBool aForward)
 {
   nsIScrollableView *scrollableView;
   nsresult result;
-  result = GetScrollableView(&scrollableView);
+  result = mFrameSelection->GetScrollableView(&scrollableView);
   if (NS_FAILED(result))
     return result;
   if (!scrollableView)
@@ -957,7 +895,7 @@ nsTextInputSelectionImpl::ScrollLine(PRBool aForward)
 {
   nsIScrollableView *scrollableView;
   nsresult result;
-  result = GetScrollableView(&scrollableView);
+  result = mFrameSelection->GetScrollableView(&scrollableView);
   if (NS_FAILED(result))
     return result;
   if (!scrollableView)
@@ -972,7 +910,7 @@ nsTextInputSelectionImpl::ScrollHorizontal(PRBool aLeft)
 {
   nsIScrollableView *scrollableView;
   nsresult result;
-  result = GetScrollableView(&scrollableView);
+  result = mFrameSelection->GetScrollableView(&scrollableView);
   if (NS_FAILED(result))
     return result;
   if (!scrollableView)
@@ -1004,217 +942,6 @@ nsTextInputSelectionImpl::CheckVisibility(nsIDOMNode *node, PRInt16 startOffset,
 
 }
 
-
-//nsTextInputSelectionImpl::FRAMESELECTIONAPIS
-
-NS_IMETHODIMP
-nsTextInputSelectionImpl::Init(nsIPresShell *aShell, nsIContent *aLimiter)
-{
-  return mFrameSelection->Init(aShell, aLimiter);
-}
-
-
-NS_IMETHODIMP
-nsTextInputSelectionImpl::ShutDown()
-{
-  return mFrameSelection->ShutDown();
-}
-
-
-NS_IMETHODIMP
-nsTextInputSelectionImpl::HandleTextEvent(nsGUIEvent *aGuiEvent)
-{
-  return mFrameSelection->HandleTextEvent(aGuiEvent);
-}
-
-
-NS_IMETHODIMP
-nsTextInputSelectionImpl::HandleKeyEvent(nsPresContext* aPresContext, nsGUIEvent *aGuiEvent)
-{
-  return mFrameSelection->HandleKeyEvent(aPresContext, aGuiEvent);
-}
-
-
-NS_IMETHODIMP
-nsTextInputSelectionImpl::HandleClick(nsIContent *aNewFocus, PRUint32 aContentOffset, PRUint32 aContentEndOffset , 
-                     PRBool aContinueSelection, PRBool aMultipleSelection, PRBool aHint)
-{
-  return mFrameSelection->HandleClick(aNewFocus, aContentOffset, aContentEndOffset , 
-                     aContinueSelection, aMultipleSelection, aHint);
-}
-
-
-NS_IMETHODIMP
-nsTextInputSelectionImpl::HandleDrag(nsPresContext *aPresContext, nsIFrame *aFrame, nsPoint& aPoint)
-{
-  return mFrameSelection->HandleDrag(aPresContext, aFrame, aPoint);
-}
-
-
-NS_IMETHODIMP
-nsTextInputSelectionImpl::HandleTableSelection(nsIContent *aParentContent, PRInt32 aContentOffset, PRInt32 aTarget, nsMouseEvent *aMouseEvent)
-{
-  // We should never have a table inside a text control frame!
-  NS_ASSERTION(PR_TRUE, "Calling HandleTableSelection inside nsTextControlFrame!");
-  return NS_OK;
-}
-
-
-NS_IMETHODIMP
-nsTextInputSelectionImpl::StartAutoScrollTimer(nsPresContext *aPresContext, nsIView *aView, nsPoint& aPoint, PRUint32 aDelay)
-{
-  return mFrameSelection->StartAutoScrollTimer(aPresContext, aView, aPoint, aDelay);
-}
-
-
-NS_IMETHODIMP
-nsTextInputSelectionImpl::StopAutoScrollTimer()
-{
-  return mFrameSelection->StopAutoScrollTimer();
-}
-
-
-NS_IMETHODIMP
-nsTextInputSelectionImpl::EnableFrameNotification(PRBool aEnable)
-{
-  return mFrameSelection->EnableFrameNotification(aEnable);
-}
-
-
-NS_IMETHODIMP
-nsTextInputSelectionImpl::LookUpSelection(nsIContent *aContent, PRInt32 aContentOffset, PRInt32 aContentLength,
-                           SelectionDetails **aReturnDetails, PRBool aSlowCheck)
-{
-  return mFrameSelection->LookUpSelection(aContent, aContentOffset, aContentLength, aReturnDetails, aSlowCheck);
-}
-
-
-NS_IMETHODIMP
-nsTextInputSelectionImpl::SetMouseDownState(PRBool aState)
-{
-  return mFrameSelection->SetMouseDownState(aState);
-}
-
-
-NS_IMETHODIMP
-nsTextInputSelectionImpl::GetMouseDownState(PRBool *aState)
-{
-  return mFrameSelection->GetMouseDownState(aState);
-}
-
-NS_IMETHODIMP
-nsTextInputSelectionImpl::SetDelayCaretOverExistingSelection(PRBool aDelay)
-{
-  return mFrameSelection->SetDelayCaretOverExistingSelection(aDelay);
-}
-
-NS_IMETHODIMP
-nsTextInputSelectionImpl::GetDelayCaretOverExistingSelection(PRBool *aDelay)
-{
-  return mFrameSelection->GetDelayCaretOverExistingSelection(aDelay);
-}
-
-NS_IMETHODIMP
-nsTextInputSelectionImpl::SetDelayedCaretData(nsMouseEvent *aMouseEvent)
-{
-  return mFrameSelection->SetDelayedCaretData(aMouseEvent);
-}
-
-NS_IMETHODIMP
-nsTextInputSelectionImpl::GetDelayedCaretData(nsMouseEvent **aMouseEvent)
-{
-  return mFrameSelection->GetDelayedCaretData(aMouseEvent);
-}
-
-NS_IMETHODIMP
-nsTextInputSelectionImpl::GetLimiter(nsIContent **aLimiterContent)
-{
-  return mFrameSelection->GetLimiter(aLimiterContent);
-}
-
-NS_IMETHODIMP
-nsTextInputSelectionImpl::GetTableCellSelection(PRBool *aState)
-{
-  return mFrameSelection->GetTableCellSelection(aState);
-}
-
-
-NS_IMETHODIMP
-nsTextInputSelectionImpl::GetFrameForNodeOffset(nsIContent *aNode, PRInt32 aOffset, HINT aHint, nsIFrame **aReturnFrame, PRInt32 *aReturnOffset)
-{
-  return mFrameSelection->GetFrameForNodeOffset(aNode, aOffset, aHint,aReturnFrame,aReturnOffset);
-}
-
-NS_IMETHODIMP nsTextInputSelectionImpl::GetHint(nsIFrameSelection::HINT *aHint)
-{
-  return mFrameSelection->GetHint(aHint);
-}
-
-NS_IMETHODIMP nsTextInputSelectionImpl::SetHint(nsIFrameSelection::HINT aHint)
-{
-  return mFrameSelection->SetHint(aHint);
-}
-
-NS_IMETHODIMP nsTextInputSelectionImpl::SetScrollableView(nsIScrollableView *aScrollableView)
-{
-  return mFrameSelection->SetScrollableView(aScrollableView);
-}
-
-NS_IMETHODIMP nsTextInputSelectionImpl::GetScrollableView(nsIScrollableView **aScrollableView)
-{
-  return mFrameSelection->GetScrollableView(aScrollableView);
-}
-
-NS_IMETHODIMP nsTextInputSelectionImpl::SetMouseDoubleDown(PRBool aDoubleDown)
-{
-  return mFrameSelection->SetMouseDoubleDown(aDoubleDown);
-}
-
-NS_IMETHODIMP nsTextInputSelectionImpl::GetMouseDoubleDown(PRBool *aDoubleDown)
-{
-  return mFrameSelection->GetMouseDoubleDown(aDoubleDown);
-}
-
-NS_IMETHODIMP nsTextInputSelectionImpl::MaintainSelection()
-{
-  return mFrameSelection->MaintainSelection();
-}
-
-NS_IMETHODIMP nsTextInputSelectionImpl::CommonPageMove(PRBool aForward, PRBool aExtend, nsIScrollableView *aScrollableView, nsIFrameSelection *aFrameSel)
-{
-  return mFrameSelection->CommonPageMove(aForward, aExtend, aScrollableView, this);
-}
-
-#ifdef IBMBIDI
-NS_IMETHODIMP nsTextInputSelectionImpl::GetPrevNextBidiLevels(nsPresContext *aPresContext,
-                                                              nsIContent *aNode,
-                                                              PRUint32 aContentOffset,
-                                                              nsIFrame **aPrevFrame,
-                                                              nsIFrame **aNextFrame,
-                                                              PRUint8 *aPrevLevel,
-                                                              PRUint8 *aNextLevel)
-{
-  if (mFrameSelection)
-    return mFrameSelection->GetPrevNextBidiLevels(aPresContext, aNode, aContentOffset, aPrevFrame, aNextFrame, aPrevLevel, aNextLevel);
-  return NS_ERROR_FAILURE;
-}
-
-NS_IMETHODIMP nsTextInputSelectionImpl::GetFrameFromLevel(nsPresContext *aPresContext,
-                                                          nsIFrame *aFrameIn,
-                                                          nsDirection aDirection,
-                                                          PRUint8 aBidiLevel,
-                                                          nsIFrame **aFrameOut)
-{
-  if (mFrameSelection)
-    return mFrameSelection->GetFrameFromLevel(aPresContext, aFrameIn, aDirection, aBidiLevel, aFrameOut);
-  return NS_ERROR_FAILURE;
-}
-#endif // IBMBIDI
-
-// END   nsTextInputSelectionImpl
-
-
-
 nsIFrame*
 NS_NewTextControlFrame(nsIPresShell* aPresShell)
 {
@@ -1280,8 +1007,7 @@ nsTextControlFrame::nsTextControlFrame(nsIPresShell* aShell)
 
 nsTextControlFrame::~nsTextControlFrame()
 {
-  //delete mTextListener;
-  //delete mTextSelImpl; dont delete this since mSelCon will release it.
+  NS_IF_RELEASE(mTextListener);
 }
 
 static PRBool
@@ -1385,9 +1111,10 @@ nsTextControlFrame::PreDestroy(nsPresContext* aPresContext)
     }
   }
 
-  mSelCon = 0;
-  mEditor = 0;
-  
+  mEditor = nsnull;
+  mSelCon = nsnull;
+  mFrameSel = nsnull;
+
 //unregister self from content
   mTextListener->SetFrame(nsnull);
   nsFormControlFrame::RegUnRegAccessKey(aPresContext, NS_STATIC_CAST(nsIFrame*, this), PR_FALSE);
@@ -1923,20 +1650,22 @@ nsTextControlFrame::CreateAnonymousContent(nsPresContext* aPresContext,
 
   // Create selection
 
-  nsCOMPtr<nsIFrameSelection> frameSel = do_CreateInstance(kFrameSelectionCID, &rv);
+  mFrameSel = do_CreateInstance(kFrameSelectionCID, &rv);
+  if (NS_FAILED(rv))
+    return rv;
 
   // Create a SelectionController
 
-  mTextSelImpl = new nsTextInputSelectionImpl(frameSel,shell,divContent);
-  if (!mTextSelImpl)
+  mSelCon = NS_STATIC_CAST(nsISelectionController*,
+                new nsTextInputSelectionImpl(mFrameSel, shell, divContent));
+  if (!mSelCon)
     return NS_ERROR_OUT_OF_MEMORY;
   mTextListener = new nsTextInputListener();
   if (!mTextListener)
     return NS_ERROR_OUT_OF_MEMORY;
+  NS_ADDREF(mTextListener);
+
   mTextListener->SetFrame(this);
-  mSelCon =  do_QueryInterface((nsISupports *)(nsISelectionController *)mTextSelImpl);//this will addref it once
-  if (!mSelCon)
-    return NS_ERROR_NO_INTERFACE;
   mSelCon->SetDisplaySelection(nsISelectionController::SELECTION_ON);
 
   // Setup the editor flags
@@ -2080,25 +1809,12 @@ nsTextControlFrame::CreateAnonymousContent(nsPresContext* aPresContext,
     if (mContent->HasAttr(kNameSpaceID_None, nsHTMLAtoms::disabled)) 
       editorFlags |= nsIPlaintextEditor::eEditorDisabledMask;
 
-    // Disable the caret and selection if necessary.
+    // Disable the selection if necessary.
 
-    if (editorFlags & nsIPlaintextEditor::eEditorReadonlyMask ||
-        editorFlags & nsIPlaintextEditor::eEditorDisabledMask)
-    {
-      if (mSelCon)
-      {
-         //do not turn caret enabled off at this time.  the caret will behave 
-         //dependent on the focused frame it is in.  disabling it here has
-         //an adverse affect on the browser in caret display mode or the editor
-         //when a readonly/disabled text form is in the page. bug 141888
-         //mSelCon->SetCaretEnabled(PR_FALSE);
+    if (editorFlags & nsIPlaintextEditor::eEditorDisabledMask)
+      mSelCon->SetDisplaySelection(nsISelectionController::SELECTION_OFF);
 
-        if (editorFlags & nsIPlaintextEditor::eEditorDisabledMask)
-          mSelCon->SetDisplaySelection(nsISelectionController::SELECTION_OFF);
-      }
-
-      mEditor->SetFlags(editorFlags);
-    }
+    mEditor->SetFlags(editorFlags);
   }
 
   return NS_OK;
@@ -2291,7 +2007,7 @@ nsresult nsTextControlFrame::SetFormProperty(nsIAtom* aName, const nsAString& aV
       }
       SetValue(aValue);   // set new text value
     }
-    else if (nsHTMLAtoms::select == aName && mSelCon)
+    else if (nsHTMLAtoms::select == aName)
     {
       // Select all the text.
       //
@@ -2372,7 +2088,7 @@ nsTextControlFrame::SetSelectionInternal(nsIDOMNode *aStartNode,
   // Get the selection, clear it and add the new range to it!
 
   nsCOMPtr<nsISelection> selection;
-  mTextSelImpl->GetSelection(nsISelectionController::SELECTION_NORMAL, getter_AddRefs(selection));  
+  mSelCon->GetSelection(nsISelectionController::SELECTION_NORMAL, getter_AddRefs(selection));  
   NS_ENSURE_TRUE(selection, NS_ERROR_FAILURE);
 
   rv = selection->RemoveAllRanges();  
@@ -2680,7 +2396,7 @@ nsTextControlFrame::GetSelectionRange(PRInt32* aSelectionStart, PRInt32* aSelect
   *aSelectionEnd = 0;
 
   nsCOMPtr<nsISelection> selection;
-  nsresult rv = mTextSelImpl->GetSelection(nsISelectionController::SELECTION_NORMAL, getter_AddRefs(selection));  
+  nsresult rv = mSelCon->GetSelection(nsISelectionController::SELECTION_NORMAL, getter_AddRefs(selection));  
   NS_ENSURE_SUCCESS(rv, rv);
   NS_ENSURE_TRUE(selection, NS_ERROR_FAILURE);
 
@@ -2728,16 +2444,6 @@ nsTextControlFrame::GetSelectionRange(PRInt32* aSelectionStart, PRInt32* aSelect
   return DOMPointToOffset(endNode, endOffset, aSelectionEnd);
 }
 
-
-NS_IMETHODIMP
-nsTextControlFrame::GetSelectionContr(nsISelectionController **aSelCon)
-{
-  NS_ENSURE_ARG_POINTER(aSelCon);
-  NS_IF_ADDREF(*aSelCon = mSelCon);
-  return NS_OK;
-}
-
-
 /////END INTERFACE IMPLEMENTATIONS
 
 ////NSIFRAME
@@ -2746,7 +2452,8 @@ nsTextControlFrame::AttributeChanged(PRInt32         aNameSpaceID,
                                      nsIAtom*        aAttribute,
                                      PRInt32         aModType)
 {
-  if (!mEditor || !mSelCon) {return NS_ERROR_NOT_INITIALIZED;}
+  if (!mEditor || !mSelCon) 
+    return NS_ERROR_NOT_INITIALIZED;
   nsresult rv = NS_OK;
 
   if (nsHTMLAtoms::maxlength == aAttribute) 
@@ -2768,20 +2475,20 @@ nsTextControlFrame::AttributeChanged(PRInt32         aNameSpaceID,
     }
     rv = NS_OK; // don't propagate the error
   } 
-  else if (mEditor && nsHTMLAtoms::readonly == aAttribute) 
+  else if (nsHTMLAtoms::readonly == aAttribute) 
   {
     PRUint32 flags;
     mEditor->GetFlags(&flags);
     if (AttributeExists(nsHTMLAtoms::readonly))
     { // set readonly
       flags |= nsIPlaintextEditor::eEditorReadonlyMask;
-      if (mSelCon && IsFocusedContent(GetPresContext(), mContent))
+      if (IsFocusedContent(GetPresContext(), mContent))
         mSelCon->SetCaretEnabled(PR_FALSE);
     }
     else 
     { // unset readonly
       flags &= ~(nsIPlaintextEditor::eEditorReadonlyMask);
-      if (mSelCon && !(flags & nsIPlaintextEditor::eEditorDisabledMask) &&
+      if (!(flags & nsIPlaintextEditor::eEditorDisabledMask) &&
           IsFocusedContent(GetPresContext(), mContent))
         mSelCon->SetCaretEnabled(PR_TRUE);
     }    
@@ -2790,31 +2497,19 @@ nsTextControlFrame::AttributeChanged(PRInt32         aNameSpaceID,
   }
   else if (mEditor && nsHTMLAtoms::disabled == aAttribute) 
   {
-    // XXXbryner do we need to check for a null presshell here?
-    //           we don't do anything with it.
-    nsIPresShell *shell = GetPresContext()->GetPresShell();
-    if (!shell)
-      return NS_ERROR_FAILURE;
-
     PRUint32 flags;
     mEditor->GetFlags(&flags);
     if (AttributeExists(nsHTMLAtoms::disabled))
     { // set disabled
       flags |= nsIPlaintextEditor::eEditorDisabledMask;
-      if (mSelCon)
-      {
-        mSelCon->SetDisplaySelection(nsISelectionController::SELECTION_OFF);
-        if (IsFocusedContent(GetPresContext(), mContent))
-          mSelCon->SetCaretEnabled(PR_FALSE);
-      }
+      mSelCon->SetDisplaySelection(nsISelectionController::SELECTION_OFF);
+      if (IsFocusedContent(GetPresContext(), mContent))
+        mSelCon->SetCaretEnabled(PR_FALSE);
     }
     else 
     { // unset disabled
       flags &= ~(nsIPlaintextEditor::eEditorDisabledMask);
-      if (mSelCon)
-      {
-        mSelCon->SetDisplaySelection(nsISelectionController::SELECTION_HIDDEN);
-      }
+      mSelCon->SetDisplaySelection(nsISelectionController::SELECTION_HIDDEN);
     }    
     mEditor->SetFlags(flags);
   }
@@ -2898,11 +2593,8 @@ nsTextControlFrame::GetMaxLength(PRInt32* aSize)
 void
 nsTextControlFrame::FireOnInput()
 {
-  NS_ASSERTION(mContent, "illegal to call unless we map to a content node");
-
-  if (!mNotifyOnInput) { 
+  if (!mNotifyOnInput)
     return; // if notification is turned off, do nothing
-  } 
   
   // Dispatch the "input" event
   nsEventStatus status = nsEventStatus_eIgnore;
@@ -2910,15 +2602,8 @@ nsTextControlFrame::FireOnInput()
 
   // Have the content handle the event, propagating it according to normal
   // DOM rules.
-  nsWeakPtr &shell = mTextSelImpl->GetPresShell();
-  nsCOMPtr<nsIPresShell> presShell = do_QueryReferent(shell);
-  NS_ASSERTION(presShell, "No pres shell");
-  if (!presShell) {
-    return;
-  }
-
-  presShell->HandleEventWithTarget(&event, nsnull, mContent,
-                                   NS_EVENT_FLAG_INIT, &status); 
+  GetPresContext()->PresShell()->HandleEventWithTarget(&event, nsnull,
+      mContent, NS_EVENT_FLAG_INIT, &status); 
 }
 
 nsresult
@@ -2932,34 +2617,19 @@ nsTextControlFrame::CheckFireOnChange()
 {
   nsString value;
   GetText(&value);
-  if (!mFocusedValue.Equals(value))//different fire onchange
+  if (!mFocusedValue.Equals(value))
   {
     mFocusedValue = value;
-    FireOnChange();
-  }
-  return NS_OK;
-}
-
-nsresult
-nsTextControlFrame::FireOnChange()
-{
-  // Dispatch th1e change event
-  nsIContent* content = GetContent();
-  if (content)
-  {
+    // Dispatch the change event
     nsEventStatus status = nsEventStatus_eIgnore;
     nsInputEvent event(PR_TRUE, NS_FORM_CHANGE, nsnull);
 
-    // Have the content handle the event.
-    nsWeakPtr &shell = mTextSelImpl->GetPresShell();
-    nsCOMPtr<nsIPresShell> presShell = do_QueryReferent(shell);
-    NS_ENSURE_TRUE(presShell, NS_ERROR_FAILURE);
-    return presShell->HandleEventWithTarget(&event, nsnull, mContent, NS_EVENT_FLAG_INIT, &status); 
+    GetPresContext()->PresShell()->HandleEventWithTarget(&event, nsnull,
+        mContent, NS_EVENT_FLAG_INIT, &status); 
   }
   return NS_OK;
 }
 
-
 //======
 //privates
 
@@ -3215,33 +2885,12 @@ nsTextControlFrame::SetInitialChildList(nsPresContext* aPresContext,
 
   if (scrollableFrame) {
     mScrollableView = scrollableFrame->GetScrollableView();
-    mTextSelImpl->SetScrollableView(mScrollableView);
+    mFrameSel->SetScrollableView(mScrollableView);
   }
 
   return rv;
 }
 
-
-PRInt32 
-nsTextControlFrame::GetWidthInCharacters() const
-{
-  // see if there's a COL attribute, if so it wins
-  nsGenericHTMLElement *content = nsGenericHTMLElement::FromContent(mContent);
-  if (content)
-  {
-    const nsAttrValue* attr = content->GetParsedAttr(nsHTMLAtoms::cols);
-    if (attr && attr->Type() == nsAttrValue::eInteger) {
-      return attr->GetIntegerValue();
-    }
-  }
-
-  // XXX: otherwise, see if CSS has a width specified.  If so, work backwards
-  // to get the number of characters this width represents.
-  
-  // otherwise, the default is just returned.
-  return DEFAULT_COLUMN_WIDTH;
-}
-
 nsIScrollableView* nsTextControlFrame::GetScrollableView()
 {
   return mScrollableView;
diff --git a/mozilla/layout/forms/nsTextControlFrame.h b/mozilla/layout/forms/nsTextControlFrame.h
index 7a602d4cc30..f41cba7425c 100644
--- a/mozilla/layout/forms/nsTextControlFrame.h
+++ b/mozilla/layout/forms/nsTextControlFrame.h
@@ -136,7 +136,10 @@ public:
   NS_IMETHOD    SetSelectionEnd(PRInt32 aSelectionEnd);
   NS_IMETHOD    SetSelectionRange(PRInt32 aSelectionStart, PRInt32 aSelectionEnd);
   NS_IMETHOD    GetSelectionRange(PRInt32* aSelectionStart, PRInt32* aSelectionEnd);
-  NS_IMETHOD    GetSelectionContr(nsISelectionController **aSelCon);
+  virtual nsISelectionController* GetOwnedSelectionController()
+    { return mSelCon; }
+  virtual nsIFrameSelection* GetOwnedFrameSelection()
+    { return mFrameSel; }
 
   // nsIPhonetic
   NS_DECL_NSIPHONETIC
@@ -155,8 +158,6 @@ public:
   NS_DECL_ISUPPORTS_INHERITED
 
 public: //for methods who access nsTextControlFrame directly
-
-  void FireOnInput();//notify that we have some kind of change.
   /**
    * Find out whether this is a single line text control.  (text or password)
    * @return whether this is a single line text control
@@ -177,6 +178,7 @@ public: //for methods who access nsTextControlFrame directly
    * @return whether this is a password ontrol
    */
   PRBool IsPasswordTextControl() const;
+  void FireOnInput();
   void SetValueChanged(PRBool aValueChanged);
   /** Called when the frame is focused, to remember the value for onChange. */
   nsresult InitFocusedValue();
@@ -232,11 +234,8 @@ protected:
   /**
    * Fire the onChange event.
    */
-  nsresult FireOnChange();
-
-//helper methods
-  nsresult GetSizeFromContent(PRInt32* aSize) const;
 
+  // Helper methods
   /**
    * Get the cols attribute (if textarea) or a default
    * @return the number of columns to use
@@ -258,8 +257,6 @@ protected:
                                  nsSize&               aDesiredSize,
                                  nsSize&               aMinSize);
 
-  PRInt32 GetWidthInCharacters() const;
-
   // nsIScrollableViewProvider
   virtual nsIScrollableView* GetScrollableView();
 
@@ -276,7 +273,6 @@ private:
 
 private:
   nsCOMPtr<nsIEditor> mEditor;
-  nsCOMPtr<nsISelectionController> mSelCon;
 
   //cached sizes and states
   nsSize       mSize;
@@ -287,8 +283,10 @@ private:
   PRPackedBool mNotifyOnInput;//default this to off to stop any notifications until setup is complete
   PRPackedBool mDidPreDestroy; // has PreDestroy been called        
 
-  nsTextInputSelectionImpl *mTextSelImpl;
-  nsTextInputListener *mTextListener;
+  nsCOMPtr<nsISelectionController> mSelCon;
+  nsCOMPtr<nsIFrameSelection> mFrameSel;
+  nsTextInputListener* mTextListener;
+  // XXX This seems unsafe; what's keeping it around?
   nsIScrollableView *mScrollableView;
   nsString mFocusedValue;
 };
diff --git a/mozilla/layout/generic/nsFrame.cpp b/mozilla/layout/generic/nsFrame.cpp
index 1f5f536f387..1dad749491d 100644
--- a/mozilla/layout/generic/nsFrame.cpp
+++ b/mozilla/layout/generic/nsFrame.cpp
@@ -830,13 +830,9 @@ nsFrame::DisplaySelectionOverlay(nsDisplayListBuilder*   aBuilder,
   if (!(displaySelection & aContentType))
     return NS_OK;
 
-//get the selection controller
-  nsCOMPtr<nsISelectionController> selCon;
-  rv = GetSelectionController(presContext, getter_AddRefs(selCon));
-  if (NS_FAILED(rv) || !selCon)
-    return rv;
   PRInt16 selectionValue;
-  selCon->GetDisplaySelection(&selectionValue);
+  nsIFrameSelection* frameSelection = GetFrameSelection();
+  frameSelection->GetDisplaySelection(&selectionValue);
   if (selectionValue <= nsISelectionController::SELECTION_HIDDEN)
     return NS_OK; // selection is hidden or off
 
@@ -850,12 +846,9 @@ nsFrame::DisplaySelectionOverlay(nsDisplayListBuilder*   aBuilder,
   }
 
   SelectionDetails *details;
-  nsCOMPtr<nsIFrameSelection> frameSelection = do_QueryInterface(selCon);
-     //this MAY implement
-  if (!frameSelection)
-    frameSelection = shell->FrameSelection();
-  rv = frameSelection->LookUpSelection(newContent, offset, 
-                                       1, &details, PR_FALSE);//look up to see what selection(s) are on this frame
+  //look up to see what selection(s) are on this frame
+  rv = frameSelection->LookUpSelection(newContent, offset,
+                                       1, &details, PR_FALSE);
   // XXX is the above really necessary? We don't actually DO anything
   // with the details other than test that they're non-null
   if (NS_FAILED(rv) || !details)
@@ -1783,31 +1776,18 @@ nsFrame::HandlePress(nsPresContext* aPresContext,
   if (!IsMouseCaptured(aPresContext))
     CaptureMouse(aPresContext, PR_TRUE);
 
-  PRInt16 displayresult = nsISelectionController::SELECTION_OFF;
-  nsCOMPtr<nsISelectionController> selCon;
-  rv = GetSelectionController(aPresContext, getter_AddRefs(selCon));
-  //get the selection controller
-  if (NS_SUCCEEDED(rv) && selCon) 
-  {
-    selCon->GetDisplaySelection(&displayresult);
-    if (displayresult == nsISelectionController::SELECTION_OFF)
-      return NS_OK;//nothing to do we cannot affect selection from here
-  }
-
-  //get the frame selection from sel controller
-
-  // nsFrameState  state = GetStateBits();
-  // if (state & NS_FRAME_INDEPENDENT_SELECTION) 
-  nsCOMPtr<nsIFrameSelection> frameselection;
-
+  // XXX This is screwy; it really should use the selection frame, not the
+  // event frame
+  nsIFrameSelection* frameselection;
   if (useFrameSelection)
-    frameselection = do_QueryInterface(selCon); //this MAY implement
-
-  if (!frameselection)//if we must get it from the pres shell's
+    frameselection = GetFrameSelection();
+  else
     frameselection = shell->FrameSelection();
 
-  if (!frameselection)
-    return NS_ERROR_FAILURE;
+  PRInt16 displayresult = nsISelectionController::SELECTION_OFF;
+  frameselection->GetDisplaySelection(&displayresult);
+  if (displayresult == nsISelectionController::SELECTION_OFF)
+    return NS_OK;//nothing to do we cannot affect selection from here
 
   nsMouseEvent *me = (nsMouseEvent *)aEvent;
 
@@ -2078,11 +2058,7 @@ nsFrame::PeekBackwardAndForward(nsSelectionAmount aAmountBack,
   //no release 
 
   // maintain selection
-  nsCOMPtr<nsIFrameSelection> frameselection = do_QueryInterface(selcon); //this MAY implement
-  if (!frameselection)
-    frameselection = aPresContext->PresShell()->FrameSelection();
-
-  return frameselection->MaintainSelection();
+  return GetFrameSelection()->MaintainSelection();
 }
 
 // Figure out which view we should point capturing at, given that drag started
@@ -2117,21 +2093,10 @@ NS_IMETHODIMP nsFrame::HandleDrag(nsPresContext* aPresContext,
   }
   nsIPresShell *presShell = aPresContext->PresShell();
 
-  nsCOMPtr<nsIFrameSelection> frameselection;
-  nsCOMPtr<nsISelectionController> selCon;
-  
-  nsresult result = GetSelectionController(aPresContext,
-                                           getter_AddRefs(selCon));
-  if (NS_SUCCEEDED(result) && selCon)
-  {
-    frameselection = do_QueryInterface(selCon); //this MAY implement
-  }
-  if (!frameselection)
-    frameselection = presShell->FrameSelection();
-
+  nsIFrameSelection* frameselection = GetFrameSelection();
   PRBool mouseDown = PR_FALSE;
   if (NS_SUCCEEDED(frameselection->GetMouseDownState(&mouseDown)) && !mouseDown)
-    return NS_OK;            
+    return NS_OK;
 
   frameselection->StopAutoScrollTimer();
   // Check if we are dragging in a table cell
@@ -2139,6 +2104,7 @@ NS_IMETHODIMP nsFrame::HandleDrag(nsPresContext* aPresContext,
   PRInt32 contentOffset;
   PRInt32 target;
   nsMouseEvent *me = (nsMouseEvent *)aEvent;
+  nsresult result;
   result = GetDataForTableSelection(frameselection, presShell, me,
                                     getter_AddRefs(parentContent),
                                     &contentOffset, &target);      
@@ -2164,18 +2130,6 @@ NS_IMETHODIMP nsFrame::HandleDrag(nsPresContext* aPresContext,
   return NS_OK;
 }
 
-static void
-GetFrameSelectionFor(nsIFrame* aFrame, nsIFrameSelection** aFrameSel, nsISelectionController** aSelCon)
-{
-  *aSelCon = nsnull;
-  *aFrameSel = nsnull;
-  nsresult result = aFrame->GetSelectionController(aFrame->GetPresContext(), aSelCon);
-  if (NS_SUCCEEDED(result) && *aSelCon)
-    CallQueryInterface(*aSelCon, aFrameSel);
-  if (!*aFrameSel)
-    NS_IF_ADDREF(*aFrameSel = aFrame->GetPresContext()->GetPresShell()->FrameSelection());
-}
-
 NS_IMETHODIMP nsFrame::HandleRelease(nsPresContext* aPresContext, 
                                      nsGUIEvent*     aEvent,
                                      nsEventStatus*  aEventStatus)
@@ -2186,28 +2140,20 @@ NS_IMETHODIMP nsFrame::HandleRelease(nsPresContext* aPresContext,
   // we should never be capturing when the mouse button is up
   CaptureMouse(aPresContext, PR_FALSE);
 
-  nsCOMPtr<nsIFrameSelection> frameselection;
-  nsCOMPtr<nsISelectionController> selCon;
-  
   // We might be capturing in some other document and the event just happened to
   // trickle down here. Make sure that document's frame selection is notified.
   if (activeFrame != this &&
       NS_STATIC_CAST(nsFrame*, activeFrame)->DisplaySelection(activeFrame->GetPresContext())
         != nsISelectionController::SELECTION_OFF) {
-    GetFrameSelectionFor(activeFrame, getter_AddRefs(frameselection), getter_AddRefs(selCon));
-    frameselection->SetMouseDownState( PR_FALSE );
-    frameselection->StopAutoScrollTimer();
+    nsIFrameSelection* frameSelection = activeFrame->GetFrameSelection();
+    frameSelection->SetMouseDownState( PR_FALSE );
+    frameSelection->StopAutoScrollTimer();
   }
 
   if (DisplaySelection(aPresContext) == nsISelectionController::SELECTION_OFF)
     return NS_OK;
 
-  nsIPresShell *presShell = aPresContext->GetPresShell();
-
-  if (!presShell)
-    return NS_ERROR_FAILURE;
-
-  GetFrameSelectionFor(this, getter_AddRefs(frameselection), getter_AddRefs(selCon));
+  nsIFrameSelection* frameselection = GetFrameSelection();
 
   nsresult result = NS_OK;
 
@@ -2265,9 +2211,12 @@ NS_IMETHODIMP nsFrame::HandleRelease(nsPresContext* aPresContext,
       {
         me = (nsMouseEvent *)aEvent;
         nsCOMPtr<nsIContent>parentContent;
-        PRInt32  contentOffset;
+        PRInt32 contentOffset;
         PRInt32 target;
-        result = GetDataForTableSelection(frameselection, presShell, me, getter_AddRefs(parentContent), &contentOffset, &target);
+        nsIPresShell* shell = GetPresContext()->PresShell();
+        result = GetDataForTableSelection(frameselection, shell, me,
+                                          getter_AddRefs(parentContent),
+                                          &contentOffset, &target);
 
         if (NS_SUCCEEDED(result) && parentContent)
         {
@@ -3575,21 +3524,28 @@ nsFrame::GetSelectionController(nsPresContext *aPresContext, nsISelectionControl
   while (frame && (frame->GetStateBits() & NS_FRAME_INDEPENDENT_SELECTION)) {
     nsITextControlFrame *tcf;
     if (NS_SUCCEEDED(frame->QueryInterface(NS_GET_IID(nsITextControlFrame),(void**)&tcf))) {
-      return tcf->GetSelectionContr(aSelCon);
+      NS_IF_ADDREF(*aSelCon = tcf->GetOwnedSelectionController());
+      return NS_OK;
     }
     frame = frame->GetParent();
   }
 
-  nsIPresShell *shell = aPresContext->GetPresShell();
-  if (shell) {
-    nsCOMPtr<nsISelectionController> selCon = do_QueryInterface(shell);
-    NS_IF_ADDREF(*aSelCon = selCon);
-  }
-
-  return NS_OK;
+  return CallQueryInterface(aPresContext->GetPresShell(), aSelCon);
 }
 
+nsIFrameSelection* nsIFrame::GetFrameSelection()
+{
+  nsIFrame *frame = this;
+  while (frame && (frame->GetStateBits() & NS_FRAME_INDEPENDENT_SELECTION)) {
+    nsITextControlFrame *tcf;
+    if (NS_SUCCEEDED(frame->QueryInterface(NS_GET_IID(nsITextControlFrame),(void**)&tcf))) {
+      return tcf->GetOwnedFrameSelection();
+    }
+    frame = frame->GetParent();
+  }
 
+  return GetPresContext()->PresShell()->FrameSelection();
+}
 
 #ifdef NS_DEBUG
 NS_IMETHODIMP
diff --git a/mozilla/layout/generic/nsIFrame.h b/mozilla/layout/generic/nsIFrame.h
index 7a7900c53f0..8ae81124c19 100644
--- a/mozilla/layout/generic/nsIFrame.h
+++ b/mozilla/layout/generic/nsIFrame.h
@@ -1253,6 +1253,11 @@ public:
    */
   NS_IMETHOD  GetSelectionController(nsPresContext *aPresContext, nsISelectionController **aSelCon) = 0;
 
+  /**
+   *  Call to get nsIFrameSelection for this frame; does not addref
+   */
+  nsIFrameSelection* GetFrameSelection();
+
   /** EndSelection related calls
    */
 
diff --git a/mozilla/layout/generic/nsTextFrame.cpp b/mozilla/layout/generic/nsTextFrame.cpp
index 7ea817bfff0..1ca2dd2ea8b 100644
--- a/mozilla/layout/generic/nsTextFrame.cpp
+++ b/mozilla/layout/generic/nsTextFrame.cpp
@@ -2721,14 +2721,6 @@ nsTextFrame::IsTextInSelection()
   if (0 != textLength) {
 
     SelectionDetails *details = nsnull;
-    nsCOMPtr<nsIFrameSelection> frameSelection;
-    //get the frameSelection from the selection controller
-    if (selCon) {
-      frameSelection = do_QueryInterface(selCon); //this MAY implement
-    }
-    //if that failed get it from the pres shell
-    if (!frameSelection)
-      frameSelection = shell->FrameSelection();
 
     nsCOMPtr<nsIContent> content;
     PRInt32 offset;
@@ -2738,9 +2730,9 @@ nsTextFrame::IsTextInSelection()
                                                    getter_AddRefs(content),
                                                    &offset, &length);
     if (NS_SUCCEEDED(rv) && content) {
-      rv = frameSelection->LookUpSelection(content, mContentOffset,
-                                           mContentLength, &details,
-                                           PR_FALSE);
+      rv = GetFrameSelection()->LookUpSelection(content, mContentOffset,
+                                                mContentLength, &details,
+                                                PR_FALSE);
     }
       
     //where are the selection points "really"
@@ -2883,27 +2875,16 @@ nsTextFrame::PaintUnicodeText(nsPresContext* aPresContext,
     else 
     { //we draw according to selection rules
       SelectionDetails *details = nsnull;
-      nsCOMPtr<nsIFrameSelection> frameSelection;
-      //get the frameSelection from the selection controller
-      if (selCon)
-      {
-        frameSelection = do_QueryInterface(selCon); //this MAY implement
-      }
-      //if that failed get it from the pres shell
-      nsresult rv = NS_OK;
-      if (!frameSelection)
-        frameSelection = shell->FrameSelection();
       nsCOMPtr<nsIContent> content;
       PRInt32 offset;
       PRInt32 length;
-
-      rv = GetContentAndOffsetsForSelection(aPresContext,
-                                            getter_AddRefs(content),
-                                            &offset, &length);
+      nsresult rv = GetContentAndOffsetsForSelection(aPresContext,
+                                                     getter_AddRefs(content),
+                                                     &offset, &length);
       if (NS_SUCCEEDED(rv) && content) {
-        rv = frameSelection->LookUpSelection(content, mContentOffset, 
-                                             mContentLength, &details,
-                                             PR_FALSE);
+        rv = GetFrameSelection()->LookUpSelection(content, mContentOffset, 
+                                                 mContentLength, &details,
+                                                 PR_FALSE);
       }
         
       //where are the selection points "really"
@@ -3620,23 +3601,16 @@ nsTextFrame::PaintTextSlowly(nsPresContext* aPresContext,
     else 
     {
       SelectionDetails *details = nsnull;
-      nsCOMPtr<nsIFrameSelection> frameSelection;
-//get the frame selection
-      nsresult rv = NS_OK;
-      frameSelection = do_QueryInterface(selCon); //this MAY implement
-      if (!frameSelection)//if that failed get it from the presshell
-        frameSelection = shell->FrameSelection();
       nsCOMPtr<nsIContent> content;
       PRInt32 offset;
       PRInt32 length;
-
-      rv = GetContentAndOffsetsForSelection(aPresContext,
-                                            getter_AddRefs(content),
-                                            &offset, &length);
+      nsresult rv = GetContentAndOffsetsForSelection(aPresContext,
+                                                     getter_AddRefs(content),
+                                                     &offset, &length);
       if (NS_SUCCEEDED(rv)) {
-        rv = frameSelection->LookUpSelection(content, mContentOffset, 
-                                             mContentLength, &details,
-                                             PR_FALSE);
+        rv = GetFrameSelection()->LookUpSelection(content, mContentOffset, 
+                                                  mContentLength, &details,
+                                                  PR_FALSE);
       }
 
       //where are the selection points "really"
@@ -3872,23 +3846,16 @@ nsTextFrame::PaintAsciiText(nsPresContext* aPresContext,
     }
     else {
       SelectionDetails *details;
-      nsCOMPtr<nsIFrameSelection> frameSelection;
-//get the frame selection
-      frameSelection = do_QueryInterface(selCon); //this MAY implement
-      nsresult rv = NS_OK;
-      if (!frameSelection)//if that failed get it from the presshell
-        frameSelection = shell->FrameSelection();
       nsCOMPtr<nsIContent> content;
       PRInt32 offset;
       PRInt32 length;
-
-      rv = GetContentAndOffsetsForSelection(aPresContext,
-                                            getter_AddRefs(content),
-                                            &offset, &length);
+      nsresult rv = GetContentAndOffsetsForSelection(aPresContext,
+                                                     getter_AddRefs(content),
+                                                     &offset, &length);
       if (NS_SUCCEEDED(rv)) {
-        rv = frameSelection->LookUpSelection(content, mContentOffset, 
-                                             mContentLength, &details,
-                                             PR_FALSE);
+        rv = GetFrameSelection()->LookUpSelection(content, mContentOffset, 
+                                                  mContentLength, &details,
+                                                  PR_FALSE);
       }
         
       //where are the selection points "really"
@@ -4233,32 +4200,17 @@ nsTextFrame::SetSelected(nsPresContext* aPresContext,
   else
   {//we need to see if any other selection available.
     SelectionDetails *details = nsnull;
-    nsCOMPtr<nsIFrameSelection> frameSelection;
+    nsCOMPtr<nsIContent> content;
+    PRInt32 offset;
+    PRInt32 length;
 
-    nsIPresShell *shell = aPresContext->GetPresShell();
-    if (shell) {
-      nsCOMPtr<nsISelectionController> selCon;
-      nsresult rv = GetSelectionController(aPresContext,
-                                           getter_AddRefs(selCon));
-      if (NS_SUCCEEDED(rv) && selCon)
-      {
-        frameSelection = do_QueryInterface(selCon); //this MAY implement
-      }
-      if (!frameSelection)
-        frameSelection = shell->FrameSelection();
-
-      nsCOMPtr<nsIContent> content;
-      PRInt32 offset;
-      PRInt32 length;
-
-      rv = GetContentAndOffsetsForSelection(aPresContext,
-                                            getter_AddRefs(content),
-                                            &offset, &length);
-      if (NS_SUCCEEDED(rv) && content) {
-        rv = frameSelection->LookUpSelection(content, offset,
-                                             length, &details, PR_TRUE);
-        // PR_TRUE last param used here! we need to see if we are still selected. so no shortcut
-      }
+    nsresult rv = GetContentAndOffsetsForSelection(aPresContext,
+                                                   getter_AddRefs(content),
+                                                   &offset, &length);
+    if (NS_SUCCEEDED(rv) && content) {
+      rv = GetFrameSelection()->LookUpSelection(content, offset,
+                                                length, &details, PR_TRUE);
+      // PR_TRUE last param used here! we need to see if we are still selected. so no shortcut
     }
     if (!details)
       RemoveStateBits(NS_FRAME_SELECTED_CONTENT);
diff --git a/mozilla/layout/mathml/base/src/nsMathMLmoFrame.cpp b/mozilla/layout/mathml/base/src/nsMathMLmoFrame.cpp
index e48364c3412..7338e6b9552 100644
--- a/mozilla/layout/mathml/base/src/nsMathMLmoFrame.cpp
+++ b/mozilla/layout/mathml/base/src/nsMathMLmoFrame.cpp
@@ -101,20 +101,8 @@ nsMathMLmoFrame::IsFrameInSelection(nsIFrame* aFrame)
     return PR_FALSE;
 
   SelectionDetails* details = nsnull;
-  nsIPresShell *shell = GetPresContext()->GetPresShell();
-  if (shell) {
-    nsCOMPtr<nsIFrameSelection> frameSelection;
-    nsCOMPtr<nsISelectionController> selCon;
-    nsresult rv = GetSelectionController(GetPresContext(),
-                                         getter_AddRefs(selCon));
-    if (NS_SUCCEEDED(rv) && selCon)
-      frameSelection = do_QueryInterface(selCon);
-    if (!frameSelection)
-      frameSelection = shell->FrameSelection();
-
-    frameSelection->LookUpSelection(aFrame->GetContent(),
-				    0, 1, &details, PR_TRUE);
-  }
+  aFrame->GetFrameSelection()->LookUpSelection(aFrame->GetContent(),	 0, 1,
+                                               &details, PR_TRUE);
   if (!details)
     return PR_FALSE;