diff --git a/image/src/imgRequest.cpp b/image/src/imgRequest.cpp
index 67529d330fd..b570496f019 100644
--- a/image/src/imgRequest.cpp
+++ b/image/src/imgRequest.cpp
@@ -637,7 +637,7 @@ NS_IMETHODIMP imgRequest::OnStartRequest(nsIRequest *aRequest, nsISupports *ctxt
     PR_LOG(GetImgLog(), PR_LOG_WARNING,
            ("[this=%p] imgRequest::OnStartRequest -- "
             "RetargetDeliveryTo rv %d=%s\n",
-            this, NS_SUCCEEDED(rv) ? "succeeded" : "failed", rv));
+            this, rv, NS_SUCCEEDED(rv) ? "succeeded" : "failed"));
   }
 
   return NS_OK;
diff --git a/image/src/imgStatusTracker.cpp b/image/src/imgStatusTracker.cpp
index b4fd8147d97..3fb2640c9c5 100644
--- a/image/src/imgStatusTracker.cpp
+++ b/image/src/imgStatusTracker.cpp
@@ -357,7 +357,7 @@ imgStatusTracker::NotifyCurrentState(imgRequestProxy* proxy)
 
 #define NOTIFY_IMAGE_OBSERVERS(func) \
   do { \
-    nsTObserverArray<imgRequestProxy*>::ForwardIterator iter(proxies); \
+    nsTObserverArray<nsRefPtr<imgRequestProxy> >::ForwardIterator iter(proxies); \
     while (iter.HasMore()) { \
       nsRefPtr<imgRequestProxy> proxy = iter.GetNext(); \
       if (!proxy->NotificationsDeferred()) { \
@@ -367,7 +367,7 @@ imgStatusTracker::NotifyCurrentState(imgRequestProxy* proxy)
   } while (false);
 
 /* static */ void
-imgStatusTracker::SyncNotifyState(nsTObserverArray<imgRequestProxy*>& proxies,
+imgStatusTracker::SyncNotifyState(nsTObserverArray<nsRefPtr<imgRequestProxy> >& proxies,
                                   bool hasImage, uint32_t state,
                                   nsIntRect& dirtyRect, bool hadLastPart)
 {
@@ -505,7 +505,7 @@ imgStatusTracker::SyncNotifyDifference(const ImageStatusDiff& diff)
   mInvalidRect.SetEmpty();
 
   if (diff.unblockedOnload) {
-    nsTObserverArray<imgRequestProxy*>::ForwardIterator iter(mConsumers);
+    nsTObserverArray<nsRefPtr<imgRequestProxy> >::ForwardIterator iter(mConsumers);
     while (iter.HasMore()) {
       // Hold on to a reference to this proxy, since notifying the state can
       // cause it to disappear.
@@ -550,7 +550,7 @@ imgStatusTracker::SyncNotify(imgRequestProxy* proxy)
     r = mImage->FrameRect(imgIContainer::FRAME_CURRENT);
   }
 
-  nsTObserverArray<imgRequestProxy*> array;
+  nsTObserverArray<nsRefPtr<imgRequestProxy> > array;
   array.AppendElement(proxy);
   SyncNotifyState(array, !!mImage, mState, r, mHadLastPart);
 }
@@ -781,7 +781,7 @@ imgStatusTracker::OnUnlockedDraw()
 {
   MOZ_ASSERT(NS_IsMainThread());
   RecordUnlockedDraw();
-  nsTObserverArray<imgRequestProxy*>::ForwardIterator iter(mConsumers);
+  nsTObserverArray<nsRefPtr<imgRequestProxy> >::ForwardIterator iter(mConsumers);
   while (iter.HasMore()) {
     SendUnlockedDraw(iter.GetNext());
   }
@@ -838,7 +838,7 @@ imgStatusTracker::OnStartRequest()
 {
   MOZ_ASSERT(NS_IsMainThread());
   RecordStartRequest();
-  nsTObserverArray<imgRequestProxy*>::ForwardIterator iter(mConsumers);
+  nsTObserverArray<nsRefPtr<imgRequestProxy> >::ForwardIterator iter(mConsumers);
   while (iter.HasMore()) {
     SendStartRequest(iter.GetNext());
   }
@@ -909,7 +909,7 @@ imgStatusTracker::OnStopRequest(bool aLastPart,
 
   RecordStopRequest(aLastPart, aStatus);
   /* notify the kids */
-  nsTObserverArray<imgRequestProxy*>::ForwardIterator srIter(mConsumers);
+  nsTObserverArray<nsRefPtr<imgRequestProxy> >::ForwardIterator srIter(mConsumers);
   while (srIter.HasMore()) {
     SendStopRequest(srIter.GetNext(), aLastPart, aStatus);
   }
@@ -926,7 +926,7 @@ imgStatusTracker::OnDiscard()
   RecordDiscard();
 
   /* notify the kids */
-  nsTObserverArray<imgRequestProxy*>::ForwardIterator iter(mConsumers);
+  nsTObserverArray<nsRefPtr<imgRequestProxy> >::ForwardIterator iter(mConsumers);
   while (iter.HasMore()) {
     SendDiscard(iter.GetNext());
   }
@@ -939,7 +939,7 @@ imgStatusTracker::FrameChanged(const nsIntRect* aDirtyRect)
   RecordFrameChanged(aDirtyRect);
 
   /* notify the kids */
-  nsTObserverArray<imgRequestProxy*>::ForwardIterator iter(mConsumers);
+  nsTObserverArray<nsRefPtr<imgRequestProxy> >::ForwardIterator iter(mConsumers);
   while (iter.HasMore()) {
     SendFrameChanged(iter.GetNext(), aDirtyRect);
   }
@@ -952,7 +952,7 @@ imgStatusTracker::OnStopFrame()
   RecordStopFrame();
 
   /* notify the kids */
-  nsTObserverArray<imgRequestProxy*>::ForwardIterator iter(mConsumers);
+  nsTObserverArray<nsRefPtr<imgRequestProxy> >::ForwardIterator iter(mConsumers);
   while (iter.HasMore()) {
     SendStopFrame(iter.GetNext());
   }
@@ -970,7 +970,7 @@ imgStatusTracker::OnDataAvailable()
     return;
   }
   // Notify any imgRequestProxys that are observing us that we have an Image.
-  nsTObserverArray<imgRequestProxy*>::ForwardIterator iter(mConsumers);
+  nsTObserverArray<nsRefPtr<imgRequestProxy> >::ForwardIterator iter(mConsumers);
   while (iter.HasMore()) {
     iter.GetNext()->SetHasImage();
   }
@@ -1021,7 +1021,7 @@ imgStatusTracker::MaybeUnblockOnload()
 
   RecordUnblockOnload();
 
-  nsTObserverArray<imgRequestProxy*>::ForwardIterator iter(mConsumers);
+  nsTObserverArray<nsRefPtr<imgRequestProxy> >::ForwardIterator iter(mConsumers);
   while (iter.HasMore()) {
     SendUnblockOnload(iter.GetNext());
   }
diff --git a/image/src/imgStatusTracker.h b/image/src/imgStatusTracker.h
index d70fdbef97d..6ca06c95c06 100644
--- a/image/src/imgStatusTracker.h
+++ b/image/src/imgStatusTracker.h
@@ -9,7 +9,6 @@
 
 class imgDecoderObserver;
 class imgIContainer;
-class imgRequestProxy;
 class imgStatusNotifyRunnable;
 class imgRequestNotifyRunnable;
 class imgStatusTrackerObserver;
@@ -21,6 +20,7 @@ class nsIRunnable;
 #include "nsTObserverArray.h"
 #include "nsThreadUtils.h"
 #include "nsRect.h"
+#include "imgRequestProxy.h"
 
 namespace mozilla {
 namespace image {
@@ -306,7 +306,7 @@ private:
 
   // Main thread only, since imgRequestProxy calls are expected on the main
   // thread, and mConsumers is not threadsafe.
-  static void SyncNotifyState(nsTObserverArray<imgRequestProxy*>& proxies,
+  static void SyncNotifyState(nsTObserverArray<nsRefPtr<imgRequestProxy> >& proxies,
                               bool hasImage, uint32_t state,
                               nsIntRect& dirtyRect, bool hadLastPart);
 
@@ -322,7 +322,7 @@ private:
   // List of proxies attached to the image. Each proxy represents a consumer
   // using the image. Array and/or individual elements should only be accessed
   // on the main thread.
-  nsTObserverArray<imgRequestProxy*> mConsumers;
+  nsTObserverArray<nsRefPtr<imgRequestProxy> > mConsumers;
 
   mozilla::RefPtr<imgDecoderObserver> mTrackerObserver;