diff --git a/common/content/buffer.js b/common/content/buffer.js
index e4b7450e..f2a62807 100644
--- a/common/content/buffer.js
+++ b/common/content/buffer.js
@@ -847,7 +847,7 @@ function Buffer() //{{{
         },
 
         /**
-         * @property {Object} The last focused input field in the buffer. Used
+         * @property {Node} The last focused input field in the buffer. Used
          *     by the "gi" key binding.
          */
         get lastInputField()
@@ -1148,7 +1148,7 @@ function Buffer() //{{{
         },
 
         /**
-         * @property {Object} The current document's selection controller.
+         * @property {nsISelectionController} The current document's selection controller.
          */
         get selectionController() getBrowser().docShell
                 .QueryInterface(Ci.nsIInterfaceRequestor)
@@ -1158,7 +1158,7 @@ function Buffer() //{{{
         /**
          * Saves a page link to disk.
          *
-         * @param {Object} elem The page link to save.
+         * @param {HTMLAnchorElement} elem The page link to save.
          * @param {boolean} skipPrompt Whether to open the "Save Link As..." dialog
          */
         saveLink: function (elem, skipPrompt)
@@ -1371,7 +1371,7 @@ function Buffer() //{{{
         /**
          * Displays information about the specified element.
          *
-         * @param {Object} elem
+         * @param {Node} elem
          */
         showElementInfo: function (elem)
         {
diff --git a/common/content/ui.js b/common/content/ui.js
index 42245d6b..82dea5bc 100644
--- a/common/content/ui.js
+++ b/common/content/ui.js
@@ -434,7 +434,7 @@ function CommandLine() //{{{
             this.itemList.selectItem(idx);
         },
 
-        ntab: 0,
+        tabs: [],
 
         tab: function tab(reverse)
         {
@@ -443,12 +443,13 @@ function CommandLine() //{{{
             if (this.context.waitingForTab || this.wildIndex == -1)
                 this.complete(true, true);
 
-            this.ntab++;
+            this.tabs.push(reverse);
             if (this.waiting)
                 return;
 
-            while (this.ntab--)
+            while (this.tabs.length)
             {
+                reverse = this.tabs.pop();
                 switch (this.wildtype.replace(/.*:/, ""))
                 {
                     case "":
diff --git a/common/content/util.js b/common/content/util.js
index 53c8c31a..fdb0390e 100644
--- a/common/content/util.js
+++ b/common/content/util.js
@@ -296,8 +296,8 @@ const util = { //{{{
     /**
      * Generates an Asciidoc help entry.
      *
-     * @param {Object} obj A liberator <b>Command</b>, <b>Mapping</b> or
-     *     <b>Option</b> object
+     * @param {Command|Mapping|Option} obj A liberator <b>Command</b>,
+     *     <b>Mapping</b> or <b>Option</b> object
      * @param {string} extraHelp Extra help text beyond the description.
      * @returns {string}
      */
@@ -360,7 +360,7 @@ const util = { //{{{
      *
      * @param {string} url
      * @param {function} callback
-     * @returns {Object}
+     * @returns {XMLHttpRequest}
      */
     httpGet: function httpGet(url, callback)
     {
@@ -426,10 +426,10 @@ const util = { //{{{
     },
 
     /**
-     * Converts a URI string into an URI object.
+     * Converts a URI string into a URI object.
      *
      * @param {string} uri
-     * @returns {Object}
+     * @returns {nsIURI}
      */
     // FIXME: createURI needed too?
     newURI: function (uri)
@@ -663,7 +663,8 @@ const util = { //{{{
      *
      * @param {Node} node
      * @param {Document} doc
-     * @param {Object} nodes
+     * @param {Object} nodes If present, nodes with the "key" attribute are
+     *     stored here, keyed to the value thereof.
      * @returns {Node}
      */
     xmlToDom: function xmlToDom(node, doc, nodes)