--- a/image/Decoder.h
+++ b/image/Decoder.h
@@ -96,17 +96,17 @@ public:
 
   explicit Decoder(RasterImage* aImage);
 
   /**
    * Initialize an image decoder. Decoders may not be re-initialized.
    *
    * @return NS_OK if the decoder could be initialized successfully.
    */
-  nsresult Init();
+  MOZ_MUST_USE nsresult Init();
 
   /**
    * Decodes, reading all data currently available in the SourceBuffer.
    *
    * If more data is needed and @aOnResume is non-null, Decode() will schedule
    * @aOnResume to be called when more data is available.
    *
    * @return a LexerResult which may indicate:
@@ -409,22 +409,22 @@ protected:
   /*
    * Internal hooks. Decoder implementations may override these and
    * only these methods.
    *
    * BeforeFinishInternal() can be used to detect if decoding is in an
    * incomplete state, e.g. due to file truncation, in which case it should
    * return a failing nsresult.
    */
-  virtual nsresult InitInternal();
+  MOZ_MUST_USE virtual nsresult InitInternal();
   virtual LexerResult DoDecode(SourceBufferIterator& aIterator,
                                IResumable* aOnResume) = 0;
-  virtual nsresult BeforeFinishInternal();
-  virtual nsresult FinishInternal();
-  virtual nsresult FinishWithErrorInternal();
+  MOZ_MUST_USE virtual nsresult BeforeFinishInternal();
+  MOZ_MUST_USE virtual nsresult FinishInternal();
+  MOZ_MUST_USE virtual nsresult FinishWithErrorInternal();
 
   /**
    * @return the per-image-format telemetry ID for recording this decoder's
    * speed, or Nothing() if we don't record speed telemetry for this kind of
    * decoder.
    */
   virtual Maybe<Telemetry::HistogramID> SpeedHistogram() const { return Nothing(); }
 
@@ -495,17 +495,17 @@ protected:
   /**
    * Allocates a new frame, making it our current frame if successful.
    *
    * The @aFrameNum parameter only exists as a sanity check; it's illegal to
    * create a new frame anywhere but immediately after the existing frames.
    *
    * If a non-paletted frame is desired, pass 0 for aPaletteDepth.
    */
-  nsresult AllocateFrame(uint32_t aFrameNum,
+  MOZ_MUST_USE nsresult AllocateFrame(uint32_t aFrameNum,
                          const gfx::IntSize& aOutputSize,
                          const gfx::IntRect& aFrameRect,
                          gfx::SurfaceFormat aFormat,
                          uint8_t aPaletteDepth = 0);
 
 private:
   /// Report that an error was encountered while decoding.
   void PostError();

--- a/image/Downscaler.h
+++ b/image/Downscaler.h
@@ -73,17 +73,17 @@ public:
    *                      would write its output when not downscaling during
    *                      decode.
    * @param aHasAlpha Whether or not this frame has an alpha channel.
    *                  Performance is a little better if it doesn't have one.
    * @param aFlipVertically If true, output rows will be written to the output
    *                        buffer in reverse order vertically, which matches
    *                        the way they are stored in some image formats.
    */
-  nsresult BeginFrame(const nsIntSize& aOriginalSize,
+  MOZ_MUST_USE nsresult BeginFrame(const nsIntSize& aOriginalSize,
                       const Maybe<nsIntRect>& aFrameRect,
                       uint8_t* aOutputBuffer,
                       bool aHasAlpha,
                       bool aFlipVertically = false);
 
   bool IsFrameComplete() const { return mCurrentInLine >= mOriginalSize.height; }
 
   /// Retrieves the buffer into which the Decoder should write each row.
@@ -157,17 +157,17 @@ public:
   {
     MOZ_RELEASE_ASSERT(false, "Skia is not enabled");
   }
 
   const nsIntSize& OriginalSize() const { return mSize; }
   const nsIntSize& TargetSize() const { return mSize; }
   const gfxSize& Scale() const { return mScale; }
 
-  nsresult BeginFrame(const nsIntSize&, const Maybe<nsIntRect>&, uint8_t*, bool, bool = false)
+  MOZ_MUST_USE nsresult BeginFrame(const nsIntSize&, const Maybe<nsIntRect>&, uint8_t*, bool, bool = false)
   {
     return NS_ERROR_FAILURE;
   }
 
   bool IsFrameComplete() const { return false; }
   uint8_t* RowBuffer() { return nullptr; }
   void ClearRow() { }
   void ClearRestOfRow(uint32_t) { }

--- a/image/FrameAnimator.cpp
+++ b/image/FrameAnimator.cpp
@@ -795,23 +795,26 @@ FrameAnimator::DoBlend(DrawableSurface& 
           } else {
             if (needToBlankComposite) {
               // Only blank composite when prev is transparent or not full.
               if (prevFrameData.mHasAlpha || !isFullPrevFrame) {
                 ClearFrame(compositingFrameData.mRawData,
                            compositingFrameData.mRect);
               }
             }
-            DrawFrameTo(prevFrameData.mRawData, prevFrameData.mRect,
+            nsresult rv = DrawFrameTo(prevFrameData.mRawData, prevFrameData.mRect,
                         prevFrameData.mPaletteDataLength,
                         prevFrameData.mHasAlpha,
                         compositingFrameData.mRawData,
                         compositingFrameData.mRect,
                         prevFrameData.mBlendMethod,
                         prevFrameData.mBlendRect);
+           if (NS_FAILED(rv)) {
+             return false;
+           }
           }
         }
     }
   } else if (needToBlankComposite) {
     // If we just created the composite, it could have anything in its
     // buffers. Clear them
     ClearFrame(compositingFrameData.mRawData,
                compositingFrameData.mRect);
@@ -844,24 +847,28 @@ FrameAnimator::DoBlend(DrawableSurface& 
                    compositingFrameData.mRect,
                    compositingPrevFrameData.mRawData,
                    compositingPrevFrameData.mRect);
 
     mCompositingPrevFrame->Finish();
   }
 
   // blit next frame into it's correct spot
-  DrawFrameTo(nextFrameData.mRawData, nextFrameData.mRect,
+  nsresult rv = DrawFrameTo(nextFrameData.mRawData, nextFrameData.mRect,
               nextFrameData.mPaletteDataLength,
               nextFrameData.mHasAlpha,
               compositingFrameData.mRawData,
               compositingFrameData.mRect,
               nextFrameData.mBlendMethod,
               nextFrameData.mBlendRect);
 
+  if (NS_FAILED(rv)) {
+    return false;
+  }
+
   // Tell the image that it is fully 'downloaded'.
   mCompositingFrame->Finish();
 
   mLastCompositedFrameIndex = int32_t(aNextFrameIndex);
 
   return true;
 }
 

--- a/image/FrameAnimator.h
+++ b/image/FrameAnimator.h
@@ -347,17 +347,17 @@ private: // methods
    * Get the time the frame we're currently displaying is supposed to end.
    *
    * In the error case (like if the requested frame is not currently
    * decoded), returns None().
    */
   Maybe<TimeStamp> GetCurrentImgFrameEndTime(AnimationState& aState,
                                              DrawableSurface& aFrames) const;
 
-  bool DoBlend(DrawableSurface& aFrames,
+  MOZ_MUST_USE bool DoBlend(DrawableSurface& aFrames,
                gfx::IntRect* aDirtyRect,
                uint32_t aPrevFrameIndex,
                uint32_t aNextFrameIndex);
 
   /** Clears an area of <aFrame> with transparent black.
    *
    * @param aFrameData Target Frame data
    * @param aFrameRect The rectangle of the data pointed ot by aFrameData
@@ -385,17 +385,17 @@ private: // methods
    *                    of the source data (0 if image is not paletted)
    * @aSrcHasAlpha whether the source data represents an image with alpha
    * @aDstPixels the raw data of the composition frame where the current frame
    *             is drawn into (32-bit ARGB)
    * @aDstRect the size of the composition frame
    * @aBlendMethod the blend method for how to blend src on the composition
    * frame.
    */
-  static nsresult DrawFrameTo(const uint8_t* aSrcData,
+  MOZ_MUST_USE static nsresult DrawFrameTo(const uint8_t* aSrcData,
                               const gfx::IntRect& aSrcRect,
                               uint32_t aSrcPaletteLength, bool aSrcHasAlpha,
                               uint8_t* aDstPixels, const gfx::IntRect& aDstRect,
                               BlendMethod aBlendMethod,
                               const Maybe<gfx::IntRect>& aBlendRect);
 
 private: // data
   //! A weak pointer to our owning image.

--- a/image/Image.h
+++ b/image/Image.h
@@ -198,21 +198,21 @@ public:
    * but by separating this functionality into a different method we don't
    * interfere with subclasses which wish to implement nsIStreamListener.
    *
    * Images should not do anything that could send out notifications until they
    * have received their first OnImageDataAvailable notification; in
    * particular, this means that instantiating decoders should be deferred
    * until OnImageDataAvailable is called.
    */
-  virtual nsresult OnImageDataAvailable(nsIRequest* aRequest,
-                                        nsISupports* aContext,
-                                        nsIInputStream* aInStr,
-                                        uint64_t aSourceOffset,
-                                        uint32_t aCount) = 0;
+  MOZ_MUST_USE virtual nsresult OnImageDataAvailable(nsIRequest* aRequest,
+                                                     nsISupports* aContext,
+                                                     nsIInputStream* aInStr,
+                                                     uint64_t aSourceOffset,
+                                                     uint32_t aCount) = 0;
 
   /**
    * Called from OnStopRequest when the image's underlying request completes.
    *
    * @param aRequest  The completed request.
    * @param aContext  Context from Necko's OnStopRequest.
    * @param aStatus   A success or failure code.
    * @param aLastPart Whether this is the final part of the underlying request.
@@ -311,18 +311,18 @@ protected:
   /**
    * Extended by child classes, if they have additional
    * conditions for being able to animate.
    */
   virtual bool ShouldAnimate() {
     return mAnimationConsumers > 0 && mAnimationMode != kDontAnimMode;
   }
 
-  virtual nsresult StartAnimation() = 0;
-  virtual nsresult StopAnimation() = 0;
+  MOZ_MUST_USE virtual nsresult StartAnimation() = 0;
+  MOZ_MUST_USE virtual nsresult StopAnimation() = 0;
 
   void SendOnUnlockedDraw(uint32_t aFlags);
 
 #ifdef DEBUG
   // Records the image drawing for startup performance testing.
   void NotifyDrawingObservers();
 #endif
 

--- a/image/ImageOps.cpp
+++ b/image/ImageOps.cpp
@@ -121,17 +121,20 @@ ImageOps::CreateImageBuffer(already_AddR
   uint64_t length;
   rv = inputStream->Available(&length);
   if (NS_FAILED(rv) || length > UINT32_MAX) {
     return nullptr;
   }
 
   // Write the data into a SourceBuffer.
   RefPtr<SourceBuffer> sourceBuffer = new SourceBuffer();
-  sourceBuffer->ExpectLength(length);
+  rv = sourceBuffer->ExpectLength(length);
+  if (NS_FAILED(rv)) {
+    return nullptr;
+  }
   rv = sourceBuffer->AppendFromInputStream(inputStream, length);
   if (NS_FAILED(rv)) {
     return nullptr;
   }
   // Make sure our sourceBuffer is marked as complete.
   if (sourceBuffer->IsComplete()) {
     NS_WARNING("The SourceBuffer was unexpectedly marked as complete. This may "
                "indicate either an OOM condition, or that imagelib was not "

--- a/image/ImageWrapper.h
+++ b/image/ImageWrapper.h
@@ -32,21 +32,21 @@ public:
                                      MallocSizeOf aMallocSizeOf) const override;
 
   virtual void IncrementAnimationConsumers() override;
   virtual void DecrementAnimationConsumers() override;
 #ifdef DEBUG
   virtual uint32_t GetAnimationConsumers() override;
 #endif
 
-  virtual nsresult OnImageDataAvailable(nsIRequest* aRequest,
-                                        nsISupports* aContext,
-                                        nsIInputStream* aInStr,
-                                        uint64_t aSourceOffset,
-                                        uint32_t aCount) override;
+  MOZ_MUST_USE virtual nsresult OnImageDataAvailable(nsIRequest* aRequest,
+                                                     nsISupports* aContext,
+                                                     nsIInputStream* aInStr,
+                                                     uint64_t aSourceOffset,
+                                                     uint32_t aCount) override;
   virtual nsresult OnImageDataComplete(nsIRequest* aRequest,
                                        nsISupports* aContext,
                                        nsresult aStatus,
                                        bool aLastPart) override;
 
   virtual void OnSurfaceDiscarded(const SurfaceKey& aSurfaceKey) override;
 
   virtual void SetInnerWindowID(uint64_t aInnerWindowId) override;

--- a/image/MultipartImage.h
+++ b/image/MultipartImage.h
@@ -28,21 +28,21 @@ public:
   NS_DECL_ISUPPORTS_INHERITED
 
   void BeginTransitionToPart(Image* aNextPart);
 
   // Overridden ImageWrapper methods:
   virtual already_AddRefed<imgIContainer> Unwrap() override;
   virtual already_AddRefed<ProgressTracker> GetProgressTracker() override;
   virtual void SetProgressTracker(ProgressTracker* aTracker) override;
-  virtual nsresult OnImageDataAvailable(nsIRequest* aRequest,
-                                        nsISupports* aContext,
-                                        nsIInputStream* aInStr,
-                                        uint64_t aSourceOffset,
-                                        uint32_t aCount) override;
+  MOZ_MUST_USE virtual nsresult OnImageDataAvailable(nsIRequest* aRequest,
+                                                     nsISupports* aContext,
+                                                     nsIInputStream* aInStr,
+                                                     uint64_t aSourceOffset,
+                                                     uint32_t aCount) override;
   virtual nsresult OnImageDataComplete(nsIRequest* aRequest,
                                        nsISupports* aContext,
                                        nsresult aStatus,
                                        bool aLastPart) override;
 
   // We don't support locking or track animation consumers for individual parts,
   // so we override these methods to do nothing.
   NS_IMETHOD LockImage() override { return NS_OK; }

--- a/image/ProgressTracker.h
+++ b/image/ProgressTracker.h
@@ -177,17 +177,17 @@ public:
   // Because this may result in recursive notifications, no decoding locks may
   // be held.  Called on the main thread only.
   void SyncNotifyProgress(Progress aProgress,
                           const nsIntRect& aInvalidRect = nsIntRect());
 
   // We manage a set of observers that are using an image and thus concerned
   // with its loading progress. Weak pointers.
   void AddObserver(IProgressObserver* aObserver);
-  bool RemoveObserver(IProgressObserver* aObserver);
+  MOZ_MUST_USE bool RemoveObserver(IProgressObserver* aObserver);
   uint32_t ObserverCount() const;
 
   // Get the event target we should currently dispatch events to.
   already_AddRefed<nsIEventTarget> GetEventTarget() const;
 
   // Resets our weak reference to our image. Image subclasses should call this
   // in their destructor.
   void ResetImage();

--- a/image/RasterImage.h
+++ b/image/RasterImage.h
@@ -157,18 +157,18 @@ public:
   NS_DECL_NSIPROPERTIES
   NS_DECL_IMGICONTAINER
 #ifdef DEBUG
   NS_DECL_IMGICONTAINERDEBUG
 #endif
 
   nsresult GetNativeSizes(nsTArray<gfx::IntSize>& aNativeSizes) const override;
   size_t GetNativeSizesLength() const override;
-  virtual nsresult StartAnimation() override;
-  virtual nsresult StopAnimation() override;
+  MOZ_MUST_USE virtual nsresult StartAnimation() override;
+  MOZ_MUST_USE virtual nsresult StopAnimation() override;
 
   // Methods inherited from Image
   virtual void OnSurfaceDiscarded(const SurfaceKey& aSurfaceKey) override;
 
   virtual size_t SizeOfSourceWithComputedFallback(SizeOfState& aState)
     const override;
   virtual void CollectSizeOfSurfaces(nsTArray<SurfaceMemoryCounter>& aCounters,
                                      MallocSizeOf aMallocSizeOf) const override;
@@ -236,21 +236,21 @@ public:
   // Helper method for NotifyDecodeComplete.
   void ReportDecoderError();
 
 
   //////////////////////////////////////////////////////////////////////////////
   // Network callbacks.
   //////////////////////////////////////////////////////////////////////////////
 
-  virtual nsresult OnImageDataAvailable(nsIRequest* aRequest,
-                                        nsISupports* aContext,
-                                        nsIInputStream* aInStr,
-                                        uint64_t aSourceOffset,
-                                        uint32_t aCount) override;
+  MOZ_MUST_USE virtual nsresult OnImageDataAvailable(nsIRequest* aRequest,
+                                                     nsISupports* aContext,
+                                                     nsIInputStream* aInStr,
+                                                     uint64_t aSourceOffset,
+                                                     uint32_t aCount) override;
   virtual nsresult OnImageDataComplete(nsIRequest* aRequest,
                                        nsISupports* aContext,
                                        nsresult aStatus,
                                        bool aLastPart) override;
 
   void NotifyForLoadEvent(Progress aProgress);
 
   /**
@@ -259,17 +259,17 @@ public:
    * appropriately preallocating the source data buffer.
    *
    * We take this approach rather than having the source data management code do
    * something more complicated (like chunklisting) because HTTP is by far the
    * dominant source of images, and the Content-Length header is quite reliable.
    * Thus, pre-allocation simplifies code and reduces the total number of
    * allocations.
    */
-  nsresult SetSourceSizeHint(uint32_t aSizeHint);
+  MOZ_MUST_USE nsresult SetSourceSizeHint(uint32_t aSizeHint);
 
  nsCString GetURIString() {
     nsCString spec;
     if (GetURI()) {
       GetURI()->GetSpec(spec);
     }
     return spec;
   }
@@ -352,17 +352,17 @@ private:
    *
    * @param aMetadata The metadata to set on this image.
    * @param aFromMetadataDecode True if this metadata came from a metadata
    *                            decode; false if it came from a full decode.
    * @return |true| unless a catastrophic failure was discovered. If |false| is
    * returned, it indicates that the image is corrupt in a way that requires all
    * surfaces to be discarded to recover.
    */
-  bool SetMetadata(const ImageMetadata& aMetadata, bool aFromMetadataDecode);
+  MOZ_MUST_USE bool SetMetadata(const ImageMetadata& aMetadata, bool aFromMetadataDecode);
 
   /**
    * In catastrophic circumstances like a GPU driver crash, the contents of our
    * frames may become invalid.  If the information we gathered during the
    * metadata decode proves to be wrong due to image corruption, the frames we
    * have may violate this class's invariants. Either way, we need to
    * immediately discard the invalid frames and redecode so that callers don't
    * perceive that we've entered an invalid state.

--- a/image/SVGDocumentWrapper.h
+++ b/image/SVGDocumentWrapper.h
@@ -126,17 +126,17 @@ public:
   /**
    * Force a layout flush of the underlying SVG document.
    */
   void FlushLayout();
 
 private:
   ~SVGDocumentWrapper();
 
-  nsresult SetupViewer(nsIRequest* aRequest,
+  MOZ_MUST_USE nsresult SetupViewer(nsIRequest* aRequest,
                        nsIContentViewer** aViewer,
                        nsILoadGroup** aLoadGroup);
   void     DestroyViewer();
   void     RegisterForXPCOMShutdown();
   void     UnregisterForXPCOMShutdown();
 
   nsCOMPtr<nsIContentViewer>  mViewer;
   nsCOMPtr<nsILoadGroup>      mLoadGroup;

--- a/image/SourceBuffer.h
+++ b/image/SourceBuffer.h
@@ -148,17 +148,17 @@ public:
    *         State::COMPLETE if the iterator could not be advanced because it's
    *           at the end of the underlying SourceBuffer and the SourceBuffer is
    *           marked complete (i.e., it will never receive any additional
    *           data).
    */
   State AdvanceOrScheduleResume(size_t aRequestedBytes, IResumable* aConsumer);
 
   /// If at the end, returns the status passed to SourceBuffer::Complete().
-  nsresult CompletionStatus() const
+  MOZ_MUST_USE nsresult CompletionStatus() const
   {
     MOZ_ASSERT(mState == COMPLETE,
                "Calling CompletionStatus() in the wrong state");
     return mState == COMPLETE ? mData.mAtEnd.mStatus : NS_OK;
   }
 
   /// If we're ready to read, returns a pointer to the new data.
   const char* Data() const
@@ -321,23 +321,24 @@ public:
   //////////////////////////////////////////////////////////////////////////////
   // Producer methods.
   //////////////////////////////////////////////////////////////////////////////
 
   /**
    * If the producer knows how long the source data will be, it should call
    * ExpectLength, which enables SourceBuffer to preallocate its buffer.
    */
-  nsresult ExpectLength(size_t aExpectedLength);
+  MOZ_MUST_USE nsresult ExpectLength(size_t aExpectedLength);
+
 
   /// Append the provided data to the buffer.
-  nsresult Append(const char* aData, size_t aLength);
+  MOZ_MUST_USE nsresult Append(const char* aData, size_t aLength);
 
   /// Append the data available on the provided nsIInputStream to the buffer.
-  nsresult AppendFromInputStream(nsIInputStream* aInputStream, uint32_t aCount);
+  MOZ_MUST_USE nsresult AppendFromInputStream(nsIInputStream* aInputStream, uint32_t aCount);
 
   /**
    * Mark the buffer complete, with a status that will be available to
    * consumers. Further calls to Append() are forbidden after Complete().
    */
   void Complete(nsresult aStatus);
 
   /// Returns true if the buffer is complete.
@@ -426,17 +427,17 @@ private:
     }
 
     void AddLength(size_t aAdditionalLength)
     {
       MOZ_ASSERT(mLength + aAdditionalLength <= mCapacity);
       mLength += aAdditionalLength;
     }
 
-    bool SetCapacity(size_t aCapacity)
+    MOZ_MUST_USE bool SetCapacity(size_t aCapacity)
     {
       MOZ_ASSERT(mData, "Allocation failed but nobody checked for it");
       char* data = static_cast<char*>(realloc(mData, aCapacity));
       if (!data) {
         return false;
       }
 
       mData = data;

--- a/image/SurfaceFilters.h
+++ b/image/SurfaceFilters.h
@@ -65,17 +65,17 @@ public:
   DeinterlacingFilter()
     : mInputRow(0)
     , mOutputRow(0)
     , mPass(0)
     , mProgressiveDisplay(true)
   { }
 
   template <typename... Rest>
-  nsresult Configure(const DeinterlacingConfig<PixelType>& aConfig, Rest... aRest)
+  MOZ_MUST_USE nsresult Configure(const DeinterlacingConfig<PixelType>& aConfig, Rest... aRest)
   {
     nsresult rv = mNext.Configure(aRest...);
     if (NS_FAILED(rv)) {
       return rv;
     }
 
     if (sizeof(PixelType) == 1 && !mNext.IsValidPalettedPipe()) {
       NS_WARNING("Paletted DeinterlacingFilter used with non-paletted pipe?");
@@ -355,17 +355,17 @@ template <typename Next>
 class RemoveFrameRectFilter final : public SurfaceFilter
 {
 public:
   RemoveFrameRectFilter()
     : mRow(0)
   { }
 
   template <typename... Rest>
-  nsresult Configure(const RemoveFrameRectConfig& aConfig, Rest... aRest)
+  MOZ_MUST_USE nsresult Configure(const RemoveFrameRectConfig& aConfig, Rest... aRest)
   {
     nsresult rv = mNext.Configure(aRest...);
     if (NS_FAILED(rv)) {
       return rv;
     }
 
     if (mNext.IsValidPalettedPipe()) {
       NS_WARNING("RemoveFrameRectFilter used with paletted pipe?");
@@ -585,17 +585,17 @@ class ADAM7InterpolatingFilter final : p
 public:
   ADAM7InterpolatingFilter()
     : mPass(0)  // The current pass, in the range 1..7. Starts at 0 so that
                 // DoResetToFirstRow() doesn't have to special case the first pass.
     , mRow(0)
   { }
 
   template <typename... Rest>
-  nsresult Configure(const ADAM7InterpolatingConfig& aConfig, Rest... aRest)
+  MOZ_MUST_USE nsresult Configure(const ADAM7InterpolatingConfig& aConfig, Rest... aRest)
   {
     nsresult rv = mNext.Configure(aRest...);
     if (NS_FAILED(rv)) {
       return rv;
     }
 
     if (mNext.IsValidPalettedPipe()) {
       NS_WARNING("ADAM7InterpolatingFilter used with paletted pipe?");

--- a/image/SurfacePipe.h
+++ b/image/SurfacePipe.h
@@ -690,17 +690,17 @@ struct SurfaceConfig
  * the surface and protects against buffer overflow. This sink should be used
  * for all non-animated images and for the first frame of animated images.
  *
  * Sinks must always be at the end of the SurfaceFilter chain.
  */
 class SurfaceSink final : public AbstractSurfaceSink
 {
 public:
-  nsresult Configure(const SurfaceConfig& aConfig);
+  MOZ_MUST_USE nsresult Configure(const SurfaceConfig& aConfig);
 
 protected:
   uint8_t* GetRowPointer() const override;
 };
 
 class PalettedSurfaceSink;
 
 struct PalettedSurfaceConfig
@@ -725,17 +725,17 @@ struct PalettedSurfaceConfig
  * XXX(seth): We'll remove all support for paletted surfaces in bug 1247520,
  * which means we can remove PalettedSurfaceSink entirely.
  */
 class PalettedSurfaceSink final : public AbstractSurfaceSink
 {
 public:
   bool IsValidPalettedPipe() const override { return true; }
 
-  nsresult Configure(const PalettedSurfaceConfig& aConfig);
+  MOZ_MUST_USE nsresult Configure(const PalettedSurfaceConfig& aConfig);
 
 protected:
   uint8_t* GetRowPointer() const override;
 
 private:
   /**
    * The surface subrect which contains data. Note that the surface size we
    * actually allocate is the size of the frame rect, not the logical size of

--- a/image/VectorImage.h
+++ b/image/VectorImage.h
@@ -36,21 +36,21 @@ public:
   // Methods inherited from Image
   nsresult GetNativeSizes(nsTArray<gfx::IntSize>& aNativeSizes) const override;
   size_t GetNativeSizesLength() const override;
   virtual size_t SizeOfSourceWithComputedFallback(SizeOfState& aState)
     const override;
   virtual void CollectSizeOfSurfaces(nsTArray<SurfaceMemoryCounter>& aCounters,
                                      MallocSizeOf aMallocSizeOf) const override;
 
-  virtual nsresult OnImageDataAvailable(nsIRequest* aRequest,
-                                        nsISupports* aContext,
-                                        nsIInputStream* aInStr,
-                                        uint64_t aSourceOffset,
-                                        uint32_t aCount) override;
+  MOZ_MUST_USE virtual nsresult OnImageDataAvailable(nsIRequest* aRequest,
+                                                     nsISupports* aContext,
+                                                     nsIInputStream* aInStr,
+                                                     uint64_t aSourceOffset,
+                                                     uint32_t aCount) override;
   virtual nsresult OnImageDataComplete(nsIRequest* aRequest,
                                        nsISupports* aContext,
                                        nsresult aResult,
                                        bool aLastPart) override;
 
   virtual void OnSurfaceDiscarded(const SurfaceKey& aSurfaceKey) override;
 
   /**
@@ -71,18 +71,18 @@ public:
   void OnSVGDocumentError();
 
   virtual void ReportUseCounters() override;
 
 protected:
   explicit VectorImage(ImageURL* aURI = nullptr);
   virtual ~VectorImage();
 
-  virtual nsresult StartAnimation() override;
-  virtual nsresult StopAnimation() override;
+  MOZ_MUST_USE virtual nsresult StartAnimation() override;
+  MOZ_MUST_USE virtual nsresult StopAnimation() override;
   virtual bool     ShouldAnimate() override;
 
 private:
   Tuple<DrawResult, IntSize, RefPtr<SourceSurface>>
     GetFrameInternal(const IntSize& aSize,
                      const Maybe<SVGImageContext>& aSVGContext,
                      uint32_t aWhichFrame,
                      uint32_t aFlags) override;
@@ -113,17 +113,17 @@ private:
                   bool& aWillCache);
 
   /// Send a frame complete notification if appropriate. Must be called only
   /// after all drawing has been completed.
   void SendFrameComplete(bool aDidCache, uint32_t aFlags);
 
   void Show(gfxDrawable* aDrawable, const SVGDrawingParameters& aParams);
 
-  nsresult Init(const char* aMimeType, uint32_t aFlags);
+  MOZ_MUST_USE nsresult Init(const char* aMimeType, uint32_t aFlags);
 
   /**
    * In catastrophic circumstances like a GPU driver crash, we may lose our
    * surfaces even if they're locked. RecoverFromLossOfSurfaces discards all
    * existing surfaces, allowing us to recover.
    */
   void RecoverFromLossOfSurfaces();
 

--- a/image/decoders/EXIF.h
+++ b/image/decoders/EXIF.h
@@ -43,29 +43,29 @@ private:
     : mStart(nullptr)
     , mCurrent(nullptr)
     , mLength(0)
     , mRemainingLength(0)
     , mByteOrder(ByteOrder::Unknown)
   { }
 
   EXIFData ParseEXIF(const uint8_t* aData, const uint32_t aLength);
-  bool ParseEXIFHeader();
-  bool ParseTIFFHeader(uint32_t& aIFD0OffsetOut);
-  bool ParseIFD0(Orientation& aOrientationOut);
-  bool ParseOrientation(uint16_t aType, uint32_t aCount, Orientation& aOut);
+  MOZ_MUST_USE bool ParseEXIFHeader();
+  MOZ_MUST_USE bool ParseTIFFHeader(uint32_t& aIFD0OffsetOut);
+  MOZ_MUST_USE bool ParseIFD0(Orientation& aOrientationOut);
+  MOZ_MUST_USE bool ParseOrientation(uint16_t aType, uint32_t aCount, Orientation& aOut);
 
-  bool Initialize(const uint8_t* aData, const uint32_t aLength);
+  MOZ_MUST_USE bool Initialize(const uint8_t* aData, const uint32_t aLength);
   void Advance(const uint32_t aDistance);
   void JumpTo(const uint32_t aOffset);
 
   bool MatchString(const char* aString, const uint32_t aLength);
   bool MatchUInt16(const uint16_t aValue);
-  bool ReadUInt16(uint16_t& aOut);
-  bool ReadUInt32(uint32_t& aOut);
+  MOZ_MUST_USE bool ReadUInt16(uint16_t& aOut);
+  MOZ_MUST_USE bool ReadUInt32(uint32_t& aOut);
 
   const uint8_t* mStart;
   const uint8_t* mCurrent;
   uint32_t       mLength;
   uint32_t       mRemainingLength;
   ByteOrder      mByteOrder;
 };
 

--- a/image/decoders/nsICODecoder.cpp
+++ b/image/decoders/nsICODecoder.cpp
@@ -84,29 +84,34 @@ nsICODecoder::FinishWithErrorInternal()
 
 nsresult
 nsICODecoder::GetFinalStateFromContainedDecoder()
 {
   if (!mContainedDecoder) {
     return NS_OK;
   }
 
+  nsresult rv;
+  bool rvb;
+
   // Let the contained decoder finish up if necessary.
-  FlushContainedDecoder();
+  rvb = FlushContainedDecoder();
 
   // Make our state the same as the state of the contained decoder.
   mDecodeDone = mContainedDecoder->GetDecodeDone();
   mProgress |= mContainedDecoder->TakeProgress();
   mInvalidRect.UnionRect(mInvalidRect, mContainedDecoder->TakeInvalidRect());
   mCurrentFrame = mContainedDecoder->GetCurrentFrameRef();
 
-  // Propagate errors.
-  nsresult rv = HasError() || mContainedDecoder->HasError()
-              ? NS_ERROR_FAILURE
-              : NS_OK;
+  if (!NS_FAILED(rv) || !rvb){
+    // Propagate errors.
+    rv = HasError() || mContainedDecoder->HasError()
+                ? NS_ERROR_FAILURE
+                : NS_OK;
+  }
 
   MOZ_ASSERT(NS_FAILED(rv) || !mCurrentFrame || mCurrentFrame->IsFinished());
   return rv;
 }
 
 LexerTransition<ICOState>
 nsICODecoder::ReadHeader(const char* aData)
 {

--- a/image/decoders/nsICODecoder.h
+++ b/image/decoders/nsICODecoder.h
@@ -53,20 +53,20 @@ public:
 private:
   friend class DecoderFactory;
 
   // Decoders should only be instantiated via DecoderFactory.
   explicit nsICODecoder(RasterImage* aImage);
 
   // Flushes the contained decoder to read all available data and sets the
   // appropriate errors. Returns true if there are no errors.
-  bool FlushContainedDecoder();
+  MOZ_MUST_USE bool FlushContainedDecoder();
 
   // Gets decoder state from the contained decoder so it's visible externally.
-  nsresult GetFinalStateFromContainedDecoder();
+  MOZ_MUST_USE nsresult GetFinalStateFromContainedDecoder();
 
   // Obtains the number of colors from the BPP, mBPP must be filled in
   uint16_t GetNumColors();
 
   LexerTransition<ICOState> ReadHeader(const char* aData);
   LexerTransition<ICOState> ReadDirEntry(const char* aData);
   LexerTransition<ICOState> IterateUnsizedDirEntry();
   LexerTransition<ICOState> FinishDirEntry();

--- a/image/decoders/nsJPEGDecoder.h
+++ b/image/decoders/nsJPEGDecoder.h
@@ -50,20 +50,20 @@ struct Orientation;
 class nsJPEGDecoder : public Decoder
 {
 public:
   virtual ~nsJPEGDecoder();
 
   void NotifyDone();
 
 protected:
-  nsresult InitInternal() override;
+  MOZ_MUST_USE nsresult InitInternal() override;
   LexerResult DoDecode(SourceBufferIterator& aIterator,
                        IResumable* aOnResume) override;
-  nsresult FinishInternal() override;
+  MOZ_MUST_USE nsresult FinishInternal() override;
 
   Maybe<Telemetry::HistogramID> SpeedHistogram() const override;
 
 protected:
   Orientation ReadOrientationFromEXIF();
   void OutputScanlines(bool* suspend);
 
 private:

--- a/image/decoders/nsPNGDecoder.h
+++ b/image/decoders/nsPNGDecoder.h
@@ -21,18 +21,18 @@ class nsPNGDecoder : public Decoder
 {
 public:
   virtual ~nsPNGDecoder();
 
   /// @return true if this PNG is a valid ICO resource.
   bool IsValidICOResource() const override;
 
 protected:
-  nsresult InitInternal() override;
-  nsresult FinishInternal() override;
+  MOZ_MUST_USE nsresult InitInternal() override;
+  MOZ_MUST_USE nsresult FinishInternal() override;
   LexerResult DoDecode(SourceBufferIterator& aIterator,
                        IResumable* aOnResume) override;
 
   Maybe<Telemetry::HistogramID> SpeedHistogram() const override;
 
 private:
   friend class DecoderFactory;
 

--- a/image/encoders/bmp/nsBMPEncoder.h
+++ b/image/encoders/bmp/nsBMPEncoder.h
@@ -98,30 +98,30 @@ protected:
 
   enum Version
   {
       VERSION_3 = 3,
       VERSION_5 = 5
   };
 
   // See InitData in the cpp for valid parse options
-  nsresult ParseOptions(const nsAString& aOptions, Version& aVersionOut,
+  MOZ_MUST_USE nsresult ParseOptions(const nsAString& aOptions, Version& aVersionOut,
                         uint16_t& aBppOut);
   // Obtains data with no alpha in machine-independent byte order
   void ConvertHostARGBRow(const uint8_t* aSrc,
                           const mozilla::UniquePtr<uint8_t[]>& aDest,
                           uint32_t aPixelWidth);
   // Thread safe notify listener
   void NotifyListener();
 
   // Initializes the bitmap file header member mBMPFileHeader
-  nsresult InitFileHeader(Version aVersion, uint16_t aBPP, uint32_t aWidth,
+  MOZ_MUST_USE nsresult InitFileHeader(Version aVersion, uint16_t aBPP, uint32_t aWidth,
                           uint32_t aHeight);
   // Initializes the bitmap info header member mBMPInfoHeader
-  nsresult InitInfoHeader(Version aVersion, uint16_t aBPP, uint32_t aWidth,
+  MOZ_MUST_USE nsresult InitInfoHeader(Version aVersion, uint16_t aBPP, uint32_t aWidth,
                           uint32_t aHeight);
 
   // Encodes the bitmap file header member mBMPFileHeader
   void EncodeFileHeader();
   // Encodes the bitmap info header member mBMPInfoHeader
   void EncodeInfoHeader();
   // Encodes a row of image data which does not have alpha data
   void EncodeImageDataRow24(const uint8_t* aData);

--- a/image/imgFrame.h
+++ b/image/imgFrame.h
@@ -102,24 +102,24 @@ public:
   /**
    * Initialize this imgFrame with an empty surface and prepare it for being
    * written to by a decoder.
    *
    * This is appropriate for use with decoded images, but it should not be used
    * when drawing content into an imgFrame, as it may use a different graphics
    * backend than normal content drawing.
    */
-  nsresult InitForDecoder(const nsIntSize& aImageSize,
+  MOZ_MUST_USE nsresult InitForDecoder(const nsIntSize& aImageSize,
                           const nsIntRect& aRect,
                           SurfaceFormat aFormat,
                           uint8_t aPaletteDepth = 0,
                           bool aNonPremult = false,
                           bool aIsAnimated = false);
 
-  nsresult InitForAnimator(const nsIntSize& aSize,
+  MOZ_MUST_USE nsresult InitForAnimator(const nsIntSize& aSize,
                            SurfaceFormat aFormat)
   {
     return InitForDecoder(aSize, nsIntRect(0, 0, aSize.width, aSize.height),
                           aFormat, 0, false, true);
   }
 
 
   /**
@@ -130,17 +130,17 @@ public:
    * uses the same graphics backend as normal content drawing. The downside is
    * that the underlying surface may not be stored in a volatile buffer on all
    * platforms, and raw access to the surface (using RawAccessRef()) may be much
    * more expensive than in the InitForDecoder() case.
    *
    * aBackend specifies the DrawTarget backend type this imgFrame is supposed
    *          to be drawn to.
    */
-  nsresult InitWithDrawable(gfxDrawable* aDrawable,
+  MOZ_MUST_USE nsresult InitWithDrawable(gfxDrawable* aDrawable,
                             const nsIntSize& aSize,
                             const SurfaceFormat aFormat,
                             SamplingFilter aSamplingFilter,
                             uint32_t aImageFlags,
                             gfx::BackendType aBackend);
 
   DrawableFrameRef DrawableRef();
   RawAccessFrameRef RawAccessRef();
@@ -152,17 +152,17 @@ public:
    * prevents this imgFrame from being optimized and makes it impossible for its
    * volatile buffer to be freed.
    *
    * It is an error to call this without already holding a RawAccessFrameRef to
    * this imgFrame.
    */
   void SetRawAccessOnly();
 
-  bool Draw(gfxContext* aContext, const ImageRegion& aRegion,
+  MOZ_MUST_USE bool Draw(gfxContext* aContext, const ImageRegion& aRegion,
             SamplingFilter aSamplingFilter, uint32_t aImageFlags,
             float aOpacity);
 
   nsresult ImageUpdated(const nsIntRect& aUpdateRect);
 
   /**
    * Mark this imgFrame as completely decoded, and set final options.
    *

--- a/image/imgIContainer.idl
+++ b/image/imgIContainer.idl
@@ -254,17 +254,17 @@ interface imgIContainer : nsISupports
    * will be a perfect match. (Some reasons you may get a surface of a different
    * size include: if you requested upscaling, if downscale-during-decode is
    * disabled, or if you didn't request the first frame.)
    *
    * @param aSize The desired size.
    * @param aWhichFrame Frame specifier of the FRAME_* variety.
    * @param aFlags Flags of the FLAG_* variety
    */
-  [noscript, notxpcom] TempRefSourceSurface getFrameAtSize([const] in nsIntSize aSize,
+  [noscript, notxpcom, must_use] TempRefSourceSurface getFrameAtSize([const] in nsIntSize aSize,
                                                            in uint32_t aWhichFrame,
                                                            in uint32_t aFlags);
 
   /**
    * Returns true if this image will draw opaquely right now if asked to draw
    * with FLAG_HIGH_QUALITY_SCALING and otherwise default flags. If this image
    * (when decoded) is opaque but no decoded frames are available then
    * willDrawOpaqueNow will return false.
@@ -287,25 +287,25 @@ interface imgIContainer : nsISupports
    * @param aManager The LayerManager which will be used to create the
    *                 ImageContainer.
    * @param aFlags Decoding / drawing flags (in other words, FLAG_* flags).
    *               Currently only FLAG_SYNC_DECODE and FLAG_SYNC_DECODE_IF_FAST
    *               are supported.
    * @return An ImageContainer for the current frame, or nullptr if one could
    *         not be created.
    */
-  [noscript, notxpcom] TempRefImageContainer getImageContainer(in LayerManager aManager,
+  [noscript, notxpcom, must_use] TempRefImageContainer getImageContainer(in LayerManager aManager,
                                                                in uint32_t aFlags);
 
   /**
    * @return true if getImageContainer() is expected to return a valid
    *         ImageContainer when passed the given @Manager, @Size and @Flags
    *         parameters.
    */
-  [noscript, notxpcom] boolean isImageContainerAvailableAtSize(in LayerManager aManager,
+  [noscript, notxpcom, must_use] boolean isImageContainerAvailableAtSize(in LayerManager aManager,
                                                                [const] in nsIntSize aSize,
                                                                in uint32_t aFlags);
 
   /**
    * Attempts to create an ImageContainer (and Image) containing the current
    * frame at the given size. Match the requested size is best effort; it's
    * not guaranteed that the surface you get will be a perfect match. (Some
    * reasons you may get a surface of a different size include: if you
@@ -320,17 +320,17 @@ interface imgIContainer : nsISupports
    *                    node, and the size of the viewport that the full image
    *                    would occupy. Ignored for raster images.
    * @param aFlags Decoding / drawing flags (in other words, FLAG_* flags).
    *               Currently only FLAG_SYNC_DECODE and FLAG_SYNC_DECODE_IF_FAST
    *               are supported.
    * @return An ImageContainer for the current frame, or nullptr if one could
    *         not be created.
    */
-  [noscript, notxpcom] TempRefImageContainer getImageContainerAtSize(in LayerManager aManager,
+  [noscript, notxpcom, must_use] TempRefImageContainer getImageContainerAtSize(in LayerManager aManager,
                                                                      [const] in nsIntSize aSize,
                                                                      [const] in MaybeSVGImageContext aSVGContext,
                                                                      in uint32_t aFlags);
 
   /**
    * Draw the requested frame of this image onto the context specified.
    *
    * Drawing an image involves scaling it to a certain size (which may be
@@ -430,17 +430,17 @@ interface imgIContainer : nsISupports
    * @param aSVGContext If specified, SVG-related rendering context, such as
    *                    overridden attributes on the image document's root <svg>
    *                    node, and the size of the viewport that the full image
    *                    would occupy. Ignored for raster images.
    * @param aFlags Flags of the FLAG_* variety
    * @return A DrawResult value indicating whether and to what degree the
    *         drawing operation was successful.
    */
-  [noscript, notxpcom] DrawResult
+  [noscript, notxpcom, must_use] DrawResult
   draw(in gfxContext aContext,
        [const] in nsIntSize aSize,
        [const] in ImageRegion aRegion,
        in uint32_t aWhichFrame,
        in SamplingFilter aSamplingFilter,
        [const] in MaybeSVGImageContext aSVGContext,
        in uint32_t aFlags,
        in float aOpacity);
@@ -458,17 +458,17 @@ interface imgIContainer : nsISupports
 
   /*
    * Exactly like startDecoding above except returns whether the current frame
    * of the image is complete or not.
    *
    * @param aFlags Flags of the FLAG_* variety. Only FLAG_ASYNC_NOTIFY
    *               is accepted; all others are ignored.
    */
-  [noscript, notxpcom] boolean startDecodingWithResult(in uint32_t aFlags);
+  [noscript, notxpcom, must_use] boolean startDecodingWithResult(in uint32_t aFlags);
 
   /*
    * This method triggers decoding for an image, but unlike startDecoding() it
    * enables the caller to provide more detailed information about the decode
    * request.
    *
    * @param aSize The size to which the image should be scaled while decoding,
    *              if possible. If the image cannot be scaled to this size while
@@ -537,17 +537,17 @@ interface imgIContainer : nsISupports
    * The units of the index aren't specified, and may vary between different
    * types of images. What you can rely on is that on all occasions when
    * getFrameIndex(FRAME_CURRENT) returns a certain value,
    * draw(..FRAME_CURRENT..) will draw the same frame. The same holds for
    * FRAME_FIRST as well.
    *
    * @param aWhichFrame Frame specifier of the FRAME_* variety.
    */
-  [notxpcom] float getFrameIndex(in uint32_t aWhichFrame);
+  [notxpcom, must_use] float getFrameIndex(in uint32_t aWhichFrame);
 
   /*
    * Returns the inherent orientation of the image, as described in the image's
    * metadata (e.g. EXIF).
    */
   [notxpcom] Orientation getOrientation();
 
   /*
@@ -576,17 +576,17 @@ interface imgIContainer : nsISupports
   /*
    * Given an invalidation rect in the coordinate system used by the decoder,
    * returns an invalidation rect in image space.
    *
    * This is the identity transformation in most cases, but the result can
    * differ if the image is wrapped by an ImageWrapper that changes its size
    * or orientation.
    */
-  [notxpcom] nsIntRectByVal
+  [notxpcom, must_use] nsIntRectByVal
   getImageSpaceInvalidationRect([const] in nsIntRect aRect);
 
   /*
    * Removes any ImageWrappers and returns the unwrapped base image.
    */
   [notxpcom, nostdcall] TempRefImgIContainer unwrap();
 
   /*

--- a/image/imgIRequest.idl
+++ b/image/imgIRequest.idl
@@ -154,17 +154,17 @@ interface imgIRequest : nsIRequest
    * if it does not yet exist.
    */
   void startDecoding(in uint32_t aFlags);
 
   /**
    * Exactly like startDecoding above except returns whether the current frame
    * of the image is complete or not.
    */
-  [noscript, notxpcom] boolean startDecodingWithResult(in uint32_t aFlags);
+  [noscript, notxpcom, must_use] boolean startDecodingWithResult(in uint32_t aFlags);
 
   /**
    * Locks an image. If the image does not exist yet, locks it once it becomes
    * available. The lock persists for the lifetime of the imgIRequest (until
    * unlockImage is called) even if the underlying image changes.
    *
    * If you don't call unlockImage() by the time this imgIRequest goes away, it
    * will be called for you automatically.

--- a/image/imgLoader.h
+++ b/image/imgLoader.h
@@ -336,37 +336,37 @@ public:
   static void ShutdownMemoryReporter();
 
   nsresult ClearChromeImageCache();
   nsresult ClearImageCache();
   void MinimizeCaches();
 
   nsresult InitCache();
 
-  bool RemoveFromCache(const ImageCacheKey& aKey);
+  MOZ_MUST_USE bool RemoveFromCache(const ImageCacheKey& aKey);
 
   // Enumeration describing if a given entry is in the cache queue or not.
   // There are some cases we know the entry is definitely not in the queue.
   enum class QueueState {
     MaybeExists,
     AlreadyRemoved
   };
 
-  bool RemoveFromCache(imgCacheEntry* entry,
+  MOZ_MUST_USE bool RemoveFromCache(imgCacheEntry* entry,
                        QueueState aQueueState = QueueState::MaybeExists);
 
   bool PutIntoCache(const ImageCacheKey& aKey, imgCacheEntry* aEntry);
 
   void AddToUncachedImages(imgRequest* aRequest);
   void RemoveFromUncachedImages(imgRequest* aRequest);
 
   // Returns true if we should prefer evicting cache entry |two| over cache
   // entry |one|.
   // This mixes units in the worst way, but provides reasonable results.
-  inline static bool CompareCacheEntries(const RefPtr<imgCacheEntry>& one,
+  MOZ_MUST_USE inline static bool CompareCacheEntries(const RefPtr<imgCacheEntry>& one,
                                          const RefPtr<imgCacheEntry>& two)
   {
     if (!one) {
       return false;
     }
     if (!two) {
       return true;
     }
@@ -399,54 +399,54 @@ public:
   // observers is re-requested.
   bool SetHasNoProxies(imgRequest* aRequest, imgCacheEntry* aEntry);
   bool SetHasProxies(imgRequest* aRequest);
 
 private: // methods
 
   static already_AddRefed<imgLoader> CreateImageLoader();
 
-  bool ValidateEntry(imgCacheEntry* aEntry, nsIURI* aKey,
+  MOZ_MUST_USE bool ValidateEntry(imgCacheEntry* aEntry, nsIURI* aKey,
                      nsIURI* aInitialDocumentURI, nsIURI* aReferrerURI,
                      ReferrerPolicy aReferrerPolicy,
                      nsILoadGroup* aLoadGroup,
                      imgINotificationObserver* aObserver, nsISupports* aCX,
                      nsIDocument* aLoadingDocument,
                      nsLoadFlags aLoadFlags,
                      nsContentPolicyType aContentPolicyType,
                      bool aCanMakeNewChannel,
                      imgRequestProxy** aProxyRequest,
                      nsIPrincipal* aLoadingPrincipal,
                      int32_t aCORSMode);
 
-  bool ValidateRequestWithNewChannel(imgRequest* request, nsIURI* aURI,
+  MOZ_MUST_USE bool ValidateRequestWithNewChannel(imgRequest* request, nsIURI* aURI,
                                      nsIURI* aInitialDocumentURI,
                                      nsIURI* aReferrerURI,
                                      ReferrerPolicy aReferrerPolicy,
                                      nsILoadGroup* aLoadGroup,
                                      imgINotificationObserver* aObserver,
                                      nsISupports* aCX,
                                      nsIDocument* aLoadingDocument,
                                      nsLoadFlags aLoadFlags,
                                      nsContentPolicyType aContentPolicyType,
                                      imgRequestProxy** aProxyRequest,
                                      nsIPrincipal* aLoadingPrincipal,
                                      int32_t aCORSMode);
 
-  nsresult CreateNewProxyForRequest(imgRequest* aRequest,
+  MOZ_MUST_USE nsresult CreateNewProxyForRequest(imgRequest* aRequest,
                                     nsILoadGroup* aLoadGroup,
                                     nsIDocument* aLoadingDocument,
                                     imgINotificationObserver* aObserver,
                                     nsLoadFlags aLoadFlags,
                                     imgRequestProxy** _retval);
 
   void ReadAcceptHeaderPref();
 
-  nsresult EvictEntries(imgCacheTable& aCacheToClear);
-  nsresult EvictEntries(imgCacheQueue& aQueueToClear);
+  MOZ_MUST_USE nsresult EvictEntries(imgCacheTable& aCacheToClear);
+  MOZ_MUST_USE nsresult EvictEntries(imgCacheQueue& aQueueToClear);
 
   imgCacheTable& GetCache(bool aForChrome);
   imgCacheTable& GetCache(const ImageCacheKey& aKey);
   imgCacheQueue& GetCacheQueue(bool aForChrome);
   imgCacheQueue& GetCacheQueue(const ImageCacheKey& aKey);
   void CacheEntriesChanged(bool aForChrome, int32_t aSizeDiff = 0);
   void CheckCacheLimits(imgCacheTable& cache, imgCacheQueue& queue);
 

--- a/image/imgRequest.h
+++ b/image/imgRequest.h
@@ -106,17 +106,17 @@ public:
   // If this function is called multiple times, the information set earliest
   // wins.
   static void SetCacheValidation(imgCacheEntry* aEntry, nsIRequest* aRequest);
 
   // Check if application cache of the original load is different from
   // application cache of the new load.  Also lack of application cache
   // on one of the loads is considered a change of a loading cache since
   // HTTP cache may contain a different data then app cache.
-  bool CacheChanged(nsIRequest* aNewRequest);
+  MOZ_MUST_USE bool CacheChanged(nsIRequest* aNewRequest);
 
   bool GetMultipart() const;
 
   // Returns whether we went through an insecure (non-HTTPS) redirect at some
   // point during loading. This does not consider the final URI.
   bool HadInsecureRedirect() const;
 
   // The CORS mode for which we loaded this image.

--- a/image/imgRequestProxy.h
+++ b/image/imgRequestProxy.h
@@ -125,26 +125,26 @@ public:
   already_AddRefed<nsIEventTarget> GetEventTarget() const override;
 
   // Removes all animation consumers that were created with
   // IncrementAnimationConsumers. This is necessary since we need
   // to do it before the proxy itself is destroyed. See
   // imgRequest::RemoveProxy
   void ClearAnimationConsumers();
 
-  nsresult SyncClone(imgINotificationObserver* aObserver,
+  MOZ_MUST_USE nsresult SyncClone(imgINotificationObserver* aObserver,
                      nsIDocument* aLoadingDocument,
                      imgRequestProxy** aClone);
-  nsresult Clone(imgINotificationObserver* aObserver,
+  MOZ_MUST_USE nsresult Clone(imgINotificationObserver* aObserver,
                  nsIDocument* aLoadingDocument,
                  imgRequestProxy** aClone);
-  nsresult GetStaticRequest(nsIDocument* aLoadingDocument,
+  MOZ_MUST_USE nsresult GetStaticRequest(nsIDocument* aLoadingDocument,
                             imgRequestProxy** aReturn);
 
-  nsresult GetURI(ImageURL** aURI);
+  MOZ_MUST_USE nsresult GetURI(ImageURL** aURI);
 
 protected:
   friend class mozilla::image::ProgressTracker;
   friend class imgStatusNotifyRunnable;
 
   class imgCancelRunnable;
   friend class imgCancelRunnable;
 
@@ -190,17 +190,17 @@ protected:
     }
     return GetOwner()->GetTimedChannel();
   }
 
   already_AddRefed<Image> GetImage() const;
   bool HasImage() const;
   imgRequest* GetOwner() const;
 
-  nsresult PerformClone(imgINotificationObserver* aObserver,
+  MOZ_MUST_USE nsresult PerformClone(imgINotificationObserver* aObserver,
                         nsIDocument* aLoadingDocument,
                         bool aSyncNotify,
                         imgRequestProxy** aClone);
 
   virtual imgRequestProxy* NewClonedProxy();
 
 public:
   NS_FORWARD_SAFE_NSITIMEDCHANNEL(TimedChannel())

--- a/image/test/gtest/TestDecoders.cpp
+++ b/image/test/gtest/TestDecoders.cpp
@@ -100,17 +100,18 @@ void WithSingleChunkDecode(const ImageTe
 
   // Figure out how much data we have.
   uint64_t length;
   nsresult rv = inputStream->Available(&length);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
 
   // Write the data into a SourceBuffer.
   auto sourceBuffer = MakeNotNull<RefPtr<SourceBuffer>>();
-  sourceBuffer->ExpectLength(length);
+  rv = sourceBuffer->ExpectLength(length);
+  ASSERT_TRUE(NS_SUCCEEDED(rv));
   rv = sourceBuffer->AppendFromInputStream(inputStream, length);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
   sourceBuffer->Complete(NS_OK);
 
   // Create a decoder.
   DecoderType decoderType =
     DecoderFactory::GetDecoderType(aTestCase.mMimeType);
   RefPtr<Decoder> decoder =
@@ -142,17 +143,18 @@ CheckDecoderMultiChunk(const ImageTestCa
 
   // Figure out how much data we have.
   uint64_t length;
   nsresult rv = inputStream->Available(&length);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
 
   // Create a SourceBuffer and a decoder.
   auto sourceBuffer = MakeNotNull<RefPtr<SourceBuffer>>();
-  sourceBuffer->ExpectLength(length);
+  rv = sourceBuffer->ExpectLength(length);
+  ASSERT_TRUE(NS_SUCCEEDED(rv));
   DecoderType decoderType =
     DecoderFactory::GetDecoderType(aTestCase.mMimeType);
   RefPtr<Decoder> decoder =
     DecoderFactory::CreateAnonymousDecoder(decoderType, sourceBuffer, Nothing(),
                                            DefaultSurfaceFlags());
   ASSERT_TRUE(decoder != nullptr);
   RefPtr<IDecodingTask> task = new AnonymousDecodingTask(WrapNotNull(decoder));
 

--- a/image/test/gtest/TestMetadata.cpp
+++ b/image/test/gtest/TestMetadata.cpp
@@ -44,17 +44,18 @@ CheckMetadata(const ImageTestCase& aTest
 
   // Figure out how much data we have.
   uint64_t length;
   nsresult rv = inputStream->Available(&length);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
 
   // Write the data into a SourceBuffer.
   auto sourceBuffer = MakeNotNull<RefPtr<SourceBuffer>>();
-  sourceBuffer->ExpectLength(length);
+  rv = sourceBuffer->ExpectLength(length);
+  ASSERT_TRUE(NS_SUCCEEDED(rv));
   rv = sourceBuffer->AppendFromInputStream(inputStream, length);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
   sourceBuffer->Complete(NS_OK);
 
   // Create a metadata decoder.
   DecoderType decoderType =
     DecoderFactory::GetDecoderType(aTestCase.mMimeType);
   RefPtr<Decoder> decoder =