diff --git a/image/src/imgRequestProxy.cpp b/image/src/imgRequestProxy.cpp
index ac98162561b..a08aacde933 100644
--- a/image/src/imgRequestProxy.cpp
+++ b/image/src/imgRequestProxy.cpp
@@ -134,6 +134,7 @@ nsresult imgRequestProxy::ChangeOwner(imgRequest *aNewOwner)
 
   nsRefPtr<imgRequest> oldOwner = mOwner;
   mOwner = aNewOwner;
+  mOwnerHasImage = !!GetStatusTracker().GetImage();
 
   // If we were locked, apply the locks here
   for (uint32_t i = 0; i < oldLockCount; i++)
@@ -481,15 +482,35 @@ NS_IMETHODIMP imgRequestProxy::GetMimeType(char **aMimeType)
   return NS_OK;
 }
 
+static imgRequestProxy* NewProxy(imgRequestProxy* /*aThis*/)
+{
+  return new imgRequestProxy();
+}
+
+imgRequestProxy* NewStaticProxy(imgRequestProxy* aThis)
+{
+  nsCOMPtr<nsIPrincipal> currentPrincipal;
+  aThis->GetImagePrincipal(getter_AddRefs(currentPrincipal));
+  return new imgRequestProxyStatic(
+      static_cast<imgRequestProxyStatic*>(aThis)->mImage, currentPrincipal);
+}
+
 NS_IMETHODIMP imgRequestProxy::Clone(imgINotificationObserver* aObserver,
                                      imgIRequest** aClone)
+{
+  return PerformClone(aObserver, NewProxy, aClone);
+}
+
+nsresult imgRequestProxy::PerformClone(imgINotificationObserver* aObserver,
+                                       imgRequestProxy* (aAllocFn)(imgRequestProxy*),
+                                       imgIRequest** aClone)
 {
   NS_PRECONDITION(aClone, "Null out param");
 
   LOG_SCOPE(gImgLog, "imgRequestProxy::Clone");
 
   *aClone = nullptr;
-  nsRefPtr<imgRequestProxy> clone = new imgRequestProxy();
+  nsRefPtr<imgRequestProxy> clone = aAllocFn(this);
 
   // It is important to call |SetLoadFlags()| before calling |Init()| because
   // |Init()| adds the request to the loadgroup.
@@ -498,7 +519,7 @@ NS_IMETHODIMP imgRequestProxy::Clone(imgINotificationObserver* aObserver,
   // XXXldb That's not true anymore.  Stuff from imgLoader adds the
   // request to the loadgroup.
   clone->SetLoadFlags(mLoadFlags);
-  nsresult rv = clone->Init(&mOwner->GetStatusTracker(), mLoadGroup, mURI, aObserver);
+  nsresult rv = clone->Init(&GetStatusTracker(), mLoadGroup, mURI, aObserver);
   if (NS_FAILED(rv))
     return rv;
 
@@ -939,3 +960,10 @@ imgRequestProxyStatic::GetStatusTracker() const
 {
   return mImage->GetStatusTracker();
 }
+
+NS_IMETHODIMP
+imgRequestProxyStatic::Clone(imgINotificationObserver* aObserver,
+                             imgIRequest** aClone)
+{
+  return PerformClone(aObserver, NewStaticProxy, aClone);
+}
diff --git a/image/src/imgRequestProxy.h b/image/src/imgRequestProxy.h
index 6e1c9f4fed4..dc4d7b00d2f 100644
--- a/image/src/imgRequestProxy.h
+++ b/image/src/imgRequestProxy.h
@@ -179,6 +179,10 @@ protected:
 
   virtual mozilla::image::Image* GetImage() const;
 
+  nsresult PerformClone(imgINotificationObserver* aObserver,
+                        imgRequestProxy* (aAllocFn)(imgRequestProxy*),
+                        imgIRequest** aClone);
+
 public:
   NS_FORWARD_SAFE_NSITIMEDCHANNEL(TimedChannel())
 
@@ -236,10 +240,15 @@ public:
     mOwnerHasImage = true;
   };
 
-  NS_IMETHOD GetImagePrincipal(nsIPrincipal** aPrincipal);
+  NS_IMETHOD GetImagePrincipal(nsIPrincipal** aPrincipal) MOZ_OVERRIDE;
   virtual imgStatusTracker& GetStatusTracker() const MOZ_OVERRIDE;
 
+  NS_IMETHOD Clone(imgINotificationObserver* aObserver,
+                   imgIRequest** aClone) MOZ_OVERRIDE;
+
 protected:
+  friend imgRequestProxy* NewStaticProxy(imgRequestProxy*);
+
   // Our image. We have to hold a strong reference here, because that's normally
   // the job of the underlying request.
   nsRefPtr<mozilla::image::Image> mImage;