Adding upstream version 86.0.1.upstream/86.0.1upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

63 files changed, 14009 insertions, 0 deletions

diff --git a/accessible/ipc/DocAccessibleChildBase.cpp b/accessible/ipc/DocAccessibleChildBase.cpp
new file mode 100644
index 0000000000..12dcc8b8e1
--- /dev/null
+++ b/accessible/ipc/DocAccessibleChildBase.cpp
@@ -0,0 +1,99 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/a11y/DocAccessibleChildBase.h"
+#include "mozilla/a11y/ProxyAccessible.h"
+
+#include "Accessible-inl.h"
+
+namespace mozilla {
+namespace a11y {
+
+/* static */
+uint32_t DocAccessibleChildBase::InterfacesFor(Accessible* aAcc) {
+  uint32_t interfaces = 0;
+  if (aAcc->IsHyperText() && aAcc->AsHyperText()->IsTextRole())
+    interfaces |= Interfaces::HYPERTEXT;
+
+  if (aAcc->IsLink()) interfaces |= Interfaces::HYPERLINK;
+
+  if (aAcc->HasNumericValue()) interfaces |= Interfaces::VALUE;
+
+  if (aAcc->IsImage()) interfaces |= Interfaces::IMAGE;
+
+  if (aAcc->IsTable()) {
+    interfaces |= Interfaces::TABLE;
+  }
+
+  if (aAcc->IsTableCell()) interfaces |= Interfaces::TABLECELL;
+
+  if (aAcc->IsDoc()) interfaces |= Interfaces::DOCUMENT;
+
+  if (aAcc->IsSelect()) {
+    interfaces |= Interfaces::SELECTION;
+  }
+
+  if (aAcc->ActionCount()) {
+    interfaces |= Interfaces::ACTION;
+  }
+
+  return interfaces;
+}
+
+/* static */
+void DocAccessibleChildBase::SerializeTree(Accessible* aRoot,
+                                           nsTArray<AccessibleData>& aTree) {
+  uint64_t id = reinterpret_cast<uint64_t>(aRoot->UniqueID());
+#if defined(XP_WIN)
+  int32_t msaaId = AccessibleWrap::GetChildIDFor(aRoot);
+#endif
+  a11y::role role = aRoot->Role();
+  uint32_t childCount = aRoot->ChildCount();
+  uint32_t interfaces = InterfacesFor(aRoot);
+
+  // OuterDocAccessibles are special because we don't want to serialize the
+  // child doc here, we'll call PDocAccessibleConstructor in
+  // NotificationController.
+  MOZ_ASSERT(!aRoot->IsDoc(), "documents shouldn't be serialized");
+  if (aRoot->IsOuterDoc()) {
+    childCount = 0;
+  }
+
+#if defined(XP_WIN)
+  aTree.AppendElement(AccessibleData(id, msaaId, role, childCount, interfaces));
+#else
+  aTree.AppendElement(AccessibleData(id, role, childCount, interfaces));
+#endif
+
+  for (uint32_t i = 0; i < childCount; i++) {
+    SerializeTree(aRoot->GetChildAt(i), aTree);
+  }
+}
+
+void DocAccessibleChildBase::InsertIntoIpcTree(Accessible* aParent,
+                                               Accessible* aChild,
+                                               uint32_t aIdxInParent) {
+  uint64_t parentID =
+      aParent->IsDoc() ? 0 : reinterpret_cast<uint64_t>(aParent->UniqueID());
+  nsTArray<AccessibleData> shownTree;
+  ShowEventData data(parentID, aIdxInParent, shownTree, true);
+  SerializeTree(aChild, data.NewTree());
+  MaybeSendShowEvent(data, false);
+}
+
+void DocAccessibleChildBase::ShowEvent(AccShowEvent* aShowEvent) {
+  Accessible* parent = aShowEvent->Parent();
+  uint64_t parentID =
+      parent->IsDoc() ? 0 : reinterpret_cast<uint64_t>(parent->UniqueID());
+  uint32_t idxInParent = aShowEvent->GetAccessible()->IndexInParent();
+  nsTArray<AccessibleData> shownTree;
+  ShowEventData data(parentID, idxInParent, shownTree, false);
+  SerializeTree(aShowEvent->GetAccessible(), data.NewTree());
+  MaybeSendShowEvent(data, aShowEvent->IsFromUserInput());
+}
+
+}  // namespace a11y
+}  // namespace mozilla
diff --git a/accessible/ipc/DocAccessibleChildBase.h b/accessible/ipc/DocAccessibleChildBase.h
new file mode 100644
index 0000000000..70beefc41f
--- /dev/null
+++ b/accessible/ipc/DocAccessibleChildBase.h
@@ -0,0 +1,87 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_a11y_DocAccessibleChildBase_h
+#define mozilla_a11y_DocAccessibleChildBase_h
+
+#include "mozilla/a11y/DocAccessible.h"
+#include "mozilla/a11y/PDocAccessibleChild.h"
+#include "mozilla/Unused.h"
+#include "nsISupportsImpl.h"
+
+namespace mozilla {
+namespace a11y {
+
+class Accessible;
+class AccShowEvent;
+
+class DocAccessibleChildBase : public PDocAccessibleChild {
+ public:
+  explicit DocAccessibleChildBase(DocAccessible* aDoc)
+      : mDoc(aDoc), mIsRemoteConstructed(false) {
+    MOZ_COUNT_CTOR(DocAccessibleChildBase);
+  }
+
+  ~DocAccessibleChildBase() {
+    // Shutdown() should have been called, but maybe it isn't if the process is
+    // killed?
+    MOZ_ASSERT(!mDoc);
+    if (mDoc) {
+      mDoc->SetIPCDoc(nullptr);
+    }
+
+    MOZ_COUNT_DTOR(DocAccessibleChildBase);
+  }
+
+  virtual void Shutdown() {
+    DetachDocument();
+    SendShutdown();
+  }
+
+  /**
+   * Serializes a shown tree and sends it to the chrome process.
+   */
+  void InsertIntoIpcTree(Accessible* aParent, Accessible* aChild,
+                         uint32_t aIdxInParent);
+  void ShowEvent(AccShowEvent* aShowEvent);
+
+  virtual void ActorDestroy(ActorDestroyReason) override {
+    if (!mDoc) {
+      return;
+    }
+
+    mDoc->SetIPCDoc(nullptr);
+    mDoc = nullptr;
+  }
+
+ protected:
+  static uint32_t InterfacesFor(Accessible* aAcc);
+  static void SerializeTree(Accessible* aRoot, nsTArray<AccessibleData>& aTree);
+
+  virtual void MaybeSendShowEvent(ShowEventData& aData, bool aFromUser) {
+    Unused << SendShowEvent(aData, aFromUser);
+  }
+
+  void DetachDocument() {
+    if (mDoc) {
+      mDoc->SetIPCDoc(nullptr);
+      mDoc = nullptr;
+    }
+  }
+
+  bool IsConstructedInParentProcess() const { return mIsRemoteConstructed; }
+  void SetConstructedInParentProcess() { mIsRemoteConstructed = true; }
+
+  DocAccessible* mDoc;
+  bool mIsRemoteConstructed;
+
+  friend void DocAccessible::DoInitialUpdate();
+};
+
+}  // namespace a11y
+}  // namespace mozilla
+
+#endif  // mozilla_a11y_DocAccessibleChildBase_h
diff --git a/accessible/ipc/DocAccessibleParent.cpp b/accessible/ipc/DocAccessibleParent.cpp
new file mode 100644
index 0000000000..70f5649d8d
--- /dev/null
+++ b/accessible/ipc/DocAccessibleParent.cpp
@@ -0,0 +1,1039 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "DocAccessibleParent.h"
+#include "mozilla/a11y/Platform.h"
+#include "mozilla/dom/BrowserBridgeParent.h"
+#include "mozilla/dom/BrowserParent.h"
+#include "xpcAccessibleDocument.h"
+#include "xpcAccEvents.h"
+#include "nsAccUtils.h"
+#include "TextRange.h"
+
+#if defined(XP_WIN)
+#  include "AccessibleWrap.h"
+#  include "Compatibility.h"
+#  include "mozilla/mscom/PassthruProxy.h"
+#  include "mozilla/mscom/Ptr.h"
+#  include "nsWinUtils.h"
+#  include "RootAccessible.h"
+#else
+#  include "mozilla/a11y/DocAccessiblePlatformExtParent.h"
+#endif
+
+namespace mozilla {
+
+#if defined(XP_WIN)
+namespace mscom {
+namespace detail {
+// Needed by mscom::PassthruProxy::Wrap<IAccessible>.
+template <>
+struct VTableSizer<IAccessible> {
+  // 3 methods in IUnknown + 4 in IDispatch + 21 in IAccessible = 28 total
+  enum { Size = 28 };
+};
+}  // namespace detail
+}  // namespace mscom
+#endif  // defined (XP_WIN)
+
+namespace a11y {
+uint64_t DocAccessibleParent::sMaxDocID = 0;
+
+mozilla::ipc::IPCResult DocAccessibleParent::RecvShowEvent(
+    const ShowEventData& aData, const bool& aFromUser) {
+  if (mShutdown) return IPC_OK();
+
+  MOZ_ASSERT(CheckDocTree());
+
+  if (aData.NewTree().IsEmpty()) {
+    return IPC_FAIL(this, "No children being added");
+  }
+
+  ProxyAccessible* parent = GetAccessible(aData.ID());
+
+  // XXX This should really never happen, but sometimes we fail to fire the
+  // required show events.
+  if (!parent) {
+    NS_ERROR("adding child to unknown accessible");
+#ifdef DEBUG
+    return IPC_FAIL(this, "unknown parent accessible");
+#else
+    return IPC_OK();
+#endif
+  }
+
+  uint32_t newChildIdx = aData.Idx();
+  if (newChildIdx > parent->ChildrenCount()) {
+    NS_ERROR("invalid index to add child at");
+#ifdef DEBUG
+    return IPC_FAIL(this, "invalid index");
+#else
+    return IPC_OK();
+#endif
+  }
+
+  uint32_t consumed = AddSubtree(parent, aData.NewTree(), 0, newChildIdx);
+  MOZ_ASSERT(consumed == aData.NewTree().Length());
+
+  // XXX This shouldn't happen, but if we failed to add children then the below
+  // is pointless and can crash.
+  if (!consumed) {
+    return IPC_FAIL(this, "failed to add children");
+  }
+
+#ifdef DEBUG
+  for (uint32_t i = 0; i < consumed; i++) {
+    uint64_t id = aData.NewTree()[i].ID();
+    MOZ_ASSERT(mAccessibles.GetEntry(id));
+  }
+#endif
+
+  MOZ_ASSERT(CheckDocTree());
+
+  // Just update, no events.
+  if (aData.EventSuppressed()) {
+    return IPC_OK();
+  }
+
+  ProxyAccessible* target = parent->ChildAt(newChildIdx);
+  ProxyShowHideEvent(target, parent, true, aFromUser);
+
+  if (!nsCoreUtils::AccEventObserversExist()) {
+    return IPC_OK();
+  }
+
+  uint32_t type = nsIAccessibleEvent::EVENT_SHOW;
+  xpcAccessibleGeneric* xpcAcc = GetXPCAccessible(target);
+  xpcAccessibleDocument* doc = GetAccService()->GetXPCDocument(this);
+  nsINode* node = nullptr;
+  RefPtr<xpcAccEvent> event =
+      new xpcAccEvent(type, xpcAcc, doc, node, aFromUser);
+  nsCoreUtils::DispatchAccEvent(std::move(event));
+
+  return IPC_OK();
+}
+
+uint32_t DocAccessibleParent::AddSubtree(
+    ProxyAccessible* aParent, const nsTArray<a11y::AccessibleData>& aNewTree,
+    uint32_t aIdx, uint32_t aIdxInParent) {
+  if (aNewTree.Length() <= aIdx) {
+    NS_ERROR("bad index in serialized tree!");
+    return 0;
+  }
+
+  const AccessibleData& newChild = aNewTree[aIdx];
+
+  if (mAccessibles.Contains(newChild.ID())) {
+    NS_ERROR("ID already in use");
+    return 0;
+  }
+
+  ProxyAccessible* newProxy = new ProxyAccessible(
+      newChild.ID(), aParent, this, newChild.Role(), newChild.Interfaces());
+
+  aParent->AddChildAt(aIdxInParent, newProxy);
+  mAccessibles.PutEntry(newChild.ID())->mProxy = newProxy;
+  ProxyCreated(newProxy, newChild.Interfaces());
+
+#if defined(XP_WIN)
+  WrapperFor(newProxy)->SetID(newChild.MsaaID());
+#endif
+
+  for (uint32_t index = 0, len = mPendingChildDocs.Length(); index < len;
+       ++index) {
+    PendingChildDoc& pending = mPendingChildDocs[index];
+    if (pending.mParentID == newChild.ID()) {
+      if (!pending.mChildDoc->IsShutdown()) {
+        AddChildDoc(pending.mChildDoc, pending.mParentID, false);
+      }
+      mPendingChildDocs.RemoveElementAt(index);
+      break;
+    }
+  }
+  DebugOnly<bool> isOuterDoc = newProxy->ChildrenCount() == 1;
+
+  uint32_t accessibles = 1;
+  uint32_t kids = newChild.ChildrenCount();
+  for (uint32_t i = 0; i < kids; i++) {
+    uint32_t consumed = AddSubtree(newProxy, aNewTree, aIdx + accessibles, i);
+    if (!consumed) return 0;
+
+    accessibles += consumed;
+  }
+
+  MOZ_ASSERT((isOuterDoc && kids == 0) || newProxy->ChildrenCount() == kids);
+
+  return accessibles;
+}
+
+mozilla::ipc::IPCResult DocAccessibleParent::RecvHideEvent(
+    const uint64_t& aRootID, const bool& aFromUser) {
+  if (mShutdown) return IPC_OK();
+
+  MOZ_ASSERT(CheckDocTree());
+
+  // We shouldn't actually need this because mAccessibles shouldn't have an
+  // entry for the document itself, but it doesn't hurt to be explicit.
+  if (!aRootID) {
+    return IPC_FAIL(this, "Trying to hide entire document?");
+  }
+
+  ProxyEntry* rootEntry = mAccessibles.GetEntry(aRootID);
+  if (!rootEntry) {
+    NS_ERROR("invalid root being removed!");
+    return IPC_OK();
+  }
+
+  ProxyAccessible* root = rootEntry->mProxy;
+  if (!root) {
+    NS_ERROR("invalid root being removed!");
+    return IPC_OK();
+  }
+
+  ProxyAccessible* parent = root->Parent();
+  ProxyShowHideEvent(root, parent, false, aFromUser);
+
+  RefPtr<xpcAccHideEvent> event = nullptr;
+  if (nsCoreUtils::AccEventObserversExist()) {
+    uint32_t type = nsIAccessibleEvent::EVENT_HIDE;
+    xpcAccessibleGeneric* xpcAcc = GetXPCAccessible(root);
+    xpcAccessibleGeneric* xpcParent = GetXPCAccessible(parent);
+    ProxyAccessible* next = root->NextSibling();
+    xpcAccessibleGeneric* xpcNext = next ? GetXPCAccessible(next) : nullptr;
+    ProxyAccessible* prev = root->PrevSibling();
+    xpcAccessibleGeneric* xpcPrev = prev ? GetXPCAccessible(prev) : nullptr;
+    xpcAccessibleDocument* doc = GetAccService()->GetXPCDocument(this);
+    nsINode* node = nullptr;
+    event = new xpcAccHideEvent(type, xpcAcc, doc, node, aFromUser, xpcParent,
+                                xpcNext, xpcPrev);
+  }
+
+  parent->RemoveChild(root);
+  root->Shutdown();
+
+  MOZ_ASSERT(CheckDocTree());
+
+  if (event) {
+    nsCoreUtils::DispatchAccEvent(std::move(event));
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleParent::RecvEvent(
+    const uint64_t& aID, const uint32_t& aEventType) {
+  if (mShutdown) {
+    return IPC_OK();
+  }
+
+  ProxyAccessible* proxy = GetAccessible(aID);
+  if (!proxy) {
+    NS_ERROR("no proxy for event!");
+    return IPC_OK();
+  }
+
+  ProxyEvent(proxy, aEventType);
+
+  if (!nsCoreUtils::AccEventObserversExist()) {
+    return IPC_OK();
+  }
+
+  xpcAccessibleGeneric* xpcAcc = GetXPCAccessible(proxy);
+  xpcAccessibleDocument* doc = GetAccService()->GetXPCDocument(this);
+  nsINode* node = nullptr;
+  bool fromUser = true;  // XXX fix me
+  RefPtr<xpcAccEvent> event =
+      new xpcAccEvent(aEventType, xpcAcc, doc, node, fromUser);
+  nsCoreUtils::DispatchAccEvent(std::move(event));
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleParent::RecvStateChangeEvent(
+    const uint64_t& aID, const uint64_t& aState, const bool& aEnabled) {
+  if (mShutdown) {
+    return IPC_OK();
+  }
+
+  ProxyAccessible* target = GetAccessible(aID);
+  if (!target) {
+    NS_ERROR("we don't know about the target of a state change event!");
+    return IPC_OK();
+  }
+
+  ProxyStateChangeEvent(target, aState, aEnabled);
+
+  if (!nsCoreUtils::AccEventObserversExist()) {
+    return IPC_OK();
+  }
+
+  xpcAccessibleGeneric* xpcAcc = GetXPCAccessible(target);
+  xpcAccessibleDocument* doc = GetAccService()->GetXPCDocument(this);
+  uint32_t type = nsIAccessibleEvent::EVENT_STATE_CHANGE;
+  bool extra;
+  uint32_t state = nsAccUtils::To32States(aState, &extra);
+  bool fromUser = true;     // XXX fix this
+  nsINode* node = nullptr;  // XXX can we do better?
+  RefPtr<xpcAccStateChangeEvent> event = new xpcAccStateChangeEvent(
+      type, xpcAcc, doc, node, fromUser, state, extra, aEnabled);
+  nsCoreUtils::DispatchAccEvent(std::move(event));
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleParent::RecvCaretMoveEvent(
+    const uint64_t& aID,
+#if defined(XP_WIN)
+    const LayoutDeviceIntRect& aCaretRect,
+#endif  // defined (XP_WIN)
+    const int32_t& aOffset, const bool& aIsSelectionCollapsed) {
+  if (mShutdown) {
+    return IPC_OK();
+  }
+
+  ProxyAccessible* proxy = GetAccessible(aID);
+  if (!proxy) {
+    NS_ERROR("unknown caret move event target!");
+    return IPC_OK();
+  }
+
+#if defined(XP_WIN)
+  ProxyCaretMoveEvent(proxy, aCaretRect);
+#else
+  ProxyCaretMoveEvent(proxy, aOffset, aIsSelectionCollapsed);
+#endif
+
+  if (!nsCoreUtils::AccEventObserversExist()) {
+    return IPC_OK();
+  }
+
+  xpcAccessibleGeneric* xpcAcc = GetXPCAccessible(proxy);
+  xpcAccessibleDocument* doc = GetAccService()->GetXPCDocument(this);
+  nsINode* node = nullptr;
+  bool fromUser = true;  // XXX fix me
+  uint32_t type = nsIAccessibleEvent::EVENT_TEXT_CARET_MOVED;
+  RefPtr<xpcAccCaretMoveEvent> event = new xpcAccCaretMoveEvent(
+      type, xpcAcc, doc, node, fromUser, aOffset, aIsSelectionCollapsed);
+  nsCoreUtils::DispatchAccEvent(std::move(event));
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleParent::RecvTextChangeEvent(
+    const uint64_t& aID, const nsString& aStr, const int32_t& aStart,
+    const uint32_t& aLen, const bool& aIsInsert, const bool& aFromUser) {
+  if (mShutdown) {
+    return IPC_OK();
+  }
+
+  ProxyAccessible* target = GetAccessible(aID);
+  if (!target) {
+    NS_ERROR("text change event target is unknown!");
+    return IPC_OK();
+  }
+
+  ProxyTextChangeEvent(target, aStr, aStart, aLen, aIsInsert, aFromUser);
+
+  if (!nsCoreUtils::AccEventObserversExist()) {
+    return IPC_OK();
+  }
+
+  xpcAccessibleGeneric* xpcAcc = GetXPCAccessible(target);
+  xpcAccessibleDocument* doc = GetAccService()->GetXPCDocument(this);
+  uint32_t type = aIsInsert ? nsIAccessibleEvent::EVENT_TEXT_INSERTED
+                            : nsIAccessibleEvent::EVENT_TEXT_REMOVED;
+  nsINode* node = nullptr;
+  RefPtr<xpcAccTextChangeEvent> event = new xpcAccTextChangeEvent(
+      type, xpcAcc, doc, node, aFromUser, aStart, aLen, aIsInsert, aStr);
+  nsCoreUtils::DispatchAccEvent(std::move(event));
+
+  return IPC_OK();
+}
+
+#if defined(XP_WIN)
+
+mozilla::ipc::IPCResult DocAccessibleParent::RecvSyncTextChangeEvent(
+    const uint64_t& aID, const nsString& aStr, const int32_t& aStart,
+    const uint32_t& aLen, const bool& aIsInsert, const bool& aFromUser) {
+  return RecvTextChangeEvent(aID, aStr, aStart, aLen, aIsInsert, aFromUser);
+}
+
+#endif  // defined(XP_WIN)
+
+mozilla::ipc::IPCResult DocAccessibleParent::RecvSelectionEvent(
+    const uint64_t& aID, const uint64_t& aWidgetID, const uint32_t& aType) {
+  if (mShutdown) {
+    return IPC_OK();
+  }
+
+  ProxyAccessible* target = GetAccessible(aID);
+  ProxyAccessible* widget = GetAccessible(aWidgetID);
+  if (!target || !widget) {
+    NS_ERROR("invalid id in selection event");
+    return IPC_OK();
+  }
+
+  ProxySelectionEvent(target, widget, aType);
+  if (!nsCoreUtils::AccEventObserversExist()) {
+    return IPC_OK();
+  }
+  xpcAccessibleGeneric* xpcTarget = GetXPCAccessible(target);
+  xpcAccessibleDocument* xpcDoc = GetAccService()->GetXPCDocument(this);
+  RefPtr<xpcAccEvent> event =
+      new xpcAccEvent(aType, xpcTarget, xpcDoc, nullptr, false);
+  nsCoreUtils::DispatchAccEvent(std::move(event));
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleParent::RecvVirtualCursorChangeEvent(
+    const uint64_t& aID, const uint64_t& aOldPositionID,
+    const int32_t& aOldStartOffset, const int32_t& aOldEndOffset,
+    const uint64_t& aNewPositionID, const int32_t& aNewStartOffset,
+    const int32_t& aNewEndOffset, const int16_t& aReason,
+    const int16_t& aBoundaryType, const bool& aFromUser) {
+  if (mShutdown) {
+    return IPC_OK();
+  }
+
+  ProxyAccessible* target = GetAccessible(aID);
+  ProxyAccessible* oldPosition = GetAccessible(aOldPositionID);
+  ProxyAccessible* newPosition = GetAccessible(aNewPositionID);
+
+  if (!target) {
+    NS_ERROR("no proxy for event!");
+    return IPC_OK();
+  }
+
+#if defined(ANDROID)
+  ProxyVirtualCursorChangeEvent(
+      target, oldPosition, aOldStartOffset, aOldEndOffset, newPosition,
+      aNewStartOffset, aNewEndOffset, aReason, aBoundaryType, aFromUser);
+#endif
+
+  if (!nsCoreUtils::AccEventObserversExist()) {
+    return IPC_OK();
+  }
+
+  xpcAccessibleDocument* doc = GetAccService()->GetXPCDocument(this);
+  RefPtr<xpcAccVirtualCursorChangeEvent> event =
+      new xpcAccVirtualCursorChangeEvent(
+          nsIAccessibleEvent::EVENT_VIRTUALCURSOR_CHANGED,
+          GetXPCAccessible(target), doc, nullptr, aFromUser,
+          GetXPCAccessible(oldPosition), aOldStartOffset, aOldEndOffset,
+          GetXPCAccessible(newPosition), aNewStartOffset, aNewEndOffset,
+          aBoundaryType, aReason);
+  nsCoreUtils::DispatchAccEvent(std::move(event));
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleParent::RecvScrollingEvent(
+    const uint64_t& aID, const uint64_t& aType, const uint32_t& aScrollX,
+    const uint32_t& aScrollY, const uint32_t& aMaxScrollX,
+    const uint32_t& aMaxScrollY) {
+  if (mShutdown) {
+    return IPC_OK();
+  }
+
+  ProxyAccessible* target = GetAccessible(aID);
+  if (!target) {
+    NS_ERROR("no proxy for event!");
+    return IPC_OK();
+  }
+
+#if defined(ANDROID)
+  ProxyScrollingEvent(target, aType, aScrollX, aScrollY, aMaxScrollX,
+                      aMaxScrollY);
+#else
+  ProxyEvent(target, aType);
+#endif
+
+  if (!nsCoreUtils::AccEventObserversExist()) {
+    return IPC_OK();
+  }
+
+  xpcAccessibleGeneric* xpcAcc = GetXPCAccessible(target);
+  xpcAccessibleDocument* doc = GetAccService()->GetXPCDocument(this);
+  nsINode* node = nullptr;
+  bool fromUser = true;  // XXX: Determine if this was from user input.
+  RefPtr<xpcAccScrollingEvent> event =
+      new xpcAccScrollingEvent(aType, xpcAcc, doc, node, fromUser, aScrollX,
+                               aScrollY, aMaxScrollX, aMaxScrollY);
+  nsCoreUtils::DispatchAccEvent(std::move(event));
+
+  return IPC_OK();
+}
+
+#if !defined(XP_WIN)
+mozilla::ipc::IPCResult DocAccessibleParent::RecvAnnouncementEvent(
+    const uint64_t& aID, const nsString& aAnnouncement,
+    const uint16_t& aPriority) {
+  if (mShutdown) {
+    return IPC_OK();
+  }
+
+  ProxyAccessible* target = GetAccessible(aID);
+  if (!target) {
+    NS_ERROR("no proxy for event!");
+    return IPC_OK();
+  }
+
+#  if defined(ANDROID)
+  ProxyAnnouncementEvent(target, aAnnouncement, aPriority);
+#  endif
+
+  if (!nsCoreUtils::AccEventObserversExist()) {
+    return IPC_OK();
+  }
+
+  xpcAccessibleGeneric* xpcAcc = GetXPCAccessible(target);
+  xpcAccessibleDocument* doc = GetAccService()->GetXPCDocument(this);
+  RefPtr<xpcAccAnnouncementEvent> event = new xpcAccAnnouncementEvent(
+      nsIAccessibleEvent::EVENT_ANNOUNCEMENT, xpcAcc, doc, nullptr, false,
+      aAnnouncement, aPriority);
+  nsCoreUtils::DispatchAccEvent(std::move(event));
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleParent::RecvTextSelectionChangeEvent(
+    const uint64_t& aID, nsTArray<TextRangeData>&& aSelection) {
+#  ifdef MOZ_WIDGET_COCOA
+  if (mShutdown) {
+    return IPC_OK();
+  }
+
+  ProxyAccessible* target = GetAccessible(aID);
+  if (!target) {
+    NS_ERROR("no proxy for event!");
+    return IPC_OK();
+  }
+
+  ProxyTextSelectionChangeEvent(target, aSelection);
+
+  return IPC_OK();
+#  else
+  return RecvEvent(aID, nsIAccessibleEvent::EVENT_TEXT_SELECTION_CHANGED);
+#  endif
+}
+
+#endif
+
+mozilla::ipc::IPCResult DocAccessibleParent::RecvRoleChangedEvent(
+    const a11y::role& aRole) {
+  if (mShutdown) {
+    return IPC_OK();
+  }
+
+  mRole = aRole;
+
+#ifdef MOZ_WIDGET_COCOA
+  ProxyRoleChangedEvent(this, aRole);
+#endif
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleParent::RecvBindChildDoc(
+    PDocAccessibleParent* aChildDoc, const uint64_t& aID) {
+  // One document should never directly be the child of another.
+  // We should always have at least an outer doc accessible in between.
+  MOZ_ASSERT(aID);
+  if (!aID) return IPC_FAIL(this, "ID is 0!");
+
+  if (mShutdown) {
+    return IPC_OK();
+  }
+
+  MOZ_ASSERT(CheckDocTree());
+
+  auto childDoc = static_cast<DocAccessibleParent*>(aChildDoc);
+  childDoc->Unbind();
+  ipc::IPCResult result = AddChildDoc(childDoc, aID, false);
+  MOZ_ASSERT(result);
+  MOZ_ASSERT(CheckDocTree());
+#ifdef DEBUG
+  if (!result) {
+    return result;
+  }
+#else
+  result = IPC_OK();
+#endif
+
+  return result;
+}
+
+ipc::IPCResult DocAccessibleParent::AddChildDoc(DocAccessibleParent* aChildDoc,
+                                                uint64_t aParentID,
+                                                bool aCreating) {
+  // We do not use GetAccessible here because we want to be sure to not get the
+  // document it self.
+  ProxyEntry* e = mAccessibles.GetEntry(aParentID);
+  if (!e) {
+    if (aChildDoc->IsTopLevelInContentProcess()) {
+      // aChildDoc is an embedded document in a different content process to
+      // this document. Sometimes, AddChildDoc gets called before the embedder
+      // sends us the OuterDocAccessible. We must add the child when the
+      // OuterDocAccessible proxy gets created later.
+#ifdef DEBUG
+      for (uint32_t index = 0, len = mPendingChildDocs.Length(); index < len;
+           ++index) {
+        MOZ_ASSERT(mPendingChildDocs[index].mChildDoc != aChildDoc,
+                   "Child doc already pending addition!");
+      }
+#endif
+      mPendingChildDocs.AppendElement(PendingChildDoc(aChildDoc, aParentID));
+      if (aCreating) {
+        ProxyCreated(aChildDoc, Interfaces::DOCUMENT | Interfaces::HYPERTEXT);
+      }
+      return IPC_OK();
+    }
+    return IPC_FAIL(this, "binding to nonexistant proxy!");
+  }
+
+  ProxyAccessible* outerDoc = e->mProxy;
+  MOZ_ASSERT(outerDoc);
+
+  // OuterDocAccessibles are expected to only have a document as a child.
+  // However for compatibility we tolerate replacing one document with another
+  // here.
+  if (outerDoc->ChildrenCount() > 1 ||
+      (outerDoc->ChildrenCount() == 1 && !outerDoc->ChildAt(0)->IsDoc())) {
+    return IPC_FAIL(this, "binding to proxy that can't be a outerDoc!");
+  }
+
+  if (outerDoc->ChildrenCount() == 1) {
+    MOZ_ASSERT(outerDoc->ChildAt(0)->AsDoc());
+    outerDoc->ChildAt(0)->AsDoc()->Unbind();
+  }
+
+  aChildDoc->SetParent(outerDoc);
+  outerDoc->SetChildDoc(aChildDoc);
+  mChildDocs.AppendElement(aChildDoc->mActorID);
+  aChildDoc->mParentDoc = mActorID;
+
+  if (aCreating) {
+    ProxyCreated(aChildDoc, Interfaces::DOCUMENT | Interfaces::HYPERTEXT);
+  }
+
+  if (aChildDoc->IsTopLevelInContentProcess()) {
+    // aChildDoc is an embedded document in a different content process to
+    // this document.
+    auto embeddedBrowser =
+        static_cast<dom::BrowserParent*>(aChildDoc->Manager());
+    dom::BrowserBridgeParent* bridge =
+        embeddedBrowser->GetBrowserBridgeParent();
+    if (bridge) {
+#if defined(XP_WIN)
+      // Send a COM proxy for the embedded document to the embedder process
+      // hosting the iframe. This will be returned as the child of the
+      // embedder OuterDocAccessible.
+      RefPtr<IDispatch> docAcc;
+      aChildDoc->GetCOMInterface((void**)getter_AddRefs(docAcc));
+      MOZ_ASSERT(docAcc);
+      if (docAcc) {
+        RefPtr<IDispatch> docWrapped(
+            mscom::PassthruProxy::Wrap<IDispatch>(WrapNotNull(docAcc)));
+        IDispatchHolder::COMPtrType docPtr(
+            mscom::ToProxyUniquePtr(std::move(docWrapped)));
+        IDispatchHolder docHolder(std::move(docPtr));
+        if (bridge->SendSetEmbeddedDocAccessibleCOMProxy(docHolder)) {
+#  if defined(MOZ_SANDBOX)
+          aChildDoc->mDocProxyStream = docHolder.GetPreservedStream();
+#  endif  // defined(MOZ_SANDBOX)
+        }
+      }
+      // Send a COM proxy for the embedder OuterDocAccessible to the embedded
+      // document process. This will be returned as the parent of the
+      // embedded document.
+      aChildDoc->SendParentCOMProxy(WrapperFor(outerDoc));
+      if (nsWinUtils::IsWindowEmulationStarted()) {
+        // The embedded document should use the same emulated window handle as
+        // its embedder. It will return the embedder document (not a window
+        // accessible) as the parent accessible, so we pass a null accessible
+        // when sending the window to the embedded document.
+        aChildDoc->SetEmulatedWindowHandle(mEmulatedWindowHandle);
+        Unused << aChildDoc->SendEmulatedWindow(
+            reinterpret_cast<uintptr_t>(mEmulatedWindowHandle), nullptr);
+      }
+      // Send a COM proxy for the top level document to the embedded document
+      // process. This will be returned when the client calls QueryService
+      // with SID_IAccessibleContentDocument on an accessible in the embedded
+      // document.
+      DocAccessibleParent* topDoc = this;
+      while (DocAccessibleParent* parentDoc = topDoc->ParentDoc()) {
+        topDoc = parentDoc;
+      }
+      MOZ_ASSERT(topDoc && topDoc->IsTopLevel());
+      RefPtr<IAccessible> topDocAcc;
+      topDoc->GetCOMInterface((void**)getter_AddRefs(topDocAcc));
+      MOZ_ASSERT(topDocAcc);
+      if (topDocAcc) {
+        RefPtr<IAccessible> topDocWrapped(
+            mscom::PassthruProxy::Wrap<IAccessible>(WrapNotNull(topDocAcc)));
+        IAccessibleHolder::COMPtrType topDocPtr(
+            mscom::ToProxyUniquePtr(std::move(topDocWrapped)));
+        IAccessibleHolder topDocHolder(std::move(topDocPtr));
+        if (aChildDoc->SendTopLevelDocCOMProxy(topDocHolder)) {
+#  if defined(MOZ_SANDBOX)
+          aChildDoc->mTopLevelDocProxyStream =
+              topDocHolder.GetPreservedStream();
+#  endif  // defined(MOZ_SANDBOX)
+        }
+      }
+#endif  // defined(XP_WIN)
+      // We need to fire a reorder event on the outer doc accessible.
+      // For same-process documents, this is fired by the content process, but
+      // this isn't possible when the document is in a different process to its
+      // embedder.
+      // RecvEvent fires both OS and XPCOM events.
+      Unused << RecvEvent(aParentID, nsIAccessibleEvent::EVENT_REORDER);
+    }
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleParent::RecvShutdown() {
+  Destroy();
+
+  auto mgr = static_cast<dom::BrowserParent*>(Manager());
+  if (!mgr->IsDestroyed()) {
+    if (!PDocAccessibleParent::Send__delete__(this)) {
+      return IPC_FAIL_NO_REASON(mgr);
+    }
+  }
+
+  return IPC_OK();
+}
+
+void DocAccessibleParent::Destroy() {
+  // If we are already shutdown that is because our containing tab parent is
+  // shutting down in which case we don't need to do anything.
+  if (mShutdown) {
+    return;
+  }
+
+  mShutdown = true;
+
+  MOZ_DIAGNOSTIC_ASSERT(LiveDocs().Contains(mActorID));
+  uint32_t childDocCount = mChildDocs.Length();
+  for (uint32_t i = 0; i < childDocCount; i++) {
+    for (uint32_t j = i + 1; j < childDocCount; j++) {
+      MOZ_DIAGNOSTIC_ASSERT(mChildDocs[i] != mChildDocs[j]);
+    }
+  }
+
+  // XXX This indirection through the hash map of live documents shouldn't be
+  // needed, but be paranoid for now.
+  int32_t actorID = mActorID;
+  for (uint32_t i = childDocCount - 1; i < childDocCount; i--) {
+    DocAccessibleParent* thisDoc = LiveDocs().Get(actorID);
+    MOZ_ASSERT(thisDoc);
+    if (!thisDoc) {
+      return;
+    }
+
+    thisDoc->ChildDocAt(i)->Destroy();
+  }
+
+  for (auto iter = mAccessibles.Iter(); !iter.Done(); iter.Next()) {
+    MOZ_ASSERT(iter.Get()->mProxy != this);
+    ProxyDestroyed(iter.Get()->mProxy);
+    iter.Remove();
+  }
+
+  DocAccessibleParent* thisDoc = LiveDocs().Get(actorID);
+  MOZ_ASSERT(thisDoc);
+  if (!thisDoc) {
+    return;
+  }
+
+  // The code above should have already completely cleared these, but to be
+  // extra safe make sure they are cleared here.
+  thisDoc->mAccessibles.Clear();
+  thisDoc->mChildDocs.Clear();
+
+  DocManager::NotifyOfRemoteDocShutdown(thisDoc);
+  thisDoc = LiveDocs().Get(actorID);
+  MOZ_ASSERT(thisDoc);
+  if (!thisDoc) {
+    return;
+  }
+
+  ProxyDestroyed(thisDoc);
+  thisDoc = LiveDocs().Get(actorID);
+  MOZ_ASSERT(thisDoc);
+  if (!thisDoc) {
+    return;
+  }
+
+  if (DocAccessibleParent* parentDoc = thisDoc->ParentDoc())
+    parentDoc->RemoveChildDoc(thisDoc);
+  else if (IsTopLevel())
+    GetAccService()->RemoteDocShutdown(this);
+}
+
+DocAccessibleParent* DocAccessibleParent::ParentDoc() const {
+  if (mParentDoc == kNoParentDoc) {
+    return nullptr;
+  }
+
+  return LiveDocs().Get(mParentDoc);
+}
+
+bool DocAccessibleParent::CheckDocTree() const {
+  size_t childDocs = mChildDocs.Length();
+  for (size_t i = 0; i < childDocs; i++) {
+    const DocAccessibleParent* childDoc = ChildDocAt(i);
+    if (!childDoc || childDoc->ParentDoc() != this) return false;
+
+    if (!childDoc->CheckDocTree()) {
+      return false;
+    }
+  }
+
+  return true;
+}
+
+xpcAccessibleGeneric* DocAccessibleParent::GetXPCAccessible(
+    ProxyAccessible* aProxy) {
+  xpcAccessibleDocument* doc = GetAccService()->GetXPCDocument(this);
+  MOZ_ASSERT(doc);
+
+  return doc->GetXPCAccessible(aProxy);
+}
+
+#if defined(XP_WIN)
+void DocAccessibleParent::MaybeInitWindowEmulation() {
+  if (!nsWinUtils::IsWindowEmulationStarted()) {
+    return;
+  }
+
+  // XXX get the bounds from the browserParent instead of poking at accessibles
+  // which might not exist yet.
+  Accessible* outerDoc = OuterDocOfRemoteBrowser();
+  if (!outerDoc) {
+    return;
+  }
+
+  RootAccessible* rootDocument = outerDoc->RootAccessible();
+  MOZ_ASSERT(rootDocument);
+
+  bool isActive = true;
+  nsIntRect rect(CW_USEDEFAULT, CW_USEDEFAULT, 0, 0);
+  if (Compatibility::IsDolphin()) {
+    rect = Bounds();
+    nsIntRect rootRect = rootDocument->Bounds();
+    rect.MoveToX(rootRect.X() - rect.X());
+    rect.MoveToY(rect.Y() - rootRect.Y());
+
+    auto browserParent = static_cast<dom::BrowserParent*>(Manager());
+    isActive = browserParent->GetDocShellIsActive();
+  }
+
+  // onCreate is guaranteed to be called synchronously by
+  // nsWinUtils::CreateNativeWindow, so this reference isn't really necessary.
+  // However, static analysis complains without it.
+  RefPtr<DocAccessibleParent> thisRef = this;
+  nsWinUtils::NativeWindowCreateProc onCreate([thisRef](HWND aHwnd) -> void {
+    IDispatchHolder hWndAccHolder;
+
+    ::SetPropW(aHwnd, kPropNameDocAccParent,
+               reinterpret_cast<HANDLE>(thisRef.get()));
+
+    thisRef->SetEmulatedWindowHandle(aHwnd);
+
+    RefPtr<IAccessible> hwndAcc;
+    if (SUCCEEDED(::AccessibleObjectFromWindow(
+            aHwnd, OBJID_WINDOW, IID_IAccessible, getter_AddRefs(hwndAcc)))) {
+      RefPtr<IDispatch> wrapped(
+          mscom::PassthruProxy::Wrap<IDispatch>(WrapNotNull(hwndAcc)));
+      hWndAccHolder.Set(IDispatchHolder::COMPtrType(
+          mscom::ToProxyUniquePtr(std::move(wrapped))));
+    }
+
+    Unused << thisRef->SendEmulatedWindow(
+        reinterpret_cast<uintptr_t>(thisRef->mEmulatedWindowHandle),
+        hWndAccHolder);
+  });
+
+  HWND parentWnd = reinterpret_cast<HWND>(rootDocument->GetNativeWindow());
+  DebugOnly<HWND> hWnd = nsWinUtils::CreateNativeWindow(
+      kClassNameTabContent, parentWnd, rect.X(), rect.Y(), rect.Width(),
+      rect.Height(), isActive, &onCreate);
+  MOZ_ASSERT(hWnd);
+}
+
+void DocAccessibleParent::SendParentCOMProxy(Accessible* aOuterDoc) {
+  // Make sure that we're not racing with a tab shutdown
+  auto tab = static_cast<dom::BrowserParent*>(Manager());
+  MOZ_ASSERT(tab);
+  if (tab->IsDestroyed()) {
+    return;
+  }
+
+  RefPtr<IAccessible> nativeAcc;
+  aOuterDoc->GetNativeInterface(getter_AddRefs(nativeAcc));
+  if (NS_WARN_IF(!nativeAcc)) {
+    // Couldn't get a COM proxy for the outer doc. That probably means it died,
+    // but the parent process hasn't received a message to remove it from the
+    // ProxyAccessible tree yet.
+    return;
+  }
+
+  RefPtr<IDispatch> wrapped(
+      mscom::PassthruProxy::Wrap<IDispatch>(WrapNotNull(nativeAcc)));
+
+  IDispatchHolder::COMPtrType ptr(mscom::ToProxyUniquePtr(std::move(wrapped)));
+  IDispatchHolder holder(std::move(ptr));
+  if (!PDocAccessibleParent::SendParentCOMProxy(holder)) {
+    return;
+  }
+
+#  if defined(MOZ_SANDBOX)
+  mParentProxyStream = holder.GetPreservedStream();
+#  endif  // defined(MOZ_SANDBOX)
+}
+
+void DocAccessibleParent::SetEmulatedWindowHandle(HWND aWindowHandle) {
+  if (!aWindowHandle && mEmulatedWindowHandle && IsTopLevel()) {
+    ::DestroyWindow(mEmulatedWindowHandle);
+  }
+  mEmulatedWindowHandle = aWindowHandle;
+}
+
+mozilla::ipc::IPCResult DocAccessibleParent::RecvGetWindowedPluginIAccessible(
+    const WindowsHandle& aHwnd, IAccessibleHolder* aPluginCOMProxy) {
+#  if defined(MOZ_SANDBOX)
+  // We don't actually want the accessible object for aHwnd, but rather the
+  // one that belongs to its child (see HTMLWin32ObjectAccessible).
+  HWND childWnd = ::GetWindow(reinterpret_cast<HWND>(aHwnd), GW_CHILD);
+  if (!childWnd) {
+    // We're seeing this in the wild - the plugin is windowed but we no longer
+    // have a window.
+    return IPC_OK();
+  }
+
+  IAccessible* rawAccPlugin = nullptr;
+  HRESULT hr = ::AccessibleObjectFromWindow(
+      childWnd, OBJID_WINDOW, IID_IAccessible, (void**)&rawAccPlugin);
+  if (FAILED(hr)) {
+    // This might happen if the plugin doesn't handle WM_GETOBJECT properly.
+    // We should not consider that a failure.
+    return IPC_OK();
+  }
+
+  aPluginCOMProxy->Set(IAccessibleHolder::COMPtrType(rawAccPlugin));
+
+  return IPC_OK();
+#  else
+  return IPC_FAIL(this, "Message unsupported in this build configuration");
+#  endif
+}
+
+mozilla::ipc::IPCResult DocAccessibleParent::RecvFocusEvent(
+    const uint64_t& aID, const LayoutDeviceIntRect& aCaretRect) {
+  if (mShutdown) {
+    return IPC_OK();
+  }
+
+  ProxyAccessible* proxy = GetAccessible(aID);
+  if (!proxy) {
+    NS_ERROR("no proxy for event!");
+    return IPC_OK();
+  }
+
+  ProxyFocusEvent(proxy, aCaretRect);
+
+  if (!nsCoreUtils::AccEventObserversExist()) {
+    return IPC_OK();
+  }
+
+  xpcAccessibleGeneric* xpcAcc = GetXPCAccessible(proxy);
+  xpcAccessibleDocument* doc = GetAccService()->GetXPCDocument(this);
+  nsINode* node = nullptr;
+  bool fromUser = true;  // XXX fix me
+  RefPtr<xpcAccEvent> event = new xpcAccEvent(nsIAccessibleEvent::EVENT_FOCUS,
+                                              xpcAcc, doc, node, fromUser);
+  nsCoreUtils::DispatchAccEvent(std::move(event));
+
+  return IPC_OK();
+}
+
+#endif  // defined(XP_WIN)
+
+#if !defined(XP_WIN)
+mozilla::ipc::IPCResult DocAccessibleParent::RecvBatch(
+    const uint64_t& aBatchType, nsTArray<BatchData>&& aData) {
+  // Only do something in Android. We can't ifdef the entire protocol out in
+  // the ipdl because it doesn't allow preprocessing.
+#  if defined(ANDROID)
+  if (mShutdown) {
+    return IPC_OK();
+  }
+  nsTArray<ProxyAccessible*> proxies(aData.Length());
+  for (size_t i = 0; i < aData.Length(); i++) {
+    DocAccessibleParent* doc = static_cast<DocAccessibleParent*>(
+        aData.ElementAt(i).Document().get_PDocAccessibleParent());
+    MOZ_ASSERT(doc);
+
+    if (doc->IsShutdown()) {
+      continue;
+    }
+
+    ProxyAccessible* proxy = doc->GetAccessible(aData.ElementAt(i).ID());
+    if (!proxy) {
+      MOZ_ASSERT_UNREACHABLE("No proxy found!");
+      continue;
+    }
+
+    proxies.AppendElement(proxy);
+  }
+  ProxyBatch(this, aBatchType, proxies, aData);
+#  endif  // defined(XP_WIN)
+  return IPC_OK();
+}
+
+bool DocAccessibleParent::DeallocPDocAccessiblePlatformExtParent(
+    PDocAccessiblePlatformExtParent* aActor) {
+  delete aActor;
+  return true;
+}
+
+PDocAccessiblePlatformExtParent*
+DocAccessibleParent::AllocPDocAccessiblePlatformExtParent() {
+  return new DocAccessiblePlatformExtParent();
+}
+
+DocAccessiblePlatformExtParent* DocAccessibleParent::GetPlatformExtension() {
+  return static_cast<DocAccessiblePlatformExtParent*>(
+      SingleManagedOrNull(ManagedPDocAccessiblePlatformExtParent()));
+}
+
+#endif  // !defined(XP_WIN)
+
+Tuple<DocAccessibleParent*, uint64_t> DocAccessibleParent::GetRemoteEmbedder() {
+  dom::BrowserParent* embeddedBrowser = dom::BrowserParent::GetFrom(Manager());
+  dom::BrowserBridgeParent* bridge = embeddedBrowser->GetBrowserBridgeParent();
+  if (!bridge) {
+    return Tuple<DocAccessibleParent*, uint64_t>(nullptr, 0);
+  }
+  DocAccessibleParent* doc;
+  uint64_t id;
+  Tie(doc, id) = bridge->GetEmbedderAccessible();
+  if (doc && doc->IsShutdown()) {
+    // Sometimes, the embedder document is destroyed before its
+    // BrowserBridgeParent. Don't return a destroyed document.
+    doc = nullptr;
+    id = 0;
+  }
+  return Tuple<DocAccessibleParent*, uint64_t>(doc, id);
+}
+
+}  // namespace a11y
+}  // namespace mozilla
diff --git a/accessible/ipc/DocAccessibleParent.h b/accessible/ipc/DocAccessibleParent.h
new file mode 100644
index 0000000000..9d7919c008
--- /dev/null
+++ b/accessible/ipc/DocAccessibleParent.h
@@ -0,0 +1,348 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_a11y_DocAccessibleParent_h
+#define mozilla_a11y_DocAccessibleParent_h
+
+#include "nsAccessibilityService.h"
+#include "mozilla/a11y/PDocAccessibleParent.h"
+#include "mozilla/a11y/ProxyAccessible.h"
+#include "mozilla/Tuple.h"
+#include "nsClassHashtable.h"
+#include "nsHashKeys.h"
+#include "nsISupportsImpl.h"
+
+namespace mozilla {
+namespace a11y {
+
+class xpcAccessibleGeneric;
+
+#if !defined(XP_WIN)
+class DocAccessiblePlatformExtParent;
+#endif
+
+/*
+ * These objects live in the main process and comunicate with and represent
+ * an accessible document in a content process.
+ */
+class DocAccessibleParent : public ProxyAccessible,
+                            public PDocAccessibleParent {
+ public:
+  NS_INLINE_DECL_REFCOUNTING(DocAccessibleParent);
+
+  DocAccessibleParent()
+      : ProxyAccessible(this),
+        mParentDoc(kNoParentDoc),
+#if defined(XP_WIN)
+        mEmulatedWindowHandle(nullptr),
+#endif  // defined(XP_WIN)
+        mTopLevel(false),
+        mTopLevelInContentProcess(false),
+        mShutdown(false) {
+    sMaxDocID++;
+    mActorID = sMaxDocID;
+    MOZ_ASSERT(!LiveDocs().Get(mActorID));
+    LiveDocs().Put(mActorID, this);
+  }
+
+  /**
+   * Set this as a top level document; i.e. it is not embedded by another remote
+   * document. This also means it is a top level document in its content
+   * process.
+   * Tab documents are top level documents.
+   */
+  void SetTopLevel() {
+    mTopLevel = true;
+    mTopLevelInContentProcess = true;
+  }
+  bool IsTopLevel() const { return mTopLevel; }
+
+  /**
+   * Set this as a top level document in its content process.
+   * Note that this could be an out-of-process iframe embedded by a remote
+   * embedder document. In that case, IsToplevel() will return false, but
+   * IsTopLevelInContentProcess() will return true.
+   */
+  void SetTopLevelInContentProcess() { mTopLevelInContentProcess = true; }
+  bool IsTopLevelInContentProcess() const { return mTopLevelInContentProcess; }
+
+  bool IsShutdown() const { return mShutdown; }
+
+  /**
+   * Mark this actor as shutdown without doing any cleanup.  This should only
+   * be called on actors that have just been initialized, so probably only from
+   * RecvPDocAccessibleConstructor.
+   */
+  void MarkAsShutdown() {
+    MOZ_ASSERT(mChildDocs.IsEmpty());
+    MOZ_ASSERT(mAccessibles.Count() == 0);
+    mShutdown = true;
+  }
+
+  /*
+   * Called when a message from a document in a child process notifies the main
+   * process it is firing an event.
+   */
+  virtual mozilla::ipc::IPCResult RecvEvent(const uint64_t& aID,
+                                            const uint32_t& aType) override;
+
+  virtual mozilla::ipc::IPCResult RecvShowEvent(const ShowEventData& aData,
+                                                const bool& aFromUser) override;
+  virtual mozilla::ipc::IPCResult RecvHideEvent(const uint64_t& aRootID,
+                                                const bool& aFromUser) override;
+  mozilla::ipc::IPCResult RecvStateChangeEvent(const uint64_t& aID,
+                                               const uint64_t& aState,
+                                               const bool& aEnabled) final;
+
+  mozilla::ipc::IPCResult RecvCaretMoveEvent(
+      const uint64_t& aID,
+#if defined(XP_WIN)
+      const LayoutDeviceIntRect& aCaretRect,
+#endif
+      const int32_t& aOffset, const bool& aIsSelectionCollapsed) final;
+
+  virtual mozilla::ipc::IPCResult RecvTextChangeEvent(
+      const uint64_t& aID, const nsString& aStr, const int32_t& aStart,
+      const uint32_t& aLen, const bool& aIsInsert,
+      const bool& aFromUser) override;
+
+#if defined(XP_WIN)
+  virtual mozilla::ipc::IPCResult RecvSyncTextChangeEvent(
+      const uint64_t& aID, const nsString& aStr, const int32_t& aStart,
+      const uint32_t& aLen, const bool& aIsInsert,
+      const bool& aFromUser) override;
+
+  virtual mozilla::ipc::IPCResult RecvFocusEvent(
+      const uint64_t& aID, const LayoutDeviceIntRect& aCaretRect) override;
+#endif  // defined(XP_WIN)
+
+  virtual mozilla::ipc::IPCResult RecvSelectionEvent(
+      const uint64_t& aID, const uint64_t& aWidgetID,
+      const uint32_t& aType) override;
+
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY
+  virtual mozilla::ipc::IPCResult RecvVirtualCursorChangeEvent(
+      const uint64_t& aID, const uint64_t& aOldPositionID,
+      const int32_t& aOldStartOffset, const int32_t& aOldEndOffset,
+      const uint64_t& aNewPositionID, const int32_t& aNewStartOffset,
+      const int32_t& aNewEndOffset, const int16_t& aReason,
+      const int16_t& aBoundaryType, const bool& aFromUser) override;
+
+  virtual mozilla::ipc::IPCResult RecvScrollingEvent(
+      const uint64_t& aID, const uint64_t& aType, const uint32_t& aScrollX,
+      const uint32_t& aScrollY, const uint32_t& aMaxScrollX,
+      const uint32_t& aMaxScrollY) override;
+
+#if !defined(XP_WIN)
+  virtual mozilla::ipc::IPCResult RecvAnnouncementEvent(
+      const uint64_t& aID, const nsString& aAnnouncement,
+      const uint16_t& aPriority) override;
+
+  virtual mozilla::ipc::IPCResult RecvTextSelectionChangeEvent(
+      const uint64_t& aID, nsTArray<TextRangeData>&& aSelection) override;
+#endif
+
+  mozilla::ipc::IPCResult RecvRoleChangedEvent(const a11y::role& aRole) final;
+
+  virtual mozilla::ipc::IPCResult RecvBindChildDoc(
+      PDocAccessibleParent* aChildDoc, const uint64_t& aID) override;
+
+  void Unbind() {
+    if (DocAccessibleParent* parent = ParentDoc()) {
+      parent->RemoveChildDoc(this);
+    }
+
+    SetParent(nullptr);
+  }
+
+  virtual mozilla::ipc::IPCResult RecvShutdown() override;
+  void Destroy();
+  virtual void ActorDestroy(ActorDestroyReason aWhy) override {
+    MOZ_ASSERT(CheckDocTree());
+    if (!mShutdown) Destroy();
+  }
+
+  /*
+   * Return the main processes representation of the parent document (if any)
+   * of the document this object represents.
+   */
+  DocAccessibleParent* ParentDoc() const;
+  static const uint64_t kNoParentDoc = UINT64_MAX;
+
+  /*
+   * Called when a document in a content process notifies the main process of a
+   * new child document.
+   */
+  ipc::IPCResult AddChildDoc(DocAccessibleParent* aChildDoc, uint64_t aParentID,
+                             bool aCreating = true);
+
+  /*
+   * Called when the document in the content process this object represents
+   * notifies the main process a child document has been removed.
+   */
+  void RemoveChildDoc(DocAccessibleParent* aChildDoc) {
+    ProxyAccessible* parent = aChildDoc->Parent();
+    MOZ_ASSERT(parent);
+    if (parent) {
+      aChildDoc->Parent()->ClearChildDoc(aChildDoc);
+    }
+    DebugOnly<bool> result = mChildDocs.RemoveElement(aChildDoc->mActorID);
+    aChildDoc->mParentDoc = kNoParentDoc;
+    MOZ_ASSERT(result);
+  }
+
+  void RemoveAccessible(ProxyAccessible* aAccessible) {
+    MOZ_DIAGNOSTIC_ASSERT(mAccessibles.GetEntry(aAccessible->ID()));
+    mAccessibles.RemoveEntry(aAccessible->ID());
+  }
+
+  /**
+   * Return the accessible for given id.
+   */
+  ProxyAccessible* GetAccessible(uintptr_t aID) {
+    if (!aID) return this;
+
+    ProxyEntry* e = mAccessibles.GetEntry(aID);
+    return e ? e->mProxy : nullptr;
+  }
+
+  const ProxyAccessible* GetAccessible(uintptr_t aID) const {
+    return const_cast<DocAccessibleParent*>(this)->GetAccessible(aID);
+  }
+
+  size_t ChildDocCount() const { return mChildDocs.Length(); }
+  const DocAccessibleParent* ChildDocAt(size_t aIdx) const {
+    return const_cast<DocAccessibleParent*>(this)->ChildDocAt(aIdx);
+  }
+  DocAccessibleParent* ChildDocAt(size_t aIdx) {
+    return LiveDocs().Get(mChildDocs[aIdx]);
+  }
+
+#if defined(XP_WIN)
+  void MaybeInitWindowEmulation();
+
+  /**
+   * Note that an OuterDocAccessible can be created before the
+   * DocAccessibleParent or vice versa. Therefore, this must be conditionally
+   * called when either of these is created.
+   * @param aOuterDoc The OuterDocAccessible to be returned as the parent of
+   *        this document. Only GetNativeInterface() is called on this, so it
+   *        may be a ProxyAccessibleWrap or similar.
+   */
+  void SendParentCOMProxy(Accessible* aOuterDoc);
+
+  virtual mozilla::ipc::IPCResult RecvGetWindowedPluginIAccessible(
+      const WindowsHandle& aHwnd, IAccessibleHolder* aPluginCOMProxy) override;
+
+  /**
+   * Set emulated native window handle for a document.
+   * @param aWindowHandle emulated native window handle
+   */
+  void SetEmulatedWindowHandle(HWND aWindowHandle);
+  HWND GetEmulatedWindowHandle() const { return mEmulatedWindowHandle; }
+#endif
+
+#if !defined(XP_WIN)
+  virtual mozilla::ipc::IPCResult RecvBatch(
+      const uint64_t& aBatchType, nsTArray<BatchData>&& aData) override;
+
+  virtual bool DeallocPDocAccessiblePlatformExtParent(
+      PDocAccessiblePlatformExtParent* aActor) override;
+
+  virtual PDocAccessiblePlatformExtParent*
+  AllocPDocAccessiblePlatformExtParent() override;
+
+  DocAccessiblePlatformExtParent* GetPlatformExtension();
+#endif
+
+  /**
+   * If this is an iframe document rendered in a different process to its
+   * embedder, return the DocAccessibleParent and id for the embedder
+   * accessible. Otherwise, return null and 0.
+   */
+  Tuple<DocAccessibleParent*, uint64_t> GetRemoteEmbedder();
+
+ private:
+  ~DocAccessibleParent() {
+    LiveDocs().Remove(mActorID);
+    MOZ_ASSERT(mChildDocs.Length() == 0);
+    MOZ_ASSERT(!ParentDoc());
+  }
+
+  class ProxyEntry : public PLDHashEntryHdr {
+   public:
+    explicit ProxyEntry(const void*) : mProxy(nullptr) {}
+    ProxyEntry(ProxyEntry&& aOther) : mProxy(aOther.mProxy) {
+      aOther.mProxy = nullptr;
+    }
+    ~ProxyEntry() { delete mProxy; }
+
+    typedef uint64_t KeyType;
+    typedef const void* KeyTypePointer;
+
+    bool KeyEquals(const void* aKey) const {
+      return mProxy->ID() == (uint64_t)aKey;
+    }
+
+    static const void* KeyToPointer(uint64_t aKey) { return (void*)aKey; }
+
+    static PLDHashNumber HashKey(const void* aKey) { return (uint64_t)aKey; }
+
+    enum { ALLOW_MEMMOVE = true };
+
+    ProxyAccessible* mProxy;
+  };
+
+  uint32_t AddSubtree(ProxyAccessible* aParent,
+                      const nsTArray<AccessibleData>& aNewTree, uint32_t aIdx,
+                      uint32_t aIdxInParent);
+  [[nodiscard]] bool CheckDocTree() const;
+  xpcAccessibleGeneric* GetXPCAccessible(ProxyAccessible* aProxy);
+
+  nsTArray<uint64_t> mChildDocs;
+  uint64_t mParentDoc;
+
+#if defined(XP_WIN)
+  // The handle associated with the emulated window that contains this document
+  HWND mEmulatedWindowHandle;
+
+#  if defined(MOZ_SANDBOX)
+  mscom::PreservedStreamPtr mParentProxyStream;
+  mscom::PreservedStreamPtr mDocProxyStream;
+  mscom::PreservedStreamPtr mTopLevelDocProxyStream;
+#  endif  // defined(MOZ_SANDBOX)
+#endif    // defined(XP_WIN)
+
+  /*
+   * Conceptually this is a map from IDs to proxies, but we store the ID in the
+   * proxy object so we can't use a real map.
+   */
+  nsTHashtable<ProxyEntry> mAccessibles;
+  uint64_t mActorID;
+  bool mTopLevel;
+  bool mTopLevelInContentProcess;
+  bool mShutdown;
+
+  struct PendingChildDoc {
+    PendingChildDoc(DocAccessibleParent* aChildDoc, uint64_t aParentID)
+        : mChildDoc(aChildDoc), mParentID(aParentID) {}
+    RefPtr<DocAccessibleParent> mChildDoc;
+    uint64_t mParentID;
+  };
+  // We use nsTArray because there will be very few entries.
+  nsTArray<PendingChildDoc> mPendingChildDocs;
+
+  static uint64_t sMaxDocID;
+  static nsDataHashtable<nsUint64HashKey, DocAccessibleParent*>& LiveDocs() {
+    static nsDataHashtable<nsUint64HashKey, DocAccessibleParent*> sLiveDocs;
+    return sLiveDocs;
+  }
+};
+
+}  // namespace a11y
+}  // namespace mozilla
+
+#endif
diff --git a/accessible/ipc/IPCTypes.h b/accessible/ipc/IPCTypes.h
new file mode 100644
index 0000000000..689c5c3d09
--- /dev/null
+++ b/accessible/ipc/IPCTypes.h
@@ -0,0 +1,103 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_a11y_IPCTypes_h
+#define mozilla_a11y_IPCTypes_h
+
+#ifdef ACCESSIBILITY
+#  include "mozilla/a11y/Role.h"
+#  include "ipc/EnumSerializer.h"
+
+namespace IPC {
+
+template <>
+struct ParamTraits<mozilla::a11y::role>
+    : public ContiguousEnumSerializerInclusive<mozilla::a11y::role,
+                                               mozilla::a11y::role::NOTHING,
+                                               mozilla::a11y::role::LAST_ROLE> {
+};
+
+}  // namespace IPC
+#else
+namespace mozilla {
+namespace a11y {
+typedef uint32_t role;
+}  // namespace a11y
+}  // namespace mozilla
+#endif  // ACCESSIBILITY
+
+/**
+ * Since IPDL does not support preprocessing, this header file allows us to
+ * define types used by PDocAccessible differently depending on platform.
+ */
+
+#if defined(XP_WIN) && defined(ACCESSIBILITY)
+
+// So that we don't include a bunch of other Windows junk.
+#  if !defined(COM_NO_WINDOWS_H)
+#    define COM_NO_WINDOWS_H
+#  endif  // !defined(COM_NO_WINDOWS_H)
+
+// COM headers pull in MSXML which conflicts with our own XMLDocument class.
+// This define excludes those conflicting definitions.
+#  if !defined(__XMLDocument_FWD_DEFINED__)
+#    define __XMLDocument_FWD_DEFINED__
+#  endif  // !defined(__XMLDocument_FWD_DEFINED__)
+
+#  include <combaseapi.h>
+
+#  include "mozilla/a11y/COMPtrTypes.h"
+
+// This define in rpcndr.h messes up our code, so we must undefine it after
+// COMPtrTypes.h has been included.
+#  if defined(small)
+#    undef small
+#  endif  // defined(small)
+
+#else
+
+namespace mozilla {
+namespace a11y {
+
+typedef uint32_t IAccessibleHolder;
+typedef uint32_t IDispatchHolder;
+typedef uint32_t IHandlerControlHolder;
+
+}  // namespace a11y
+}  // namespace mozilla
+
+#endif  // defined(XP_WIN) && defined(ACCESSIBILITY)
+
+#if defined(MOZ_WIDGET_COCOA)
+#  if defined(ACCESSIBILITY)
+#    include "mozilla/a11y/PlatformExtTypes.h"
+namespace IPC {
+
+template <>
+struct ParamTraits<mozilla::a11y::EWhichRange>
+    : public ContiguousEnumSerializerInclusive<
+          mozilla::a11y::EWhichRange, mozilla::a11y::EWhichRange::eLeftWord,
+          mozilla::a11y::EWhichRange::eStyle> {};
+
+template <>
+struct ParamTraits<mozilla::a11y::EWhichPostFilter>
+    : public ContiguousEnumSerializerInclusive<
+          mozilla::a11y::EWhichPostFilter,
+          mozilla::a11y::EWhichPostFilter::eContainsText,
+          mozilla::a11y::EWhichPostFilter::eContainsText> {};
+
+}  // namespace IPC
+
+#  else
+namespace mozilla {
+namespace a11y {
+typedef uint32_t EWhichRange;
+}  // namespace a11y
+}  // namespace mozilla
+#  endif  // defined(ACCESSIBILITY)
+#endif    // defined(MOZ_WIDGET_COCOA)
+
+#endif  // mozilla_a11y_IPCTypes_h
diff --git a/accessible/ipc/ProxyAccessibleBase.cpp b/accessible/ipc/ProxyAccessibleBase.cpp
new file mode 100644
index 0000000000..d0264ce86c
--- /dev/null
+++ b/accessible/ipc/ProxyAccessibleBase.cpp
@@ -0,0 +1,169 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "DocAccessible.h"
+#include "mozilla/a11y/DocAccessibleParent.h"
+#include "mozilla/a11y/DocManager.h"
+#include "mozilla/a11y/Platform.h"
+#include "mozilla/a11y/ProxyAccessibleBase.h"
+#include "mozilla/a11y/ProxyAccessible.h"
+#include "mozilla/a11y/Role.h"
+#include "mozilla/dom/Element.h"
+#include "mozilla/dom/BrowserParent.h"
+#include "mozilla/Unused.h"
+#include "RelationType.h"
+#include "xpcAccessibleDocument.h"
+
+namespace mozilla {
+namespace a11y {
+
+template <class Derived>
+void ProxyAccessibleBase<Derived>::Shutdown() {
+  MOZ_DIAGNOSTIC_ASSERT(!IsDoc());
+  xpcAccessibleDocument* xpcDoc =
+      GetAccService()->GetCachedXPCDocument(Document());
+  if (xpcDoc) {
+    xpcDoc->NotifyOfShutdown(static_cast<Derived*>(this));
+  }
+
+  // XXX Ideally  this wouldn't be necessary, but it seems OuterDoc accessibles
+  // can be destroyed before the doc they own.
+  uint32_t childCount = mChildren.Length();
+  if (!mOuterDoc) {
+    for (uint32_t idx = 0; idx < childCount; idx++) mChildren[idx]->Shutdown();
+  } else {
+    if (childCount > 1) {
+      MOZ_CRASH("outer doc has too many documents!");
+    } else if (childCount == 1) {
+      mChildren[0]->AsDoc()->Unbind();
+    }
+  }
+
+  mChildren.Clear();
+  ProxyDestroyed(static_cast<Derived*>(this));
+  mDoc->RemoveAccessible(static_cast<Derived*>(this));
+}
+
+template <class Derived>
+void ProxyAccessibleBase<Derived>::SetChildDoc(DocAccessibleParent* aChildDoc) {
+  MOZ_ASSERT(aChildDoc);
+  MOZ_ASSERT(mChildren.Length() == 0);
+  mChildren.AppendElement(aChildDoc);
+  mOuterDoc = true;
+}
+
+template <class Derived>
+void ProxyAccessibleBase<Derived>::ClearChildDoc(
+    DocAccessibleParent* aChildDoc) {
+  MOZ_ASSERT(aChildDoc);
+  // This is possible if we're replacing one document with another: Doc 1
+  // has not had a chance to remove itself, but was already replaced by Doc 2
+  // in SetChildDoc(). This could result in two subsequent calls to
+  // ClearChildDoc() even though mChildren.Length() == 1.
+  MOZ_ASSERT(mChildren.Length() <= 1);
+  mChildren.RemoveElement(aChildDoc);
+}
+
+template <class Derived>
+uint32_t ProxyAccessibleBase<Derived>::EmbeddedChildCount() const {
+  size_t count = 0, kids = mChildren.Length();
+  for (size_t i = 0; i < kids; i++) {
+    if (mChildren[i]->IsEmbeddedObject()) {
+      count++;
+    }
+  }
+
+  return count;
+}
+
+template <class Derived>
+int32_t ProxyAccessibleBase<Derived>::IndexOfEmbeddedChild(
+    const Derived* aChild) {
+  size_t index = 0, kids = mChildren.Length();
+  for (size_t i = 0; i < kids; i++) {
+    if (mChildren[i]->IsEmbeddedObject()) {
+      if (mChildren[i] == aChild) {
+        return index;
+      }
+
+      index++;
+    }
+  }
+
+  return -1;
+}
+
+template <class Derived>
+Derived* ProxyAccessibleBase<Derived>::EmbeddedChildAt(size_t aChildIdx) {
+  size_t index = 0, kids = mChildren.Length();
+  for (size_t i = 0; i < kids; i++) {
+    if (!mChildren[i]->IsEmbeddedObject()) {
+      continue;
+    }
+
+    if (index == aChildIdx) {
+      return mChildren[i];
+    }
+
+    index++;
+  }
+
+  return nullptr;
+}
+
+template <class Derived>
+Accessible* ProxyAccessibleBase<Derived>::OuterDocOfRemoteBrowser() const {
+  auto tab = static_cast<dom::BrowserParent*>(mDoc->Manager());
+  dom::Element* frame = tab->GetOwnerElement();
+  NS_ASSERTION(frame, "why isn't the tab in a frame!");
+  if (!frame) return nullptr;
+
+  DocAccessible* chromeDoc = GetExistingDocAccessible(frame->OwnerDoc());
+
+  return chromeDoc ? chromeDoc->GetAccessible(frame) : nullptr;
+}
+
+template <class Derived>
+void ProxyAccessibleBase<Derived>::SetParent(Derived* aParent) {
+  MOZ_ASSERT(IsDoc(), "we should only reparent documents");
+  if (!aParent) {
+    mParent = kNoParent;
+  } else {
+    MOZ_ASSERT(!aParent->IsDoc());
+    mParent = aParent->ID();
+  }
+}
+
+template <class Derived>
+Derived* ProxyAccessibleBase<Derived>::Parent() const {
+  if (mParent == kNoParent) {
+    return nullptr;
+  }
+
+  // if we are not a document then are parent is another proxy in the same
+  // document.  That means we can just ask our document for the proxy with our
+  // parent id.
+  if (!IsDoc()) {
+    return Document()->GetAccessible(mParent);
+  }
+
+  // If we are a top level document then our parent is not a proxy.
+  if (AsDoc()->IsTopLevel()) {
+    return nullptr;
+  }
+
+  // Finally if we are a non top level document then our parent id is for a
+  // proxy in our parent document so get the proxy from there.
+  DocAccessibleParent* parentDoc = AsDoc()->ParentDoc();
+  MOZ_ASSERT(parentDoc);
+  MOZ_ASSERT(mParent);
+  return parentDoc->GetAccessible(mParent);
+}
+
+template class ProxyAccessibleBase<ProxyAccessible>;
+
+}  // namespace a11y
+}  // namespace mozilla
diff --git a/accessible/ipc/ProxyAccessibleBase.h b/accessible/ipc/ProxyAccessibleBase.h
new file mode 100644
index 0000000000..c3ddd817ba
--- /dev/null
+++ b/accessible/ipc/ProxyAccessibleBase.h
@@ -0,0 +1,219 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_a11y_ProxyAccessibleBase_h
+#define mozilla_a11y_ProxyAccessibleBase_h
+
+#include "mozilla/a11y/Role.h"
+#include "nsIAccessibleText.h"
+#include "nsIAccessibleTypes.h"
+#include "Accessible.h"
+#include "nsString.h"
+#include "nsTArray.h"
+#include "nsRect.h"
+#include "Accessible.h"
+
+namespace mozilla {
+namespace a11y {
+
+class Accessible;
+class Attribute;
+class DocAccessibleParent;
+class ProxyAccessible;
+enum class RelationType;
+
+enum Interfaces {
+  HYPERTEXT = 1,
+  HYPERLINK = 1 << 1,
+  IMAGE = 1 << 2,
+  VALUE = 1 << 3,
+  TABLE = 1 << 4,
+  TABLECELL = 1 << 5,
+  DOCUMENT = 1 << 6,
+  SELECTION = 1 << 7,
+  ACTION = 1 << 8,
+};
+
+template <class Derived>
+class ProxyAccessibleBase {
+ public:
+  ~ProxyAccessibleBase() { MOZ_ASSERT(!mWrapper); }
+
+  void AddChildAt(uint32_t aIdx, Derived* aChild) {
+    mChildren.InsertElementAt(aIdx, aChild);
+  }
+
+  uint32_t ChildrenCount() const { return mChildren.Length(); }
+  Derived* ChildAt(uint32_t aIdx) const { return mChildren[aIdx]; }
+  Derived* FirstChild() const {
+    return mChildren.Length() ? mChildren[0] : nullptr;
+  }
+  Derived* LastChild() const {
+    return mChildren.Length() ? mChildren[mChildren.Length() - 1] : nullptr;
+  }
+  Derived* PrevSibling() const {
+    int32_t idx = IndexInParent();
+    if (idx == -1) {
+      return nullptr;  // No parent.
+    }
+    return idx > 0 ? Parent()->mChildren[idx - 1] : nullptr;
+  }
+  Derived* NextSibling() const {
+    int32_t idx = IndexInParent();
+    if (idx == -1) {
+      return nullptr;  // No parent.
+    }
+    MOZ_ASSERT(idx >= 0);
+    size_t newIdx = idx + 1;
+    return newIdx < Parent()->mChildren.Length() ? Parent()->mChildren[newIdx]
+                                                 : nullptr;
+  }
+
+  // XXX evaluate if this is fast enough.
+  int32_t IndexInParent() const {
+    Derived* parent = Parent();
+    if (!parent) {
+      return -1;
+    }
+    return parent->mChildren.IndexOf(static_cast<const Derived*>(this));
+  }
+  uint32_t EmbeddedChildCount() const;
+  int32_t IndexOfEmbeddedChild(const Derived* aChild);
+  Derived* EmbeddedChildAt(size_t aChildIdx);
+
+  void Shutdown();
+
+  void SetChildDoc(DocAccessibleParent* aChildDoc);
+  void ClearChildDoc(DocAccessibleParent* aChildDoc);
+
+  /**
+   * Remove The given child.
+   */
+  void RemoveChild(Derived* aChild) { mChildren.RemoveElement(aChild); }
+
+  /**
+   * Return the proxy for the parent of the wrapped accessible.
+   */
+  Derived* Parent() const;
+
+  Accessible* OuterDocOfRemoteBrowser() const;
+
+  /**
+   * Get the role of the accessible we're proxying.
+   */
+  role Role() const { return mRole; }
+
+  /**
+   * Return true if this is an embedded object.
+   */
+  bool IsEmbeddedObject() const {
+    role role = Role();
+    return role != roles::TEXT_LEAF && role != roles::WHITESPACE &&
+           role != roles::STATICTEXT;
+  }
+
+  /**
+   * Allow the platform to store a pointers worth of data on us.
+   */
+  uintptr_t GetWrapper() const { return mWrapper; }
+  void SetWrapper(uintptr_t aWrapper) { mWrapper = aWrapper; }
+
+  /*
+   * Return the ID of the accessible being proxied.
+   */
+  uint64_t ID() const { return mID; }
+
+  /**
+   * Return the document containing this proxy, or the proxy itself if it is a
+   * document.
+   */
+  DocAccessibleParent* Document() const { return mDoc; }
+
+  /**
+   * Return true if this proxy is a DocAccessibleParent.
+   */
+  bool IsDoc() const { return mIsDoc; }
+  DocAccessibleParent* AsDoc() const { return IsDoc() ? mDoc : nullptr; }
+
+  // XXX checking mRole alone may not result in same behavior as Accessibles
+  // due to ARIA roles. See bug 1210477.
+  inline bool IsTable() const {
+    return mRole == roles::TABLE || mRole == roles::MATHML_TABLE;
+  }
+  inline bool IsTableRow() const {
+    return (mRole == roles::ROW || mRole == roles::MATHML_TABLE_ROW ||
+            mRole == roles::MATHML_LABELED_ROW);
+  }
+  inline bool IsTableCell() const {
+    return (mRole == roles::CELL || mRole == roles::COLUMNHEADER ||
+            mRole == roles::ROWHEADER || mRole == roles::GRID_CELL ||
+            mRole == roles::MATHML_CELL);
+  }
+
+ protected:
+  ProxyAccessibleBase(uint64_t aID, Derived* aParent, DocAccessibleParent* aDoc,
+                      role aRole, uint32_t aInterfaces)
+      : mParent(aParent->ID()),
+        mDoc(aDoc),
+        mWrapper(0),
+        mID(aID),
+        mRole(aRole),
+        mOuterDoc(false),
+        mIsDoc(false),
+        mHasValue(aInterfaces & Interfaces::VALUE),
+        mIsHyperLink(aInterfaces & Interfaces::HYPERLINK),
+        mIsHyperText(aInterfaces & Interfaces::HYPERTEXT),
+        mIsSelection(aInterfaces & Interfaces::SELECTION) {}
+
+  explicit ProxyAccessibleBase(DocAccessibleParent* aThisAsDoc)
+      : mParent(kNoParent),
+        mDoc(aThisAsDoc),
+        mWrapper(0),
+        mID(0),
+        mRole(roles::DOCUMENT),
+        mOuterDoc(false),
+        mIsDoc(true),
+        mHasValue(false),
+        mIsHyperLink(false),
+        mIsHyperText(false),
+        mIsSelection(false) {}
+
+ protected:
+  void SetParent(Derived* aParent);
+
+ private:
+  uintptr_t mParent;
+  static const uintptr_t kNoParent = UINTPTR_MAX;
+
+  friend Derived;
+
+  nsTArray<Derived*> mChildren;
+  DocAccessibleParent* mDoc;
+  uintptr_t mWrapper;
+  uint64_t mID;
+
+ protected:
+  // XXX DocAccessibleParent gets to change this to change the role of
+  // documents.
+  role mRole : 27;
+
+ private:
+  bool mOuterDoc : 1;
+
+ public:
+  const bool mIsDoc : 1;
+  const bool mHasValue : 1;
+  const bool mIsHyperLink : 1;
+  const bool mIsHyperText : 1;
+  const bool mIsSelection : 1;
+};
+
+extern template class ProxyAccessibleBase<ProxyAccessible>;
+
+}  // namespace a11y
+}  // namespace mozilla
+
+#endif
diff --git a/accessible/ipc/ProxyAccessibleShared.h b/accessible/ipc/ProxyAccessibleShared.h
new file mode 100644
index 0000000000..d6538b9354
--- /dev/null
+++ b/accessible/ipc/ProxyAccessibleShared.h
@@ -0,0 +1,272 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_a11y_ProxyAccessibleShared_h
+#define mozilla_a11y_ProxyAccessibleShared_h
+
+/**
+ * These are function declarations shared between win/ProxyAccessible.h and
+ * other/ProxyAccessible.h.
+ */
+
+/*
+ * Return the states for the proxied accessible.
+ */
+uint64_t State() const;
+
+/*
+ * Return the native states for the proxied accessible.
+ */
+uint64_t NativeState() const;
+
+/*
+ * Set aName to the name of the proxied accessible.
+ * Return the ENameValueFlag passed from Accessible::Name
+ */
+uint32_t Name(nsString& aName) const;
+
+/*
+ * Set aValue to the value of the proxied accessible.
+ */
+void Value(nsString& aValue) const;
+
+/*
+ * Set aHelp to the help string of the proxied accessible.
+ */
+void Help(nsString& aHelp) const;
+
+/**
+ * Set aDesc to the description of the proxied accessible.
+ */
+void Description(nsString& aDesc) const;
+
+/**
+ * Get the set of attributes on the proxied accessible.
+ */
+void Attributes(nsTArray<Attribute>* aAttrs) const;
+
+/**
+ * Return set of targets of given relation type.
+ */
+nsTArray<ProxyAccessible*> RelationByType(RelationType aType) const;
+
+/**
+ * Get all relations for this accessible.
+ */
+void Relations(nsTArray<RelationType>* aTypes,
+               nsTArray<nsTArray<ProxyAccessible*>>* aTargetSets) const;
+
+bool IsSearchbox() const;
+
+nsAtom* LandmarkRole() const;
+
+nsStaticAtom* ARIARoleAtom() const;
+
+mozilla::a11y::GroupPos GroupPosition();
+void ScrollTo(uint32_t aScrollType);
+void ScrollToPoint(uint32_t aScrollType, int32_t aX, int32_t aY);
+
+void Announce(const nsString& aAnnouncement, uint16_t aPriority);
+
+int32_t CaretLineNumber();
+int32_t CaretOffset();
+void SetCaretOffset(int32_t aOffset);
+
+int32_t CharacterCount();
+int32_t SelectionCount();
+
+/**
+ * Get the text between the given offsets.
+ */
+bool TextSubstring(int32_t aStartOffset, int32_t aEndOfset,
+                   nsString& aText) const;
+
+void GetTextAfterOffset(int32_t aOffset, AccessibleTextBoundary aBoundaryType,
+                        nsString& aText, int32_t* aStartOffset,
+                        int32_t* aEndOffset);
+
+void GetTextAtOffset(int32_t aOffset, AccessibleTextBoundary aBoundaryType,
+                     nsString& aText, int32_t* aStartOffset,
+                     int32_t* aEndOffset);
+
+void GetTextBeforeOffset(int32_t aOffset, AccessibleTextBoundary aBoundaryType,
+                         nsString& aText, int32_t* aStartOffset,
+                         int32_t* aEndOffset);
+
+char16_t CharAt(int32_t aOffset);
+
+void TextAttributes(bool aIncludeDefAttrs, const int32_t aOffset,
+                    nsTArray<Attribute>* aAttributes, int32_t* aStartOffset,
+                    int32_t* aEndOffset);
+void DefaultTextAttributes(nsTArray<Attribute>* aAttrs);
+
+nsIntRect TextBounds(
+    int32_t aStartOffset, int32_t aEndOffset,
+    uint32_t aCoordType =
+        nsIAccessibleCoordinateType::COORDTYPE_SCREEN_RELATIVE);
+
+nsIntRect CharBounds(int32_t aOffset, uint32_t aCoordType);
+
+int32_t OffsetAtPoint(int32_t aX, int32_t aY, uint32_t aCoordType);
+
+bool SelectionBoundsAt(int32_t aSelectionNum, nsString& aData,
+                       int32_t* aStartOffset, int32_t* aEndOffset);
+
+bool SetSelectionBoundsAt(int32_t aSelectionNum, int32_t aStartOffset,
+                          int32_t aEndOffset);
+
+bool AddToSelection(int32_t aStartOffset, int32_t aEndOffset);
+
+bool RemoveFromSelection(int32_t aSelectionNum);
+
+void ScrollSubstringTo(int32_t aStartOffset, int32_t aEndOffset,
+                       uint32_t aScrollType);
+
+void ScrollSubstringToPoint(int32_t aStartOffset, int32_t aEndOffset,
+                            uint32_t aCoordinateType, int32_t aX, int32_t aY);
+
+void Text(nsString* aText);
+
+void ReplaceText(const nsString& aText);
+
+bool InsertText(const nsString& aText, int32_t aPosition);
+
+bool CopyText(int32_t aStartPos, int32_t aEndPos);
+
+bool CutText(int32_t aStartPos, int32_t aEndPos);
+
+bool DeleteText(int32_t aStartPos, int32_t aEndPos);
+
+bool PasteText(int32_t aPosition);
+
+nsIntPoint ImagePosition(uint32_t aCoordType);
+
+nsIntSize ImageSize();
+
+uint32_t StartOffset(bool* aOk);
+
+uint32_t EndOffset(bool* aOk);
+
+bool IsLinkValid();
+
+uint32_t AnchorCount(bool* aOk);
+
+void AnchorURIAt(uint32_t aIndex, nsCString& aURI, bool* aOk);
+
+ProxyAccessible* AnchorAt(uint32_t aIndex);
+
+uint32_t LinkCount();
+
+ProxyAccessible* LinkAt(const uint32_t& aIndex);
+
+int32_t LinkIndexOf(ProxyAccessible* aLink);
+
+int32_t LinkIndexAtOffset(uint32_t aOffset);
+
+ProxyAccessible* TableOfACell();
+
+uint32_t ColIdx();
+
+uint32_t RowIdx();
+
+void GetPosition(uint32_t* aColIdx, uint32_t* aRowIdx);
+
+uint32_t ColExtent();
+
+uint32_t RowExtent();
+
+void GetColRowExtents(uint32_t* aColIdx, uint32_t* aRowIdx,
+                      uint32_t* aColExtent, uint32_t* aRowExtent);
+
+void ColHeaderCells(nsTArray<ProxyAccessible*>* aCells);
+
+void RowHeaderCells(nsTArray<ProxyAccessible*>* aCells);
+
+bool IsCellSelected();
+
+ProxyAccessible* TableCaption();
+void TableSummary(nsString& aSummary);
+uint32_t TableColumnCount();
+uint32_t TableRowCount();
+ProxyAccessible* TableCellAt(uint32_t aRow, uint32_t aCol);
+int32_t TableCellIndexAt(uint32_t aRow, uint32_t aCol);
+int32_t TableColumnIndexAt(uint32_t aCellIndex);
+int32_t TableRowIndexAt(uint32_t aCellIndex);
+void TableRowAndColumnIndicesAt(uint32_t aCellIndex, int32_t* aRow,
+                                int32_t* aCol);
+uint32_t TableColumnExtentAt(uint32_t aRow, uint32_t aCol);
+uint32_t TableRowExtentAt(uint32_t aRow, uint32_t aCol);
+void TableColumnDescription(uint32_t aCol, nsString& aDescription);
+void TableRowDescription(uint32_t aRow, nsString& aDescription);
+bool TableColumnSelected(uint32_t aCol);
+bool TableRowSelected(uint32_t aRow);
+bool TableCellSelected(uint32_t aRow, uint32_t aCol);
+uint32_t TableSelectedCellCount();
+uint32_t TableSelectedColumnCount();
+uint32_t TableSelectedRowCount();
+void TableSelectedCells(nsTArray<ProxyAccessible*>* aCellIDs);
+void TableSelectedCellIndices(nsTArray<uint32_t>* aCellIndices);
+void TableSelectedColumnIndices(nsTArray<uint32_t>* aColumnIndices);
+void TableSelectedRowIndices(nsTArray<uint32_t>* aRowIndices);
+void TableSelectColumn(uint32_t aCol);
+void TableSelectRow(uint32_t aRow);
+void TableUnselectColumn(uint32_t aCol);
+void TableUnselectRow(uint32_t aRow);
+bool TableIsProbablyForLayout();
+ProxyAccessible* AtkTableColumnHeader(int32_t aCol);
+ProxyAccessible* AtkTableRowHeader(int32_t aRow);
+
+void SelectedItems(nsTArray<ProxyAccessible*>* aSelectedItems);
+uint32_t SelectedItemCount();
+ProxyAccessible* GetSelectedItem(uint32_t aIndex);
+bool IsItemSelected(uint32_t aIndex);
+bool AddItemToSelection(uint32_t aIndex);
+bool RemoveItemFromSelection(uint32_t aIndex);
+bool SelectAll();
+bool UnselectAll();
+
+void TakeSelection();
+void SetSelected(bool aSelect);
+
+bool DoAction(uint8_t aIndex);
+uint8_t ActionCount();
+void ActionDescriptionAt(uint8_t aIndex, nsString& aDescription);
+void ActionNameAt(uint8_t aIndex, nsString& aName);
+KeyBinding AccessKey();
+KeyBinding KeyboardShortcut();
+void AtkKeyBinding(nsString& aBinding);
+
+double CurValue();
+bool SetCurValue(double aValue);
+double MinValue();
+double MaxValue();
+double Step();
+
+void TakeFocus();
+ProxyAccessible* FocusedChild();
+ProxyAccessible* ChildAtPoint(int32_t aX, int32_t aY,
+                              Accessible::EWhichChildAtPoint aWhichChild);
+nsIntRect Bounds();
+nsIntRect BoundsInCSSPixels();
+
+void Language(nsString& aLocale);
+void DocType(nsString& aType);
+void Title(nsString& aTitle);
+void URL(nsString& aURL);
+void MimeType(nsString aMime);
+void URLDocTypeMimeType(nsString& aURL, nsString& aDocType,
+                        nsString& aMimeType);
+
+void Extents(bool aNeedsScreenCoords, int32_t* aX, int32_t* aY, int32_t* aWidth,
+             int32_t* aHeight);
+
+/**
+ * Return the id of the dom node this accessible represents.  Note this
+ * should probably only be used for testing.
+ */
+void DOMNodeID(nsString& aID);
+
+#endif
diff --git a/accessible/ipc/extension/android/DocAccessiblePlatformExtChild.cpp b/accessible/ipc/extension/android/DocAccessiblePlatformExtChild.cpp
new file mode 100644
index 0000000000..2cf7160dac
--- /dev/null
+++ b/accessible/ipc/extension/android/DocAccessiblePlatformExtChild.cpp
@@ -0,0 +1,84 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "DocAccessiblePlatformExtChild.h"
+
+#include "DocAccessibleChild.h"
+#include "AccessibleWrap.h"
+
+namespace mozilla {
+namespace a11y {
+
+mozilla::ipc::IPCResult DocAccessiblePlatformExtChild::RecvPivot(
+    uint64_t aID, int32_t aGranularity, bool aForward, bool aInclusive) {
+  if (auto acc = IdToAccessibleWrap(aID)) {
+    acc->PivotTo(aGranularity, aForward, aInclusive);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessiblePlatformExtChild::RecvNavigateText(
+    uint64_t aID, int32_t aGranularity, int32_t aStartOffset,
+    int32_t aEndOffset, bool aForward, bool aSelect) {
+  if (auto acc = IdToAccessibleWrap(aID)) {
+    acc->NavigateText(aGranularity, aStartOffset, aEndOffset, aForward,
+                      aSelect);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessiblePlatformExtChild::RecvSetSelection(
+    uint64_t aID, int32_t aStart, int32_t aEnd) {
+  if (auto acc = IdToAccessibleWrap(aID)) {
+    acc->SetSelection(aStart, aEnd);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessiblePlatformExtChild::RecvCut(uint64_t aID) {
+  if (auto acc = IdToAccessibleWrap(aID)) {
+    acc->Cut();
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessiblePlatformExtChild::RecvCopy(uint64_t aID) {
+  if (auto acc = IdToAccessibleWrap(aID)) {
+    acc->Copy();
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessiblePlatformExtChild::RecvPaste(uint64_t aID) {
+  if (auto acc = IdToAccessibleWrap(aID)) {
+    acc->Paste();
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessiblePlatformExtChild::RecvExploreByTouch(
+    uint64_t aID, float aX, float aY) {
+  if (auto acc = IdToAccessibleWrap(aID)) {
+    acc->ExploreByTouch(aX, aY);
+  }
+
+  return IPC_OK();
+}
+
+AccessibleWrap* DocAccessiblePlatformExtChild::IdToAccessibleWrap(
+    const uint64_t& aID) const {
+  return static_cast<AccessibleWrap*>(
+      static_cast<DocAccessibleChild*>(Manager())->IdToAccessible(aID));
+}
+
+}  // namespace a11y
+}  // namespace mozilla
diff --git a/accessible/ipc/extension/android/DocAccessiblePlatformExtChild.h b/accessible/ipc/extension/android/DocAccessiblePlatformExtChild.h
new file mode 100644
index 0000000000..b4bc0ce7ab
--- /dev/null
+++ b/accessible/ipc/extension/android/DocAccessiblePlatformExtChild.h
@@ -0,0 +1,44 @@
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_a11y_DocAccessiblePlatformExtChild_h
+#define mozilla_a11y_DocAccessiblePlatformExtChild_h
+
+#include "mozilla/a11y/PDocAccessiblePlatformExtChild.h"
+
+namespace mozilla {
+namespace a11y {
+
+class AccessibleWrap;
+class DocAccessibleChild;
+
+class DocAccessiblePlatformExtChild : public PDocAccessiblePlatformExtChild {
+ public:
+  mozilla::ipc::IPCResult RecvPivot(uint64_t aID, int32_t aGranularity,
+                                    bool aForward, bool aInclusive);
+
+  mozilla::ipc::IPCResult RecvNavigateText(uint64_t aID, int32_t aGranularity,
+                                           int32_t aStartOffset,
+                                           int32_t aEndOffset, bool aForward,
+                                           bool aSelect);
+
+  mozilla::ipc::IPCResult RecvSetSelection(uint64_t aID, int32_t aStart,
+                                           int32_t aEnd);
+
+  mozilla::ipc::IPCResult RecvCut(uint64_t aID);
+
+  mozilla::ipc::IPCResult RecvCopy(uint64_t aID);
+
+  mozilla::ipc::IPCResult RecvPaste(uint64_t aID);
+
+  mozilla::ipc::IPCResult RecvExploreByTouch(uint64_t aID, float aX, float aY);
+
+ private:
+  AccessibleWrap* IdToAccessibleWrap(const uint64_t& aID) const;
+};
+}  // namespace a11y
+}  // namespace mozilla
+
+#endif
diff --git a/accessible/ipc/extension/android/DocAccessiblePlatformExtParent.cpp b/accessible/ipc/extension/android/DocAccessiblePlatformExtParent.cpp
new file mode 100644
index 0000000000..960a68a554
--- /dev/null
+++ b/accessible/ipc/extension/android/DocAccessiblePlatformExtParent.cpp
@@ -0,0 +1,46 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "DocAccessiblePlatformExtParent.h"
+
+#include "AccessibleWrap.h"
+#include "SessionAccessibility.h"
+
+#include "mozilla/a11y/DocAccessibleParent.h"
+
+namespace mozilla {
+namespace a11y {
+
+mozilla::ipc::IPCResult DocAccessiblePlatformExtParent::RecvSetPivotBoundaries(
+    PDocAccessibleParent* aFirstDoc, uint64_t aFirst,
+    PDocAccessibleParent* aLastDoc, uint64_t aLast) {
+  MOZ_ASSERT(aFirstDoc);
+  MOZ_ASSERT(aLastDoc);
+
+  RefPtr<SessionAccessibility> sessionAcc =
+      SessionAccessibility::GetInstanceFor(
+          static_cast<DocAccessibleParent*>(Manager()));
+  if (!sessionAcc) {
+    return IPC_OK();
+  }
+
+  ProxyAccessible* first =
+      static_cast<DocAccessibleParent*>(aFirstDoc)->GetAccessible(aFirst);
+  ProxyAccessible* last =
+      static_cast<DocAccessibleParent*>(aLastDoc)->GetAccessible(aLast);
+
+  // We may not have proxy accessibles available yet for those accessibles
+  // in the parent process.
+  if (first && last) {
+    sessionAcc->UpdateAccessibleFocusBoundaries(WrapperFor(first),
+                                                WrapperFor(last));
+  }
+
+  return IPC_OK();
+}
+
+}  // namespace a11y
+}  // namespace mozilla
diff --git a/accessible/ipc/extension/android/DocAccessiblePlatformExtParent.h b/accessible/ipc/extension/android/DocAccessiblePlatformExtParent.h
new file mode 100644
index 0000000000..b9278599bb
--- /dev/null
+++ b/accessible/ipc/extension/android/DocAccessiblePlatformExtParent.h
@@ -0,0 +1,22 @@
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_a11y_DocAccessiblePlatformExtParent_h
+#define mozilla_a11y_DocAccessiblePlatformExtParent_h
+
+#include "mozilla/a11y/PDocAccessiblePlatformExtParent.h"
+
+namespace mozilla {
+namespace a11y {
+class DocAccessiblePlatformExtParent : public PDocAccessiblePlatformExtParent {
+ public:
+  mozilla::ipc::IPCResult RecvSetPivotBoundaries(
+      PDocAccessibleParent* aFirstDoc, uint64_t aFirst,
+      PDocAccessibleParent* aLastDoc, uint64_t aLast);
+};
+}  // namespace a11y
+}  // namespace mozilla
+
+#endif
diff --git a/accessible/ipc/extension/android/PDocAccessiblePlatformExt.ipdl b/accessible/ipc/extension/android/PDocAccessiblePlatformExt.ipdl
new file mode 100644
index 0000000000..e0a1043358
--- /dev/null
+++ b/accessible/ipc/extension/android/PDocAccessiblePlatformExt.ipdl
@@ -0,0 +1,36 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+include protocol PDocAccessible;
+
+namespace mozilla {
+namespace a11y {
+
+protocol PDocAccessiblePlatformExt {
+  manager PDocAccessible;
+
+child:
+  async __delete__();
+
+  async Pivot(uint64_t aID, int32_t aGranularity, bool aForward, bool aInclusive);
+
+  async NavigateText(uint64_t aID, int32_t aGranularity, int32_t aStartOffset, int32_t aEndOffset, bool aForward, bool aSelect);
+
+  async SetSelection(uint64_t aID, int32_t aStart, int32_t aEnd);
+
+  async Cut(uint64_t aID);
+
+  async Copy(uint64_t aID);
+
+  async Paste(uint64_t aID);
+
+  async ExploreByTouch(uint64_t aID, float aX, float aY);
+
+parent:
+  async SetPivotBoundaries(PDocAccessible aFirstDoc, uint64_t aFirst, PDocAccessible aLastDoc, uint64_t aLast);
+  };
+}
+}
diff --git a/accessible/ipc/extension/android/moz.build b/accessible/ipc/extension/android/moz.build
new file mode 100644
index 0000000000..50871e326b
--- /dev/null
+++ b/accessible/ipc/extension/android/moz.build
@@ -0,0 +1,29 @@
+# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+if CONFIG["ACCESSIBILITY"]:
+    IPDL_SOURCES += ["PDocAccessiblePlatformExt.ipdl"]
+
+    EXPORTS.mozilla.a11y += [
+        "DocAccessiblePlatformExtChild.h",
+        "DocAccessiblePlatformExtParent.h",
+    ]
+
+    SOURCES += [
+        "DocAccessiblePlatformExtChild.cpp",
+        "DocAccessiblePlatformExtParent.cpp",
+    ]
+
+    LOCAL_INCLUDES += [
+        "/accessible/android",
+        "/accessible/generic",
+        "/accessible/ipc/other",
+        "/widget/android",
+    ]
+
+include("/ipc/chromium/chromium-config.mozbuild")
+
+FINAL_LIBRARY = "xul"
diff --git a/accessible/ipc/extension/mac/DocAccessiblePlatformExtChild.cpp b/accessible/ipc/extension/mac/DocAccessiblePlatformExtChild.cpp
new file mode 100644
index 0000000000..6086ade230
--- /dev/null
+++ b/accessible/ipc/extension/mac/DocAccessiblePlatformExtChild.cpp
@@ -0,0 +1,248 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "DocAccessiblePlatformExtChild.h"
+
+#include "DocAccessibleChild.h"
+#include "HyperTextAccessibleWrap.h"
+
+#define UNIQUE_ID(acc)               \
+  !acc || acc->Document() == acc ? 0 \
+                                 : reinterpret_cast<uint64_t>(acc->UniqueID())
+
+namespace mozilla {
+namespace a11y {
+
+mozilla::ipc::IPCResult DocAccessiblePlatformExtChild::RecvRangeAt(
+    const uint64_t& aID, const int32_t& aOffset, const EWhichRange& aRangeType,
+    uint64_t* aStartContainer, int32_t* aStartOffset, uint64_t* aEndContainer,
+    int32_t* aEndOffset) {
+  *aStartContainer = 0;
+  *aStartOffset = 0;
+  *aEndContainer = 0;
+  *aEndOffset = 0;
+
+  HyperTextAccessibleWrap* acc = IdToHyperTextAccessibleWrap(aID);
+  if (!acc) {
+    return IPC_OK();
+  }
+
+  HyperTextAccessible* startContainer = nullptr;
+  HyperTextAccessible* endContainer = nullptr;
+
+  acc->RangeAt(aOffset, aRangeType, &startContainer, aStartOffset,
+               &endContainer, aEndOffset);
+
+  MOZ_ASSERT(!startContainer || startContainer->Document() == acc->Document());
+  MOZ_ASSERT(!endContainer || endContainer->Document() == acc->Document());
+
+  *aStartContainer = UNIQUE_ID(startContainer);
+  *aEndContainer = UNIQUE_ID(endContainer);
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessiblePlatformExtChild::RecvNextClusterAt(
+    const uint64_t& aID, const int32_t& aOffset, uint64_t* aNextContainer,
+    int32_t* aNextOffset) {
+  *aNextContainer = 0;
+  *aNextOffset = 0;
+
+  HyperTextAccessibleWrap* acc = IdToHyperTextAccessibleWrap(aID);
+  if (!acc) {
+    return IPC_OK();
+  }
+
+  HyperTextAccessible* nextContainer = nullptr;
+
+  acc->NextClusterAt(aOffset, &nextContainer, aNextOffset);
+
+  MOZ_ASSERT(!nextContainer || nextContainer->Document() == acc->Document());
+
+  *aNextContainer = UNIQUE_ID(nextContainer);
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessiblePlatformExtChild::RecvPreviousClusterAt(
+    const uint64_t& aID, const int32_t& aOffset, uint64_t* aPrevContainer,
+    int32_t* aPrevOffset) {
+  *aPrevContainer = 0;
+  *aPrevOffset = 0;
+
+  HyperTextAccessibleWrap* acc = IdToHyperTextAccessibleWrap(aID);
+  if (!acc) {
+    return IPC_OK();
+  }
+
+  HyperTextAccessible* prevContainer = nullptr;
+
+  acc->PreviousClusterAt(aOffset, &prevContainer, aPrevOffset);
+
+  MOZ_ASSERT(!prevContainer || prevContainer->Document() == acc->Document());
+
+  *aPrevContainer = UNIQUE_ID(prevContainer);
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessiblePlatformExtChild::RecvTextForRange(
+    const uint64_t& aID, const int32_t& aStartOffset,
+    const uint64_t& aEndContainer, const int32_t& aEndOffset, nsString* aText) {
+  HyperTextAccessibleWrap* acc = IdToHyperTextAccessibleWrap(aID);
+  HyperTextAccessibleWrap* endContainer =
+      IdToHyperTextAccessibleWrap(aEndContainer);
+  if (!acc || !endContainer) {
+    return IPC_OK();
+  }
+
+  acc->TextForRange(*aText, aStartOffset, endContainer, aEndOffset);
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessiblePlatformExtChild::RecvBoundsForRange(
+    const uint64_t& aID, const int32_t& aStartOffset,
+    const uint64_t& aEndContainer, const int32_t& aEndOffset,
+    nsIntRect* aBounds) {
+  HyperTextAccessibleWrap* acc = IdToHyperTextAccessibleWrap(aID);
+  HyperTextAccessibleWrap* endContainer =
+      IdToHyperTextAccessibleWrap(aEndContainer);
+  if (!acc || !endContainer) {
+    *aBounds = nsIntRect();
+    return IPC_OK();
+  }
+
+  *aBounds = acc->BoundsForRange(aStartOffset, endContainer, aEndOffset);
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessiblePlatformExtChild::RecvLengthForRange(
+    const uint64_t& aID, const int32_t& aStartOffset,
+    const uint64_t& aEndContainer, const int32_t& aEndOffset,
+    int32_t* aLength) {
+  *aLength = 0;
+
+  HyperTextAccessibleWrap* acc = IdToHyperTextAccessibleWrap(aID);
+  HyperTextAccessibleWrap* endContainer =
+      IdToHyperTextAccessibleWrap(aEndContainer);
+  if (!acc || !endContainer) {
+    return IPC_OK();
+  }
+
+  *aLength = acc->LengthForRange(aStartOffset, endContainer, aEndOffset);
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessiblePlatformExtChild::RecvOffsetAtIndex(
+    const uint64_t& aID, const int32_t& aIndex, uint64_t* aContainer,
+    int32_t* aOffset) {
+  *aContainer = 0;
+  *aOffset = 0;
+
+  HyperTextAccessibleWrap* acc = IdToHyperTextAccessibleWrap(aID);
+  if (!acc) {
+    return IPC_OK();
+  }
+
+  HyperTextAccessible* container = nullptr;
+
+  acc->OffsetAtIndex(aIndex, &container, aOffset);
+
+  MOZ_ASSERT(!container || container->Document() == acc->Document());
+
+  *aContainer = UNIQUE_ID(container);
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessiblePlatformExtChild::RecvRangeOfChild(
+    const uint64_t& aID, const uint64_t& aChild, int32_t* aStartOffset,
+    int32_t* aEndOffset) {
+  *aStartOffset = 0;
+  *aEndOffset = 0;
+
+  HyperTextAccessibleWrap* acc = IdToHyperTextAccessibleWrap(aID);
+  Accessible* child =
+      static_cast<DocAccessibleChild*>(Manager())->IdToAccessible(aChild);
+  if (!acc || !child) {
+    return IPC_OK();
+  }
+
+  acc->RangeOfChild(child, aStartOffset, aEndOffset);
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessiblePlatformExtChild::RecvLeafAtOffset(
+    const uint64_t& aID, const int32_t& aOffset, uint64_t* aLeaf) {
+  *aLeaf = 0;
+
+  HyperTextAccessibleWrap* acc = IdToHyperTextAccessibleWrap(aID);
+  if (!acc) {
+    return IPC_OK();
+  }
+
+  Accessible* leaf = acc->LeafAtOffset(aOffset);
+
+  MOZ_ASSERT(!leaf || leaf->Document() == acc->Document());
+
+  *aLeaf = UNIQUE_ID(leaf);
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessiblePlatformExtChild::RecvSelectRange(
+    const uint64_t& aID, const int32_t& aStartOffset,
+    const uint64_t& aEndContainer, const int32_t& aEndOffset) {
+  RefPtr<HyperTextAccessibleWrap> acc = IdToHyperTextAccessibleWrap(aID);
+  RefPtr<HyperTextAccessibleWrap> endContainer =
+      IdToHyperTextAccessibleWrap(aEndContainer);
+  if (!acc || !endContainer) {
+    return IPC_OK();
+  }
+
+  acc->SelectRange(aStartOffset, endContainer, aEndOffset);
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult
+DocAccessiblePlatformExtChild::RecvApplyPostSearchFilter(
+    const nsTArray<uint64_t>& aAccessibles, const int32_t& aLimit,
+    const EWhichPostFilter& aSearchKey, const nsString& aSearchText,
+    nsTArray<uint64_t>* aMatches) {
+  if (aSearchKey != EWhichPostFilter::eContainsText) {
+    return IPC_OK();
+  }
+
+  DocAccessibleChild* ipcDoc = static_cast<DocAccessibleChild*>(Manager());
+  for (size_t i = 0; i < aAccessibles.Length(); i++) {
+    AccessibleWrap* acc = static_cast<AccessibleWrap*>(
+        ipcDoc->IdToAccessible(aAccessibles.ElementAt(i)));
+    if (!acc) {
+      continue;
+    }
+
+    if (acc->ApplyPostFilter(aSearchKey, aSearchText)) {
+      aMatches->AppendElement(UNIQUE_ID(acc));
+    }
+  }
+
+  return IPC_OK();
+}
+
+HyperTextAccessibleWrap*
+DocAccessiblePlatformExtChild::IdToHyperTextAccessibleWrap(
+    const uint64_t& aID) const {
+  return static_cast<HyperTextAccessibleWrap*>(
+      static_cast<DocAccessibleChild*>(Manager())->IdToHyperTextAccessible(
+          aID));
+}
+
+}  // namespace a11y
+}  // namespace mozilla
diff --git a/accessible/ipc/extension/mac/DocAccessiblePlatformExtChild.h b/accessible/ipc/extension/mac/DocAccessiblePlatformExtChild.h
new file mode 100644
index 0000000000..e372a96885
--- /dev/null
+++ b/accessible/ipc/extension/mac/DocAccessiblePlatformExtChild.h
@@ -0,0 +1,82 @@
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_a11y_DocAccessiblePlatformExtChild_h
+#define mozilla_a11y_DocAccessiblePlatformExtChild_h
+
+#include "mozilla/a11y/PDocAccessiblePlatformExtChild.h"
+
+namespace mozilla {
+namespace a11y {
+
+class HyperTextAccessibleWrap;
+class DocAccessibleChild;
+
+class DocAccessiblePlatformExtChild : public PDocAccessiblePlatformExtChild {
+ public:
+  mozilla::ipc::IPCResult RecvRangeAt(
+      const uint64_t& aID, const int32_t& aOffset,
+      const EWhichRange& aRangeType, uint64_t* aStartContainer,
+      int32_t* aStartOffset, uint64_t* aEndContainer, int32_t* aEndOffset);
+
+  mozilla::ipc::IPCResult RecvNextClusterAt(const uint64_t& aID,
+                                            const int32_t& aOffset,
+                                            uint64_t* aNextContainer,
+                                            int32_t* aNextOffset);
+
+  mozilla::ipc::IPCResult RecvPreviousClusterAt(const uint64_t& aID,
+                                                const int32_t& aOffset,
+                                                uint64_t* aPrevContainer,
+                                                int32_t* aPrevOffset);
+
+  mozilla::ipc::IPCResult RecvTextForRange(const uint64_t& aID,
+                                           const int32_t& aStartOffset,
+                                           const uint64_t& aEndContainer,
+                                           const int32_t& aEndOffset,
+                                           nsString* aText);
+
+  mozilla::ipc::IPCResult RecvBoundsForRange(const uint64_t& aID,
+                                             const int32_t& aStartOffset,
+                                             const uint64_t& aEndContainer,
+                                             const int32_t& aEndOffset,
+                                             nsIntRect* aBounds);
+
+  mozilla::ipc::IPCResult RecvLengthForRange(const uint64_t& aID,
+                                             const int32_t& aStartOffset,
+                                             const uint64_t& aEndContainer,
+                                             const int32_t& aEndOffset,
+                                             int32_t* aLength);
+
+  mozilla::ipc::IPCResult RecvOffsetAtIndex(const uint64_t& aID,
+                                            const int32_t& aIndex,
+                                            uint64_t* aContainer,
+                                            int32_t* aOffset);
+
+  mozilla::ipc::IPCResult RecvRangeOfChild(const uint64_t& aID,
+                                           const uint64_t& aChild,
+                                           int32_t* aStartOffset,
+                                           int32_t* aEndOffset);
+
+  mozilla::ipc::IPCResult RecvLeafAtOffset(const uint64_t& aID,
+                                           const int32_t& aOffset,
+                                           uint64_t* aLeaf);
+
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY mozilla::ipc::IPCResult RecvSelectRange(
+      const uint64_t& aID, const int32_t& aStartOffset,
+      const uint64_t& aEndContainer, const int32_t& aEndOffset);
+
+  mozilla::ipc::IPCResult RecvApplyPostSearchFilter(
+      const nsTArray<uint64_t>& aAccessibles, const int32_t& aLimit,
+      const EWhichPostFilter& aSearchKey, const nsString& aSearchText,
+      nsTArray<uint64_t>* aMatches);
+
+ private:
+  HyperTextAccessibleWrap* IdToHyperTextAccessibleWrap(
+      const uint64_t& aID) const;
+};
+}  // namespace a11y
+}  // namespace mozilla
+
+#endif
diff --git a/accessible/ipc/extension/mac/DocAccessiblePlatformExtParent.h b/accessible/ipc/extension/mac/DocAccessiblePlatformExtParent.h
new file mode 100644
index 0000000000..07e65c6e2d
--- /dev/null
+++ b/accessible/ipc/extension/mac/DocAccessiblePlatformExtParent.h
@@ -0,0 +1,19 @@
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_a11y_DocAccessiblePlatformExtParent_h
+#define mozilla_a11y_DocAccessiblePlatformExtParent_h
+
+#include "mozilla/a11y/PDocAccessiblePlatformExtParent.h"
+
+namespace mozilla {
+namespace a11y {
+class DocAccessiblePlatformExtParent : public PDocAccessiblePlatformExtParent {
+
+};
+}  // namespace a11y
+}  // namespace mozilla
+
+#endif
diff --git a/accessible/ipc/extension/mac/PDocAccessiblePlatformExt.ipdl b/accessible/ipc/extension/mac/PDocAccessiblePlatformExt.ipdl
new file mode 100644
index 0000000000..2aec735b16
--- /dev/null
+++ b/accessible/ipc/extension/mac/PDocAccessiblePlatformExt.ipdl
@@ -0,0 +1,62 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+include protocol PDocAccessible;
+
+include "mozilla/GfxMessageUtils.h";
+
+using mozilla::a11y::EWhichRange from "mozilla/a11y/IPCTypes.h";
+using mozilla::a11y::EWhichPostFilter from "mozilla/a11y/IPCTypes.h";
+using nsIntRect from "nsRect.h";
+
+namespace mozilla {
+namespace a11y {
+
+nested(upto inside_sync) sync protocol PDocAccessiblePlatformExt {
+  manager PDocAccessible;
+
+child:
+  async __delete__();
+
+  nested(inside_sync) sync RangeAt(uint64_t aID, int32_t aOffset, EWhichRange aRangeType)
+      returns(uint64_t aStartContainer, int32_t aStartOffset,
+              uint64_t aEndContainer, int32_t aEndOffset);
+
+  nested(inside_sync) sync NextClusterAt(uint64_t aID, int32_t aOffset)
+      returns(uint64_t aNextContainer, int32_t aNextOffset);
+
+  nested(inside_sync) sync PreviousClusterAt(uint64_t aID, int32_t aOffset)
+      returns(uint64_t aNextContainer, int32_t aNextOffset);
+
+  nested(inside_sync) sync TextForRange(uint64_t aID, int32_t aStartOffset, uint64_t aEndContainer, int32_t aEndOffset)
+      returns(nsString aText);
+
+  nested(inside_sync) sync BoundsForRange(uint64_t aID, int32_t aStartOffset, uint64_t aEndContainer, int32_t aEndOffset)
+      returns(nsIntRect aRetVal);
+
+  nested(inside_sync) sync LengthForRange(uint64_t aID, int32_t aStartOffset, uint64_t aEndContainer, int32_t aEndOffset)
+      returns(int32_t aLength);
+
+  nested(inside_sync) sync OffsetAtIndex(uint64_t aID, int32_t aIndex)
+      returns(uint64_t aContainer, int32_t aOffset);
+
+  nested(inside_sync) sync RangeOfChild(uint64_t aID, uint64_t aChild)
+      returns(int32_t aStartOffset, int32_t aEndOffset);
+
+  nested(inside_sync) sync LeafAtOffset(uint64_t aID, int32_t aOffset)
+      returns(uint64_t aLeaf);
+
+  async SelectRange(uint64_t aID, int32_t aStartOffset, uint64_t aEndContainer, int32_t aEndOffset);
+
+  // A filter that can be applied to search predicate results.
+  nested(inside_sync) sync ApplyPostSearchFilter(uint64_t[] aAccessibles, int32_t aLimit,
+                                             EWhichPostFilter aSearchKey, nsString aSearchText)
+      returns(uint64_t[] aMatches);
+
+};
+
+}  // namespace a11y
+}  // namespace mozilla
diff --git a/accessible/ipc/extension/mac/moz.build b/accessible/ipc/extension/mac/moz.build
new file mode 100644
index 0000000000..e7a7bf3bf8
--- /dev/null
+++ b/accessible/ipc/extension/mac/moz.build
@@ -0,0 +1,28 @@
+# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+if CONFIG["ACCESSIBILITY"]:
+    IPDL_SOURCES += ["PDocAccessiblePlatformExt.ipdl"]
+
+    EXPORTS.mozilla.a11y += [
+        "DocAccessiblePlatformExtChild.h",
+        "DocAccessiblePlatformExtParent.h",
+    ]
+
+    SOURCES += [
+        "DocAccessiblePlatformExtChild.cpp",
+    ]
+
+    LOCAL_INCLUDES += [
+        "/accessible/base",
+        "/accessible/generic",
+        "/accessible/ipc/other",
+        "/accessible/mac",
+    ]
+
+include("/ipc/chromium/chromium-config.mozbuild")
+
+FINAL_LIBRARY = "xul"
diff --git a/accessible/ipc/extension/moz.build b/accessible/ipc/extension/moz.build
new file mode 100644
index 0000000000..3c82fd90b4
--- /dev/null
+++ b/accessible/ipc/extension/moz.build
@@ -0,0 +1,14 @@
+# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+toolkit = CONFIG["MOZ_WIDGET_TOOLKIT"]
+
+if toolkit == "android":
+    DIRS += ["android"]
+elif toolkit == "cocoa":
+    DIRS += ["mac"]
+else:
+    DIRS += ["other"]
diff --git a/accessible/ipc/extension/other/DocAccessiblePlatformExtChild.h b/accessible/ipc/extension/other/DocAccessiblePlatformExtChild.h
new file mode 100644
index 0000000000..6a6542bf71
--- /dev/null
+++ b/accessible/ipc/extension/other/DocAccessiblePlatformExtChild.h
@@ -0,0 +1,20 @@
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_a11y_DocAccessiblePlatformExtChild_h
+#define mozilla_a11y_DocAccessiblePlatformExtChild_h
+
+#include "mozilla/a11y/PDocAccessiblePlatformExtChild.h"
+
+namespace mozilla {
+namespace a11y {
+
+class DocAccessibleChild;
+
+class DocAccessiblePlatformExtChild : public PDocAccessiblePlatformExtChild {};
+}  // namespace a11y
+}  // namespace mozilla
+
+#endif
diff --git a/accessible/ipc/extension/other/DocAccessiblePlatformExtParent.h b/accessible/ipc/extension/other/DocAccessiblePlatformExtParent.h
new file mode 100644
index 0000000000..e2e1cd907f
--- /dev/null
+++ b/accessible/ipc/extension/other/DocAccessiblePlatformExtParent.h
@@ -0,0 +1,18 @@
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_a11y_DocAccessiblePlatformExtParent_h
+#define mozilla_a11y_DocAccessiblePlatformExtParent_h
+
+#include "mozilla/a11y/PDocAccessiblePlatformExtParent.h"
+
+namespace mozilla {
+namespace a11y {
+class DocAccessiblePlatformExtParent : public PDocAccessiblePlatformExtParent {
+};
+}  // namespace a11y
+}  // namespace mozilla
+
+#endif
diff --git a/accessible/ipc/extension/other/PDocAccessiblePlatformExt.ipdl b/accessible/ipc/extension/other/PDocAccessiblePlatformExt.ipdl
new file mode 100644
index 0000000000..4ebf35fbbd
--- /dev/null
+++ b/accessible/ipc/extension/other/PDocAccessiblePlatformExt.ipdl
@@ -0,0 +1,19 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+include protocol PDocAccessible;
+
+namespace mozilla {
+namespace a11y {
+
+protocol PDocAccessiblePlatformExt {
+  manager PDocAccessible;
+
+child:
+  async __delete__();
+};
+
+}}
\ No newline at end of file
diff --git a/accessible/ipc/extension/other/moz.build b/accessible/ipc/extension/other/moz.build
new file mode 100644
index 0000000000..dbbc98702c
--- /dev/null
+++ b/accessible/ipc/extension/other/moz.build
@@ -0,0 +1,17 @@
+# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+if CONFIG["ACCESSIBILITY"]:
+    IPDL_SOURCES += ["PDocAccessiblePlatformExt.ipdl"]
+
+    EXPORTS.mozilla.a11y += [
+        "DocAccessiblePlatformExtChild.h",
+        "DocAccessiblePlatformExtParent.h",
+    ]
+
+include("/ipc/chromium/chromium-config.mozbuild")
+
+FINAL_LIBRARY = "xul"
diff --git a/accessible/ipc/moz.build b/accessible/ipc/moz.build
new file mode 100644
index 0000000000..b50625e40e
--- /dev/null
+++ b/accessible/ipc/moz.build
@@ -0,0 +1,68 @@
+# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+if CONFIG["OS_ARCH"] == "WINNT":
+    DIRS += ["win"]
+    LOCAL_INCLUDES += [
+        "/accessible/ipc/win",
+        "/accessible/windows/ia2",
+        "/accessible/windows/msaa",
+    ]
+else:
+    DIRS += ["other", "extension"]
+    LOCAL_INCLUDES += [
+        "/accessible/ipc/other",
+    ]
+    if CONFIG["MOZ_WIDGET_TOOLKIT"] == "gtk":
+        LOCAL_INCLUDES += [
+            "/accessible/atk",
+        ]
+    elif CONFIG["MOZ_WIDGET_TOOLKIT"] == "cocoa":
+        LOCAL_INCLUDES += [
+            "/accessible/mac",
+        ]
+    elif CONFIG["MOZ_WIDGET_TOOLKIT"] == "android":
+        LOCAL_INCLUDES += [
+            "/accessible/android",
+        ]
+    else:
+        LOCAL_INCLUDES += [
+            "/accessible/other",
+        ]
+
+EXPORTS.mozilla.a11y += [
+    "IPCTypes.h",
+]
+
+if CONFIG["CC_TYPE"] in ("clang", "gcc"):
+    CXXFLAGS += ["-Wno-error=shadow"]
+
+if CONFIG["ACCESSIBILITY"]:
+    EXPORTS.mozilla.a11y += [
+        "DocAccessibleChildBase.h",
+        "DocAccessibleParent.h",
+        "ProxyAccessibleBase.h",
+        "ProxyAccessibleShared.h",
+    ]
+
+    UNIFIED_SOURCES += [
+        "DocAccessibleChildBase.cpp",
+        "DocAccessibleParent.cpp",
+        "ProxyAccessibleBase.cpp",
+    ]
+
+    LOCAL_INCLUDES += [
+        "/accessible/base",
+        "/accessible/generic",
+        "/accessible/xpcom",
+    ]
+
+include("/ipc/chromium/chromium-config.mozbuild")
+
+FINAL_LIBRARY = "xul"
+
+# Add libFuzzer configuration directives
+include("/tools/fuzzing/libfuzzer-config.mozbuild")
diff --git a/accessible/ipc/other/DocAccessibleChild.cpp b/accessible/ipc/other/DocAccessibleChild.cpp
new file mode 100644
index 0000000000..523b8e127e
--- /dev/null
+++ b/accessible/ipc/other/DocAccessibleChild.cpp
@@ -0,0 +1,1734 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "DocAccessibleChild.h"
+
+#include "nsAccessibilityService.h"
+#include "Accessible-inl.h"
+#include "ProxyAccessible.h"
+#include "Relation.h"
+#include "HyperTextAccessible-inl.h"
+#include "TextLeafAccessible.h"
+#include "ImageAccessible.h"
+#include "TableAccessible.h"
+#include "TableCellAccessible.h"
+#include "nsIPersistentProperties2.h"
+#include "nsAccUtils.h"
+#ifdef MOZ_ACCESSIBILITY_ATK
+#  include "AccessibleWrap.h"
+#endif
+#include "mozilla/PresShell.h"
+#include "mozilla/a11y/DocAccessiblePlatformExtChild.h"
+
+namespace mozilla {
+namespace a11y {
+
+Accessible* DocAccessibleChild::IdToAccessible(const uint64_t& aID) const {
+  if (!aID) return mDoc;
+
+  if (!mDoc) return nullptr;
+
+  return mDoc->GetAccessibleByUniqueID(reinterpret_cast<void*>(aID));
+}
+
+Accessible* DocAccessibleChild::IdToAccessibleLink(const uint64_t& aID) const {
+  Accessible* acc = IdToAccessible(aID);
+  return acc && acc->IsLink() ? acc : nullptr;
+}
+
+Accessible* DocAccessibleChild::IdToAccessibleSelect(
+    const uint64_t& aID) const {
+  Accessible* acc = IdToAccessible(aID);
+  return acc && acc->IsSelect() ? acc : nullptr;
+}
+
+HyperTextAccessible* DocAccessibleChild::IdToHyperTextAccessible(
+    const uint64_t& aID) const {
+  Accessible* acc = IdToAccessible(aID);
+  return acc && acc->IsHyperText() ? acc->AsHyperText() : nullptr;
+}
+
+TextLeafAccessible* DocAccessibleChild::IdToTextLeafAccessible(
+    const uint64_t& aID) const {
+  Accessible* acc = IdToAccessible(aID);
+  return acc && acc->IsTextLeaf() ? acc->AsTextLeaf() : nullptr;
+}
+
+ImageAccessible* DocAccessibleChild::IdToImageAccessible(
+    const uint64_t& aID) const {
+  Accessible* acc = IdToAccessible(aID);
+  return (acc && acc->IsImage()) ? acc->AsImage() : nullptr;
+}
+
+TableCellAccessible* DocAccessibleChild::IdToTableCellAccessible(
+    const uint64_t& aID) const {
+  Accessible* acc = IdToAccessible(aID);
+  return (acc && acc->IsTableCell()) ? acc->AsTableCell() : nullptr;
+}
+
+TableAccessible* DocAccessibleChild::IdToTableAccessible(
+    const uint64_t& aID) const {
+  Accessible* acc = IdToAccessible(aID);
+  return (acc && acc->IsTable()) ? acc->AsTable() : nullptr;
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvState(const uint64_t& aID,
+                                                      uint64_t* aState) {
+  Accessible* acc = IdToAccessible(aID);
+  if (!acc) {
+    *aState = states::DEFUNCT;
+    return IPC_OK();
+  }
+
+  *aState = acc->State();
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvNativeState(const uint64_t& aID,
+                                                            uint64_t* aState) {
+  Accessible* acc = IdToAccessible(aID);
+  if (!acc) {
+    *aState = states::DEFUNCT;
+    return IPC_OK();
+  }
+
+  *aState = acc->NativeState();
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvName(const uint64_t& aID,
+                                                     nsString* aName,
+                                                     uint32_t* aFlag) {
+  Accessible* acc = IdToAccessible(aID);
+  if (!acc) return IPC_OK();
+
+  *aFlag = acc->Name(*aName);
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvValue(const uint64_t& aID,
+                                                      nsString* aValue) {
+  Accessible* acc = IdToAccessible(aID);
+  if (!acc) {
+    return IPC_OK();
+  }
+
+  acc->Value(*aValue);
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvHelp(const uint64_t& aID,
+                                                     nsString* aHelp) {
+  Accessible* acc = IdToAccessible(aID);
+  if (!acc) {
+    return IPC_OK();
+  }
+
+  acc->Help(*aHelp);
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvDescription(const uint64_t& aID,
+                                                            nsString* aDesc) {
+  Accessible* acc = IdToAccessible(aID);
+  if (!acc) return IPC_OK();
+
+  acc->Description(*aDesc);
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvAttributes(
+    const uint64_t& aID, nsTArray<Attribute>* aAttributes) {
+  Accessible* acc = IdToAccessible(aID);
+  if (!acc) return IPC_OK();
+
+  nsCOMPtr<nsIPersistentProperties> props = acc->Attributes();
+  if (!nsAccUtils::PersistentPropertiesToArray(props, aAttributes)) {
+    return IPC_FAIL_NO_REASON(this);
+  }
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvRelationByType(
+    const uint64_t& aID, const uint32_t& aType, nsTArray<uint64_t>* aTargets) {
+  Accessible* acc = IdToAccessible(aID);
+  if (!acc) return IPC_OK();
+
+  auto type = static_cast<RelationType>(aType);
+  Relation rel = acc->RelationByType(type);
+  while (Accessible* target = rel.Next())
+    aTargets->AppendElement(reinterpret_cast<uint64_t>(target->UniqueID()));
+
+  return IPC_OK();
+}
+
+static void AddRelation(Accessible* aAcc, RelationType aType,
+                        nsTArray<RelationTargets>* aTargets) {
+  Relation rel = aAcc->RelationByType(aType);
+  nsTArray<uint64_t> targets;
+  while (Accessible* target = rel.Next())
+    targets.AppendElement(reinterpret_cast<uint64_t>(target->UniqueID()));
+
+  if (!targets.IsEmpty()) {
+    RelationTargets* newRelation = aTargets->AppendElement(
+        RelationTargets(static_cast<uint32_t>(aType), nsTArray<uint64_t>()));
+    newRelation->Targets() = std::move(targets);
+  }
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvRelations(
+    const uint64_t& aID, nsTArray<RelationTargets>* aRelations) {
+  Accessible* acc = IdToAccessible(aID);
+  if (!acc) return IPC_OK();
+
+#define RELATIONTYPE(gecko, s, a, m, i) \
+  AddRelation(acc, RelationType::gecko, aRelations);
+
+#include "RelationTypeMap.h"
+#undef RELATIONTYPE
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvIsSearchbox(const uint64_t& aID,
+                                                            bool* aRetVal) {
+  Accessible* acc = IdToAccessible(aID);
+  if (!acc) return IPC_OK();
+
+  *aRetVal = acc->IsSearchbox();
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvLandmarkRole(
+    const uint64_t& aID, nsString* aLandmark) {
+  Accessible* acc = IdToAccessible(aID);
+  if (!acc) {
+    return IPC_OK();
+  }
+
+  if (nsAtom* roleAtom = acc->LandmarkRole()) {
+    roleAtom->ToString(*aLandmark);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvARIARoleAtom(
+    const uint64_t& aID, nsString* aRole) {
+  Accessible* acc = IdToAccessible(aID);
+  if (!acc) {
+    return IPC_OK();
+  }
+
+  if (const nsRoleMapEntry* roleMap = acc->ARIARoleMap()) {
+    if (nsStaticAtom* roleAtom = roleMap->roleAtom) {
+      roleAtom->ToString(*aRole);
+    }
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvGroupPosition(
+    const uint64_t& aID, int32_t* aLevel, int32_t* aSimilarItemsInGroup,
+    int32_t* aPositionInGroup) {
+  Accessible* acc = IdToAccessible(aID);
+  if (acc) {
+    GroupPos groupPos = acc->GroupPosition();
+    *aLevel = groupPos.level;
+    *aSimilarItemsInGroup = groupPos.setSize;
+    *aPositionInGroup = groupPos.posInSet;
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvScrollTo(
+    const uint64_t& aID, const uint32_t& aScrollType) {
+  Accessible* acc = IdToAccessible(aID);
+  if (acc) {
+    RefPtr<PresShell> presShell = acc->Document()->PresShellPtr();
+    nsCOMPtr<nsIContent> content = acc->GetContent();
+    nsCoreUtils::ScrollTo(presShell, content, aScrollType);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvScrollToPoint(
+    const uint64_t& aID, const uint32_t& aScrollType, const int32_t& aX,
+    const int32_t& aY) {
+  Accessible* acc = IdToAccessible(aID);
+  if (acc) {
+    acc->ScrollToPoint(aScrollType, aX, aY);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvAnnounce(
+    const uint64_t& aID, const nsString& aAnnouncement,
+    const uint16_t& aPriority) {
+  Accessible* acc = IdToAccessible(aID);
+  if (acc) {
+    acc->Announce(aAnnouncement, aPriority);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvCaretLineNumber(
+    const uint64_t& aID, int32_t* aLineNumber) {
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  *aLineNumber = acc && acc->IsTextRole() ? acc->CaretLineNumber() : 0;
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvCaretOffset(const uint64_t& aID,
+                                                            int32_t* aOffset) {
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  *aOffset = acc && acc->IsTextRole() ? acc->CaretOffset() : 0;
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvSetCaretOffset(
+    const uint64_t& aID, const int32_t& aOffset) {
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  if (acc && acc->IsTextRole() && acc->IsValidOffset(aOffset)) {
+    acc->SetCaretOffset(aOffset);
+  }
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvCharacterCount(
+    const uint64_t& aID, int32_t* aCount) {
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  *aCount = acc ? acc->CharacterCount() : 0;
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvSelectionCount(
+    const uint64_t& aID, int32_t* aCount) {
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  *aCount = acc ? acc->SelectionCount() : 0;
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTextSubstring(
+    const uint64_t& aID, const int32_t& aStartOffset, const int32_t& aEndOffset,
+    nsString* aText, bool* aValid) {
+  Accessible* acc = IdToAccessible(aID);
+  if (!acc) {
+    return IPC_OK();
+  }
+
+  TextLeafAccessible* leaf = acc->AsTextLeaf();
+  if (leaf) {
+    if (aStartOffset != 0 || aEndOffset != -1) {
+      // We don't support fetching partial text from a leaf.
+      *aValid = false;
+      return IPC_OK();
+    }
+    *aValid = true;
+    *aText = leaf->Text();
+    return IPC_OK();
+  }
+
+  HyperTextAccessible* hyper = acc->AsHyperText();
+  if (!hyper) {
+    return IPC_OK();
+  }
+
+  *aValid = hyper->IsValidRange(aStartOffset, aEndOffset);
+  hyper->TextSubstring(aStartOffset, aEndOffset, *aText);
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvGetTextAfterOffset(
+    const uint64_t& aID, const int32_t& aOffset, const int32_t& aBoundaryType,
+    nsString* aText, int32_t* aStartOffset, int32_t* aEndOffset) {
+  *aStartOffset = 0;
+  *aEndOffset = 0;
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  if (acc) {
+    acc->TextAfterOffset(aOffset, aBoundaryType, aStartOffset, aEndOffset,
+                         *aText);
+  }
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvGetTextAtOffset(
+    const uint64_t& aID, const int32_t& aOffset, const int32_t& aBoundaryType,
+    nsString* aText, int32_t* aStartOffset, int32_t* aEndOffset) {
+  *aStartOffset = 0;
+  *aEndOffset = 0;
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  if (acc) {
+    acc->TextAtOffset(aOffset, aBoundaryType, aStartOffset, aEndOffset, *aText);
+  }
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvGetTextBeforeOffset(
+    const uint64_t& aID, const int32_t& aOffset, const int32_t& aBoundaryType,
+    nsString* aText, int32_t* aStartOffset, int32_t* aEndOffset) {
+  *aStartOffset = 0;
+  *aEndOffset = 0;
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  if (acc) {
+    acc->TextBeforeOffset(aOffset, aBoundaryType, aStartOffset, aEndOffset,
+                          *aText);
+  }
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvCharAt(const uint64_t& aID,
+                                                       const int32_t& aOffset,
+                                                       uint16_t* aChar) {
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  *aChar = acc && acc->IsTextRole()
+               ? static_cast<uint16_t>(acc->CharAt(aOffset))
+               : 0;
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTextAttributes(
+    const uint64_t& aID, const bool& aIncludeDefAttrs, const int32_t& aOffset,
+    nsTArray<Attribute>* aAttributes, int32_t* aStartOffset,
+    int32_t* aEndOffset) {
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  if (!acc || !acc->IsTextRole()) {
+    return IPC_OK();
+  }
+
+  nsCOMPtr<nsIPersistentProperties> props =
+      acc->TextAttributes(aIncludeDefAttrs, aOffset, aStartOffset, aEndOffset);
+  if (!nsAccUtils::PersistentPropertiesToArray(props, aAttributes)) {
+    return IPC_FAIL_NO_REASON(this);
+  }
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvDefaultTextAttributes(
+    const uint64_t& aID, nsTArray<Attribute>* aAttributes) {
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  if (!acc || !acc->IsTextRole()) {
+    return IPC_OK();
+  }
+
+  nsCOMPtr<nsIPersistentProperties> props = acc->DefaultTextAttributes();
+  if (!nsAccUtils::PersistentPropertiesToArray(props, aAttributes)) {
+    return IPC_FAIL_NO_REASON(this);
+  }
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTextBounds(
+    const uint64_t& aID, const int32_t& aStartOffset, const int32_t& aEndOffset,
+    const uint32_t& aCoordType, nsIntRect* aRetVal) {
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  if (acc && acc->IsTextRole()) {
+    *aRetVal = acc->TextBounds(aStartOffset, aEndOffset, aCoordType);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvCharBounds(
+    const uint64_t& aID, const int32_t& aOffset, const uint32_t& aCoordType,
+    nsIntRect* aRetVal) {
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  if (acc && acc->IsTextRole()) {
+    *aRetVal = acc->CharBounds(aOffset, aCoordType);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvOffsetAtPoint(
+    const uint64_t& aID, const int32_t& aX, const int32_t& aY,
+    const uint32_t& aCoordType, int32_t* aRetVal) {
+  *aRetVal = -1;
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  if (acc && acc->IsTextRole()) {
+    *aRetVal = acc->OffsetAtPoint(aX, aY, aCoordType);
+  }
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvSelectionBoundsAt(
+    const uint64_t& aID, const int32_t& aSelectionNum, bool* aSucceeded,
+    nsString* aData, int32_t* aStartOffset, int32_t* aEndOffset) {
+  *aSucceeded = false;
+  *aStartOffset = 0;
+  *aEndOffset = 0;
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  if (acc && acc->IsTextRole()) {
+    *aSucceeded =
+        acc->SelectionBoundsAt(aSelectionNum, aStartOffset, aEndOffset);
+    if (*aSucceeded) {
+      acc->TextSubstring(*aStartOffset, *aEndOffset, *aData);
+    }
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvSetSelectionBoundsAt(
+    const uint64_t& aID, const int32_t& aSelectionNum,
+    const int32_t& aStartOffset, const int32_t& aEndOffset, bool* aSucceeded) {
+  *aSucceeded = false;
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  if (acc && acc->IsTextRole()) {
+    *aSucceeded =
+        acc->SetSelectionBoundsAt(aSelectionNum, aStartOffset, aEndOffset);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvAddToSelection(
+    const uint64_t& aID, const int32_t& aStartOffset, const int32_t& aEndOffset,
+    bool* aSucceeded) {
+  *aSucceeded = false;
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  if (acc && acc->IsTextRole()) {
+    *aSucceeded = acc->AddToSelection(aStartOffset, aEndOffset);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvRemoveFromSelection(
+    const uint64_t& aID, const int32_t& aSelectionNum, bool* aSucceeded) {
+  *aSucceeded = false;
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  if (acc && acc->IsTextRole()) {
+    *aSucceeded = acc->RemoveFromSelection(aSelectionNum);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvScrollSubstringTo(
+    const uint64_t& aID, const int32_t& aStartOffset, const int32_t& aEndOffset,
+    const uint32_t& aScrollType) {
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  if (acc) {
+    acc->ScrollSubstringTo(aStartOffset, aEndOffset, aScrollType);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvScrollSubstringToPoint(
+    const uint64_t& aID, const int32_t& aStartOffset, const int32_t& aEndOffset,
+    const uint32_t& aCoordinateType, const int32_t& aX, const int32_t& aY) {
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  if (acc) {
+    acc->ScrollSubstringToPoint(aStartOffset, aEndOffset, aCoordinateType, aX,
+                                aY);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvText(const uint64_t& aID,
+                                                     nsString* aText) {
+  TextLeafAccessible* acc = IdToTextLeafAccessible(aID);
+  if (acc) {
+    *aText = acc->Text();
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvReplaceText(
+    const uint64_t& aID, const nsString& aText) {
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  if (acc && acc->IsTextRole()) {
+    acc->ReplaceText(aText);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvInsertText(
+    const uint64_t& aID, const nsString& aText, const int32_t& aPosition,
+    bool* aValid) {
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  if (acc && acc->IsTextRole()) {
+    *aValid = acc->IsValidOffset(aPosition);
+    acc->InsertText(aText, aPosition);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvCopyText(
+    const uint64_t& aID, const int32_t& aStartPos, const int32_t& aEndPos,
+    bool* aValid) {
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  if (acc && acc->IsTextRole()) {
+    acc->CopyText(aStartPos, aEndPos);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvCutText(
+    const uint64_t& aID, const int32_t& aStartPos, const int32_t& aEndPos,
+    bool* aValid) {
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  if (acc && acc->IsTextRole()) {
+    *aValid = acc->IsValidRange(aStartPos, aEndPos);
+    acc->CutText(aStartPos, aEndPos);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvDeleteText(
+    const uint64_t& aID, const int32_t& aStartPos, const int32_t& aEndPos,
+    bool* aValid) {
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  if (acc && acc->IsTextRole()) {
+    *aValid = acc->IsValidRange(aStartPos, aEndPos);
+    acc->DeleteText(aStartPos, aEndPos);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvPasteText(
+    const uint64_t& aID, const int32_t& aPosition, bool* aValid) {
+  RefPtr<HyperTextAccessible> acc = IdToHyperTextAccessible(aID);
+  if (acc && acc->IsTextRole()) {
+    *aValid = acc->IsValidOffset(aPosition);
+    acc->PasteText(aPosition);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvImagePosition(
+    const uint64_t& aID, const uint32_t& aCoordType, nsIntPoint* aRetVal) {
+  ImageAccessible* acc = IdToImageAccessible(aID);
+  if (acc) {
+    *aRetVal = acc->Position(aCoordType);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvImageSize(const uint64_t& aID,
+                                                          nsIntSize* aRetVal) {
+  ImageAccessible* acc = IdToImageAccessible(aID);
+  if (acc) {
+    *aRetVal = acc->Size();
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvStartOffset(const uint64_t& aID,
+                                                            uint32_t* aRetVal,
+                                                            bool* aOk) {
+  Accessible* acc = IdToAccessibleLink(aID);
+  if (acc) {
+    *aRetVal = acc->StartOffset();
+    *aOk = true;
+  } else {
+    *aRetVal = 0;
+    *aOk = false;
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvEndOffset(const uint64_t& aID,
+                                                          uint32_t* aRetVal,
+                                                          bool* aOk) {
+  Accessible* acc = IdToAccessibleLink(aID);
+  if (acc) {
+    *aRetVal = acc->EndOffset();
+    *aOk = true;
+  } else {
+    *aRetVal = 0;
+    *aOk = false;
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvIsLinkValid(const uint64_t& aID,
+                                                            bool* aRetVal) {
+  Accessible* acc = IdToAccessibleLink(aID);
+  if (acc) {
+    *aRetVal = acc->IsLinkValid();
+  } else {
+    *aRetVal = false;
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvAnchorCount(const uint64_t& aID,
+                                                            uint32_t* aRetVal,
+                                                            bool* aOk) {
+  Accessible* acc = IdToAccessibleLink(aID);
+  if (acc) {
+    *aRetVal = acc->AnchorCount();
+    *aOk = true;
+  } else {
+    *aRetVal = 0;
+    *aOk = false;
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvAnchorURIAt(
+    const uint64_t& aID, const uint32_t& aIndex, nsCString* aURI, bool* aOk) {
+  Accessible* acc = IdToAccessibleLink(aID);
+  *aOk = false;
+  if (acc) {
+    nsCOMPtr<nsIURI> uri = acc->AnchorURIAt(aIndex);
+    if (uri) {
+      uri->GetSpec(*aURI);
+      *aOk = true;
+    }
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvAnchorAt(const uint64_t& aID,
+                                                         const uint32_t& aIndex,
+                                                         uint64_t* aIDOfAnchor,
+                                                         bool* aOk) {
+  *aIDOfAnchor = 0;
+  *aOk = false;
+  Accessible* acc = IdToAccessibleLink(aID);
+  if (acc) {
+    Accessible* anchor = acc->AnchorAt(aIndex);
+    if (anchor) {
+      *aIDOfAnchor = reinterpret_cast<uint64_t>(anchor->UniqueID());
+      *aOk = true;
+    }
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvLinkCount(const uint64_t& aID,
+                                                          uint32_t* aCount) {
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  *aCount = acc ? acc->LinkCount() : 0;
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvLinkAt(const uint64_t& aID,
+                                                       const uint32_t& aIndex,
+                                                       uint64_t* aIDOfLink,
+                                                       bool* aOk) {
+  *aIDOfLink = 0;
+  *aOk = false;
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  if (acc) {
+    Accessible* link = acc->LinkAt(aIndex);
+    if (link) {
+      *aIDOfLink = reinterpret_cast<uint64_t>(link->UniqueID());
+      *aOk = true;
+    }
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvLinkIndexOf(
+    const uint64_t& aID, const uint64_t& aLinkID, int32_t* aIndex) {
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  Accessible* link = IdToAccessible(aLinkID);
+  *aIndex = -1;
+  if (acc && link) {
+    *aIndex = acc->LinkIndexOf(link);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvLinkIndexAtOffset(
+    const uint64_t& aID, const uint32_t& aOffset, int32_t* aIndex) {
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  *aIndex = acc ? acc->LinkIndexAtOffset(aOffset) : -1;
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTableOfACell(
+    const uint64_t& aID, uint64_t* aTableID, bool* aOk) {
+  *aTableID = 0;
+  *aOk = false;
+  TableCellAccessible* acc = IdToTableCellAccessible(aID);
+  if (acc) {
+    TableAccessible* table = acc->Table();
+    if (table) {
+      *aTableID = reinterpret_cast<uint64_t>(table->AsAccessible()->UniqueID());
+      *aOk = true;
+    }
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvColIdx(const uint64_t& aID,
+                                                       uint32_t* aIndex) {
+  *aIndex = 0;
+  TableCellAccessible* acc = IdToTableCellAccessible(aID);
+  if (acc) {
+    *aIndex = acc->ColIdx();
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvRowIdx(const uint64_t& aID,
+                                                       uint32_t* aIndex) {
+  *aIndex = 0;
+  TableCellAccessible* acc = IdToTableCellAccessible(aID);
+  if (acc) {
+    *aIndex = acc->RowIdx();
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvGetPosition(const uint64_t& aID,
+                                                            uint32_t* aColIdx,
+                                                            uint32_t* aRowIdx) {
+  *aColIdx = 0;
+  *aRowIdx = 0;
+  TableCellAccessible* acc = IdToTableCellAccessible(aID);
+  if (acc) {
+    *aColIdx = acc->ColIdx();
+    *aRowIdx = acc->RowIdx();
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvGetColRowExtents(
+    const uint64_t& aID, uint32_t* aColIdx, uint32_t* aRowIdx,
+    uint32_t* aColExtent, uint32_t* aRowExtent) {
+  *aColIdx = 0;
+  *aRowIdx = 0;
+  *aColExtent = 0;
+  *aRowExtent = 0;
+  TableCellAccessible* acc = IdToTableCellAccessible(aID);
+  if (acc) {
+    *aColIdx = acc->ColIdx();
+    *aRowIdx = acc->RowIdx();
+    *aColExtent = acc->ColExtent();
+    *aRowExtent = acc->RowExtent();
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvColExtent(const uint64_t& aID,
+                                                          uint32_t* aExtent) {
+  *aExtent = 0;
+  TableCellAccessible* acc = IdToTableCellAccessible(aID);
+  if (acc) {
+    *aExtent = acc->ColExtent();
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvRowExtent(const uint64_t& aID,
+                                                          uint32_t* aExtent) {
+  *aExtent = 0;
+  TableCellAccessible* acc = IdToTableCellAccessible(aID);
+  if (acc) {
+    *aExtent = acc->RowExtent();
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvColHeaderCells(
+    const uint64_t& aID, nsTArray<uint64_t>* aCells) {
+  TableCellAccessible* acc = IdToTableCellAccessible(aID);
+  if (acc) {
+    AutoTArray<Accessible*, 10> headerCells;
+    acc->ColHeaderCells(&headerCells);
+    aCells->SetCapacity(headerCells.Length());
+    for (uint32_t i = 0; i < headerCells.Length(); ++i) {
+      aCells->AppendElement(
+          reinterpret_cast<uint64_t>(headerCells[i]->UniqueID()));
+    }
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvRowHeaderCells(
+    const uint64_t& aID, nsTArray<uint64_t>* aCells) {
+  TableCellAccessible* acc = IdToTableCellAccessible(aID);
+  if (acc) {
+    AutoTArray<Accessible*, 10> headerCells;
+    acc->RowHeaderCells(&headerCells);
+    aCells->SetCapacity(headerCells.Length());
+    for (uint32_t i = 0; i < headerCells.Length(); ++i) {
+      aCells->AppendElement(
+          reinterpret_cast<uint64_t>(headerCells[i]->UniqueID()));
+    }
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvIsCellSelected(
+    const uint64_t& aID, bool* aSelected) {
+  TableCellAccessible* acc = IdToTableCellAccessible(aID);
+  *aSelected = acc && acc->Selected();
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTableCaption(
+    const uint64_t& aID, uint64_t* aCaptionID, bool* aOk) {
+  *aCaptionID = 0;
+  *aOk = false;
+  TableAccessible* acc = IdToTableAccessible(aID);
+  if (acc) {
+    Accessible* caption = acc->Caption();
+    if (caption) {
+      *aCaptionID = reinterpret_cast<uint64_t>(caption->UniqueID());
+      *aOk = true;
+    }
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTableSummary(
+    const uint64_t& aID, nsString* aSummary) {
+  TableAccessible* acc = IdToTableAccessible(aID);
+  if (acc) {
+    acc->Summary(*aSummary);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTableColumnCount(
+    const uint64_t& aID, uint32_t* aColCount) {
+  *aColCount = 0;
+  TableAccessible* acc = IdToTableAccessible(aID);
+  if (acc) {
+    *aColCount = acc->ColCount();
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTableRowCount(
+    const uint64_t& aID, uint32_t* aRowCount) {
+  *aRowCount = 0;
+  TableAccessible* acc = IdToTableAccessible(aID);
+  if (acc) {
+    *aRowCount = acc->RowCount();
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTableCellAt(
+    const uint64_t& aID, const uint32_t& aRow, const uint32_t& aCol,
+    uint64_t* aCellID, bool* aOk) {
+  *aCellID = 0;
+  *aOk = false;
+  TableAccessible* acc = IdToTableAccessible(aID);
+  if (acc) {
+    Accessible* cell = acc->CellAt(aRow, aCol);
+    if (cell) {
+      *aCellID = reinterpret_cast<uint64_t>(cell->UniqueID());
+      *aOk = true;
+    }
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTableCellIndexAt(
+    const uint64_t& aID, const uint32_t& aRow, const uint32_t& aCol,
+    int32_t* aIndex) {
+  *aIndex = -1;
+  TableAccessible* acc = IdToTableAccessible(aID);
+  if (acc) {
+    *aIndex = acc->CellIndexAt(aRow, aCol);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTableColumnIndexAt(
+    const uint64_t& aID, const uint32_t& aCellIndex, int32_t* aCol) {
+  *aCol = -1;
+  TableAccessible* acc = IdToTableAccessible(aID);
+  if (acc) {
+    *aCol = acc->ColIndexAt(aCellIndex);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTableRowIndexAt(
+    const uint64_t& aID, const uint32_t& aCellIndex, int32_t* aRow) {
+  *aRow = -1;
+  TableAccessible* acc = IdToTableAccessible(aID);
+  if (acc) {
+    *aRow = acc->RowIndexAt(aCellIndex);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTableRowAndColumnIndicesAt(
+    const uint64_t& aID, const uint32_t& aCellIndex, int32_t* aRow,
+    int32_t* aCol) {
+  *aRow = -1;
+  *aCol = -1;
+  TableAccessible* acc = IdToTableAccessible(aID);
+  if (acc) {
+    acc->RowAndColIndicesAt(aCellIndex, aRow, aCol);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTableColumnExtentAt(
+    const uint64_t& aID, const uint32_t& aRow, const uint32_t& aCol,
+    uint32_t* aExtent) {
+  *aExtent = 0;
+  TableAccessible* acc = IdToTableAccessible(aID);
+  if (acc) {
+    *aExtent = acc->ColExtentAt(aRow, aCol);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTableRowExtentAt(
+    const uint64_t& aID, const uint32_t& aRow, const uint32_t& aCol,
+    uint32_t* aExtent) {
+  *aExtent = 0;
+  TableAccessible* acc = IdToTableAccessible(aID);
+  if (acc) {
+    *aExtent = acc->RowExtentAt(aRow, aCol);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTableColumnDescription(
+    const uint64_t& aID, const uint32_t& aCol, nsString* aDescription) {
+  TableAccessible* acc = IdToTableAccessible(aID);
+  if (acc) {
+    acc->ColDescription(aCol, *aDescription);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTableRowDescription(
+    const uint64_t& aID, const uint32_t& aRow, nsString* aDescription) {
+  TableAccessible* acc = IdToTableAccessible(aID);
+  if (acc) {
+    acc->RowDescription(aRow, *aDescription);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTableColumnSelected(
+    const uint64_t& aID, const uint32_t& aCol, bool* aSelected) {
+  *aSelected = false;
+  TableAccessible* acc = IdToTableAccessible(aID);
+  if (acc) {
+    *aSelected = acc->IsColSelected(aCol);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTableRowSelected(
+    const uint64_t& aID, const uint32_t& aRow, bool* aSelected) {
+  *aSelected = false;
+  TableAccessible* acc = IdToTableAccessible(aID);
+  if (acc) {
+    *aSelected = acc->IsRowSelected(aRow);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTableCellSelected(
+    const uint64_t& aID, const uint32_t& aRow, const uint32_t& aCol,
+    bool* aSelected) {
+  *aSelected = false;
+  TableAccessible* acc = IdToTableAccessible(aID);
+  if (acc) {
+    *aSelected = acc->IsCellSelected(aRow, aCol);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTableSelectedCellCount(
+    const uint64_t& aID, uint32_t* aSelectedCells) {
+  *aSelectedCells = 0;
+  TableAccessible* acc = IdToTableAccessible(aID);
+  if (acc) {
+    *aSelectedCells = acc->SelectedCellCount();
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTableSelectedColumnCount(
+    const uint64_t& aID, uint32_t* aSelectedColumns) {
+  *aSelectedColumns = 0;
+  TableAccessible* acc = IdToTableAccessible(aID);
+  if (acc) {
+    *aSelectedColumns = acc->SelectedColCount();
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTableSelectedRowCount(
+    const uint64_t& aID, uint32_t* aSelectedRows) {
+  *aSelectedRows = 0;
+  TableAccessible* acc = IdToTableAccessible(aID);
+  if (acc) {
+    *aSelectedRows = acc->SelectedRowCount();
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTableSelectedCells(
+    const uint64_t& aID, nsTArray<uint64_t>* aCellIDs) {
+  TableAccessible* acc = IdToTableAccessible(aID);
+  if (acc) {
+    AutoTArray<Accessible*, 30> cells;
+    acc->SelectedCells(&cells);
+    aCellIDs->SetCapacity(cells.Length());
+    for (uint32_t i = 0; i < cells.Length(); ++i) {
+      aCellIDs->AppendElement(reinterpret_cast<uint64_t>(cells[i]->UniqueID()));
+    }
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTableSelectedCellIndices(
+    const uint64_t& aID, nsTArray<uint32_t>* aCellIndices) {
+  TableAccessible* acc = IdToTableAccessible(aID);
+  if (acc) {
+    acc->SelectedCellIndices(aCellIndices);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTableSelectedColumnIndices(
+    const uint64_t& aID, nsTArray<uint32_t>* aColumnIndices) {
+  TableAccessible* acc = IdToTableAccessible(aID);
+  if (acc) {
+    acc->SelectedColIndices(aColumnIndices);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTableSelectedRowIndices(
+    const uint64_t& aID, nsTArray<uint32_t>* aRowIndices) {
+  TableAccessible* acc = IdToTableAccessible(aID);
+  if (acc) {
+    acc->SelectedRowIndices(aRowIndices);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTableSelectColumn(
+    const uint64_t& aID, const uint32_t& aCol) {
+  TableAccessible* acc = IdToTableAccessible(aID);
+  if (acc) {
+    acc->SelectCol(aCol);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTableSelectRow(
+    const uint64_t& aID, const uint32_t& aRow) {
+  TableAccessible* acc = IdToTableAccessible(aID);
+  if (acc) {
+    acc->SelectRow(aRow);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTableUnselectColumn(
+    const uint64_t& aID, const uint32_t& aCol) {
+  TableAccessible* acc = IdToTableAccessible(aID);
+  if (acc) {
+    acc->UnselectCol(aCol);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTableUnselectRow(
+    const uint64_t& aID, const uint32_t& aRow) {
+  TableAccessible* acc = IdToTableAccessible(aID);
+  if (acc) {
+    acc->UnselectRow(aRow);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTableIsProbablyForLayout(
+    const uint64_t& aID, bool* aForLayout) {
+  *aForLayout = false;
+  TableAccessible* acc = IdToTableAccessible(aID);
+  if (acc) {
+    *aForLayout = acc->IsProbablyLayoutTable();
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvAtkTableColumnHeader(
+    const uint64_t& aID, const int32_t& aCol, uint64_t* aHeader, bool* aOk) {
+  *aHeader = 0;
+  *aOk = false;
+
+#ifdef MOZ_ACCESSIBILITY_ATK
+  TableAccessible* acc = IdToTableAccessible(aID);
+  if (acc) {
+    Accessible* header = AccessibleWrap::GetColumnHeader(acc, aCol);
+    if (header) {
+      *aHeader = reinterpret_cast<uint64_t>(header->UniqueID());
+      *aOk = true;
+    }
+  }
+#endif
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvAtkTableRowHeader(
+    const uint64_t& aID, const int32_t& aRow, uint64_t* aHeader, bool* aOk) {
+  *aHeader = 0;
+  *aOk = false;
+
+#ifdef MOZ_ACCESSIBILITY_ATK
+  TableAccessible* acc = IdToTableAccessible(aID);
+  if (acc) {
+    Accessible* header = AccessibleWrap::GetRowHeader(acc, aRow);
+    if (header) {
+      *aHeader = reinterpret_cast<uint64_t>(header->UniqueID());
+      *aOk = true;
+    }
+  }
+#endif
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvSelectedItems(
+    const uint64_t& aID, nsTArray<uint64_t>* aSelectedItemIDs) {
+  Accessible* acc = IdToAccessibleSelect(aID);
+  if (acc) {
+    AutoTArray<Accessible*, 10> selectedItems;
+    acc->SelectedItems(&selectedItems);
+    aSelectedItemIDs->SetCapacity(selectedItems.Length());
+    for (size_t i = 0; i < selectedItems.Length(); ++i) {
+      aSelectedItemIDs->AppendElement(
+          reinterpret_cast<uint64_t>(selectedItems[i]->UniqueID()));
+    }
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvSelectedItemCount(
+    const uint64_t& aID, uint32_t* aCount) {
+  *aCount = 0;
+  Accessible* acc = IdToAccessibleSelect(aID);
+  if (acc) {
+    *aCount = acc->SelectedItemCount();
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvGetSelectedItem(
+    const uint64_t& aID, const uint32_t& aIndex, uint64_t* aSelected,
+    bool* aOk) {
+  *aSelected = 0;
+  *aOk = false;
+  Accessible* acc = IdToAccessibleSelect(aID);
+  if (acc) {
+    Accessible* item = acc->GetSelectedItem(aIndex);
+    if (item) {
+      *aSelected = reinterpret_cast<uint64_t>(item->UniqueID());
+      *aOk = true;
+    }
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvIsItemSelected(
+    const uint64_t& aID, const uint32_t& aIndex, bool* aSelected) {
+  *aSelected = false;
+  Accessible* acc = IdToAccessibleSelect(aID);
+  if (acc) {
+    *aSelected = acc->IsItemSelected(aIndex);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvAddItemToSelection(
+    const uint64_t& aID, const uint32_t& aIndex, bool* aSuccess) {
+  *aSuccess = false;
+  Accessible* acc = IdToAccessibleSelect(aID);
+  if (acc) {
+    *aSuccess = acc->AddItemToSelection(aIndex);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvRemoveItemFromSelection(
+    const uint64_t& aID, const uint32_t& aIndex, bool* aSuccess) {
+  *aSuccess = false;
+  Accessible* acc = IdToAccessibleSelect(aID);
+  if (acc) {
+    *aSuccess = acc->RemoveItemFromSelection(aIndex);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvSelectAll(const uint64_t& aID,
+                                                          bool* aSuccess) {
+  *aSuccess = false;
+  Accessible* acc = IdToAccessibleSelect(aID);
+  if (acc) {
+    *aSuccess = acc->SelectAll();
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvUnselectAll(const uint64_t& aID,
+                                                            bool* aSuccess) {
+  *aSuccess = false;
+  Accessible* acc = IdToAccessibleSelect(aID);
+  if (acc) {
+    *aSuccess = acc->UnselectAll();
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTakeSelection(
+    const uint64_t& aID) {
+  Accessible* acc = IdToAccessible(aID);
+  if (acc) {
+    acc->TakeSelection();
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvSetSelected(
+    const uint64_t& aID, const bool& aSelect) {
+  Accessible* acc = IdToAccessible(aID);
+  if (acc) {
+    acc->SetSelected(aSelect);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvDoAction(const uint64_t& aID,
+                                                         const uint8_t& aIndex,
+                                                         bool* aSuccess) {
+  *aSuccess = false;
+  Accessible* acc = IdToAccessible(aID);
+  if (acc) {
+    *aSuccess = acc->DoAction(aIndex);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvActionCount(const uint64_t& aID,
+                                                            uint8_t* aCount) {
+  *aCount = 0;
+  Accessible* acc = IdToAccessible(aID);
+  if (acc) {
+    *aCount = acc->ActionCount();
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvActionDescriptionAt(
+    const uint64_t& aID, const uint8_t& aIndex, nsString* aDescription) {
+  Accessible* acc = IdToAccessible(aID);
+  if (acc) {
+    acc->ActionDescriptionAt(aIndex, *aDescription);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvActionNameAt(
+    const uint64_t& aID, const uint8_t& aIndex, nsString* aName) {
+  Accessible* acc = IdToAccessible(aID);
+  if (acc) {
+    acc->ActionNameAt(aIndex, *aName);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvAccessKey(
+    const uint64_t& aID, uint32_t* aKey, uint32_t* aModifierMask) {
+  *aKey = 0;
+  *aModifierMask = 0;
+  Accessible* acc = IdToAccessible(aID);
+  if (acc) {
+    KeyBinding kb = acc->AccessKey();
+    *aKey = kb.Key();
+    *aModifierMask = kb.ModifierMask();
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvKeyboardShortcut(
+    const uint64_t& aID, uint32_t* aKey, uint32_t* aModifierMask) {
+  *aKey = 0;
+  *aModifierMask = 0;
+  Accessible* acc = IdToAccessible(aID);
+  if (acc) {
+    KeyBinding kb = acc->KeyboardShortcut();
+    *aKey = kb.Key();
+    *aModifierMask = kb.ModifierMask();
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvAtkKeyBinding(
+    const uint64_t& aID, nsString* aResult) {
+#ifdef MOZ_ACCESSIBILITY_ATK
+  Accessible* acc = IdToAccessible(aID);
+  if (acc) {
+    AccessibleWrap::GetKeyBinding(acc, *aResult);
+  }
+#endif
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvCurValue(const uint64_t& aID,
+                                                         double* aValue) {
+  *aValue = UnspecifiedNaN<double>();
+  Accessible* acc = IdToAccessible(aID);
+  if (acc) {
+    *aValue = acc->CurValue();
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvSetCurValue(
+    const uint64_t& aID, const double& aValue, bool* aRetVal) {
+  *aRetVal = false;
+  Accessible* acc = IdToAccessible(aID);
+  if (acc) {
+    *aRetVal = acc->SetCurValue(aValue);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvMinValue(const uint64_t& aID,
+                                                         double* aValue) {
+  *aValue = UnspecifiedNaN<double>();
+  Accessible* acc = IdToAccessible(aID);
+  if (acc) {
+    *aValue = acc->MinValue();
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvMaxValue(const uint64_t& aID,
+                                                         double* aValue) {
+  *aValue = UnspecifiedNaN<double>();
+  Accessible* acc = IdToAccessible(aID);
+  if (acc) {
+    *aValue = acc->MaxValue();
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvStep(const uint64_t& aID,
+                                                     double* aStep) {
+  *aStep = UnspecifiedNaN<double>();
+  Accessible* acc = IdToAccessible(aID);
+  if (acc) {
+    *aStep = acc->Step();
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTakeFocus(const uint64_t& aID) {
+  Accessible* acc = IdToAccessible(aID);
+  if (acc) {
+    acc->TakeFocus();
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvFocusedChild(
+    const uint64_t& aID, uint64_t* aChild, bool* aOk) {
+  *aChild = 0;
+  *aOk = false;
+  Accessible* acc = IdToAccessible(aID);
+  if (acc) {
+    Accessible* child = acc->FocusedChild();
+    if (child) {
+      *aChild = reinterpret_cast<uint64_t>(child->UniqueID());
+      *aOk = true;
+    }
+  }
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvLanguage(const uint64_t& aID,
+                                                         nsString* aLocale) {
+  Accessible* acc = IdToAccessible(aID);
+  if (acc) {
+    acc->Language(*aLocale);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvDocType(const uint64_t& aID,
+                                                        nsString* aType) {
+  Accessible* acc = IdToAccessible(aID);
+  if (acc && acc->IsDoc()) {
+    acc->AsDoc()->DocType(*aType);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvTitle(const uint64_t& aID,
+                                                      nsString* aTitle) {
+  Accessible* acc = IdToAccessible(aID);
+  if (acc) {
+    mozilla::ErrorResult rv;
+    acc->GetContent()->GetTextContent(*aTitle, rv);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvURL(const uint64_t& aID,
+                                                    nsString* aURL) {
+  Accessible* acc = IdToAccessible(aID);
+  if (acc && acc->IsDoc()) {
+    acc->AsDoc()->URL(*aURL);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvMimeType(const uint64_t& aID,
+                                                         nsString* aMime) {
+  Accessible* acc = IdToAccessible(aID);
+  if (acc && acc->IsDoc()) {
+    acc->AsDoc()->MimeType(*aMime);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvURLDocTypeMimeType(
+    const uint64_t& aID, nsString* aURL, nsString* aDocType,
+    nsString* aMimeType) {
+  Accessible* acc = IdToAccessible(aID);
+  if (acc && acc->IsDoc()) {
+    DocAccessible* doc = acc->AsDoc();
+    doc->URL(*aURL);
+    doc->DocType(*aDocType);
+    doc->MimeType(*aMimeType);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvChildAtPoint(
+    const uint64_t& aID, const int32_t& aX, const int32_t& aY,
+    const uint32_t& aWhich, PDocAccessibleChild** aResultDoc,
+    uint64_t* aResultID) {
+  *aResultDoc = nullptr;
+  *aResultID = 0;
+  Accessible* acc = IdToAccessible(aID);
+  if (acc && !acc->IsDefunct()) {
+    int32_t x = aX;
+    int32_t y = aY;
+    Accessible* result = acc->ChildAtPoint(
+        x, y, static_cast<Accessible::EWhichChildAtPoint>(aWhich));
+    if (result) {
+      // Accessible::ChildAtPoint can return an Accessible from a descendant
+      // document.
+      DocAccessibleChild* resultDoc = result->Document()->IPCDoc();
+      // We've sent the constructor for this document to the parent process.
+      // However, because the constructor is async, the parent process might
+      // get the result of this (sync) method before it runs the constructor.
+      // If we send this document in this case, the parent process will crash.
+      // Therefore, we only do this if the parent process has explicitly told
+      // us that the document has been constructed there.
+      if (resultDoc && resultDoc->IsConstructedInParentProcess()) {
+        *aResultDoc = resultDoc;
+        *aResultID = result->IsDoc()
+                         ? 0
+                         : reinterpret_cast<uint64_t>(result->UniqueID());
+      }
+    }
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvExtents(
+    const uint64_t& aID, const bool& aNeedsScreenCoords, int32_t* aX,
+    int32_t* aY, int32_t* aWidth, int32_t* aHeight) {
+  *aX = 0;
+  *aY = 0;
+  *aWidth = 0;
+  *aHeight = 0;
+  Accessible* acc = IdToAccessible(aID);
+  if (acc && !acc->IsDefunct()) {
+    nsIntRect screenRect = acc->Bounds();
+    if (!screenRect.IsEmpty()) {
+      if (aNeedsScreenCoords) {
+        nsIntPoint winCoords =
+            nsCoreUtils::GetScreenCoordsForWindow(acc->GetNode());
+        screenRect.x -= winCoords.x;
+        screenRect.y -= winCoords.y;
+      }
+
+      *aX = screenRect.x;
+      *aY = screenRect.y;
+      *aWidth = screenRect.width;
+      *aHeight = screenRect.height;
+    }
+  }
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvExtentsInCSSPixels(
+    const uint64_t& aID, int32_t* aX, int32_t* aY, int32_t* aWidth,
+    int32_t* aHeight) {
+  *aX = 0;
+  *aY = 0;
+  *aWidth = 0;
+  *aHeight = 0;
+  Accessible* acc = IdToAccessible(aID);
+  if (acc && !acc->IsDefunct()) {
+    nsIntRect screenRect = acc->BoundsInCSSPixels();
+    if (!screenRect.IsEmpty()) {
+      *aX = screenRect.x;
+      *aY = screenRect.y;
+      *aWidth = screenRect.width;
+      *aHeight = screenRect.height;
+    }
+  }
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvDOMNodeID(
+    const uint64_t& aID, nsString* aDOMNodeID) {
+  Accessible* acc = IdToAccessible(aID);
+  if (!acc) {
+    return IPC_OK();
+  }
+
+  nsIContent* content = acc->GetContent();
+  if (!content) {
+    return IPC_OK();
+  }
+
+  nsAtom* id = content->GetID();
+  if (id) {
+    id->ToString(*aDOMNodeID);
+  }
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvConstructedInParentProcess() {
+  SetConstructedInParentProcess();
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult DocAccessibleChild::RecvRestoreFocus() {
+  FocusMgr()->ForceFocusEvent();
+  return IPC_OK();
+}
+
+bool DocAccessibleChild::DeallocPDocAccessiblePlatformExtChild(
+    PDocAccessiblePlatformExtChild* aActor) {
+  delete aActor;
+  return true;
+}
+
+PDocAccessiblePlatformExtChild*
+DocAccessibleChild::AllocPDocAccessiblePlatformExtChild() {
+  return new DocAccessiblePlatformExtChild();
+}
+
+DocAccessiblePlatformExtChild* DocAccessibleChild::GetPlatformExtension() {
+  return static_cast<DocAccessiblePlatformExtChild*>(
+      SingleManagedOrNull(ManagedPDocAccessiblePlatformExtChild()));
+}
+
+}  // namespace a11y
+}  // namespace mozilla
diff --git a/accessible/ipc/other/DocAccessibleChild.h b/accessible/ipc/other/DocAccessibleChild.h
new file mode 100644
index 0000000000..f568ce6ad6
--- /dev/null
+++ b/accessible/ipc/other/DocAccessibleChild.h
@@ -0,0 +1,501 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_a11y_DocAccessibleChild_h
+#define mozilla_a11y_DocAccessibleChild_h
+
+#include "mozilla/a11y/DocAccessibleChildBase.h"
+
+namespace mozilla {
+namespace a11y {
+
+class Accessible;
+class DocAccessiblePlatformExtChild;
+class HyperTextAccessible;
+class TextLeafAccessible;
+class ImageAccessible;
+class TableAccessible;
+class TableCellAccessible;
+
+/*
+ * These objects handle content side communication for an accessible document,
+ * and their lifetime is the same as the document they represent.
+ */
+class DocAccessibleChild : public DocAccessibleChildBase {
+  friend DocAccessiblePlatformExtChild;
+
+ public:
+  DocAccessibleChild(DocAccessible* aDoc, IProtocol* aManager)
+      : DocAccessibleChildBase(aDoc) {
+    MOZ_COUNT_CTOR_INHERITED(DocAccessibleChild, DocAccessibleChildBase);
+    SetManager(aManager);
+  }
+
+  ~DocAccessibleChild() {
+    MOZ_COUNT_DTOR_INHERITED(DocAccessibleChild, DocAccessibleChildBase);
+  }
+
+  virtual mozilla::ipc::IPCResult RecvConstructedInParentProcess() override;
+  virtual mozilla::ipc::IPCResult RecvRestoreFocus() override;
+
+  /*
+   * Return the state for the accessible with given ID.
+   */
+  virtual mozilla::ipc::IPCResult RecvState(const uint64_t& aID,
+                                            uint64_t* aState) override;
+
+  /*
+   * Return the native state for the accessible with given ID.
+   */
+  virtual mozilla::ipc::IPCResult RecvNativeState(const uint64_t& aID,
+                                                  uint64_t* aState) override;
+
+  /*
+   * Get the name for the accessible with given id.
+   */
+  virtual mozilla::ipc::IPCResult RecvName(const uint64_t& aID, nsString* aName,
+                                           uint32_t* aFlag) override;
+
+  virtual mozilla::ipc::IPCResult RecvValue(const uint64_t& aID,
+                                            nsString* aValue) override;
+
+  virtual mozilla::ipc::IPCResult RecvHelp(const uint64_t& aID,
+                                           nsString* aHelp) override;
+
+  /*
+   * Get the description for the accessible with given id.
+   */
+  virtual mozilla::ipc::IPCResult RecvDescription(const uint64_t& aID,
+                                                  nsString* aDesc) override;
+  virtual mozilla::ipc::IPCResult RecvRelationByType(
+      const uint64_t& aID, const uint32_t& aType,
+      nsTArray<uint64_t>* aTargets) override;
+  virtual mozilla::ipc::IPCResult RecvRelations(
+      const uint64_t& aID, nsTArray<RelationTargets>* aRelations) override;
+
+  virtual mozilla::ipc::IPCResult RecvIsSearchbox(const uint64_t& aID,
+                                                  bool* aRetVal) override;
+
+  virtual mozilla::ipc::IPCResult RecvLandmarkRole(
+      const uint64_t& aID, nsString* aLandmark) override;
+
+  virtual mozilla::ipc::IPCResult RecvARIARoleAtom(const uint64_t& aID,
+                                                   nsString* aRole) override;
+
+  virtual mozilla::ipc::IPCResult RecvGroupPosition(
+      const uint64_t& aID, int32_t* aLevel, int32_t* aSimilarItemsInGroup,
+      int32_t* aPositionInGroup) override;
+
+  virtual mozilla::ipc::IPCResult RecvAttributes(
+      const uint64_t& aID, nsTArray<Attribute>* aAttributes) override;
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY
+  virtual mozilla::ipc::IPCResult RecvScrollTo(
+      const uint64_t& aID, const uint32_t& aScrollType) override;
+  virtual mozilla::ipc::IPCResult RecvScrollToPoint(const uint64_t& aID,
+                                                    const uint32_t& aScrollType,
+                                                    const int32_t& aX,
+                                                    const int32_t& aY) override;
+
+  virtual mozilla::ipc::IPCResult RecvAnnounce(
+      const uint64_t& aID, const nsString& aAnnouncement,
+      const uint16_t& aPriority) override;
+
+  virtual mozilla::ipc::IPCResult RecvCaretLineNumber(
+      const uint64_t& aID, int32_t* aLineNumber) override;
+  virtual mozilla::ipc::IPCResult RecvCaretOffset(const uint64_t& aID,
+                                                  int32_t* aOffset) override;
+  virtual mozilla::ipc::IPCResult RecvSetCaretOffset(
+      const uint64_t& aID, const int32_t& aOffset) override;
+
+  virtual mozilla::ipc::IPCResult RecvCharacterCount(const uint64_t& aID,
+                                                     int32_t* aCount) override;
+  virtual mozilla::ipc::IPCResult RecvSelectionCount(const uint64_t& aID,
+                                                     int32_t* aCount) override;
+
+  virtual mozilla::ipc::IPCResult RecvTextSubstring(const uint64_t& aID,
+                                                    const int32_t& aStartOffset,
+                                                    const int32_t& aEndOffset,
+                                                    nsString* aText,
+                                                    bool* aValid) override;
+
+  virtual mozilla::ipc::IPCResult RecvGetTextAfterOffset(
+      const uint64_t& aID, const int32_t& aOffset, const int32_t& aBoundaryType,
+      nsString* aText, int32_t* aStartOffset, int32_t* aEndOffset) override;
+  virtual mozilla::ipc::IPCResult RecvGetTextAtOffset(
+      const uint64_t& aID, const int32_t& aOffset, const int32_t& aBoundaryType,
+      nsString* aText, int32_t* aStartOffset, int32_t* aEndOffset) override;
+  virtual mozilla::ipc::IPCResult RecvGetTextBeforeOffset(
+      const uint64_t& aID, const int32_t& aOffset, const int32_t& aBoundaryType,
+      nsString* aText, int32_t* aStartOffset, int32_t* aEndOffset) override;
+
+  virtual mozilla::ipc::IPCResult RecvCharAt(const uint64_t& aID,
+                                             const int32_t& aOffset,
+                                             uint16_t* aChar) override;
+
+  virtual mozilla::ipc::IPCResult RecvTextAttributes(
+      const uint64_t& aID, const bool& aIncludeDefAttrs, const int32_t& aOffset,
+      nsTArray<Attribute>* aAttributes, int32_t* aStartOffset,
+      int32_t* aEndOffset) override;
+
+  virtual mozilla::ipc::IPCResult RecvDefaultTextAttributes(
+      const uint64_t& aID, nsTArray<Attribute>* aAttributes) override;
+
+  virtual mozilla::ipc::IPCResult RecvTextBounds(const uint64_t& aID,
+                                                 const int32_t& aStartOffset,
+                                                 const int32_t& aEndOffset,
+                                                 const uint32_t& aCoordType,
+                                                 nsIntRect* aRetVal) override;
+
+  virtual mozilla::ipc::IPCResult RecvCharBounds(const uint64_t& aID,
+                                                 const int32_t& aOffset,
+                                                 const uint32_t& aCoordType,
+                                                 nsIntRect* aRetVal) override;
+
+  virtual mozilla::ipc::IPCResult RecvOffsetAtPoint(const uint64_t& aID,
+                                                    const int32_t& aX,
+                                                    const int32_t& aY,
+                                                    const uint32_t& aCoordType,
+                                                    int32_t* aRetVal) override;
+
+  virtual mozilla::ipc::IPCResult RecvSelectionBoundsAt(
+      const uint64_t& aID, const int32_t& aSelectionNum, bool* aSucceeded,
+      nsString* aData, int32_t* aStartOffset, int32_t* aEndOffset) override;
+
+  virtual mozilla::ipc::IPCResult RecvSetSelectionBoundsAt(
+      const uint64_t& aID, const int32_t& aSelectionNum,
+      const int32_t& aStartOffset, const int32_t& aEndOffset,
+      bool* aSucceeded) override;
+
+  virtual mozilla::ipc::IPCResult RecvAddToSelection(
+      const uint64_t& aID, const int32_t& aStartOffset,
+      const int32_t& aEndOffset, bool* aSucceeded) override;
+
+  virtual mozilla::ipc::IPCResult RecvRemoveFromSelection(
+      const uint64_t& aID, const int32_t& aSelectionNum,
+      bool* aSucceeded) override;
+
+  virtual mozilla::ipc::IPCResult RecvScrollSubstringTo(
+      const uint64_t& aID, const int32_t& aStartOffset,
+      const int32_t& aEndOffset, const uint32_t& aScrollType) override;
+
+  virtual mozilla::ipc::IPCResult RecvScrollSubstringToPoint(
+      const uint64_t& aID, const int32_t& aStartOffset,
+      const int32_t& aEndOffset, const uint32_t& aCoordinateType,
+      const int32_t& aX, const int32_t& aY) override;
+
+  virtual mozilla::ipc::IPCResult RecvText(const uint64_t& aID,
+                                           nsString* aText) override;
+
+  virtual mozilla::ipc::IPCResult RecvReplaceText(
+      const uint64_t& aID, const nsString& aText) override;
+
+  virtual mozilla::ipc::IPCResult RecvInsertText(const uint64_t& aID,
+                                                 const nsString& aText,
+                                                 const int32_t& aPosition,
+                                                 bool* aValid) override;
+
+  virtual mozilla::ipc::IPCResult RecvCopyText(const uint64_t& aID,
+                                               const int32_t& aStartPos,
+                                               const int32_t& aEndPos,
+                                               bool* aValid) override;
+
+  virtual mozilla::ipc::IPCResult RecvCutText(const uint64_t& aID,
+                                              const int32_t& aStartPos,
+                                              const int32_t& aEndPos,
+                                              bool* aValid) override;
+
+  virtual mozilla::ipc::IPCResult RecvDeleteText(const uint64_t& aID,
+                                                 const int32_t& aStartPos,
+                                                 const int32_t& aEndPos,
+                                                 bool* aValid) override;
+
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY
+  virtual mozilla::ipc::IPCResult RecvPasteText(const uint64_t& aID,
+                                                const int32_t& aPosition,
+                                                bool* aValid) override;
+
+  virtual mozilla::ipc::IPCResult RecvImagePosition(
+      const uint64_t& aID, const uint32_t& aCoordType,
+      nsIntPoint* aRetVal) override;
+
+  virtual mozilla::ipc::IPCResult RecvImageSize(const uint64_t& aID,
+                                                nsIntSize* aRetVal) override;
+
+  virtual mozilla::ipc::IPCResult RecvStartOffset(const uint64_t& aID,
+                                                  uint32_t* aRetVal,
+                                                  bool* aOk) override;
+  virtual mozilla::ipc::IPCResult RecvEndOffset(const uint64_t& aID,
+                                                uint32_t* aRetVal,
+                                                bool* aOk) override;
+  virtual mozilla::ipc::IPCResult RecvIsLinkValid(const uint64_t& aID,
+                                                  bool* aRetVal) override;
+  virtual mozilla::ipc::IPCResult RecvAnchorCount(const uint64_t& aID,
+                                                  uint32_t* aRetVal,
+                                                  bool* aOk) override;
+  virtual mozilla::ipc::IPCResult RecvAnchorURIAt(const uint64_t& aID,
+                                                  const uint32_t& aIndex,
+                                                  nsCString* aURI,
+                                                  bool* aOk) override;
+  virtual mozilla::ipc::IPCResult RecvAnchorAt(const uint64_t& aID,
+                                               const uint32_t& aIndex,
+                                               uint64_t* aIDOfAnchor,
+                                               bool* aOk) override;
+
+  virtual mozilla::ipc::IPCResult RecvLinkCount(const uint64_t& aID,
+                                                uint32_t* aCount) override;
+
+  virtual mozilla::ipc::IPCResult RecvLinkAt(const uint64_t& aID,
+                                             const uint32_t& aIndex,
+                                             uint64_t* aIDOfLink,
+                                             bool* aOk) override;
+
+  virtual mozilla::ipc::IPCResult RecvLinkIndexOf(const uint64_t& aID,
+                                                  const uint64_t& aLinkID,
+                                                  int32_t* aIndex) override;
+
+  virtual mozilla::ipc::IPCResult RecvLinkIndexAtOffset(
+      const uint64_t& aID, const uint32_t& aOffset, int32_t* aIndex) override;
+
+  virtual mozilla::ipc::IPCResult RecvTableOfACell(const uint64_t& aID,
+                                                   uint64_t* aTableID,
+                                                   bool* aOk) override;
+
+  virtual mozilla::ipc::IPCResult RecvColIdx(const uint64_t& aID,
+                                             uint32_t* aIndex) override;
+
+  virtual mozilla::ipc::IPCResult RecvRowIdx(const uint64_t& aID,
+                                             uint32_t* aIndex) override;
+
+  virtual mozilla::ipc::IPCResult RecvColExtent(const uint64_t& aID,
+                                                uint32_t* aExtent) override;
+
+  virtual mozilla::ipc::IPCResult RecvGetPosition(const uint64_t& aID,
+                                                  uint32_t* aColIdx,
+                                                  uint32_t* aRowIdx) override;
+
+  virtual mozilla::ipc::IPCResult RecvGetColRowExtents(
+      const uint64_t& aID, uint32_t* aColIdx, uint32_t* aRowIdx,
+      uint32_t* aColExtent, uint32_t* aRowExtent) override;
+
+  virtual mozilla::ipc::IPCResult RecvRowExtent(const uint64_t& aID,
+                                                uint32_t* aExtent) override;
+
+  virtual mozilla::ipc::IPCResult RecvColHeaderCells(
+      const uint64_t& aID, nsTArray<uint64_t>* aCells) override;
+
+  virtual mozilla::ipc::IPCResult RecvRowHeaderCells(
+      const uint64_t& aID, nsTArray<uint64_t>* aCells) override;
+
+  virtual mozilla::ipc::IPCResult RecvIsCellSelected(const uint64_t& aID,
+                                                     bool* aSelected) override;
+
+  virtual mozilla::ipc::IPCResult RecvTableCaption(const uint64_t& aID,
+                                                   uint64_t* aCaptionID,
+                                                   bool* aOk) override;
+  virtual mozilla::ipc::IPCResult RecvTableSummary(const uint64_t& aID,
+                                                   nsString* aSummary) override;
+  virtual mozilla::ipc::IPCResult RecvTableColumnCount(
+      const uint64_t& aID, uint32_t* aColCount) override;
+  virtual mozilla::ipc::IPCResult RecvTableRowCount(
+      const uint64_t& aID, uint32_t* aRowCount) override;
+  virtual mozilla::ipc::IPCResult RecvTableCellAt(const uint64_t& aID,
+                                                  const uint32_t& aRow,
+                                                  const uint32_t& aCol,
+                                                  uint64_t* aCellID,
+                                                  bool* aOk) override;
+  virtual mozilla::ipc::IPCResult RecvTableCellIndexAt(
+      const uint64_t& aID, const uint32_t& aRow, const uint32_t& aCol,
+      int32_t* aIndex) override;
+  virtual mozilla::ipc::IPCResult RecvTableColumnIndexAt(
+      const uint64_t& aID, const uint32_t& aCellIndex, int32_t* aCol) override;
+  virtual mozilla::ipc::IPCResult RecvTableRowIndexAt(
+      const uint64_t& aID, const uint32_t& aCellIndex, int32_t* aRow) override;
+  virtual mozilla::ipc::IPCResult RecvTableRowAndColumnIndicesAt(
+      const uint64_t& aID, const uint32_t& aCellIndex, int32_t* aRow,
+      int32_t* aCol) override;
+  virtual mozilla::ipc::IPCResult RecvTableColumnExtentAt(
+      const uint64_t& aID, const uint32_t& aRow, const uint32_t& aCol,
+      uint32_t* aExtent) override;
+  virtual mozilla::ipc::IPCResult RecvTableRowExtentAt(
+      const uint64_t& aID, const uint32_t& aRow, const uint32_t& aCol,
+      uint32_t* aExtent) override;
+  virtual mozilla::ipc::IPCResult RecvTableColumnDescription(
+      const uint64_t& aID, const uint32_t& aCol,
+      nsString* aDescription) override;
+  virtual mozilla::ipc::IPCResult RecvTableRowDescription(
+      const uint64_t& aID, const uint32_t& aRow,
+      nsString* aDescription) override;
+  virtual mozilla::ipc::IPCResult RecvTableColumnSelected(
+      const uint64_t& aID, const uint32_t& aCol, bool* aSelected) override;
+  virtual mozilla::ipc::IPCResult RecvTableRowSelected(
+      const uint64_t& aID, const uint32_t& aRow, bool* aSelected) override;
+  virtual mozilla::ipc::IPCResult RecvTableCellSelected(
+      const uint64_t& aID, const uint32_t& aRow, const uint32_t& aCol,
+      bool* aSelected) override;
+  virtual mozilla::ipc::IPCResult RecvTableSelectedCellCount(
+      const uint64_t& aID, uint32_t* aSelectedCells) override;
+  virtual mozilla::ipc::IPCResult RecvTableSelectedColumnCount(
+      const uint64_t& aID, uint32_t* aSelectedColumns) override;
+  virtual mozilla::ipc::IPCResult RecvTableSelectedRowCount(
+      const uint64_t& aID, uint32_t* aSelectedRows) override;
+  virtual mozilla::ipc::IPCResult RecvTableSelectedCells(
+      const uint64_t& aID, nsTArray<uint64_t>* aCellIDs) override;
+  virtual mozilla::ipc::IPCResult RecvTableSelectedCellIndices(
+      const uint64_t& aID, nsTArray<uint32_t>* aCellIndices) override;
+  virtual mozilla::ipc::IPCResult RecvTableSelectedColumnIndices(
+      const uint64_t& aID, nsTArray<uint32_t>* aColumnIndices) override;
+  virtual mozilla::ipc::IPCResult RecvTableSelectedRowIndices(
+      const uint64_t& aID, nsTArray<uint32_t>* aRowIndices) override;
+  virtual mozilla::ipc::IPCResult RecvTableSelectColumn(
+      const uint64_t& aID, const uint32_t& aCol) override;
+  virtual mozilla::ipc::IPCResult RecvTableSelectRow(
+      const uint64_t& aID, const uint32_t& aRow) override;
+  virtual mozilla::ipc::IPCResult RecvTableUnselectColumn(
+      const uint64_t& aID, const uint32_t& aCol) override;
+  virtual mozilla::ipc::IPCResult RecvTableUnselectRow(
+      const uint64_t& aID, const uint32_t& aRow) override;
+  virtual mozilla::ipc::IPCResult RecvTableIsProbablyForLayout(
+      const uint64_t& aID, bool* aForLayout) override;
+  virtual mozilla::ipc::IPCResult RecvAtkTableColumnHeader(const uint64_t& aID,
+                                                           const int32_t& aCol,
+                                                           uint64_t* aHeader,
+                                                           bool* aOk) override;
+  virtual mozilla::ipc::IPCResult RecvAtkTableRowHeader(const uint64_t& aID,
+                                                        const int32_t& aRow,
+                                                        uint64_t* aHeader,
+                                                        bool* aOk) override;
+
+  virtual mozilla::ipc::IPCResult RecvSelectedItems(
+      const uint64_t& aID, nsTArray<uint64_t>* aSelectedItemIDs) override;
+
+  virtual mozilla::ipc::IPCResult RecvSelectedItemCount(
+      const uint64_t& aID, uint32_t* aCount) override;
+
+  virtual mozilla::ipc::IPCResult RecvGetSelectedItem(const uint64_t& aID,
+                                                      const uint32_t& aIndex,
+                                                      uint64_t* aSelected,
+                                                      bool* aOk) override;
+
+  virtual mozilla::ipc::IPCResult RecvIsItemSelected(const uint64_t& aID,
+                                                     const uint32_t& aIndex,
+                                                     bool* aSelected) override;
+
+  virtual mozilla::ipc::IPCResult RecvAddItemToSelection(
+      const uint64_t& aID, const uint32_t& aIndex, bool* aSuccess) override;
+
+  virtual mozilla::ipc::IPCResult RecvRemoveItemFromSelection(
+      const uint64_t& aID, const uint32_t& aIndex, bool* aSuccess) override;
+
+  virtual mozilla::ipc::IPCResult RecvSelectAll(const uint64_t& aID,
+                                                bool* aSuccess) override;
+
+  virtual mozilla::ipc::IPCResult RecvUnselectAll(const uint64_t& aID,
+                                                  bool* aSuccess) override;
+
+  virtual mozilla::ipc::IPCResult RecvTakeSelection(
+      const uint64_t& aID) override;
+  virtual mozilla::ipc::IPCResult RecvSetSelected(const uint64_t& aID,
+                                                  const bool& aSelect) override;
+
+  virtual mozilla::ipc::IPCResult RecvDoAction(const uint64_t& aID,
+                                               const uint8_t& aIndex,
+                                               bool* aSuccess) override;
+
+  virtual mozilla::ipc::IPCResult RecvActionCount(const uint64_t& aID,
+                                                  uint8_t* aCount) override;
+
+  virtual mozilla::ipc::IPCResult RecvActionDescriptionAt(
+      const uint64_t& aID, const uint8_t& aIndex,
+      nsString* aDescription) override;
+
+  virtual mozilla::ipc::IPCResult RecvActionNameAt(const uint64_t& aID,
+                                                   const uint8_t& aIndex,
+                                                   nsString* aName) override;
+
+  virtual mozilla::ipc::IPCResult RecvAccessKey(
+      const uint64_t& aID, uint32_t* aKey, uint32_t* aModifierMask) override;
+
+  virtual mozilla::ipc::IPCResult RecvKeyboardShortcut(
+      const uint64_t& aID, uint32_t* aKey, uint32_t* aModifierMask) override;
+
+  virtual mozilla::ipc::IPCResult RecvAtkKeyBinding(const uint64_t& aID,
+                                                    nsString* aResult) override;
+
+  virtual mozilla::ipc::IPCResult RecvCurValue(const uint64_t& aID,
+                                               double* aValue) override;
+
+  virtual mozilla::ipc::IPCResult RecvSetCurValue(const uint64_t& aID,
+                                                  const double& aValue,
+                                                  bool* aRetVal) override;
+
+  virtual mozilla::ipc::IPCResult RecvMinValue(const uint64_t& aID,
+                                               double* aValue) override;
+
+  virtual mozilla::ipc::IPCResult RecvMaxValue(const uint64_t& aID,
+                                               double* aValue) override;
+
+  virtual mozilla::ipc::IPCResult RecvStep(const uint64_t& aID,
+                                           double* aStep) override;
+
+  virtual mozilla::ipc::IPCResult RecvTakeFocus(const uint64_t& aID) override;
+
+  virtual mozilla::ipc::IPCResult RecvFocusedChild(const uint64_t& aID,
+                                                   uint64_t* aChild,
+                                                   bool* aOk) override;
+
+  virtual mozilla::ipc::IPCResult RecvLanguage(const uint64_t& aID,
+                                               nsString* aLocale) override;
+  virtual mozilla::ipc::IPCResult RecvDocType(const uint64_t& aID,
+                                              nsString* aType) override;
+  virtual mozilla::ipc::IPCResult RecvTitle(const uint64_t& aID,
+                                            nsString* aTitle) override;
+  virtual mozilla::ipc::IPCResult RecvURL(const uint64_t& aID,
+                                          nsString* aURL) override;
+  virtual mozilla::ipc::IPCResult RecvMimeType(const uint64_t& aID,
+                                               nsString* aMime) override;
+  virtual mozilla::ipc::IPCResult RecvURLDocTypeMimeType(
+      const uint64_t& aID, nsString* aURL, nsString* aDocType,
+      nsString* aMimeType) override;
+
+  virtual mozilla::ipc::IPCResult RecvChildAtPoint(
+      const uint64_t& aID, const int32_t& aX, const int32_t& aY,
+      const uint32_t& aWhich, PDocAccessibleChild** aResultDoc,
+      uint64_t* aResultID) override;
+
+  virtual mozilla::ipc::IPCResult RecvExtents(const uint64_t& aID,
+                                              const bool& aNeedsScreenCoords,
+                                              int32_t* aX, int32_t* aY,
+                                              int32_t* aWidth,
+                                              int32_t* aHeight) override;
+  virtual mozilla::ipc::IPCResult RecvExtentsInCSSPixels(
+      const uint64_t& aID, int32_t* aX, int32_t* aY, int32_t* aWidth,
+      int32_t* aHeight) override;
+  virtual mozilla::ipc::IPCResult RecvDOMNodeID(const uint64_t& aID,
+                                                nsString* aDOMNodeID) override;
+
+  virtual bool DeallocPDocAccessiblePlatformExtChild(
+      PDocAccessiblePlatformExtChild* aActor) override;
+
+  virtual PDocAccessiblePlatformExtChild* AllocPDocAccessiblePlatformExtChild()
+      override;
+
+  DocAccessiblePlatformExtChild* GetPlatformExtension();
+
+ private:
+  Accessible* IdToAccessible(const uint64_t& aID) const;
+  Accessible* IdToAccessibleLink(const uint64_t& aID) const;
+  Accessible* IdToAccessibleSelect(const uint64_t& aID) const;
+  HyperTextAccessible* IdToHyperTextAccessible(const uint64_t& aID) const;
+  TextLeafAccessible* IdToTextLeafAccessible(const uint64_t& aID) const;
+  ImageAccessible* IdToImageAccessible(const uint64_t& aID) const;
+  TableCellAccessible* IdToTableCellAccessible(const uint64_t& aID) const;
+  TableAccessible* IdToTableAccessible(const uint64_t& aID) const;
+};
+
+}  // namespace a11y
+}  // namespace mozilla
+
+#endif
diff --git a/accessible/ipc/other/PDocAccessible.ipdl b/accessible/ipc/other/PDocAccessible.ipdl
new file mode 100644
index 0000000000..d47a704a62
--- /dev/null
+++ b/accessible/ipc/other/PDocAccessible.ipdl
@@ -0,0 +1,333 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+include protocol PFileDescriptorSet;
+include protocol PBrowser;
+include protocol PDocAccessiblePlatformExt;
+
+include "mozilla/GfxMessageUtils.h";
+
+using nsIntRect from "nsRect.h";
+using mozilla::a11y::role from "mozilla/a11y/IPCTypes.h";
+using mozilla::gfx::IntSize from "mozilla/gfx/Point.h";
+using mozilla::gfx::IntPoint from "mozilla/gfx/Point.h";
+
+namespace mozilla {
+namespace a11y {
+
+struct AccessibleData
+{
+  uint64_t ID;
+  role Role;
+  uint32_t ChildrenCount;
+  uint32_t Interfaces;
+};
+
+union OriginDocument
+{
+  PDocAccessible;
+};
+
+struct BatchData
+{
+  OriginDocument Document;
+  uint64_t ID;
+  uint64_t State;
+  nsIntRect Bounds;
+  uint8_t ActionCount;
+  nsString Name;
+  nsString TextValue;
+  nsString DOMNodeID;
+  nsString Description;
+  double CurValue;
+  double MinValue;
+  double MaxValue;
+  double Step;
+  Attribute[] Attributes;
+};
+
+struct ShowEventData
+{
+  uint64_t ID;
+  uint32_t Idx;
+  AccessibleData[] NewTree;
+  bool EventSuppressed;
+};
+
+struct Attribute
+{
+  nsCString Name;
+  nsString Value;
+};
+
+struct RelationTargets
+{
+  uint32_t Type;
+  uint64_t[] Targets;
+};
+
+struct TextRangeData
+{
+  uint64_t StartID;
+  uint64_t EndID;
+  int32_t StartOffset;
+  int32_t EndOffset;
+};
+
+nested(upto inside_sync) sync protocol PDocAccessible
+{
+  manager PBrowser;
+  manages PDocAccessiblePlatformExt;
+
+parent:
+  async PDocAccessiblePlatformExt();
+  async Shutdown();
+
+  /*
+   * Notify the parent process the document in the child process is firing an
+   * event.
+   */
+  async Event(uint64_t aID, uint32_t type);
+  async ShowEvent(ShowEventData data, bool aFromuser);
+  async HideEvent(uint64_t aRootID, bool aFromUser);
+  async StateChangeEvent(uint64_t aID, uint64_t aState, bool aEnabled);
+  async CaretMoveEvent(uint64_t aID, int32_t aOffset, bool aIsSelectionCollapsed);
+  async TextChangeEvent(uint64_t aID, nsString aStr, int32_t aStart, uint32_t aLen,
+                        bool aIsInsert, bool aFromUser);
+  async SelectionEvent(uint64_t aID, uint64_t aWidgetID, uint32_t aType);
+  async RoleChangedEvent(role aRole);
+  async VirtualCursorChangeEvent(uint64_t aID,
+                                 uint64_t aOldPosition,
+                                 int32_t aOldStartOffset, int32_t aOldEndOffset,
+                                 uint64_t aPosition,
+                                 int32_t aStartOffset, int32_t aEndOffset,
+                                 int16_t aReason, int16_t aBoundaryType,
+                                 bool aFromUservcEvent);
+  async ScrollingEvent(uint64_t aID, uint64_t aType,
+                       uint32_t aScrollX, uint32_t aScrollY,
+                       uint32_t aMaxScrollX, uint32_t aMaxScrollY);
+  async AnnouncementEvent(uint64_t aID,
+                          nsString aAnnouncement,
+                          uint16_t aPriority);
+  async TextSelectionChangeEvent(uint64_t aID, TextRangeData[] aSelection);
+
+  /*
+   * Tell the parent document to bind the existing document as a new child
+   * document.
+   */
+  async BindChildDoc(PDocAccessible aChildDoc, uint64_t aID);
+
+  // Android
+  async Batch(uint64_t aBatchType, BatchData[] aData);
+
+child:
+  /*
+   * Notify the content process that the PDocAccessible has finished being
+   * constructed in the parent process.
+   */
+  async ConstructedInParentProcess();
+
+  async __delete__();
+
+  /*
+   * Called as a result of focus shifting from chrome to content
+   * elements through keyboard navigation.
+   */
+  async RestoreFocus();
+
+  // Accessible
+  nested(inside_sync) sync State(uint64_t aID) returns(uint64_t states);
+  nested(inside_sync) sync NativeState(uint64_t aID) returns(uint64_t states);
+  nested(inside_sync) sync Name(uint64_t aID) returns(nsString name, uint32_t flag);
+  nested(inside_sync) sync Value(uint64_t aID) returns(nsString value);
+  nested(inside_sync) sync Help(uint64_t aID) returns(nsString help);
+  nested(inside_sync) sync Description(uint64_t aID) returns(nsString desc);
+  nested(inside_sync) sync Attributes(uint64_t aID) returns(Attribute[] attributes);
+  nested(inside_sync) sync RelationByType(uint64_t aID, uint32_t aRelationType)
+    returns(uint64_t[] targets);
+  nested(inside_sync) sync Relations(uint64_t aID) returns(RelationTargets[] relations);
+  nested(inside_sync) sync IsSearchbox(uint64_t aID) returns(bool retval);
+  nested(inside_sync) sync LandmarkRole(uint64_t aID) returns(nsString landmark);
+  nested(inside_sync) sync ARIARoleAtom(uint64_t aID) returns(nsString ariaRole);
+  nested(inside_sync) sync GroupPosition(uint64_t aID)
+    returns(int32_t groupLevel, int32_t similarItemsInGroup, int32_t positionInGroup);
+  async ScrollTo(uint64_t aID, uint32_t aScrollType);
+  async ScrollToPoint(uint64_t aID, uint32_t aScrollType, int32_t aX,
+                      int32_t aY);
+  async Announce(uint64_t aID, nsString aAnnouncement, uint16_t aPriority);
+
+  // AccessibleText
+
+  // TextSubstring is getText in IDL.
+  nested(inside_sync) sync CaretLineNumber(uint64_t aID) returns(int32_t aLineNumber);
+  nested(inside_sync) sync CaretOffset(uint64_t aID) returns(int32_t aOffset);
+   async SetCaretOffset(uint64_t aID, int32_t aOffset);
+  nested(inside_sync) sync CharacterCount(uint64_t aID) returns(int32_t aCount);
+  nested(inside_sync) sync SelectionCount(uint64_t aID) returns(int32_t aCount);
+  nested(inside_sync) sync TextSubstring(uint64_t aID, int32_t aStartOffset, int32_t
+                                         aEndOffset) returns(nsString aText, bool aValid);
+  nested(inside_sync) sync GetTextAfterOffset(uint64_t aID, int32_t aOffset, int32_t aBoundaryType)
+    returns(nsString aText, int32_t aStartOffset, int32_t aEndOffset);
+  nested(inside_sync) sync GetTextAtOffset(uint64_t aID, int32_t aOffset, int32_t aBoundaryType)
+    returns(nsString aText, int32_t aStartOffset, int32_t aEndOffset);
+
+  nested(inside_sync) sync GetTextBeforeOffset(uint64_t aID, int32_t aOffset, int32_t aBoundaryType)
+    returns(nsString aText, int32_t aStartOffset, int32_t aEndOffset);
+  nested(inside_sync) sync CharAt(uint64_t aID, int32_t aOffset) returns(uint16_t aChar);
+
+  nested(inside_sync) sync TextAttributes(uint64_t aID, bool aIncludeDefAttrs, int32_t aOffset)
+    returns(Attribute[] aAttributes, int32_t aStartOffset, int32_t aEndOffset);
+  nested(inside_sync) sync DefaultTextAttributes(uint64_t aID) returns(Attribute[] aAttributes);
+
+  nested(inside_sync) sync TextBounds(uint64_t aID, int32_t aStartOffset, int32_t aEndOffset,
+                             uint32_t aCoordType)
+    returns(nsIntRect aRetVal);
+  nested(inside_sync) sync CharBounds(uint64_t aID, int32_t aOffset, uint32_t aCoordType)
+    returns(nsIntRect aRetVal);
+
+  nested(inside_sync) sync OffsetAtPoint(uint64_t aID, int32_t aX, int32_t aY, uint32_t aCoordType)
+    returns(int32_t aRetVal);
+
+  nested(inside_sync) sync SelectionBoundsAt(uint64_t aID, int32_t aSelectionNum)
+    returns(bool aSucceeded, nsString aData, int32_t aStartOffset, int32_t aEndOffset);
+  nested(inside_sync) sync SetSelectionBoundsAt(uint64_t aID, int32_t aSelectionNum,
+                                       int32_t aStartOffset, int32_t aEndOffset)
+    returns(bool aSucceeded);
+  nested(inside_sync) sync AddToSelection(uint64_t aID, int32_t aStartOffset, int32_t aEndOffset)
+    returns(bool aSucceeded);
+  nested(inside_sync) sync RemoveFromSelection(uint64_t aID, int32_t aSelectionNum)
+    returns(bool aSucceeded);
+
+  async ScrollSubstringTo(uint64_t aID, int32_t aStartOffset, int32_t aEndOffset,
+                          uint32_t aScrollType);
+  async ScrollSubstringToPoint(uint64_t aID,
+                               int32_t aStartOffset,
+                               int32_t aEndOffset,
+                               uint32_t aCoordinateType,
+                               int32_t aX, int32_t aY);
+
+  nested(inside_sync) sync Text(uint64_t aID) returns(nsString aText);
+  nested(inside_sync) sync ReplaceText(uint64_t aID, nsString aText);
+  nested(inside_sync) sync InsertText(uint64_t aID, nsString aText, int32_t aPosition)
+    returns(bool aValid);
+  nested(inside_sync) sync CopyText(uint64_t aID, int32_t aStartPos, int32_t aEndPos)
+    returns(bool aValid);
+  nested(inside_sync) sync CutText(uint64_t aID, int32_t aStartPos, int32_t aEndPos)
+    returns(bool aValid);
+  nested(inside_sync) sync DeleteText(uint64_t aID, int32_t aStartPos, int32_t aEndPos)
+    returns(bool aValid);
+  nested(inside_sync) sync PasteText(uint64_t aID, int32_t aPosition)
+    returns(bool aValid);
+
+  nested(inside_sync) sync ImagePosition(uint64_t aID, uint32_t aCoordType) returns(IntPoint aRetVal);
+  nested(inside_sync) sync ImageSize(uint64_t aID) returns(IntSize aRetVal);
+
+  nested(inside_sync) sync StartOffset(uint64_t aID) returns(uint32_t aRetVal, bool aOk);
+  nested(inside_sync) sync EndOffset(uint64_t aID) returns(uint32_t aRetVal, bool aOk);
+  nested(inside_sync) sync IsLinkValid(uint64_t aID) returns(bool aRetVal);
+  nested(inside_sync) sync AnchorCount(uint64_t aID) returns(uint32_t aRetVal, bool aOk);
+  nested(inside_sync) sync AnchorURIAt(uint64_t aID, uint32_t aIndex) returns(nsCString aURI, bool aOk);
+  nested(inside_sync) sync AnchorAt(uint64_t aID, uint32_t aIndex) returns(uint64_t aIDOfAnchor, bool aOk);
+
+  nested(inside_sync) sync LinkCount(uint64_t aID) returns(uint32_t aCount);
+  nested(inside_sync) sync LinkAt(uint64_t aID, uint32_t aIndex) returns(uint64_t aIDOfLink, bool aOk);
+  nested(inside_sync) sync LinkIndexOf(uint64_t aID, uint64_t aLinkID) returns(int32_t aIndex);
+  nested(inside_sync) sync LinkIndexAtOffset(uint64_t aID, uint32_t aOffset) returns(int32_t aIndex);
+
+  nested(inside_sync) sync TableOfACell(uint64_t aID) returns(uint64_t aTableID, bool aOk);
+  nested(inside_sync) sync ColIdx(uint64_t aID) returns(uint32_t aIndex);
+  nested(inside_sync) sync RowIdx(uint64_t aID) returns(uint32_t aIndex);
+  nested(inside_sync) sync GetPosition(uint64_t aID) returns(uint32_t aRow, uint32_t aCol);
+  nested(inside_sync) sync ColExtent(uint64_t aID) returns(uint32_t aExtent);
+  nested(inside_sync) sync RowExtent(uint64_t aID) returns(uint32_t aExtent);
+  nested(inside_sync) sync GetColRowExtents(uint64_t aID)
+    returns(uint32_t aCol, uint32_t aRow, uint32_t aColExtent, uint32_t aRowExtent);
+  nested(inside_sync) sync ColHeaderCells(uint64_t aID) returns(uint64_t[] aCells);
+  nested(inside_sync) sync RowHeaderCells(uint64_t aID) returns(uint64_t[] aCells);
+  nested(inside_sync) sync IsCellSelected(uint64_t aID) returns(bool aSelected);
+
+  nested(inside_sync) sync TableCaption(uint64_t aID) returns(uint64_t aCaptionID, bool aOk);
+  nested(inside_sync) sync TableSummary(uint64_t aID) returns(nsString aSummary);
+  nested(inside_sync) sync TableColumnCount(uint64_t aID) returns(uint32_t aColCount);
+  nested(inside_sync) sync TableRowCount(uint64_t aID) returns(uint32_t aRowCount);
+  nested(inside_sync) sync TableCellAt(uint64_t aID, uint32_t aRow, uint32_t aCol) returns(uint64_t aCellID, bool aOk);
+  nested(inside_sync) sync TableCellIndexAt(uint64_t aID, uint32_t aRow, uint32_t aCol) returns(int32_t aIndex);
+  nested(inside_sync) sync TableColumnIndexAt(uint64_t aID, uint32_t aCellIndex) returns(int32_t aCol);
+  nested(inside_sync) sync TableRowIndexAt(uint64_t aID, uint32_t aCellIndex) returns(int32_t aRow);
+  nested(inside_sync) sync TableRowAndColumnIndicesAt(uint64_t aID, uint32_t aCellIndex) returns(int32_t aRow, int32_t aCol);
+  nested(inside_sync) sync TableColumnExtentAt(uint64_t aID, uint32_t aRow, uint32_t aCol) returns(uint32_t aExtent);
+  nested(inside_sync) sync TableRowExtentAt(uint64_t aID, uint32_t aRow, uint32_t aCol) returns(uint32_t aExtent);
+  nested(inside_sync) sync TableColumnDescription(uint64_t aID, uint32_t aCol) returns(nsString aDescription);
+  nested(inside_sync) sync TableRowDescription(uint64_t aID, uint32_t aRow) returns(nsString aDescription);
+  nested(inside_sync) sync TableColumnSelected(uint64_t aID, uint32_t aCol) returns(bool aSelected);
+  nested(inside_sync) sync TableRowSelected(uint64_t aID, uint32_t aRow) returns(bool aSelected);
+  nested(inside_sync) sync TableCellSelected(uint64_t aID, uint32_t aRow, uint32_t aCol) returns(bool aSelected);
+  nested(inside_sync) sync TableSelectedCellCount(uint64_t aID) returns(uint32_t aSelectedCells);
+  nested(inside_sync) sync TableSelectedColumnCount(uint64_t aID) returns(uint32_t aSelectedColumns);
+  nested(inside_sync) sync TableSelectedRowCount(uint64_t aID) returns(uint32_t aSelectedRows);
+  nested(inside_sync) sync TableSelectedCells(uint64_t aID) returns(uint64_t[] aCellIDs);
+  nested(inside_sync) sync TableSelectedCellIndices(uint64_t aID) returns(uint32_t[] aCellIndeces);
+  nested(inside_sync) sync TableSelectedColumnIndices(uint64_t aID) returns(uint32_t[] aColumnIndeces);
+  nested(inside_sync) sync TableSelectedRowIndices(uint64_t aID) returns(uint32_t[] aRowIndeces);
+  nested(inside_sync) sync TableSelectColumn(uint64_t aID, uint32_t aCol);
+  nested(inside_sync) sync TableSelectRow(uint64_t aID, uint32_t aRow);
+  nested(inside_sync) sync TableUnselectColumn(uint64_t aID, uint32_t aCol);
+  nested(inside_sync) sync TableUnselectRow(uint64_t aID, uint32_t aRow);
+  nested(inside_sync) sync TableIsProbablyForLayout(uint64_t aID) returns(bool aForLayout);
+  nested(inside_sync) sync AtkTableColumnHeader(uint64_t aID, int32_t aCol)
+    returns(uint64_t aHeaderID, bool aOk);
+  nested(inside_sync) sync AtkTableRowHeader(uint64_t aID, int32_t aRow)
+    returns(uint64_t aHeaderID, bool aOk);
+
+  nested(inside_sync) sync SelectedItems(uint64_t aID) returns(uint64_t[] aSelectedItemIDs);
+  nested(inside_sync) sync SelectedItemCount(uint64_t aID) returns(uint32_t aCount);
+  nested(inside_sync) sync GetSelectedItem(uint64_t aID, uint32_t aIndex) returns(uint64_t aSelected, bool aOk);
+  nested(inside_sync) sync IsItemSelected(uint64_t aID, uint32_t aIndex) returns(bool aSelected);
+  nested(inside_sync) sync AddItemToSelection(uint64_t aID, uint32_t aIndex) returns(bool aSuccess);
+  nested(inside_sync) sync RemoveItemFromSelection(uint64_t aID, uint32_t aIndex) returns(bool aSuccess);
+  nested(inside_sync) sync SelectAll(uint64_t aID) returns(bool aSuccess);
+  nested(inside_sync) sync UnselectAll(uint64_t aID) returns(bool aSuccess);
+
+  async TakeSelection(uint64_t aID);
+  async SetSelected(uint64_t aID, bool aSelected);
+
+  nested(inside_sync) sync DoAction(uint64_t aID, uint8_t aIndex) returns(bool aSuccess);
+  nested(inside_sync) sync ActionCount(uint64_t aID) returns(uint8_t aCount);
+  nested(inside_sync) sync ActionDescriptionAt(uint64_t aID, uint8_t aIndex) returns(nsString aDescription);
+  nested(inside_sync) sync ActionNameAt(uint64_t aID, uint8_t aIndex) returns(nsString aName);
+  nested(inside_sync) sync AccessKey(uint64_t aID) returns(uint32_t aKey, uint32_t aModifierMask);
+  nested(inside_sync) sync KeyboardShortcut(uint64_t aID) returns(uint32_t aKey, uint32_t aModifierMask);
+  nested(inside_sync) sync AtkKeyBinding(uint64_t aID) returns(nsString aResult);
+
+  nested(inside_sync) sync CurValue(uint64_t aID) returns(double aValue);
+  nested(inside_sync) sync SetCurValue(uint64_t aID, double aValue) returns(bool aRetVal);
+  nested(inside_sync) sync MinValue(uint64_t aID) returns(double aValue);
+  nested(inside_sync) sync MaxValue(uint64_t aID) returns(double aValue);
+  nested(inside_sync) sync Step(uint64_t aID) returns(double aStep);
+
+  async TakeFocus(uint64_t aID);
+  nested(inside_sync) sync FocusedChild(uint64_t aID)
+    returns(uint64_t aChild, bool aOk);
+
+  nested(inside_sync) sync Language(uint64_t aID) returns(nsString aLocale);
+  nested(inside_sync) sync DocType(uint64_t aID) returns(nsString aType);
+  nested(inside_sync) sync Title(uint64_t aID) returns(nsString aTitle);
+  nested(inside_sync) sync URL(uint64_t aID) returns(nsString aURL);
+  nested(inside_sync) sync MimeType(uint64_t aID) returns(nsString aMime);
+  nested(inside_sync) sync URLDocTypeMimeType(uint64_t aID) returns(nsString aURL, nsString aDocType, nsString aMimeType);
+
+  nested(inside_sync) sync ChildAtPoint(uint64_t aID, int32_t aX, int32_t aY, uint32_t aWhich)
+    returns(nullable PDocAccessible aResultDoc, uint64_t aResultID);
+
+  nested(inside_sync) sync Extents(uint64_t aID, bool aNeedsScreenCoords)
+    returns(int32_t aX, int32_t aY, int32_t aWidth, int32_t aHeight);
+  nested(inside_sync) sync ExtentsInCSSPixels(uint64_t aID)
+    returns(int32_t aX, int32_t aY, int32_t aWidth, int32_t aHeight);
+  nested(inside_sync) sync DOMNodeID(uint64_t aID) returns(nsString aDOMNodeID);
+};
+
+}
+}
diff --git a/accessible/ipc/other/ProxyAccessible.cpp b/accessible/ipc/other/ProxyAccessible.cpp
new file mode 100644
index 0000000000..31c2fe8b3b
--- /dev/null
+++ b/accessible/ipc/other/ProxyAccessible.cpp
@@ -0,0 +1,856 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ProxyAccessible.h"
+#include "mozilla/a11y/DocAccessibleParent.h"
+#include "DocAccessible.h"
+#include "mozilla/a11y/DocManager.h"
+#include "mozilla/dom/Element.h"
+#include "mozilla/dom/BrowserParent.h"
+#include "mozilla/Unused.h"
+#include "mozilla/a11y/Platform.h"
+#include "RelationType.h"
+#include "mozilla/a11y/Role.h"
+
+namespace mozilla {
+namespace a11y {
+
+uint64_t ProxyAccessible::State() const {
+  uint64_t state = 0;
+  Unused << mDoc->SendState(mID, &state);
+  return state;
+}
+
+uint64_t ProxyAccessible::NativeState() const {
+  uint64_t state = 0;
+  Unused << mDoc->SendNativeState(mID, &state);
+  return state;
+}
+
+uint32_t ProxyAccessible::Name(nsString& aName) const {
+  uint32_t flag;
+  Unused << mDoc->SendName(mID, &aName, &flag);
+  return flag;
+}
+
+void ProxyAccessible::Value(nsString& aValue) const {
+  Unused << mDoc->SendValue(mID, &aValue);
+}
+
+void ProxyAccessible::Help(nsString& aHelp) const {
+  Unused << mDoc->SendHelp(mID, &aHelp);
+}
+
+void ProxyAccessible::Description(nsString& aDesc) const {
+  Unused << mDoc->SendDescription(mID, &aDesc);
+}
+
+void ProxyAccessible::Attributes(nsTArray<Attribute>* aAttrs) const {
+  Unused << mDoc->SendAttributes(mID, aAttrs);
+}
+
+nsTArray<ProxyAccessible*> ProxyAccessible::RelationByType(
+    RelationType aType) const {
+  nsTArray<uint64_t> targetIDs;
+  Unused << mDoc->SendRelationByType(mID, static_cast<uint32_t>(aType),
+                                     &targetIDs);
+
+  size_t targetCount = targetIDs.Length();
+  nsTArray<ProxyAccessible*> targets(targetCount);
+  for (size_t i = 0; i < targetCount; i++)
+    if (ProxyAccessible* proxy = mDoc->GetAccessible(targetIDs[i]))
+      targets.AppendElement(proxy);
+
+  return targets;
+}
+
+void ProxyAccessible::Relations(
+    nsTArray<RelationType>* aTypes,
+    nsTArray<nsTArray<ProxyAccessible*>>* aTargetSets) const {
+  nsTArray<RelationTargets> ipcRelations;
+  Unused << mDoc->SendRelations(mID, &ipcRelations);
+
+  size_t relationCount = ipcRelations.Length();
+  aTypes->SetCapacity(relationCount);
+  aTargetSets->SetCapacity(relationCount);
+  for (size_t i = 0; i < relationCount; i++) {
+    uint32_t type = ipcRelations[i].Type();
+    if (type > static_cast<uint32_t>(RelationType::LAST)) continue;
+
+    size_t targetCount = ipcRelations[i].Targets().Length();
+    nsTArray<ProxyAccessible*> targets(targetCount);
+    for (size_t j = 0; j < targetCount; j++)
+      if (ProxyAccessible* proxy =
+              mDoc->GetAccessible(ipcRelations[i].Targets()[j]))
+        targets.AppendElement(proxy);
+
+    if (targets.IsEmpty()) continue;
+
+    aTargetSets->AppendElement(std::move(targets));
+    aTypes->AppendElement(static_cast<RelationType>(type));
+  }
+}
+
+bool ProxyAccessible::IsSearchbox() const {
+  bool retVal = false;
+  Unused << mDoc->SendIsSearchbox(mID, &retVal);
+  return retVal;
+}
+
+nsAtom* ProxyAccessible::LandmarkRole() const {
+  nsString landmark;
+  Unused << mDoc->SendLandmarkRole(mID, &landmark);
+  return NS_GetStaticAtom(landmark);
+}
+
+nsStaticAtom* ProxyAccessible::ARIARoleAtom() const {
+  nsString role;
+  Unused << mDoc->SendARIARoleAtom(mID, &role);
+  return NS_GetStaticAtom(role);
+}
+
+GroupPos ProxyAccessible::GroupPosition() {
+  GroupPos groupPos;
+  Unused << mDoc->SendGroupPosition(mID, &groupPos.level, &groupPos.setSize,
+                                    &groupPos.posInSet);
+  return groupPos;
+}
+
+void ProxyAccessible::ScrollTo(uint32_t aScrollType) {
+  Unused << mDoc->SendScrollTo(mID, aScrollType);
+}
+
+void ProxyAccessible::ScrollToPoint(uint32_t aScrollType, int32_t aX,
+                                    int32_t aY) {
+  Unused << mDoc->SendScrollToPoint(mID, aScrollType, aX, aY);
+}
+
+void ProxyAccessible::Announce(const nsString& aAnnouncement,
+                               uint16_t aPriority) {
+  Unused << mDoc->SendAnnounce(mID, aAnnouncement, aPriority);
+}
+
+int32_t ProxyAccessible::CaretLineNumber() {
+  int32_t line = -1;
+  Unused << mDoc->SendCaretOffset(mID, &line);
+  return line;
+}
+
+int32_t ProxyAccessible::CaretOffset() {
+  int32_t offset = 0;
+  Unused << mDoc->SendCaretOffset(mID, &offset);
+  return offset;
+}
+
+void ProxyAccessible::SetCaretOffset(int32_t aOffset) {
+  Unused << mDoc->SendSetCaretOffset(mID, aOffset);
+}
+
+int32_t ProxyAccessible::CharacterCount() {
+  int32_t count = 0;
+  Unused << mDoc->SendCharacterCount(mID, &count);
+  return count;
+}
+
+int32_t ProxyAccessible::SelectionCount() {
+  int32_t count = 0;
+  Unused << mDoc->SendSelectionCount(mID, &count);
+  return count;
+}
+
+bool ProxyAccessible::TextSubstring(int32_t aStartOffset, int32_t aEndOfset,
+                                    nsString& aText) const {
+  bool valid;
+  Unused << mDoc->SendTextSubstring(mID, aStartOffset, aEndOfset, &aText,
+                                    &valid);
+  return valid;
+}
+
+void ProxyAccessible::GetTextAfterOffset(int32_t aOffset,
+                                         AccessibleTextBoundary aBoundaryType,
+                                         nsString& aText, int32_t* aStartOffset,
+                                         int32_t* aEndOffset) {
+  Unused << mDoc->SendGetTextAfterOffset(mID, aOffset, aBoundaryType, &aText,
+                                         aStartOffset, aEndOffset);
+}
+
+void ProxyAccessible::GetTextAtOffset(int32_t aOffset,
+                                      AccessibleTextBoundary aBoundaryType,
+                                      nsString& aText, int32_t* aStartOffset,
+                                      int32_t* aEndOffset) {
+  Unused << mDoc->SendGetTextAtOffset(mID, aOffset, aBoundaryType, &aText,
+                                      aStartOffset, aEndOffset);
+}
+
+void ProxyAccessible::GetTextBeforeOffset(int32_t aOffset,
+                                          AccessibleTextBoundary aBoundaryType,
+                                          nsString& aText,
+                                          int32_t* aStartOffset,
+                                          int32_t* aEndOffset) {
+  Unused << mDoc->SendGetTextBeforeOffset(mID, aOffset, aBoundaryType, &aText,
+                                          aStartOffset, aEndOffset);
+}
+
+char16_t ProxyAccessible::CharAt(int32_t aOffset) {
+  uint16_t retval = 0;
+  Unused << mDoc->SendCharAt(mID, aOffset, &retval);
+  return static_cast<char16_t>(retval);
+}
+
+void ProxyAccessible::TextAttributes(bool aIncludeDefAttrs, int32_t aOffset,
+                                     nsTArray<Attribute>* aAttributes,
+                                     int32_t* aStartOffset,
+                                     int32_t* aEndOffset) {
+  Unused << mDoc->SendTextAttributes(mID, aIncludeDefAttrs, aOffset,
+                                     aAttributes, aStartOffset, aEndOffset);
+}
+
+void ProxyAccessible::DefaultTextAttributes(nsTArray<Attribute>* aAttrs) {
+  Unused << mDoc->SendDefaultTextAttributes(mID, aAttrs);
+}
+
+nsIntRect ProxyAccessible::TextBounds(int32_t aStartOffset, int32_t aEndOffset,
+                                      uint32_t aCoordType) {
+  nsIntRect rect;
+  Unused << mDoc->SendTextBounds(mID, aStartOffset, aEndOffset, aCoordType,
+                                 &rect);
+  return rect;
+}
+
+nsIntRect ProxyAccessible::CharBounds(int32_t aOffset, uint32_t aCoordType) {
+  nsIntRect rect;
+  Unused << mDoc->SendCharBounds(mID, aOffset, aCoordType, &rect);
+  return rect;
+}
+
+int32_t ProxyAccessible::OffsetAtPoint(int32_t aX, int32_t aY,
+                                       uint32_t aCoordType) {
+  int32_t retVal = -1;
+  Unused << mDoc->SendOffsetAtPoint(mID, aX, aY, aCoordType, &retVal);
+  return retVal;
+}
+
+bool ProxyAccessible::SelectionBoundsAt(int32_t aSelectionNum, nsString& aData,
+                                        int32_t* aStartOffset,
+                                        int32_t* aEndOffset) {
+  bool retVal = false;
+  Unused << mDoc->SendSelectionBoundsAt(mID, aSelectionNum, &retVal, &aData,
+                                        aStartOffset, aEndOffset);
+  return retVal;
+}
+
+bool ProxyAccessible::SetSelectionBoundsAt(int32_t aSelectionNum,
+                                           int32_t aStartOffset,
+                                           int32_t aEndOffset) {
+  bool retVal = false;
+  Unused << mDoc->SendSetSelectionBoundsAt(mID, aSelectionNum, aStartOffset,
+                                           aEndOffset, &retVal);
+  return retVal;
+}
+
+bool ProxyAccessible::AddToSelection(int32_t aStartOffset, int32_t aEndOffset) {
+  bool retVal = false;
+  Unused << mDoc->SendAddToSelection(mID, aStartOffset, aEndOffset, &retVal);
+  return retVal;
+}
+
+bool ProxyAccessible::RemoveFromSelection(int32_t aSelectionNum) {
+  bool retVal = false;
+  Unused << mDoc->SendRemoveFromSelection(mID, aSelectionNum, &retVal);
+  return retVal;
+}
+
+void ProxyAccessible::ScrollSubstringTo(int32_t aStartOffset,
+                                        int32_t aEndOffset,
+                                        uint32_t aScrollType) {
+  Unused << mDoc->SendScrollSubstringTo(mID, aStartOffset, aEndOffset,
+                                        aScrollType);
+}
+
+void ProxyAccessible::ScrollSubstringToPoint(int32_t aStartOffset,
+                                             int32_t aEndOffset,
+                                             uint32_t aCoordinateType,
+                                             int32_t aX, int32_t aY) {
+  Unused << mDoc->SendScrollSubstringToPoint(mID, aStartOffset, aEndOffset,
+                                             aCoordinateType, aX, aY);
+}
+
+void ProxyAccessible::Text(nsString* aText) {
+  Unused << mDoc->SendText(mID, aText);
+}
+
+void ProxyAccessible::ReplaceText(const nsString& aText) {
+  Unused << mDoc->SendReplaceText(mID, aText);
+}
+
+bool ProxyAccessible::InsertText(const nsString& aText, int32_t aPosition) {
+  bool valid;
+  Unused << mDoc->SendInsertText(mID, aText, aPosition, &valid);
+  return valid;
+}
+
+bool ProxyAccessible::CopyText(int32_t aStartPos, int32_t aEndPos) {
+  bool valid;
+  Unused << mDoc->SendCopyText(mID, aStartPos, aEndPos, &valid);
+  return valid;
+}
+
+bool ProxyAccessible::CutText(int32_t aStartPos, int32_t aEndPos) {
+  bool valid;
+  Unused << mDoc->SendCutText(mID, aStartPos, aEndPos, &valid);
+  return valid;
+}
+
+bool ProxyAccessible::DeleteText(int32_t aStartPos, int32_t aEndPos) {
+  bool valid;
+  Unused << mDoc->SendDeleteText(mID, aStartPos, aEndPos, &valid);
+  return valid;
+}
+
+bool ProxyAccessible::PasteText(int32_t aPosition) {
+  bool valid;
+  Unused << mDoc->SendPasteText(mID, aPosition, &valid);
+  return valid;
+}
+
+nsIntPoint ProxyAccessible::ImagePosition(uint32_t aCoordType) {
+  nsIntPoint retVal;
+  Unused << mDoc->SendImagePosition(mID, aCoordType, &retVal);
+  return retVal;
+}
+
+nsIntSize ProxyAccessible::ImageSize() {
+  nsIntSize retVal;
+  Unused << mDoc->SendImageSize(mID, &retVal);
+  return retVal;
+}
+
+uint32_t ProxyAccessible::StartOffset(bool* aOk) {
+  uint32_t retVal = 0;
+  Unused << mDoc->SendStartOffset(mID, &retVal, aOk);
+  return retVal;
+}
+
+uint32_t ProxyAccessible::EndOffset(bool* aOk) {
+  uint32_t retVal = 0;
+  Unused << mDoc->SendEndOffset(mID, &retVal, aOk);
+  return retVal;
+}
+
+bool ProxyAccessible::IsLinkValid() {
+  bool retVal = false;
+  Unused << mDoc->SendIsLinkValid(mID, &retVal);
+  return retVal;
+}
+
+uint32_t ProxyAccessible::AnchorCount(bool* aOk) {
+  uint32_t retVal = 0;
+  Unused << mDoc->SendAnchorCount(mID, &retVal, aOk);
+  return retVal;
+}
+
+void ProxyAccessible::AnchorURIAt(uint32_t aIndex, nsCString& aURI, bool* aOk) {
+  Unused << mDoc->SendAnchorURIAt(mID, aIndex, &aURI, aOk);
+}
+
+ProxyAccessible* ProxyAccessible::AnchorAt(uint32_t aIndex) {
+  uint64_t id = 0;
+  bool ok = false;
+  Unused << mDoc->SendAnchorAt(mID, aIndex, &id, &ok);
+  return ok ? mDoc->GetAccessible(id) : nullptr;
+}
+
+uint32_t ProxyAccessible::LinkCount() {
+  uint32_t retVal = 0;
+  Unused << mDoc->SendLinkCount(mID, &retVal);
+  return retVal;
+}
+
+ProxyAccessible* ProxyAccessible::LinkAt(const uint32_t& aIndex) {
+  uint64_t linkID = 0;
+  bool ok = false;
+  Unused << mDoc->SendLinkAt(mID, aIndex, &linkID, &ok);
+  return ok ? mDoc->GetAccessible(linkID) : nullptr;
+}
+
+int32_t ProxyAccessible::LinkIndexOf(ProxyAccessible* aLink) {
+  int32_t retVal = -1;
+  if (aLink) {
+    Unused << mDoc->SendLinkIndexOf(mID, aLink->ID(), &retVal);
+  }
+
+  return retVal;
+}
+
+int32_t ProxyAccessible::LinkIndexAtOffset(uint32_t aOffset) {
+  int32_t retVal = -1;
+  Unused << mDoc->SendLinkIndexAtOffset(mID, aOffset, &retVal);
+  return retVal;
+}
+
+ProxyAccessible* ProxyAccessible::TableOfACell() {
+  uint64_t tableID = 0;
+  bool ok = false;
+  Unused << mDoc->SendTableOfACell(mID, &tableID, &ok);
+  return ok ? mDoc->GetAccessible(tableID) : nullptr;
+}
+
+uint32_t ProxyAccessible::ColIdx() {
+  uint32_t index = 0;
+  Unused << mDoc->SendColIdx(mID, &index);
+  return index;
+}
+
+uint32_t ProxyAccessible::RowIdx() {
+  uint32_t index = 0;
+  Unused << mDoc->SendRowIdx(mID, &index);
+  return index;
+}
+
+void ProxyAccessible::GetColRowExtents(uint32_t* aColIdx, uint32_t* aRowIdx,
+                                       uint32_t* aColExtent,
+                                       uint32_t* aRowExtent) {
+  Unused << mDoc->SendGetColRowExtents(mID, aColIdx, aRowIdx, aColExtent,
+                                       aRowExtent);
+}
+
+void ProxyAccessible::GetPosition(uint32_t* aColIdx, uint32_t* aRowIdx) {
+  Unused << mDoc->SendGetPosition(mID, aColIdx, aRowIdx);
+}
+
+uint32_t ProxyAccessible::ColExtent() {
+  uint32_t extent = 0;
+  Unused << mDoc->SendColExtent(mID, &extent);
+  return extent;
+}
+
+uint32_t ProxyAccessible::RowExtent() {
+  uint32_t extent = 0;
+  Unused << mDoc->SendRowExtent(mID, &extent);
+  return extent;
+}
+
+void ProxyAccessible::ColHeaderCells(nsTArray<ProxyAccessible*>* aCells) {
+  nsTArray<uint64_t> targetIDs;
+  Unused << mDoc->SendColHeaderCells(mID, &targetIDs);
+
+  size_t targetCount = targetIDs.Length();
+  for (size_t i = 0; i < targetCount; i++) {
+    aCells->AppendElement(mDoc->GetAccessible(targetIDs[i]));
+  }
+}
+
+void ProxyAccessible::RowHeaderCells(nsTArray<ProxyAccessible*>* aCells) {
+  nsTArray<uint64_t> targetIDs;
+  Unused << mDoc->SendRowHeaderCells(mID, &targetIDs);
+
+  size_t targetCount = targetIDs.Length();
+  for (size_t i = 0; i < targetCount; i++) {
+    aCells->AppendElement(mDoc->GetAccessible(targetIDs[i]));
+  }
+}
+
+bool ProxyAccessible::IsCellSelected() {
+  bool selected = false;
+  Unused << mDoc->SendIsCellSelected(mID, &selected);
+  return selected;
+}
+
+ProxyAccessible* ProxyAccessible::TableCaption() {
+  uint64_t captionID = 0;
+  bool ok = false;
+  Unused << mDoc->SendTableCaption(mID, &captionID, &ok);
+  return ok ? mDoc->GetAccessible(captionID) : nullptr;
+}
+
+void ProxyAccessible::TableSummary(nsString& aSummary) {
+  Unused << mDoc->SendTableSummary(mID, &aSummary);
+}
+
+uint32_t ProxyAccessible::TableColumnCount() {
+  uint32_t count = 0;
+  Unused << mDoc->SendTableColumnCount(mID, &count);
+  return count;
+}
+
+uint32_t ProxyAccessible::TableRowCount() {
+  uint32_t count = 0;
+  Unused << mDoc->SendTableRowCount(mID, &count);
+  return count;
+}
+
+ProxyAccessible* ProxyAccessible::TableCellAt(uint32_t aRow, uint32_t aCol) {
+  uint64_t cellID = 0;
+  bool ok = false;
+  Unused << mDoc->SendTableCellAt(mID, aRow, aCol, &cellID, &ok);
+  return ok ? mDoc->GetAccessible(cellID) : nullptr;
+}
+
+int32_t ProxyAccessible::TableCellIndexAt(uint32_t aRow, uint32_t aCol) {
+  int32_t index = 0;
+  Unused << mDoc->SendTableCellIndexAt(mID, aRow, aCol, &index);
+  return index;
+}
+
+int32_t ProxyAccessible::TableColumnIndexAt(uint32_t aCellIndex) {
+  int32_t index = 0;
+  Unused << mDoc->SendTableColumnIndexAt(mID, aCellIndex, &index);
+  return index;
+}
+
+int32_t ProxyAccessible::TableRowIndexAt(uint32_t aCellIndex) {
+  int32_t index = 0;
+  Unused << mDoc->SendTableRowIndexAt(mID, aCellIndex, &index);
+  return index;
+}
+
+void ProxyAccessible::TableRowAndColumnIndicesAt(uint32_t aCellIndex,
+                                                 int32_t* aRow, int32_t* aCol) {
+  Unused << mDoc->SendTableRowAndColumnIndicesAt(mID, aCellIndex, aRow, aCol);
+}
+
+uint32_t ProxyAccessible::TableColumnExtentAt(uint32_t aRow, uint32_t aCol) {
+  uint32_t extent = 0;
+  Unused << mDoc->SendTableColumnExtentAt(mID, aRow, aCol, &extent);
+  return extent;
+}
+
+uint32_t ProxyAccessible::TableRowExtentAt(uint32_t aRow, uint32_t aCol) {
+  uint32_t extent = 0;
+  Unused << mDoc->SendTableRowExtentAt(mID, aRow, aCol, &extent);
+  return extent;
+}
+
+void ProxyAccessible::TableColumnDescription(uint32_t aCol,
+                                             nsString& aDescription) {
+  Unused << mDoc->SendTableColumnDescription(mID, aCol, &aDescription);
+}
+
+void ProxyAccessible::TableRowDescription(uint32_t aRow,
+                                          nsString& aDescription) {
+  Unused << mDoc->SendTableRowDescription(mID, aRow, &aDescription);
+}
+
+bool ProxyAccessible::TableColumnSelected(uint32_t aCol) {
+  bool selected = false;
+  Unused << mDoc->SendTableColumnSelected(mID, aCol, &selected);
+  return selected;
+}
+
+bool ProxyAccessible::TableRowSelected(uint32_t aRow) {
+  bool selected = false;
+  Unused << mDoc->SendTableRowSelected(mID, aRow, &selected);
+  return selected;
+}
+
+bool ProxyAccessible::TableCellSelected(uint32_t aRow, uint32_t aCol) {
+  bool selected = false;
+  Unused << mDoc->SendTableCellSelected(mID, aRow, aCol, &selected);
+  return selected;
+}
+
+uint32_t ProxyAccessible::TableSelectedCellCount() {
+  uint32_t count = 0;
+  Unused << mDoc->SendTableSelectedCellCount(mID, &count);
+  return count;
+}
+
+uint32_t ProxyAccessible::TableSelectedColumnCount() {
+  uint32_t count = 0;
+  Unused << mDoc->SendTableSelectedColumnCount(mID, &count);
+  return count;
+}
+
+uint32_t ProxyAccessible::TableSelectedRowCount() {
+  uint32_t count = 0;
+  Unused << mDoc->SendTableSelectedRowCount(mID, &count);
+  return count;
+}
+
+void ProxyAccessible::TableSelectedCells(nsTArray<ProxyAccessible*>* aCellIDs) {
+  AutoTArray<uint64_t, 30> cellIDs;
+  Unused << mDoc->SendTableSelectedCells(mID, &cellIDs);
+  aCellIDs->SetCapacity(cellIDs.Length());
+  for (uint32_t i = 0; i < cellIDs.Length(); ++i) {
+    aCellIDs->AppendElement(mDoc->GetAccessible(cellIDs[i]));
+  }
+}
+
+void ProxyAccessible::TableSelectedCellIndices(
+    nsTArray<uint32_t>* aCellIndices) {
+  Unused << mDoc->SendTableSelectedCellIndices(mID, aCellIndices);
+}
+
+void ProxyAccessible::TableSelectedColumnIndices(
+    nsTArray<uint32_t>* aColumnIndices) {
+  Unused << mDoc->SendTableSelectedColumnIndices(mID, aColumnIndices);
+}
+
+void ProxyAccessible::TableSelectedRowIndices(nsTArray<uint32_t>* aRowIndices) {
+  Unused << mDoc->SendTableSelectedRowIndices(mID, aRowIndices);
+}
+
+void ProxyAccessible::TableSelectColumn(uint32_t aCol) {
+  Unused << mDoc->SendTableSelectColumn(mID, aCol);
+}
+
+void ProxyAccessible::TableSelectRow(uint32_t aRow) {
+  Unused << mDoc->SendTableSelectRow(mID, aRow);
+}
+
+void ProxyAccessible::TableUnselectColumn(uint32_t aCol) {
+  Unused << mDoc->SendTableUnselectColumn(mID, aCol);
+}
+
+void ProxyAccessible::TableUnselectRow(uint32_t aRow) {
+  Unused << mDoc->SendTableUnselectRow(mID, aRow);
+}
+
+bool ProxyAccessible::TableIsProbablyForLayout() {
+  bool forLayout = false;
+  Unused << mDoc->SendTableIsProbablyForLayout(mID, &forLayout);
+  return forLayout;
+}
+
+ProxyAccessible* ProxyAccessible::AtkTableColumnHeader(int32_t aCol) {
+  uint64_t headerID = 0;
+  bool ok = false;
+  Unused << mDoc->SendAtkTableColumnHeader(mID, aCol, &headerID, &ok);
+  return ok ? mDoc->GetAccessible(headerID) : nullptr;
+}
+
+ProxyAccessible* ProxyAccessible::AtkTableRowHeader(int32_t aRow) {
+  uint64_t headerID = 0;
+  bool ok = false;
+  Unused << mDoc->SendAtkTableRowHeader(mID, aRow, &headerID, &ok);
+  return ok ? mDoc->GetAccessible(headerID) : nullptr;
+}
+
+void ProxyAccessible::SelectedItems(
+    nsTArray<ProxyAccessible*>* aSelectedItems) {
+  AutoTArray<uint64_t, 10> itemIDs;
+  Unused << mDoc->SendSelectedItems(mID, &itemIDs);
+  aSelectedItems->SetCapacity(itemIDs.Length());
+  for (size_t i = 0; i < itemIDs.Length(); ++i) {
+    aSelectedItems->AppendElement(mDoc->GetAccessible(itemIDs[i]));
+  }
+}
+
+uint32_t ProxyAccessible::SelectedItemCount() {
+  uint32_t count = 0;
+  Unused << mDoc->SendSelectedItemCount(mID, &count);
+  return count;
+}
+
+ProxyAccessible* ProxyAccessible::GetSelectedItem(uint32_t aIndex) {
+  uint64_t selectedItemID = 0;
+  bool ok = false;
+  Unused << mDoc->SendGetSelectedItem(mID, aIndex, &selectedItemID, &ok);
+  return ok ? mDoc->GetAccessible(selectedItemID) : nullptr;
+}
+
+bool ProxyAccessible::IsItemSelected(uint32_t aIndex) {
+  bool selected = false;
+  Unused << mDoc->SendIsItemSelected(mID, aIndex, &selected);
+  return selected;
+}
+
+bool ProxyAccessible::AddItemToSelection(uint32_t aIndex) {
+  bool success = false;
+  Unused << mDoc->SendAddItemToSelection(mID, aIndex, &success);
+  return success;
+}
+
+bool ProxyAccessible::RemoveItemFromSelection(uint32_t aIndex) {
+  bool success = false;
+  Unused << mDoc->SendRemoveItemFromSelection(mID, aIndex, &success);
+  return success;
+}
+
+bool ProxyAccessible::SelectAll() {
+  bool success = false;
+  Unused << mDoc->SendSelectAll(mID, &success);
+  return success;
+}
+
+bool ProxyAccessible::UnselectAll() {
+  bool success = false;
+  Unused << mDoc->SendUnselectAll(mID, &success);
+  return success;
+}
+
+void ProxyAccessible::TakeSelection() {
+  Unused << mDoc->SendTakeSelection(mID);
+}
+
+void ProxyAccessible::SetSelected(bool aSelect) {
+  Unused << mDoc->SendSetSelected(mID, aSelect);
+}
+
+bool ProxyAccessible::DoAction(uint8_t aIndex) {
+  bool success = false;
+  Unused << mDoc->SendDoAction(mID, aIndex, &success);
+  return success;
+}
+
+uint8_t ProxyAccessible::ActionCount() {
+  uint8_t count = 0;
+  Unused << mDoc->SendActionCount(mID, &count);
+  return count;
+}
+
+void ProxyAccessible::ActionDescriptionAt(uint8_t aIndex,
+                                          nsString& aDescription) {
+  Unused << mDoc->SendActionDescriptionAt(mID, aIndex, &aDescription);
+}
+
+void ProxyAccessible::ActionNameAt(uint8_t aIndex, nsString& aName) {
+  Unused << mDoc->SendActionNameAt(mID, aIndex, &aName);
+}
+
+KeyBinding ProxyAccessible::AccessKey() {
+  uint32_t key = 0;
+  uint32_t modifierMask = 0;
+  Unused << mDoc->SendAccessKey(mID, &key, &modifierMask);
+  return KeyBinding(key, modifierMask);
+}
+
+KeyBinding ProxyAccessible::KeyboardShortcut() {
+  uint32_t key = 0;
+  uint32_t modifierMask = 0;
+  Unused << mDoc->SendKeyboardShortcut(mID, &key, &modifierMask);
+  return KeyBinding(key, modifierMask);
+}
+
+void ProxyAccessible::AtkKeyBinding(nsString& aBinding) {
+  Unused << mDoc->SendAtkKeyBinding(mID, &aBinding);
+}
+
+double ProxyAccessible::CurValue() {
+  double val = UnspecifiedNaN<double>();
+  Unused << mDoc->SendCurValue(mID, &val);
+  return val;
+}
+
+bool ProxyAccessible::SetCurValue(double aValue) {
+  bool success = false;
+  Unused << mDoc->SendSetCurValue(mID, aValue, &success);
+  return success;
+}
+
+double ProxyAccessible::MinValue() {
+  double val = UnspecifiedNaN<double>();
+  Unused << mDoc->SendMinValue(mID, &val);
+  return val;
+}
+
+double ProxyAccessible::MaxValue() {
+  double val = UnspecifiedNaN<double>();
+  Unused << mDoc->SendMaxValue(mID, &val);
+  return val;
+}
+
+double ProxyAccessible::Step() {
+  double step = UnspecifiedNaN<double>();
+  Unused << mDoc->SendStep(mID, &step);
+  return step;
+}
+
+void ProxyAccessible::TakeFocus() { Unused << mDoc->SendTakeFocus(mID); }
+
+ProxyAccessible* ProxyAccessible::FocusedChild() {
+  uint64_t childID = 0;
+  bool ok = false;
+  Unused << mDoc->SendFocusedChild(mID, &childID, &ok);
+  return ok ? mDoc->GetAccessible(childID) : nullptr;
+}
+
+ProxyAccessible* ProxyAccessible::ChildAtPoint(
+    int32_t aX, int32_t aY, Accessible::EWhichChildAtPoint aWhichChild) {
+  ProxyAccessible* target = this;
+  do {
+    if (target->mOuterDoc) {
+      MOZ_ASSERT(target->ChildrenCount() == 1);
+      DocAccessibleParent* childDoc = target->ChildAt(0)->AsDoc();
+      MOZ_ASSERT(childDoc);
+      if (childDoc->IsTopLevelInContentProcess()) {
+        // This is an OOP iframe. Remote calls can only work within their
+        // process, so they stop at OOP iframes.
+        if (aWhichChild == Accessible::eDirectChild) {
+          // Return the child document if it's within the bounds of the iframe.
+          nsIntRect docRect = target->Bounds();
+          if (docRect.Contains(aX, aY)) {
+            return childDoc;
+          }
+          return nullptr;
+        }
+        // We must continue the search from the child document.
+        target = childDoc;
+      }
+    }
+    PDocAccessibleParent* resultDoc = nullptr;
+    uint64_t resultID = 0;
+    Unused << target->mDoc->SendChildAtPoint(target->mID, aX, aY,
+                                             static_cast<uint32_t>(aWhichChild),
+                                             &resultDoc, &resultID);
+    // If resultDoc is null, this means there is no child at this point.
+    auto useDoc = static_cast<DocAccessibleParent*>(resultDoc);
+    target = resultDoc ? useDoc->GetAccessible(resultID) : nullptr;
+  } while (target && target->mOuterDoc &&
+           aWhichChild == Accessible::eDeepestChild);
+  return target;
+}
+
+nsIntRect ProxyAccessible::Bounds() {
+  nsIntRect rect;
+  Unused << mDoc->SendExtents(mID, false, &(rect.x), &(rect.y), &(rect.width),
+                              &(rect.height));
+  return rect;
+}
+
+nsIntRect ProxyAccessible::BoundsInCSSPixels() {
+  nsIntRect rect;
+  Unused << mDoc->SendExtentsInCSSPixels(mID, &rect.x, &rect.y, &rect.width,
+                                         &rect.height);
+  return rect;
+}
+
+void ProxyAccessible::Language(nsString& aLocale) {
+  Unused << mDoc->SendLanguage(mID, &aLocale);
+}
+
+void ProxyAccessible::DocType(nsString& aType) {
+  Unused << mDoc->SendDocType(mID, &aType);
+}
+
+void ProxyAccessible::Title(nsString& aTitle) {
+  Unused << mDoc->SendTitle(mID, &aTitle);
+}
+
+void ProxyAccessible::URL(nsString& aURL) {
+  Unused << mDoc->SendURL(mID, &aURL);
+}
+
+void ProxyAccessible::MimeType(nsString aMime) {
+  Unused << mDoc->SendMimeType(mID, &aMime);
+}
+
+void ProxyAccessible::URLDocTypeMimeType(nsString& aURL, nsString& aDocType,
+                                         nsString& aMimeType) {
+  Unused << mDoc->SendURLDocTypeMimeType(mID, &aURL, &aDocType, &aMimeType);
+}
+
+void ProxyAccessible::Extents(bool aNeedsScreenCoords, int32_t* aX, int32_t* aY,
+                              int32_t* aWidth, int32_t* aHeight) {
+  Unused << mDoc->SendExtents(mID, aNeedsScreenCoords, aX, aY, aWidth, aHeight);
+}
+
+void ProxyAccessible::DOMNodeID(nsString& aID) {
+  Unused << mDoc->SendDOMNodeID(mID, &aID);
+}
+
+}  // namespace a11y
+}  // namespace mozilla
diff --git a/accessible/ipc/other/ProxyAccessible.h b/accessible/ipc/other/ProxyAccessible.h
new file mode 100644
index 0000000000..ae104004a5
--- /dev/null
+++ b/accessible/ipc/other/ProxyAccessible.h
@@ -0,0 +1,46 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_a11y_ProxyAccessible_h
+#define mozilla_a11y_ProxyAccessible_h
+
+#include "Accessible.h"
+#include "mozilla/a11y/ProxyAccessibleBase.h"
+#include "mozilla/a11y/Role.h"
+#include "nsIAccessibleText.h"
+#include "nsIAccessibleTypes.h"
+#include "nsString.h"
+#include "nsTArray.h"
+#include "nsRect.h"
+
+namespace mozilla {
+namespace a11y {
+
+class ProxyAccessible : public ProxyAccessibleBase<ProxyAccessible> {
+ public:
+  ProxyAccessible(uint64_t aID, ProxyAccessible* aParent,
+                  DocAccessibleParent* aDoc, role aRole, uint32_t aInterfaces)
+      : ProxyAccessibleBase(aID, aParent, aDoc, aRole, aInterfaces)
+
+  {
+    MOZ_COUNT_CTOR(ProxyAccessible);
+  }
+
+  MOZ_COUNTED_DTOR(ProxyAccessible)
+
+#include "mozilla/a11y/ProxyAccessibleShared.h"
+
+ protected:
+  explicit ProxyAccessible(DocAccessibleParent* aThisAsDoc)
+      : ProxyAccessibleBase(aThisAsDoc) {
+    MOZ_COUNT_CTOR(ProxyAccessible);
+  }
+};
+
+}  // namespace a11y
+}  // namespace mozilla
+
+#endif
diff --git a/accessible/ipc/other/moz.build b/accessible/ipc/other/moz.build
new file mode 100644
index 0000000000..db386c6eb3
--- /dev/null
+++ b/accessible/ipc/other/moz.build
@@ -0,0 +1,52 @@
+# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+
+if CONFIG["ACCESSIBILITY"]:
+    IPDL_SOURCES += ["PDocAccessible.ipdl"]
+
+    EXPORTS.mozilla.a11y += [
+        "DocAccessibleChild.h",
+        "ProxyAccessible.h",
+    ]
+
+    SOURCES += [
+        "DocAccessibleChild.cpp",
+        "ProxyAccessible.cpp",
+    ]
+
+    LOCAL_INCLUDES += [
+        "../../base",
+        "../../generic",
+        "../../xpcom",
+    ]
+
+    if CONFIG["MOZ_WIDGET_TOOLKIT"] == "gtk":
+        LOCAL_INCLUDES += [
+            "/accessible/atk",
+        ]
+    elif CONFIG["MOZ_WIDGET_TOOLKIT"] == "cocoa":
+        LOCAL_INCLUDES += [
+            "/accessible/mac",
+        ]
+    elif CONFIG["MOZ_WIDGET_TOOLKIT"] == "android":
+        LOCAL_INCLUDES += [
+            "/accessible/android",
+        ]
+    else:
+        LOCAL_INCLUDES += [
+            "/accessible/other",
+        ]
+
+include("/ipc/chromium/chromium-config.mozbuild")
+
+# Add libFuzzer configuration directives
+include("/tools/fuzzing/libfuzzer-config.mozbuild")
+
+if CONFIG["CC_TYPE"] in ("clang", "gcc"):
+    CXXFLAGS += ["-Wno-error=shadow"]
+
+FINAL_LIBRARY = "xul"
diff --git a/accessible/ipc/win/COMPtrTypes.cpp b/accessible/ipc/win/COMPtrTypes.cpp
new file mode 100644
index 0000000000..cea8dac926
--- /dev/null
+++ b/accessible/ipc/win/COMPtrTypes.cpp
@@ -0,0 +1,74 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/a11y/COMPtrTypes.h"
+
+#include <utility>
+
+#include "MainThreadUtils.h"
+#include "mozilla/Assertions.h"
+#include "mozilla/Preferences.h"
+#include "mozilla/RefPtr.h"
+#include "mozilla/a11y/Accessible.h"
+#include "mozilla/a11y/HandlerProvider.h"
+#include "mozilla/a11y/Platform.h"
+#include "mozilla/mscom/MainThreadHandoff.h"
+#include "mozilla/mscom/Utils.h"
+#include "nsXULAppAPI.h"
+
+using mozilla::mscom::MainThreadHandoff;
+using mozilla::mscom::ProxyUniquePtr;
+using mozilla::mscom::STAUniquePtr;
+
+namespace mozilla {
+namespace a11y {
+
+IAccessibleHolder CreateHolderFromAccessible(NotNull<Accessible*> aAccToWrap) {
+  MOZ_ASSERT(NS_IsMainThread());
+
+  STAUniquePtr<IAccessible> iaToProxy;
+  aAccToWrap->GetNativeInterface(mscom::getter_AddRefs(iaToProxy));
+  MOZ_DIAGNOSTIC_ASSERT(iaToProxy);
+  if (!iaToProxy) {
+    return nullptr;
+  }
+
+  static const bool useHandler =
+      Preferences::GetBool("accessibility.handler.enabled", false) &&
+      IsHandlerRegistered();
+
+  RefPtr<HandlerProvider> payload;
+  if (useHandler) {
+    payload = new HandlerProvider(IID_IAccessible,
+                                  mscom::ToInterceptorTargetPtr(iaToProxy));
+  }
+
+  ProxyUniquePtr<IAccessible> intercepted;
+  HRESULT hr = MainThreadHandoff::WrapInterface(
+      std::move(iaToProxy), payload,
+      (IAccessible**)mscom::getter_AddRefs(intercepted));
+  MOZ_ASSERT(SUCCEEDED(hr));
+  if (FAILED(hr)) {
+    return nullptr;
+  }
+
+  return IAccessibleHolder(std::move(intercepted));
+}
+
+IHandlerControlHolder CreateHolderFromHandlerControl(
+    mscom::ProxyUniquePtr<IHandlerControl> aHandlerControl) {
+  MOZ_ASSERT(aHandlerControl);
+  MOZ_ASSERT(XRE_IsContentProcess());
+  MOZ_ASSERT(NS_IsMainThread());
+  if (!aHandlerControl) {
+    return nullptr;
+  }
+
+  return IHandlerControlHolder(std::move(aHandlerControl));
+}
+
+}  // namespace a11y
+}  // namespace mozilla
diff --git a/accessible/ipc/win/COMPtrTypes.h b/accessible/ipc/win/COMPtrTypes.h
new file mode 100644
index 0000000000..b1d86eff7e
--- /dev/null
+++ b/accessible/ipc/win/COMPtrTypes.h
@@ -0,0 +1,77 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_a11y_COMPtrTypes_h
+#define mozilla_a11y_COMPtrTypes_h
+
+#include "mozilla/a11y/AccessibleHandler.h"
+#include "mozilla/a11y/Compatibility.h"
+#include "mozilla/Attributes.h"
+#include "mozilla/mscom/ActivationContext.h"
+#include "mozilla/mscom/COMPtrHolder.h"
+#include "mozilla/NotNull.h"
+
+#include <oleacc.h>
+
+namespace mozilla {
+namespace a11y {
+
+class MOZ_RAII IAccessibleEnvironment : public mscom::ProxyStream::Environment {
+ public:
+  IAccessibleEnvironment() = default;
+
+  bool Push() override {
+    mActCtxRgn = GetActCtx();
+    return !!mActCtxRgn;
+  }
+
+  bool Pop() override { return mActCtxRgn.Deactivate(); }
+
+ private:
+  static const mscom::ActivationContext& GetActCtx() {
+    static const mscom::ActivationContext sActCtx(
+        Compatibility::GetActCtxResourceId());
+    MOZ_DIAGNOSTIC_ASSERT(sActCtx);
+    return sActCtx;
+  }
+
+ private:
+  mscom::ActivationContextRegion mActCtxRgn;
+};
+
+}  // namespace a11y
+
+namespace mscom {
+namespace detail {
+
+template <>
+struct EnvironmentSelector<IAccessible> {
+  typedef a11y::IAccessibleEnvironment Type;
+};
+
+}  // namespace detail
+}  // namespace mscom
+
+namespace a11y {
+
+typedef mozilla::mscom::COMPtrHolder<IAccessible, IID_IAccessible>
+    IAccessibleHolder;
+typedef mozilla::mscom::COMPtrHolder<IDispatch, IID_IDispatch> IDispatchHolder;
+
+class Accessible;
+
+IAccessibleHolder CreateHolderFromAccessible(NotNull<Accessible*> aAccToWrap);
+
+typedef mozilla::mscom::COMPtrHolder<IHandlerControl, IID_IHandlerControl>
+    IHandlerControlHolder;
+
+IHandlerControlHolder CreateHolderFromHandlerControl(
+    mscom::ProxyUniquePtr<IHandlerControl> aHandlerControl);
+
+}  // namespace a11y
+}  // namespace mozilla
+
+#endif  // mozilla_a11y_COMPtrTypes_h
diff --git a/accessible/ipc/win/DocAccessibleChild.cpp b/accessible/ipc/win/DocAccessibleChild.cpp
new file mode 100644
index 0000000000..6663256fba
--- /dev/null
+++ b/accessible/ipc/win/DocAccessibleChild.cpp
@@ -0,0 +1,320 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "DocAccessibleChild.h"
+
+#include "nsAccessibilityService.h"
+#include "Accessible-inl.h"
+#include "mozilla/a11y/PlatformChild.h"
+#include "mozilla/ClearOnShutdown.h"
+#include "RootAccessible.h"
+
+namespace mozilla {
+namespace a11y {
+
+static StaticAutoPtr<PlatformChild> sPlatformChild;
+
+DocAccessibleChild::DocAccessibleChild(DocAccessible* aDoc, IProtocol* aManager)
+    : DocAccessibleChildBase(aDoc), mEmulatedWindowHandle(nullptr) {
+  MOZ_COUNT_CTOR_INHERITED(DocAccessibleChild, DocAccessibleChildBase);
+  if (!sPlatformChild) {
+    sPlatformChild = new PlatformChild();
+    ClearOnShutdown(&sPlatformChild, ShutdownPhase::Shutdown);
+  }
+
+  SetManager(aManager);
+}
+
+DocAccessibleChild::~DocAccessibleChild() {
+  MOZ_COUNT_DTOR_INHERITED(DocAccessibleChild, DocAccessibleChildBase);
+}
+
+void DocAccessibleChild::Shutdown() {
+  if (IsConstructedInParentProcess()) {
+    DocAccessibleChildBase::Shutdown();
+    return;
+  }
+
+  PushDeferredEvent(MakeUnique<SerializedShutdown>(this));
+  DetachDocument();
+}
+
+ipc::IPCResult DocAccessibleChild::RecvParentCOMProxy(
+    const IDispatchHolder& aParentCOMProxy) {
+  MOZ_ASSERT(!aParentCOMProxy.IsNull());
+  mParentProxy.reset(const_cast<IDispatchHolder&>(aParentCOMProxy).Release());
+  SetConstructedInParentProcess();
+
+  for (uint32_t i = 0, l = mDeferredEvents.Length(); i < l; ++i) {
+    mDeferredEvents[i]->Dispatch();
+  }
+
+  mDeferredEvents.Clear();
+
+  return IPC_OK();
+}
+
+ipc::IPCResult DocAccessibleChild::RecvEmulatedWindow(
+    const WindowsHandle& aEmulatedWindowHandle,
+    const IDispatchHolder& aEmulatedWindowCOMProxy) {
+  mEmulatedWindowHandle = reinterpret_cast<HWND>(aEmulatedWindowHandle);
+  if (!aEmulatedWindowCOMProxy.IsNull()) {
+    MOZ_ASSERT(!mEmulatedWindowProxy);
+    mEmulatedWindowProxy.reset(
+        const_cast<IDispatchHolder&>(aEmulatedWindowCOMProxy).Release());
+  }
+
+  return IPC_OK();
+}
+
+ipc::IPCResult DocAccessibleChild::RecvTopLevelDocCOMProxy(
+    const IAccessibleHolder& aCOMProxy) {
+  MOZ_ASSERT(!aCOMProxy.IsNull());
+  mTopLevelDocProxy.reset(const_cast<IAccessibleHolder&>(aCOMProxy).Release());
+  return IPC_OK();
+}
+
+HWND DocAccessibleChild::GetNativeWindowHandle() const {
+  if (mEmulatedWindowHandle) {
+    return mEmulatedWindowHandle;
+  }
+
+  auto browser = static_cast<dom::BrowserChild*>(Manager());
+  MOZ_ASSERT(browser);
+  // Iframe documents use the same window handle as their top level document.
+  auto topDoc = static_cast<DocAccessibleChild*>(
+      browser->GetTopLevelDocAccessibleChild());
+  MOZ_ASSERT(topDoc);
+  if (topDoc != this && topDoc->mEmulatedWindowHandle) {
+    return topDoc->mEmulatedWindowHandle;
+  }
+
+  return reinterpret_cast<HWND>(browser->GetNativeWindowHandle());
+}
+
+void DocAccessibleChild::PushDeferredEvent(UniquePtr<DeferredEvent> aEvent) {
+  DocAccessibleChild* topLevelIPCDoc = nullptr;
+
+  if (mDoc && mDoc->IsRoot()) {
+    topLevelIPCDoc = this;
+  } else {
+    auto browserChild = static_cast<dom::BrowserChild*>(Manager());
+    if (!browserChild) {
+      return;
+    }
+
+    topLevelIPCDoc = static_cast<DocAccessibleChild*>(
+        browserChild->GetTopLevelDocAccessibleChild());
+  }
+
+  if (topLevelIPCDoc) {
+    topLevelIPCDoc->mDeferredEvents.AppendElement(std::move(aEvent));
+  }
+}
+
+bool DocAccessibleChild::SendEvent(const uint64_t& aID, const uint32_t& aType) {
+  if (IsConstructedInParentProcess()) {
+    return PDocAccessibleChild::SendEvent(aID, aType);
+  }
+
+  PushDeferredEvent(MakeUnique<SerializedEvent>(this, aID, aType));
+  return false;
+}
+
+void DocAccessibleChild::MaybeSendShowEvent(ShowEventData& aData,
+                                            bool aFromUser) {
+  if (IsConstructedInParentProcess()) {
+    Unused << SendShowEvent(aData, aFromUser);
+    return;
+  }
+
+  PushDeferredEvent(MakeUnique<SerializedShow>(this, aData, aFromUser));
+}
+
+bool DocAccessibleChild::SendHideEvent(const uint64_t& aRootID,
+                                       const bool& aFromUser) {
+  if (IsConstructedInParentProcess()) {
+    return PDocAccessibleChild::SendHideEvent(aRootID, aFromUser);
+  }
+
+  PushDeferredEvent(MakeUnique<SerializedHide>(this, aRootID, aFromUser));
+  return true;
+}
+
+bool DocAccessibleChild::SendStateChangeEvent(const uint64_t& aID,
+                                              const uint64_t& aState,
+                                              const bool& aEnabled) {
+  if (IsConstructedInParentProcess()) {
+    return PDocAccessibleChild::SendStateChangeEvent(aID, aState, aEnabled);
+  }
+
+  PushDeferredEvent(
+      MakeUnique<SerializedStateChange>(this, aID, aState, aEnabled));
+  return true;
+}
+
+LayoutDeviceIntRect DocAccessibleChild::GetCaretRectFor(const uint64_t& aID) {
+  Accessible* target;
+
+  if (aID) {
+    target = reinterpret_cast<Accessible*>(aID);
+  } else {
+    target = mDoc;
+  }
+
+  MOZ_ASSERT(target);
+
+  HyperTextAccessible* text = target->AsHyperText();
+  if (!text) {
+    return LayoutDeviceIntRect();
+  }
+
+  nsIWidget* widget = nullptr;
+  return text->GetCaretRect(&widget);
+}
+
+bool DocAccessibleChild::SendFocusEvent(const uint64_t& aID) {
+  return SendFocusEvent(aID, GetCaretRectFor(aID));
+}
+
+bool DocAccessibleChild::SendFocusEvent(const uint64_t& aID,
+                                        const LayoutDeviceIntRect& aCaretRect) {
+  if (IsConstructedInParentProcess()) {
+    return PDocAccessibleChild::SendFocusEvent(aID, aCaretRect);
+  }
+
+  PushDeferredEvent(MakeUnique<SerializedFocus>(this, aID, aCaretRect));
+  return true;
+}
+
+bool DocAccessibleChild::SendCaretMoveEvent(const uint64_t& aID,
+                                            const int32_t& aOffset,
+                                            const bool& aIsSelectionCollapsed) {
+  return SendCaretMoveEvent(aID, GetCaretRectFor(aID), aOffset,
+                            aIsSelectionCollapsed);
+}
+
+bool DocAccessibleChild::SendCaretMoveEvent(
+    const uint64_t& aID, const LayoutDeviceIntRect& aCaretRect,
+    const int32_t& aOffset, const bool& aIsSelectionCollapsed) {
+  if (IsConstructedInParentProcess()) {
+    return PDocAccessibleChild::SendCaretMoveEvent(aID, aCaretRect, aOffset,
+                                                   aIsSelectionCollapsed);
+  }
+
+  PushDeferredEvent(MakeUnique<SerializedCaretMove>(
+      this, aID, aCaretRect, aOffset, aIsSelectionCollapsed));
+  return true;
+}
+
+bool DocAccessibleChild::SendTextChangeEvent(
+    const uint64_t& aID, const nsString& aStr, const int32_t& aStart,
+    const uint32_t& aLen, const bool& aIsInsert, const bool& aFromUser,
+    const bool aDoSync) {
+  if (IsConstructedInParentProcess()) {
+    if (aDoSync) {
+      // The AT is going to need to reenter content while the event is being
+      // dispatched synchronously.
+      return PDocAccessibleChild::SendSyncTextChangeEvent(
+          aID, aStr, aStart, aLen, aIsInsert, aFromUser);
+    }
+    return PDocAccessibleChild::SendTextChangeEvent(aID, aStr, aStart, aLen,
+                                                    aIsInsert, aFromUser);
+  }
+
+  PushDeferredEvent(MakeUnique<SerializedTextChange>(
+      this, aID, aStr, aStart, aLen, aIsInsert, aFromUser));
+  return true;
+}
+
+bool DocAccessibleChild::SendSelectionEvent(const uint64_t& aID,
+                                            const uint64_t& aWidgetID,
+                                            const uint32_t& aType) {
+  if (IsConstructedInParentProcess()) {
+    return PDocAccessibleChild::SendSelectionEvent(aID, aWidgetID, aType);
+  }
+
+  PushDeferredEvent(
+      MakeUnique<SerializedSelection>(this, aID, aWidgetID, aType));
+  return true;
+}
+
+bool DocAccessibleChild::SendRoleChangedEvent(const a11y::role& aRole) {
+  if (IsConstructedInParentProcess()) {
+    return PDocAccessibleChild::SendRoleChangedEvent(aRole);
+  }
+
+  PushDeferredEvent(MakeUnique<SerializedRoleChanged>(this, aRole));
+  return true;
+}
+
+bool DocAccessibleChild::SendScrollingEvent(const uint64_t& aID,
+                                            const uint64_t& aType,
+                                            const uint32_t& aScrollX,
+                                            const uint32_t& aScrollY,
+                                            const uint32_t& aMaxScrollX,
+                                            const uint32_t& aMaxScrollY) {
+  if (IsConstructedInParentProcess()) {
+    return PDocAccessibleChild::SendScrollingEvent(
+        aID, aType, aScrollX, aScrollY, aMaxScrollX, aMaxScrollY);
+  }
+
+  PushDeferredEvent(MakeUnique<SerializedScrolling>(
+      this, aID, aType, aScrollX, aScrollY, aMaxScrollX, aMaxScrollY));
+  return true;
+}
+
+bool DocAccessibleChild::ConstructChildDocInParentProcess(
+    DocAccessibleChild* aNewChildDoc, uint64_t aUniqueID, uint32_t aMsaaID) {
+  if (IsConstructedInParentProcess()) {
+    // We may send the constructor immediately
+    auto browserChild = static_cast<dom::BrowserChild*>(Manager());
+    MOZ_ASSERT(browserChild);
+    bool result = browserChild->SendPDocAccessibleConstructor(
+        aNewChildDoc, this, aUniqueID, aMsaaID, IAccessibleHolder());
+    if (result) {
+      aNewChildDoc->SetConstructedInParentProcess();
+    }
+    return result;
+  }
+
+  PushDeferredEvent(MakeUnique<SerializedChildDocConstructor>(
+      aNewChildDoc, this, aUniqueID, aMsaaID));
+  return true;
+}
+
+bool DocAccessibleChild::SendBindChildDoc(DocAccessibleChild* aChildDoc,
+                                          const uint64_t& aNewParentID) {
+  if (IsConstructedInParentProcess()) {
+    return DocAccessibleChildBase::SendBindChildDoc(aChildDoc, aNewParentID);
+  }
+
+  PushDeferredEvent(
+      MakeUnique<SerializedBindChildDoc>(this, aChildDoc, aNewParentID));
+  return true;
+}
+
+ipc::IPCResult DocAccessibleChild::RecvRestoreFocus() {
+  FocusMgr()->ForceFocusEvent();
+  return IPC_OK();
+}
+
+void DocAccessibleChild::SetEmbedderOnBridge(dom::BrowserBridgeChild* aBridge,
+                                             uint64_t aID) {
+  if (CanSend()) {
+    aBridge->SendSetEmbedderAccessible(this, aID);
+  } else {
+    // This DocAccessibleChild hasn't sent the constructor to the parent
+    // process yet. This happens if the top level document hasn't received its
+    // parent COM proxy yet, in which case sending constructors for child
+    // documents gets deferred. We must also defer sending this as an embedder.
+    MOZ_ASSERT(!IsConstructedInParentProcess());
+    PushDeferredEvent(MakeUnique<SerializedSetEmbedder>(aBridge, this, aID));
+  }
+}
+
+}  // namespace a11y
+}  // namespace mozilla
diff --git a/accessible/ipc/win/DocAccessibleChild.h b/accessible/ipc/win/DocAccessibleChild.h
new file mode 100644
index 0000000000..d47a410016
--- /dev/null
+++ b/accessible/ipc/win/DocAccessibleChild.h
@@ -0,0 +1,369 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_a11y_DocAccessibleChild_h
+#define mozilla_a11y_DocAccessibleChild_h
+
+#include "mozilla/a11y/COMPtrTypes.h"
+#include "mozilla/a11y/DocAccessibleChildBase.h"
+#include "mozilla/dom/BrowserBridgeChild.h"
+#include "mozilla/dom/BrowserChild.h"
+#include "mozilla/mscom/Ptr.h"
+
+namespace mozilla {
+namespace a11y {
+
+/*
+ * These objects handle content side communication for an accessible document,
+ * and their lifetime is the same as the document they represent.
+ */
+class DocAccessibleChild : public DocAccessibleChildBase {
+ public:
+  DocAccessibleChild(DocAccessible* aDoc, IProtocol* aManager);
+  ~DocAccessibleChild();
+
+  virtual void Shutdown() override;
+
+  virtual ipc::IPCResult RecvParentCOMProxy(
+      const IDispatchHolder& aParentCOMProxy) override;
+  virtual ipc::IPCResult RecvEmulatedWindow(
+      const WindowsHandle& aEmulatedWindowHandle,
+      const IDispatchHolder& aEmulatedWindowCOMProxy) override;
+  virtual ipc::IPCResult RecvTopLevelDocCOMProxy(
+      const IAccessibleHolder& aCOMProxy) override;
+  virtual ipc::IPCResult RecvRestoreFocus() override;
+
+  HWND GetNativeWindowHandle() const;
+  IDispatch* GetEmulatedWindowIAccessible() const {
+    return mEmulatedWindowProxy.get();
+  }
+
+  IDispatch* GetParentIAccessible() const { return mParentProxy.get(); }
+  IAccessible* GetTopLevelDocIAccessible() const {
+    return mTopLevelDocProxy.get();
+  }
+
+  bool SendEvent(const uint64_t& aID, const uint32_t& type);
+  bool SendHideEvent(const uint64_t& aRootID, const bool& aFromUser);
+  bool SendStateChangeEvent(const uint64_t& aID, const uint64_t& aState,
+                            const bool& aEnabled);
+  bool SendCaretMoveEvent(const uint64_t& aID, const int32_t& aOffset,
+                          const bool& aIsSelectionCollapsed);
+  bool SendCaretMoveEvent(const uint64_t& aID,
+                          const LayoutDeviceIntRect& aCaretRect,
+                          const int32_t& aOffset,
+                          const bool& aIsSelectionCollapsed);
+  bool SendFocusEvent(const uint64_t& aID);
+  bool SendFocusEvent(const uint64_t& aID,
+                      const LayoutDeviceIntRect& aCaretRect);
+  bool SendTextChangeEvent(const uint64_t& aID, const nsString& aStr,
+                           const int32_t& aStart, const uint32_t& aLen,
+                           const bool& aIsInsert, const bool& aFromUser,
+                           const bool aDoSync = false);
+  bool SendSelectionEvent(const uint64_t& aID, const uint64_t& aWidgetID,
+                          const uint32_t& aType);
+  bool SendRoleChangedEvent(const a11y::role& aRole);
+  bool SendScrollingEvent(const uint64_t& aID, const uint64_t& aType,
+                          const uint32_t& aScrollX, const uint32_t& aScrollY,
+                          const uint32_t& aMaxScrollX,
+                          const uint32_t& aMaxScrollY);
+
+  bool ConstructChildDocInParentProcess(DocAccessibleChild* aNewChildDoc,
+                                        uint64_t aUniqueID, uint32_t aMsaaID);
+
+  bool SendBindChildDoc(DocAccessibleChild* aChildDoc,
+                        const uint64_t& aNewParentID);
+
+  /**
+   * Set the embedder accessible on a BrowserBridgeChild to an accessible in
+   * this document.
+   * Sending this will be deferred if this DocAccessibleChild hasn't been
+   * constructed in the parent process yet.
+   */
+  void SetEmbedderOnBridge(dom::BrowserBridgeChild* aBridge, uint64_t aID);
+
+ protected:
+  virtual void MaybeSendShowEvent(ShowEventData& aData,
+                                  bool aFromUser) override;
+
+ private:
+  void RemoveDeferredConstructor();
+
+  LayoutDeviceIntRect GetCaretRectFor(const uint64_t& aID);
+
+  /**
+   * DocAccessibleChild should not fire events until it has asynchronously
+   * received the COM proxy for its parent. OTOH, content a11y may still be
+   * attempting to fire events during this window of time. If this object does
+   * not yet have its parent proxy, instead of immediately sending the events to
+   * our parent, we enqueue them to mDeferredEvents. As soon as
+   * RecvParentCOMProxy is called, we play back mDeferredEvents.
+   */
+  struct DeferredEvent {
+    void Dispatch() { Dispatch(mTarget); }
+
+    virtual ~DeferredEvent() {}
+
+   protected:
+    explicit DeferredEvent(DocAccessibleChild* aTarget) : mTarget(aTarget) {}
+
+    virtual void Dispatch(DocAccessibleChild* aIPCDoc) = 0;
+
+   private:
+    DocAccessibleChild* mTarget;
+  };
+
+  void PushDeferredEvent(UniquePtr<DeferredEvent> aEvent);
+
+  struct SerializedShow final : public DeferredEvent {
+    SerializedShow(DocAccessibleChild* aTarget, ShowEventData& aEventData,
+                   bool aFromUser)
+        : DeferredEvent(aTarget),
+          mEventData(aEventData.ID(), aEventData.Idx(),
+                     nsTArray<AccessibleData>(), aEventData.EventSuppressed()),
+          mFromUser(aFromUser) {
+      // Since IPDL doesn't generate a move constructor for ShowEventData,
+      // we move NewTree manually (ugh). We still construct with an empty
+      // NewTree above so that the compiler catches any changes made to the
+      // ShowEventData structure in IPDL.
+      mEventData.NewTree() = std::move(aEventData.NewTree());
+    }
+
+    void Dispatch(DocAccessibleChild* aIPCDoc) override {
+      Unused << aIPCDoc->SendShowEvent(mEventData, mFromUser);
+    }
+
+    ShowEventData mEventData;
+    bool mFromUser;
+  };
+
+  struct SerializedHide final : public DeferredEvent {
+    SerializedHide(DocAccessibleChild* aTarget, uint64_t aRootID,
+                   bool aFromUser)
+        : DeferredEvent(aTarget), mRootID(aRootID), mFromUser(aFromUser) {}
+
+    void Dispatch(DocAccessibleChild* aIPCDoc) override {
+      Unused << aIPCDoc->SendHideEvent(mRootID, mFromUser);
+    }
+
+    uint64_t mRootID;
+    bool mFromUser;
+  };
+
+  struct SerializedStateChange final : public DeferredEvent {
+    SerializedStateChange(DocAccessibleChild* aTarget, uint64_t aID,
+                          uint64_t aState, bool aEnabled)
+        : DeferredEvent(aTarget),
+          mID(aID),
+          mState(aState),
+          mEnabled(aEnabled) {}
+
+    void Dispatch(DocAccessibleChild* aIPCDoc) override {
+      Unused << aIPCDoc->SendStateChangeEvent(mID, mState, mEnabled);
+    }
+
+    uint64_t mID;
+    uint64_t mState;
+    bool mEnabled;
+  };
+
+  struct SerializedCaretMove final : public DeferredEvent {
+    SerializedCaretMove(DocAccessibleChild* aTarget, uint64_t aID,
+                        const LayoutDeviceIntRect& aCaretRect, int32_t aOffset,
+                        bool aIsSelectionCollapsed)
+        : DeferredEvent(aTarget),
+          mID(aID),
+          mCaretRect(aCaretRect),
+          mOffset(aOffset),
+          mIsSelectionCollapsed(aIsSelectionCollapsed) {}
+
+    void Dispatch(DocAccessibleChild* aIPCDoc) override {
+      Unused << aIPCDoc->SendCaretMoveEvent(mID, mCaretRect, mOffset,
+                                            mIsSelectionCollapsed);
+    }
+
+    uint64_t mID;
+    LayoutDeviceIntRect mCaretRect;
+    int32_t mOffset;
+    bool mIsSelectionCollapsed;
+  };
+
+  struct SerializedFocus final : public DeferredEvent {
+    SerializedFocus(DocAccessibleChild* aTarget, uint64_t aID,
+                    const LayoutDeviceIntRect& aCaretRect)
+        : DeferredEvent(aTarget), mID(aID), mCaretRect(aCaretRect) {}
+
+    void Dispatch(DocAccessibleChild* aIPCDoc) override {
+      Unused << aIPCDoc->SendFocusEvent(mID, mCaretRect);
+    }
+
+    uint64_t mID;
+    LayoutDeviceIntRect mCaretRect;
+  };
+
+  struct SerializedTextChange final : public DeferredEvent {
+    SerializedTextChange(DocAccessibleChild* aTarget, uint64_t aID,
+                         const nsString& aStr, int32_t aStart, uint32_t aLen,
+                         bool aIsInsert, bool aFromUser)
+        : DeferredEvent(aTarget),
+          mID(aID),
+          mStr(aStr),
+          mStart(aStart),
+          mLen(aLen),
+          mIsInsert(aIsInsert),
+          mFromUser(aFromUser) {}
+
+    void Dispatch(DocAccessibleChild* aIPCDoc) override {
+      Unused << aIPCDoc->SendTextChangeEvent(mID, mStr, mStart, mLen, mIsInsert,
+                                             mFromUser, false);
+    }
+
+    uint64_t mID;
+    nsString mStr;
+    int32_t mStart;
+    uint32_t mLen;
+    bool mIsInsert;
+    bool mFromUser;
+  };
+
+  struct SerializedSelection final : public DeferredEvent {
+    SerializedSelection(DocAccessibleChild* aTarget, uint64_t aID,
+                        uint64_t aWidgetID, uint32_t aType)
+        : DeferredEvent(aTarget),
+          mID(aID),
+          mWidgetID(aWidgetID),
+          mType(aType) {}
+
+    void Dispatch(DocAccessibleChild* aIPCDoc) override {
+      Unused << aIPCDoc->SendSelectionEvent(mID, mWidgetID, mType);
+    }
+
+    uint64_t mID;
+    uint64_t mWidgetID;
+    uint32_t mType;
+  };
+
+  struct SerializedRoleChanged final : public DeferredEvent {
+    explicit SerializedRoleChanged(DocAccessibleChild* aTarget,
+                                   a11y::role aRole)
+        : DeferredEvent(aTarget), mRole(aRole) {}
+
+    void Dispatch(DocAccessibleChild* aIPCDoc) override {
+      Unused << aIPCDoc->SendRoleChangedEvent(mRole);
+    }
+
+    a11y::role mRole;
+  };
+
+  struct SerializedScrolling final : public DeferredEvent {
+    explicit SerializedScrolling(DocAccessibleChild* aTarget, uint64_t aID,
+                                 uint64_t aType, uint32_t aScrollX,
+                                 uint32_t aScrollY, uint32_t aMaxScrollX,
+                                 uint32_t aMaxScrollY)
+        : DeferredEvent(aTarget),
+          mID(aID),
+          mType(aType),
+          mScrollX(aScrollX),
+          mScrollY(aScrollY),
+          mMaxScrollX(aMaxScrollX),
+          mMaxScrollY(aMaxScrollY) {}
+
+    void Dispatch(DocAccessibleChild* aIPCDoc) override {
+      Unused << aIPCDoc->SendScrollingEvent(mID, mType, mScrollX, mScrollY,
+                                            mMaxScrollX, mMaxScrollY);
+    }
+
+    uint64_t mID;
+    uint64_t mType;
+    uint32_t mScrollX;
+    uint32_t mScrollY;
+    uint32_t mMaxScrollX;
+    uint32_t mMaxScrollY;
+  };
+
+  struct SerializedEvent final : public DeferredEvent {
+    SerializedEvent(DocAccessibleChild* aTarget, uint64_t aID, uint32_t aType)
+        : DeferredEvent(aTarget), mID(aID), mType(aType) {}
+
+    void Dispatch(DocAccessibleChild* aIPCDoc) override {
+      Unused << aIPCDoc->SendEvent(mID, mType);
+    }
+
+    uint64_t mID;
+    uint32_t mType;
+  };
+
+  struct SerializedChildDocConstructor final : public DeferredEvent {
+    SerializedChildDocConstructor(DocAccessibleChild* aIPCDoc,
+                                  DocAccessibleChild* aParentIPCDoc,
+                                  uint64_t aUniqueID, uint32_t aMsaaID)
+        : DeferredEvent(aParentIPCDoc),
+          mIPCDoc(aIPCDoc),
+          mUniqueID(aUniqueID),
+          mMsaaID(aMsaaID) {}
+
+    void Dispatch(DocAccessibleChild* aParentIPCDoc) override {
+      auto browserChild =
+          static_cast<dom::BrowserChild*>(aParentIPCDoc->Manager());
+      MOZ_ASSERT(browserChild);
+      Unused << browserChild->SendPDocAccessibleConstructor(
+          mIPCDoc, aParentIPCDoc, mUniqueID, mMsaaID, IAccessibleHolder());
+      mIPCDoc->SetConstructedInParentProcess();
+    }
+
+    DocAccessibleChild* mIPCDoc;
+    uint64_t mUniqueID;
+    uint32_t mMsaaID;
+  };
+
+  friend struct SerializedChildDocConstructor;
+
+  struct SerializedBindChildDoc final : public DeferredEvent {
+    SerializedBindChildDoc(DocAccessibleChild* aParentDoc,
+                           DocAccessibleChild* aChildDoc, uint64_t aNewParentID)
+        : DeferredEvent(aParentDoc),
+          mChildDoc(aChildDoc),
+          mNewParentID(aNewParentID) {}
+
+    void Dispatch(DocAccessibleChild* aParentIPCDoc) override {
+      Unused << aParentIPCDoc->SendBindChildDoc(mChildDoc, mNewParentID);
+    }
+
+    DocAccessibleChild* mChildDoc;
+    uint64_t mNewParentID;
+  };
+
+  struct SerializedShutdown final : public DeferredEvent {
+    explicit SerializedShutdown(DocAccessibleChild* aTarget)
+        : DeferredEvent(aTarget) {}
+
+    void Dispatch(DocAccessibleChild* aIPCDoc) override { aIPCDoc->Shutdown(); }
+  };
+
+  struct SerializedSetEmbedder final : public DeferredEvent {
+    SerializedSetEmbedder(dom::BrowserBridgeChild* aBridge,
+                          DocAccessibleChild* aDoc, uint64_t aID)
+        : DeferredEvent(aDoc), mBridge(aBridge), mID(aID) {}
+
+    void Dispatch(DocAccessibleChild* aDoc) override {
+      Unused << mBridge->SendSetEmbedderAccessible(aDoc, mID);
+    }
+
+    RefPtr<dom::BrowserBridgeChild> mBridge;
+    uint64_t mID;
+  };
+
+  mscom::ProxyUniquePtr<IDispatch> mParentProxy;
+  mscom::ProxyUniquePtr<IDispatch> mEmulatedWindowProxy;
+  mscom::ProxyUniquePtr<IAccessible> mTopLevelDocProxy;
+  nsTArray<UniquePtr<DeferredEvent>> mDeferredEvents;
+  HWND mEmulatedWindowHandle;
+};
+
+}  // namespace a11y
+}  // namespace mozilla
+
+#endif  // mozilla_a11y_DocAccessibleChild_h
diff --git a/accessible/ipc/win/HandlerProvider.cpp b/accessible/ipc/win/HandlerProvider.cpp
new file mode 100644
index 0000000000..6e8e5e52c3
--- /dev/null
+++ b/accessible/ipc/win/HandlerProvider.cpp
@@ -0,0 +1,974 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/a11y/HandlerProvider.h"
+
+#include <memory.h>
+
+#include <utility>
+
+#include "Accessible2_3.h"
+#include "AccessibleApplication.h"
+#include "AccessibleDocument.h"
+#include "AccessibleEditableText.h"
+#include "AccessibleImage.h"
+#include "AccessibleRelation.h"
+#include "AccessibleTable.h"
+#include "AccessibleTable2.h"
+#include "AccessibleTableCell.h"
+#include "HandlerData.h"
+#include "HandlerData_i.c"
+#include "ISimpleDOM.h"
+#include "mozilla/Assertions.h"
+#include "mozilla/UniquePtr.h"
+#include "mozilla/a11y/AccessibleWrap.h"
+#include "mozilla/dom/ContentChild.h"
+#include "mozilla/mscom/AgileReference.h"
+#include "mozilla/mscom/FastMarshaler.h"
+#include "mozilla/mscom/Interceptor.h"
+#include "mozilla/mscom/MainThreadHandoff.h"
+#include "mozilla/mscom/MainThreadInvoker.h"
+#include "mozilla/mscom/Ptr.h"
+#include "mozilla/mscom/StructStream.h"
+#include "mozilla/mscom/Utils.h"
+#include "nsTArray.h"
+#include "nsThreadUtils.h"
+#include "uiautomation.h"
+
+namespace mozilla {
+namespace a11y {
+
+HandlerProvider::HandlerProvider(REFIID aIid,
+                                 mscom::InterceptorTargetPtr<IUnknown> aTarget)
+    : mRefCnt(0),
+      mMutex("mozilla::a11y::HandlerProvider::mMutex"),
+      mTargetUnkIid(aIid),
+      mTargetUnk(std::move(aTarget)),
+      mPayloadMutex("mozilla::a11y::HandlerProvider::mPayloadMutex") {}
+
+HRESULT
+HandlerProvider::QueryInterface(REFIID riid, void** ppv) {
+  if (!ppv) {
+    return E_INVALIDARG;
+  }
+
+  if (riid == IID_IUnknown || riid == IID_IGeckoBackChannel) {
+    RefPtr<IUnknown> punk(static_cast<IGeckoBackChannel*>(this));
+    punk.forget(ppv);
+    return S_OK;
+  }
+
+  if (riid == IID_IMarshal) {
+    if (!mFastMarshalUnk) {
+      HRESULT hr =
+          mscom::FastMarshaler::Create(static_cast<IGeckoBackChannel*>(this),
+                                       getter_AddRefs(mFastMarshalUnk));
+      if (FAILED(hr)) {
+        return hr;
+      }
+    }
+
+    return mFastMarshalUnk->QueryInterface(riid, ppv);
+  }
+
+  return E_NOINTERFACE;
+}
+
+ULONG
+HandlerProvider::AddRef() { return ++mRefCnt; }
+
+ULONG
+HandlerProvider::Release() {
+  ULONG result = --mRefCnt;
+  if (!result) {
+    delete this;
+  }
+  return result;
+}
+
+HRESULT
+HandlerProvider::GetHandler(NotNull<CLSID*> aHandlerClsid) {
+  if (!IsTargetInterfaceCacheable()) {
+    return E_NOINTERFACE;
+  }
+
+  *aHandlerClsid = CLSID_AccessibleHandler;
+  return S_OK;
+}
+
+void HandlerProvider::GetAndSerializePayload(
+    const MutexAutoLock&, NotNull<mscom::IInterceptor*> aInterceptor) {
+  MOZ_ASSERT(mscom::IsCurrentThreadMTA());
+
+  if (mSerializer) {
+    return;
+  }
+
+  IA2PayloadPtr payload;
+  {  // Scope for lock
+    MutexAutoLock lock(mPayloadMutex);
+    if (mPayload) {
+      // The payload was already built by prebuildPayload() called during a
+      // bulk fetch operation.
+      payload = std::move(mPayload);
+    }
+  }
+
+  if (!payload) {
+    // We don't have a pre-built payload, so build it now.
+    payload.reset(new IA2Payload());
+    if (!mscom::InvokeOnMainThread(
+            "HandlerProvider::BuildInitialIA2Data", this,
+            &HandlerProvider::BuildInitialIA2Data,
+            std::forward<NotNull<mscom::IInterceptor*>>(aInterceptor),
+            std::forward<StaticIA2Data*>(&payload->mStaticData),
+            std::forward<DynamicIA2Data*>(&payload->mDynamicData)) ||
+        !payload->mDynamicData.mUniqueId) {
+      return;
+    }
+  }
+
+  // But we set mGeckoBackChannel on the current thread which resides in the
+  // MTA. This is important to ensure that COM always invokes
+  // IGeckoBackChannel methods in an MTA background thread.
+  RefPtr<IGeckoBackChannel> payloadRef(this);
+  // AddRef/Release pair for this reference is handled by payloadRef
+  payload->mGeckoBackChannel = this;
+
+  mSerializer = MakeUnique<mscom::StructToStream>(*payload, &IA2Payload_Encode);
+}
+
+HRESULT
+HandlerProvider::GetHandlerPayloadSize(
+    NotNull<mscom::IInterceptor*> aInterceptor,
+    NotNull<DWORD*> aOutPayloadSize) {
+  MOZ_ASSERT(mscom::IsCurrentThreadMTA());
+
+  if (!IsTargetInterfaceCacheable()) {
+    // No handler, so no payload for this instance.
+    return E_NOTIMPL;
+  }
+
+  MutexAutoLock lock(mMutex);
+
+  GetAndSerializePayload(lock, aInterceptor);
+
+  if (!mSerializer || !(*mSerializer)) {
+    // Failed payload serialization is non-fatal
+    *aOutPayloadSize = mscom::StructToStream::GetEmptySize();
+    return S_OK;
+  }
+
+  *aOutPayloadSize = mSerializer->GetSize();
+  return S_OK;
+}
+
+void HandlerProvider::BuildStaticIA2Data(
+    NotNull<mscom::IInterceptor*> aInterceptor, StaticIA2Data* aOutData) {
+  MOZ_ASSERT(aOutData);
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(mTargetUnk);
+  MOZ_ASSERT(IsTargetInterfaceCacheable());
+
+  // Include interfaces the client is likely to request.
+  // This is cheap here and saves multiple cross-process calls later.
+  // These interfaces must be released in ReleaseStaticIA2DataInterfaces!
+
+  // If the target is already an IAccessible2, this pointer is redundant.
+  // However, the target might be an IAccessibleHyperlink, etc., in which
+  // case the client will almost certainly QI for IAccessible2.
+  HRESULT hr = aInterceptor->GetInterceptorForIID(NEWEST_IA2_IID,
+                                                  (void**)&aOutData->mIA2);
+  if (FAILED(hr)) {
+    // IA2 should always be present, so something has
+    // gone very wrong if this fails.
+    aOutData->mIA2 = nullptr;
+    return;
+  }
+
+  // Some of these interfaces aren't present on all accessibles,
+  // so it's not a failure if these interfaces can't be fetched.
+  hr = aInterceptor->GetInterceptorForIID(IID_IAccessibleHypertext2,
+                                          (void**)&aOutData->mIAHypertext);
+  if (FAILED(hr)) {
+    aOutData->mIAHypertext = nullptr;
+  }
+
+  hr = aInterceptor->GetInterceptorForIID(IID_IAccessibleHyperlink,
+                                          (void**)&aOutData->mIAHyperlink);
+  if (FAILED(hr)) {
+    aOutData->mIAHyperlink = nullptr;
+  }
+
+  hr = aInterceptor->GetInterceptorForIID(IID_IAccessibleTable,
+                                          (void**)&aOutData->mIATable);
+  if (FAILED(hr)) {
+    aOutData->mIATable = nullptr;
+  }
+
+  hr = aInterceptor->GetInterceptorForIID(IID_IAccessibleTable2,
+                                          (void**)&aOutData->mIATable2);
+  if (FAILED(hr)) {
+    aOutData->mIATable2 = nullptr;
+  }
+
+  hr = aInterceptor->GetInterceptorForIID(IID_IAccessibleTableCell,
+                                          (void**)&aOutData->mIATableCell);
+  if (FAILED(hr)) {
+    aOutData->mIATableCell = nullptr;
+  }
+}
+
+void HandlerProvider::BuildDynamicIA2Data(DynamicIA2Data* aOutIA2Data,
+                                          bool aMarshaledByCom) {
+  MOZ_ASSERT(aOutIA2Data);
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(IsTargetInterfaceCacheable());
+
+  if (!mTargetUnk) {
+    return;
+  }
+
+  RefPtr<NEWEST_IA2_INTERFACE> target;
+  HRESULT hr =
+      mTargetUnk.get()->QueryInterface(NEWEST_IA2_IID, getter_AddRefs(target));
+  if (FAILED(hr)) {
+    return;
+  }
+
+  hr = E_UNEXPECTED;
+
+  auto hasFailed = [&hr]() -> bool { return FAILED(hr); };
+
+  auto cleanup = [aOutIA2Data, aMarshaledByCom]() -> void {
+    CleanupDynamicIA2Data(*aOutIA2Data, aMarshaledByCom);
+  };
+
+  mscom::ExecuteWhen<decltype(hasFailed), decltype(cleanup)> onFail(hasFailed,
+                                                                    cleanup);
+
+  // When allocating memory to be returned to the client, you *must* use
+  // allocMem, not CoTaskMemAlloc!
+  auto allocMem = [aMarshaledByCom](size_t aSize) {
+    if (aMarshaledByCom) {
+      return ::CoTaskMemAlloc(aSize);
+    }
+    // We use midl_user_allocate rather than CoTaskMemAlloc because this
+    // struct is being marshaled by RPC, not COM.
+    return ::midl_user_allocate(aSize);
+  };
+
+  const VARIANT kChildIdSelf = {VT_I4};
+  VARIANT varVal;
+
+  hr = target->accLocation(&aOutIA2Data->mLeft, &aOutIA2Data->mTop,
+                           &aOutIA2Data->mWidth, &aOutIA2Data->mHeight,
+                           kChildIdSelf);
+  if (FAILED(hr)) {
+    return;
+  }
+
+  hr = target->get_accRole(kChildIdSelf, &aOutIA2Data->mRole);
+  if (FAILED(hr)) {
+    return;
+  }
+
+  hr = target->get_accState(kChildIdSelf, &varVal);
+  if (FAILED(hr)) {
+    return;
+  }
+
+  aOutIA2Data->mState = varVal.lVal;
+
+  hr = target->get_accKeyboardShortcut(kChildIdSelf,
+                                       &aOutIA2Data->mKeyboardShortcut);
+  if (FAILED(hr)) {
+    return;
+  }
+
+  hr = target->get_accName(kChildIdSelf, &aOutIA2Data->mName);
+  if (FAILED(hr)) {
+    return;
+  }
+
+  hr = target->get_accDescription(kChildIdSelf, &aOutIA2Data->mDescription);
+  if (FAILED(hr)) {
+    return;
+  }
+
+  hr = target->get_accDefaultAction(kChildIdSelf, &aOutIA2Data->mDefaultAction);
+  if (FAILED(hr)) {
+    return;
+  }
+
+  hr = target->get_accChildCount(&aOutIA2Data->mChildCount);
+  if (FAILED(hr)) {
+    return;
+  }
+
+  hr = target->get_accValue(kChildIdSelf, &aOutIA2Data->mValue);
+  if (FAILED(hr)) {
+    return;
+  }
+
+  hr = target->get_states(&aOutIA2Data->mIA2States);
+  if (FAILED(hr)) {
+    return;
+  }
+
+  hr = target->get_attributes(&aOutIA2Data->mAttributes);
+  if (FAILED(hr)) {
+    return;
+  }
+
+  HWND hwnd;
+  hr = target->get_windowHandle(&hwnd);
+  if (FAILED(hr)) {
+    return;
+  }
+
+  aOutIA2Data->mHwnd = PtrToLong(hwnd);
+
+  hr = target->get_locale(&aOutIA2Data->mIA2Locale);
+  if (FAILED(hr)) {
+    return;
+  }
+
+  hr = target->role(&aOutIA2Data->mIA2Role);
+  if (FAILED(hr)) {
+    return;
+  }
+
+  RefPtr<IAccessibleAction> action;
+  // It is not an error if this fails.
+  hr = mTargetUnk.get()->QueryInterface(IID_IAccessibleAction,
+                                        getter_AddRefs(action));
+  if (SUCCEEDED(hr)) {
+    hr = action->nActions(&aOutIA2Data->mNActions);
+    if (FAILED(hr)) {
+      return;
+    }
+  }
+
+  RefPtr<IAccessibleTableCell> cell;
+  // It is not an error if this fails.
+  hr = mTargetUnk.get()->QueryInterface(IID_IAccessibleTableCell,
+                                        getter_AddRefs(cell));
+  if (SUCCEEDED(hr)) {
+    hr = cell->get_rowColumnExtents(
+        &aOutIA2Data->mRowIndex, &aOutIA2Data->mColumnIndex,
+        &aOutIA2Data->mRowExtent, &aOutIA2Data->mColumnExtent,
+        &aOutIA2Data->mCellIsSelected);
+    if (FAILED(hr)) {
+      return;
+    }
+
+    // Because the same headers can apply to many cells, include the ids of
+    // header cells, rather than the actual objects. Otherwise, we might
+    // end up marshaling the same objects (and their payloads) many times.
+    IUnknown** headers = nullptr;
+    hr = cell->get_rowHeaderCells(&headers, &aOutIA2Data->mNRowHeaderCells);
+    if (FAILED(hr)) {
+      return;
+    }
+    if (aOutIA2Data->mNRowHeaderCells > 0) {
+      aOutIA2Data->mRowHeaderCellIds = static_cast<long*>(
+          allocMem(sizeof(long) * aOutIA2Data->mNRowHeaderCells));
+      for (long i = 0; i < aOutIA2Data->mNRowHeaderCells; ++i) {
+        RefPtr<IAccessible2> headerAcc;
+        hr = headers[i]->QueryInterface(IID_IAccessible2,
+                                        getter_AddRefs(headerAcc));
+        MOZ_ASSERT(SUCCEEDED(hr));
+        headers[i]->Release();
+        hr = headerAcc->get_uniqueID(&aOutIA2Data->mRowHeaderCellIds[i]);
+        MOZ_ASSERT(SUCCEEDED(hr));
+      }
+    }
+    ::CoTaskMemFree(headers);
+
+    hr = cell->get_columnHeaderCells(&headers,
+                                     &aOutIA2Data->mNColumnHeaderCells);
+    if (FAILED(hr)) {
+      return;
+    }
+    if (aOutIA2Data->mNColumnHeaderCells > 0) {
+      aOutIA2Data->mColumnHeaderCellIds = static_cast<long*>(
+          allocMem(sizeof(long) * aOutIA2Data->mNColumnHeaderCells));
+      for (long i = 0; i < aOutIA2Data->mNColumnHeaderCells; ++i) {
+        RefPtr<IAccessible2> headerAcc;
+        hr = headers[i]->QueryInterface(IID_IAccessible2,
+                                        getter_AddRefs(headerAcc));
+        MOZ_ASSERT(SUCCEEDED(hr));
+        headers[i]->Release();
+        hr = headerAcc->get_uniqueID(&aOutIA2Data->mColumnHeaderCellIds[i]);
+        MOZ_ASSERT(SUCCEEDED(hr));
+      }
+    }
+    ::CoTaskMemFree(headers);
+  }
+
+  // NB: get_uniqueID should be the final property retrieved in this method,
+  // as its presence is used to determine whether the rest of this data
+  // retrieval was successful.
+  hr = target->get_uniqueID(&aOutIA2Data->mUniqueId);
+}
+
+void HandlerProvider::BuildInitialIA2Data(
+    NotNull<mscom::IInterceptor*> aInterceptor, StaticIA2Data* aOutStaticData,
+    DynamicIA2Data* aOutDynamicData) {
+  BuildStaticIA2Data(aInterceptor, aOutStaticData);
+  if (!aOutStaticData->mIA2) {
+    return;
+  }
+  BuildDynamicIA2Data(aOutDynamicData);
+}
+
+bool HandlerProvider::IsTargetInterfaceCacheable() {
+  return MarshalAs(mTargetUnkIid) == NEWEST_IA2_IID ||
+         mTargetUnkIid == IID_IAccessibleHyperlink;
+}
+
+HRESULT
+HandlerProvider::WriteHandlerPayload(NotNull<mscom::IInterceptor*> aInterceptor,
+                                     NotNull<IStream*> aStream) {
+  if (!IsTargetInterfaceCacheable()) {
+    // No handler, so no payload for this instance.
+    return E_NOTIMPL;
+  }
+
+  MutexAutoLock lock(mMutex);
+
+  if (!mSerializer || !(*mSerializer)) {
+    // Failed payload serialization is non-fatal
+    mscom::StructToStream emptyStruct;
+    return emptyStruct.Write(aStream);
+  }
+
+  HRESULT hr = mSerializer->Write(aStream);
+
+  mSerializer.reset();
+
+  return hr;
+}
+
+REFIID
+HandlerProvider::MarshalAs(REFIID aIid) {
+  static_assert(&NEWEST_IA2_IID == &IID_IAccessible2_3,
+                "You have modified NEWEST_IA2_IID. This code needs updating.");
+  if (aIid == IID_IDispatch || aIid == IID_IAccessible ||
+      aIid == IID_IAccessible2 || aIid == IID_IAccessible2_2 ||
+      aIid == IID_IAccessible2_3) {
+    // This should always be the newest IA2 interface ID
+    return NEWEST_IA2_IID;
+  }
+  // Otherwise we juse return the identity.
+  return aIid;
+}
+
+HRESULT
+HandlerProvider::DisconnectHandlerRemotes() {
+  // If a handlerProvider call is pending on another thread,
+  // CoDisconnectObject won't release this HandlerProvider immediately.
+  // However, the interceptor and its target (mTargetUnk) might be destroyed.
+  mTargetUnk = nullptr;
+
+  IUnknown* unk = static_cast<IGeckoBackChannel*>(this);
+  return ::CoDisconnectObject(unk, 0);
+}
+
+HRESULT
+HandlerProvider::IsInterfaceMaybeSupported(REFIID aIid) {
+  static_assert(&NEWEST_IA2_IID == &IID_IAccessible2_3,
+                "You have modified NEWEST_IA2_IID. This code needs updating.");
+  if (aIid == IID_IUnknown || aIid == IID_IDispatch ||
+      aIid == IID_IAccessible || aIid == IID_IServiceProvider ||
+      aIid == IID_IEnumVARIANT || aIid == IID_IAccessible2 ||
+      aIid == IID_IAccessible2_2 || aIid == IID_IAccessible2_3 ||
+      aIid == IID_IAccessibleAction || aIid == IID_IAccessibleApplication ||
+      aIid == IID_IAccessibleComponent || aIid == IID_IAccessibleDocument ||
+      aIid == IID_IAccessibleEditableText || aIid == IID_IAccessibleHyperlink ||
+      aIid == IID_IAccessibleHypertext || aIid == IID_IAccessibleHypertext2 ||
+      aIid == IID_IAccessibleImage || aIid == IID_IAccessibleRelation ||
+      aIid == IID_IAccessibleTable || aIid == IID_IAccessibleTable2 ||
+      aIid == IID_IAccessibleTableCell || aIid == IID_IAccessibleText ||
+      aIid == IID_IAccessibleValue || aIid == IID_ISimpleDOMNode ||
+      aIid == IID_ISimpleDOMDocument || aIid == IID_ISimpleDOMText ||
+      aIid == IID_IAccessibleEx || aIid == IID_IRawElementProviderSimple) {
+    return S_OK;
+  }
+  return E_NOINTERFACE;
+}
+
+REFIID
+HandlerProvider::GetEffectiveOutParamIid(REFIID aCallIid, ULONG aCallMethod) {
+  if (aCallIid == IID_IAccessibleTable || aCallIid == IID_IAccessibleTable2 ||
+      aCallIid == IID_IAccessibleDocument ||
+      aCallIid == IID_IAccessibleTableCell ||
+      aCallIid == IID_IAccessibleRelation) {
+    return NEWEST_IA2_IID;
+  }
+
+  // IAccessible2_2::accessibleWithCaret
+  static_assert(&NEWEST_IA2_IID == &IID_IAccessible2_3,
+                "You have modified NEWEST_IA2_IID. This code needs updating.");
+  if ((aCallIid == IID_IAccessible2_2 || aCallIid == IID_IAccessible2_3) &&
+      aCallMethod == 47) {
+    return NEWEST_IA2_IID;
+  }
+
+  // IAccessible::get_accSelection
+  if ((aCallIid == IID_IAccessible || aCallIid == IID_IAccessible2 ||
+       aCallIid == IID_IAccessible2_2 || aCallIid == IID_IAccessible2_3) &&
+      aCallMethod == 19) {
+    return IID_IEnumVARIANT;
+  }
+
+  MOZ_ASSERT(false);
+  return IID_IUnknown;
+}
+
+HRESULT
+HandlerProvider::NewInstance(
+    REFIID aIid, mscom::InterceptorTargetPtr<IUnknown> aTarget,
+    NotNull<mscom::IHandlerProvider**> aOutNewPayload) {
+  RefPtr<IHandlerProvider> newPayload(
+      new HandlerProvider(aIid, std::move(aTarget)));
+  newPayload.forget(aOutNewPayload.get());
+  return S_OK;
+}
+
+void HandlerProvider::SetHandlerControlOnMainThread(
+    DWORD aPid, mscom::ProxyUniquePtr<IHandlerControl> aCtrl) {
+  MOZ_ASSERT(NS_IsMainThread());
+
+  auto content = dom::ContentChild::GetSingleton();
+  MOZ_ASSERT(content);
+
+  IHandlerControlHolder holder(
+      CreateHolderFromHandlerControl(std::move(aCtrl)));
+  Unused << content->SendA11yHandlerControl(aPid, holder);
+}
+
+HRESULT
+HandlerProvider::put_HandlerControl(long aPid, IHandlerControl* aCtrl) {
+  MOZ_ASSERT(mscom::IsCurrentThreadMTA());
+
+  if (!aCtrl) {
+    return E_INVALIDARG;
+  }
+
+  auto ptrProxy = mscom::ToProxyUniquePtr(aCtrl);
+
+  if (!mscom::InvokeOnMainThread(
+          "HandlerProvider::SetHandlerControlOnMainThread", this,
+          &HandlerProvider::SetHandlerControlOnMainThread,
+          static_cast<DWORD>(aPid), std::move(ptrProxy))) {
+    return E_FAIL;
+  }
+
+  return S_OK;
+}
+
+HRESULT
+HandlerProvider::Refresh(DynamicIA2Data* aOutData) {
+  MOZ_ASSERT(mscom::IsCurrentThreadMTA());
+
+  if (!mTargetUnk) {
+    return CO_E_OBJNOTCONNECTED;
+  }
+
+  if (!mscom::InvokeOnMainThread("HandlerProvider::BuildDynamicIA2Data", this,
+                                 &HandlerProvider::BuildDynamicIA2Data,
+                                 std::forward<DynamicIA2Data*>(aOutData),
+                                 /* aMarshaledByCom */ true)) {
+    return E_FAIL;
+  }
+
+  if (!aOutData->mUniqueId) {
+    // BuildDynamicIA2Data failed.
+    if (!mTargetUnk) {
+      // Even though we checked this before, the accessible can be shut down
+      // before BuildDynamicIA2Data executes on the main thread.
+      return CO_E_OBJNOTCONNECTED;
+    }
+    return E_FAIL;
+  }
+
+  return S_OK;
+}
+
+void HandlerProvider::PrebuildPayload(
+    NotNull<mscom::IInterceptor*> aInterceptor) {
+  MOZ_ASSERT(NS_IsMainThread());
+  MutexAutoLock lock(mPayloadMutex);
+  mPayload.reset(new IA2Payload());
+  BuildInitialIA2Data(aInterceptor, &mPayload->mStaticData,
+                      &mPayload->mDynamicData);
+  if (!mPayload->mDynamicData.mUniqueId) {
+    // Building the payload failed.
+    mPayload.reset();
+  }
+}
+
+template <typename Interface>
+HRESULT HandlerProvider::ToWrappedObject(Interface** aObj) {
+  MOZ_ASSERT(NS_IsMainThread());
+  mscom::STAUniquePtr<Interface> inObj(*aObj);
+  RefPtr<HandlerProvider> hprov = new HandlerProvider(
+      __uuidof(Interface), mscom::ToInterceptorTargetPtr(inObj));
+  HRESULT hr =
+      mscom::MainThreadHandoff::WrapInterface(std::move(inObj), hprov, aObj);
+  if (FAILED(hr)) {
+    *aObj = nullptr;
+    return hr;
+  }
+  // Build the payload for this object now to avoid a cross-thread call when
+  // marshaling it later.
+  RefPtr<mscom::IInterceptor> interceptor;
+  hr = (*aObj)->QueryInterface(mscom::IID_IInterceptor,
+                               getter_AddRefs(interceptor));
+  MOZ_ASSERT(SUCCEEDED(hr));
+  // Even though we created a new HandlerProvider, that won't be used if
+  // there's an existing Interceptor. Therefore, we must get the
+  // HandlerProvider from the Interceptor.
+  RefPtr<mscom::IInterceptorSink> interceptorSink;
+  interceptor->GetEventSink(getter_AddRefs(interceptorSink));
+  MOZ_ASSERT(interceptorSink);
+  RefPtr<mscom::IMainThreadHandoff> handoff;
+  hr = interceptorSink->QueryInterface(mscom::IID_IMainThreadHandoff,
+                                       getter_AddRefs(handoff));
+  // If a11y Interceptors stop using MainThreadHandoff as their event sink, we
+  // *really* want to know about it ASAP.
+  MOZ_DIAGNOSTIC_ASSERT(SUCCEEDED(hr),
+                        "A11y Interceptor isn't using MainThreadHandoff");
+  RefPtr<mscom::IHandlerProvider> usedIHprov;
+  handoff->GetHandlerProvider(getter_AddRefs(usedIHprov));
+  MOZ_ASSERT(usedIHprov);
+  auto usedHprov = static_cast<HandlerProvider*>(usedIHprov.get());
+  usedHprov->PrebuildPayload(WrapNotNull(interceptor));
+  return hr;
+}
+
+void HandlerProvider::GetAllTextInfoMainThread(
+    BSTR* aText, IAccessibleHyperlink*** aHyperlinks, long* aNHyperlinks,
+    IA2TextSegment** aAttribRuns, long* aNAttribRuns, HRESULT* result) {
+  MOZ_ASSERT(aText);
+  MOZ_ASSERT(aHyperlinks);
+  MOZ_ASSERT(aNHyperlinks);
+  MOZ_ASSERT(aAttribRuns);
+  MOZ_ASSERT(aNAttribRuns);
+  MOZ_ASSERT(NS_IsMainThread());
+
+  if (!mTargetUnk) {
+    *result = CO_E_OBJNOTCONNECTED;
+    return;
+  }
+
+  RefPtr<IAccessibleHypertext2> ht;
+  HRESULT hr =
+      mTargetUnk->QueryInterface(IID_IAccessibleHypertext2, getter_AddRefs(ht));
+  if (FAILED(hr)) {
+    *result = hr;
+    return;
+  }
+
+  hr = ht->get_text(0, IA2_TEXT_OFFSET_LENGTH, aText);
+  if (FAILED(hr)) {
+    *result = hr;
+    return;
+  }
+
+  if (hr == S_FALSE) {
+    // No text.
+    *aHyperlinks = nullptr;
+    *aNHyperlinks = 0;
+    *aAttribRuns = nullptr;
+    *aNAttribRuns = 0;
+    *result = S_FALSE;
+    return;
+  }
+
+  hr = ht->get_hyperlinks(aHyperlinks, aNHyperlinks);
+  if (FAILED(hr)) {
+    *aHyperlinks = nullptr;
+    // -1 signals to the handler that it should call hyperlinks itself.
+    *aNHyperlinks = -1;
+  }
+  // We must wrap these hyperlinks in an interceptor.
+  for (long index = 0; index < *aNHyperlinks; ++index) {
+    ToWrappedObject(&(*aHyperlinks)[index]);
+  }
+
+  // Fetch all attribute runs.
+  nsTArray<IA2TextSegment> attribRuns;
+  long end = 0;
+  long length = ::SysStringLen(*aText);
+  while (end < length) {
+    long offset = end;
+    long start;
+    BSTR attribs;
+    // The (exclusive) end of the last run is the start of the next run.
+    hr = ht->get_attributes(offset, &start, &end, &attribs);
+    // Bug 1421873: Gecko can return end <= offset in some rare cases, which
+    // isn't valid. This is perhaps because the text mutated during the loop
+    // for some reason, making this offset invalid.
+    if (FAILED(hr) || end <= offset) {
+      break;
+    }
+    attribRuns.AppendElement(IA2TextSegment({attribs, start, end}));
+  }
+
+  // Put the attribute runs in a COM array.
+  *aNAttribRuns = attribRuns.Length();
+  *aAttribRuns = static_cast<IA2TextSegment*>(
+      ::CoTaskMemAlloc(sizeof(IA2TextSegment) * *aNAttribRuns));
+  for (long index = 0; index < *aNAttribRuns; ++index) {
+    (*aAttribRuns)[index] = attribRuns[index];
+  }
+
+  *result = S_OK;
+}
+
+HRESULT
+HandlerProvider::get_AllTextInfo(BSTR* aText,
+                                 IAccessibleHyperlink*** aHyperlinks,
+                                 long* aNHyperlinks,
+                                 IA2TextSegment** aAttribRuns,
+                                 long* aNAttribRuns) {
+  MOZ_ASSERT(mscom::IsCurrentThreadMTA());
+
+  if (!mTargetUnk) {
+    return CO_E_OBJNOTCONNECTED;
+  }
+
+  HRESULT hr;
+  if (!mscom::InvokeOnMainThread(
+          "HandlerProvider::GetAllTextInfoMainThread", this,
+          &HandlerProvider::GetAllTextInfoMainThread,
+          std::forward<BSTR*>(aText),
+          std::forward<IAccessibleHyperlink***>(aHyperlinks),
+          std::forward<long*>(aNHyperlinks),
+          std::forward<IA2TextSegment**>(aAttribRuns),
+          std::forward<long*>(aNAttribRuns), std::forward<HRESULT*>(&hr))) {
+    return E_FAIL;
+  }
+
+  return hr;
+}
+
+void HandlerProvider::GetRelationsInfoMainThread(IARelationData** aRelations,
+                                                 long* aNRelations,
+                                                 HRESULT* hr) {
+  MOZ_ASSERT(aRelations);
+  MOZ_ASSERT(aNRelations);
+  MOZ_ASSERT(NS_IsMainThread());
+
+  if (!mTargetUnk) {
+    *hr = CO_E_OBJNOTCONNECTED;
+    return;
+  }
+
+  RefPtr<NEWEST_IA2_INTERFACE> acc;
+  *hr = mTargetUnk.get()->QueryInterface(NEWEST_IA2_IID, getter_AddRefs(acc));
+  if (FAILED(*hr)) {
+    return;
+  }
+
+  *hr = acc->get_nRelations(aNRelations);
+  if (FAILED(*hr)) {
+    return;
+  }
+
+  auto rawRels = MakeUnique<IAccessibleRelation*[]>(*aNRelations);
+  *hr = acc->get_relations(*aNRelations, rawRels.get(), aNRelations);
+  if (FAILED(*hr)) {
+    return;
+  }
+
+  *aRelations = static_cast<IARelationData*>(
+      ::CoTaskMemAlloc(sizeof(IARelationData) * *aNRelations));
+  for (long index = 0; index < *aNRelations; ++index) {
+    IAccessibleRelation* rawRel = rawRels[index];
+    IARelationData& relData = (*aRelations)[index];
+    *hr = rawRel->get_relationType(&relData.mType);
+    if (FAILED(*hr)) {
+      relData.mType = nullptr;
+    }
+    *hr = rawRel->get_nTargets(&relData.mNTargets);
+    if (FAILED(*hr)) {
+      relData.mNTargets = -1;
+    }
+    rawRel->Release();
+  }
+
+  *hr = S_OK;
+}
+
+HRESULT
+HandlerProvider::get_RelationsInfo(IARelationData** aRelations,
+                                   long* aNRelations) {
+  MOZ_ASSERT(mscom::IsCurrentThreadMTA());
+
+  if (!mTargetUnk) {
+    return CO_E_OBJNOTCONNECTED;
+  }
+
+  HRESULT hr;
+  if (!mscom::InvokeOnMainThread(
+          "HandlerProvider::GetRelationsInfoMainThread", this,
+          &HandlerProvider::GetRelationsInfoMainThread,
+          std::forward<IARelationData**>(aRelations),
+          std::forward<long*>(aNRelations), std::forward<HRESULT*>(&hr))) {
+    return E_FAIL;
+  }
+
+  return hr;
+}
+
+// Helper function for GetAllChildrenMainThread.
+static bool SetChildDataForTextLeaf(NEWEST_IA2_INTERFACE* acc,
+                                    AccChildData& data) {
+  const VARIANT kChildIdSelf = {VT_I4};
+  VARIANT varVal;
+
+  // 1. Check whether this is a text leaf.
+
+  // 1.1. A text leaf always has ROLE_SYSTEM_TEXT or ROLE_SYSTEM_WHITESPACE.
+  HRESULT hr = acc->get_accRole(kChildIdSelf, &varVal);
+  if (FAILED(hr)) {
+    return false;
+  }
+  if (varVal.vt != VT_I4) {
+    return false;
+  }
+  long role = varVal.lVal;
+  if (role != ROLE_SYSTEM_TEXT && role != ROLE_SYSTEM_WHITESPACE) {
+    return false;
+  }
+
+  // 1.2. A text leaf doesn't support IAccessibleText.
+  RefPtr<IAccessibleText> iaText;
+  hr = acc->QueryInterface(IID_IAccessibleText, getter_AddRefs(iaText));
+  if (SUCCEEDED(hr)) {
+    return false;
+  }
+
+  // 1.3. A text leaf doesn't have children.
+  long count;
+  hr = acc->get_accChildCount(&count);
+  if (FAILED(hr) || count != 0) {
+    return false;
+  }
+
+  // 2. Update |data| with the data for this text leaf.
+  // Because marshaling objects is more expensive than marshaling other data,
+  // we just marshal the data we need for text leaf children, rather than
+  // marshaling the full accessible object.
+
+  // |data| has already been zeroed, so we don't need to do anything if these
+  // calls fail.
+  acc->get_accName(kChildIdSelf, &data.mText);
+  data.mTextRole = role;
+  acc->get_uniqueID(&data.mTextId);
+  acc->get_accState(kChildIdSelf, &varVal);
+  data.mTextState = varVal.lVal;
+  acc->accLocation(&data.mTextLeft, &data.mTextTop, &data.mTextWidth,
+                   &data.mTextHeight, kChildIdSelf);
+
+  return true;
+}
+
+void HandlerProvider::GetAllChildrenMainThread(AccChildData** aChildren,
+                                               ULONG* aNChildren, HRESULT* hr) {
+  MOZ_ASSERT(aChildren);
+  MOZ_ASSERT(aNChildren);
+  MOZ_ASSERT(NS_IsMainThread());
+
+  if (!mTargetUnk) {
+    *hr = CO_E_OBJNOTCONNECTED;
+    return;
+  }
+
+  RefPtr<NEWEST_IA2_INTERFACE> acc;
+  *hr = mTargetUnk.get()->QueryInterface(NEWEST_IA2_IID, getter_AddRefs(acc));
+  if (FAILED(*hr)) {
+    return;
+  }
+
+  long count;
+  *hr = acc->get_accChildCount(&count);
+  if (FAILED(*hr)) {
+    return;
+  }
+  MOZ_ASSERT(count >= 0);
+
+  if (count == 0) {
+    *aChildren = nullptr;
+    *aNChildren = 0;
+    return;
+  }
+
+  RefPtr<IEnumVARIANT> enumVar;
+  *hr = mTargetUnk.get()->QueryInterface(IID_IEnumVARIANT,
+                                         getter_AddRefs(enumVar));
+  if (FAILED(*hr)) {
+    return;
+  }
+
+  auto rawChildren = MakeUnique<VARIANT[]>(count);
+  *hr = enumVar->Next((ULONG)count, rawChildren.get(), aNChildren);
+  if (FAILED(*hr)) {
+    *aChildren = nullptr;
+    *aNChildren = 0;
+    return;
+  }
+
+  *aChildren = static_cast<AccChildData*>(
+      ::CoTaskMemAlloc(sizeof(AccChildData) * *aNChildren));
+  for (ULONG index = 0; index < *aNChildren; ++index) {
+    (*aChildren)[index] = {};
+    AccChildData& child = (*aChildren)[index];
+
+    MOZ_ASSERT(rawChildren[index].vt == VT_DISPATCH);
+    MOZ_ASSERT(rawChildren[index].pdispVal);
+    RefPtr<NEWEST_IA2_INTERFACE> childAcc;
+    *hr = rawChildren[index].pdispVal->QueryInterface(NEWEST_IA2_IID,
+                                                      getter_AddRefs(childAcc));
+    rawChildren[index].pdispVal->Release();
+    MOZ_ASSERT(SUCCEEDED(*hr));
+    if (FAILED(*hr)) {
+      continue;
+    }
+
+    if (!SetChildDataForTextLeaf(childAcc, child)) {
+      // This isn't a text leaf. Marshal the accessible.
+      childAcc.forget(&child.mAccessible);
+      // We must wrap this accessible in an Interceptor.
+      ToWrappedObject(&child.mAccessible);
+    }
+  }
+
+  *hr = S_OK;
+}
+
+HRESULT
+HandlerProvider::get_AllChildren(AccChildData** aChildren, ULONG* aNChildren) {
+  MOZ_ASSERT(mscom::IsCurrentThreadMTA());
+
+  HRESULT hr;
+  if (!mscom::InvokeOnMainThread(
+          "HandlerProvider::GetAllChildrenMainThread", this,
+          &HandlerProvider::GetAllChildrenMainThread,
+          std::forward<AccChildData**>(aChildren),
+          std::forward<ULONG*>(aNChildren), std::forward<HRESULT*>(&hr))) {
+    return E_FAIL;
+  }
+
+  return hr;
+}
+
+}  // namespace a11y
+}  // namespace mozilla
diff --git a/accessible/ipc/win/HandlerProvider.h b/accessible/ipc/win/HandlerProvider.h
new file mode 100644
index 0000000000..bfaa58667d
--- /dev/null
+++ b/accessible/ipc/win/HandlerProvider.h
@@ -0,0 +1,145 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_a11y_HandlerProvider_h
+#define mozilla_a11y_HandlerProvider_h
+
+#include "mozilla/a11y/AccessibleHandler.h"
+#include "mozilla/a11y/HandlerDataCleanup.h"
+#include "mozilla/AlreadyAddRefed.h"
+#include "mozilla/Atomics.h"
+#include "mozilla/mscom/IHandlerProvider.h"
+#include "mozilla/mscom/Ptr.h"
+#include "mozilla/mscom/StructStream.h"
+#include "mozilla/Mutex.h"
+#include "mozilla/UniquePtr.h"
+#include "HandlerData.h"
+
+struct NEWEST_IA2_INTERFACE;
+
+namespace mozilla {
+
+namespace mscom {
+
+class StructToStream;
+
+}  // namespace mscom
+
+namespace a11y {
+
+class HandlerProvider final : public IGeckoBackChannel,
+                              public mscom::IHandlerProvider {
+ public:
+  HandlerProvider(REFIID aIid, mscom::InterceptorTargetPtr<IUnknown> aTarget);
+
+  // IUnknown
+  STDMETHODIMP QueryInterface(REFIID riid, void** ppv) override;
+  STDMETHODIMP_(ULONG) AddRef() override;
+  STDMETHODIMP_(ULONG) Release() override;
+
+  // IHandlerProvider
+  STDMETHODIMP GetHandler(NotNull<CLSID*> aHandlerClsid) override;
+  STDMETHODIMP GetHandlerPayloadSize(NotNull<mscom::IInterceptor*> aInterceptor,
+                                     NotNull<DWORD*> aOutPayloadSize) override;
+  STDMETHODIMP WriteHandlerPayload(NotNull<mscom::IInterceptor*> aInterceptor,
+                                   NotNull<IStream*> aStream) override;
+  STDMETHODIMP_(REFIID) MarshalAs(REFIID aIid) override;
+  STDMETHODIMP DisconnectHandlerRemotes() override;
+  STDMETHODIMP IsInterfaceMaybeSupported(REFIID aIid) override;
+  STDMETHODIMP_(REFIID)
+  GetEffectiveOutParamIid(REFIID aCallIid, ULONG aCallMethod) override;
+  STDMETHODIMP NewInstance(
+      REFIID aIid, mscom::InterceptorTargetPtr<IUnknown> aTarget,
+      NotNull<mscom::IHandlerProvider**> aOutNewPayload) override;
+
+  // IGeckoBackChannel
+  STDMETHODIMP put_HandlerControl(long aPid, IHandlerControl* aCtrl) override;
+  STDMETHODIMP Refresh(DynamicIA2Data* aOutData) override;
+  STDMETHODIMP get_AllTextInfo(BSTR* aText, IAccessibleHyperlink*** aHyperlinks,
+                               long* aNHyperlinks, IA2TextSegment** aAttribRuns,
+                               long* aNAttribRuns) override;
+  STDMETHODIMP get_RelationsInfo(IARelationData** aRelations,
+                                 long* aNRelations) override;
+  STDMETHODIMP get_AllChildren(AccChildData** aChildren,
+                               ULONG* aNChildren) override;
+
+ private:
+  ~HandlerProvider() = default;
+
+  void SetHandlerControlOnMainThread(
+      DWORD aPid, mscom::ProxyUniquePtr<IHandlerControl> aCtrl);
+  void GetAndSerializePayload(const MutexAutoLock&,
+                              NotNull<mscom::IInterceptor*> aInterceptor);
+  void BuildStaticIA2Data(NotNull<mscom::IInterceptor*> aInterceptor,
+                          StaticIA2Data* aOutData);
+  /**
+   * Pass true for aMarshaledByCom if this struct is being directly marshaled as
+   * an out parameter of a COM method, currently only
+   * IGeckoBackChannel::Refresh.
+   * When aMarshaledByCom is false, this means the struct is being marshaled
+   * by RPC encoding functions. This means we must allocate memory differently,
+   * even though we're using this as part of a COM handler payload.
+   */
+  void BuildDynamicIA2Data(DynamicIA2Data* aOutIA2Data,
+                           bool aMarshaledByCom = false);
+  void BuildInitialIA2Data(NotNull<mscom::IInterceptor*> aInterceptor,
+                           StaticIA2Data* aOutStaticData,
+                           DynamicIA2Data* aOutDynamicData);
+  bool IsTargetInterfaceCacheable();
+
+  /**
+   * Build the payload for later marshaling.
+   * This is intended to be used during a bulk fetch operation and must only be
+   * called from the main thread.
+   */
+  void PrebuildPayload(NotNull<mscom::IInterceptor*> aInterceptor);
+
+  // Replace a raw object from the main thread with a wrapped, intercepted
+  // object suitable for calling from the MTA.
+  // The reference to the original object is adopted; i.e. you should not
+  // separately release it.
+  // This is intended for objects returned from method calls on the main thread.
+  template <typename Interface>
+  HRESULT ToWrappedObject(Interface** aObj);
+  void GetAllTextInfoMainThread(BSTR* aText,
+                                IAccessibleHyperlink*** aHyperlinks,
+                                long* aNHyperlinks,
+                                IA2TextSegment** aAttribRuns,
+                                long* aNAttribRuns, HRESULT* result);
+  void GetRelationsInfoMainThread(IARelationData** aRelations,
+                                  long* aNRelations, HRESULT* result);
+  void GetAllChildrenMainThread(AccChildData** aChildren, ULONG* aNChildren,
+                                HRESULT* result);
+
+  Atomic<uint32_t> mRefCnt;
+  Mutex mMutex;  // Protects mSerializer
+  const IID mTargetUnkIid;
+  mscom::InterceptorTargetPtr<IUnknown>
+      mTargetUnk;  // Constant, main thread only
+  UniquePtr<mscom::StructToStream> mSerializer;
+  RefPtr<IUnknown> mFastMarshalUnk;
+
+  struct IA2PayloadDeleter {
+    void operator()(IA2Payload* aPayload) {
+      // When CoMarshalInterface writes interfaces out to a stream, it AddRefs.
+      // Therefore, we must release our references after this.
+      ReleaseStaticIA2DataInterfaces(aPayload->mStaticData);
+      CleanupDynamicIA2Data(aPayload->mDynamicData);
+      delete aPayload;
+    }
+  };
+  using IA2PayloadPtr = UniquePtr<IA2Payload, IA2PayloadDeleter>;
+
+  // Used when the payload is built prior to marshaling the object by a bulk
+  // fetch operation. See prebuildPayload().
+  IA2PayloadPtr mPayload;
+  Mutex mPayloadMutex;  // Protects mPayload
+};
+
+}  // namespace a11y
+}  // namespace mozilla
+
+#endif  // mozilla_a11y_HandlerProvider_h
diff --git a/accessible/ipc/win/IAccessible32.manifest b/accessible/ipc/win/IAccessible32.manifest
new file mode 100644
index 0000000000..e80ae3e9d4
--- /dev/null
+++ b/accessible/ipc/win/IAccessible32.manifest
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
+  <assemblyIdentity type="win32" name="Mozilla.Firefox.xul" version="1.0.0.0" />
+  <file name="xul.dll" />
+  <comInterfaceExternalProxyStub
+      iid="{618736E0-3C3D-11CF-810C-00AA00389B71}"
+      proxyStubClsid32="{00020424-0000-0000-C000-000000000046}"
+      name="IAccessible"
+      tlbid="{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}"
+  />
+</assembly>
diff --git a/accessible/ipc/win/IAccessible64.manifest b/accessible/ipc/win/IAccessible64.manifest
new file mode 100644
index 0000000000..f1672e4844
--- /dev/null
+++ b/accessible/ipc/win/IAccessible64.manifest
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
+  <assemblyIdentity type="win32" name="Mozilla.Firefox.xul" version="1.0.0.0" />
+  <file name="xul.dll" />
+  <comInterfaceExternalProxyStub
+      iid="{618736E0-3C3D-11CF-810C-00AA00389B71}"
+      proxyStubClsid32="{03022430-ABC4-11D0-BDE2-00AA001A1953}"
+      name="IAccessible"
+  />
+</assembly>
diff --git a/accessible/ipc/win/PDocAccessible.ipdl b/accessible/ipc/win/PDocAccessible.ipdl
new file mode 100644
index 0000000000..82fecdc54a
--- /dev/null
+++ b/accessible/ipc/win/PDocAccessible.ipdl
@@ -0,0 +1,112 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+include protocol PFileDescriptorSet;
+include protocol PBrowser;
+
+include "mozilla/GfxMessageUtils.h";
+
+using mozilla::a11y::role from "mozilla/a11y/IPCTypes.h";
+using mozilla::a11y::IAccessibleHolder from "mozilla/a11y/IPCTypes.h";
+using mozilla::a11y::IDispatchHolder from "mozilla/a11y/IPCTypes.h";
+using mozilla::WindowsHandle from "mozilla/ipc/IPCTypes.h";
+using mozilla::LayoutDeviceIntRect from "Units.h";
+
+namespace mozilla {
+namespace a11y {
+
+struct AccessibleData
+{
+  uint64_t ID;
+  int32_t MsaaID;
+  role Role;
+  uint32_t ChildrenCount;
+  uint32_t Interfaces;
+};
+
+struct ShowEventData
+{
+  uint64_t ID;
+  uint32_t Idx;
+  AccessibleData[] NewTree;
+  bool EventSuppressed;
+};
+
+struct Attribute
+{
+  nsCString Name;
+  nsString Value;
+};
+
+sync protocol PDocAccessible
+{
+  manager PBrowser;
+
+parent:
+  async Shutdown();
+
+  /*
+   * Notify the parent process the document in the child process is firing an
+   * event.
+   */
+  async Event(uint64_t aID, uint32_t type);
+  async ShowEvent(ShowEventData data, bool aFromUser);
+  async HideEvent(uint64_t aRootID, bool aFromUser);
+  async StateChangeEvent(uint64_t aID, uint64_t aState, bool aEnabled);
+  async CaretMoveEvent(uint64_t aID, LayoutDeviceIntRect aCaretRect,
+                       int32_t aOffset, bool aIsSelectionCollapsed);
+  async TextChangeEvent(uint64_t aID, nsString aStr, int32_t aStart, uint32_t aLen,
+                        bool aIsInsert, bool aFromUser);
+  sync SyncTextChangeEvent(uint64_t aID, nsString aStr, int32_t aStart,
+                           uint32_t aLen, bool aIsInsert, bool aFromUser);
+  async SelectionEvent(uint64_t aID, uint64_t aWidgetID, uint32_t aType);
+  async RoleChangedEvent(role aRole);
+  async FocusEvent(uint64_t aID, LayoutDeviceIntRect aCaretRect);
+  async VirtualCursorChangeEvent(uint64_t aID,
+                                 uint64_t aOldPosition,
+                                 int32_t aOldStartOffset, int32_t aOldEndOffset,
+                                 uint64_t aPosition,
+                                 int32_t aStartOffset, int32_t aEndOffset,
+                                 int16_t aReason, int16_t aBoundaryType,
+                                 bool aFromUservcEvent);
+  async ScrollingEvent(uint64_t aID, uint64_t aType,
+                       uint32_t aScrollX, uint32_t aScrollY,
+                       uint32_t aMaxScrollX, uint32_t aMaxScrollY);
+
+  /*
+   * Tell the parent document to bind the existing document as a new child
+   * document.
+   */
+  async BindChildDoc(PDocAccessible aChildDoc, uint64_t aID);
+
+  sync GetWindowedPluginIAccessible(WindowsHandle aHwnd)
+    returns (IAccessibleHolder aPluginCOMProxy);
+
+child:
+  /**
+   * We use IDispatchHolder instead of IAccessibleHolder for the following two
+   * methods because of sandboxing. IAccessible::get_accParent returns the parent
+   * as an IDispatch. COM is not smart enough to understand that IAccessible is
+   * derived from IDispatch, so during marshaling it attempts to QueryInterface
+   * on the parent's proxy for IDispatch. This will fail with E_ACCESSDENIED
+   * thanks to the sandbox. We can avoid this entirely by just giving content
+   * the correct interface to begin with: IDispatch.
+   */
+  async ParentCOMProxy(IDispatchHolder aParentCOMProxy);
+  async EmulatedWindow(WindowsHandle aEmulatedWindowHandle,
+                       IDispatchHolder aEmulatedWindowCOMProxy);
+  async TopLevelDocCOMProxy(IAccessibleHolder aCOMProxy);
+  /*
+   * Called as a result of focus shifting from chrome to content
+   * elements through keyboard navigation.
+   */
+  async RestoreFocus();
+
+  async __delete__();
+};
+
+}
+}
diff --git a/accessible/ipc/win/PlatformChild.cpp b/accessible/ipc/win/PlatformChild.cpp
new file mode 100644
index 0000000000..5c4c190e5a
--- /dev/null
+++ b/accessible/ipc/win/PlatformChild.cpp
@@ -0,0 +1,87 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/a11y/AccessibleHandler.h"
+#include "mozilla/a11y/Compatibility.h"
+#include "mozilla/a11y/PlatformChild.h"
+#include "mozilla/mscom/EnsureMTA.h"
+#include "mozilla/mscom/InterceptorLog.h"
+
+#include "Accessible2.h"
+#include "Accessible2_2.h"
+#include "AccessibleHypertext2.h"
+#include "AccessibleTable2.h"
+#include "AccessibleTableCell.h"
+
+#include "AccessibleDocument_i.c"
+#include "AccessibleHypertext2_i.c"
+
+namespace mozilla {
+namespace a11y {
+
+/**
+ * Unfortunately the COM interceptor does not intrinsically handle array
+ * outparams. Instead we manually define the relevant metadata here, and
+ * register it in a call to mozilla::mscom::RegisterArrayData.
+ * @see mozilla::mscom::ArrayData
+ */
+static const mozilla::mscom::ArrayData sPlatformChildArrayData[] = {
+    {IID_IEnumVARIANT, 3, 1, VT_DISPATCH, IID_IDispatch, 2},
+    {IID_IAccessible2, 30, 1, VT_UNKNOWN | VT_BYREF, IID_IAccessibleRelation,
+     2},
+    {IID_IAccessibleRelation, 7, 1, VT_UNKNOWN | VT_BYREF, NEWEST_IA2_IID, 2},
+    {IID_IAccessible2_2, 48, 2, VT_UNKNOWN | VT_BYREF, NEWEST_IA2_IID, 3,
+     mozilla::mscom::ArrayData::Flag::eAllocatedByServer},
+    {IID_IAccessibleTableCell, 4, 0, VT_UNKNOWN | VT_BYREF, NEWEST_IA2_IID, 1,
+     mozilla::mscom::ArrayData::Flag::eAllocatedByServer},
+    {IID_IAccessibleTableCell, 7, 0, VT_UNKNOWN | VT_BYREF, NEWEST_IA2_IID, 1,
+     mozilla::mscom::ArrayData::Flag::eAllocatedByServer},
+    {IID_IAccessibleHypertext2, 25, 0, VT_UNKNOWN | VT_BYREF,
+     IID_IAccessibleHyperlink, 1,
+     mozilla::mscom::ArrayData::Flag::eAllocatedByServer},
+    {IID_IAccessibleTable2, 12, 0, VT_UNKNOWN | VT_BYREF, NEWEST_IA2_IID, 1,
+     mozilla::mscom::ArrayData::Flag::eAllocatedByServer}};
+
+// Type libraries are thread-neutral, so we can register those from any
+// apartment. OTOH, proxies must be registered from within the apartment where
+// we intend to instantiate them. Therefore RegisterProxy() must be called
+// via EnsureMTA.
+PlatformChild::PlatformChild()
+    : mIA2Proxy(mozilla::mscom::RegisterProxy(L"ia2marshal.dll")),
+      mAccTypelib(mozilla::mscom::RegisterTypelib(
+          L"oleacc.dll",
+          mozilla::mscom::RegistrationFlags::eUseSystemDirectory)),
+      mMiscTypelib(mozilla::mscom::RegisterTypelib(L"Accessible.tlb")),
+      mSdnTypelib(mozilla::mscom::RegisterTypelib(L"AccessibleMarshal.dll")) {
+  WORD actCtxResourceId = Compatibility::GetActCtxResourceId();
+
+  mozilla::mscom::MTADeletePtr<mozilla::mscom::ActivationContextRegion>
+      tmpActCtxMTA;
+  mozilla::mscom::EnsureMTA([actCtxResourceId, &tmpActCtxMTA]() -> void {
+    tmpActCtxMTA.reset(
+        new mozilla::mscom::ActivationContextRegion(actCtxResourceId));
+  });
+  mActCtxMTA = std::move(tmpActCtxMTA);
+
+  mozilla::mscom::InterceptorLog::Init();
+  mozilla::mscom::RegisterArrayData(sPlatformChildArrayData);
+
+  UniquePtr<mozilla::mscom::RegisteredProxy> customProxy;
+  mozilla::mscom::EnsureMTA([&customProxy]() -> void {
+    customProxy = mozilla::mscom::RegisterProxy();
+  });
+  mCustomProxy = std::move(customProxy);
+
+  // IA2 needs to be registered in both the main thread's STA as well as the MTA
+  UniquePtr<mozilla::mscom::RegisteredProxy> ia2ProxyMTA;
+  mozilla::mscom::EnsureMTA([&ia2ProxyMTA]() -> void {
+    ia2ProxyMTA = mozilla::mscom::RegisterProxy(L"ia2marshal.dll");
+  });
+  mIA2ProxyMTA = std::move(ia2ProxyMTA);
+}
+
+}  // namespace a11y
+}  // namespace mozilla
diff --git a/accessible/ipc/win/PlatformChild.h b/accessible/ipc/win/PlatformChild.h
new file mode 100644
index 0000000000..a175d6f453
--- /dev/null
+++ b/accessible/ipc/win/PlatformChild.h
@@ -0,0 +1,39 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_a11y_PlatformChild_h
+#define mozilla_a11y_PlatformChild_h
+
+#include "mozilla/mscom/ActivationContext.h"
+#include "mozilla/mscom/Ptr.h"
+#include "mozilla/mscom/Registration.h"
+
+namespace mozilla {
+namespace a11y {
+
+class PlatformChild {
+ public:
+  PlatformChild();
+
+  PlatformChild(PlatformChild&) = delete;
+  PlatformChild(PlatformChild&&) = delete;
+  PlatformChild& operator=(PlatformChild&) = delete;
+  PlatformChild& operator=(PlatformChild&&) = delete;
+
+ private:
+  mscom::MTADeletePtr<mozilla::mscom::ActivationContextRegion> mActCtxMTA;
+  UniquePtr<mozilla::mscom::RegisteredProxy> mCustomProxy;
+  UniquePtr<mozilla::mscom::RegisteredProxy> mIA2Proxy;
+  UniquePtr<mozilla::mscom::RegisteredProxy> mIA2ProxyMTA;
+  UniquePtr<mozilla::mscom::RegisteredProxy> mAccTypelib;
+  UniquePtr<mozilla::mscom::RegisteredProxy> mMiscTypelib;
+  UniquePtr<mozilla::mscom::RegisteredProxy> mSdnTypelib;
+};
+
+}  // namespace a11y
+}  // namespace mozilla
+
+#endif  // mozilla_a11y_PlatformChild_h
diff --git a/accessible/ipc/win/ProxyAccessible.cpp b/accessible/ipc/win/ProxyAccessible.cpp
new file mode 100644
index 0000000000..bcf388e603
--- /dev/null
+++ b/accessible/ipc/win/ProxyAccessible.cpp
@@ -0,0 +1,816 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "Accessible2.h"
+#include "ProxyAccessible.h"
+#include "ia2AccessibleRelation.h"
+#include "ia2AccessibleValue.h"
+#include "IGeckoCustom.h"
+#include "mozilla/a11y/DocAccessibleParent.h"
+#include "DocAccessible.h"
+#include "mozilla/a11y/DocManager.h"
+#include "mozilla/dom/Element.h"
+#include "mozilla/dom/BrowserParent.h"
+#include "mozilla/Unused.h"
+#include "mozilla/a11y/Platform.h"
+#include "RelationType.h"
+#include "mozilla/a11y/Role.h"
+
+#include <comutil.h>
+
+static const VARIANT kChildIdSelf = {{{VT_I4}}};
+
+namespace mozilla {
+namespace a11y {
+
+bool ProxyAccessible::GetCOMInterface(void** aOutAccessible) const {
+  if (!aOutAccessible) {
+    return false;
+  }
+
+  if (!mCOMProxy && mSafeToRecurse) {
+    // See if we can lazily obtain a COM proxy
+    AccessibleWrap* wrap = WrapperFor(this);
+    bool isDefunct = false;
+    ProxyAccessible* thisPtr = const_cast<ProxyAccessible*>(this);
+    // NB: Don't pass CHILDID_SELF here, use the absolute MSAA ID. Otherwise
+    // GetIAccessibleFor will recurse into this function and we will just
+    // overflow the stack.
+    VARIANT realId = {{{VT_I4}}};
+    realId.ulVal = wrap->GetExistingID();
+    MOZ_DIAGNOSTIC_ASSERT(realId.ulVal != CHILDID_SELF);
+    thisPtr->mCOMProxy = wrap->GetIAccessibleFor(realId, &isDefunct);
+  }
+
+  RefPtr<IAccessible> addRefed = mCOMProxy;
+  addRefed.forget(aOutAccessible);
+  return !!mCOMProxy;
+}
+
+/**
+ * Specializations of this template map an IAccessible type to its IID
+ */
+template <typename Interface>
+struct InterfaceIID {};
+
+template <>
+struct InterfaceIID<IAccessibleValue> {
+  static REFIID Value() { return IID_IAccessibleValue; }
+};
+
+template <>
+struct InterfaceIID<IAccessibleText> {
+  static REFIID Value() { return IID_IAccessibleText; }
+};
+
+template <>
+struct InterfaceIID<IAccessibleHyperlink> {
+  static REFIID Value() { return IID_IAccessibleHyperlink; }
+};
+
+template <>
+struct InterfaceIID<IGeckoCustom> {
+  static REFIID Value() { return IID_IGeckoCustom; }
+};
+
+template <>
+struct InterfaceIID<IAccessible2_2> {
+  static REFIID Value() { return IID_IAccessible2_2; }
+};
+
+/**
+ * Get the COM proxy for this proxy accessible and QueryInterface it with the
+ * correct IID
+ */
+template <typename Interface>
+static already_AddRefed<Interface> QueryInterface(
+    const ProxyAccessible* aProxy) {
+  RefPtr<IAccessible> acc;
+  if (!aProxy->GetCOMInterface((void**)getter_AddRefs(acc))) {
+    return nullptr;
+  }
+
+  RefPtr<Interface> acc2;
+  if (FAILED(acc->QueryInterface(InterfaceIID<Interface>::Value(),
+                                 (void**)getter_AddRefs(acc2)))) {
+    return nullptr;
+  }
+
+  return acc2.forget();
+}
+
+static ProxyAccessible* GetProxyFor(DocAccessibleParent* aDoc,
+                                    IUnknown* aCOMProxy) {
+  RefPtr<IGeckoCustom> custom;
+  if (FAILED(aCOMProxy->QueryInterface(IID_IGeckoCustom,
+                                       (void**)getter_AddRefs(custom)))) {
+    return nullptr;
+  }
+
+  uint64_t id;
+  if (FAILED(custom->get_ID(&id))) {
+    return nullptr;
+  }
+
+  return aDoc->GetAccessible(id);
+}
+
+uint32_t ProxyAccessible::Name(nsString& aName) const {
+  /* The return values here exist only to match behvaiour required
+   * by the header declaration of this function. On Mac, we'd like
+   * to return the associated ENameValueFlag, but we don't have
+   * access to that here, so we return a dummy eNameOK value instead.
+   */
+  aName.Truncate();
+  RefPtr<IAccessible> acc;
+  if (!GetCOMInterface((void**)getter_AddRefs(acc))) {
+    return eNameOK;
+  }
+
+  BSTR result;
+  HRESULT hr = acc->get_accName(kChildIdSelf, &result);
+  _bstr_t resultWrap(result, false);
+  if (FAILED(hr)) {
+    return eNameOK;
+  }
+  aName = (wchar_t*)resultWrap;
+  return eNameOK;
+}
+
+void ProxyAccessible::Value(nsString& aValue) const {
+  aValue.Truncate();
+  RefPtr<IAccessible> acc;
+  if (!GetCOMInterface((void**)getter_AddRefs(acc))) {
+    return;
+  }
+
+  BSTR result;
+  HRESULT hr = acc->get_accValue(kChildIdSelf, &result);
+  _bstr_t resultWrap(result, false);
+  if (FAILED(hr)) {
+    return;
+  }
+  aValue = (wchar_t*)resultWrap;
+}
+
+double ProxyAccessible::Step() {
+  RefPtr<IGeckoCustom> custom = QueryInterface<IGeckoCustom>(this);
+  if (!custom) {
+    return 0;
+  }
+
+  double increment;
+  HRESULT hr = custom->get_minimumIncrement(&increment);
+  if (FAILED(hr)) {
+    return 0;
+  }
+
+  return increment;
+}
+
+void ProxyAccessible::Description(nsString& aDesc) const {
+  aDesc.Truncate();
+  RefPtr<IAccessible> acc;
+  if (!GetCOMInterface((void**)getter_AddRefs(acc))) {
+    return;
+  }
+
+  BSTR result;
+  HRESULT hr = acc->get_accDescription(kChildIdSelf, &result);
+  _bstr_t resultWrap(result, false);
+  if (FAILED(hr)) {
+    return;
+  }
+  aDesc = (wchar_t*)resultWrap;
+}
+
+uint64_t ProxyAccessible::State() const {
+  RefPtr<IGeckoCustom> custom = QueryInterface<IGeckoCustom>(this);
+  if (!custom) {
+    return 0;
+  }
+
+  uint64_t state;
+  HRESULT hr = custom->get_mozState(&state);
+  if (FAILED(hr)) {
+    return 0;
+  }
+  return state;
+}
+
+nsIntRect ProxyAccessible::Bounds() {
+  nsIntRect rect;
+
+  RefPtr<IAccessible> acc;
+  if (!GetCOMInterface((void**)getter_AddRefs(acc))) {
+    return rect;
+  }
+
+  long left;
+  long top;
+  long width;
+  long height;
+  HRESULT hr = acc->accLocation(&left, &top, &width, &height, kChildIdSelf);
+  if (FAILED(hr)) {
+    return rect;
+  }
+  rect.SetRect(left, top, width, height);
+  return rect;
+}
+
+nsIntRect ProxyAccessible::BoundsInCSSPixels() {
+  RefPtr<IGeckoCustom> custom = QueryInterface<IGeckoCustom>(this);
+  if (!custom) {
+    return nsIntRect();
+  }
+
+  nsIntRect rect;
+  Unused << custom->get_boundsInCSSPixels(&rect.x, &rect.y, &rect.width,
+                                          &rect.height);
+  return rect;
+}
+
+void ProxyAccessible::Language(nsString& aLocale) {
+  aLocale.Truncate();
+
+  RefPtr<IAccessible> acc;
+  if (!GetCOMInterface((void**)getter_AddRefs(acc))) {
+    return;
+  }
+
+  RefPtr<IAccessible2> acc2;
+  if (FAILED(acc->QueryInterface(IID_IAccessible2,
+                                 (void**)getter_AddRefs(acc2)))) {
+    return;
+  }
+
+  IA2Locale locale;
+  HRESULT hr = acc2->get_locale(&locale);
+
+  _bstr_t langWrap(locale.language, false);
+  _bstr_t countryWrap(locale.country, false);
+  _bstr_t variantWrap(locale.variant, false);
+
+  if (FAILED(hr)) {
+    return;
+  }
+
+  // The remaining code should essentially be the inverse of the
+  // ia2Accessible::get_locale conversion to IA2Locale.
+
+  if (!!variantWrap) {
+    aLocale = (wchar_t*)variantWrap;
+    return;
+  }
+
+  if (!!langWrap) {
+    aLocale = (wchar_t*)langWrap;
+    if (!!countryWrap) {
+      aLocale += L"-";
+      aLocale += (wchar_t*)countryWrap;
+    }
+  }
+}
+
+static bool IsEscapedChar(const wchar_t c) {
+  return c == L'\\' || c == L':' || c == ',' || c == '=' || c == ';';
+}
+
+static bool ConvertBSTRAttributesToArray(const nsAString& aStr,
+                                         nsTArray<Attribute>* aAttrs) {
+  if (!aAttrs) {
+    return false;
+  }
+
+  enum { eName = 0, eValue = 1, eNumStates } state;
+  nsAutoString tokens[eNumStates];
+  auto itr = aStr.BeginReading(), end = aStr.EndReading();
+
+  state = eName;
+  while (itr != end) {
+    switch (*itr) {
+      case L'\\':
+        // Skip the backslash so that we're looking at the escaped char
+        ++itr;
+        if (itr == end || !IsEscapedChar(*itr)) {
+          // Invalid state
+          return false;
+        }
+        break;
+      case L':':
+        if (state != eName) {
+          // Bad, should be looking at name
+          return false;
+        }
+        state = eValue;
+        ++itr;
+        continue;
+      case L';':
+        if (state != eValue) {
+          // Bad, should be looking at value
+          return false;
+        }
+        state = eName;
+        aAttrs->AppendElement(
+            Attribute(NS_ConvertUTF16toUTF8(tokens[eName]), tokens[eValue]));
+        tokens[eName].Truncate();
+        tokens[eValue].Truncate();
+        ++itr;
+        continue;
+      default:
+        break;
+    }
+    tokens[state] += *itr;
+    ++itr;
+  }
+  return true;
+}
+
+void ProxyAccessible::Attributes(nsTArray<Attribute>* aAttrs) const {
+  aAttrs->Clear();
+
+  RefPtr<IAccessible> acc;
+  if (!GetCOMInterface((void**)getter_AddRefs(acc))) {
+    return;
+  }
+
+  RefPtr<IAccessible2> acc2;
+  if (FAILED(acc->QueryInterface(IID_IAccessible2,
+                                 (void**)getter_AddRefs(acc2)))) {
+    return;
+  }
+
+  BSTR attrs;
+  HRESULT hr = acc2->get_attributes(&attrs);
+  _bstr_t attrsWrap(attrs, false);
+  if (FAILED(hr)) {
+    return;
+  }
+
+  ConvertBSTRAttributesToArray(
+      nsDependentString((wchar_t*)attrs, attrsWrap.length()), aAttrs);
+}
+
+nsTArray<ProxyAccessible*> ProxyAccessible::RelationByType(
+    RelationType aType) const {
+  RefPtr<IAccessible2_2> acc = QueryInterface<IAccessible2_2>(this);
+  if (!acc) {
+    return nsTArray<ProxyAccessible*>();
+  }
+
+  _bstr_t relationType;
+  for (uint32_t idx = 0; idx < ArrayLength(sRelationTypePairs); idx++) {
+    if (aType == sRelationTypePairs[idx].first) {
+      relationType = sRelationTypePairs[idx].second;
+      break;
+    }
+  }
+
+  if (!relationType) {
+    return nsTArray<ProxyAccessible*>();
+  }
+
+  IUnknown** targets;
+  long nTargets = 0;
+  HRESULT hr =
+      acc->get_relationTargetsOfType(relationType, 0, &targets, &nTargets);
+  if (FAILED(hr)) {
+    return nsTArray<ProxyAccessible*>();
+  }
+
+  nsTArray<ProxyAccessible*> proxies;
+  for (long idx = 0; idx < nTargets; idx++) {
+    IUnknown* target = targets[idx];
+    proxies.AppendElement(GetProxyFor(Document(), target));
+    target->Release();
+  }
+  CoTaskMemFree(targets);
+
+  return proxies;
+}
+
+double ProxyAccessible::CurValue() {
+  RefPtr<IAccessibleValue> acc = QueryInterface<IAccessibleValue>(this);
+  if (!acc) {
+    return UnspecifiedNaN<double>();
+  }
+
+  VARIANT currentValue;
+  HRESULT hr = acc->get_currentValue(&currentValue);
+  if (FAILED(hr) || currentValue.vt != VT_R8) {
+    return UnspecifiedNaN<double>();
+  }
+
+  return currentValue.dblVal;
+}
+
+bool ProxyAccessible::SetCurValue(double aValue) {
+  RefPtr<IAccessibleValue> acc = QueryInterface<IAccessibleValue>(this);
+  if (!acc) {
+    return false;
+  }
+
+  VARIANT currentValue;
+  VariantInit(&currentValue);
+  currentValue.vt = VT_R8;
+  currentValue.dblVal = aValue;
+  HRESULT hr = acc->setCurrentValue(currentValue);
+  return SUCCEEDED(hr);
+}
+
+double ProxyAccessible::MinValue() {
+  RefPtr<IAccessibleValue> acc = QueryInterface<IAccessibleValue>(this);
+  if (!acc) {
+    return UnspecifiedNaN<double>();
+  }
+
+  VARIANT minimumValue;
+  HRESULT hr = acc->get_minimumValue(&minimumValue);
+  if (FAILED(hr) || minimumValue.vt != VT_R8) {
+    return UnspecifiedNaN<double>();
+  }
+
+  return minimumValue.dblVal;
+}
+
+double ProxyAccessible::MaxValue() {
+  RefPtr<IAccessibleValue> acc = QueryInterface<IAccessibleValue>(this);
+  if (!acc) {
+    return UnspecifiedNaN<double>();
+  }
+
+  VARIANT maximumValue;
+  HRESULT hr = acc->get_maximumValue(&maximumValue);
+  if (FAILED(hr) || maximumValue.vt != VT_R8) {
+    return UnspecifiedNaN<double>();
+  }
+
+  return maximumValue.dblVal;
+}
+
+static IA2TextBoundaryType GetIA2TextBoundary(
+    AccessibleTextBoundary aGeckoBoundaryType) {
+  switch (aGeckoBoundaryType) {
+    case nsIAccessibleText::BOUNDARY_CHAR:
+      return IA2_TEXT_BOUNDARY_CHAR;
+    case nsIAccessibleText::BOUNDARY_WORD_START:
+      return IA2_TEXT_BOUNDARY_WORD;
+    case nsIAccessibleText::BOUNDARY_LINE_START:
+      return IA2_TEXT_BOUNDARY_LINE;
+    case nsIAccessibleText::BOUNDARY_PARAGRAPH:
+      return IA2_TEXT_BOUNDARY_PARAGRAPH;
+    default:
+      MOZ_CRASH();
+  }
+}
+
+int32_t ProxyAccessible::OffsetAtPoint(int32_t aX, int32_t aY,
+                                       uint32_t aCoordinateType) {
+  RefPtr<IAccessibleText> acc = QueryInterface<IAccessibleText>(this);
+  if (!acc) {
+    return -1;
+  }
+
+  IA2CoordinateType coordType;
+  if (aCoordinateType ==
+      nsIAccessibleCoordinateType::COORDTYPE_SCREEN_RELATIVE) {
+    coordType = IA2_COORDTYPE_SCREEN_RELATIVE;
+  } else if (aCoordinateType ==
+             nsIAccessibleCoordinateType::COORDTYPE_PARENT_RELATIVE) {
+    coordType = IA2_COORDTYPE_PARENT_RELATIVE;
+  } else {
+    MOZ_CRASH("unsupported coord type");
+  }
+
+  long offset;
+  HRESULT hr = acc->get_offsetAtPoint(
+      static_cast<long>(aX), static_cast<long>(aY), coordType, &offset);
+  if (FAILED(hr)) {
+    return -1;
+  }
+
+  return static_cast<int32_t>(offset);
+}
+
+bool ProxyAccessible::TextSubstring(int32_t aStartOffset, int32_t aEndOffset,
+                                    nsString& aText) const {
+  RefPtr<IAccessibleText> acc = QueryInterface<IAccessibleText>(this);
+  if (!acc) {
+    return false;
+  }
+
+  BSTR result;
+  HRESULT hr = acc->get_text(static_cast<long>(aStartOffset),
+                             static_cast<long>(aEndOffset), &result);
+  if (FAILED(hr)) {
+    return false;
+  }
+
+  _bstr_t resultWrap(result, false);
+  aText = (wchar_t*)result;
+
+  return true;
+}
+
+void ProxyAccessible::GetTextBeforeOffset(int32_t aOffset,
+                                          AccessibleTextBoundary aBoundaryType,
+                                          nsString& aText,
+                                          int32_t* aStartOffset,
+                                          int32_t* aEndOffset) {
+  RefPtr<IAccessibleText> acc = QueryInterface<IAccessibleText>(this);
+  if (!acc) {
+    return;
+  }
+
+  BSTR result;
+  long start, end;
+  HRESULT hr = acc->get_textBeforeOffset(
+      aOffset, GetIA2TextBoundary(aBoundaryType), &start, &end, &result);
+  if (FAILED(hr)) {
+    return;
+  }
+
+  _bstr_t resultWrap(result, false);
+  *aStartOffset = start;
+  *aEndOffset = end;
+  aText = (wchar_t*)result;
+}
+
+void ProxyAccessible::GetTextAfterOffset(int32_t aOffset,
+                                         AccessibleTextBoundary aBoundaryType,
+                                         nsString& aText, int32_t* aStartOffset,
+                                         int32_t* aEndOffset) {
+  RefPtr<IAccessibleText> acc = QueryInterface<IAccessibleText>(this);
+  if (!acc) {
+    return;
+  }
+
+  BSTR result;
+  long start, end;
+  HRESULT hr = acc->get_textAfterOffset(
+      aOffset, GetIA2TextBoundary(aBoundaryType), &start, &end, &result);
+  if (FAILED(hr)) {
+    return;
+  }
+
+  _bstr_t resultWrap(result, false);
+  aText = (wchar_t*)result;
+  *aStartOffset = start;
+  *aEndOffset = end;
+}
+
+void ProxyAccessible::GetTextAtOffset(int32_t aOffset,
+                                      AccessibleTextBoundary aBoundaryType,
+                                      nsString& aText, int32_t* aStartOffset,
+                                      int32_t* aEndOffset) {
+  RefPtr<IAccessibleText> acc = QueryInterface<IAccessibleText>(this);
+  if (!acc) {
+    return;
+  }
+
+  BSTR result;
+  long start, end;
+  HRESULT hr = acc->get_textAtOffset(aOffset, GetIA2TextBoundary(aBoundaryType),
+                                     &start, &end, &result);
+  if (FAILED(hr)) {
+    return;
+  }
+
+  _bstr_t resultWrap(result, false);
+  aText = (wchar_t*)result;
+  *aStartOffset = start;
+  *aEndOffset = end;
+}
+
+bool ProxyAccessible::AddToSelection(int32_t aStartOffset, int32_t aEndOffset) {
+  RefPtr<IAccessibleText> acc = QueryInterface<IAccessibleText>(this);
+  if (!acc) {
+    return false;
+  }
+
+  return SUCCEEDED(acc->addSelection(static_cast<long>(aStartOffset),
+                                     static_cast<long>(aEndOffset)));
+}
+
+bool ProxyAccessible::RemoveFromSelection(int32_t aSelectionNum) {
+  RefPtr<IAccessibleText> acc = QueryInterface<IAccessibleText>(this);
+  if (!acc) {
+    return false;
+  }
+
+  return SUCCEEDED(acc->removeSelection(static_cast<long>(aSelectionNum)));
+}
+
+int32_t ProxyAccessible::CaretOffset() {
+  RefPtr<IAccessibleText> acc = QueryInterface<IAccessibleText>(this);
+  if (!acc) {
+    return -1;
+  }
+
+  long offset;
+  HRESULT hr = acc->get_caretOffset(&offset);
+  if (FAILED(hr)) {
+    return -1;
+  }
+
+  return static_cast<int32_t>(offset);
+}
+
+void ProxyAccessible::SetCaretOffset(int32_t aOffset) {
+  RefPtr<IAccessibleText> acc = QueryInterface<IAccessibleText>(this);
+  if (!acc) {
+    return;
+  }
+
+  acc->setCaretOffset(static_cast<long>(aOffset));
+}
+
+/**
+ * aScrollType should be one of the nsIAccessiblescrollType constants.
+ */
+void ProxyAccessible::ScrollSubstringTo(int32_t aStartOffset,
+                                        int32_t aEndOffset,
+                                        uint32_t aScrollType) {
+  RefPtr<IAccessibleText> acc = QueryInterface<IAccessibleText>(this);
+  if (!acc) {
+    return;
+  }
+
+  acc->scrollSubstringTo(static_cast<long>(aStartOffset),
+                         static_cast<long>(aEndOffset),
+                         static_cast<IA2ScrollType>(aScrollType));
+}
+
+/**
+ * aCoordinateType is one of the nsIAccessibleCoordinateType constants.
+ */
+void ProxyAccessible::ScrollSubstringToPoint(int32_t aStartOffset,
+                                             int32_t aEndOffset,
+                                             uint32_t aCoordinateType,
+                                             int32_t aX, int32_t aY) {
+  RefPtr<IAccessibleText> acc = QueryInterface<IAccessibleText>(this);
+  if (!acc) {
+    return;
+  }
+
+  IA2CoordinateType coordType;
+  if (aCoordinateType ==
+      nsIAccessibleCoordinateType::COORDTYPE_SCREEN_RELATIVE) {
+    coordType = IA2_COORDTYPE_SCREEN_RELATIVE;
+  } else if (aCoordinateType ==
+             nsIAccessibleCoordinateType::COORDTYPE_PARENT_RELATIVE) {
+    coordType = IA2_COORDTYPE_PARENT_RELATIVE;
+  } else {
+    MOZ_CRASH("unsupported coord type");
+  }
+
+  acc->scrollSubstringToPoint(static_cast<long>(aStartOffset),
+                              static_cast<long>(aEndOffset), coordType,
+                              static_cast<long>(aX), static_cast<long>(aY));
+}
+
+uint32_t ProxyAccessible::StartOffset(bool* aOk) {
+  RefPtr<IAccessibleHyperlink> acc = QueryInterface<IAccessibleHyperlink>(this);
+  if (!acc) {
+    *aOk = false;
+    return 0;
+  }
+
+  long startOffset;
+  *aOk = SUCCEEDED(acc->get_startIndex(&startOffset));
+  return static_cast<uint32_t>(startOffset);
+}
+
+uint32_t ProxyAccessible::EndOffset(bool* aOk) {
+  RefPtr<IAccessibleHyperlink> acc = QueryInterface<IAccessibleHyperlink>(this);
+  if (!acc) {
+    *aOk = false;
+    return 0;
+  }
+
+  long endOffset;
+  *aOk = SUCCEEDED(acc->get_endIndex(&endOffset));
+  return static_cast<uint32_t>(endOffset);
+}
+
+bool ProxyAccessible::IsLinkValid() {
+  RefPtr<IAccessibleHyperlink> acc = QueryInterface<IAccessibleHyperlink>(this);
+  if (!acc) {
+    return false;
+  }
+
+  boolean valid;
+  if (FAILED(acc->get_valid(&valid))) {
+    return false;
+  }
+
+  return valid;
+}
+
+uint32_t ProxyAccessible::AnchorCount(bool* aOk) {
+  *aOk = false;
+  RefPtr<IGeckoCustom> custom = QueryInterface<IGeckoCustom>(this);
+  if (!custom) {
+    return 0;
+  }
+
+  long count;
+  if (FAILED(custom->get_anchorCount(&count))) {
+    return 0;
+  }
+
+  *aOk = true;
+  return count;
+}
+
+ProxyAccessible* ProxyAccessible::AnchorAt(uint32_t aIdx) {
+  RefPtr<IAccessibleHyperlink> link =
+      QueryInterface<IAccessibleHyperlink>(this);
+  if (!link) {
+    return nullptr;
+  }
+
+  VARIANT anchor;
+  if (FAILED(link->get_anchor(aIdx, &anchor))) {
+    return nullptr;
+  }
+
+  MOZ_ASSERT(anchor.vt == VT_UNKNOWN);
+  ProxyAccessible* proxyAnchor = GetProxyFor(Document(), anchor.punkVal);
+  anchor.punkVal->Release();
+  return proxyAnchor;
+}
+
+void ProxyAccessible::DOMNodeID(nsString& aID) {
+  aID.Truncate();
+  RefPtr<IGeckoCustom> custom = QueryInterface<IGeckoCustom>(this);
+  if (!custom) {
+    return;
+  }
+
+  BSTR result;
+  HRESULT hr = custom->get_DOMNodeID(&result);
+  _bstr_t resultWrap(result, false);
+  if (FAILED(hr)) {
+    return;
+  }
+  aID = (wchar_t*)resultWrap;
+}
+
+void ProxyAccessible::TakeFocus() {
+  RefPtr<IAccessible> acc;
+  if (!GetCOMInterface((void**)getter_AddRefs(acc))) {
+    return;
+  }
+  acc->accSelect(SELFLAG_TAKEFOCUS, kChildIdSelf);
+}
+
+ProxyAccessible* ProxyAccessible::ChildAtPoint(
+    int32_t aX, int32_t aY, Accessible::EWhichChildAtPoint aWhichChild) {
+  RefPtr<IAccessible2_2> target = QueryInterface<IAccessible2_2>(this);
+  if (!target) {
+    return nullptr;
+  }
+  DocAccessibleParent* doc = Document();
+  ProxyAccessible* proxy = this;
+  // accHitTest only does direct children, but we might want the deepest child.
+  for (;;) {
+    VARIANT childVar;
+    if (FAILED(target->accHitTest(aX, aY, &childVar)) ||
+        childVar.vt == VT_EMPTY) {
+      return nullptr;
+    }
+    if (childVar.vt == VT_I4 && childVar.lVal == CHILDID_SELF) {
+      break;
+    }
+    MOZ_ASSERT(childVar.vt == VT_DISPATCH && childVar.pdispVal);
+    target = nullptr;
+    childVar.pdispVal->QueryInterface(IID_IAccessible2_2,
+                                      getter_AddRefs(target));
+    childVar.pdispVal->Release();
+    if (!target) {
+      return nullptr;
+    }
+    // We can't always use GetProxyFor because it can't cross document
+    // boundaries.
+    if (proxy->ChildrenCount() == 1) {
+      proxy = proxy->ChildAt(0);
+      if (proxy->IsDoc()) {
+        // We're crossing into a child document.
+        doc = proxy->AsDoc();
+      }
+    } else {
+      proxy = GetProxyFor(doc, target);
+    }
+    if (aWhichChild == Accessible::eDirectChild) {
+      break;
+    }
+  }
+  return proxy;
+}
+
+}  // namespace a11y
+}  // namespace mozilla
diff --git a/accessible/ipc/win/ProxyAccessible.h b/accessible/ipc/win/ProxyAccessible.h
new file mode 100644
index 0000000000..cadd248579
--- /dev/null
+++ b/accessible/ipc/win/ProxyAccessible.h
@@ -0,0 +1,61 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_a11y_ProxyAccessible_h
+#define mozilla_a11y_ProxyAccessible_h
+
+#include "Accessible.h"
+#include "mozilla/a11y/ProxyAccessibleBase.h"
+#include "mozilla/a11y/Role.h"
+#include "nsString.h"
+#include "nsTArray.h"
+#include "nsRect.h"
+
+#include <oleacc.h>
+
+namespace mozilla {
+namespace a11y {
+
+class ProxyAccessible : public ProxyAccessibleBase<ProxyAccessible> {
+ public:
+  ProxyAccessible(uint64_t aID, ProxyAccessible* aParent,
+                  DocAccessibleParent* aDoc, role aRole, uint32_t aInterfaces)
+      : ProxyAccessibleBase(aID, aParent, aDoc, aRole, aInterfaces),
+        mSafeToRecurse(true) {
+    MOZ_COUNT_CTOR(ProxyAccessible);
+  }
+
+  MOZ_COUNTED_DTOR(ProxyAccessible)
+
+#include "mozilla/a11y/ProxyAccessibleShared.h"
+
+  bool GetCOMInterface(void** aOutAccessible) const;
+  void SetCOMInterface(const RefPtr<IAccessible>& aIAccessible) {
+    if (aIAccessible) {
+      mCOMProxy = aIAccessible;
+    } else {
+      // If we were supposed to be receiving an interface (hence the call to
+      // this function), but the interface turns out to be null, then we're
+      // broken for some reason.
+      mSafeToRecurse = false;
+    }
+  }
+
+ protected:
+  explicit ProxyAccessible(DocAccessibleParent* aThisAsDoc)
+      : ProxyAccessibleBase(aThisAsDoc) {
+    MOZ_COUNT_CTOR(ProxyAccessible);
+  }
+
+ private:
+  RefPtr<IAccessible> mCOMProxy;
+  bool mSafeToRecurse;
+};
+
+}  // namespace a11y
+}  // namespace mozilla
+
+#endif
diff --git a/accessible/ipc/win/handler/AccessibleHandler.cpp b/accessible/ipc/win/handler/AccessibleHandler.cpp
new file mode 100644
index 0000000000..90d98abee8
--- /dev/null
+++ b/accessible/ipc/win/handler/AccessibleHandler.cpp
@@ -0,0 +1,2144 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#if defined(MOZILLA_INTERNAL_API)
+#  error This code is NOT for internal Gecko use!
+#endif  // defined(MOZILLA_INTERNAL_API)
+
+#include "AccessibleHandler.h"
+#include "AccessibleHandlerControl.h"
+#include "HandlerChildEnumerator.h"
+#include "HandlerRelation.h"
+
+#include "Factory.h"
+#include "mozilla/ArrayUtils.h"
+#include "mozilla/a11y/HandlerDataCleanup.h"
+#include "mozilla/mscom/Registration.h"
+#include "mozilla/UniquePtr.h"
+
+#include <objbase.h>
+#include <uiautomation.h>
+#include <winreg.h>
+
+#include "AccessibleHypertext.h"
+#include "AccessibleHypertext2.h"
+#include "AccessibleRole.h"
+#include "Accessible2_i.c"
+#include "Accessible2_2_i.c"
+#include "Accessible2_3_i.c"
+#include "AccessibleAction_i.c"
+#include "AccessibleHyperlink_i.c"
+#include "AccessibleHypertext_i.c"
+#include "AccessibleHypertext2_i.c"
+#include "AccessibleTable_i.c"
+#include "AccessibleTable2_i.c"
+#include "AccessibleTableCell_i.c"
+#include "AccessibleText_i.c"
+
+namespace mozilla {
+namespace a11y {
+
+// Must be kept in sync with kClassNameTabContent in
+// accessible/windows/msaa/nsWinUtils.h.
+const WCHAR kEmulatedWindowClassName[] = L"MozillaContentWindowClass";
+const uint32_t kEmulatedWindowClassNameNChars =
+    sizeof(kEmulatedWindowClassName) / sizeof(WCHAR);
+// Mask to get the content process portion of a Windows accessible unique id.
+// This is bits 24 through 30 (LSB 0) of the id. This must be kept in sync
+// with kNumContentProcessIDBits in accessible/windows/msaa/MsaaIdGenerator.cpp.
+const uint32_t kIdContentProcessMask = 0x7F000000;
+
+static mscom::Factory<AccessibleHandler> sHandlerFactory;
+
+HRESULT
+AccessibleHandler::Create(IUnknown* aOuter, REFIID aIid, void** aOutInterface) {
+  if (!aOutInterface || !aOuter || aIid != IID_IUnknown) {
+    return E_INVALIDARG;
+  }
+
+  *aOutInterface = nullptr;
+
+  HRESULT hr;
+  RefPtr<AccessibleHandler> handler(new AccessibleHandler(aOuter, &hr));
+  if (!handler) {
+    return E_OUTOFMEMORY;
+  }
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  return handler->InternalQueryInterface(aIid, aOutInterface);
+}
+
+AccessibleHandler::AccessibleHandler(IUnknown* aOuter, HRESULT* aResult)
+    : mscom::Handler(aOuter, aResult),
+      mDispatch(nullptr),
+      mIA2PassThru(nullptr),
+      mServProvPassThru(nullptr),
+      mIAHyperlinkPassThru(nullptr),
+      mIATableCellPassThru(nullptr),
+      mIAHypertextPassThru(nullptr),
+      mCachedData(),
+      mCachedDynamicDataMarshaledByCom(false),
+      mCacheGen(0),
+      mCachedHyperlinks(nullptr),
+      mCachedNHyperlinks(-1),
+      mCachedTextAttribRuns(nullptr),
+      mCachedNTextAttribRuns(-1),
+      mCachedRelations(nullptr),
+      mCachedNRelations(-1),
+      mIsEmulatedWindow(false) {
+  RefPtr<AccessibleHandlerControl> ctl(gControlFactory.GetOrCreateSingleton());
+  MOZ_ASSERT(ctl);
+  if (!ctl) {
+    if (aResult) {
+      *aResult = E_UNEXPECTED;
+    }
+    return;
+  }
+
+  mCacheGen = ctl->GetCacheGen();
+}
+
+AccessibleHandler::~AccessibleHandler() {
+  CleanupDynamicIA2Data(mCachedData.mDynamicData,
+                        mCachedDynamicDataMarshaledByCom);
+  if (mCachedData.mGeckoBackChannel) {
+    mCachedData.mGeckoBackChannel->Release();
+  }
+  ClearTextCache();
+  ClearRelationCache();
+}
+
+HRESULT
+AccessibleHandler::ResolveIA2() {
+  if (mIA2PassThru) {
+    return S_OK;
+  }
+
+  RefPtr<IUnknown> proxy(GetProxy());
+  if (!proxy) {
+    return E_UNEXPECTED;
+  }
+
+  HRESULT hr = proxy->QueryInterface(NEWEST_IA2_IID,
+                                     reinterpret_cast<void**>(&mIA2PassThru));
+  if (SUCCEEDED(hr)) {
+    // mIA2PassThru is a weak reference (see comments in AccesssibleHandler.h)
+    mIA2PassThru->Release();
+  }
+
+  return hr;
+}
+
+HRESULT
+AccessibleHandler::ResolveIAHyperlink() {
+  if (mIAHyperlinkPassThru) {
+    return S_OK;
+  }
+
+  RefPtr<IUnknown> proxy(GetProxy());
+  if (!proxy) {
+    return E_UNEXPECTED;
+  }
+
+  HRESULT hr =
+      proxy->QueryInterface(IID_IAccessibleHyperlink,
+                            reinterpret_cast<void**>(&mIAHyperlinkPassThru));
+  if (SUCCEEDED(hr)) {
+    // mIAHyperlinkPassThru is a weak reference
+    // (see comments in AccesssibleHandler.h)
+    mIAHyperlinkPassThru->Release();
+  }
+
+  return hr;
+}
+
+HRESULT
+AccessibleHandler::ResolveIATableCell() {
+  if (mIATableCellPassThru) {
+    return S_OK;
+  }
+
+  RefPtr<IUnknown> proxy(GetProxy());
+  if (!proxy) {
+    return E_UNEXPECTED;
+  }
+
+  HRESULT hr =
+      proxy->QueryInterface(IID_IAccessibleTableCell,
+                            reinterpret_cast<void**>(&mIATableCellPassThru));
+  if (SUCCEEDED(hr)) {
+    // mIATableCellPassThru is a weak reference
+    // (see comments in AccesssibleHandler.h)
+    mIATableCellPassThru->Release();
+  }
+
+  return hr;
+}
+
+HRESULT
+AccessibleHandler::ResolveIAHypertext() {
+  if (mIAHypertextPassThru) {
+    return S_OK;
+  }
+
+  RefPtr<IUnknown> proxy(GetProxy());
+  if (!proxy) {
+    return E_UNEXPECTED;
+  }
+
+  HRESULT hr =
+      proxy->QueryInterface(IID_IAccessibleHypertext2,
+                            reinterpret_cast<void**>(&mIAHypertextPassThru));
+  if (SUCCEEDED(hr)) {
+    // mIAHypertextPassThru is a weak reference
+    // (see comments in AccessibleHandler.h)
+    mIAHypertextPassThru->Release();
+  }
+
+  return hr;
+}
+
+HRESULT
+AccessibleHandler::MaybeUpdateCachedData() {
+  RefPtr<AccessibleHandlerControl> ctl(gControlFactory.GetOrCreateSingleton());
+  if (!ctl) {
+    return E_OUTOFMEMORY;
+  }
+
+  uint32_t gen = ctl->GetCacheGen();
+  if (gen == mCacheGen) {
+    // Cache is already up to date.
+    return S_OK;
+  }
+
+  if (!mCachedData.mGeckoBackChannel) {
+    return E_POINTER;
+  }
+
+  // While we're making the outgoing COM call below, an incoming COM call can
+  // be handled which calls ReadHandlerPayload or re-enters this function.
+  // Therefore, we mustn't update the cached data directly lest it be mutated
+  // elsewhere before the outgoing COM call returns and cause corruption or
+  // memory leaks. Instead, pass a temporary struct and update the cached data
+  // only after this call completes.
+  DynamicIA2Data newData;
+  HRESULT hr = mCachedData.mGeckoBackChannel->Refresh(&newData);
+  if (SUCCEEDED(hr)) {
+    // Clean up the old data.
+    CleanupDynamicIA2Data(mCachedData.mDynamicData,
+                          mCachedDynamicDataMarshaledByCom);
+    mCachedData.mDynamicData = newData;
+    mCachedDynamicDataMarshaledByCom = true;
+    // We just updated the cache, so update this object's cache generation
+    // so we only update the cache again after the next change.
+    mCacheGen = gen;
+  }
+  return hr;
+}
+
+HRESULT
+AccessibleHandler::GetAllTextInfo(BSTR* aText) {
+  MOZ_ASSERT(mCachedData.mGeckoBackChannel);
+
+  ClearTextCache();
+
+  return mCachedData.mGeckoBackChannel->get_AllTextInfo(
+      aText, &mCachedHyperlinks, &mCachedNHyperlinks, &mCachedTextAttribRuns,
+      &mCachedNTextAttribRuns);
+}
+
+void AccessibleHandler::ClearTextCache() {
+  if (mCachedNHyperlinks >= 0) {
+    // We cached hyperlinks, but the caller never retrieved them.
+    for (long index = 0; index < mCachedNHyperlinks; ++index) {
+      mCachedHyperlinks[index]->Release();
+    }
+    // mCachedHyperlinks might already be null if there are no hyperlinks.
+    if (mCachedHyperlinks) {
+      ::CoTaskMemFree(mCachedHyperlinks);
+      mCachedHyperlinks = nullptr;
+    }
+    mCachedNHyperlinks = -1;
+  }
+
+  if (mCachedTextAttribRuns) {
+    for (long index = 0; index < mCachedNTextAttribRuns; ++index) {
+      if (mCachedTextAttribRuns[index].text) {
+        // The caller never requested this attribute run.
+        ::SysFreeString(mCachedTextAttribRuns[index].text);
+      }
+    }
+    // This array is internal to us, so we must always free it.
+    ::CoTaskMemFree(mCachedTextAttribRuns);
+    mCachedTextAttribRuns = nullptr;
+    mCachedNTextAttribRuns = -1;
+  }
+}
+
+HRESULT
+AccessibleHandler::GetRelationsInfo() {
+  MOZ_ASSERT(mCachedData.mGeckoBackChannel);
+
+  ClearRelationCache();
+
+  return mCachedData.mGeckoBackChannel->get_RelationsInfo(&mCachedRelations,
+                                                          &mCachedNRelations);
+}
+
+void AccessibleHandler::ClearRelationCache() {
+  if (mCachedNRelations == -1) {
+    // No cache; nothing to do.
+    return;
+  }
+
+  // We cached relations, but the client never retrieved them.
+  if (mCachedRelations) {
+    for (long index = 0; index < mCachedNRelations; ++index) {
+      IARelationData& relData = mCachedRelations[index];
+      if (relData.mType) {
+        ::SysFreeString(relData.mType);
+      }
+    }
+    // This array is internal to us, so we must always free it.
+    ::CoTaskMemFree(mCachedRelations);
+    mCachedRelations = nullptr;
+  }
+  mCachedNRelations = -1;
+}
+
+HRESULT
+AccessibleHandler::ResolveIDispatch() {
+  if (mDispatch) {
+    return S_OK;
+  }
+
+  HRESULT hr;
+
+  if (!mDispatchUnk) {
+    RefPtr<AccessibleHandlerControl> ctl(
+        gControlFactory.GetOrCreateSingleton());
+    if (!ctl) {
+      return E_OUTOFMEMORY;
+    }
+
+    RefPtr<ITypeInfo> typeinfo;
+    hr = ctl->GetHandlerTypeInfo(getter_AddRefs(typeinfo));
+    if (FAILED(hr)) {
+      return hr;
+    }
+
+    hr = ::CreateStdDispatch(GetOuter(),
+                             static_cast<NEWEST_IA2_INTERFACE*>(this), typeinfo,
+                             getter_AddRefs(mDispatchUnk));
+    if (FAILED(hr)) {
+      return hr;
+    }
+  }
+
+  hr = mDispatchUnk->QueryInterface(IID_IDispatch,
+                                    reinterpret_cast<void**>(&mDispatch));
+  if (SUCCEEDED(hr)) {
+    // mDispatch is weak (see comments in AccessibleHandler.h)
+    mDispatch->Release();
+  }
+
+  return hr;
+}
+
+HRESULT
+AccessibleHandler::QueryHandlerInterface(IUnknown* aProxyUnknown, REFIID aIid,
+                                         void** aOutInterface) {
+  MOZ_ASSERT(aProxyUnknown);
+
+  static_assert(&NEWEST_IA2_IID == &IID_IAccessible2_3,
+                "You have modified NEWEST_IA2_IID. This code needs updating.");
+  if (aIid == IID_IDispatch || aIid == IID_IAccessible2_3 ||
+      aIid == IID_IAccessible2_2 || aIid == IID_IAccessible2 ||
+      aIid == IID_IAccessible) {
+    RefPtr<NEWEST_IA2_INTERFACE> ia2(static_cast<NEWEST_IA2_INTERFACE*>(this));
+    ia2.forget(aOutInterface);
+    return S_OK;
+  }
+
+  if (aIid == IID_IServiceProvider) {
+    RefPtr<IServiceProvider> svcProv(static_cast<IServiceProvider*>(this));
+    svcProv.forget(aOutInterface);
+    return S_OK;
+  }
+
+  if (HasPayload()) {
+    // The proxy manager caches interfaces marshaled in the payload
+    // and returns them on QI without a cross-process call.
+    // However, it doesn't know about interfaces which don't exist.
+    // We can determine this from the payload.
+    if (((aIid == IID_IAccessibleText || aIid == IID_IAccessibleHypertext ||
+          aIid == IID_IAccessibleHypertext2) &&
+         !mCachedData.mStaticData.mIAHypertext) ||
+        ((aIid == IID_IAccessibleAction || aIid == IID_IAccessibleHyperlink) &&
+         !mCachedData.mStaticData.mIAHyperlink) ||
+        (aIid == IID_IAccessibleTable && !mCachedData.mStaticData.mIATable) ||
+        (aIid == IID_IAccessibleTable2 && !mCachedData.mStaticData.mIATable2) ||
+        (aIid == IID_IAccessibleTableCell &&
+         !mCachedData.mStaticData.mIATableCell)) {
+      // We already know this interface is not available, so don't query
+      // the proxy, thus avoiding a pointless cross-process call.
+      // If we return E_NOINTERFACE here, mscom::Handler will try the COM
+      // proxy. S_FALSE signals that the proxy should not be tried.
+      return S_FALSE;
+    }
+  }
+
+  if (aIid == IID_IAccessibleAction || aIid == IID_IAccessibleHyperlink) {
+    RefPtr<IAccessibleHyperlink> iaLink(
+        static_cast<IAccessibleHyperlink*>(this));
+    iaLink.forget(aOutInterface);
+    return S_OK;
+  }
+
+  if (aIid == IID_IAccessibleTableCell) {
+    RefPtr<IAccessibleTableCell> iaCell(
+        static_cast<IAccessibleTableCell*>(this));
+    iaCell.forget(aOutInterface);
+    return S_OK;
+  }
+
+  if (aIid == IID_IAccessibleText || aIid == IID_IAccessibleHypertext ||
+      aIid == IID_IAccessibleHypertext2) {
+    RefPtr<IAccessibleHypertext2> iaHt(
+        static_cast<IAccessibleHypertext2*>(this));
+    iaHt.forget(aOutInterface);
+    return S_OK;
+  }
+
+  if (aIid == IID_IProvideClassInfo) {
+    RefPtr<IProvideClassInfo> clsInfo(this);
+    clsInfo.forget(aOutInterface);
+    return S_OK;
+  }
+
+  if (aIid == IID_IEnumVARIANT && mCachedData.mGeckoBackChannel) {
+    if (mCachedData.mDynamicData.mChildCount == 0) {
+      return E_NOINTERFACE;
+    }
+    if (mCachedData.mDynamicData.mIA2Role == IA2_ROLE_INTERNAL_FRAME &&
+        mCachedData.mDynamicData.mChildCount == 1) {
+      // This is for an iframe. HandlerChildEnumerator works fine for iframes
+      // rendered in the same content process. However, for out-of-process
+      // iframes, HandlerProvider::get_AllChildren (called by
+      // HandlerChildEnumerator) will fail. This is because we only send down
+      // an IDispatch COM proxy for the embedded document, but get_AllChildren
+      // will try to QueryInterface this to IAccessible2 to reduce QI calls
+      // from the parent process. Because the content process is sandboxed,
+      // it can't make the outgoing COM call to QI the proxy from IDispatch to
+      // IAccessible2 and so it fails.
+      // Since an iframe only has one child anyway, we don't need the bulk fetch
+      // optimization offered by HandlerChildEnumerator or even IEnumVARIANT.
+      // Therefore, we explicitly tell the client this interface is not
+      // supported, which will cause the oleacc AccessibleChildren function
+      // to fall back to accChild.
+      // If we return E_NOINTERFACE here, mscom::Handler will try the COM
+      // proxy. S_FALSE signals that the proxy should not be tried.
+      return S_FALSE;
+    }
+    RefPtr<IEnumVARIANT> childEnum(
+        new HandlerChildEnumerator(this, mCachedData.mGeckoBackChannel));
+    childEnum.forget(aOutInterface);
+    return S_OK;
+  }
+
+  return E_NOINTERFACE;
+}
+
+HRESULT
+AccessibleHandler::ReadHandlerPayload(IStream* aStream, REFIID aIid) {
+  if (!aStream) {
+    return E_INVALIDARG;
+  }
+
+  mscom::StructFromStream deserializer(aStream);
+  if (!deserializer) {
+    return E_FAIL;
+  }
+  if (deserializer.IsEmpty()) {
+    return S_FALSE;
+  }
+
+  // QueryHandlerInterface might get called while we deserialize the payload,
+  // but that checks the interface pointers in the payload to determine what
+  // interfaces are available. Therefore, deserialize into a temporary struct
+  // and update mCachedData only after deserialization completes.
+  // The decoding functions can misbehave if their target memory is not zeroed
+  // beforehand, so ensure we do that.
+  IA2Payload newData{};
+  if (!deserializer.Read(&newData, &IA2Payload_Decode)) {
+    return E_FAIL;
+  }
+  // Clean up the old data.
+  CleanupDynamicIA2Data(mCachedData.mDynamicData,
+                        mCachedDynamicDataMarshaledByCom);
+  mCachedData = newData;
+  mCachedDynamicDataMarshaledByCom = false;
+
+  // These interfaces have been aggregated into the proxy manager.
+  // The proxy manager will resolve these interfaces now on QI,
+  // so we can release these pointers.
+  // However, we don't null them out because we use their presence
+  // to determine whether the interface is available
+  // so as to avoid pointless cross-proc QI calls returning E_NOINTERFACE.
+  // Note that if pointers to other objects (in contrast to
+  // interfaces of *this* object) are added in future, we should not release
+  // those pointers.
+  ReleaseStaticIA2DataInterfaces(mCachedData.mStaticData);
+
+  WCHAR className[kEmulatedWindowClassNameNChars];
+  if (mCachedData.mDynamicData.mHwnd &&
+      ::GetClassName(
+          reinterpret_cast<HWND>(uintptr_t(mCachedData.mDynamicData.mHwnd)),
+          className, kEmulatedWindowClassNameNChars) > 0 &&
+      wcscmp(className, kEmulatedWindowClassName) == 0) {
+    mIsEmulatedWindow = true;
+  }
+
+  if (!mCachedData.mGeckoBackChannel) {
+    return S_OK;
+  }
+
+  RefPtr<AccessibleHandlerControl> ctl(gControlFactory.GetOrCreateSingleton());
+  if (!ctl) {
+    return E_OUTOFMEMORY;
+  }
+
+  if (mCachedData.mDynamicData.mIA2Role == ROLE_SYSTEM_COLUMNHEADER ||
+      mCachedData.mDynamicData.mIA2Role == ROLE_SYSTEM_ROWHEADER) {
+    // Because the same headers can apply to many cells, handler payloads
+    // include the ids of header cells, rather than potentially marshaling the
+    // same objects many times. We need to cache header cells here so we can
+    // get them by id later.
+    ctl->CacheAccessible(mCachedData.mDynamicData.mUniqueId, this);
+  }
+
+  return ctl->Register(WrapNotNull(mCachedData.mGeckoBackChannel));
+}
+
+REFIID
+AccessibleHandler::MarshalAs(REFIID aIid) {
+  static_assert(&NEWEST_IA2_IID == &IID_IAccessible2_3,
+                "You have modified NEWEST_IA2_IID. This code needs updating.");
+  if (aIid == IID_IAccessible2_3 || aIid == IID_IAccessible2_2 ||
+      aIid == IID_IAccessible2 || aIid == IID_IAccessible ||
+      aIid == IID_IDispatch) {
+    return NEWEST_IA2_IID;
+  }
+
+  return aIid;
+}
+
+HRESULT
+AccessibleHandler::GetMarshalInterface(REFIID aMarshalAsIid,
+                                       NotNull<IUnknown*> aProxy,
+                                       NotNull<IID*> aOutIid,
+                                       NotNull<IUnknown**> aOutUnk) {
+  if (aMarshalAsIid == NEWEST_IA2_IID) {
+    *aOutIid = IID_IAccessible;
+  } else {
+    *aOutIid = aMarshalAsIid;
+  }
+
+  return aProxy->QueryInterface(
+      aMarshalAsIid,
+      reinterpret_cast<void**>(static_cast<IUnknown**>(aOutUnk)));
+}
+
+HRESULT
+AccessibleHandler::GetHandlerPayloadSize(REFIID aIid, DWORD* aOutPayloadSize) {
+  if (!aOutPayloadSize) {
+    return E_INVALIDARG;
+  }
+
+  // If we're sending the payload to somebody else, we'd better make sure that
+  // it is up to date. If the cache update fails then we'll return a 0 payload
+  // size so that we don't transfer obsolete data.
+  if (FAILED(MaybeUpdateCachedData())) {
+    *aOutPayloadSize = mscom::StructToStream::GetEmptySize();
+    return S_OK;
+  }
+
+  mSerializer =
+      MakeUnique<mscom::StructToStream>(mCachedData, &IA2Payload_Encode);
+  if (!mSerializer) {
+    return E_FAIL;
+  }
+
+  *aOutPayloadSize = mSerializer->GetSize();
+  return S_OK;
+}
+
+HRESULT
+AccessibleHandler::WriteHandlerPayload(IStream* aStream, REFIID aIid) {
+  if (!aStream) {
+    return E_INVALIDARG;
+  }
+
+  if (!mSerializer) {
+    return E_UNEXPECTED;
+  }
+
+  HRESULT hr = mSerializer->Write(aStream);
+  mSerializer.reset();
+  return hr;
+}
+
+HRESULT
+AccessibleHandler::QueryInterface(REFIID riid, void** ppv) {
+  return Handler::QueryInterface(riid, ppv);
+}
+
+ULONG
+AccessibleHandler::AddRef() { return Handler::AddRef(); }
+
+ULONG
+AccessibleHandler::Release() { return Handler::Release(); }
+
+HRESULT
+AccessibleHandler::GetTypeInfoCount(UINT* pctinfo) {
+  HRESULT hr = ResolveIDispatch();
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  return mDispatch->GetTypeInfoCount(pctinfo);
+}
+
+HRESULT
+AccessibleHandler::GetTypeInfo(UINT iTInfo, LCID lcid, ITypeInfo** ppTInfo) {
+  HRESULT hr = ResolveIDispatch();
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  return mDispatch->GetTypeInfo(iTInfo, lcid, ppTInfo);
+}
+
+HRESULT
+AccessibleHandler::GetIDsOfNames(REFIID riid, LPOLESTR* rgszNames, UINT cNames,
+                                 LCID lcid, DISPID* rgDispId) {
+  HRESULT hr = ResolveIDispatch();
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  return mDispatch->GetIDsOfNames(riid, rgszNames, cNames, lcid, rgDispId);
+}
+
+HRESULT
+AccessibleHandler::Invoke(DISPID dispIdMember, REFIID riid, LCID lcid,
+                          WORD wFlags, DISPPARAMS* pDispParams,
+                          VARIANT* pVarResult, EXCEPINFO* pExcepInfo,
+                          UINT* puArgErr) {
+  HRESULT hr = ResolveIDispatch();
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  return mDispatch->Invoke(dispIdMember, riid, lcid, wFlags, pDispParams,
+                           pVarResult, pExcepInfo, puArgErr);
+}
+
+#define BEGIN_CACHE_ACCESS                      \
+  {                                             \
+    HRESULT hr;                                 \
+    if (FAILED(hr = MaybeUpdateCachedData())) { \
+      return hr;                                \
+    }                                           \
+  }
+
+#define GET_FIELD(member, assignTo) \
+  { assignTo = mCachedData.mDynamicData.member; }
+
+#define GET_BSTR(member, assignTo) \
+  { assignTo = CopyBSTR(mCachedData.mDynamicData.member); }
+
+/*** IAccessible ***/
+
+HRESULT
+AccessibleHandler::get_accParent(IDispatch** ppdispParent) {
+  HRESULT hr = ResolveIA2();
+  if (FAILED(hr)) {
+    return hr;
+  }
+  return mIA2PassThru->get_accParent(ppdispParent);
+}
+
+HRESULT
+AccessibleHandler::get_accChildCount(long* pcountChildren) {
+  if (!pcountChildren) {
+    return E_INVALIDARG;
+  }
+
+  if (!HasPayload()) {
+    HRESULT hr = ResolveIA2();
+    if (FAILED(hr)) {
+      return hr;
+    }
+    return mIA2PassThru->get_accChildCount(pcountChildren);
+  }
+
+  BEGIN_CACHE_ACCESS;
+  GET_FIELD(mChildCount, *pcountChildren);
+  return S_OK;
+}
+
+HRESULT
+AccessibleHandler::get_accChild(VARIANT varChild, IDispatch** ppdispChild) {
+  if (!ppdispChild) {
+    return E_INVALIDARG;
+  }
+  // Unlikely, but we might as well optimize for it
+  if (varChild.vt == VT_I4 && varChild.lVal == CHILDID_SELF) {
+    RefPtr<IDispatch> disp(this);
+    disp.forget(ppdispChild);
+    return S_OK;
+  }
+
+  if (mIsEmulatedWindow && varChild.vt == VT_I4 && varChild.lVal < 0 &&
+      (varChild.lVal & kIdContentProcessMask) !=
+          (mCachedData.mDynamicData.mUniqueId & kIdContentProcessMask)) {
+    // Window emulation is enabled and the target id is in a different
+    // process to this accessible.
+    // When window emulation is enabled, each tab document gets its own HWND.
+    // OOP iframes get the same HWND as their tab document and fire events with
+    // that HWND. However, the root accessible for the HWND (the tab document)
+    // can't return accessibles for OOP iframes. Therefore, we must get the root
+    // accessible from the main HWND and call accChild on that instead.
+    // We don't need an oleacc proxy, so send WM_GETOBJECT directly instead of
+    // calling AccessibleObjectFromEvent.
+    HWND rootHwnd = GetParent(
+        reinterpret_cast<HWND>(uintptr_t(mCachedData.mDynamicData.mHwnd)));
+    MOZ_ASSERT(rootHwnd);
+    LRESULT lresult = ::SendMessage(rootHwnd, WM_GETOBJECT, 0, OBJID_CLIENT);
+    if (lresult > 0) {
+      RefPtr<IAccessible2_3> rootAcc;
+      HRESULT hr = ::ObjectFromLresult(lresult, IID_IAccessible2_3, 0,
+                                       getter_AddRefs(rootAcc));
+      if (hr == S_OK) {
+        return rootAcc->get_accChild(varChild, ppdispChild);
+      }
+    }
+  }
+
+  HRESULT hr = ResolveIA2();
+  if (FAILED(hr)) {
+    return hr;
+  }
+  return mIA2PassThru->get_accChild(varChild, ppdispChild);
+}
+
+HRESULT
+AccessibleHandler::get_accName(VARIANT varChild, BSTR* pszName) {
+  if (!pszName) {
+    return E_INVALIDARG;
+  }
+
+  if (varChild.lVal != CHILDID_SELF || !HasPayload()) {
+    HRESULT hr = ResolveIA2();
+    if (FAILED(hr)) {
+      return hr;
+    }
+    return mIA2PassThru->get_accName(varChild, pszName);
+  }
+
+  BEGIN_CACHE_ACCESS;
+  GET_BSTR(mName, *pszName);
+  return S_OK;
+}
+
+HRESULT
+AccessibleHandler::get_accValue(VARIANT varChild, BSTR* pszValue) {
+  if (!pszValue) {
+    return E_INVALIDARG;
+  }
+
+  if (varChild.lVal != CHILDID_SELF || !HasPayload()) {
+    HRESULT hr = ResolveIA2();
+    if (FAILED(hr)) {
+      return hr;
+    }
+    return mIA2PassThru->get_accValue(varChild, pszValue);
+  }
+
+  BEGIN_CACHE_ACCESS;
+  GET_BSTR(mValue, *pszValue);
+  return S_OK;
+}
+
+HRESULT
+AccessibleHandler::get_accDescription(VARIANT varChild, BSTR* pszDescription) {
+  if (!pszDescription) {
+    return E_INVALIDARG;
+  }
+
+  if (varChild.lVal != CHILDID_SELF || !HasPayload()) {
+    HRESULT hr = ResolveIA2();
+    if (FAILED(hr)) {
+      return hr;
+    }
+    return mIA2PassThru->get_accDescription(varChild, pszDescription);
+  }
+
+  BEGIN_CACHE_ACCESS;
+  GET_BSTR(mDescription, *pszDescription);
+  return S_OK;
+}
+
+HRESULT
+AccessibleHandler::get_accRole(VARIANT varChild, VARIANT* pvarRole) {
+  if (!pvarRole) {
+    return E_INVALIDARG;
+  }
+
+  if (varChild.lVal != CHILDID_SELF || !HasPayload()) {
+    HRESULT hr = ResolveIA2();
+    if (FAILED(hr)) {
+      return hr;
+    }
+    return mIA2PassThru->get_accRole(varChild, pvarRole);
+  }
+
+  BEGIN_CACHE_ACCESS;
+  return ::VariantCopy(pvarRole, &mCachedData.mDynamicData.mRole);
+}
+
+HRESULT
+AccessibleHandler::get_accState(VARIANT varChild, VARIANT* pvarState) {
+  if (!pvarState) {
+    return E_INVALIDARG;
+  }
+
+  if (varChild.lVal != CHILDID_SELF || !HasPayload()) {
+    HRESULT hr = ResolveIA2();
+    if (FAILED(hr)) {
+      return hr;
+    }
+    return mIA2PassThru->get_accState(varChild, pvarState);
+  }
+
+  pvarState->vt = VT_I4;
+  BEGIN_CACHE_ACCESS;
+  GET_FIELD(mState, pvarState->lVal);
+  return S_OK;
+}
+
+HRESULT
+AccessibleHandler::get_accHelp(VARIANT varChild, BSTR* pszHelp) {
+  // This matches what AccessibleWrap does
+  if (!pszHelp) {
+    return E_INVALIDARG;
+  }
+  *pszHelp = nullptr;
+  return S_FALSE;
+}
+
+HRESULT
+AccessibleHandler::get_accHelpTopic(BSTR* pszHelpFile, VARIANT varChild,
+                                    long* pidTopic) {
+  // This matches what AccessibleWrap does
+  if (!pszHelpFile || !pidTopic) {
+    return E_INVALIDARG;
+  }
+  *pszHelpFile = nullptr;
+  *pidTopic = 0;
+  return S_FALSE;
+}
+
+HRESULT
+AccessibleHandler::get_accKeyboardShortcut(VARIANT varChild,
+                                           BSTR* pszKeyboardShortcut) {
+  if (!pszKeyboardShortcut) {
+    return E_INVALIDARG;
+  }
+
+  if (varChild.lVal != CHILDID_SELF || !HasPayload()) {
+    HRESULT hr = ResolveIA2();
+    if (FAILED(hr)) {
+      return hr;
+    }
+    return mIA2PassThru->get_accKeyboardShortcut(varChild, pszKeyboardShortcut);
+  }
+
+  BEGIN_CACHE_ACCESS;
+  GET_BSTR(mKeyboardShortcut, *pszKeyboardShortcut);
+  return S_OK;
+}
+
+HRESULT
+AccessibleHandler::get_accFocus(VARIANT* pvarChild) {
+  HRESULT hr = ResolveIA2();
+  if (FAILED(hr)) {
+    return hr;
+  }
+  return mIA2PassThru->get_accFocus(pvarChild);
+}
+
+HRESULT
+AccessibleHandler::get_accSelection(VARIANT* pvarChildren) {
+  HRESULT hr = ResolveIA2();
+  if (FAILED(hr)) {
+    return hr;
+  }
+  return mIA2PassThru->get_accSelection(pvarChildren);
+}
+
+HRESULT
+AccessibleHandler::get_accDefaultAction(VARIANT varChild,
+                                        BSTR* pszDefaultAction) {
+  if (!pszDefaultAction) {
+    return E_INVALIDARG;
+  }
+
+  if (varChild.lVal != CHILDID_SELF || !HasPayload()) {
+    HRESULT hr = ResolveIA2();
+    if (FAILED(hr)) {
+      return hr;
+    }
+    return mIA2PassThru->get_accDefaultAction(varChild, pszDefaultAction);
+  }
+
+  BEGIN_CACHE_ACCESS;
+  GET_BSTR(mDefaultAction, *pszDefaultAction);
+  return S_OK;
+}
+
+HRESULT
+AccessibleHandler::accSelect(long flagsSelect, VARIANT varChild) {
+  HRESULT hr = ResolveIA2();
+  if (FAILED(hr)) {
+    return hr;
+  }
+  return mIA2PassThru->accSelect(flagsSelect, varChild);
+}
+
+HRESULT
+AccessibleHandler::accLocation(long* pxLeft, long* pyTop, long* pcxWidth,
+                               long* pcyHeight, VARIANT varChild) {
+  if (varChild.lVal != CHILDID_SELF || !HasPayload()) {
+    HRESULT hr = ResolveIA2();
+    if (FAILED(hr)) {
+      return hr;
+    }
+    return mIA2PassThru->accLocation(pxLeft, pyTop, pcxWidth, pcyHeight,
+                                     varChild);
+  }
+
+  if (!pxLeft || !pyTop || !pcxWidth || !pcyHeight) {
+    return E_INVALIDARG;
+  }
+
+  BEGIN_CACHE_ACCESS;
+  GET_FIELD(mLeft, *pxLeft);
+  GET_FIELD(mTop, *pyTop);
+  GET_FIELD(mWidth, *pcxWidth);
+  GET_FIELD(mHeight, *pcyHeight);
+  return S_OK;
+}
+
+HRESULT
+AccessibleHandler::accNavigate(long navDir, VARIANT varStart,
+                               VARIANT* pvarEndUpAt) {
+  HRESULT hr = ResolveIA2();
+  if (FAILED(hr)) {
+    return hr;
+  }
+  return mIA2PassThru->accNavigate(navDir, varStart, pvarEndUpAt);
+}
+
+HRESULT
+AccessibleHandler::accHitTest(long xLeft, long yTop, VARIANT* pvarChild) {
+  HRESULT hr = ResolveIA2();
+  if (FAILED(hr)) {
+    return hr;
+  }
+  return mIA2PassThru->accHitTest(xLeft, yTop, pvarChild);
+}
+
+HRESULT
+AccessibleHandler::accDoDefaultAction(VARIANT varChild) {
+  HRESULT hr = ResolveIA2();
+  if (FAILED(hr)) {
+    return hr;
+  }
+  return mIA2PassThru->accDoDefaultAction(varChild);
+}
+
+HRESULT
+AccessibleHandler::put_accName(VARIANT varChild, BSTR szName) {
+  // This matches AccessibleWrap
+  return E_NOTIMPL;
+}
+
+HRESULT
+AccessibleHandler::put_accValue(VARIANT varChild, BSTR szValue) {
+  HRESULT hr = ResolveIA2();
+  if (FAILED(hr)) {
+    return hr;
+  }
+  return mIA2PassThru->put_accValue(varChild, szValue);
+}
+
+/*** IAccessible2 ***/
+
+HRESULT
+AccessibleHandler::get_nRelations(long* nRelations) {
+  if (!nRelations) {
+    return E_INVALIDARG;
+  }
+
+  HRESULT hr;
+  if (mCachedData.mGeckoBackChannel) {
+    // If the caller wants nRelations, they will almost certainly want the
+    // actual relations too.
+    hr = GetRelationsInfo();
+    if (SUCCEEDED(hr)) {
+      *nRelations = mCachedNRelations;
+      return S_OK;
+    }
+    // We fall back to a normal call if this fails.
+  }
+
+  hr = ResolveIA2();
+  if (FAILED(hr)) {
+    return hr;
+  }
+  return mIA2PassThru->get_nRelations(nRelations);
+}
+
+HRESULT
+AccessibleHandler::get_relation(long relationIndex,
+                                IAccessibleRelation** relation) {
+  HRESULT hr = ResolveIA2();
+  if (FAILED(hr)) {
+    return hr;
+  }
+  return mIA2PassThru->get_relation(relationIndex, relation);
+}
+
+HRESULT
+AccessibleHandler::get_relations(long maxRelations,
+                                 IAccessibleRelation** relations,
+                                 long* nRelations) {
+  if (maxRelations == 0 || !relations || !nRelations) {
+    return E_INVALIDARG;
+  }
+
+  // We currently only support retrieval of *all* cached relations at once.
+  if (mCachedNRelations != -1 && maxRelations >= mCachedNRelations) {
+    for (long index = 0; index < mCachedNRelations; ++index) {
+      IARelationData& relData = mCachedRelations[index];
+      RefPtr<IAccessibleRelation> hrel(new HandlerRelation(this, relData));
+      hrel.forget(&relations[index]);
+    }
+    *nRelations = mCachedNRelations;
+    // Clean up the cache, since we only cache for one call.
+    // We don't use ClearRelationCache here because that scans for data to free
+    // in the array and we don't we need that. The HandlerRelation instances
+    // will handle freeing of the data.
+    ::CoTaskMemFree(mCachedRelations);
+    mCachedRelations = nullptr;
+    mCachedNRelations = -1;
+    return S_OK;
+  }
+
+  HRESULT hr = ResolveIA2();
+  if (FAILED(hr)) {
+    return hr;
+  }
+  return mIA2PassThru->get_relations(maxRelations, relations, nRelations);
+}
+
+HRESULT
+AccessibleHandler::role(long* role) {
+  if (!role) {
+    return E_INVALIDARG;
+  }
+
+  if (!HasPayload()) {
+    HRESULT hr = ResolveIA2();
+    if (FAILED(hr)) {
+      return hr;
+    }
+    return mIA2PassThru->role(role);
+  }
+
+  BEGIN_CACHE_ACCESS;
+  GET_FIELD(mIA2Role, *role);
+  return S_OK;
+}
+
+HRESULT
+AccessibleHandler::scrollTo(IA2ScrollType scrollType) {
+  HRESULT hr = ResolveIA2();
+  if (FAILED(hr)) {
+    return hr;
+  }
+  return mIA2PassThru->scrollTo(scrollType);
+}
+
+HRESULT
+AccessibleHandler::scrollToPoint(IA2CoordinateType coordinateType, long x,
+                                 long y) {
+  HRESULT hr = ResolveIA2();
+  if (FAILED(hr)) {
+    return hr;
+  }
+  return mIA2PassThru->scrollToPoint(coordinateType, x, y);
+}
+
+HRESULT
+AccessibleHandler::get_groupPosition(long* groupLevel,
+                                     long* similarItemsInGroup,
+                                     long* positionInGroup) {
+  HRESULT hr = ResolveIA2();
+  if (FAILED(hr)) {
+    return hr;
+  }
+  return mIA2PassThru->get_groupPosition(groupLevel, similarItemsInGroup,
+                                         positionInGroup);
+}
+
+HRESULT
+AccessibleHandler::get_states(AccessibleStates* states) {
+  if (!states) {
+    return E_INVALIDARG;
+  }
+
+  if (!HasPayload()) {
+    HRESULT hr = ResolveIA2();
+    if (FAILED(hr)) {
+      return hr;
+    }
+    return mIA2PassThru->get_states(states);
+  }
+
+  BEGIN_CACHE_ACCESS;
+  GET_FIELD(mIA2States, *states);
+  return S_OK;
+}
+
+HRESULT
+AccessibleHandler::get_extendedRole(BSTR* extendedRole) {
+  // This matches ia2Accessible
+  if (!extendedRole) {
+    return E_INVALIDARG;
+  }
+  *extendedRole = nullptr;
+  return E_NOTIMPL;
+}
+
+HRESULT
+AccessibleHandler::get_localizedExtendedRole(BSTR* localizedExtendedRole) {
+  // This matches ia2Accessible
+  if (!localizedExtendedRole) {
+    return E_INVALIDARG;
+  }
+  *localizedExtendedRole = nullptr;
+  return E_NOTIMPL;
+}
+
+HRESULT
+AccessibleHandler::get_nExtendedStates(long* nExtendedStates) {
+  // This matches ia2Accessible
+  if (!nExtendedStates) {
+    return E_INVALIDARG;
+  }
+  *nExtendedStates = 0;
+  return E_NOTIMPL;
+}
+
+HRESULT
+AccessibleHandler::get_extendedStates(long maxExtendedStates,
+                                      BSTR** extendedStates,
+                                      long* nExtendedStates) {
+  // This matches ia2Accessible
+  if (!extendedStates || !nExtendedStates) {
+    return E_INVALIDARG;
+  }
+  *extendedStates = nullptr;
+  *nExtendedStates = 0;
+  return E_NOTIMPL;
+}
+
+HRESULT
+AccessibleHandler::get_localizedExtendedStates(long maxLocalizedExtendedStates,
+                                               BSTR** localizedExtendedStates,
+                                               long* nLocalizedExtendedStates) {
+  // This matches ia2Accessible
+  if (!localizedExtendedStates || !nLocalizedExtendedStates) {
+    return E_INVALIDARG;
+  }
+  *localizedExtendedStates = nullptr;
+  *nLocalizedExtendedStates = 0;
+  return E_NOTIMPL;
+}
+
+HRESULT
+AccessibleHandler::get_uniqueID(long* uniqueID) {
+  if (!uniqueID) {
+    return E_INVALIDARG;
+  }
+  if (!HasPayload()) {
+    HRESULT hr = ResolveIA2();
+    if (FAILED(hr)) {
+      return hr;
+    }
+    return mIA2PassThru->get_uniqueID(uniqueID);
+  }
+  *uniqueID = mCachedData.mDynamicData.mUniqueId;
+  return S_OK;
+}
+
+HRESULT
+AccessibleHandler::get_windowHandle(HWND* windowHandle) {
+  if (!windowHandle) {
+    return E_INVALIDARG;
+  }
+
+  if (!HasPayload()) {
+    HRESULT hr = ResolveIA2();
+    if (FAILED(hr)) {
+      return hr;
+    }
+    return mIA2PassThru->get_windowHandle(windowHandle);
+  }
+
+  BEGIN_CACHE_ACCESS;
+  long hwnd = 0;
+  GET_FIELD(mHwnd, hwnd);
+  *windowHandle = reinterpret_cast<HWND>(uintptr_t(hwnd));
+  return S_OK;
+}
+
+HRESULT
+AccessibleHandler::get_indexInParent(long* indexInParent) {
+  HRESULT hr = ResolveIA2();
+  if (FAILED(hr)) {
+    return hr;
+  }
+  return mIA2PassThru->get_indexInParent(indexInParent);
+}
+
+HRESULT
+AccessibleHandler::get_locale(IA2Locale* locale) {
+  if (!locale) {
+    return E_INVALIDARG;
+  }
+
+  if (!HasPayload()) {
+    HRESULT hr = ResolveIA2();
+    if (FAILED(hr)) {
+      return hr;
+    }
+    return mIA2PassThru->get_locale(locale);
+  }
+
+  BEGIN_CACHE_ACCESS;
+  GET_BSTR(mIA2Locale.language, locale->language);
+  GET_BSTR(mIA2Locale.country, locale->country);
+  GET_BSTR(mIA2Locale.variant, locale->variant);
+  return S_OK;
+}
+
+HRESULT
+AccessibleHandler::get_attributes(BSTR* attributes) {
+  if (!attributes) {
+    return E_INVALIDARG;
+  }
+
+  if (!HasPayload()) {
+    HRESULT hr = ResolveIA2();
+    if (FAILED(hr)) {
+      return hr;
+    }
+    return mIA2PassThru->get_attributes(attributes);
+  }
+
+  BEGIN_CACHE_ACCESS;
+  GET_BSTR(mAttributes, *attributes);
+  return S_OK;
+}
+
+/*** IAccessible2_2 ***/
+
+HRESULT
+AccessibleHandler::get_attribute(BSTR name, VARIANT* attribute) {
+  // Not yet implemented by ia2Accessible.
+  // Once ia2Accessible implements this, we could either pass it through
+  // or we could extract these individually from cached mAttributes.
+  // The latter should be considered if traffic warrants it.
+  return E_NOTIMPL;
+}
+
+HRESULT
+AccessibleHandler::get_accessibleWithCaret(IUnknown** accessible,
+                                           long* caretOffset) {
+  HRESULT hr = ResolveIA2();
+  if (FAILED(hr)) {
+    return hr;
+  }
+  return mIA2PassThru->get_accessibleWithCaret(accessible, caretOffset);
+}
+
+HRESULT
+AccessibleHandler::get_relationTargetsOfType(BSTR type, long maxTargets,
+                                             IUnknown*** targets,
+                                             long* nTargets) {
+  HRESULT hr = ResolveIA2();
+  if (FAILED(hr)) {
+    return hr;
+  }
+  return mIA2PassThru->get_relationTargetsOfType(type, maxTargets, targets,
+                                                 nTargets);
+}
+
+/*** IAccessible2_3 ***/
+
+HRESULT
+AccessibleHandler::get_selectionRanges(IA2Range** ranges, long* nRanges) {
+  HRESULT hr = ResolveIA2();
+  if (FAILED(hr)) {
+    return hr;
+  }
+  return mIA2PassThru->get_selectionRanges(ranges, nRanges);
+}
+
+/*** IServiceProvider ***/
+
+HRESULT
+AccessibleHandler::QueryService(REFGUID aServiceId, REFIID aIid,
+                                void** aOutInterface) {
+  static_assert(&NEWEST_IA2_IID == &IID_IAccessible2_3,
+                "You have modified NEWEST_IA2_IID. This code needs updating.");
+  /* We're taking advantage of the fact that we are implementing IA2 as part
+     of our own object to implement this just like a QI. */
+  if (aIid == IID_IAccessible2_3 || aIid == IID_IAccessible2_2 ||
+      aIid == IID_IAccessible2) {
+    RefPtr<NEWEST_IA2_INTERFACE> ia2(this);
+    ia2.forget(aOutInterface);
+    return S_OK;
+  }
+
+  // JAWS uses QueryService for these, but QI will work just fine and we can
+  // thus avoid a cross-process call. More importantly, if QS is used, the
+  // handler won't get used for that object, so our caching won't be used.
+  if (aIid == IID_IAccessibleAction || aIid == IID_IAccessibleText) {
+    return InternalQueryInterface(aIid, aOutInterface);
+  }
+
+  for (uint32_t i = 0; i < ArrayLength(kUnsupportedServices); ++i) {
+    if (aServiceId == kUnsupportedServices[i]) {
+      return E_NOINTERFACE;
+    }
+  }
+
+  if (!mServProvPassThru) {
+    RefPtr<IUnknown> proxy(GetProxy());
+    if (!proxy) {
+      return E_UNEXPECTED;
+    }
+
+    HRESULT hr = proxy->QueryInterface(
+        IID_IServiceProvider, reinterpret_cast<void**>(&mServProvPassThru));
+    if (FAILED(hr)) {
+      return hr;
+    }
+
+    // mServProvPassThru is a weak reference (see comments in
+    // AccessibleHandler.h)
+    mServProvPassThru->Release();
+  }
+
+  return mServProvPassThru->QueryService(aServiceId, aIid, aOutInterface);
+}
+
+/*** IProvideClassInfo ***/
+
+HRESULT
+AccessibleHandler::GetClassInfo(ITypeInfo** aOutTypeInfo) {
+  RefPtr<AccessibleHandlerControl> ctl(gControlFactory.GetOrCreateSingleton());
+  if (!ctl) {
+    return E_OUTOFMEMORY;
+  }
+
+  return ctl->GetHandlerTypeInfo(aOutTypeInfo);
+}
+
+/*** IAccessibleAction ***/
+
+HRESULT
+AccessibleHandler::nActions(long* nActions) {
+  if (!nActions) {
+    return E_INVALIDARG;
+  }
+
+  if (!HasPayload()) {
+    HRESULT hr = ResolveIAHyperlink();
+    if (FAILED(hr)) {
+      return hr;
+    }
+    return mIAHyperlinkPassThru->nActions(nActions);
+  }
+
+  BEGIN_CACHE_ACCESS;
+  GET_FIELD(mNActions, *nActions);
+  return S_OK;
+}
+
+HRESULT
+AccessibleHandler::doAction(long actionIndex) {
+  HRESULT hr = ResolveIAHyperlink();
+  if (FAILED(hr)) {
+    return hr;
+  }
+  return mIAHyperlinkPassThru->doAction(actionIndex);
+}
+
+HRESULT
+AccessibleHandler::get_description(long actionIndex, BSTR* description) {
+  HRESULT hr = ResolveIAHyperlink();
+  if (FAILED(hr)) {
+    return hr;
+  }
+  return mIAHyperlinkPassThru->get_description(actionIndex, description);
+}
+
+HRESULT
+AccessibleHandler::get_keyBinding(long actionIndex, long nMaxBindings,
+                                  BSTR** keyBindings, long* nBindings) {
+  HRESULT hr = ResolveIAHyperlink();
+  if (FAILED(hr)) {
+    return hr;
+  }
+  return mIAHyperlinkPassThru->get_keyBinding(actionIndex, nMaxBindings,
+                                              keyBindings, nBindings);
+}
+
+HRESULT
+AccessibleHandler::get_name(long actionIndex, BSTR* name) {
+  if (!name) {
+    return E_INVALIDARG;
+  }
+
+  if (HasPayload()) {
+    if (actionIndex >= mCachedData.mDynamicData.mNActions) {
+      // Action does not exist.
+      return E_INVALIDARG;
+    }
+
+    if (actionIndex == 0) {
+      // same as accDefaultAction.
+      GET_BSTR(mDefaultAction, *name);
+      return S_OK;
+    }
+  }
+
+  // At this point, there's either no payload or actionIndex is > 0.
+  HRESULT hr = ResolveIAHyperlink();
+  if (FAILED(hr)) {
+    return hr;
+  }
+  return mIAHyperlinkPassThru->get_name(actionIndex, name);
+}
+
+HRESULT
+AccessibleHandler::get_localizedName(long actionIndex, BSTR* localizedName) {
+  HRESULT hr = ResolveIAHyperlink();
+  if (FAILED(hr)) {
+    return hr;
+  }
+  return mIAHyperlinkPassThru->get_localizedName(actionIndex, localizedName);
+}
+
+/*** IAccessibleHyperlink ***/
+
+HRESULT
+AccessibleHandler::get_anchor(long index, VARIANT* anchor) {
+  HRESULT hr = ResolveIAHyperlink();
+  if (FAILED(hr)) {
+    return hr;
+  }
+  return mIAHyperlinkPassThru->get_anchor(index, anchor);
+}
+
+HRESULT
+AccessibleHandler::get_anchorTarget(long index, VARIANT* anchorTarget) {
+  HRESULT hr = ResolveIAHyperlink();
+  if (FAILED(hr)) {
+    return hr;
+  }
+  return mIAHyperlinkPassThru->get_anchorTarget(index, anchorTarget);
+}
+
+HRESULT
+AccessibleHandler::get_startIndex(long* index) {
+  HRESULT hr = ResolveIAHyperlink();
+  if (FAILED(hr)) {
+    return hr;
+  }
+  return mIAHyperlinkPassThru->get_startIndex(index);
+}
+
+HRESULT
+AccessibleHandler::get_endIndex(long* index) {
+  HRESULT hr = ResolveIAHyperlink();
+  if (FAILED(hr)) {
+    return hr;
+  }
+  return mIAHyperlinkPassThru->get_endIndex(index);
+}
+
+HRESULT
+AccessibleHandler::get_valid(boolean* valid) {
+  HRESULT hr = ResolveIAHyperlink();
+  if (FAILED(hr)) {
+    return hr;
+  }
+  return mIAHyperlinkPassThru->get_valid(valid);
+}
+
+/*** IAccessibleTableCell ***/
+
+HRESULT
+AccessibleHandler::get_columnExtent(long* nColumnsSpanned) {
+  if (!nColumnsSpanned) {
+    return E_INVALIDARG;
+  }
+
+  if (!HasPayload()) {
+    HRESULT hr = ResolveIATableCell();
+    if (FAILED(hr)) {
+      return hr;
+    }
+    return mIATableCellPassThru->get_columnExtent(nColumnsSpanned);
+  }
+
+  BEGIN_CACHE_ACCESS;
+  GET_FIELD(mColumnExtent, *nColumnsSpanned);
+  return S_OK;
+}
+
+HRESULT
+AccessibleHandler::get_columnHeaderCells(IUnknown*** cellAccessibles,
+                                         long* nColumnHeaderCells) {
+  if (!cellAccessibles || !nColumnHeaderCells) {
+    return E_INVALIDARG;
+  }
+
+  HRESULT hr = S_OK;
+  if (HasPayload()) {
+    RefPtr<AccessibleHandlerControl> ctl(
+        gControlFactory.GetOrCreateSingleton());
+    if (!ctl) {
+      return E_OUTOFMEMORY;
+    }
+    *nColumnHeaderCells = mCachedData.mDynamicData.mNColumnHeaderCells;
+    *cellAccessibles = static_cast<IUnknown**>(
+        ::CoTaskMemAlloc(sizeof(IUnknown*) * *nColumnHeaderCells));
+    long i;
+    for (i = 0; i < *nColumnHeaderCells; ++i) {
+      RefPtr<AccessibleHandler> headerAcc;
+      hr = ctl->GetCachedAccessible(
+          mCachedData.mDynamicData.mColumnHeaderCellIds[i],
+          getter_AddRefs(headerAcc));
+      if (FAILED(hr)) {
+        break;
+      }
+      hr = headerAcc->QueryInterface(IID_IUnknown,
+                                     (void**)&(*cellAccessibles)[i]);
+      if (FAILED(hr)) {
+        break;
+      }
+    }
+    if (SUCCEEDED(hr)) {
+      return S_OK;
+    }
+    // If we failed to get any of the headers from the cache, don't use the
+    // cache at all. We need to clean up anything we did so far.
+    long failedHeader = i;
+    for (i = 0; i < failedHeader; ++i) {
+      (*cellAccessibles)[i]->Release();
+    }
+    ::CoTaskMemFree(*cellAccessibles);
+    *cellAccessibles = nullptr;
+  }
+
+  hr = ResolveIATableCell();
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  return mIATableCellPassThru->get_columnHeaderCells(cellAccessibles,
+                                                     nColumnHeaderCells);
+}
+
+HRESULT
+AccessibleHandler::get_columnIndex(long* columnIndex) {
+  if (!columnIndex) {
+    return E_INVALIDARG;
+  }
+
+  if (!HasPayload()) {
+    HRESULT hr = ResolveIATableCell();
+    if (FAILED(hr)) {
+      return hr;
+    }
+    return mIATableCellPassThru->get_columnIndex(columnIndex);
+  }
+
+  BEGIN_CACHE_ACCESS;
+  GET_FIELD(mColumnIndex, *columnIndex);
+  return S_OK;
+}
+
+HRESULT
+AccessibleHandler::get_rowExtent(long* nRowsSpanned) {
+  if (!nRowsSpanned) {
+    return E_INVALIDARG;
+  }
+
+  if (!HasPayload()) {
+    HRESULT hr = ResolveIATableCell();
+    if (FAILED(hr)) {
+      return hr;
+    }
+    return mIATableCellPassThru->get_rowExtent(nRowsSpanned);
+  }
+
+  BEGIN_CACHE_ACCESS;
+  GET_FIELD(mRowExtent, *nRowsSpanned);
+  return S_OK;
+}
+
+HRESULT
+AccessibleHandler::get_rowHeaderCells(IUnknown*** cellAccessibles,
+                                      long* nRowHeaderCells) {
+  if (!cellAccessibles || !nRowHeaderCells) {
+    return E_INVALIDARG;
+  }
+
+  HRESULT hr = S_OK;
+  if (HasPayload()) {
+    RefPtr<AccessibleHandlerControl> ctl(
+        gControlFactory.GetOrCreateSingleton());
+    if (!ctl) {
+      return E_OUTOFMEMORY;
+    }
+    *nRowHeaderCells = mCachedData.mDynamicData.mNRowHeaderCells;
+    *cellAccessibles = static_cast<IUnknown**>(
+        ::CoTaskMemAlloc(sizeof(IUnknown*) * *nRowHeaderCells));
+    long i;
+    for (i = 0; i < *nRowHeaderCells; ++i) {
+      RefPtr<AccessibleHandler> headerAcc;
+      hr = ctl->GetCachedAccessible(
+          mCachedData.mDynamicData.mRowHeaderCellIds[i],
+          getter_AddRefs(headerAcc));
+      if (FAILED(hr)) {
+        break;
+      }
+      hr = headerAcc->QueryInterface(IID_IUnknown,
+                                     (void**)&(*cellAccessibles)[i]);
+      if (FAILED(hr)) {
+        break;
+      }
+    }
+    if (SUCCEEDED(hr)) {
+      return S_OK;
+    }
+    // If we failed to get any of the headers from the cache, don't use the
+    // cache at all. We need to clean up anything we did so far.
+    long failedHeader = i;
+    for (i = 0; i < failedHeader; ++i) {
+      (*cellAccessibles)[i]->Release();
+    }
+    ::CoTaskMemFree(*cellAccessibles);
+    *cellAccessibles = nullptr;
+  }
+
+  hr = ResolveIATableCell();
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  return mIATableCellPassThru->get_rowHeaderCells(cellAccessibles,
+                                                  nRowHeaderCells);
+}
+
+HRESULT
+AccessibleHandler::get_rowIndex(long* rowIndex) {
+  if (!rowIndex) {
+    return E_INVALIDARG;
+  }
+
+  if (!HasPayload()) {
+    HRESULT hr = ResolveIATableCell();
+    if (FAILED(hr)) {
+      return hr;
+    }
+    return mIATableCellPassThru->get_rowIndex(rowIndex);
+  }
+
+  BEGIN_CACHE_ACCESS;
+  GET_FIELD(mRowIndex, *rowIndex);
+  return S_OK;
+}
+
+HRESULT
+AccessibleHandler::get_isSelected(boolean* isSelected) {
+  if (!isSelected) {
+    return E_INVALIDARG;
+  }
+
+  if (!HasPayload()) {
+    HRESULT hr = ResolveIATableCell();
+    if (FAILED(hr)) {
+      return hr;
+    }
+    return mIATableCellPassThru->get_isSelected(isSelected);
+  }
+
+  BEGIN_CACHE_ACCESS;
+  GET_FIELD(mCellIsSelected, *isSelected);
+  return S_OK;
+}
+
+HRESULT
+AccessibleHandler::get_rowColumnExtents(long* row, long* column,
+                                        long* rowExtents, long* columnExtents,
+                                        boolean* isSelected) {
+  if (!row || !column || !rowExtents || !columnExtents || !isSelected) {
+    return E_INVALIDARG;
+  }
+
+  if (!HasPayload()) {
+    HRESULT hr = ResolveIATableCell();
+    if (FAILED(hr)) {
+      return hr;
+    }
+    return mIATableCellPassThru->get_rowColumnExtents(
+        row, column, rowExtents, columnExtents, isSelected);
+  }
+
+  BEGIN_CACHE_ACCESS;
+  GET_FIELD(mRowIndex, *row);
+  GET_FIELD(mColumnIndex, *column);
+  GET_FIELD(mRowExtent, *rowExtents);
+  GET_FIELD(mColumnExtent, *columnExtents);
+  GET_FIELD(mCellIsSelected, *isSelected);
+  return S_OK;
+}
+
+HRESULT
+AccessibleHandler::get_table(IUnknown** table) {
+  HRESULT hr = ResolveIATableCell();
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  return mIATableCellPassThru->get_table(table);
+}
+
+/*** IAccessibleText ***/
+
+HRESULT
+AccessibleHandler::addSelection(long startOffset, long endOffset) {
+  HRESULT hr = ResolveIAHypertext();
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  return mIAHypertextPassThru->addSelection(startOffset, endOffset);
+}
+
+HRESULT
+AccessibleHandler::get_attributes(long offset, long* startOffset,
+                                  long* endOffset, BSTR* textAttributes) {
+  if (!startOffset || !endOffset || !textAttributes) {
+    return E_INVALIDARG;
+  }
+
+  if (mCachedNTextAttribRuns >= 0) {
+    // We have cached attributes.
+    for (long index = 0; index < mCachedNTextAttribRuns; ++index) {
+      auto& attribRun = mCachedTextAttribRuns[index];
+      if (attribRun.start <= offset && offset < attribRun.end) {
+        *startOffset = attribRun.start;
+        *endOffset = attribRun.end;
+        *textAttributes = attribRun.text;
+        // The caller will clean this up.
+        // (We only keep each cached attribute run for one call.)
+        attribRun.text = nullptr;
+        // The cache for this run is now invalid, so don't visit it again.
+        attribRun.end = 0;
+        return S_OK;
+      }
+    }
+  }
+
+  HRESULT hr = ResolveIAHypertext();
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  return mIAHypertextPassThru->get_attributes(offset, startOffset, endOffset,
+                                              textAttributes);
+}
+
+HRESULT
+AccessibleHandler::get_caretOffset(long* offset) {
+  HRESULT hr = ResolveIAHypertext();
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  return mIAHypertextPassThru->get_caretOffset(offset);
+}
+
+HRESULT
+AccessibleHandler::get_characterExtents(long offset,
+                                        enum IA2CoordinateType coordType,
+                                        long* x, long* y, long* width,
+                                        long* height) {
+  HRESULT hr = ResolveIAHypertext();
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  return mIAHypertextPassThru->get_characterExtents(offset, coordType, x, y,
+                                                    width, height);
+}
+
+HRESULT
+AccessibleHandler::get_nSelections(long* nSelections) {
+  HRESULT hr = ResolveIAHypertext();
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  return mIAHypertextPassThru->get_nSelections(nSelections);
+}
+
+HRESULT
+AccessibleHandler::get_offsetAtPoint(long x, long y,
+                                     enum IA2CoordinateType coordType,
+                                     long* offset) {
+  HRESULT hr = ResolveIAHypertext();
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  return mIAHypertextPassThru->get_offsetAtPoint(x, y, coordType, offset);
+}
+
+HRESULT
+AccessibleHandler::get_selection(long selectionIndex, long* startOffset,
+                                 long* endOffset) {
+  HRESULT hr = ResolveIAHypertext();
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  return mIAHypertextPassThru->get_selection(selectionIndex, startOffset,
+                                             endOffset);
+}
+
+HRESULT
+AccessibleHandler::get_text(long startOffset, long endOffset, BSTR* text) {
+  if (!text) {
+    return E_INVALIDARG;
+  }
+
+  HRESULT hr;
+  if (mCachedData.mGeckoBackChannel && startOffset == 0 &&
+      endOffset == IA2_TEXT_OFFSET_LENGTH) {
+    // If the caller is retrieving all text, they will probably want all
+    // hyperlinks and attributes as well.
+    hr = GetAllTextInfo(text);
+    if (SUCCEEDED(hr)) {
+      return hr;
+    }
+    // We fall back to a normal call if this fails.
+  }
+
+  hr = ResolveIAHypertext();
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  return mIAHypertextPassThru->get_text(startOffset, endOffset, text);
+}
+
+HRESULT
+AccessibleHandler::get_textBeforeOffset(long offset,
+                                        enum IA2TextBoundaryType boundaryType,
+                                        long* startOffset, long* endOffset,
+                                        BSTR* text) {
+  HRESULT hr = ResolveIAHypertext();
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  return mIAHypertextPassThru->get_textBeforeOffset(
+      offset, boundaryType, startOffset, endOffset, text);
+}
+
+HRESULT
+AccessibleHandler::get_textAfterOffset(long offset,
+                                       enum IA2TextBoundaryType boundaryType,
+                                       long* startOffset, long* endOffset,
+                                       BSTR* text) {
+  HRESULT hr = ResolveIAHypertext();
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  return mIAHypertextPassThru->get_textAfterOffset(
+      offset, boundaryType, startOffset, endOffset, text);
+}
+
+HRESULT
+AccessibleHandler::get_textAtOffset(long offset,
+                                    enum IA2TextBoundaryType boundaryType,
+                                    long* startOffset, long* endOffset,
+                                    BSTR* text) {
+  HRESULT hr = ResolveIAHypertext();
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  return mIAHypertextPassThru->get_textAtOffset(offset, boundaryType,
+                                                startOffset, endOffset, text);
+}
+
+HRESULT
+AccessibleHandler::removeSelection(long selectionIndex) {
+  HRESULT hr = ResolveIAHypertext();
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  return mIAHypertextPassThru->removeSelection(selectionIndex);
+}
+
+HRESULT
+AccessibleHandler::setCaretOffset(long offset) {
+  HRESULT hr = ResolveIAHypertext();
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  return mIAHypertextPassThru->setCaretOffset(offset);
+}
+
+HRESULT
+AccessibleHandler::setSelection(long selectionIndex, long startOffset,
+                                long endOffset) {
+  HRESULT hr = ResolveIAHypertext();
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  return mIAHypertextPassThru->setSelection(selectionIndex, startOffset,
+                                            endOffset);
+}
+
+HRESULT
+AccessibleHandler::get_nCharacters(long* nCharacters) {
+  HRESULT hr = ResolveIAHypertext();
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  return mIAHypertextPassThru->get_nCharacters(nCharacters);
+}
+
+HRESULT
+AccessibleHandler::scrollSubstringTo(long startIndex, long endIndex,
+                                     enum IA2ScrollType scrollType) {
+  HRESULT hr = ResolveIAHypertext();
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  return mIAHypertextPassThru->scrollSubstringTo(startIndex, endIndex,
+                                                 scrollType);
+}
+
+HRESULT
+AccessibleHandler::scrollSubstringToPoint(long startIndex, long endIndex,
+                                          enum IA2CoordinateType coordinateType,
+                                          long x, long y) {
+  HRESULT hr = ResolveIAHypertext();
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  return mIAHypertextPassThru->scrollSubstringToPoint(startIndex, endIndex,
+                                                      coordinateType, x, y);
+}
+
+HRESULT
+AccessibleHandler::get_newText(IA2TextSegment* newText) {
+  if (!newText) {
+    return E_INVALIDARG;
+  }
+
+  RefPtr<AccessibleHandlerControl> ctl(gControlFactory.GetSingleton());
+  MOZ_ASSERT(ctl);
+  if (!ctl) {
+    return S_OK;
+  }
+
+  long id;
+  HRESULT hr = this->get_uniqueID(&id);
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  return ctl->GetNewText(id, WrapNotNull(newText));
+}
+
+HRESULT
+AccessibleHandler::get_oldText(IA2TextSegment* oldText) {
+  if (!oldText) {
+    return E_INVALIDARG;
+  }
+
+  RefPtr<AccessibleHandlerControl> ctl(gControlFactory.GetSingleton());
+  MOZ_ASSERT(ctl);
+  if (!ctl) {
+    return S_OK;
+  }
+
+  long id;
+  HRESULT hr = this->get_uniqueID(&id);
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  return ctl->GetOldText(id, WrapNotNull(oldText));
+}
+
+/*** IAccessibleHypertext ***/
+
+HRESULT
+AccessibleHandler::get_nHyperlinks(long* hyperlinkCount) {
+  HRESULT hr = ResolveIAHypertext();
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  return mIAHypertextPassThru->get_nHyperlinks(hyperlinkCount);
+}
+
+HRESULT
+AccessibleHandler::get_hyperlink(long index, IAccessibleHyperlink** hyperlink) {
+  HRESULT hr = ResolveIAHypertext();
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  return mIAHypertextPassThru->get_hyperlink(index, hyperlink);
+}
+
+HRESULT
+AccessibleHandler::get_hyperlinkIndex(long charIndex, long* hyperlinkIndex) {
+  HRESULT hr = ResolveIAHypertext();
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  return mIAHypertextPassThru->get_hyperlinkIndex(charIndex, hyperlinkIndex);
+}
+
+/*** IAccessibleHypertext2 ***/
+
+HRESULT
+AccessibleHandler::get_hyperlinks(IAccessibleHyperlink*** hyperlinks,
+                                  long* nHyperlinks) {
+  if (!hyperlinks || !nHyperlinks) {
+    return E_INVALIDARG;
+  }
+
+  if (mCachedNHyperlinks >= 0) {
+    // We have cached hyperlinks.
+    *hyperlinks = mCachedHyperlinks;
+    *nHyperlinks = mCachedNHyperlinks;
+    // The client will clean these up. (We only keep the cache for one call.)
+    mCachedHyperlinks = nullptr;
+    mCachedNHyperlinks = -1;
+    return mCachedNHyperlinks == 0 ? S_FALSE : S_OK;
+  }
+
+  HRESULT hr = ResolveIAHypertext();
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  return mIAHypertextPassThru->get_hyperlinks(hyperlinks, nHyperlinks);
+}
+
+}  // namespace a11y
+}  // namespace mozilla
+
+extern "C" HRESULT __stdcall ProxyDllCanUnloadNow();
+
+extern "C" HRESULT __stdcall DllCanUnloadNow() {
+  return mozilla::mscom::Module::CanUnload() && ProxyDllCanUnloadNow();
+}
+
+extern "C" HRESULT __stdcall ProxyDllGetClassObject(REFCLSID aClsid,
+                                                    REFIID aIid,
+                                                    LPVOID* aOutInterface);
+
+extern "C" HRESULT __stdcall DllGetClassObject(REFCLSID aClsid, REFIID aIid,
+                                               LPVOID* aOutInterface) {
+  if (aClsid == CLSID_AccessibleHandler) {
+    return mozilla::a11y::sHandlerFactory.QueryInterface(aIid, aOutInterface);
+  }
+  return ProxyDllGetClassObject(aClsid, aIid, aOutInterface);
+}
+
+extern "C" BOOL WINAPI ProxyDllMain(HINSTANCE aInstDll, DWORD aReason,
+                                    LPVOID aReserved);
+
+BOOL WINAPI DllMain(HINSTANCE aInstDll, DWORD aReason, LPVOID aReserved) {
+  if (aReason == DLL_PROCESS_ATTACH) {
+    DisableThreadLibraryCalls((HMODULE)aInstDll);
+  }
+  // This is required for ProxyDllRegisterServer to work correctly
+  return ProxyDllMain(aInstDll, aReason, aReserved);
+}
+
+extern "C" HRESULT __stdcall ProxyDllRegisterServer();
+
+extern "C" HRESULT __stdcall DllRegisterServer() {
+  HRESULT hr = mozilla::mscom::Handler::Register(CLSID_AccessibleHandler);
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  return ProxyDllRegisterServer();
+}
+
+extern "C" HRESULT __stdcall ProxyDllUnregisterServer();
+
+extern "C" HRESULT __stdcall DllUnregisterServer() {
+  HRESULT hr = mozilla::mscom::Handler::Unregister(CLSID_AccessibleHandler);
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  return ProxyDllUnregisterServer();
+}
diff --git a/accessible/ipc/win/handler/AccessibleHandler.def b/accessible/ipc/win/handler/AccessibleHandler.def
new file mode 100644
index 0000000000..8f2a245922
--- /dev/null
+++ b/accessible/ipc/win/handler/AccessibleHandler.def
@@ -0,0 +1,11 @@
+;+# This Source Code Form is subject to the terms of the Mozilla Public
+;+# License, v. 2.0. If a copy of the MPL was not distributed with this
+;+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+LIBRARY        AccessibleHandler.dll
+
+EXPORTS        DllGetClassObject      PRIVATE
+               DllCanUnloadNow        PRIVATE
+               DllRegisterServer      PRIVATE
+               DllUnregisterServer    PRIVATE
+               GetProxyDllInfo        PRIVATE
diff --git a/accessible/ipc/win/handler/AccessibleHandler.h b/accessible/ipc/win/handler/AccessibleHandler.h
new file mode 100644
index 0000000000..f99091d6c3
--- /dev/null
+++ b/accessible/ipc/win/handler/AccessibleHandler.h
@@ -0,0 +1,336 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_a11y_AccessibleHandler_h
+#define mozilla_a11y_AccessibleHandler_h
+
+#define NEWEST_IA2_BASENAME Accessible2_3
+
+#define __GENIFACE(base) I##base
+#define INTERFACEFOR(base) __GENIFACE(base)
+#define NEWEST_IA2_INTERFACE INTERFACEFOR(NEWEST_IA2_BASENAME)
+
+#define __GENIID(iface) IID_##iface
+#define IIDFOR(iface) __GENIID(iface)
+#define NEWEST_IA2_IID IIDFOR(NEWEST_IA2_INTERFACE)
+
+#if defined(__midl) || defined(__WIDL__)
+
+import "Accessible2_3.idl";
+
+#else
+
+#  include "HandlerData.h"
+
+#  include <windows.h>
+
+namespace mozilla {
+namespace a11y {
+
+static const GUID kUnsupportedServices[] = {
+    // clang-format off
+  // Unknown, queried by Windows on devices with touch screens or similar devices
+  // connected.
+  {0x33f139ee, 0xe509, 0x47f7, {0xbf, 0x39, 0x83, 0x76, 0x44, 0xf7, 0x45, 0x76}},
+  // Unknown, queried by Windows
+  {0xFDA075CF, 0x7C8B, 0x498C, { 0xB5, 0x14, 0xA9, 0xCB, 0x52, 0x1B, 0xBF, 0xB4 }},
+  // Unknown, queried by Windows
+  {0x8EDAA462, 0x21F4, 0x4C87, { 0xA0, 0x12, 0xB3, 0xCD, 0xA3, 0xAB, 0x01, 0xFC }},
+  // Unknown, queried by Windows
+  {0xacd46652, 0x829d, 0x41cb, { 0xa5, 0xfc, 0x17, 0xac, 0xf4, 0x36, 0x61, 0xac }},
+  // SID_IsUIAutomationObject (undocumented), queried by Windows
+  {0xb96fdb85, 0x7204, 0x4724, { 0x84, 0x2b, 0xc7, 0x05, 0x9d, 0xed, 0xb9, 0xd0 }},
+  // IIS_IsOleaccProxy (undocumented), queried by Windows
+  {0x902697FA, 0x80E4, 0x4560, {0x80, 0x2A, 0xA1, 0x3F, 0x22, 0xA6, 0x47, 0x09}},
+  // IID_IHTMLElement, queried by JAWS
+  {0x3050F1FF, 0x98B5, 0x11CF, {0xBB, 0x82, 0x00, 0xAA, 0x00, 0xBD, 0xCE, 0x0B}}
+    // clang-format on
+};
+
+}
+}  // namespace mozilla
+
+#  if !defined(MOZILLA_INTERNAL_API)
+
+#    include "Accessible2_3.h"
+#    include "AccessibleHyperlink.h"
+#    include "AccessibleHypertext2.h"
+#    include "AccessibleTableCell.h"
+#    include "Handler.h"
+#    include "mozilla/mscom/StructStream.h"
+#    include "mozilla/UniquePtr.h"
+
+#    include <ocidl.h>
+#    include <servprov.h>
+
+namespace mozilla {
+namespace a11y {
+
+class AccessibleHandler final : public mscom::Handler,
+                                public NEWEST_IA2_INTERFACE,
+                                public IServiceProvider,
+                                public IProvideClassInfo,
+                                public IAccessibleHyperlink,
+                                public IAccessibleTableCell,
+                                public IAccessibleHypertext2 {
+ public:
+  static HRESULT Create(IUnknown* aOuter, REFIID aIid, void** aOutInterface);
+
+  // mscom::Handler
+  HRESULT QueryHandlerInterface(IUnknown* aProxyUnknown, REFIID aIid,
+                                void** aOutInterface) override;
+  HRESULT ReadHandlerPayload(IStream* aStream, REFIID aIid) override;
+
+  REFIID MarshalAs(REFIID aRequestedIid) override;
+  HRESULT GetMarshalInterface(REFIID aMarshalAsIid, NotNull<IUnknown*> aProxy,
+                              NotNull<IID*> aOutIid,
+                              NotNull<IUnknown**> aOutUnk) override;
+  HRESULT GetHandlerPayloadSize(REFIID aIid, DWORD* aOutPayloadSize) override;
+  HRESULT WriteHandlerPayload(IStream* aStream, REFIID aIId) override;
+
+  // IUnknown
+  STDMETHODIMP QueryInterface(REFIID riid, void** ppv) override;
+  STDMETHODIMP_(ULONG) AddRef() override;
+  STDMETHODIMP_(ULONG) Release() override;
+
+  // IDispatch
+  STDMETHODIMP GetTypeInfoCount(UINT* pctinfo) override;
+  STDMETHODIMP GetTypeInfo(UINT iTInfo, LCID lcid,
+                           ITypeInfo** ppTInfo) override;
+  STDMETHODIMP GetIDsOfNames(REFIID riid, LPOLESTR* rgszNames, UINT cNames,
+                             LCID lcid, DISPID* rgDispId) override;
+  STDMETHODIMP Invoke(DISPID dispIdMember, REFIID riid, LCID lcid, WORD wFlags,
+                      DISPPARAMS* pDispParams, VARIANT* pVarResult,
+                      EXCEPINFO* pExcepInfo, UINT* puArgErr) override;
+
+  // IAccessible
+  STDMETHODIMP get_accParent(IDispatch** ppdispParent) override;
+  STDMETHODIMP get_accChildCount(long* pcountChildren) override;
+  STDMETHODIMP get_accChild(VARIANT varChild, IDispatch** ppdispChild) override;
+  STDMETHODIMP get_accName(VARIANT varChild, BSTR* pszName) override;
+  STDMETHODIMP get_accValue(VARIANT varChild, BSTR* pszValue) override;
+  STDMETHODIMP get_accDescription(VARIANT varChild,
+                                  BSTR* pszDescription) override;
+  STDMETHODIMP get_accRole(VARIANT varChild, VARIANT* pvarRole) override;
+  STDMETHODIMP get_accState(VARIANT varChild, VARIANT* pvarState) override;
+  STDMETHODIMP get_accHelp(VARIANT varChild, BSTR* pszHelp) override;
+  STDMETHODIMP get_accHelpTopic(BSTR* pszHelpFile, VARIANT varChild,
+                                long* pidTopic) override;
+  STDMETHODIMP get_accKeyboardShortcut(VARIANT varChild,
+                                       BSTR* pszKeyboardShortcut) override;
+  STDMETHODIMP get_accFocus(VARIANT* pvarChild) override;
+  STDMETHODIMP get_accSelection(VARIANT* pvarChildren) override;
+  STDMETHODIMP get_accDefaultAction(VARIANT varChild,
+                                    BSTR* pszDefaultAction) override;
+  STDMETHODIMP accSelect(long flagsSelect, VARIANT varChild) override;
+  STDMETHODIMP accLocation(long* pxLeft, long* pyTop, long* pcxWidth,
+                           long* pcyHeight, VARIANT varChild) override;
+  STDMETHODIMP accNavigate(long navDir, VARIANT varStart,
+                           VARIANT* pvarEndUpAt) override;
+  STDMETHODIMP accHitTest(long xLeft, long yTop, VARIANT* pvarChild) override;
+  STDMETHODIMP accDoDefaultAction(VARIANT varChild) override;
+  STDMETHODIMP put_accName(VARIANT varChild, BSTR szName) override;
+  STDMETHODIMP put_accValue(VARIANT varChild, BSTR szValue) override;
+
+  // IAccessible2
+  STDMETHODIMP get_nRelations(long* nRelations) override;
+  STDMETHODIMP get_relation(long relationIndex,
+                            IAccessibleRelation** relation) override;
+  STDMETHODIMP get_relations(long maxRelations, IAccessibleRelation** relations,
+                             long* nRelations) override;
+  STDMETHODIMP role(long* role) override;
+  STDMETHODIMP scrollTo(IA2ScrollType scrollType) override;
+  STDMETHODIMP scrollToPoint(IA2CoordinateType coordinateType, long x,
+                             long y) override;
+  STDMETHODIMP get_groupPosition(long* groupLevel, long* similarItemsInGroup,
+                                 long* positionInGroup) override;
+  STDMETHODIMP get_states(AccessibleStates* states) override;
+  STDMETHODIMP get_extendedRole(BSTR* extendedRole) override;
+  STDMETHODIMP get_localizedExtendedRole(BSTR* localizedExtendedRole) override;
+  STDMETHODIMP get_nExtendedStates(long* nExtendedStates) override;
+  STDMETHODIMP get_extendedStates(long maxExtendedStates, BSTR** extendedStates,
+                                  long* nExtendedStates) override;
+  STDMETHODIMP get_localizedExtendedStates(
+      long maxLocalizedExtendedStates, BSTR** localizedExtendedStates,
+      long* nLocalizedExtendedStates) override;
+  STDMETHODIMP get_uniqueID(long* uniqueID) override;
+  STDMETHODIMP get_windowHandle(HWND* windowHandle) override;
+  STDMETHODIMP get_indexInParent(long* indexInParent) override;
+  STDMETHODIMP get_locale(IA2Locale* locale) override;
+  STDMETHODIMP get_attributes(BSTR* attributes) override;
+
+  // IAccessible2_2
+  STDMETHODIMP get_attribute(BSTR name, VARIANT* attribute) override;
+  STDMETHODIMP get_accessibleWithCaret(IUnknown** accessible,
+                                       long* caretOffset) override;
+  STDMETHODIMP get_relationTargetsOfType(BSTR type, long maxTargets,
+                                         IUnknown*** targets,
+                                         long* nTargets) override;
+
+  // IAccessible2_3
+  STDMETHODIMP get_selectionRanges(IA2Range** ranges, long* nRanges) override;
+
+  // IServiceProvider
+  STDMETHODIMP QueryService(REFGUID aServiceId, REFIID aIid,
+                            void** aOutInterface) override;
+
+  // IProvideClassInfo
+  STDMETHODIMP GetClassInfo(ITypeInfo** aOutTypeInfo) override;
+
+  // IAccessibleAction
+  STDMETHODIMP nActions(long* nActions) override;
+  STDMETHODIMP doAction(long actionIndex) override;
+  STDMETHODIMP get_description(long actionIndex, BSTR* description) override;
+  STDMETHODIMP get_keyBinding(long actionIndex, long nMaxBindings,
+                              BSTR** keyBindings, long* nBindings) override;
+  STDMETHODIMP get_name(long actionIndex, BSTR* name) override;
+  STDMETHODIMP get_localizedName(long actionIndex,
+                                 BSTR* localizedName) override;
+
+  // IAccessibleHyperlink
+  STDMETHODIMP get_anchor(long index, VARIANT* anchor) override;
+  STDMETHODIMP get_anchorTarget(long index, VARIANT* anchorTarget) override;
+  STDMETHODIMP get_startIndex(long* index) override;
+  STDMETHODIMP get_endIndex(long* index) override;
+  STDMETHODIMP get_valid(boolean* valid) override;
+
+  // IAccessibleTableCell
+  STDMETHODIMP get_columnExtent(long* nColumnsSpanned) override;
+  STDMETHODIMP get_columnHeaderCells(IUnknown*** cellAccessibles,
+                                     long* nColumnHeaderCells) override;
+  STDMETHODIMP get_columnIndex(long* columnIndex) override;
+  STDMETHODIMP get_rowExtent(long* nRowsSpanned) override;
+  STDMETHODIMP get_rowHeaderCells(IUnknown*** cellAccessibles,
+                                  long* nRowHeaderCells) override;
+  STDMETHODIMP get_rowIndex(long* rowIndex) override;
+  STDMETHODIMP get_isSelected(boolean* isSelected) override;
+  STDMETHODIMP get_rowColumnExtents(long* row, long* column, long* rowExtents,
+                                    long* columnExtents,
+                                    boolean* isSelected) override;
+  STDMETHODIMP get_table(IUnknown** table) override;
+
+  // IAccessibleText
+  STDMETHODIMP addSelection(long startOffset, long endOffset) override;
+  STDMETHODIMP get_attributes(long offset, long* startOffset, long* endOffset,
+                              BSTR* textAttributes) override;
+  STDMETHODIMP get_caretOffset(long* offset) override;
+  STDMETHODIMP get_characterExtents(long offset,
+                                    enum IA2CoordinateType coordType, long* x,
+                                    long* y, long* width,
+                                    long* height) override;
+  STDMETHODIMP get_nSelections(long* nSelections) override;
+  STDMETHODIMP get_offsetAtPoint(long x, long y,
+                                 enum IA2CoordinateType coordType,
+                                 long* offset) override;
+  STDMETHODIMP get_selection(long selectionIndex, long* startOffset,
+                             long* endOffset) override;
+  STDMETHODIMP get_text(long startOffset, long endOffset, BSTR* text) override;
+  STDMETHODIMP get_textBeforeOffset(long offset,
+                                    enum IA2TextBoundaryType boundaryType,
+                                    long* startOffset, long* endOffset,
+                                    BSTR* text) override;
+  STDMETHODIMP get_textAfterOffset(long offset,
+                                   enum IA2TextBoundaryType boundaryType,
+                                   long* startOffset, long* endOffset,
+                                   BSTR* text) override;
+  STDMETHODIMP get_textAtOffset(long offset,
+                                enum IA2TextBoundaryType boundaryType,
+                                long* startOffset, long* endOffset,
+                                BSTR* text) override;
+  STDMETHODIMP removeSelection(long selectionIndex) override;
+  STDMETHODIMP setCaretOffset(long offset) override;
+  STDMETHODIMP setSelection(long selectionIndex, long startOffset,
+                            long endOffset) override;
+  STDMETHODIMP get_nCharacters(long* nCharacters) override;
+  STDMETHODIMP scrollSubstringTo(long startIndex, long endIndex,
+                                 enum IA2ScrollType scrollType) override;
+  STDMETHODIMP scrollSubstringToPoint(long startIndex, long endIndex,
+                                      enum IA2CoordinateType coordinateType,
+                                      long x, long y) override;
+  STDMETHODIMP get_newText(IA2TextSegment* newText) override;
+  STDMETHODIMP get_oldText(IA2TextSegment* oldText) override;
+
+  // IAccessibleHypertext
+  STDMETHODIMP get_nHyperlinks(long* hyperlinkCount) override;
+  STDMETHODIMP get_hyperlink(long index,
+                             IAccessibleHyperlink** hyperlink) override;
+  STDMETHODIMP get_hyperlinkIndex(long charIndex,
+                                  long* hyperlinkIndex) override;
+
+  // IAccessibleHypertext2
+  STDMETHODIMP get_hyperlinks(IAccessibleHyperlink*** hyperlinks,
+                              long* nHyperlinks) override;
+
+ private:
+  AccessibleHandler(IUnknown* aOuter, HRESULT* aResult);
+  virtual ~AccessibleHandler();
+
+  HRESULT ResolveIA2();
+  HRESULT ResolveIDispatch();
+  HRESULT ResolveIAHyperlink();
+  HRESULT ResolveIAHypertext();
+  HRESULT ResolveIATableCell();
+  HRESULT MaybeUpdateCachedData();
+  HRESULT GetAllTextInfo(BSTR* aText);
+  void ClearTextCache();
+  HRESULT GetRelationsInfo();
+  void ClearRelationCache();
+
+  RefPtr<IUnknown> mDispatchUnk;
+  /**
+   * Handlers aggregate their proxies. This means that their proxies delegate
+   * their IUnknown implementation to us.
+   *
+   * mDispatchUnk and the result of Handler::GetProxy() are both strong
+   * references to the aggregated objects. OTOH, any interfaces that are QI'd
+   * from those aggregated objects have delegated unknowns.
+   *
+   * AddRef'ing an interface with a delegated unknown ends up incrementing the
+   * refcount of the *aggregator*. Since we are the aggregator of mDispatchUnk
+   * and of the wrapped proxy, holding a strong reference to any interfaces
+   * QI'd off of those objects would create a reference cycle.
+   *
+   * We may hold onto pointers to those references, but when we query them we
+   * must immediately Release() them to prevent these cycles.
+   *
+   * It is safe for us to use these raw pointers because the aggregated
+   * objects's lifetimes are proper subsets of our own lifetime.
+   */
+  IDispatch* mDispatch;                         // weak
+  NEWEST_IA2_INTERFACE* mIA2PassThru;           // weak
+  IServiceProvider* mServProvPassThru;          // weak
+  IAccessibleHyperlink* mIAHyperlinkPassThru;   // weak
+  IAccessibleTableCell* mIATableCellPassThru;   // weak
+  IAccessibleHypertext2* mIAHypertextPassThru;  // weak
+  IA2Payload mCachedData;
+  bool mCachedDynamicDataMarshaledByCom;
+  UniquePtr<mscom::StructToStream> mSerializer;
+  uint32_t mCacheGen;
+  IAccessibleHyperlink** mCachedHyperlinks;
+  long mCachedNHyperlinks;
+  IA2TextSegment* mCachedTextAttribRuns;
+  long mCachedNTextAttribRuns;
+  IARelationData* mCachedRelations;
+  long mCachedNRelations;
+  bool mIsEmulatedWindow;
+};
+
+inline static BSTR CopyBSTR(BSTR aSrc) {
+  if (!aSrc) {
+    return nullptr;
+  }
+
+  return ::SysAllocStringLen(aSrc, ::SysStringLen(aSrc));
+}
+
+}  // namespace a11y
+}  // namespace mozilla
+
+#  endif  // !defined(MOZILLA_INTERNAL_API)
+
+#endif  // defined(__midl)
+
+#endif  // mozilla_a11y_AccessibleHandler_h
diff --git a/accessible/ipc/win/handler/AccessibleHandler.rc b/accessible/ipc/win/handler/AccessibleHandler.rc
new file mode 100644
index 0000000000..3dac2f89d5
--- /dev/null
+++ b/accessible/ipc/win/handler/AccessibleHandler.rc
@@ -0,0 +1,5 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+1 typelib HandlerData.tlb
diff --git a/accessible/ipc/win/handler/AccessibleHandlerControl.cpp b/accessible/ipc/win/handler/AccessibleHandlerControl.cpp
new file mode 100644
index 0000000000..24324c1b5e
--- /dev/null
+++ b/accessible/ipc/win/handler/AccessibleHandlerControl.cpp
@@ -0,0 +1,205 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#if defined(MOZILLA_INTERNAL_API)
+#  error This code is NOT for internal Gecko use!
+#endif  // defined(MOZILLA_INTERNAL_API)
+
+#include "AccessibleHandlerControl.h"
+
+#include <utility>
+
+#include "AccessibleEventId.h"
+#include "AccessibleHandler.h"
+#include "mozilla/RefPtr.h"
+
+namespace mozilla {
+namespace a11y {
+
+mscom::SingletonFactory<AccessibleHandlerControl> gControlFactory;
+
+namespace detail {
+
+TextChange::TextChange() : mIA2UniqueId(0), mIsInsert(false), mText() {}
+
+TextChange::TextChange(long aIA2UniqueId, bool aIsInsert,
+                       NotNull<IA2TextSegment*> aText)
+    : mIA2UniqueId(aIA2UniqueId),
+      mIsInsert(aIsInsert),
+      mText{BSTRCopy(aText->text), aText->start, aText->end} {}
+
+TextChange::TextChange(TextChange&& aOther) : mText() {
+  *this = std::move(aOther);
+}
+
+TextChange::TextChange(const TextChange& aOther) : mText() { *this = aOther; }
+
+TextChange& TextChange::operator=(TextChange&& aOther) {
+  mIA2UniqueId = aOther.mIA2UniqueId;
+  mIsInsert = aOther.mIsInsert;
+  aOther.mIA2UniqueId = 0;
+  ::SysFreeString(mText.text);
+  mText = aOther.mText;
+  aOther.mText.text = nullptr;
+  return *this;
+}
+
+TextChange& TextChange::operator=(const TextChange& aOther) {
+  mIA2UniqueId = aOther.mIA2UniqueId;
+  mIsInsert = aOther.mIsInsert;
+  ::SysFreeString(mText.text);
+  mText = {BSTRCopy(aOther.mText.text), aOther.mText.start, aOther.mText.end};
+  return *this;
+}
+
+TextChange::~TextChange() { ::SysFreeString(mText.text); }
+
+HRESULT
+TextChange::GetOld(long aIA2UniqueId, NotNull<IA2TextSegment*> aOutOldSegment) {
+  if (mIsInsert || aIA2UniqueId != mIA2UniqueId) {
+    return S_OK;
+  }
+
+  return SegCopy(*aOutOldSegment, mText);
+}
+
+HRESULT
+TextChange::GetNew(long aIA2UniqueId, NotNull<IA2TextSegment*> aOutNewSegment) {
+  if (!mIsInsert || aIA2UniqueId != mIA2UniqueId) {
+    return S_OK;
+  }
+
+  return SegCopy(*aOutNewSegment, mText);
+}
+
+/* static */
+BSTR TextChange::BSTRCopy(const BSTR& aIn) {
+  return ::SysAllocStringLen(aIn, ::SysStringLen(aIn));
+}
+
+/* static */
+HRESULT TextChange::SegCopy(IA2TextSegment& aDest, const IA2TextSegment& aSrc) {
+  aDest = {BSTRCopy(aSrc.text), aSrc.start, aSrc.end};
+  if (aSrc.text && !aDest.text) {
+    return E_OUTOFMEMORY;
+  }
+  if (!::SysStringLen(aDest.text)) {
+    return S_FALSE;
+  }
+  return S_OK;
+}
+
+}  // namespace detail
+
+HRESULT
+AccessibleHandlerControl::Create(AccessibleHandlerControl** aOutObject) {
+  if (!aOutObject) {
+    return E_INVALIDARG;
+  }
+
+  RefPtr<AccessibleHandlerControl> ctl(new AccessibleHandlerControl());
+  ctl.forget(aOutObject);
+  return S_OK;
+}
+
+AccessibleHandlerControl::AccessibleHandlerControl()
+    : mIsRegistered(false),
+      mCacheGen(0),
+      mIA2Proxy(mscom::RegisterProxy(L"ia2marshal.dll")),
+      mHandlerProxy(mscom::RegisterProxy()) {
+  MOZ_ASSERT(mIA2Proxy);
+}
+
+IMPL_IUNKNOWN1(AccessibleHandlerControl, IHandlerControl)
+
+HRESULT
+AccessibleHandlerControl::Invalidate() {
+  ++mCacheGen;
+  // We can't just call mAccessibleCache.clear() because doing so would release
+  // remote objects, making remote COM calls. Since this is an STA, an incoming
+  // COM call might be handled which might marshal an AccessibleHandler,
+  // which in turn might add itself to mAccessibleCache. Since we'd be in the
+  // middle of mutating mAccessibleCache, that might cause a crash. Instead,
+  // swap mAccessibleCache into a temporary map first, which will empty
+  // mAccessibleCache without releasing remote objects. Once mAccessibleCache
+  // is empty, it's safe to let the temporary map be destroyed when it goes
+  // out of scope. Remote calls will be made, but nothing will re-enter
+  // the temporary map while it's being destroyed.
+  AccessibleCache oldCache;
+  mAccessibleCache.swap(oldCache);
+  return S_OK;
+}
+
+HRESULT
+AccessibleHandlerControl::OnTextChange(long aHwnd, long aIA2UniqueId,
+                                       VARIANT_BOOL aIsInsert,
+                                       IA2TextSegment* aText) {
+  if (!aText) {
+    return E_INVALIDARG;
+  }
+
+  mTextChange = detail::TextChange(aIA2UniqueId, aIsInsert, WrapNotNull(aText));
+  NotifyWinEvent(aIsInsert ? IA2_EVENT_TEXT_INSERTED : IA2_EVENT_TEXT_REMOVED,
+                 reinterpret_cast<HWND>(static_cast<uintptr_t>(aHwnd)),
+                 OBJID_CLIENT, aIA2UniqueId);
+  return S_OK;
+}
+
+HRESULT
+AccessibleHandlerControl::GetNewText(long aIA2UniqueId,
+                                     NotNull<IA2TextSegment*> aOutNewText) {
+  return mTextChange.GetNew(aIA2UniqueId, aOutNewText);
+}
+
+HRESULT
+AccessibleHandlerControl::GetOldText(long aIA2UniqueId,
+                                     NotNull<IA2TextSegment*> aOutOldText) {
+  return mTextChange.GetOld(aIA2UniqueId, aOutOldText);
+}
+
+HRESULT
+AccessibleHandlerControl::GetHandlerTypeInfo(ITypeInfo** aOutTypeInfo) {
+  if (!mHandlerProxy) {
+    return E_UNEXPECTED;
+  }
+
+  return mHandlerProxy->GetTypeInfoForGuid(CLSID_AccessibleHandler,
+                                           aOutTypeInfo);
+}
+
+HRESULT
+AccessibleHandlerControl::Register(NotNull<IGeckoBackChannel*> aGecko) {
+  if (mIsRegistered) {
+    return S_OK;
+  }
+
+  long pid = static_cast<long>(::GetCurrentProcessId());
+  HRESULT hr = aGecko->put_HandlerControl(pid, this);
+  mIsRegistered = SUCCEEDED(hr);
+  MOZ_ASSERT(mIsRegistered);
+  return hr;
+}
+
+void AccessibleHandlerControl::CacheAccessible(long aUniqueId,
+                                               AccessibleHandler* aAccessible) {
+  MOZ_ASSERT(aUniqueId && aAccessible);
+  mAccessibleCache[aUniqueId] = aAccessible;
+}
+
+HRESULT AccessibleHandlerControl::GetCachedAccessible(
+    long aUniqueId, AccessibleHandler** aAccessible) {
+  MOZ_ASSERT(aUniqueId && aAccessible);
+  auto it = mAccessibleCache.find(aUniqueId);
+  if (it == mAccessibleCache.end()) {
+    return E_INVALIDARG;
+  }
+  RefPtr<AccessibleHandler> ref = it->second;
+  ref.forget(aAccessible);
+  return S_OK;
+}
+
+}  // namespace a11y
+}  // namespace mozilla
diff --git a/accessible/ipc/win/handler/AccessibleHandlerControl.h b/accessible/ipc/win/handler/AccessibleHandlerControl.h
new file mode 100644
index 0000000000..d016ecb98b
--- /dev/null
+++ b/accessible/ipc/win/handler/AccessibleHandlerControl.h
@@ -0,0 +1,97 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#if defined(MOZILLA_INTERNAL_API)
+#  error This code is NOT for internal Gecko use!
+#endif  // defined(MOZILLA_INTERNAL_API)
+
+#ifndef mozilla_a11y_AccessibleHandlerControl_h
+#  define mozilla_a11y_AccessibleHandlerControl_h
+
+#  include <unordered_map>
+#  include "Factory.h"
+#  include "HandlerData.h"
+#  include "IUnknownImpl.h"
+#  include "mozilla/mscom/Registration.h"
+#  include "mozilla/NotNull.h"
+
+namespace mozilla {
+namespace a11y {
+
+namespace detail {
+
+class TextChange final {
+ public:
+  TextChange();
+  TextChange(long aIA2UniqueId, bool aIsInsert, NotNull<IA2TextSegment*> aText);
+  TextChange(TextChange&& aOther);
+  TextChange(const TextChange& aOther);
+
+  TextChange& operator=(TextChange&& aOther);
+  TextChange& operator=(const TextChange& aOther);
+
+  ~TextChange();
+
+  HRESULT GetOld(long aIA2UniqueId, NotNull<IA2TextSegment*> aOutOldSegment);
+  HRESULT GetNew(long aIA2UniqueId, NotNull<IA2TextSegment*> aOutNewSegment);
+
+ private:
+  static BSTR BSTRCopy(const BSTR& aIn);
+  static HRESULT SegCopy(IA2TextSegment& aDest, const IA2TextSegment& aSrc);
+
+  long mIA2UniqueId;
+  bool mIsInsert;
+  IA2TextSegment mText;
+};
+
+}  // namespace detail
+
+class AccessibleHandler;
+
+class AccessibleHandlerControl final : public IHandlerControl {
+ public:
+  static HRESULT Create(AccessibleHandlerControl** aOutObject);
+
+  DECL_IUNKNOWN
+
+  // IHandlerControl
+  STDMETHODIMP Invalidate() override;
+  STDMETHODIMP OnTextChange(long aHwnd, long aIA2UniqueId,
+                            VARIANT_BOOL aIsInsert,
+                            IA2TextSegment* aText) override;
+
+  uint32_t GetCacheGen() const { return mCacheGen; }
+
+  HRESULT GetNewText(long aIA2UniqueId, NotNull<IA2TextSegment*> aOutNewText);
+  HRESULT GetOldText(long aIA2UniqueId, NotNull<IA2TextSegment*> aOutOldText);
+
+  HRESULT GetHandlerTypeInfo(ITypeInfo** aOutTypeInfo);
+
+  HRESULT Register(NotNull<IGeckoBackChannel*> aGecko);
+
+  void CacheAccessible(long aUniqueId, AccessibleHandler* aAccessible);
+  HRESULT GetCachedAccessible(long aUniqueId, AccessibleHandler** aAccessible);
+
+ private:
+  AccessibleHandlerControl();
+  ~AccessibleHandlerControl() = default;
+
+  bool mIsRegistered;
+  uint32_t mCacheGen;
+  detail::TextChange mTextChange;
+  UniquePtr<mscom::RegisteredProxy> mIA2Proxy;
+  UniquePtr<mscom::RegisteredProxy> mHandlerProxy;
+  // We can't use Gecko APIs in this dll, hence the use of std::unordered_map.
+  typedef std::unordered_map<long, RefPtr<AccessibleHandler>> AccessibleCache;
+  AccessibleCache mAccessibleCache;
+};
+
+extern mscom::SingletonFactory<AccessibleHandlerControl> gControlFactory;
+
+}  // namespace a11y
+}  // namespace mozilla
+
+#endif  // mozilla_a11y_AccessibleHandlerControl_h
diff --git a/accessible/ipc/win/handler/HandlerChildEnumerator.cpp b/accessible/ipc/win/handler/HandlerChildEnumerator.cpp
new file mode 100644
index 0000000000..2062387bf6
--- /dev/null
+++ b/accessible/ipc/win/handler/HandlerChildEnumerator.cpp
@@ -0,0 +1,170 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#if defined(MOZILLA_INTERNAL_API)
+#  error This code is NOT for internal Gecko use!
+#endif  // defined(MOZILLA_INTERNAL_API)
+
+#include "HandlerChildEnumerator.h"
+#include "HandlerTextLeaf.h"
+#include "mozilla/Assertions.h"
+
+namespace mozilla {
+namespace a11y {
+
+HandlerChildEnumerator::HandlerChildEnumerator(
+    AccessibleHandler* aHandler, IGeckoBackChannel* aGeckoBackChannel)
+    : mHandler(aHandler),
+      mGeckoBackChannel(aGeckoBackChannel),
+      mChildCount(0),
+      mNextChild(0) {
+  MOZ_ASSERT(aHandler);
+  MOZ_ASSERT(aGeckoBackChannel);
+}
+
+HandlerChildEnumerator::HandlerChildEnumerator(
+    const HandlerChildEnumerator& aEnumerator)
+    : mHandler(aEnumerator.mHandler),
+      mGeckoBackChannel(aEnumerator.mGeckoBackChannel),
+      mChildCount(aEnumerator.mChildCount),
+      mNextChild(aEnumerator.mNextChild) {
+  if (mChildCount == 0) {
+    return;
+  }
+  mChildren = MakeUnique<VARIANT[]>(mChildCount);
+  CopyMemory(mChildren.get(), aEnumerator.mChildren.get(),
+             sizeof(VARIANT) * mChildCount);
+  for (ULONG index = 0; index < mChildCount; ++index) {
+    mChildren[index].pdispVal->AddRef();
+  }
+}
+
+HandlerChildEnumerator::~HandlerChildEnumerator() { ClearCache(); }
+
+void HandlerChildEnumerator::ClearCache() {
+  if (!mChildren) {
+    return;
+  }
+
+  for (ULONG index = 0; index < mChildCount; ++index) {
+    mChildren[index].pdispVal->Release();
+  }
+
+  mChildren = nullptr;
+  mChildCount = 0;
+}
+
+HRESULT
+HandlerChildEnumerator::MaybeCacheChildren() {
+  if (mChildren) {
+    // Already cached.
+    return S_OK;
+  }
+
+  AccChildData* children;
+  HRESULT hr = mGeckoBackChannel->get_AllChildren(&children, &mChildCount);
+  if (FAILED(hr)) {
+    mChildCount = 0;
+    ClearCache();
+    return hr;
+  }
+
+  HWND hwnd = nullptr;
+  hr = mHandler->get_windowHandle(&hwnd);
+  MOZ_ASSERT(SUCCEEDED(hr));
+
+  RefPtr<IDispatch> parent;
+  hr = mHandler->QueryInterface(IID_IDispatch, getter_AddRefs(parent));
+  MOZ_ASSERT(SUCCEEDED(hr));
+
+  mChildren = MakeUnique<VARIANT[]>(mChildCount);
+  for (ULONG index = 0; index < mChildCount; ++index) {
+    AccChildData& data = children[index];
+    VARIANT& child = mChildren[index];
+    if (data.mAccessible) {
+      RefPtr<IDispatch> disp;
+      hr =
+          data.mAccessible->QueryInterface(IID_IDispatch, getter_AddRefs(disp));
+      data.mAccessible->Release();
+      MOZ_ASSERT(SUCCEEDED(hr));
+      if (FAILED(hr)) {
+        child.vt = VT_EMPTY;
+        continue;
+      }
+      child.vt = VT_DISPATCH;
+      disp.forget(&child.pdispVal);
+    } else {
+      // Text leaf.
+      RefPtr<IDispatch> leaf(new HandlerTextLeaf(parent, index, hwnd, data));
+      child.vt = VT_DISPATCH;
+      leaf.forget(&child.pdispVal);
+    }
+  }
+
+  ::CoTaskMemFree(children);
+  return S_OK;
+}
+
+IMPL_IUNKNOWN_QUERY_HEAD(HandlerChildEnumerator)
+IMPL_IUNKNOWN_QUERY_IFACE(IEnumVARIANT)
+IMPL_IUNKNOWN_QUERY_TAIL_AGGREGATED(mHandler)
+
+/*** IEnumVARIANT ***/
+
+HRESULT
+HandlerChildEnumerator::Clone(IEnumVARIANT** aPpEnum) {
+  RefPtr<HandlerChildEnumerator> newEnum(new HandlerChildEnumerator(*this));
+  newEnum.forget(aPpEnum);
+  return S_OK;
+}
+
+HRESULT
+HandlerChildEnumerator::Next(ULONG aCelt, VARIANT* aRgVar,
+                             ULONG* aPCeltFetched) {
+  if (!aRgVar || aCelt == 0) {
+    return E_INVALIDARG;
+  }
+
+  HRESULT hr = MaybeCacheChildren();
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  for (ULONG index = 0; index < aCelt; ++index) {
+    if (mNextChild >= mChildCount) {
+      // Less elements remaining than were requested.
+      if (aPCeltFetched) {
+        *aPCeltFetched = index;
+      }
+      return S_FALSE;
+    }
+    aRgVar[index] = mChildren[mNextChild];
+    aRgVar[index].pdispVal->AddRef();
+    ++mNextChild;
+  }
+  *aPCeltFetched = aCelt;
+  return S_OK;
+}
+
+HRESULT
+HandlerChildEnumerator::Reset() {
+  mNextChild = 0;
+  ClearCache();
+  return S_OK;
+}
+
+HRESULT
+HandlerChildEnumerator::Skip(ULONG aCelt) {
+  mNextChild += aCelt;
+  if (mNextChild > mChildCount) {
+    // Less elements remaining than the client requested to skip.
+    return S_FALSE;
+  }
+  return S_OK;
+}
+
+}  // namespace a11y
+}  // namespace mozilla
diff --git a/accessible/ipc/win/handler/HandlerChildEnumerator.h b/accessible/ipc/win/handler/HandlerChildEnumerator.h
new file mode 100644
index 0000000000..df0218c6ed
--- /dev/null
+++ b/accessible/ipc/win/handler/HandlerChildEnumerator.h
@@ -0,0 +1,51 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#if defined(MOZILLA_INTERNAL_API)
+#  error This code is NOT for internal Gecko use!
+#endif  // defined(MOZILLA_INTERNAL_API)
+
+#ifndef mozilla_a11y_HandlerChildEnumerator_h
+#  define mozilla_a11y_HandlerChildEnumerator_h
+
+#  include "AccessibleHandler.h"
+#  include "IUnknownImpl.h"
+#  include "mozilla/RefPtr.h"
+
+namespace mozilla {
+namespace a11y {
+
+class HandlerChildEnumerator final : public IEnumVARIANT {
+ public:
+  explicit HandlerChildEnumerator(AccessibleHandler* aHandler,
+                                  IGeckoBackChannel* aGeckoBackChannel);
+
+  DECL_IUNKNOWN
+
+  // IEnumVARIANT
+  STDMETHODIMP Clone(IEnumVARIANT** aPpEnum) override;
+  STDMETHODIMP Next(ULONG aCelt, VARIANT* aRgVar,
+                    ULONG* aPCeltFetched) override;
+  STDMETHODIMP Reset() override;
+  STDMETHODIMP Skip(ULONG aCelt) override;
+
+ private:
+  explicit HandlerChildEnumerator(const HandlerChildEnumerator& aEnumerator);
+  ~HandlerChildEnumerator();
+  void ClearCache();
+  HRESULT MaybeCacheChildren();
+
+  RefPtr<AccessibleHandler> mHandler;
+  RefPtr<IGeckoBackChannel> mGeckoBackChannel;
+  UniquePtr<VARIANT[]> mChildren;
+  ULONG mChildCount;
+  ULONG mNextChild;
+};
+
+}  // namespace a11y
+}  // namespace mozilla
+
+#endif  // mozilla_a11y_HandlerChildEnumerator_h
diff --git a/accessible/ipc/win/handler/HandlerData.acf b/accessible/ipc/win/handler/HandlerData.acf
new file mode 100644
index 0000000000..993240b063
--- /dev/null
+++ b/accessible/ipc/win/handler/HandlerData.acf
@@ -0,0 +1,11 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+[explicit_handle]
+interface HandlerData
+{
+  typedef [encode,decode] IA2Payload;
+}
diff --git a/accessible/ipc/win/handler/HandlerData.idl b/accessible/ipc/win/handler/HandlerData.idl
new file mode 100644
index 0000000000..06f6a8ac21
--- /dev/null
+++ b/accessible/ipc/win/handler/HandlerData.idl
@@ -0,0 +1,212 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla-config.h"
+#include "AccessibleHandler.h"
+
+import "ocidl.idl";
+import "servprov.idl";
+
+import "Accessible2_3.idl";
+import "AccessibleHypertext2.idl";
+import "AccessibleHyperlink.idl";
+import "AccessibleTable.idl";
+import "AccessibleTable2.idl";
+import "AccessibleTableCell.idl";
+
+typedef struct _StaticIA2Data
+{
+  NEWEST_IA2_INTERFACE* mIA2;
+  IAccessibleHypertext2* mIAHypertext;
+  IAccessibleHyperlink* mIAHyperlink;
+  IAccessibleTable* mIATable;
+  IAccessibleTable2* mIATable2;
+  IAccessibleTableCell* mIATableCell;
+} StaticIA2Data;
+
+typedef struct _DynamicIA2Data
+{
+  // From IAccessible/IAccessible2
+  VARIANT           mRole;
+  long              mState;
+  long              mChildCount;
+  long              mIA2Role;
+  AccessibleStates  mIA2States;
+  long              mLeft;
+  long              mTop;
+  long              mWidth;
+  long              mHeight;
+  long              mHwnd;
+  BSTR              mKeyboardShortcut;
+  BSTR              mName;
+  BSTR              mDescription;
+  BSTR              mDefaultAction;
+  BSTR              mValue;
+  BSTR              mAttributes;
+  IA2Locale         mIA2Locale;
+  // From IAccessibleAction
+  long              mNActions;
+  // From IAccessibleTableCell
+  long              mRowIndex;
+  long              mColumnIndex;
+  long              mRowExtent;
+  long              mColumnExtent;
+  boolean           mCellIsSelected;
+  long mNRowHeaderCells;
+  [size_is(mNRowHeaderCells)] long* mRowHeaderCellIds;
+  long mNColumnHeaderCells;
+  [size_is(mNColumnHeaderCells)] long* mColumnHeaderCellIds;
+  // From IAccessible2
+  long              mUniqueId;
+} DynamicIA2Data;
+
+interface IGeckoBackChannel;
+
+// We define different CLSIDs and IIDs depending on channel and officiality.
+// This prevents handlers from installing overtop one another when multiple
+// channels are present. Note that we do not do this for all UUIDs in this IDL,
+// just the ones that are written to the registry (coclass and interfaces that
+// have the [object] annotation)
+#if defined(USE_LOCAL_UUID)
+
+# if defined(DEBUG)
+
+// Local debug builds
+#  define HANDLER_CLSID 398ffd8d-5382-48f7-9e3b-19012762d39a
+#  define IHANDLERCONTROL_IID a218497e-8b10-460b-b668-a92b7ee39ff2
+#  define ASYNCIHANDLERCONTROL_IID ca18b9ab-04b6-41be-87f7-d99913d6a2e8
+#  define IGECKOBACKCHANNEL_IID 231c4946-4479-4c8e-aadc-8a0e48fc4c51
+
+# else
+
+// Local non-debug builds
+#  define HANDLER_CLSID ce573faf-7815-4fc2-a031-b092268ace9e
+#  define IHANDLERCONTROL_IID 2b715cce-1790-4fe1-aef5-48bb5acdf3a1
+#  define ASYNCIHANDLERCONTROL_IID 8e089670-4f57-41a7-89c0-37f17482fa6f
+#  define IGECKOBACKCHANNEL_IID 18e2488d-310f-400f-8339-0e50b513e801
+
+# endif
+
+#elif defined(NIGHTLY_BUILD)
+
+// Nightly Builds
+# define IHANDLERCONTROL_IID c57343fc-e011-40c2-b748-da82eabf0f1f
+# define ASYNCIHANDLERCONTROL_IID 648c92a1-ea35-46da-a806-6b55c6247373
+# define HANDLER_CLSID 4629216b-8753-41bf-9527-5bff51401671
+# define IGECKOBACKCHANNEL_IID e61e038d-40dd-464a-9aba-66b206b6911b
+
+#elif defined(USE_BETA_UUID)
+
+// Beta Builds
+# define IHANDLERCONTROL_IID 119149fa-d212-4f22-9517-082eecc1a084
+# define ASYNCIHANDLERCONTROL_IID 4e253d9b-59cf-4b32-a973-38bc85495d61
+# define HANDLER_CLSID 21e9f98d-a6c9-4cb5-b288-ae2fd2a96c58
+# define IGECKOBACKCHANNEL_IID 77b75c7d-d1c2-4469-864d-31aaebb67cc6
+
+#elif defined(RELEASE_OR_BETA)
+
+// Release Builds
+# define IHANDLERCONTROL_IID ce30f77e-8847-44f0-a648-a9656bd89c0d
+# define ASYNCIHANDLERCONTROL_IID dca8d857-1a63-4045-8f36-8809eb093d04
+# define HANDLER_CLSID 1baa303d-b4b9-45e5-9ccb-e3fca3e274b6
+# define IGECKOBACKCHANNEL_IID b32983ff-ef84-4945-8f86-fb7491b4f57b
+
+#else
+
+// Catch-all
+# define IHANDLERCONTROL_IID 3316ce35-f892-4832-97c5-06c52c03cdba
+# define ASYNCIHANDLERCONTROL_IID 15b48b76-ad38-4ad3-bd1a-d3c48a5a9947
+# define HANDLER_CLSID 4a195748-dca2-45fb-9295-0a139e76a9e7
+# define IGECKOBACKCHANNEL_IID dd2e4a89-999e-4d65-8b65-440c923ddb61
+
+#endif
+
+[uuid(2b0e83b3-fd1a-443f-9ed6-c00d39055b58)]
+interface HandlerData
+{
+  typedef struct _IA2Payload
+  {
+    StaticIA2Data mStaticData;
+    DynamicIA2Data mDynamicData;
+    IGeckoBackChannel* mGeckoBackChannel;
+  } IA2Payload;
+}
+
+[object,
+ uuid(IHANDLERCONTROL_IID),
+ async_uuid(ASYNCIHANDLERCONTROL_IID),
+ pointer_default(unique)]
+interface IHandlerControl : IUnknown
+{
+  HRESULT Invalidate();
+  HRESULT OnTextChange([in] long aHwnd, [in] long aIA2UniqueId,
+                       [in] VARIANT_BOOL aIsInsert,
+                       [in] IA2TextSegment* aText);
+}
+
+typedef struct _IARelationData
+{
+  BSTR mType;
+  long mNTargets;
+} IARelationData;
+
+typedef struct _AccChildData
+{
+  NEWEST_IA2_INTERFACE* mAccessible;
+  BSTR mText;
+  long mTextRole;
+  long mTextId;
+  long mTextState;
+  long mTextLeft;
+  long mTextTop;
+  long mTextWidth;
+  long mTextHeight;
+} AccChildData;
+
+[object,
+ uuid(IGECKOBACKCHANNEL_IID),
+ pointer_default(unique)]
+interface IGeckoBackChannel : IUnknown
+{
+  [propput] HRESULT HandlerControl([in] long aPid, [in] IHandlerControl* aCtrl);
+  HRESULT Refresh([out] DynamicIA2Data* aOutData);
+  [propget] HRESULT AllTextInfo([out] BSTR* aText,
+    [out, size_is(,*aNHyperlinks)] IAccessibleHyperlink*** aHyperlinks,
+    [out] long* aNHyperlinks,
+    [out, size_is(,*aNAttribRuns)] IA2TextSegment** aAttribRuns,
+    [out] long* aNAttribRuns);
+  [propget] HRESULT RelationsInfo(
+    [out, size_is(,*aNRelations)] IARelationData** aRelations,
+    [out] long* aNRelations);
+  [propget] HRESULT AllChildren(
+    [out, size_is(,*aNChildren)] AccChildData** aChildren,
+    [out] ULONG* aNChildren);
+}
+
+[uuid(1e545f07-f108-4912-9471-546827a80983)]
+library AccessibleHandlerTypeLib
+{
+  importlib("stdole2.tlb");
+
+  /**
+   * This definition is required in order for the handler implementation to
+   * support IDispatch (aka Automation). This is used by interpreted language
+   * FFIs to discover which interfaces may be controlled via IDispatch.
+   * (In particular, the python FFI used by NVDA needs this).
+   *
+   * In reality, the only a11y interface that is Automation compliant is
+   * IAccessible; our remaining interfaces are not.
+   *
+   * Once the FFI knows that IAccessible is supported, the FFI queries for
+   * IAccessible and is then able to resolve non-automation interfaces from
+   * there.
+   */
+  [uuid(HANDLER_CLSID)]
+  coclass AccessibleHandler
+  {
+    [default] interface IAccessible;
+  };
+};
diff --git a/accessible/ipc/win/handler/HandlerDataCleanup.h b/accessible/ipc/win/handler/HandlerDataCleanup.h
new file mode 100644
index 0000000000..14d9995c19
--- /dev/null
+++ b/accessible/ipc/win/handler/HandlerDataCleanup.h
@@ -0,0 +1,95 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_a11y_HandlerDataCleanup_h
+#define mozilla_a11y_HandlerDataCleanup_h
+
+#include <oleauto.h>
+
+namespace mozilla {
+namespace a11y {
+
+inline void ReleaseStaticIA2DataInterfaces(StaticIA2Data& aData) {
+  // Only interfaces of the proxied object wrapped by this handler should be
+  // released here, never other objects!
+  // For example, if StaticIA2Data were to include accParent in future,
+  // that must not be released here.
+  if (aData.mIA2) {
+    aData.mIA2->Release();
+  }
+  if (aData.mIAHypertext) {
+    aData.mIAHypertext->Release();
+  }
+  if (aData.mIAHyperlink) {
+    aData.mIAHyperlink->Release();
+  }
+  if (aData.mIATable) {
+    aData.mIATable->Release();
+  }
+  if (aData.mIATable2) {
+    aData.mIATable2->Release();
+  }
+  if (aData.mIATableCell) {
+    aData.mIATableCell->Release();
+  }
+}
+
+/**
+ * Pass true for aMarshaledByCom  if this struct was directly marshaled as an
+ * out parameter of a COM method, currently only IGeckoBackChannel::Refresh.
+ */
+inline void CleanupDynamicIA2Data(DynamicIA2Data& aData,
+                                  bool aMarshaledByCom = false) {
+  // If freeing generic memory returned to the client, you *must* use freeMem,
+  // not CoTaskMemFree!
+  auto freeMem = [aMarshaledByCom](void* aMem) {
+    if (aMarshaledByCom) {
+      ::CoTaskMemFree(aMem);
+    } else {
+      ::midl_user_free(aMem);
+    }
+  };
+
+  ::VariantClear(&aData.mRole);
+  if (aData.mKeyboardShortcut) {
+    ::SysFreeString(aData.mKeyboardShortcut);
+  }
+  if (aData.mName) {
+    ::SysFreeString(aData.mName);
+  }
+  if (aData.mDescription) {
+    ::SysFreeString(aData.mDescription);
+  }
+  if (aData.mDefaultAction) {
+    ::SysFreeString(aData.mDefaultAction);
+  }
+  if (aData.mValue) {
+    ::SysFreeString(aData.mValue);
+  }
+  if (aData.mAttributes) {
+    ::SysFreeString(aData.mAttributes);
+  }
+  if (aData.mIA2Locale.language) {
+    ::SysFreeString(aData.mIA2Locale.language);
+  }
+  if (aData.mIA2Locale.country) {
+    ::SysFreeString(aData.mIA2Locale.country);
+  }
+  if (aData.mIA2Locale.variant) {
+    ::SysFreeString(aData.mIA2Locale.variant);
+  }
+  if (aData.mRowHeaderCellIds) {
+    freeMem(aData.mRowHeaderCellIds);
+  }
+  if (aData.mColumnHeaderCellIds) {
+    freeMem(aData.mColumnHeaderCellIds);
+  }
+}
+
+}  // namespace a11y
+}  // namespace mozilla
+
+#endif  // mozilla_a11y_HandlerDataCleanup_h
diff --git a/accessible/ipc/win/handler/HandlerRelation.cpp b/accessible/ipc/win/handler/HandlerRelation.cpp
new file mode 100644
index 0000000000..8e03da5360
--- /dev/null
+++ b/accessible/ipc/win/handler/HandlerRelation.cpp
@@ -0,0 +1,138 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#if defined(MOZILLA_INTERNAL_API)
+#  error This code is NOT for internal Gecko use!
+#endif  // defined(MOZILLA_INTERNAL_API)
+
+#include "HandlerRelation.h"
+#include "mozilla/Assertions.h"
+
+#include "AccessibleRelation_i.c"
+
+namespace mozilla {
+namespace a11y {
+
+HandlerRelation::HandlerRelation(AccessibleHandler* aHandler,
+                                 IARelationData& aData)
+    : mHandler(aHandler), mData(aData), mTargets(nullptr) {
+  // This instance now owns any pointers, so ensure no one else can
+  // manipulate them.
+  aData.mType = nullptr;
+}
+
+HandlerRelation::~HandlerRelation() {
+  if (mData.mType) {
+    ::SysFreeString(mData.mType);
+  }
+
+  if (mTargets) {
+    for (long index = 0; index < mData.mNTargets; ++index) {
+      mTargets[index]->Release();
+    }
+    ::CoTaskMemFree(mTargets);
+    mTargets = nullptr;
+  }
+}
+
+HRESULT
+HandlerRelation::GetTargets() {
+  if (mTargets) {
+    // Already cached.
+    return S_OK;
+  }
+
+  // Marshaling all of the IAccessibleRelation objects across processes is
+  // slow, and the client probably only wants targets for a few of them.
+  // Therefore, we just use IAccessible2_2::relationTargetsOfType, passing
+  // the type we have cached. This is a bit inefficient because Gecko has
+  // to look up the relation twice, but it's significantly faster than
+  // marshaling the relation objects regardless.
+  return mHandler->get_relationTargetsOfType(mData.mType, 0, &mTargets,
+                                             &mData.mNTargets);
+}
+
+IMPL_IUNKNOWN1(HandlerRelation, IAccessibleRelation)
+
+/*** IAccessibleRelation ***/
+
+HRESULT
+HandlerRelation::get_relationType(BSTR* aType) {
+  if (!aType) {
+    return E_INVALIDARG;
+  }
+  if (!mData.mType) {
+    return E_FAIL;
+  }
+  *aType = CopyBSTR(mData.mType);
+  return S_OK;
+}
+
+HRESULT
+HandlerRelation::get_localizedRelationType(BSTR* aLocalizedType) {
+  // This is not implemented as per ia2AccessibleRelation.
+  return E_NOTIMPL;
+}
+
+HRESULT
+HandlerRelation::get_nTargets(long* aNTargets) {
+  if (!aNTargets) {
+    return E_INVALIDARG;
+  }
+  if (mData.mNTargets == -1) {
+    return E_FAIL;
+  }
+  *aNTargets = mData.mNTargets;
+  return S_OK;
+}
+
+HRESULT
+HandlerRelation::get_target(long aIndex, IUnknown** aTarget) {
+  if (!aTarget) {
+    return E_INVALIDARG;
+  }
+
+  HRESULT hr = GetTargets();
+  if (FAILED(hr)) {
+    return hr;
+  }
+  if (aIndex >= mData.mNTargets) {
+    return E_INVALIDARG;
+  }
+
+  *aTarget = mTargets[aIndex];
+  (*aTarget)->AddRef();
+  return S_OK;
+}
+
+HRESULT
+HandlerRelation::get_targets(long aMaxTargets, IUnknown** aTargets,
+                             long* aNTargets) {
+  if (aMaxTargets == 0 || !aTargets || !aNTargets) {
+    return E_INVALIDARG;
+  }
+
+  HRESULT hr = GetTargets();
+  if (FAILED(hr)) {
+    return hr;
+  }
+
+  if (mData.mNTargets > aMaxTargets) {
+    // Don't give back more targets than were requested.
+    *aNTargets = aMaxTargets;
+  } else {
+    *aNTargets = mData.mNTargets;
+  }
+
+  for (long index = 0; index < *aNTargets; ++index) {
+    aTargets[index] = mTargets[index];
+    aTargets[index]->AddRef();
+  }
+  return S_OK;
+}
+
+}  // namespace a11y
+}  // namespace mozilla
diff --git a/accessible/ipc/win/handler/HandlerRelation.h b/accessible/ipc/win/handler/HandlerRelation.h
new file mode 100644
index 0000000000..e25b4ee189
--- /dev/null
+++ b/accessible/ipc/win/handler/HandlerRelation.h
@@ -0,0 +1,46 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#if defined(MOZILLA_INTERNAL_API)
+#  error This code is NOT for internal Gecko use!
+#endif  // defined(MOZILLA_INTERNAL_API)
+
+#ifndef mozilla_a11y_HandlerRelation_h
+#  define mozilla_a11y_HandlerRelation_h
+
+#  include "AccessibleHandler.h"
+#  include "IUnknownImpl.h"
+#  include "mozilla/RefPtr.h"
+
+namespace mozilla {
+namespace a11y {
+
+class HandlerRelation final : public IAccessibleRelation {
+ public:
+  explicit HandlerRelation(AccessibleHandler* aHandler, IARelationData& aData);
+
+  DECL_IUNKNOWN
+
+  // IAccessibleRelation
+  STDMETHODIMP get_relationType(BSTR* aType) override;
+  STDMETHODIMP get_localizedRelationType(BSTR* aLocalizedType) override;
+  STDMETHODIMP get_nTargets(long* aNTargets) override;
+  STDMETHODIMP get_target(long aIndex, IUnknown** aTarget) override;
+  STDMETHODIMP get_targets(long aMaxTargets, IUnknown** aTargets,
+                           long* aNTargets) override;
+
+ private:
+  virtual ~HandlerRelation();
+  HRESULT GetTargets();
+  RefPtr<AccessibleHandler> mHandler;
+  IARelationData mData;
+  IUnknown** mTargets;
+};
+
+}  // namespace a11y
+}  // namespace mozilla
+
+#endif  // mozilla_a11y_HandlerRelation_h
diff --git a/accessible/ipc/win/handler/HandlerTextLeaf.cpp b/accessible/ipc/win/handler/HandlerTextLeaf.cpp
new file mode 100644
index 0000000000..730aa88df9
--- /dev/null
+++ b/accessible/ipc/win/handler/HandlerTextLeaf.cpp
@@ -0,0 +1,337 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#if defined(MOZILLA_INTERNAL_API)
+#  error This code is NOT for internal Gecko use!
+#endif  // defined(MOZILLA_INTERNAL_API)
+
+#include "HandlerTextLeaf.h"
+#include "mozilla/Assertions.h"
+
+namespace mozilla {
+namespace a11y {
+
+HandlerTextLeaf::HandlerTextLeaf(IDispatch* aParent, long aIndexInParent,
+                                 HWND aHwnd, AccChildData& aData)
+    : mParent(aParent),
+      mIndexInParent(aIndexInParent),
+      mHwnd(aHwnd),
+      mData(aData) {
+  MOZ_ASSERT(aParent);
+}
+
+HandlerTextLeaf::~HandlerTextLeaf() {
+  if (mData.mText) {
+    ::SysFreeString(mData.mText);
+  }
+}
+
+IMPL_IUNKNOWN_QUERY_HEAD(HandlerTextLeaf)
+IMPL_IUNKNOWN_QUERY_IFACE(IDispatch)
+IMPL_IUNKNOWN_QUERY_IFACE(IAccessible)
+IMPL_IUNKNOWN_QUERY_IFACE(IAccessible2)
+IMPL_IUNKNOWN_QUERY_IFACE(IServiceProvider)
+IMPL_IUNKNOWN_QUERY_TAIL
+
+/*** IDispatch ***/
+
+HRESULT
+HandlerTextLeaf::GetTypeInfoCount(UINT* pctinfo) { return E_NOTIMPL; }
+
+HRESULT
+HandlerTextLeaf::GetTypeInfo(UINT iTInfo, LCID lcid, ITypeInfo** ppTInfo) {
+  return E_NOTIMPL;
+}
+
+HRESULT
+HandlerTextLeaf::GetIDsOfNames(REFIID riid, LPOLESTR* rgszNames, UINT cNames,
+                               LCID lcid, DISPID* rgDispId) {
+  return E_NOTIMPL;
+}
+
+HRESULT
+HandlerTextLeaf::Invoke(DISPID dispIdMember, REFIID riid, LCID lcid,
+                        WORD wFlags, DISPPARAMS* pDispParams,
+                        VARIANT* pVarResult, EXCEPINFO* pExcepInfo,
+                        UINT* puArgErr) {
+  return E_NOTIMPL;
+}
+
+/*** IAccessible ***/
+
+HRESULT
+HandlerTextLeaf::get_accParent(IDispatch** ppdispParent) {
+  if (!ppdispParent) {
+    return E_INVALIDARG;
+  }
+
+  RefPtr<IDispatch> parent(mParent);
+  parent.forget(ppdispParent);
+  return S_OK;
+}
+
+HRESULT
+HandlerTextLeaf::get_accChildCount(long* pcountChildren) {
+  if (!pcountChildren) {
+    return E_INVALIDARG;
+  }
+
+  *pcountChildren = 0;
+  return S_OK;
+}
+
+HRESULT
+HandlerTextLeaf::get_accChild(VARIANT varChild, IDispatch** ppdispChild) {
+  return E_NOTIMPL;
+}
+
+HRESULT
+HandlerTextLeaf::get_accName(VARIANT varChild, BSTR* pszName) {
+  if (varChild.lVal != CHILDID_SELF || !pszName) {
+    return E_INVALIDARG;
+  }
+
+  *pszName = CopyBSTR(mData.mText);
+  return S_OK;
+}
+
+HRESULT
+HandlerTextLeaf::get_accValue(VARIANT varChild, BSTR* pszValue) {
+  return E_NOTIMPL;
+}
+
+HRESULT
+HandlerTextLeaf::get_accDescription(VARIANT varChild, BSTR* pszDescription) {
+  return E_NOTIMPL;
+}
+
+HRESULT
+HandlerTextLeaf::get_accRole(VARIANT varChild, VARIANT* pvarRole) {
+  if (varChild.lVal != CHILDID_SELF || !pvarRole) {
+    return E_INVALIDARG;
+  }
+
+  pvarRole->vt = VT_I4;
+  pvarRole->lVal = mData.mTextRole;
+  return S_OK;
+}
+
+HRESULT
+HandlerTextLeaf::get_accState(VARIANT varChild, VARIANT* pvarState) {
+  if (varChild.lVal != CHILDID_SELF || !pvarState) {
+    return E_INVALIDARG;
+  }
+
+  pvarState->vt = VT_I4;
+  pvarState->lVal = mData.mTextState;
+  return S_OK;
+}
+
+HRESULT
+HandlerTextLeaf::get_accHelp(VARIANT varChild, BSTR* pszHelp) {
+  return E_NOTIMPL;
+}
+
+HRESULT
+HandlerTextLeaf::get_accHelpTopic(BSTR* pszHelpFile, VARIANT varChild,
+                                  long* pidTopic) {
+  return E_NOTIMPL;
+}
+
+HRESULT
+HandlerTextLeaf::get_accKeyboardShortcut(VARIANT varChild,
+                                         BSTR* pszKeyboardShortcut) {
+  return E_NOTIMPL;
+}
+
+HRESULT
+HandlerTextLeaf::get_accFocus(VARIANT* pvarChild) { return E_NOTIMPL; }
+
+HRESULT
+HandlerTextLeaf::get_accSelection(VARIANT* pvarChildren) { return E_NOTIMPL; }
+
+HRESULT
+HandlerTextLeaf::get_accDefaultAction(VARIANT varChild,
+                                      BSTR* pszDefaultAction) {
+  return E_NOTIMPL;
+}
+
+HRESULT
+HandlerTextLeaf::accSelect(long flagsSelect, VARIANT varChild) {
+  return E_NOTIMPL;
+}
+
+HRESULT
+HandlerTextLeaf::accLocation(long* pxLeft, long* pyTop, long* pcxWidth,
+                             long* pcyHeight, VARIANT varChild) {
+  if (varChild.lVal != CHILDID_SELF || !pxLeft || !pyTop || !pcxWidth ||
+      !pcyHeight) {
+    return E_INVALIDARG;
+  }
+
+  *pxLeft = mData.mTextLeft;
+  *pyTop = mData.mTextTop;
+  *pcxWidth = mData.mTextWidth;
+  *pcyHeight = mData.mTextHeight;
+  return S_OK;
+}
+
+HRESULT
+HandlerTextLeaf::accNavigate(long navDir, VARIANT varStart,
+                             VARIANT* pvarEndUpAt) {
+  return E_NOTIMPL;
+}
+
+HRESULT
+HandlerTextLeaf::accHitTest(long xLeft, long yTop, VARIANT* pvarChild) {
+  return E_NOTIMPL;
+}
+
+HRESULT
+HandlerTextLeaf::accDoDefaultAction(VARIANT varChild) { return E_NOTIMPL; }
+
+HRESULT
+HandlerTextLeaf::put_accName(VARIANT varChild, BSTR szName) {
+  return E_NOTIMPL;
+}
+
+HRESULT
+HandlerTextLeaf::put_accValue(VARIANT varChild, BSTR szValue) {
+  return E_NOTIMPL;
+}
+
+/*** IAccessible2 ***/
+
+HRESULT
+HandlerTextLeaf::get_nRelations(long* nRelations) { return E_NOTIMPL; }
+
+HRESULT
+HandlerTextLeaf::get_relation(long relationIndex,
+                              IAccessibleRelation** relation) {
+  return E_NOTIMPL;
+}
+
+HRESULT
+HandlerTextLeaf::get_relations(long maxRelations,
+                               IAccessibleRelation** relations,
+                               long* nRelations) {
+  return E_NOTIMPL;
+}
+
+HRESULT
+HandlerTextLeaf::role(long* role) {
+  if (!role) {
+    return E_INVALIDARG;
+  }
+
+  *role = mData.mTextRole;
+  return S_OK;
+}
+
+HRESULT
+HandlerTextLeaf::scrollTo(IA2ScrollType scrollType) { return E_NOTIMPL; }
+
+HRESULT
+HandlerTextLeaf::scrollToPoint(IA2CoordinateType coordinateType, long x,
+                               long y) {
+  return E_NOTIMPL;
+}
+
+HRESULT
+HandlerTextLeaf::get_groupPosition(long* groupLevel, long* similarItemsInGroup,
+                                   long* positionInGroup) {
+  return E_NOTIMPL;
+}
+
+HRESULT
+HandlerTextLeaf::get_states(AccessibleStates* states) {
+  if (!states) {
+    return E_INVALIDARG;
+  }
+
+  *states = 0;
+  return S_OK;
+}
+
+HRESULT
+HandlerTextLeaf::get_extendedRole(BSTR* extendedRole) { return E_NOTIMPL; }
+
+HRESULT
+HandlerTextLeaf::get_localizedExtendedRole(BSTR* localizedExtendedRole) {
+  return E_NOTIMPL;
+}
+
+HRESULT
+HandlerTextLeaf::get_nExtendedStates(long* nExtendedStates) {
+  return E_NOTIMPL;
+}
+
+HRESULT
+HandlerTextLeaf::get_extendedStates(long maxExtendedStates,
+                                    BSTR** extendedStates,
+                                    long* nExtendedStates) {
+  return E_NOTIMPL;
+}
+
+HRESULT
+HandlerTextLeaf::get_localizedExtendedStates(long maxLocalizedExtendedStates,
+                                             BSTR** localizedExtendedStates,
+                                             long* nLocalizedExtendedStates) {
+  return E_NOTIMPL;
+}
+
+HRESULT
+HandlerTextLeaf::get_uniqueID(long* uniqueID) {
+  if (!uniqueID) {
+    return E_INVALIDARG;
+  }
+
+  *uniqueID = mData.mTextId;
+  return S_OK;
+}
+
+HRESULT
+HandlerTextLeaf::get_windowHandle(HWND* windowHandle) {
+  if (!windowHandle) {
+    return E_INVALIDARG;
+  }
+
+  *windowHandle = mHwnd;
+  return S_OK;
+}
+
+HRESULT
+HandlerTextLeaf::get_indexInParent(long* indexInParent) {
+  if (!indexInParent) {
+    return E_INVALIDARG;
+  }
+
+  *indexInParent = mIndexInParent;
+  return S_OK;
+}
+
+HRESULT
+HandlerTextLeaf::get_locale(IA2Locale* locale) { return E_NOTIMPL; }
+
+HRESULT
+HandlerTextLeaf::get_attributes(BSTR* attributes) { return E_NOTIMPL; }
+
+/*** IServiceProvider ***/
+
+HRESULT
+HandlerTextLeaf::QueryService(REFGUID aServiceId, REFIID aIid,
+                              void** aOutInterface) {
+  if (aIid == IID_IAccessible2) {
+    RefPtr<IAccessible2> ia2(this);
+    ia2.forget(aOutInterface);
+    return S_OK;
+  }
+
+  return E_INVALIDARG;
+}
+
+}  // namespace a11y
+}  // namespace mozilla
diff --git a/accessible/ipc/win/handler/HandlerTextLeaf.h b/accessible/ipc/win/handler/HandlerTextLeaf.h
new file mode 100644
index 0000000000..f1a31b9219
--- /dev/null
+++ b/accessible/ipc/win/handler/HandlerTextLeaf.h
@@ -0,0 +1,110 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#if defined(MOZILLA_INTERNAL_API)
+#  error This code is NOT for internal Gecko use!
+#endif  // defined(MOZILLA_INTERNAL_API)
+
+#ifndef mozilla_a11y_HandlerTextLeaf_h
+#  define mozilla_a11y_HandlerTextLeaf_h
+
+#  include "AccessibleHandler.h"
+#  include "IUnknownImpl.h"
+#  include "mozilla/RefPtr.h"
+
+namespace mozilla {
+namespace a11y {
+
+class HandlerTextLeaf final : public IAccessible2, public IServiceProvider {
+ public:
+  explicit HandlerTextLeaf(IDispatch* aParent, long aIndexInParent, HWND aHwnd,
+                           AccChildData& aData);
+
+  DECL_IUNKNOWN
+
+  // IDispatch
+  STDMETHODIMP GetTypeInfoCount(UINT* pctinfo) override;
+  STDMETHODIMP GetTypeInfo(UINT iTInfo, LCID lcid,
+                           ITypeInfo** ppTInfo) override;
+  STDMETHODIMP GetIDsOfNames(REFIID riid, LPOLESTR* rgszNames, UINT cNames,
+                             LCID lcid, DISPID* rgDispId) override;
+  STDMETHODIMP Invoke(DISPID dispIdMember, REFIID riid, LCID lcid, WORD wFlags,
+                      DISPPARAMS* pDispParams, VARIANT* pVarResult,
+                      EXCEPINFO* pExcepInfo, UINT* puArgErr) override;
+
+  // IAccessible
+  STDMETHODIMP get_accParent(IDispatch** ppdispParent) override;
+  STDMETHODIMP get_accChildCount(long* pcountChildren) override;
+  STDMETHODIMP get_accChild(VARIANT varChild, IDispatch** ppdispChild) override;
+  STDMETHODIMP get_accName(VARIANT varChild, BSTR* pszName) override;
+  STDMETHODIMP get_accValue(VARIANT varChild, BSTR* pszValue) override;
+  STDMETHODIMP get_accDescription(VARIANT varChild,
+                                  BSTR* pszDescription) override;
+  STDMETHODIMP get_accRole(VARIANT varChild, VARIANT* pvarRole) override;
+  STDMETHODIMP get_accState(VARIANT varChild, VARIANT* pvarState) override;
+  STDMETHODIMP get_accHelp(VARIANT varChild, BSTR* pszHelp) override;
+  STDMETHODIMP get_accHelpTopic(BSTR* pszHelpFile, VARIANT varChild,
+                                long* pidTopic) override;
+  STDMETHODIMP get_accKeyboardShortcut(VARIANT varChild,
+                                       BSTR* pszKeyboardShortcut) override;
+  STDMETHODIMP get_accFocus(VARIANT* pvarChild) override;
+  STDMETHODIMP get_accSelection(VARIANT* pvarChildren) override;
+  STDMETHODIMP get_accDefaultAction(VARIANT varChild,
+                                    BSTR* pszDefaultAction) override;
+  STDMETHODIMP accSelect(long flagsSelect, VARIANT varChild) override;
+  STDMETHODIMP accLocation(long* pxLeft, long* pyTop, long* pcxWidth,
+                           long* pcyHeight, VARIANT varChild) override;
+  STDMETHODIMP accNavigate(long navDir, VARIANT varStart,
+                           VARIANT* pvarEndUpAt) override;
+  STDMETHODIMP accHitTest(long xLeft, long yTop, VARIANT* pvarChild) override;
+  STDMETHODIMP accDoDefaultAction(VARIANT varChild) override;
+  STDMETHODIMP put_accName(VARIANT varChild, BSTR szName) override;
+  STDMETHODIMP put_accValue(VARIANT varChild, BSTR szValue) override;
+
+  // IAccessible2
+  STDMETHODIMP get_nRelations(long* nRelations) override;
+  STDMETHODIMP get_relation(long relationIndex,
+                            IAccessibleRelation** relation) override;
+  STDMETHODIMP get_relations(long maxRelations, IAccessibleRelation** relations,
+                             long* nRelations) override;
+  STDMETHODIMP role(long* role) override;
+  STDMETHODIMP scrollTo(IA2ScrollType scrollType) override;
+  STDMETHODIMP scrollToPoint(IA2CoordinateType coordinateType, long x,
+                             long y) override;
+  STDMETHODIMP get_groupPosition(long* groupLevel, long* similarItemsInGroup,
+                                 long* positionInGroup) override;
+  STDMETHODIMP get_states(AccessibleStates* states) override;
+  STDMETHODIMP get_extendedRole(BSTR* extendedRole) override;
+  STDMETHODIMP get_localizedExtendedRole(BSTR* localizedExtendedRole) override;
+  STDMETHODIMP get_nExtendedStates(long* nExtendedStates) override;
+  STDMETHODIMP get_extendedStates(long maxExtendedStates, BSTR** extendedStates,
+                                  long* nExtendedStates) override;
+  STDMETHODIMP get_localizedExtendedStates(
+      long maxLocalizedExtendedStates, BSTR** localizedExtendedStates,
+      long* nLocalizedExtendedStates) override;
+  STDMETHODIMP get_uniqueID(long* uniqueID) override;
+  STDMETHODIMP get_windowHandle(HWND* windowHandle) override;
+  STDMETHODIMP get_indexInParent(long* indexInParent) override;
+  STDMETHODIMP get_locale(IA2Locale* locale) override;
+  STDMETHODIMP get_attributes(BSTR* attributes) override;
+
+  // IServiceProvider
+  STDMETHODIMP QueryService(REFGUID aServiceId, REFIID aIid,
+                            void** aOutInterface) override;
+
+ private:
+  ~HandlerTextLeaf();
+
+  RefPtr<IDispatch> mParent;
+  long mIndexInParent;
+  HWND mHwnd;
+  AccChildData mData;
+};
+
+}  // namespace a11y
+}  // namespace mozilla
+
+#endif  // mozilla_a11y_HandlerTextLeaf_h
diff --git a/accessible/ipc/win/handler/moz.build b/accessible/ipc/win/handler/moz.build
new file mode 100644
index 0000000000..46f3cb95a4
--- /dev/null
+++ b/accessible/ipc/win/handler/moz.build
@@ -0,0 +1,128 @@
+# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+SharedLibrary("AccessibleHandler")
+
+EXPORTS.mozilla.a11y += [
+    "AccessibleHandler.h",
+    "HandlerDataCleanup.h",
+]
+
+LOCAL_INCLUDES += [
+    "/accessible/interfaces/ia2",
+    "/ipc/mscom/oop",
+]
+
+# We want to generate distinct UUIDs on a per-channel basis, so we need
+# finer granularity than the standard preprocessor definitions offer.
+# These defines allow us to separate local builds from automated builds,
+# as well as separate beta from release.
+flags = []
+if CONFIG["MOZ_UPDATE_CHANNEL"] == "default":
+    flags += ["-DUSE_LOCAL_UUID"]
+elif CONFIG["MOZ_UPDATE_CHANNEL"] == "beta":
+    flags += ["-DUSE_BETA_UUID"]
+
+GeneratedFile(
+    "HandlerData.h",
+    "HandlerData_p.c",
+    "HandlerData_i.c",
+    "HandlerData_c.c",
+    "HandlerData_dlldata.c",
+    "HandlerData.tlb",
+    inputs=["HandlerData.idl"],
+    script="/build/midl.py",
+    entry_point="midl",
+    flags=flags
+    + [
+        "-I",
+        TOPOBJDIR,
+        "-I",
+        TOPOBJDIR + "/dist/include",
+        "-I",
+        TOPSRCDIR + "/other-licenses/ia2",
+        "-I",
+        SRCDIR,
+        "-acf",
+        SRCDIR + "/HandlerData.acf",
+        "-dlldata",
+        OBJDIR + "/HandlerData_dlldata.c",
+    ],
+)
+
+SOURCES += [
+    "!HandlerData_c.c",
+    "!HandlerData_dlldata.c",
+    "!HandlerData_i.c",
+    "!HandlerData_p.c",
+    "AccessibleHandler.cpp",
+    "AccessibleHandlerControl.cpp",
+    "HandlerChildEnumerator.cpp",
+    "HandlerRelation.cpp",
+    "HandlerTextLeaf.cpp",
+]
+
+EXPORTS += [
+    "!HandlerData.h",
+    "!HandlerData_i.c",
+]
+
+# Give some symbols a unique name in each translation unit, to avoid
+# collisions caused by https://llvm.org/pr41817.
+if CONFIG["CC_TYPE"] == "clang-cl":
+    SOURCES["!HandlerData_p.c"].flags += [
+        "-DHandlerData__MIDL_ProcFormatString=HandlerData__MIDL_ProcFormatString__HandlerData_p"
+    ]
+    SOURCES["!HandlerData_p.c"].flags += [
+        "-DHandlerData__MIDL_TypeFormatString=HandlerData__MIDL_TypeFormatString__HandlerData_p"
+    ]
+    for p in ("dlldata", "c", "i", "p"):
+        SOURCES["!HandlerData_%s.c" % p].flags += [
+            "-DUserMarshalRoutines=UserMarshalRoutines__HandlerData_%s" % p
+        ]
+
+DEFFILE = "AccessibleHandler.def"
+
+USE_LIBS += [
+    "mscom_oop",
+]
+
+OS_LIBS += [
+    "rpcrt4",
+    "oleacc",
+]
+
+RCINCLUDE = "AccessibleHandler.rc"
+
+# Suppress warnings from the MIDL generated code.
+if CONFIG["CC_TYPE"] == "clang-cl":
+    CFLAGS += [
+        "-Wno-extern-initializer",
+        "-Wno-incompatible-pointer-types",
+        "-Wno-missing-braces",
+        "-Wno-unused-const-variable",
+    ]
+
+# Since we are defining our own COM entry points (DllRegisterServer et al),
+# but we still want to be able to delegate some work to the generated code,
+# we add the prefix "Proxy" to all of the generated counterparts.
+DEFINES["ENTRY_PREFIX"] = "Proxy"
+DEFINES["REGISTER_PROXY_DLL"] = True
+LIBRARY_DEFINES["MOZ_MSCOM_REMARSHAL_NO_HANDLER"] = True
+
+# This DLL may be loaded into other processes, so we need static libs for
+# Windows 7 and Windows 8.
+USE_STATIC_LIBS = True
+
+LIBRARY_DEFINES["UNICODE"] = True
+LIBRARY_DEFINES["_UNICODE"] = True
+LIBRARY_DEFINES["MOZ_NO_MOZALLOC"] = True
+DisableStlWrapping()
+
+DELAYLOAD_DLLS += [
+    "advapi32.dll",
+    "ktmw32.dll",
+]
diff --git a/accessible/ipc/win/moz.build b/accessible/ipc/win/moz.build
new file mode 100644
index 0000000000..ab6b3beb78
--- /dev/null
+++ b/accessible/ipc/win/moz.build
@@ -0,0 +1,72 @@
+# -*- Mode: python; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+if CONFIG["COMPILE_ENVIRONMENT"] and CONFIG["ACCESSIBILITY"]:
+    DIRS += [
+        "handler",
+        "typelib",
+    ]
+
+if CONFIG["ACCESSIBILITY"]:
+    IPDL_SOURCES += ["PDocAccessible.ipdl"]
+
+    if not CONFIG["HAVE_64BIT_BUILD"]:
+        EXPORTS += [
+            "IAccessible32.manifest",
+        ]
+
+    EXPORTS += [
+        "IAccessible64.manifest",
+    ]
+
+    EXPORTS.mozilla.a11y += [
+        "COMPtrTypes.h",
+        "DocAccessibleChild.h",
+        "HandlerProvider.h",
+        "PlatformChild.h",
+        "ProxyAccessible.h",
+    ]
+
+    SOURCES += [
+        "!./handler/HandlerData_c.c",
+        "COMPtrTypes.cpp",
+        "DocAccessibleChild.cpp",
+        "HandlerProvider.cpp",
+        "PlatformChild.cpp",
+        "ProxyAccessible.cpp",
+    ]
+
+    # Give some symbols a unique name in each translation unit, to avoid
+    # collisions caused by https://llvm.org/pr41817.
+    if CONFIG["CC_TYPE"] == "clang-cl":
+        SOURCES["!./handler/HandlerData_c.c"].flags += [
+            "-DUserMarshalRoutines=UserMarshalRoutines__HandlerData_c"
+        ]
+
+    LOCAL_INCLUDES += [
+        "/accessible/base",
+        "/accessible/generic",
+        "/accessible/windows/ia2",
+        "/accessible/windows/msaa",
+        "/accessible/xpcom",
+    ]
+
+    # Suppress warnings from the MIDL generated code.
+    if CONFIG["CC_TYPE"] == "clang-cl":
+        CFLAGS += [
+            "-Wno-extern-initializer",
+            "-Wno-incompatible-pointer-types",
+            "-Wno-missing-braces",
+            "-Wno-unused-const-variable",
+        ]
+
+        CXXFLAGS += [
+            "-Wno-missing-braces",
+        ]
+
+include("/ipc/chromium/chromium-config.mozbuild")
+
+FINAL_LIBRARY = "xul"
diff --git a/accessible/ipc/win/typelib/Accessible.idl b/accessible/ipc/win/typelib/Accessible.idl
new file mode 100644
index 0000000000..82ddcf5065
--- /dev/null
+++ b/accessible/ipc/win/typelib/Accessible.idl
@@ -0,0 +1,16 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+import "oaidl.idl";
+import "servprov.idl";
+
+[uuid(b4d37cda-0dac-45e6-b613-158a5eb94293)]
+library Accessible
+{
+  interface IEnumVARIANT;
+  interface IServiceProvider;
+};
+
diff --git a/accessible/ipc/win/typelib/moz.build b/accessible/ipc/win/typelib/moz.build
new file mode 100644
index 0000000000..2992deda1a
--- /dev/null
+++ b/accessible/ipc/win/typelib/moz.build
@@ -0,0 +1,16 @@
+# -*- Mode: python; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+FINAL_TARGET_FILES += [
+    "!Accessible.tlb",
+]
+
+GeneratedFile(
+    "Accessible.tlb",
+    inputs=["Accessible.idl"],
+    script="/build/midl.py",
+    entry_point="midl",
+)