diff --git a/htmlparser/src/nsExpatTokenizer.cpp b/htmlparser/src/nsExpatTokenizer.cpp
index 4845753b991a..ae991a487bc4 100644
--- a/htmlparser/src/nsExpatTokenizer.cpp
+++ b/htmlparser/src/nsExpatTokenizer.cpp
@@ -670,12 +670,16 @@ void Tokenizer_HandleCharacterData(void *userData, const XML_Char *s, int len) {
         break;
       case kSpace:
       case kTab:
-        newToken = state->tokenAllocator->CreateTokenOfType(eToken_whitespace,eHTMLTag_unknown, nsDependentString((PRUnichar*)s, len)); 
+        newToken = state->tokenAllocator->CreateTokenOfType(
+                       eToken_whitespace,
+                       eHTMLTag_unknown,
+                       Substring(NS_REINTERPRET_CAST(const PRUnichar*, s),
+                                 NS_REINTERPRET_CAST(const PRUnichar*, s) + len));
         break;
       default:
         {
           CTextToken* textToken = (CTextToken*)state->tokenAllocator->CreateTokenOfType(eToken_text, eHTMLTag_unknown);
-          PRUnichar* ptr = (PRUnichar*)s;
+          const PRUnichar* ptr = NS_REINTERPRET_CAST(const PRUnichar*, s);
           if ((ptr >= state->bufferStart) && (ptr < state->bufferEnd)) {
             nsReadingIterator<PRUnichar> start, end;
             start = state->currentIterator;
@@ -685,7 +689,7 @@ void Tokenizer_HandleCharacterData(void *userData, const XML_Char *s, int len) {
             textToken->Bind(state->scanner, start, end);
           }
           else {
-            textToken->Bind(nsDependentString(ptr, len));
+            textToken->Bind(Substring(ptr, ptr+len));
           }
           newToken = textToken;
         }
diff --git a/htmlparser/src/nsParser.cpp b/htmlparser/src/nsParser.cpp
index 4485ef06e054..d4ede756f0b6 100644
--- a/htmlparser/src/nsParser.cpp
+++ b/htmlparser/src/nsParser.cpp
@@ -2278,7 +2278,8 @@ nsParser::DetectMetaTag(const char* aBytes,
 
   // Fast and loose parsing to determine if we have a complete
   // META tag in this block, looking upto 2k into it.
-  nsDependentCString str(aBytes, PR_MIN(aLen, 2048));
+  const nsASingleFragmentCString& str =
+      Substring(aBytes, aBytes + PR_MIN(aLen, 2048));
   nsReadingIterator<char> begin, end;
   
   str.BeginReading(begin);
diff --git a/intl/chardet/src/nsMetaCharsetObserver.cpp b/intl/chardet/src/nsMetaCharsetObserver.cpp
index b601edfcfceb..c6e367e40c2b 100644
--- a/intl/chardet/src/nsMetaCharsetObserver.cpp
+++ b/intl/chardet/src/nsMetaCharsetObserver.cpp
@@ -215,15 +215,15 @@ NS_IMETHODIMP nsMetaCharsetObserver::Notify(
         while(IS_SPACE_CHARS(*keyStr)) 
           keyStr++;
 
-        if(0 == Compare(nsDependentString(keyStr, 10),
+        if(0 == Compare(Substring(keyStr, keyStr+10),
                         NS_LITERAL_STRING("HTTP-EQUIV"),
                         nsCaseInsensitiveStringComparator()))
               httpEquivValue = values->StringAt(i)->get();
-        else if(0 == Compare(nsDependentString(keyStr, 7),
+        else if(0 == Compare(Substring(keyStr, keyStr+7),
                              NS_LITERAL_STRING("content"),
                              nsCaseInsensitiveStringComparator()))
               contentValue = values->StringAt(i)->get();
-        else if (0 == Compare(nsDependentString(keyStr, 7),
+        else if (0 == Compare(Substring(keyStr, keyStr+7),
                               NS_LITERAL_STRING("charset"),
                               nsCaseInsensitiveStringComparator()))
               charsetValue = values->StringAt(i)->get();
@@ -241,24 +241,24 @@ NS_IMETHODIMP nsMetaCharsetObserver::Notify(
 
       if(
           // first try unquoted strings
-         ((0==Compare(nsDependentString(httpEquivValue,contenttype.Length()),
+         ((0==Compare(Substring(httpEquivValue,httpEquivValue+contenttype.Length()),
                       contenttype,
                       nsCaseInsensitiveStringComparator())) ||
           // now try "quoted" or 'quoted' strings
           (( (httpEquivValue[0]=='\'') ||
              (httpEquivValue[0]=='\"') ) && 
-           (0==Compare(nsDependentString(httpEquivValue+1, contenttype.Length()),
+           (0==Compare(Substring(httpEquivValue+1, httpEquivValue+1+contenttype.Length()),
                        contenttype,
                        nsCaseInsensitiveStringComparator()))
           )) &&
           // first try unquoted strings
-         ((0==Compare(nsDependentString(contentValue,texthtml.Length()),
+         ((0==Compare(Substring(contentValue,contentValue+texthtml.Length()),
                       texthtml,
                       nsCaseInsensitiveStringComparator())) ||
           // now try "quoted" or 'quoted' strings
           (((contentValue[0]=='\'') ||
             (contentValue[0]=='\"'))&&
-           (0==Compare(nsDependentString(contentValue+1, texthtml.Length()),
+           (0==Compare(Substring(contentValue+1, contentValue+1+texthtml.Length()),
                        texthtml,
                        nsCaseInsensitiveStringComparator()))
           ))
diff --git a/js/src/xpconnect/src/xpcprivate.h b/js/src/xpconnect/src/xpcprivate.h
index e3a695ea6b04..c6e37ae4b9a7 100644
--- a/js/src/xpconnect/src/xpcprivate.h
+++ b/js/src/xpconnect/src/xpcprivate.h
@@ -2266,7 +2266,7 @@ public:
     { }
 
     XPCReadableJSStringWrapper() :
-        nsDependentString(nsnull, (PRUint32)0), mStr(nsnull),
+        nsDependentString(&sEmptyString, &sEmptyString), mStr(nsnull),
         mBufferHandle(nsnull), mHandleIsShared(JS_FALSE)
     { }
 
@@ -2289,6 +2289,9 @@ public:
     }
 
 protected:
+
+    static const PRUnichar sEmptyString;
+
     struct WrapperBufferHandle :
         public nsSharedBufferHandleWithAllocator<PRUnichar>
     {
diff --git a/js/src/xpconnect/src/xpcstring.cpp b/js/src/xpconnect/src/xpcstring.cpp
index 7cc31f106f44..1e26a3d83d51 100644
--- a/js/src/xpconnect/src/xpcstring.cpp
+++ b/js/src/xpconnect/src/xpcstring.cpp
@@ -58,6 +58,9 @@
 #error "JSVAL_STRING has zero value -- need to fix root management!"
 #endif
 
+/* static */
+const PRUnichar XPCReadableJSStringWrapper::sEmptyString = PRUnichar(0);
+
 XPCReadableJSStringWrapper::~XPCReadableJSStringWrapper()
 {
     if (mBufferHandle)
diff --git a/mailnews/addrbook/src/nsAbAutoCompleteSession.cpp b/mailnews/addrbook/src/nsAbAutoCompleteSession.cpp
index 4f839d997901..3f6d25982b96 100644
--- a/mailnews/addrbook/src/nsAbAutoCompleteSession.cpp
+++ b/mailnews/addrbook/src/nsAbAutoCompleteSession.cpp
@@ -256,8 +256,8 @@ static PRBool CommonPrefix(const PRUnichar *aString, const PRUnichar *aSubstr, P
   if (aSubstrLen == 0 || nsCRT::strlen(aString) < aSubstrLen)
     return PR_FALSE;
 
-  return (Compare(nsDependentString(aString, aSubstrLen),
-                  nsDependentString(aSubstr, aSubstrLen),
+  return (Compare(Substring(aString, aString+aSubstrLen),
+                  Substring(aSubstr, aSubstr+aSubstrLen),
                   nsCaseInsensitiveStringComparator()) == 0);
 }
 
diff --git a/mailnews/db/msgdb/src/nsMsgDatabase.cpp b/mailnews/db/msgdb/src/nsMsgDatabase.cpp
index aaa58d7034f8..52b43b14014c 100644
--- a/mailnews/db/msgdb/src/nsMsgDatabase.cpp
+++ b/mailnews/db/msgdb/src/nsMsgDatabase.cpp
@@ -3005,12 +3005,20 @@ nsresult nsMsgDatabase::RowCellColumnToCharPtr(nsIMdbRow *row, mdb_token columnT
 
 /* static */void nsMsgDatabase::YarnTonsString(struct mdbYarn *yarn, nsString *str)
 {
-	str->AssignWithConversion((const char *) yarn->mYarn_Buf, yarn->mYarn_Fill);
+    const char* buf = (const char*)yarn->mYarn_Buf;
+    if (buf)
+        str->AssignWithConversion(buf, yarn->mYarn_Fill);
+    else
+        str->Truncate();
 }
 
 /* static */void nsMsgDatabase::YarnTonsCString(struct mdbYarn *yarn, nsCString *str)
 {
-	str->Assign((const char *) yarn->mYarn_Buf, yarn->mYarn_Fill);
+    const char* buf = (const char*)yarn->mYarn_Buf;
+    if (buf)
+        str->Assign(buf, yarn->mYarn_Fill);
+    else
+        str->Truncate();
 }
 
 // WARNING - if yarn is empty, *pResult will not be changed!!!!
diff --git a/mailnews/imap/src/nsImapMailFolder.cpp b/mailnews/imap/src/nsImapMailFolder.cpp
index db75e497d514..118d3ab05946 100644
--- a/mailnews/imap/src/nsImapMailFolder.cpp
+++ b/mailnews/imap/src/nsImapMailFolder.cpp
@@ -3676,8 +3676,8 @@ nsImapMailFolder::NotifyMessageDeleted(const char *onlineFolderName,PRBool delet
 PRBool nsImapMailFolder::ShowDeletedMessages()
 {
   nsresult err;
-    nsCOMPtr<nsIImapHostSessionList> hostSession = 
-             do_GetService(kCImapHostSessionList, &err);
+  nsCOMPtr<nsIImapHostSessionList> hostSession = 
+      do_GetService(kCImapHostSessionList, &err);
   PRBool showDeleted = PR_FALSE;
 
   if (NS_SUCCEEDED(err) && hostSession)
@@ -3704,11 +3704,13 @@ PRBool nsImapMailFolder::ShowDeletedMessages()
         nsXPIDLString convertedName;
         rv = imapServer->ConvertFolderName(specialTrashName.get(), getter_Copies(convertedName));
         if (NS_SUCCEEDED(rv))
-      {
-        nsXPIDLString folderName;
-        GetName(getter_Copies(folderName));
-          if (!Compare(folderName, convertedName, nsCaseInsensitiveStringComparator()))
-          showDeleted = PR_TRUE;
+        {
+          nsXPIDLString folderName;
+          GetName(getter_Copies(folderName));
+          if (!Compare(Substring(folderName,0,convertedName.Length()),
+                       convertedName,
+                       nsCaseInsensitiveStringComparator()))
+            showDeleted = PR_TRUE;
         }
       }
     }
diff --git a/mailnews/mime/src/nsMsgHeaderParser.cpp b/mailnews/mime/src/nsMsgHeaderParser.cpp
index 1f9d10a29c1c..0e5bc308fe1a 100644
--- a/mailnews/mime/src/nsMsgHeaderParser.cpp
+++ b/mailnews/mime/src/nsMsgHeaderParser.cpp
@@ -275,7 +275,8 @@ NS_IMETHODIMP nsMsgHeaderParser::ParseHeadersWithEnumerator(const PRUnichar *lin
 nsresult nsMsgHeaderParser::ParseHeaderAddresses (const char *charset, const char *line, char **names, char **addresses, PRUint32 *numAddresses)
 {
 #if DEBUG
-  (void) NS_ConvertUTF8toUCS2(line).get(); // asserts if invalid UTF-8
+  if (line)
+    (void) NS_ConvertUTF8toUCS2(line).get(); // asserts if invalid UTF-8
 #endif
 
   *numAddresses = msg_parse_Header_addresses(line, names, addresses);
@@ -288,7 +289,8 @@ nsresult nsMsgHeaderParser::ExtractHeaderAddressMailboxes (const char *charset,
   if (mailboxes)
   {
 #if DEBUG
-    (void) NS_ConvertUTF8toUCS2(line).get(); // asserts if invalid UTF-8
+    if (line)
+      (void) NS_ConvertUTF8toUCS2(line).get(); // asserts if invalid UTF-8
 #endif
     
     *mailboxes = msg_extract_Header_address_mailboxes(line);
@@ -303,7 +305,8 @@ nsresult nsMsgHeaderParser::ExtractHeaderAddressNames (const char *charset, cons
 	if (names)
 	{
 #if DEBUG
-    (void) NS_ConvertUTF8toUCS2(line).get(); // asserts if invalid UTF-8
+    if (line)
+      (void) NS_ConvertUTF8toUCS2(line).get(); // asserts if invalid UTF-8
 #endif
 
     *names = msg_extract_Header_address_names(line);
@@ -319,7 +322,8 @@ nsresult nsMsgHeaderParser::ExtractHeaderAddressName (const char *charset, const
 	if (name)
 	{
 #if DEBUG
-    (void) NS_ConvertUTF8toUCS2(line).get(); // asserts if invalid UTF-8
+    if (line)
+      (void) NS_ConvertUTF8toUCS2(line).get(); // asserts if invalid UTF-8
 #endif
 
 		*name = msg_extract_Header_address_name(line);
@@ -334,7 +338,8 @@ nsresult nsMsgHeaderParser::ReformatHeaderAddresses (const char *charset, const
 	if (reformattedAddress)
 	{
 #if DEBUG
-    (void) NS_ConvertUTF8toUCS2(line).get(); // asserts if invalid UTF-8
+    if (line)
+      (void) NS_ConvertUTF8toUCS2(line).get(); // asserts if invalid UTF-8
 #endif
 
 		*reformattedAddress = msg_reformat_Header_addresses(line);
@@ -349,8 +354,10 @@ nsresult nsMsgHeaderParser::RemoveDuplicateAddresses (const char *charset, const
 	if (newOutput)
 	{
 #if DEBUG
-  (void) NS_ConvertUTF8toUCS2(addrs).get(); // asserts if invalid UTF-8
-  (void) NS_ConvertUTF8toUCS2(other_addrs).get();
+    if (addrs)
+      (void) NS_ConvertUTF8toUCS2(addrs).get(); // asserts if invalid UTF-8
+    if (other_addrs)
+      (void) NS_ConvertUTF8toUCS2(other_addrs).get();
 #endif
 
 		*newOutput = msg_remove_duplicate_addresses(addrs, other_addrs, removeAliasesToMe);
@@ -365,7 +372,8 @@ nsresult nsMsgHeaderParser::MakeFullAddress (const char *charset, const char* na
 	if (fullAddress)
 	{
 #if DEBUG
-    (void) NS_ConvertUTF8toUCS2(addr).get(); // asserts if invalid UTF-8
+    if (addr)
+      (void) NS_ConvertUTF8toUCS2(addr).get(); // asserts if invalid UTF-8
 #endif
 
 		*fullAddress = msg_make_full_address(name, addr);
@@ -378,7 +386,8 @@ nsresult nsMsgHeaderParser::MakeFullAddress (const char *charset, const char* na
 nsresult nsMsgHeaderParser::UnquotePhraseOrAddr (const char *charset, const char *line, char** lineout)
 {
 #if DEBUG
-  (void) NS_ConvertUTF8toUCS2(line).get(); // asserts if invalid UTF-8
+  if (line)
+    (void) NS_ConvertUTF8toUCS2(line).get(); // asserts if invalid UTF-8
 #endif
 
   msg_unquote_phrase_or_addr(line, lineout);
diff --git a/netwerk/streamconv/converters/mozTXTToHTMLConv.cpp b/netwerk/streamconv/converters/mozTXTToHTMLConv.cpp
index 8bb767aa04b9..a57082c6e56b 100644
--- a/netwerk/streamconv/converters/mozTXTToHTMLConv.cpp
+++ b/netwerk/streamconv/converters/mozTXTToHTMLConv.cpp
@@ -542,7 +542,11 @@ mozTXTToHTMLConv::ItMatchesDelimited(const PRUnichar * aInString,
           nsCRT::IsAsciiDigit(textAfterPos) ||
           textAfterPos == *rep
         ) ||
-        Compare(nsDependentString(aInString + (before == LT_IGNORE ? 0 : 1) ), nsDependentString(rep, aRepLen), nsCaseInsensitiveStringComparator())
+        Compare(Substring(nsDependentString(aInString, aInLength),
+                          (before == LT_IGNORE ? 0 : 1),
+                          aRepLen),
+                nsDependentString(rep, aRepLen),
+                nsCaseInsensitiveStringComparator())
     )
     return PR_FALSE;
 
@@ -974,8 +978,8 @@ mozTXTToHTMLConv::CiteLevelTXT(const PRUnichar *line,
       const PRUnichar * indexString = &line[logLineStart];
            // here, |logLineStart < lineLength| is always true
       PRUint32 minlength = MinInt(6,nsCRT::strlen(indexString));
-      if (!Compare(nsDependentString(indexString, minlength),
-                   nsDependentString(NS_LITERAL_STRING(">From ").get(), minlength), nsCaseInsensitiveStringComparator()))
+      if (!Compare(Substring(indexString, indexString+minlength),
+                   Substring(NS_LITERAL_STRING(">From "), 0, minlength), nsCaseInsensitiveStringComparator()))
         //XXX RFC2646
         moreCites = PR_FALSE;
       else
diff --git a/parser/htmlparser/src/nsExpatTokenizer.cpp b/parser/htmlparser/src/nsExpatTokenizer.cpp
index 4845753b991a..ae991a487bc4 100644
--- a/parser/htmlparser/src/nsExpatTokenizer.cpp
+++ b/parser/htmlparser/src/nsExpatTokenizer.cpp
@@ -670,12 +670,16 @@ void Tokenizer_HandleCharacterData(void *userData, const XML_Char *s, int len) {
         break;
       case kSpace:
       case kTab:
-        newToken = state->tokenAllocator->CreateTokenOfType(eToken_whitespace,eHTMLTag_unknown, nsDependentString((PRUnichar*)s, len)); 
+        newToken = state->tokenAllocator->CreateTokenOfType(
+                       eToken_whitespace,
+                       eHTMLTag_unknown,
+                       Substring(NS_REINTERPRET_CAST(const PRUnichar*, s),
+                                 NS_REINTERPRET_CAST(const PRUnichar*, s) + len));
         break;
       default:
         {
           CTextToken* textToken = (CTextToken*)state->tokenAllocator->CreateTokenOfType(eToken_text, eHTMLTag_unknown);
-          PRUnichar* ptr = (PRUnichar*)s;
+          const PRUnichar* ptr = NS_REINTERPRET_CAST(const PRUnichar*, s);
           if ((ptr >= state->bufferStart) && (ptr < state->bufferEnd)) {
             nsReadingIterator<PRUnichar> start, end;
             start = state->currentIterator;
@@ -685,7 +689,7 @@ void Tokenizer_HandleCharacterData(void *userData, const XML_Char *s, int len) {
             textToken->Bind(state->scanner, start, end);
           }
           else {
-            textToken->Bind(nsDependentString(ptr, len));
+            textToken->Bind(Substring(ptr, ptr+len));
           }
           newToken = textToken;
         }
diff --git a/parser/htmlparser/src/nsParser.cpp b/parser/htmlparser/src/nsParser.cpp
index 4485ef06e054..d4ede756f0b6 100644
--- a/parser/htmlparser/src/nsParser.cpp
+++ b/parser/htmlparser/src/nsParser.cpp
@@ -2278,7 +2278,8 @@ nsParser::DetectMetaTag(const char* aBytes,
 
   // Fast and loose parsing to determine if we have a complete
   // META tag in this block, looking upto 2k into it.
-  nsDependentCString str(aBytes, PR_MIN(aLen, 2048));
+  const nsASingleFragmentCString& str =
+      Substring(aBytes, aBytes + PR_MIN(aLen, 2048));
   nsReadingIterator<char> begin, end;
   
   str.BeginReading(begin);
diff --git a/string/public/nsAFlatString.h b/string/public/nsAFlatString.h
index 5db9dbc3a501..a79b3944a65a 100644
--- a/string/public/nsAFlatString.h
+++ b/string/public/nsAFlatString.h
@@ -30,6 +30,16 @@
 #include "nsASingleFragmentString.h"
 #endif
 
+  /**
+   * |nsAFlatC?String| is an abstract class.  Strings implementing
+   * |nsAFlatC?String| have a buffer that is stored as a single fragment
+   * and is NULL-terminated.  That buffer can be accessed for reading
+   * using the |get| method.
+   *
+   * See also |nsASingleFragmentC?String| and |nsAC?String|, base
+   * classes of |nsAFlatC?String|.
+   */
+
 class NS_COM nsAFlatString
     : public nsASingleFragmentString
   {
diff --git a/string/public/nsASingleFragmentString.h b/string/public/nsASingleFragmentString.h
index f693143950fc..c18b957e7b54 100644
--- a/string/public/nsASingleFragmentString.h
+++ b/string/public/nsASingleFragmentString.h
@@ -30,6 +30,16 @@
 #include "nsAString.h"
 #endif
 
+  /**
+   * |nsASingleFragmentC?String| is an abstract class.  Strings
+   * implementing |nsASingleFragmentC?String| have a buffer that is
+   * stored as a single fragment.  However, they are not necessarily
+   * NULL-terminated.
+   *
+   * See also |nsAFlatC?String|, the remaining more-specific abstract
+   * class in the string hierarchy.
+   */
+
 class NS_COM nsASingleFragmentString
     : public nsAString
   {
diff --git a/string/public/nsAString.h b/string/public/nsAString.h
index b22a4091feec..362039a55fc7 100644
--- a/string/public/nsAString.h
+++ b/string/public/nsAString.h
@@ -42,7 +42,14 @@
 
 
   /**
+   * |nsAC?String| is the most abstract class in the string hierarchy.
+   * Strings implementing |nsAC?String| may be stored in multiple
+   * fragments.  They need not be null-terminated and they may contain
+   * embedded null characters.  They may be dependent objects that
+   * depend on other strings.
    *
+   * See also |nsASingleFragmentC?String| and |nsAFlatC?String|, the
+   * other main abstract classes in the string hierarchy.
    */
 
 class NS_COM nsAString
diff --git a/string/public/nsDependentString.h b/string/public/nsDependentString.h
index f8d1703182d5..34981d7918cd 100644
--- a/string/public/nsDependentString.h
+++ b/string/public/nsDependentString.h
@@ -51,13 +51,19 @@ class NS_COM nsDependentString
       void
       Rebind( const char_type* aPtr )
         {
+          NS_ASSERTION(aPtr, "nsDependentString must wrap a non-NULL buffer");
           mHandle.DataStart(aPtr);
+          // XXX This should not be NULL-safe, but we should flip the switch
+          // early in a milestone.
+          //mHandle.DataEnd(aPtr+nsCharTraits<char_type>::length(aPtr));
           mHandle.DataEnd(aPtr ? (aPtr+nsCharTraits<char_type>::length(aPtr)) : 0);
         }
 
       void
       Rebind( const char_type* aStartPtr, const char_type* aEndPtr )
         {
+          NS_ASSERTION(aStartPtr && aEndPtr, "nsDependentString must wrap a non-NULL buffer");
+          NS_ASSERTION(!*aEndPtr, "nsDependentString must wrap only null-terminated strings");
           mHandle.DataStart(aStartPtr);
           mHandle.DataEnd(aEndPtr);
         }
@@ -65,13 +71,8 @@ class NS_COM nsDependentString
       void
       Rebind( const char_type* aPtr, PRUint32 aLength )
         {
-          if ( aLength == PRUint32(-1) )
-            {
-//            NS_WARNING("Tell scc: Caller binding a dependent string doesn't know the real length.  Please pick the appropriate call.");
-              Rebind(aPtr);
-            }
-          else
-            Rebind(aPtr, aPtr+aLength);
+          NS_ASSERTION(aLength != PRUint32(-1), "caller passing bogus length");
+          Rebind(aPtr, aPtr+aLength);
         }
 
       nsDependentString( const char_type* aStartPtr, const char_type* aEndPtr ) { Rebind(aStartPtr, aEndPtr); }
@@ -104,13 +105,19 @@ class NS_COM nsDependentCString
       void
       Rebind( const char_type* aPtr )
         {
+          NS_ASSERTION(aPtr, "nsDependentCString must wrap a non-NULL buffer");
           mHandle.DataStart(aPtr);
+          // XXX This should not be NULL-safe, but we should flip the switch
+          // early in a milestone.
+          //mHandle.DataEnd(aPtr+nsCharTraits<char_type>::length(aPtr));
           mHandle.DataEnd(aPtr ? (aPtr+nsCharTraits<char_type>::length(aPtr)) : 0);
         }
 
       void
       Rebind( const char_type* aStartPtr, const char_type* aEndPtr )
         {
+          NS_ASSERTION(aStartPtr && aEndPtr, "nsDependentCString must wrap a non-NULL buffer");
+          NS_ASSERTION(!*aEndPtr, "nsDependentCString must wrap only null-terminated strings");
           mHandle.DataStart(aStartPtr);
           mHandle.DataEnd(aEndPtr);
         }
@@ -118,13 +125,8 @@ class NS_COM nsDependentCString
       void
       Rebind( const char_type* aPtr, PRUint32 aLength )
         {
-          if ( aLength == PRUint32(-1) )
-            {
-//            NS_WARNING("Tell scc: Caller binding a dependent string doesn't know the real length.  Please pick the appropriate call.");
-              Rebind(aPtr);
-            }
-          else
-            Rebind(aPtr, aPtr+aLength);
+          NS_ASSERTION(aLength != PRUint32(-1), "caller passing bogus length");
+          Rebind(aPtr, aPtr+aLength);
         }
 
       nsDependentCString( const char_type* aStartPtr, const char_type* aEndPtr ) { Rebind(aStartPtr, aEndPtr); }
@@ -136,7 +138,7 @@ class NS_COM nsDependentCString
 
     private:
         // NOT TO BE IMPLEMENTED
-      void operator=( const self_type& );                                        // we're immutable, so no copy-assignment operator
+      void operator=( const self_type& );                                       // we're immutable, so no copy-assignment operator
 
     public:
       virtual const buffer_handle_type* GetFlatBufferHandle() const             { return NS_REINTERPRET_CAST(const buffer_handle_type*, &mHandle); }
diff --git a/string/public/nsDependentSubstring.h b/string/public/nsDependentSubstring.h
index c0ddc6a1112c..1e4e709bd4de 100644
--- a/string/public/nsDependentSubstring.h
+++ b/string/public/nsDependentSubstring.h
@@ -28,6 +28,10 @@
 #include "nsAString.h"
 #endif
 
+#ifndef nsASingleFragmentString_h___
+#include "nsASingleFragmentString.h"
+#endif
+
 #ifndef nsStringTraits_h___
 #include "nsStringTraits.h"
 #endif
@@ -145,8 +149,88 @@ class NS_COM nsDependentCSubstring
   };
 
 
+class NS_COM nsDependentSingleFragmentSubstring
+      : public nsASingleFragmentString
+  {
+    public:
+      typedef nsDependentSingleFragmentSubstring self_type;
+      typedef nsASingleFragmentString   abstract_single_fragment_type;
+
+      void
+      Rebind( const char_type* aStartPtr, const char_type* aEndPtr )
+        {
+          NS_ASSERTION(aStartPtr && aEndPtr, "nsDependentSingleFragmentString must wrap a non-NULL buffer");
+          mHandle.DataStart(aStartPtr);
+          mHandle.DataEnd(aEndPtr);
+        }
+
+      void
+      Rebind( const abstract_single_fragment_type& aString, const PRUint32 aStartPos, const PRUint32 aLength )
+        {
+          const_char_iterator iter;
+          mHandle.DataStart(aString.BeginReading(iter) + NS_MIN(aStartPos, aString.Length()));
+          mHandle.DataEnd( NS_MIN(mHandle.DataStart() + aLength, aString.EndReading(iter)) );
+        }
+
+      nsDependentSingleFragmentSubstring( const char_type* aStartPtr, const char_type* aEndPtr ) { Rebind(aStartPtr, aEndPtr); }
+      nsDependentSingleFragmentSubstring( const abstract_single_fragment_type& aString, const PRUint32 aStartPos, const PRUint32 aLength ) { Rebind(aString, aStartPos, aLength); }
+
+      // nsDependentSingleFragmentSubstring( const self_type& );                  // auto-generated copy-constructor OK
+      // ~nsDependentSingleFragmentSubstring();                                   // auto-generated destructor OK
+
+    private:
+        // NOT TO BE IMPLEMENTED
+      void operator=( const self_type& );                                       // we're immutable, so no copy-assignment operator
+
+    public:
+      virtual const buffer_handle_type* GetFlatBufferHandle() const             { return NS_REINTERPRET_CAST(const buffer_handle_type*, &mHandle); }
+      virtual const buffer_handle_type* GetBufferHandle() const                 { return NS_REINTERPRET_CAST(const buffer_handle_type*, &mHandle); }
+
+    private:
+      const_buffer_handle_type mHandle;
+  };
 
 
+class NS_COM nsDependentSingleFragmentCSubstring
+      : public nsASingleFragmentCString
+  {
+    public:
+      typedef nsDependentSingleFragmentCSubstring self_type;
+      typedef nsASingleFragmentCString  abstract_single_fragment_type;
+
+      void
+      Rebind( const char_type* aStartPtr, const char_type* aEndPtr )
+        {
+          NS_ASSERTION(aStartPtr && aEndPtr, "nsDependentSingleFragmentCString must wrap a non-NULL buffer");
+          mHandle.DataStart(aStartPtr);
+          mHandle.DataEnd(aEndPtr);
+        }
+
+      void
+      Rebind( const abstract_single_fragment_type& aString, const PRUint32 aStartPos, const PRUint32 aLength )
+        {
+          const_char_iterator iter;
+          mHandle.DataStart(aString.BeginReading(iter) + NS_MIN(aStartPos, aString.Length()));
+          mHandle.DataEnd( NS_MIN(mHandle.DataStart() + aLength, aString.EndReading(iter)) );
+        }
+
+      nsDependentSingleFragmentCSubstring( const char_type* aStartPtr, const char_type* aEndPtr ) { Rebind(aStartPtr, aEndPtr); }
+      nsDependentSingleFragmentCSubstring( const abstract_single_fragment_type& aString, const PRUint32 aStartPos, const PRUint32 aLength ) { Rebind(aString, aStartPos, aLength); }
+
+      // nsDependentSingleFragmentCSubstring( const self_type& );                  // auto-generated copy-constructor OK
+      // ~nsDependentSingleFragmentCSubstring();                                   // auto-generated destructor OK
+
+    private:
+        // NOT TO BE IMPLEMENTED
+      void operator=( const self_type& );                                       // we're immutable, so no copy-assignment operator
+
+    public:
+      virtual const buffer_handle_type* GetFlatBufferHandle() const             { return NS_REINTERPRET_CAST(const buffer_handle_type*, &mHandle); }
+      virtual const buffer_handle_type* GetBufferHandle() const                 { return NS_REINTERPRET_CAST(const buffer_handle_type*, &mHandle); }
+
+    private:
+      const_buffer_handle_type mHandle;
+  };
 
 
 
@@ -179,4 +263,33 @@ Substring( const nsAString::const_iterator& aStart, const nsAString::const_itera
   }
 
 
+inline
+const nsDependentSingleFragmentCSubstring
+Substring( const nsASingleFragmentCString& aString, PRUint32 aStartPos, PRUint32 aSubstringLength )
+  {
+    return nsDependentSingleFragmentCSubstring(aString, aStartPos, aSubstringLength);
+  }
+
+inline
+const nsDependentSingleFragmentSubstring
+Substring( const nsASingleFragmentString& aString, PRUint32 aStartPos, PRUint32 aSubstringLength )
+  {
+    return nsDependentSingleFragmentSubstring(aString, aStartPos, aSubstringLength);
+  }
+
+inline
+const nsDependentSingleFragmentCSubstring
+Substring( const nsASingleFragmentCString::const_char_iterator& aStart, const nsASingleFragmentCString::const_char_iterator& aEnd )
+  {
+    return nsDependentSingleFragmentCSubstring(aStart, aEnd);
+  }
+
+inline
+const nsDependentSingleFragmentSubstring
+Substring( const nsASingleFragmentString::const_char_iterator& aStart, const nsASingleFragmentString::const_char_iterator& aEnd )
+  {
+    return nsDependentSingleFragmentSubstring(aStart, aEnd);
+  }
+
+
 #endif /* !defined(nsDependentSubstring_h___) */
diff --git a/string/src/nsAString.cpp b/string/src/nsAString.cpp
index 454530201b9c..e4dcfbf22dfa 100644
--- a/string/src/nsAString.cpp
+++ b/string/src/nsAString.cpp
@@ -306,13 +306,13 @@ nsAString::do_AssignFromElementPtr( const char_type* aPtr )
 void
 nsAString::do_AssignFromElementPtrLength( const char_type* aPtr, size_type aLength )
   {
-    do_AssignFromReadable(nsDependentString(aPtr, aLength));
+    do_AssignFromReadable(Substring(aPtr, aPtr+aLength));
   }
 
 void
 nsAString::do_AssignFromElement( char_type aChar )
   {
-    do_AssignFromReadable(nsDependentString(&aChar, 1));
+    do_AssignFromReadable(Substring(&aChar, &aChar+1));
   }
 
 
@@ -371,13 +371,13 @@ nsAString::do_AppendFromElementPtr( const char_type* aPtr )
 void
 nsAString::do_AppendFromElementPtrLength( const char_type* aPtr, size_type aLength )
   {
-    do_AppendFromReadable(nsDependentString(aPtr, aLength));
+    do_AppendFromReadable(Substring(aPtr, aPtr+aLength));
   }
 
 void
 nsAString::do_AppendFromElement( char_type aChar )
   {
-    do_AppendFromReadable(nsDependentString(&aChar, 1));
+    do_AppendFromReadable(Substring(&aChar, &aChar + 1));
   }
 
 
@@ -440,13 +440,13 @@ nsAString::do_InsertFromElementPtr( const char_type* aPtr, index_type atPosition
 void
 nsAString::do_InsertFromElementPtrLength( const char_type* aPtr, index_type atPosition, size_type aLength )
   {
-    do_InsertFromReadable(nsDependentString(aPtr, aLength), atPosition);
+    do_InsertFromReadable(Substring(aPtr, aPtr+aLength), atPosition);
   }
 
 void
 nsAString::do_InsertFromElement( char_type aChar, index_type atPosition )
   {
-    do_InsertFromReadable(nsDependentString(&aChar, 1), atPosition);
+    do_InsertFromReadable(Substring(&aChar, &aChar+1), atPosition);
   }
 
 
@@ -825,13 +825,13 @@ nsACString::do_AssignFromElementPtr( const char_type* aPtr )
 void
 nsACString::do_AssignFromElementPtrLength( const char_type* aPtr, size_type aLength )
   {
-    do_AssignFromReadable(nsDependentCString(aPtr, aLength));
+    do_AssignFromReadable(Substring(aPtr, aPtr+aLength));
   }
 
 void
 nsACString::do_AssignFromElement( char_type aChar )
   {
-    do_AssignFromReadable(nsDependentCString(&aChar, 1));
+    do_AssignFromReadable(Substring(&aChar, &aChar+1));
   }
 
 
@@ -890,13 +890,13 @@ nsACString::do_AppendFromElementPtr( const char_type* aPtr )
 void
 nsACString::do_AppendFromElementPtrLength( const char_type* aPtr, size_type aLength )
   {
-    do_AppendFromReadable(nsDependentCString(aPtr, aLength));
+    do_AppendFromReadable(Substring(aPtr, aPtr+aLength));
   }
 
 void
 nsACString::do_AppendFromElement( char_type aChar )
   {
-    do_AppendFromReadable(nsDependentCString(&aChar, 1));
+    do_AppendFromReadable(Substring(&aChar, &aChar + 1));
   }
 
 
@@ -959,13 +959,13 @@ nsACString::do_InsertFromElementPtr( const char_type* aPtr, index_type atPositio
 void
 nsACString::do_InsertFromElementPtrLength( const char_type* aPtr, index_type atPosition, size_type aLength )
   {
-    do_InsertFromReadable(nsDependentCString(aPtr, aLength), atPosition);
+    do_InsertFromReadable(Substring(aPtr, aPtr+aLength), atPosition);
   }
 
 void
 nsACString::do_InsertFromElement( char_type aChar, index_type atPosition )
   {
-    do_InsertFromReadable(nsDependentCString(&aChar, 1), atPosition);
+    do_InsertFromReadable(Substring(&aChar, &aChar+1), atPosition);
   }
 
 
diff --git a/xpcom/io/nsLocalFileUnix.cpp b/xpcom/io/nsLocalFileUnix.cpp
index d440bd53251e..e3d4f286b17e 100644
--- a/xpcom/io/nsLocalFileUnix.cpp
+++ b/xpcom/io/nsLocalFileUnix.cpp
@@ -262,11 +262,10 @@ nsLocalFile::InitWithPath(const char *filePath)
     NS_ENSURE_ARG(filePath);
 
     ssize_t len  = strlen(filePath);
-    char   *name = (char *) nsMemory::Clone(filePath, len+1);
-    while (name[len-1] == '/' && len > 1)
-        name[--len] = '\0';
-
-    mPath.Adopt(name);
+    while (filePath[len-1] == '/' && len > 1)
+        --len;
+    // XXXldb change to |Assign| rather than |Adopt(ToNewCString|
+    mPath.Adopt(ToNewCString(Substring(filePath, filePath+len)));
 
     InvalidateCache();
     return NS_OK;
diff --git a/xpcom/string/public/nsAFlatString.h b/xpcom/string/public/nsAFlatString.h
index 5db9dbc3a501..a79b3944a65a 100644
--- a/xpcom/string/public/nsAFlatString.h
+++ b/xpcom/string/public/nsAFlatString.h
@@ -30,6 +30,16 @@
 #include "nsASingleFragmentString.h"
 #endif
 
+  /**
+   * |nsAFlatC?String| is an abstract class.  Strings implementing
+   * |nsAFlatC?String| have a buffer that is stored as a single fragment
+   * and is NULL-terminated.  That buffer can be accessed for reading
+   * using the |get| method.
+   *
+   * See also |nsASingleFragmentC?String| and |nsAC?String|, base
+   * classes of |nsAFlatC?String|.
+   */
+
 class NS_COM nsAFlatString
     : public nsASingleFragmentString
   {
diff --git a/xpcom/string/public/nsASingleFragmentString.h b/xpcom/string/public/nsASingleFragmentString.h
index f693143950fc..c18b957e7b54 100644
--- a/xpcom/string/public/nsASingleFragmentString.h
+++ b/xpcom/string/public/nsASingleFragmentString.h
@@ -30,6 +30,16 @@
 #include "nsAString.h"
 #endif
 
+  /**
+   * |nsASingleFragmentC?String| is an abstract class.  Strings
+   * implementing |nsASingleFragmentC?String| have a buffer that is
+   * stored as a single fragment.  However, they are not necessarily
+   * NULL-terminated.
+   *
+   * See also |nsAFlatC?String|, the remaining more-specific abstract
+   * class in the string hierarchy.
+   */
+
 class NS_COM nsASingleFragmentString
     : public nsAString
   {
diff --git a/xpcom/string/public/nsAString.h b/xpcom/string/public/nsAString.h
index b22a4091feec..362039a55fc7 100644
--- a/xpcom/string/public/nsAString.h
+++ b/xpcom/string/public/nsAString.h
@@ -42,7 +42,14 @@
 
 
   /**
+   * |nsAC?String| is the most abstract class in the string hierarchy.
+   * Strings implementing |nsAC?String| may be stored in multiple
+   * fragments.  They need not be null-terminated and they may contain
+   * embedded null characters.  They may be dependent objects that
+   * depend on other strings.
    *
+   * See also |nsASingleFragmentC?String| and |nsAFlatC?String|, the
+   * other main abstract classes in the string hierarchy.
    */
 
 class NS_COM nsAString
diff --git a/xpcom/string/public/nsDependentString.h b/xpcom/string/public/nsDependentString.h
index f8d1703182d5..34981d7918cd 100644
--- a/xpcom/string/public/nsDependentString.h
+++ b/xpcom/string/public/nsDependentString.h
@@ -51,13 +51,19 @@ class NS_COM nsDependentString
       void
       Rebind( const char_type* aPtr )
         {
+          NS_ASSERTION(aPtr, "nsDependentString must wrap a non-NULL buffer");
           mHandle.DataStart(aPtr);
+          // XXX This should not be NULL-safe, but we should flip the switch
+          // early in a milestone.
+          //mHandle.DataEnd(aPtr+nsCharTraits<char_type>::length(aPtr));
           mHandle.DataEnd(aPtr ? (aPtr+nsCharTraits<char_type>::length(aPtr)) : 0);
         }
 
       void
       Rebind( const char_type* aStartPtr, const char_type* aEndPtr )
         {
+          NS_ASSERTION(aStartPtr && aEndPtr, "nsDependentString must wrap a non-NULL buffer");
+          NS_ASSERTION(!*aEndPtr, "nsDependentString must wrap only null-terminated strings");
           mHandle.DataStart(aStartPtr);
           mHandle.DataEnd(aEndPtr);
         }
@@ -65,13 +71,8 @@ class NS_COM nsDependentString
       void
       Rebind( const char_type* aPtr, PRUint32 aLength )
         {
-          if ( aLength == PRUint32(-1) )
-            {
-//            NS_WARNING("Tell scc: Caller binding a dependent string doesn't know the real length.  Please pick the appropriate call.");
-              Rebind(aPtr);
-            }
-          else
-            Rebind(aPtr, aPtr+aLength);
+          NS_ASSERTION(aLength != PRUint32(-1), "caller passing bogus length");
+          Rebind(aPtr, aPtr+aLength);
         }
 
       nsDependentString( const char_type* aStartPtr, const char_type* aEndPtr ) { Rebind(aStartPtr, aEndPtr); }
@@ -104,13 +105,19 @@ class NS_COM nsDependentCString
       void
       Rebind( const char_type* aPtr )
         {
+          NS_ASSERTION(aPtr, "nsDependentCString must wrap a non-NULL buffer");
           mHandle.DataStart(aPtr);
+          // XXX This should not be NULL-safe, but we should flip the switch
+          // early in a milestone.
+          //mHandle.DataEnd(aPtr+nsCharTraits<char_type>::length(aPtr));
           mHandle.DataEnd(aPtr ? (aPtr+nsCharTraits<char_type>::length(aPtr)) : 0);
         }
 
       void
       Rebind( const char_type* aStartPtr, const char_type* aEndPtr )
         {
+          NS_ASSERTION(aStartPtr && aEndPtr, "nsDependentCString must wrap a non-NULL buffer");
+          NS_ASSERTION(!*aEndPtr, "nsDependentCString must wrap only null-terminated strings");
           mHandle.DataStart(aStartPtr);
           mHandle.DataEnd(aEndPtr);
         }
@@ -118,13 +125,8 @@ class NS_COM nsDependentCString
       void
       Rebind( const char_type* aPtr, PRUint32 aLength )
         {
-          if ( aLength == PRUint32(-1) )
-            {
-//            NS_WARNING("Tell scc: Caller binding a dependent string doesn't know the real length.  Please pick the appropriate call.");
-              Rebind(aPtr);
-            }
-          else
-            Rebind(aPtr, aPtr+aLength);
+          NS_ASSERTION(aLength != PRUint32(-1), "caller passing bogus length");
+          Rebind(aPtr, aPtr+aLength);
         }
 
       nsDependentCString( const char_type* aStartPtr, const char_type* aEndPtr ) { Rebind(aStartPtr, aEndPtr); }
@@ -136,7 +138,7 @@ class NS_COM nsDependentCString
 
     private:
         // NOT TO BE IMPLEMENTED
-      void operator=( const self_type& );                                        // we're immutable, so no copy-assignment operator
+      void operator=( const self_type& );                                       // we're immutable, so no copy-assignment operator
 
     public:
       virtual const buffer_handle_type* GetFlatBufferHandle() const             { return NS_REINTERPRET_CAST(const buffer_handle_type*, &mHandle); }
diff --git a/xpcom/string/public/nsDependentSubstring.h b/xpcom/string/public/nsDependentSubstring.h
index c0ddc6a1112c..1e4e709bd4de 100644
--- a/xpcom/string/public/nsDependentSubstring.h
+++ b/xpcom/string/public/nsDependentSubstring.h
@@ -28,6 +28,10 @@
 #include "nsAString.h"
 #endif
 
+#ifndef nsASingleFragmentString_h___
+#include "nsASingleFragmentString.h"
+#endif
+
 #ifndef nsStringTraits_h___
 #include "nsStringTraits.h"
 #endif
@@ -145,8 +149,88 @@ class NS_COM nsDependentCSubstring
   };
 
 
+class NS_COM nsDependentSingleFragmentSubstring
+      : public nsASingleFragmentString
+  {
+    public:
+      typedef nsDependentSingleFragmentSubstring self_type;
+      typedef nsASingleFragmentString   abstract_single_fragment_type;
+
+      void
+      Rebind( const char_type* aStartPtr, const char_type* aEndPtr )
+        {
+          NS_ASSERTION(aStartPtr && aEndPtr, "nsDependentSingleFragmentString must wrap a non-NULL buffer");
+          mHandle.DataStart(aStartPtr);
+          mHandle.DataEnd(aEndPtr);
+        }
+
+      void
+      Rebind( const abstract_single_fragment_type& aString, const PRUint32 aStartPos, const PRUint32 aLength )
+        {
+          const_char_iterator iter;
+          mHandle.DataStart(aString.BeginReading(iter) + NS_MIN(aStartPos, aString.Length()));
+          mHandle.DataEnd( NS_MIN(mHandle.DataStart() + aLength, aString.EndReading(iter)) );
+        }
+
+      nsDependentSingleFragmentSubstring( const char_type* aStartPtr, const char_type* aEndPtr ) { Rebind(aStartPtr, aEndPtr); }
+      nsDependentSingleFragmentSubstring( const abstract_single_fragment_type& aString, const PRUint32 aStartPos, const PRUint32 aLength ) { Rebind(aString, aStartPos, aLength); }
+
+      // nsDependentSingleFragmentSubstring( const self_type& );                  // auto-generated copy-constructor OK
+      // ~nsDependentSingleFragmentSubstring();                                   // auto-generated destructor OK
+
+    private:
+        // NOT TO BE IMPLEMENTED
+      void operator=( const self_type& );                                       // we're immutable, so no copy-assignment operator
+
+    public:
+      virtual const buffer_handle_type* GetFlatBufferHandle() const             { return NS_REINTERPRET_CAST(const buffer_handle_type*, &mHandle); }
+      virtual const buffer_handle_type* GetBufferHandle() const                 { return NS_REINTERPRET_CAST(const buffer_handle_type*, &mHandle); }
+
+    private:
+      const_buffer_handle_type mHandle;
+  };
 
 
+class NS_COM nsDependentSingleFragmentCSubstring
+      : public nsASingleFragmentCString
+  {
+    public:
+      typedef nsDependentSingleFragmentCSubstring self_type;
+      typedef nsASingleFragmentCString  abstract_single_fragment_type;
+
+      void
+      Rebind( const char_type* aStartPtr, const char_type* aEndPtr )
+        {
+          NS_ASSERTION(aStartPtr && aEndPtr, "nsDependentSingleFragmentCString must wrap a non-NULL buffer");
+          mHandle.DataStart(aStartPtr);
+          mHandle.DataEnd(aEndPtr);
+        }
+
+      void
+      Rebind( const abstract_single_fragment_type& aString, const PRUint32 aStartPos, const PRUint32 aLength )
+        {
+          const_char_iterator iter;
+          mHandle.DataStart(aString.BeginReading(iter) + NS_MIN(aStartPos, aString.Length()));
+          mHandle.DataEnd( NS_MIN(mHandle.DataStart() + aLength, aString.EndReading(iter)) );
+        }
+
+      nsDependentSingleFragmentCSubstring( const char_type* aStartPtr, const char_type* aEndPtr ) { Rebind(aStartPtr, aEndPtr); }
+      nsDependentSingleFragmentCSubstring( const abstract_single_fragment_type& aString, const PRUint32 aStartPos, const PRUint32 aLength ) { Rebind(aString, aStartPos, aLength); }
+
+      // nsDependentSingleFragmentCSubstring( const self_type& );                  // auto-generated copy-constructor OK
+      // ~nsDependentSingleFragmentCSubstring();                                   // auto-generated destructor OK
+
+    private:
+        // NOT TO BE IMPLEMENTED
+      void operator=( const self_type& );                                       // we're immutable, so no copy-assignment operator
+
+    public:
+      virtual const buffer_handle_type* GetFlatBufferHandle() const             { return NS_REINTERPRET_CAST(const buffer_handle_type*, &mHandle); }
+      virtual const buffer_handle_type* GetBufferHandle() const                 { return NS_REINTERPRET_CAST(const buffer_handle_type*, &mHandle); }
+
+    private:
+      const_buffer_handle_type mHandle;
+  };
 
 
 
@@ -179,4 +263,33 @@ Substring( const nsAString::const_iterator& aStart, const nsAString::const_itera
   }
 
 
+inline
+const nsDependentSingleFragmentCSubstring
+Substring( const nsASingleFragmentCString& aString, PRUint32 aStartPos, PRUint32 aSubstringLength )
+  {
+    return nsDependentSingleFragmentCSubstring(aString, aStartPos, aSubstringLength);
+  }
+
+inline
+const nsDependentSingleFragmentSubstring
+Substring( const nsASingleFragmentString& aString, PRUint32 aStartPos, PRUint32 aSubstringLength )
+  {
+    return nsDependentSingleFragmentSubstring(aString, aStartPos, aSubstringLength);
+  }
+
+inline
+const nsDependentSingleFragmentCSubstring
+Substring( const nsASingleFragmentCString::const_char_iterator& aStart, const nsASingleFragmentCString::const_char_iterator& aEnd )
+  {
+    return nsDependentSingleFragmentCSubstring(aStart, aEnd);
+  }
+
+inline
+const nsDependentSingleFragmentSubstring
+Substring( const nsASingleFragmentString::const_char_iterator& aStart, const nsASingleFragmentString::const_char_iterator& aEnd )
+  {
+    return nsDependentSingleFragmentSubstring(aStart, aEnd);
+  }
+
+
 #endif /* !defined(nsDependentSubstring_h___) */
diff --git a/xpcom/string/src/nsAString.cpp b/xpcom/string/src/nsAString.cpp
index 454530201b9c..e4dcfbf22dfa 100644
--- a/xpcom/string/src/nsAString.cpp
+++ b/xpcom/string/src/nsAString.cpp
@@ -306,13 +306,13 @@ nsAString::do_AssignFromElementPtr( const char_type* aPtr )
 void
 nsAString::do_AssignFromElementPtrLength( const char_type* aPtr, size_type aLength )
   {
-    do_AssignFromReadable(nsDependentString(aPtr, aLength));
+    do_AssignFromReadable(Substring(aPtr, aPtr+aLength));
   }
 
 void
 nsAString::do_AssignFromElement( char_type aChar )
   {
-    do_AssignFromReadable(nsDependentString(&aChar, 1));
+    do_AssignFromReadable(Substring(&aChar, &aChar+1));
   }
 
 
@@ -371,13 +371,13 @@ nsAString::do_AppendFromElementPtr( const char_type* aPtr )
 void
 nsAString::do_AppendFromElementPtrLength( const char_type* aPtr, size_type aLength )
   {
-    do_AppendFromReadable(nsDependentString(aPtr, aLength));
+    do_AppendFromReadable(Substring(aPtr, aPtr+aLength));
   }
 
 void
 nsAString::do_AppendFromElement( char_type aChar )
   {
-    do_AppendFromReadable(nsDependentString(&aChar, 1));
+    do_AppendFromReadable(Substring(&aChar, &aChar + 1));
   }
 
 
@@ -440,13 +440,13 @@ nsAString::do_InsertFromElementPtr( const char_type* aPtr, index_type atPosition
 void
 nsAString::do_InsertFromElementPtrLength( const char_type* aPtr, index_type atPosition, size_type aLength )
   {
-    do_InsertFromReadable(nsDependentString(aPtr, aLength), atPosition);
+    do_InsertFromReadable(Substring(aPtr, aPtr+aLength), atPosition);
   }
 
 void
 nsAString::do_InsertFromElement( char_type aChar, index_type atPosition )
   {
-    do_InsertFromReadable(nsDependentString(&aChar, 1), atPosition);
+    do_InsertFromReadable(Substring(&aChar, &aChar+1), atPosition);
   }
 
 
@@ -825,13 +825,13 @@ nsACString::do_AssignFromElementPtr( const char_type* aPtr )
 void
 nsACString::do_AssignFromElementPtrLength( const char_type* aPtr, size_type aLength )
   {
-    do_AssignFromReadable(nsDependentCString(aPtr, aLength));
+    do_AssignFromReadable(Substring(aPtr, aPtr+aLength));
   }
 
 void
 nsACString::do_AssignFromElement( char_type aChar )
   {
-    do_AssignFromReadable(nsDependentCString(&aChar, 1));
+    do_AssignFromReadable(Substring(&aChar, &aChar+1));
   }
 
 
@@ -890,13 +890,13 @@ nsACString::do_AppendFromElementPtr( const char_type* aPtr )
 void
 nsACString::do_AppendFromElementPtrLength( const char_type* aPtr, size_type aLength )
   {
-    do_AppendFromReadable(nsDependentCString(aPtr, aLength));
+    do_AppendFromReadable(Substring(aPtr, aPtr+aLength));
   }
 
 void
 nsACString::do_AppendFromElement( char_type aChar )
   {
-    do_AppendFromReadable(nsDependentCString(&aChar, 1));
+    do_AppendFromReadable(Substring(&aChar, &aChar + 1));
   }
 
 
@@ -959,13 +959,13 @@ nsACString::do_InsertFromElementPtr( const char_type* aPtr, index_type atPositio
 void
 nsACString::do_InsertFromElementPtrLength( const char_type* aPtr, index_type atPosition, size_type aLength )
   {
-    do_InsertFromReadable(nsDependentCString(aPtr, aLength), atPosition);
+    do_InsertFromReadable(Substring(aPtr, aPtr+aLength), atPosition);
   }
 
 void
 nsACString::do_InsertFromElement( char_type aChar, index_type atPosition )
   {
-    do_InsertFromReadable(nsDependentCString(&aChar, 1), atPosition);
+    do_InsertFromReadable(Substring(&aChar, &aChar+1), atPosition);
   }
 
 
diff --git a/xpfe/components/urlbarhistory/src/nsUrlbarHistory.cpp b/xpfe/components/urlbarhistory/src/nsUrlbarHistory.cpp
index 0dfc0e2b150b..3ce28c1c7b8a 100644
--- a/xpfe/components/urlbarhistory/src/nsUrlbarHistory.cpp
+++ b/xpfe/components/urlbarhistory/src/nsUrlbarHistory.cpp
@@ -1,4 +1,4 @@
-/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 0 -*-
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
  *
  * The contents of this file are subject to the Mozilla Public
  * License Version 1.1 (the "License"); you may not use this file
@@ -323,7 +323,6 @@ nsUrlbarHistory::SearchPreviousResults(const PRUnichar *searchStr, nsIAutoComple
     nsXPIDLString prevSearchString;
     PRUint32 searchStrLen = nsCRT::strlen(searchStr);
     nsresult rv;
-    nsAutoString   searchAutoStr(searchStr);
 
     rv = previousSearchResult->GetSearchString(getter_Copies(prevSearchString));
     if (NS_FAILED(rv))
@@ -333,8 +332,12 @@ nsUrlbarHistory::SearchPreviousResults(const PRUnichar *searchStr, nsIAutoComple
         return NS_ERROR_FAILURE;
     
     PRUint32 prevSearchStrLen = nsCRT::strlen(prevSearchString);
+    // XXXldb This code used to be the line:
+    // if (searchStrLen < prevSearchStrLen || nsCRT::strncasecmp(searchStr, prevSearchString, prevSearchStrLen != 0))
+    // which doesn't make any sense (since the "!= 0" was inside the
+    // parentheses)
     if (searchStrLen < prevSearchStrLen ||
-        Compare(nsDependentString(searchStr),
+        Compare(Substring(searchStr, searchStr+prevSearchStrLen),
                 nsDependentString(prevSearchString, prevSearchStrLen),
                 nsCaseInsensitiveStringComparator())!= 0)
         return NS_ERROR_ABORT;
@@ -365,11 +368,11 @@ nsUrlbarHistory::SearchPreviousResults(const PRUnichar *searchStr, nsIAutoComple
 
 			if (itemValue.IsEmpty())
 				continue;
-		    if (Compare(nsDependentString(searchStr, searchStrLen),
-                        itemValue,
+            if (Compare(nsDependentString(searchStr, searchStrLen),
+                        Substring(itemValue, 0, searchStrLen),
                         nsCaseInsensitiveStringComparator()) == 0)
-			    continue;
-			
+                continue;
+
 	    }
 	    return NS_OK;
     }