diff --git a/mozilla/content/base/src/nsImageLoadingContent.cpp b/mozilla/content/base/src/nsImageLoadingContent.cpp
index fcd96f06ccd..234b4f5ca7c 100644
--- a/mozilla/content/base/src/nsImageLoadingContent.cpp
+++ b/mozilla/content/base/src/nsImageLoadingContent.cpp
@@ -375,6 +375,9 @@ nsImageLoadingContent::LoadImageWithChannel(nsIChannel* aChannel,
     // Don't bother
     return NS_OK;
   }
+
+  // Null out our mCurrentURI, in case we have no image requests right now.
+  mCurrentURI = nsnull;
   
   CancelImageRequests(NS_ERROR_IMAGE_SRC_CHANGED, PR_FALSE,
                       nsIContentPolicy::ACCEPT);
@@ -520,6 +523,14 @@ nsImageLoadingContent::ImageURIChanged(const nsAString& aNewURI,
   return NS_OK;
 }
 
+void
+nsImageLoadingContent::CancelImageRequests()
+{
+  // Make sure to null out mCurrentURI here, so we no longer look like an image
+  mCurrentURI = nsnull;
+  CancelImageRequests(NS_BINDING_ABORTED, PR_TRUE, nsIContentPolicy::ACCEPT);
+}
+
 void
 nsImageLoadingContent::CancelImageRequests(nsresult aReason,
                                            PRBool   aEvenIfSizeAvailable,
diff --git a/mozilla/content/base/src/nsImageLoadingContent.h b/mozilla/content/base/src/nsImageLoadingContent.h
index ced8e579803..5d3878579a5 100644
--- a/mozilla/content/base/src/nsImageLoadingContent.h
+++ b/mozilla/content/base/src/nsImageLoadingContent.h
@@ -87,6 +87,13 @@ protected:
   nsresult ImageURIChanged(const nsAString& aNewURI,
                            PRBool aForce);
 
+  /**
+   * CancelImageRequests is called by subclasses when they want to
+   * cancel all image requests (for example when the subclass is
+   * somehow not an image anymore).
+   */
+  void CancelImageRequests();
+
 private:
   /**
    * Struct used to manage the image observers.
diff --git a/mozilla/content/html/content/src/nsHTMLInputElement.cpp b/mozilla/content/html/content/src/nsHTMLInputElement.cpp
index 3a72b38768d..77b584ebcc9 100644
--- a/mozilla/content/html/content/src/nsHTMLInputElement.cpp
+++ b/mozilla/content/html/content/src/nsHTMLInputElement.cpp
@@ -531,6 +531,13 @@ nsHTMLInputElement::AfterSetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
       }
     }
 
+    if (mType != NS_FORM_INPUT_IMAGE) {
+      // We're no longer an image input.  Cancel our image requests, if we have
+      // any.  Note that doing this when we already weren't an image is ok --
+      // just does nothing.
+      CancelImageRequests();
+    }
+    
     if (aNotify && mType == NS_FORM_INPUT_IMAGE && !mCurrentRequest) {
       // We just got switched to be an image input; we should see
       // whether we have an image to load;