--- a/dom/base/DocumentFragment.cpp
+++ b/dom/base/DocumentFragment.cpp
@@ -28,17 +28,17 @@ JSObject*
 DocumentFragment::WrapNode(JSContext *aCx, JS::Handle<JSObject*> aGivenProto)
 {
   return DocumentFragmentBinding::Wrap(aCx, this, aGivenProto);
 }
 
 bool
 DocumentFragment::IsNodeOfType(uint32_t aFlags) const
 {
-  return !(aFlags & ~eDOCUMENT_FRAGMENT);
+  return false;
 }
 
 #ifdef DEBUG
 void
 DocumentFragment::List(FILE* out, int32_t aIndent) const
 {
   int32_t indent;
   for (indent = aIndent; --indent >= 0; ) {

--- a/dom/base/nsContentUtils.cpp
+++ b/dom/base/nsContentUtils.cpp
@@ -2439,19 +2439,19 @@ nsContentUtils::ContentIsHostIncludingDe
   const nsINode* aPossibleDescendant, const nsINode* aPossibleAncestor)
 {
   NS_PRECONDITION(aPossibleDescendant, "The possible descendant is null!");
   NS_PRECONDITION(aPossibleAncestor, "The possible ancestor is null!");
 
   do {
     if (aPossibleDescendant == aPossibleAncestor)
       return true;
-    if (aPossibleDescendant->NodeType() == nsINode::DOCUMENT_FRAGMENT_NODE) {
+    if (aPossibleDescendant->IsDocumentFragment()) {
       aPossibleDescendant =
-        static_cast<const DocumentFragment*>(aPossibleDescendant)->GetHost();
+        aPossibleDescendant->AsDocumentFragment()->GetHost();
     } else {
       aPossibleDescendant = aPossibleDescendant->GetParentNode();
     }
   } while (aPossibleDescendant);
 
   return false;
 }
 

--- a/dom/base/nsDocumentEncoder.cpp
+++ b/dom/base/nsDocumentEncoder.cpp
@@ -538,20 +538,18 @@ nsDocumentEncoder::SerializeToStringIter
       // Check if we have siblings.
       node = current->GetNextSibling();
       if (!node) {
         // Perhaps parent node has siblings.
         current = current->GetParentNode();
 
         // Handle template element. If the parent is a template's content,
         // then adjust the parent to be the template element.
-        if (current && current != aNode &&
-            current->NodeType() == nsINode::DOCUMENT_FRAGMENT_NODE) {
-          DocumentFragment* frag = static_cast<DocumentFragment*>(current);
-          nsIContent* host = frag->GetHost();
+        if (current && current != aNode && current->IsDocumentFragment()) {
+          nsIContent* host = current->AsDocumentFragment()->GetHost();
           if (host && host->IsHTMLElement(nsGkAtoms::_template)) {
             current = host;
           }
         }
       }
     }
   }
 

--- a/dom/base/nsINode.cpp
+++ b/dom/base/nsINode.cpp
@@ -1678,17 +1678,17 @@ nsINode::doRemoveChildAt(uint32_t aIndex
 static
 bool IsAllowedAsChild(nsIContent* aNewChild, nsINode* aParent,
                       bool aIsReplace, nsINode* aRefChild)
 {
   MOZ_ASSERT(aNewChild, "Must have new child");
   MOZ_ASSERT_IF(aIsReplace, aRefChild);
   MOZ_ASSERT(aParent);
   MOZ_ASSERT(aParent->IsDocument() ||
-             aParent->IsNodeOfType(nsINode::eDOCUMENT_FRAGMENT) ||
+             aParent->IsDocumentFragment() ||
              aParent->IsElement(),
              "Nodes that are not documents, document fragments or elements "
              "can't be parents!");
 
   // A common case is that aNewChild has no kids, in which case
   // aParent can't be a descendant of aNewChild unless they're
   // actually equal to each other.  Fast-path that case, since aParent
   // could be pretty deep in the DOM tree.
@@ -1840,19 +1840,17 @@ nsINode::EnsurePreInsertionValidity(nsIN
   }
   EnsurePreInsertionValidity2(false, aNewChild, aRefChild, aError);
 }
 
 void
 nsINode::EnsurePreInsertionValidity1(nsINode& aNewChild, nsINode* aRefChild,
                                      ErrorResult& aError)
 {
-  if ((!IsDocument() &&
-       !IsNodeOfType(eDOCUMENT_FRAGMENT) &&
-       !IsElement()) ||
+  if ((!IsDocument() && !IsDocumentFragment() && !IsElement()) ||
       !aNewChild.IsContent()) {
     aError.Throw(NS_ERROR_DOM_HIERARCHY_REQUEST_ERR);
     return;
   }
 }
 
 void
 nsINode::EnsurePreInsertionValidity2(bool aReplace, nsINode& aNewChild,
@@ -2357,22 +2355,21 @@ nsINode::Contains(const nsINode* aOther)
   const nsIContent* other = static_cast<const nsIContent*>(aOther);
   if (this == OwnerDoc()) {
     // document.contains(aOther) returns true if aOther is in the document,
     // but is not in any anonymous subtree.
     // IsInUncomposedDoc() check is done already before this.
     return !other->IsInAnonymousSubtree();
   }
 
-  if (!IsElement() && !IsNodeOfType(nsINode::eDOCUMENT_FRAGMENT)) {
+  if (!IsElement() && !IsDocumentFragment()) {
     return false;
   }
 
-  const nsIContent* thisContent = static_cast<const nsIContent*>(this);
-  if (thisContent->GetBindingParent() != other->GetBindingParent()) {
+  if (AsContent()->GetBindingParent() != other->GetBindingParent()) {
     return false;
   }
 
   return nsContentUtils::ContentIsDescendantOf(other, this);
 }
 
 uint32_t
 nsINode::Length() const
@@ -2518,17 +2515,17 @@ nsINode::QuerySelectorAll(const nsAStrin
   const bool useInvalidation = false;
   Servo_SelectorList_QueryAll(this, list, contentList.get(), useInvalidation);
   return contentList.forget();
 }
 
 Element*
 nsINode::GetElementById(const nsAString& aId)
 {
-  MOZ_ASSERT(IsElement() || IsNodeOfType(eDOCUMENT_FRAGMENT),
+  MOZ_ASSERT(IsElement() || IsDocumentFragment(),
              "Bogus this object for GetElementById call");
   if (IsInUncomposedDoc()) {
     ElementHolder holder;
     FindMatchingElementsWithId<true>(aId, this, nullptr, holder);
     return holder.mElement;
   }
 
   for (nsIContent* kid = GetFirstChild(); kid; kid = kid->GetNextNode(this)) {

--- a/dom/base/nsINode.h
+++ b/dom/base/nsINode.h
@@ -415,18 +415,16 @@ public:
     /** nsIAttribute nodes */
     eATTRIBUTE           = 1 << 2,
     /** xml processing instructions */
     ePROCESSING_INSTRUCTION = 1 << 4,
     /** comment nodes */
     eCOMMENT             = 1 << 5,
     /** form control elements */
     eHTML_FORM_CONTROL   = 1 << 6,
-    /** document fragments */
-    eDOCUMENT_FRAGMENT   = 1 << 7,
     /** character data nodes (comments, PIs, text). */
     eDATA_NODE           = 1 << 8,
     /** HTMLMediaElement */
     eMEDIA               = 1 << 9,
     /** animation elements */
     eANIMATION           = 1 << 10,
     /** filter elements that implement SVGFilterPrimitiveStandardAttributes */
     eFILTER              = 1 << 11,

--- a/dom/base/nsRange.cpp
+++ b/dom/base/nsRange.cpp
@@ -979,17 +979,17 @@ nsRange::DoSetRange(const RawRangeBounda
                    aEnd.Container()->IsContent() &&
                    aRoot ==
                     static_cast<nsIContent*>(aStart.Container())->GetBindingParent() &&
                    aRoot ==
                     static_cast<nsIContent*>(aEnd.Container())->GetBindingParent()) ||
                   (!aRoot->GetParentNode() &&
                    (aRoot->IsDocument() ||
                     aRoot->IsNodeOfType(nsINode::eATTRIBUTE) ||
-                    aRoot->IsNodeOfType(nsINode::eDOCUMENT_FRAGMENT) ||
+                    aRoot->IsDocumentFragment() ||
                      /*For backward compatibility*/
                     aRoot->IsContent())),
                   "Bad root");
   if (mRoot != aRoot) {
     if (mRoot) {
       mRoot->RemoveMutationObserver(this);
     }
     if (aRoot) {

--- a/dom/base/nsTreeSanitizer.cpp
+++ b/dom/base/nsTreeSanitizer.cpp
@@ -9,16 +9,17 @@
 #include "mozilla/ArrayUtils.h"
 #include "mozilla/BindingStyleRule.h"
 #include "mozilla/DeclarationBlock.h"
 #include "mozilla/DeclarationBlockInlines.h"
 #include "mozilla/ServoDeclarationBlock.h"
 #include "mozilla/StyleSheetInlines.h"
 #include "mozilla/css/Rule.h"
 #include "mozilla/dom/CSSRuleList.h"
+#include "mozilla/dom/DocumentFragment.h"
 #include "mozilla/dom/SRIMetadata.h"
 #include "nsCSSParser.h"
 #include "nsCSSPropertyID.h"
 #include "nsUnicharInputStream.h"
 #include "nsAttrName.h"
 #include "nsIScriptError.h"
 #include "nsIScriptSecurityManager.h"
 #include "nsNetUtil.h"
@@ -1345,23 +1346,21 @@ nsTreeSanitizer::SanitizeURL(mozilla::do
                  aElement->OwnerDoc(), aElement, aLocalName);
     }
     return true;
   }
   return false;
 }
 
 void
-nsTreeSanitizer::Sanitize(nsIContent* aFragment)
+nsTreeSanitizer::Sanitize(DocumentFragment* aFragment)
 {
   // If you want to relax these preconditions, be sure to check the code in
   // here that notifies / does not notify or that fires mutation events if
   // in tree.
-  NS_PRECONDITION(aFragment->IsNodeOfType(nsINode::eDOCUMENT_FRAGMENT),
-      "Argument was not DOM fragment.");
   NS_PRECONDITION(!aFragment->IsInUncomposedDoc(), "The fragment is in doc?");
 
   mFullDocument = false;
   SanitizeChildren(aFragment);
 }
 
 void
 nsTreeSanitizer::Sanitize(nsIDocument* aDocument)

--- a/dom/base/nsTreeSanitizer.h
+++ b/dom/base/nsTreeSanitizer.h
@@ -25,22 +25,20 @@ class MOZ_STACK_CLASS nsTreeSanitizer {
      */
     explicit nsTreeSanitizer(uint32_t aFlags = 0);
 
     static void InitializeStatics();
     static void ReleaseStatics();
 
     /**
      * Sanitizes a disconnected DOM fragment freshly obtained from a parser.
-     * The argument must be of type nsINode::eDOCUMENT_FRAGMENT and,
-     * consequently, must not be in the document. Furthermore, the fragment
-     * must have just come from a parser so that it can't have mutation
-     * event listeners set on it.
+     * The fragment must have just come from a parser so that it can't have
+     * mutation event listeners set on it.
      */
-    void Sanitize(nsIContent* aFragment);
+    void Sanitize(mozilla::dom::DocumentFragment* aFragment);
 
     /**
      * Sanitizes a disconnected (not in a docshell) document freshly obtained
      * from a parser. The document must not be embedded in a docshell and must
      * not have had a chance to get mutation event listeners attached to it.
      * The root element must be <html>.
      */
     void Sanitize(nsIDocument* aDocument);

--- a/dom/xslt/xpath/txMozillaXPathTreeWalker.cpp
+++ b/dom/xslt/xpath/txMozillaXPathTreeWalker.cpp
@@ -458,17 +458,17 @@ txXPathNodeUtils::appendNodeValue(const 
             aResult.Append(result);
         }
 
         return;
     }
 
     if (aNode.isDocument() ||
         aNode.mNode->IsElement() ||
-        aNode.mNode->IsNodeOfType(nsINode::eDOCUMENT_FRAGMENT)) {
+        aNode.mNode->IsDocumentFragment()) {
         nsContentUtils::AppendNodeTextContent(aNode.mNode, true, aResult,
                                               mozilla::fallible);
 
         return;
     }
 
     MOZ_ASSERT(aNode.mNode->IsCharacterData());
     static_cast<CharacterData*>(aNode.Content())->AppendTextTo(aResult);

--- a/dom/xslt/xslt/txEXSLTFunctions.cpp
+++ b/dom/xslt/xslt/txEXSLTFunctions.cpp
@@ -104,22 +104,18 @@ createTextNode(txIEvalContext *aContext,
     *aResult = txXPathNativeNode::createXPathNode(text->AsContent(), true);
     NS_ENSURE_TRUE(*aResult, NS_ERROR_OUT_OF_MEMORY);
 
     return NS_OK;
 }
 
 static nsresult
 createAndAddToResult(nsAtom* aName, const nsAString& aValue,
-                     txNodeSet* aResultSet, nsIContent* aResultHolder)
+                     txNodeSet* aResultSet, DocumentFragment* aResultHolder)
 {
-    NS_ASSERTION(aResultHolder->IsNodeOfType(nsINode::eDOCUMENT_FRAGMENT) &&
-                 aResultHolder->OwnerDoc(),
-                 "invalid result-holder");
-
     nsIDocument* doc = aResultHolder->OwnerDoc();
     nsCOMPtr<Element> elem = doc->CreateElem(nsDependentAtomString(aName),
                                              nullptr, kNameSpaceID_None);
     NS_ENSURE_TRUE(elem, NS_ERROR_NULL_POINTER);
 
     RefPtr<nsTextNode> text = new nsTextNode(doc->NodeInfoManager());
 
     nsresult rv = text->SetText(aValue, false);

--- a/editor/libeditor/HTMLEditorDataTransfer.cpp
+++ b/editor/libeditor/HTMLEditorDataTransfer.cpp
@@ -264,17 +264,17 @@ HTMLEditor::DoInsertHTMLWithContext(cons
     }
   }
 
   // we need to recalculate various things based on potentially new offsets
   // this is work to be completed at a later date (probably by jfrancis)
 
   // make a list of what nodes in docFrag we need to move
   nsTArray<OwningNonNull<nsINode>> nodeList;
-  CreateListOfNodesToPaste(*static_cast<DocumentFragment*>(fragmentAsNode.get()),
+  CreateListOfNodesToPaste(*fragmentAsNode->AsDocumentFragment(),
                            nodeList,
                            streamStartParent, streamStartOffset,
                            streamEndParent, streamEndOffset);
 
   if (nodeList.IsEmpty()) {
     // We aren't inserting anything, but if aDeleteSelection is set, we do want
     // to delete everything.
     if (aDeleteSelection) {

--- a/parser/html/nsHtml5TreeOperation.cpp
+++ b/parser/html/nsHtml5TreeOperation.cpp
@@ -210,21 +210,19 @@ nsHtml5TreeOperation::AppendToDocument(n
 }
 
 static bool
 IsElementOrTemplateContent(nsINode* aNode)
 {
   if (aNode) {
     if (aNode->IsElement()) {
       return true;
-    } else if (aNode->NodeType() == nsINode::DOCUMENT_FRAGMENT_NODE) {
+    } else if (aNode->IsDocumentFragment()) {
       // Check if the node is a template content.
-      mozilla::dom::DocumentFragment* frag =
-        static_cast<mozilla::dom::DocumentFragment*>(aNode);
-      nsIContent* fragHost = frag->GetHost();
+      nsIContent* fragHost = aNode->AsDocumentFragment()->GetHost();
       if (fragHost && nsNodeUtils::IsTemplateElement(fragHost)) {
         return true;
       }
     }
   }
   return false;
 }
 

--- a/parser/html/nsParserUtils.cpp
+++ b/parser/html/nsParserUtils.cpp
@@ -159,17 +159,17 @@ nsParserUtils::ParseFragment(const nsASt
   } else {
     NS_ADDREF(*aReturn = new DocumentFragment(document->NodeInfoManager()));
     fragment = do_QueryInterface(*aReturn);
     rv = nsContentUtils::ParseFragmentHTML(
       aFragment, fragment, nsGkAtoms::body, kNameSpaceID_XHTML, false, true);
   }
   if (fragment) {
     nsTreeSanitizer sanitizer(aFlags);
-    sanitizer.Sanitize(fragment);
+    sanitizer.Sanitize(fragment->AsDocumentFragment());
   }
 
   if (scripts_enabled) {
     loader->SetEnabled(true);
   }
 
   return rv;
 }