diff --git a/mozilla/content/base/src/nsRuleNode.cpp b/mozilla/content/base/src/nsRuleNode.cpp
index d97df250622..70b8ddb1114 100644
--- a/mozilla/content/base/src/nsRuleNode.cpp
+++ b/mozilla/content/base/src/nsRuleNode.cpp
@@ -3517,8 +3517,8 @@ nsRuleNode::ComputeListData(nsStyleStruct* aStartStruct,
   }
 
   // list-style-image: url, none, inherit
-  if (eCSSUnit_URL == listData.mImage.GetUnit()) {
-    list->mListStyleImage = listData.mImage.GetURLValue();
+  if (eCSSUnit_Image == listData.mImage.GetUnit()) {
+    list->mListStyleImage = listData.mImage.GetImageValue();
   }
   else if (eCSSUnit_None == listData.mImage.GetUnit()) {
     list->mListStyleImage = nsnull;
diff --git a/mozilla/content/html/content/src/nsGenericHTMLElement.cpp b/mozilla/content/html/content/src/nsGenericHTMLElement.cpp
index a5f49b51190..be392664932 100644
--- a/mozilla/content/html/content/src/nsGenericHTMLElement.cpp
+++ b/mozilla/content/html/content/src/nsGenericHTMLElement.cpp
@@ -2983,7 +2983,8 @@ nsGenericHTMLElement::MapBackgroundAttributesInto(const nsMappedAttributes* aAtt
             getter_AddRefs(uri), spec, doc, doc->GetBaseURI());
         if (NS_SUCCEEDED(rv)) {
           nsCSSValue::Image *img =
-            new nsCSSValue::Image(uri, spec.get(), doc->GetDocumentURI(), doc);
+            new nsCSSValue::Image(uri, spec.get(), doc->GetDocumentURI(),
+                                  doc, PR_TRUE);
           if (img) {
             if (img->mString) {
               aData->mColorData->mBackImage.SetImageValue(img);
diff --git a/mozilla/content/html/style/src/nsCSSDataBlock.cpp b/mozilla/content/html/style/src/nsCSSDataBlock.cpp
index 41196561916..c54e613855c 100644
--- a/mozilla/content/html/style/src/nsCSSDataBlock.cpp
+++ b/mozilla/content/html/style/src/nsCSSDataBlock.cpp
@@ -185,9 +185,11 @@ nsCSSCompressedDataBlock::MapRuleInfoInto(nsRuleData *aRuleData) const
                     if (target->GetUnit() == eCSSUnit_Null) {
                         const nsCSSValue *val = ValueAtCursor(cursor);
                         NS_ASSERTION(val->GetUnit() != eCSSUnit_Null, "oops");
-                        if (iProp == eCSSProperty_background_image &&
+                        if ((iProp == eCSSProperty_background_image ||
+                             iProp == eCSSProperty_list_style_image) &&
                             val->GetUnit() == eCSSUnit_URL) {
-                            val->StartImageLoad(aRuleData->mPresContext->GetDocument());
+                            val->StartImageLoad(aRuleData->mPresContext->GetDocument(),
+                                                iProp == eCSSProperty_background_image);
                         }
                         *target = *val;
                         if (iProp == eCSSProperty_font_family) {
diff --git a/mozilla/content/html/style/src/nsCSSValue.cpp b/mozilla/content/html/style/src/nsCSSValue.cpp
index b663ee6e73c..3629126cd51 100644
--- a/mozilla/content/html/style/src/nsCSSValue.cpp
+++ b/mozilla/content/html/style/src/nsCSSValue.cpp
@@ -342,14 +342,14 @@ void nsCSSValue::SetNormalValue()
   mUnit = eCSSUnit_Normal;
 }
 
-void nsCSSValue::StartImageLoad(nsIDocument* aDocument) const
+void nsCSSValue::StartImageLoad(nsIDocument* aDocument, PRBool aIsBGImage) const
 {
   NS_PRECONDITION(eCSSUnit_URL == mUnit, "Not a URL value!");
   nsCSSValue::Image* image =
     new nsCSSValue::Image(mValue.mURL->mURI,
                           mValue.mURL->mString,
                           mValue.mURL->mReferrer,
-                          aDocument);
+                          aDocument, aIsBGImage);
   if (image) {
     if (image->mString) {
       nsCSSValue* writable = NS_CONST_CAST(nsCSSValue*, this);
@@ -361,7 +361,8 @@ void nsCSSValue::StartImageLoad(nsIDocument* aDocument) const
 }
 
 nsCSSValue::Image::Image(nsIURI* aURI, const PRUnichar* aString,
-                         nsIURI* aReferrer, nsIDocument* aDocument)
+                         nsIURI* aReferrer, nsIDocument* aDocument,
+                         PRBool aIsBGImage)
   : URL(aURI, aString, aReferrer)
 {
   MOZ_COUNT_CTOR(nsCSSValue::Image);
@@ -371,8 +372,11 @@ nsCSSValue::Image::Image(nsIURI* aURI, const PRUnichar* aString,
     return;
 
   // If Paint Forcing is enabled, then force all background image loads to
-  // complete before firing onload for the document
-  static PRInt32 loadFlag = PR_GetEnv("MOZ_FORCE_PAINT_AFTER_ONLOAD")
+  // complete before firing onload for the document.  Otherwise, background
+  // image loads are special and don't block onload.
+  static PRBool bg_in_bg = !PR_GetEnv("MOZ_FORCE_PAINT_AFTER_ONLOAD");
+
+  PRInt32 loadFlag = (!aIsBGImage || !bg_in_bg)
     ? (PRInt32)nsIRequest::LOAD_NORMAL
     : (PRInt32)nsIRequest::LOAD_BACKGROUND;
 
diff --git a/mozilla/content/html/style/src/nsCSSValue.h b/mozilla/content/html/style/src/nsCSSValue.h
index b153a5f4a2b..84377a609dc 100644
--- a/mozilla/content/html/style/src/nsCSSValue.h
+++ b/mozilla/content/html/style/src/nsCSSValue.h
@@ -259,7 +259,9 @@ public:
   NS_HIDDEN_(void)  SetInitialValue();
   NS_HIDDEN_(void)  SetNoneValue();
   NS_HIDDEN_(void)  SetNormalValue();
-  NS_HIDDEN_(void)  StartImageLoad(nsIDocument* aDocument) const;  // Not really const, but pretending
+  NS_HIDDEN_(void)  StartImageLoad(nsIDocument* aDocument,
+                                   PRBool aIsBGImage = PR_FALSE)
+                                   const;  // Not really const, but pretending
 
 #ifdef DEBUG
   NS_HIDDEN_(void)
@@ -320,7 +322,7 @@ public:
     // force us to include imgIRequest.h, which leads to REQUIRES hell, since
     // this header is included all over.
     Image(nsIURI* aURI, const PRUnichar* aString, nsIURI* aReferrer,
-          nsIDocument* aDocument) NS_HIDDEN;
+          nsIDocument* aDocument, PRBool aIsBGImage = PR_FALSE) NS_HIDDEN;
     ~Image() NS_HIDDEN;
 
     // Inherit operator== from nsCSSValue::URL
diff --git a/mozilla/content/html/style/src/nsComputedDOMStyle.cpp b/mozilla/content/html/style/src/nsComputedDOMStyle.cpp
index 10bf12865a0..8dd7f635b28 100644
--- a/mozilla/content/html/style/src/nsComputedDOMStyle.cpp
+++ b/mozilla/content/html/style/src/nsComputedDOMStyle.cpp
@@ -1411,7 +1411,11 @@ nsComputedDOMStyle::GetListStyleImage(nsIFrame *aFrame,
     if (!list->mListStyleImage) {
       val->SetIdent(nsLayoutAtoms::none);
     } else {
-      val->SetURI(list->mListStyleImage);
+      nsCOMPtr<nsIURI> uri;
+      if (list->mListStyleImage) {
+        list->mListStyleImage->GetURI(getter_AddRefs(uri));
+      }
+      val->SetURI(uri);
     }
   }
     
diff --git a/mozilla/content/shared/public/nsStyleStruct.h b/mozilla/content/shared/public/nsStyleStruct.h
index 7ce91f8d309..305c4e2ec01 100644
--- a/mozilla/content/shared/public/nsStyleStruct.h
+++ b/mozilla/content/shared/public/nsStyleStruct.h
@@ -578,7 +578,7 @@ struct nsStyleList : public nsStyleStruct {
   
   PRUint8   mListStyleType;             // [inherited] See nsStyleConsts.h
   PRUint8   mListStylePosition;         // [inherited] 
-  nsCOMPtr<nsIURI> mListStyleImage;     // [inherited]
+  nsCOMPtr<imgIRequest> mListStyleImage; // [inherited]
   nsRect        mImageRegion;           // [inherited] the rect to use within an image  
 };
 
diff --git a/mozilla/content/shared/src/nsStyleStruct.cpp b/mozilla/content/shared/src/nsStyleStruct.cpp
index 6d09458461c..fe11994fb64 100644
--- a/mozilla/content/shared/src/nsStyleStruct.cpp
+++ b/mozilla/content/shared/src/nsStyleStruct.cpp
@@ -680,7 +680,7 @@ nsStyleList::nsStyleList(const nsStyleList& aSource)
 nsChangeHint nsStyleList::CalcDifference(const nsStyleList& aOther) const
 {
   if (mListStylePosition == aOther.mListStylePosition &&
-      EqualURIs(mListStyleImage, aOther.mListStyleImage) &&
+      EqualImages(mListStyleImage, aOther.mListStyleImage) &&
       mListStyleType == aOther.mListStyleType) {
     if (mImageRegion == aOther.mImageRegion)
       return NS_STYLE_HINT_NONE;
diff --git a/mozilla/layout/generic/nsBulletFrame.cpp b/mozilla/layout/generic/nsBulletFrame.cpp
index d4fef58581b..f9310cfac9e 100644
--- a/mozilla/layout/generic/nsBulletFrame.cpp
+++ b/mozilla/layout/generic/nsBulletFrame.cpp
@@ -123,26 +123,11 @@ nsBulletFrame::Init(nsPresContext*  aPresContext,
   mPresContext = aPresContext;
   
   nsresult  rv = nsFrame::Init(aPresContext, aContent, aParent, aContext, aPrevInFlow);
+  if (NS_FAILED(rv))
+    return rv;
 
-  nsIURI *imgURI = GetStyleList()->mListStyleImage;
-  if (imgURI) {
-    nsCOMPtr<imgILoader> il(do_GetService("@mozilla.org/image/loader;1", &rv));
-    if (NS_FAILED(rv))
-      return rv;
-
-    nsCOMPtr<nsILoadGroup> loadGroup;
-    GetLoadGroup(aPresContext, getter_AddRefs(loadGroup));
-
-    // Get the document URI for the referrer...
-    nsIURI *documentURI = nsnull;
-    nsCOMPtr<nsIDocument> doc;
-    if (mContent) {
-      doc = mContent->GetDocument();
-      if (doc) {
-        documentURI = doc->GetDocumentURI();
-      }
-    }
-
+  imgIRequest *imgRequest = GetStyleList()->mListStyleImage;
+  if (imgRequest) {
     if (!mListener) {
       nsBulletListener *listener;
       NS_NEWXPCOM(listener, nsBulletListener);
@@ -153,10 +138,7 @@ nsBulletFrame::Init(nsPresContext*  aPresContext,
       NS_RELEASE(listener);
     }
 
-    if (nsContentUtils::CanLoadImage(imgURI, doc, doc)) {
-      // XXX: initialDocumentURI is NULL !
-      il->LoadImage(imgURI, nsnull, documentURI, loadGroup, mListener, aPresContext, nsIRequest::LOAD_NORMAL, nsnull, nsnull, getter_AddRefs(mImageRequest));
-    }
+    imgRequest->Clone(mListener, getter_AddRefs(mImageRequest));
   }
 
   return NS_OK;
@@ -1585,9 +1567,9 @@ nsBulletFrame::Reflow(nsPresContext* aPresContext,
   }
 
   if (isStyleChange) {
-    nsIURI *newURI = GetStyleList()->mListStyleImage;
+    imgIRequest *newRequest = GetStyleList()->mListStyleImage;
 
-    if (newURI) {
+    if (newRequest) {
 
       if (!mListener) {
         nsBulletListener *listener;
@@ -1605,7 +1587,9 @@ nsBulletFrame::Reflow(nsPresContext* aPresContext,
         // Reload the image, maybe...
         nsCOMPtr<nsIURI> oldURI;
         mImageRequest->GetURI(getter_AddRefs(oldURI));
-        if (oldURI) {
+        nsCOMPtr<nsIURI> newURI;
+        newRequest->GetURI(getter_AddRefs(newURI));
+        if (oldURI && newURI) {
           PRBool same;
           newURI->Equals(oldURI, &same);
           if (same) {
@@ -1618,29 +1602,7 @@ nsBulletFrame::Reflow(nsPresContext* aPresContext,
       }
 
       if (needNewRequest) {
-        nsresult rv;
-        nsCOMPtr<imgILoader> il(do_GetService("@mozilla.org/image/loader;1", &rv));
-        if (NS_FAILED(rv))
-          return rv;
-
-        nsCOMPtr<nsILoadGroup> loadGroup;
-        GetLoadGroup(aPresContext, getter_AddRefs(loadGroup));
-
-        // Get the document URI for the referrer...
-        nsIURI* documentURI = nsnull;
-        nsCOMPtr<nsIDocument> doc;
-        if (mContent) {
-          doc = mContent->GetDocument();
-          if (doc) {
-            documentURI = doc->GetDocumentURI();
-          }
-        }
-
-
-        // XXX: initialDocumentURI is NULL !
-        il->LoadImage(newURI, nsnull, documentURI, loadGroup, mListener, doc,
-                      nsIRequest::LOAD_NORMAL, nsnull, nsnull,
-                      getter_AddRefs(mImageRequest));
+        newRequest->Clone(mListener, getter_AddRefs(mImageRequest));
       }
     }
   }
diff --git a/mozilla/layout/html/base/src/nsBulletFrame.cpp b/mozilla/layout/html/base/src/nsBulletFrame.cpp
index d4fef58581b..f9310cfac9e 100644
--- a/mozilla/layout/html/base/src/nsBulletFrame.cpp
+++ b/mozilla/layout/html/base/src/nsBulletFrame.cpp
@@ -123,26 +123,11 @@ nsBulletFrame::Init(nsPresContext*  aPresContext,
   mPresContext = aPresContext;
   
   nsresult  rv = nsFrame::Init(aPresContext, aContent, aParent, aContext, aPrevInFlow);
+  if (NS_FAILED(rv))
+    return rv;
 
-  nsIURI *imgURI = GetStyleList()->mListStyleImage;
-  if (imgURI) {
-    nsCOMPtr<imgILoader> il(do_GetService("@mozilla.org/image/loader;1", &rv));
-    if (NS_FAILED(rv))
-      return rv;
-
-    nsCOMPtr<nsILoadGroup> loadGroup;
-    GetLoadGroup(aPresContext, getter_AddRefs(loadGroup));
-
-    // Get the document URI for the referrer...
-    nsIURI *documentURI = nsnull;
-    nsCOMPtr<nsIDocument> doc;
-    if (mContent) {
-      doc = mContent->GetDocument();
-      if (doc) {
-        documentURI = doc->GetDocumentURI();
-      }
-    }
-
+  imgIRequest *imgRequest = GetStyleList()->mListStyleImage;
+  if (imgRequest) {
     if (!mListener) {
       nsBulletListener *listener;
       NS_NEWXPCOM(listener, nsBulletListener);
@@ -153,10 +138,7 @@ nsBulletFrame::Init(nsPresContext*  aPresContext,
       NS_RELEASE(listener);
     }
 
-    if (nsContentUtils::CanLoadImage(imgURI, doc, doc)) {
-      // XXX: initialDocumentURI is NULL !
-      il->LoadImage(imgURI, nsnull, documentURI, loadGroup, mListener, aPresContext, nsIRequest::LOAD_NORMAL, nsnull, nsnull, getter_AddRefs(mImageRequest));
-    }
+    imgRequest->Clone(mListener, getter_AddRefs(mImageRequest));
   }
 
   return NS_OK;
@@ -1585,9 +1567,9 @@ nsBulletFrame::Reflow(nsPresContext* aPresContext,
   }
 
   if (isStyleChange) {
-    nsIURI *newURI = GetStyleList()->mListStyleImage;
+    imgIRequest *newRequest = GetStyleList()->mListStyleImage;
 
-    if (newURI) {
+    if (newRequest) {
 
       if (!mListener) {
         nsBulletListener *listener;
@@ -1605,7 +1587,9 @@ nsBulletFrame::Reflow(nsPresContext* aPresContext,
         // Reload the image, maybe...
         nsCOMPtr<nsIURI> oldURI;
         mImageRequest->GetURI(getter_AddRefs(oldURI));
-        if (oldURI) {
+        nsCOMPtr<nsIURI> newURI;
+        newRequest->GetURI(getter_AddRefs(newURI));
+        if (oldURI && newURI) {
           PRBool same;
           newURI->Equals(oldURI, &same);
           if (same) {
@@ -1618,29 +1602,7 @@ nsBulletFrame::Reflow(nsPresContext* aPresContext,
       }
 
       if (needNewRequest) {
-        nsresult rv;
-        nsCOMPtr<imgILoader> il(do_GetService("@mozilla.org/image/loader;1", &rv));
-        if (NS_FAILED(rv))
-          return rv;
-
-        nsCOMPtr<nsILoadGroup> loadGroup;
-        GetLoadGroup(aPresContext, getter_AddRefs(loadGroup));
-
-        // Get the document URI for the referrer...
-        nsIURI* documentURI = nsnull;
-        nsCOMPtr<nsIDocument> doc;
-        if (mContent) {
-          doc = mContent->GetDocument();
-          if (doc) {
-            documentURI = doc->GetDocumentURI();
-          }
-        }
-
-
-        // XXX: initialDocumentURI is NULL !
-        il->LoadImage(newURI, nsnull, documentURI, loadGroup, mListener, doc,
-                      nsIRequest::LOAD_NORMAL, nsnull, nsnull,
-                      getter_AddRefs(mImageRequest));
+        newRequest->Clone(mListener, getter_AddRefs(mImageRequest));
       }
     }
   }
diff --git a/mozilla/layout/style/nsCSSDataBlock.cpp b/mozilla/layout/style/nsCSSDataBlock.cpp
index 41196561916..c54e613855c 100644
--- a/mozilla/layout/style/nsCSSDataBlock.cpp
+++ b/mozilla/layout/style/nsCSSDataBlock.cpp
@@ -185,9 +185,11 @@ nsCSSCompressedDataBlock::MapRuleInfoInto(nsRuleData *aRuleData) const
                     if (target->GetUnit() == eCSSUnit_Null) {
                         const nsCSSValue *val = ValueAtCursor(cursor);
                         NS_ASSERTION(val->GetUnit() != eCSSUnit_Null, "oops");
-                        if (iProp == eCSSProperty_background_image &&
+                        if ((iProp == eCSSProperty_background_image ||
+                             iProp == eCSSProperty_list_style_image) &&
                             val->GetUnit() == eCSSUnit_URL) {
-                            val->StartImageLoad(aRuleData->mPresContext->GetDocument());
+                            val->StartImageLoad(aRuleData->mPresContext->GetDocument(),
+                                                iProp == eCSSProperty_background_image);
                         }
                         *target = *val;
                         if (iProp == eCSSProperty_font_family) {
diff --git a/mozilla/layout/style/nsCSSValue.cpp b/mozilla/layout/style/nsCSSValue.cpp
index b663ee6e73c..3629126cd51 100644
--- a/mozilla/layout/style/nsCSSValue.cpp
+++ b/mozilla/layout/style/nsCSSValue.cpp
@@ -342,14 +342,14 @@ void nsCSSValue::SetNormalValue()
   mUnit = eCSSUnit_Normal;
 }
 
-void nsCSSValue::StartImageLoad(nsIDocument* aDocument) const
+void nsCSSValue::StartImageLoad(nsIDocument* aDocument, PRBool aIsBGImage) const
 {
   NS_PRECONDITION(eCSSUnit_URL == mUnit, "Not a URL value!");
   nsCSSValue::Image* image =
     new nsCSSValue::Image(mValue.mURL->mURI,
                           mValue.mURL->mString,
                           mValue.mURL->mReferrer,
-                          aDocument);
+                          aDocument, aIsBGImage);
   if (image) {
     if (image->mString) {
       nsCSSValue* writable = NS_CONST_CAST(nsCSSValue*, this);
@@ -361,7 +361,8 @@ void nsCSSValue::StartImageLoad(nsIDocument* aDocument) const
 }
 
 nsCSSValue::Image::Image(nsIURI* aURI, const PRUnichar* aString,
-                         nsIURI* aReferrer, nsIDocument* aDocument)
+                         nsIURI* aReferrer, nsIDocument* aDocument,
+                         PRBool aIsBGImage)
   : URL(aURI, aString, aReferrer)
 {
   MOZ_COUNT_CTOR(nsCSSValue::Image);
@@ -371,8 +372,11 @@ nsCSSValue::Image::Image(nsIURI* aURI, const PRUnichar* aString,
     return;
 
   // If Paint Forcing is enabled, then force all background image loads to
-  // complete before firing onload for the document
-  static PRInt32 loadFlag = PR_GetEnv("MOZ_FORCE_PAINT_AFTER_ONLOAD")
+  // complete before firing onload for the document.  Otherwise, background
+  // image loads are special and don't block onload.
+  static PRBool bg_in_bg = !PR_GetEnv("MOZ_FORCE_PAINT_AFTER_ONLOAD");
+
+  PRInt32 loadFlag = (!aIsBGImage || !bg_in_bg)
     ? (PRInt32)nsIRequest::LOAD_NORMAL
     : (PRInt32)nsIRequest::LOAD_BACKGROUND;
 
diff --git a/mozilla/layout/style/nsCSSValue.h b/mozilla/layout/style/nsCSSValue.h
index b153a5f4a2b..84377a609dc 100644
--- a/mozilla/layout/style/nsCSSValue.h
+++ b/mozilla/layout/style/nsCSSValue.h
@@ -259,7 +259,9 @@ public:
   NS_HIDDEN_(void)  SetInitialValue();
   NS_HIDDEN_(void)  SetNoneValue();
   NS_HIDDEN_(void)  SetNormalValue();
-  NS_HIDDEN_(void)  StartImageLoad(nsIDocument* aDocument) const;  // Not really const, but pretending
+  NS_HIDDEN_(void)  StartImageLoad(nsIDocument* aDocument,
+                                   PRBool aIsBGImage = PR_FALSE)
+                                   const;  // Not really const, but pretending
 
 #ifdef DEBUG
   NS_HIDDEN_(void)
@@ -320,7 +322,7 @@ public:
     // force us to include imgIRequest.h, which leads to REQUIRES hell, since
     // this header is included all over.
     Image(nsIURI* aURI, const PRUnichar* aString, nsIURI* aReferrer,
-          nsIDocument* aDocument) NS_HIDDEN;
+          nsIDocument* aDocument, PRBool aIsBGImage = PR_FALSE) NS_HIDDEN;
     ~Image() NS_HIDDEN;
 
     // Inherit operator== from nsCSSValue::URL
diff --git a/mozilla/layout/style/nsComputedDOMStyle.cpp b/mozilla/layout/style/nsComputedDOMStyle.cpp
index 10bf12865a0..8dd7f635b28 100644
--- a/mozilla/layout/style/nsComputedDOMStyle.cpp
+++ b/mozilla/layout/style/nsComputedDOMStyle.cpp
@@ -1411,7 +1411,11 @@ nsComputedDOMStyle::GetListStyleImage(nsIFrame *aFrame,
     if (!list->mListStyleImage) {
       val->SetIdent(nsLayoutAtoms::none);
     } else {
-      val->SetURI(list->mListStyleImage);
+      nsCOMPtr<nsIURI> uri;
+      if (list->mListStyleImage) {
+        list->mListStyleImage->GetURI(getter_AddRefs(uri));
+      }
+      val->SetURI(uri);
     }
   }
     
diff --git a/mozilla/layout/style/nsRuleNode.cpp b/mozilla/layout/style/nsRuleNode.cpp
index d97df250622..70b8ddb1114 100644
--- a/mozilla/layout/style/nsRuleNode.cpp
+++ b/mozilla/layout/style/nsRuleNode.cpp
@@ -3517,8 +3517,8 @@ nsRuleNode::ComputeListData(nsStyleStruct* aStartStruct,
   }
 
   // list-style-image: url, none, inherit
-  if (eCSSUnit_URL == listData.mImage.GetUnit()) {
-    list->mListStyleImage = listData.mImage.GetURLValue();
+  if (eCSSUnit_Image == listData.mImage.GetUnit()) {
+    list->mListStyleImage = listData.mImage.GetImageValue();
   }
   else if (eCSSUnit_None == listData.mImage.GetUnit()) {
     list->mListStyleImage = nsnull;
diff --git a/mozilla/layout/style/nsStyleStruct.cpp b/mozilla/layout/style/nsStyleStruct.cpp
index 6d09458461c..fe11994fb64 100644
--- a/mozilla/layout/style/nsStyleStruct.cpp
+++ b/mozilla/layout/style/nsStyleStruct.cpp
@@ -680,7 +680,7 @@ nsStyleList::nsStyleList(const nsStyleList& aSource)
 nsChangeHint nsStyleList::CalcDifference(const nsStyleList& aOther) const
 {
   if (mListStylePosition == aOther.mListStylePosition &&
-      EqualURIs(mListStyleImage, aOther.mListStyleImage) &&
+      EqualImages(mListStyleImage, aOther.mListStyleImage) &&
       mListStyleType == aOther.mListStyleType) {
     if (mImageRegion == aOther.mImageRegion)
       return NS_STYLE_HINT_NONE;
diff --git a/mozilla/layout/style/nsStyleStruct.h b/mozilla/layout/style/nsStyleStruct.h
index 7ce91f8d309..305c4e2ec01 100644
--- a/mozilla/layout/style/nsStyleStruct.h
+++ b/mozilla/layout/style/nsStyleStruct.h
@@ -578,7 +578,7 @@ struct nsStyleList : public nsStyleStruct {
   
   PRUint8   mListStyleType;             // [inherited] See nsStyleConsts.h
   PRUint8   mListStylePosition;         // [inherited] 
-  nsCOMPtr<nsIURI> mListStyleImage;     // [inherited]
+  nsCOMPtr<imgIRequest> mListStyleImage; // [inherited]
   nsRect        mImageRegion;           // [inherited] the rect to use within an image  
 };
 
diff --git a/mozilla/layout/xul/base/src/nsImageBoxFrame.cpp b/mozilla/layout/xul/base/src/nsImageBoxFrame.cpp
index 541318df930..7d18a88db12 100644
--- a/mozilla/layout/xul/base/src/nsImageBoxFrame.cpp
+++ b/mozilla/layout/xul/base/src/nsImageBoxFrame.cpp
@@ -261,12 +261,13 @@ nsImageBoxFrame::AttributeChanged(nsPresContext* aPresContext,
 {
   nsresult rv = nsLeafBoxFrame::AttributeChanged(aPresContext, aChild, aNameSpaceID, aAttribute, aModType);
 
-  PRBool aResize = UpdateAttributes(aAttribute);
-
-  if (aResize) {
+  if (aAttribute == nsHTMLAtoms::src) {
+    UpdateImage();
     nsBoxLayoutState state(aPresContext);
     MarkDirty(state);
   }
+  else if (aAttribute == nsXULAtoms::validate)
+    UpdateLoadFlags();
 
   return rv;
 }
@@ -274,8 +275,6 @@ nsImageBoxFrame::AttributeChanged(nsPresContext* aPresContext,
 nsImageBoxFrame::nsImageBoxFrame(nsIPresShell* aShell) :
   nsLeafBoxFrame(aShell),
   mUseSrcAttr(PR_FALSE),
-  mSizeFrozen(PR_FALSE),
-  mHasImage(PR_FALSE),
   mSuppressStyleCheck(PR_FALSE),
   mIntrinsicSize(0,0),
   mLoadFlags(nsIRequest::LOAD_NORMAL)
@@ -329,17 +328,21 @@ nsImageBoxFrame::Init(nsPresContext*  aPresContext,
   nsresult  rv = nsLeafBoxFrame::Init(aPresContext, aContent, aParent, aContext, aPrevInFlow);
   mSuppressStyleCheck = PR_FALSE;
 
-  GetImageSource();
   UpdateLoadFlags();
-
   UpdateImage();
 
   return rv;
 }
 
 void
-nsImageBoxFrame::GetImageSource()
+nsImageBoxFrame::UpdateImage()
 {
+  if (mImageRequest) {
+    mImageRequest->Cancel(NS_ERROR_FAILURE);
+    mImageRequest = nsnull;
+    mIntrinsicSize.SizeTo(0, 0);
+  }
+
   // get the new image src
   nsAutoString src;
   mContent->GetAttr(kNameSpaceID_None, nsHTMLAtoms::src, src);
@@ -350,33 +353,37 @@ nsImageBoxFrame::GetImageSource()
       baseURI = mContent->GetBaseURI();
     }
     // XXX origin charset needed
-    NS_NewURI(getter_AddRefs(mURI), src, nsnull, baseURI);
+    nsCOMPtr<nsIURI> uri;
+    NS_NewURI(getter_AddRefs(uri), src, nsnull, baseURI);
+
+    nsresult rv;
+    nsCOMPtr<imgILoader> il(do_GetService("@mozilla.org/image/loader;1", &rv));
+    if (uri && NS_SUCCEEDED(rv)) {
+      nsCOMPtr<nsILoadGroup> loadGroup = GetLoadGroup();
+
+      // Get the document URI for the referrer...
+      nsIDocument* doc = mContent ? mContent->GetDocument() : nsnull;
+      nsIURI *documentURI = doc ? doc->GetDocumentURI() : nsnull;
+
+      // XXX: initialDocumentURI is NULL!
+      il->LoadImage(uri, nsnull, documentURI, loadGroup, mListener, doc,
+                    mLoadFlags, nsnull, nsnull, getter_AddRefs(mImageRequest));
+    }
   } else {
     // Only get the list-style-image if we aren't being drawn
     // by a native theme.
-    const nsStyleDisplay* disp = GetStyleDisplay();
-    if (disp->mAppearance && nsBox::gTheme && 
-        nsBox::gTheme->ThemeSupportsWidget(nsnull, this, disp->mAppearance))
-      return;
-
-    // get the list-style-image
-    mURI = GetStyleList()->mListStyleImage;
+    PRUint8 appearance = GetStyleDisplay()->mAppearance;
+    if (!(appearance && nsBox::gTheme && 
+          nsBox::gTheme->ThemeSupportsWidget(nsnull, this, appearance))) {
+      // get the list-style-image
+      imgIRequest *styleRequest = GetStyleList()->mListStyleImage;
+      if (styleRequest) {
+        styleRequest->Clone(mListener, getter_AddRefs(mImageRequest));
+      }
+    }
   }
 }
 
-PRBool
-nsImageBoxFrame::UpdateAttributes(nsIAtom* aAttribute)
-{
-  if (aAttribute == nsnull || aAttribute == nsHTMLAtoms::src) {
-    GetImageSource();
-    return UpdateImage();
-  }
-  else if (aAttribute == nsXULAtoms::validate)
-    UpdateLoadFlags();
-
-  return PR_FALSE;
-}
-
 void
 nsImageBoxFrame::UpdateLoadFlags()
 {
@@ -390,66 +397,6 @@ nsImageBoxFrame::UpdateLoadFlags()
     mLoadFlags = nsIRequest::LOAD_NORMAL;
 }
 
-PRBool
-nsImageBoxFrame::UpdateImage()
-{
-  // get the new image src
-  if (!mURI) {
-    mSizeFrozen = PR_TRUE;
-    mHasImage = PR_FALSE;
-
-    if (mImageRequest) {
-      mImageRequest->Cancel(NS_ERROR_FAILURE);
-      mImageRequest = nsnull;
-    }
-
-    return PR_TRUE;
-  }
-
-  nsresult rv;
-  if (mImageRequest) {
-    nsCOMPtr<nsIURI> requestURI;
-    rv = mImageRequest->GetURI(getter_AddRefs(requestURI));
-    NS_ASSERTION(NS_SUCCEEDED(rv) && requestURI,"no request URI");
-    if (NS_FAILED(rv) || !requestURI) return PR_FALSE;
-
-    PRBool eq;
-    // if the source uri and the current one are the same, return
-    if (NS_SUCCEEDED(requestURI->Equals(mURI, &eq)) && eq)
-      return PR_FALSE;
-  }
-
-  mSizeFrozen = PR_FALSE;
-  mHasImage = PR_TRUE;
-
-  // otherwise, we need to load the new uri
-  if (mImageRequest) {
-    mImageRequest->Cancel(NS_ERROR_FAILURE);
-    mImageRequest = nsnull;
-  }
-
-  nsCOMPtr<imgILoader> il(do_GetService("@mozilla.org/image/loader;1", &rv));
-  if (NS_FAILED(rv)) return PR_FALSE;
-
-  nsCOMPtr<nsILoadGroup> loadGroup = GetLoadGroup();
-
-  // Get the document URI for the referrer...
-  nsIURI *documentURI = nsnull;
-  nsCOMPtr<nsIDocument> doc;
-  if (mContent) {
-    doc = mContent->GetDocument();
-    if (doc) {
-      documentURI = doc->GetDocumentURI();
-    }
-  }
-
-  // XXX: initialDocumentURI is NULL!
-  il->LoadImage(mURI, nsnull, documentURI, loadGroup, mListener, doc,
-                mLoadFlags, nsnull, nsnull, getter_AddRefs(mImageRequest));
-
-  return PR_TRUE;
-}
-
 NS_IMETHODIMP
 nsImageBoxFrame::Paint(nsPresContext*      aPresContext,
                        nsIRenderingContext& aRenderingContext,
@@ -490,7 +437,7 @@ nsImageBoxFrame::PaintImage(nsIRenderingContext& aRenderingContext,
     return;
 
   // don't draw if the image is not dirty
-  if (!mHasImage || !aDirtyRect.Intersects(rect))
+  if (!aDirtyRect.Intersects(rect))
     return;
 
   nsCOMPtr<imgIContainer> imgCon;
@@ -548,14 +495,17 @@ nsImageBoxFrame::DidSetStyleContext( nsPresContext* aPresContext )
     return NS_OK;
 
   // If list-style-image changes, we have a new image.
-  nsIURI *newURI = myList->mListStyleImage;
+  nsCOMPtr<nsIURI> oldURI, newURI;
+  if (mImageRequest)
+    mImageRequest->GetURI(getter_AddRefs(oldURI));
+  if (myList->mListStyleImage)
+    myList->mListStyleImage->GetURI(getter_AddRefs(newURI));
   PRBool equal;
-  if (newURI == mURI ||   // handles null==null
-      (newURI && mURI && NS_SUCCEEDED(newURI->Equals(mURI, &equal)) && equal))
+  if (newURI == oldURI ||   // handles null==null
+      (newURI && oldURI &&
+       NS_SUCCEEDED(newURI->Equals(oldURI, &equal)) && equal))
     return NS_OK;
 
-  mURI = newURI;
-
   UpdateImage();
   return NS_OK;
 } // DidSetStyleContext
@@ -563,36 +513,13 @@ nsImageBoxFrame::DidSetStyleContext( nsPresContext* aPresContext )
 void
 nsImageBoxFrame::GetImageSize()
 {
-  nsHTMLReflowMetrics desiredSize(PR_TRUE);
-  const PRInt32 kDefaultSize = 0;
-  // XXX constant zero?
-  const PRInt32 kDefaultSizeInTwips =
-    GetPresContext()->IntScaledPixelsToTwips(kDefaultSize);
-
-// not calculated? Get the intrinsic size
-	if (mHasImage) {
-	  // get the size of the image and set the desired size
-	  if (mSizeFrozen) {
-			mImageSize.width = kDefaultSizeInTwips;
-			mImageSize.height = kDefaultSizeInTwips;
-      return;
-	  } else {
-      // Ask the image loader for the *intrinsic* image size
-      if (mIntrinsicSize.width > 0 && mIntrinsicSize.height > 0) {
-        mImageSize.width = mIntrinsicSize.width;
-        mImageSize.height = mIntrinsicSize.height;
-        return;
-      } else {
-        mImageSize.width = kDefaultSizeInTwips;
-        mImageSize.height = kDefaultSizeInTwips;
-        return;
-      }
-	  }
-	}
-
-  // XXX constant zero?
-  mImageSize.width = desiredSize.width;
-  mImageSize.height = desiredSize.height;
+  if (mIntrinsicSize.width > 0 && mIntrinsicSize.height > 0) {
+    mImageSize.width = mIntrinsicSize.width;
+    mImageSize.height = mIntrinsicSize.height;
+  } else {
+    mImageSize.width = 0;
+    mImageSize.height = 0;
+  }
 }
 
 
@@ -682,9 +609,6 @@ NS_IMETHODIMP nsImageBoxFrame::OnStartContainer(imgIRequest *request,
   // Ensure the animation (if any) is started
   image->StartAnimation();
 
-  mHasImage = PR_TRUE;
-  mSizeFrozen = PR_FALSE;
-
   nscoord w, h;
   image->GetWidth(&w);
   image->GetHeight(&h);
diff --git a/mozilla/layout/xul/base/src/nsImageBoxFrame.h b/mozilla/layout/xul/base/src/nsImageBoxFrame.h
index a615f67f88b..f60eca03ce3 100644
--- a/mozilla/layout/xul/base/src/nsImageBoxFrame.h
+++ b/mozilla/layout/xul/base/src/nsImageBoxFrame.h
@@ -97,19 +97,12 @@ public:
   NS_IMETHOD GetFrameName(nsAString& aResult) const;
 #endif
 
-  /**
-   * Update internal state when a given attribute changes. Does not reload the
-   * image.
-   * @return Whether the size of the image (possibly) changed
-   */
-  PRBool UpdateAttributes(nsIAtom* aAttribute);
-
   /** 
-   * Load the image to which mURI points, or throw away the current image if
-   * mURI is nsnull. Usually, this is preceded by a call to GetImageSource.
-   * @return PR_TRUE if the image is (possibly) of a different size
+   * Update mUseSrcAttr from appropriate content attributes or from
+   * style, throw away the current image, and load the appropriate
+   * image.
    * */
-  PRBool UpdateImage();
+  void UpdateImage();
 
   /**
    * Update mLoadFlags from content attributes. Does not attempt to reload the
@@ -141,12 +134,6 @@ protected:
 
   nsImageBoxFrame(nsIPresShell* aShell);
 
-  /**
-   * Update mURI and mUseSrcAttr from appropriate content attributes or from
-   * style. Does not reload the image.
-   */
-  void GetImageSource();
-
   /**
    * Get the load group for the current document, that should be used for
    * network requests.
@@ -160,11 +147,7 @@ private:
   nsCOMPtr<imgIRequest> mImageRequest;
   nsCOMPtr<imgIDecoderObserver> mListener;
 
-  nsCOMPtr<nsIURI> mURI; ///< The URI of the image.
-
   PRPackedBool mUseSrcAttr; ///< Whether or not the image src comes from an attribute.
-  PRPackedBool mSizeFrozen;
-  PRPackedBool mHasImage;
   PRPackedBool mSuppressStyleCheck;
   
   nsRect mSubRect; ///< If set, indicates that only the portion of the image specified by the rect should be used.
diff --git a/mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp b/mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp
index fa6c92691c0..be4242a74e1 100644
--- a/mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp
+++ b/mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp
@@ -1627,15 +1627,18 @@ nsTreeBodyFrame::GetImage(PRInt32 aRowIndex, nsTreeColumn* aCol, PRBool aUseCont
 
   nsAutoString imageSrc;
   mView->GetImageSrc(aRowIndex, aCol, imageSrc);
+  nsCOMPtr<imgIRequest> styleRequest;
   if (!aUseContext && !imageSrc.IsEmpty()) {
     aAllowImageRegions = PR_FALSE;
   }
   else {
     // Obtain the URL from the style context.
     aAllowImageRegions = PR_TRUE;
-    nsIURI* uri = aStyleContext->GetStyleList()->mListStyleImage;
-    if (!uri)
+    styleRequest = aStyleContext->GetStyleList()->mListStyleImage;
+    if (!styleRequest)
       return NS_OK;
+    nsCOMPtr<nsIURI> uri;
+    styleRequest->GetURI(getter_AddRefs(uri));
     nsCAutoString spec;
     uri->GetSpec(spec);
     CopyUTF8toUTF16(spec, imageSrc);
@@ -1676,30 +1679,35 @@ nsTreeBodyFrame::GetImage(PRInt32 aRowIndex, nsTreeColumn* aCol, PRBool aUseCont
     listener->AddCell(aRowIndex, aCol);
     nsCOMPtr<imgIDecoderObserver> imgDecoderObserver = listener;
 
-    nsCOMPtr<nsIURI> baseURI;
-    nsCOMPtr<nsIDocument> doc = mContent->GetDocument();
-    if (!doc)
-      // The page is currently being torn down.  Why bother.
-      return NS_ERROR_FAILURE;
-
-    baseURI = mContent->GetBaseURI();
-
-    nsCOMPtr<nsIURI> srcURI;
-    // XXX origin charset needed
-    NS_NewURI(getter_AddRefs(srcURI), imageSrc, nsnull, baseURI);
-    if (!srcURI)
-      return NS_ERROR_FAILURE;
     nsCOMPtr<imgIRequest> imageRequest;
+    if (styleRequest) {
+      styleRequest->Clone(imgDecoderObserver, getter_AddRefs(imageRequest));
+    } else {
+      nsCOMPtr<nsIURI> baseURI;
+      nsCOMPtr<nsIDocument> doc = mContent->GetDocument();
+      if (!doc)
+        // The page is currently being torn down.  Why bother.
+        return NS_ERROR_FAILURE;
 
-    nsresult rv;
-    nsCOMPtr<imgILoader> il(do_GetService("@mozilla.org/image/loader;1", &rv));
-    if (NS_FAILED(rv))
-      return rv;
+      baseURI = mContent->GetBaseURI();
 
-    // XXX: initialDocumentURI is NULL!
-    rv = il->LoadImage(srcURI, nsnull, doc->GetDocumentURI(), nsnull,
-                       imgDecoderObserver, doc, nsIRequest::LOAD_NORMAL,
-                       nsnull, nsnull, getter_AddRefs(imageRequest));
+      nsCOMPtr<nsIURI> srcURI;
+      // XXX origin charset needed
+      NS_NewURI(getter_AddRefs(srcURI), imageSrc, nsnull, baseURI);
+      if (!srcURI)
+        return NS_ERROR_FAILURE;
+
+      nsresult rv;
+      nsCOMPtr<imgILoader> il =
+        do_GetService("@mozilla.org/image/loader;1", &rv);
+      if (NS_FAILED(rv))
+        return rv;
+
+      // XXX: initialDocumentURI is NULL!
+      rv = il->LoadImage(srcURI, nsnull, doc->GetDocumentURI(), nsnull,
+                         imgDecoderObserver, doc, nsIRequest::LOAD_NORMAL,
+                         nsnull, nsnull, getter_AddRefs(imageRequest));
+    }
     listener->UnsuppressInvalidation();
 
     if (!imageRequest)