--- a/image/imgLoader.cpp
+++ b/image/imgLoader.cpp
@@ -1110,26 +1110,26 @@ NS_IMPL_ISUPPORTS(imgLoader, imgILoader,
 
 static imgLoader* gSingleton = nullptr;
 static imgLoader* gPBSingleton = nullptr;
 
 imgLoader*
 imgLoader::Singleton()
 {
   if (!gSingleton) {
-    gSingleton = imgLoader::Create();
+    gSingleton = imgLoader::Create().take();
   }
   return gSingleton;
 }
 
 imgLoader*
 imgLoader::PBSingleton()
 {
   if (!gPBSingleton) {
-    gPBSingleton = imgLoader::Create();
+    gPBSingleton = imgLoader::Create().take();
     gPBSingleton->RespectPrivacyNotifications();
   }
   return gPBSingleton;
 }
 
 imgLoader::imgLoader()
 : mUncachedImagesMutex("imgLoader::UncachedImages"), mRespectPrivacy(false)
 {

--- a/image/imgLoader.h
+++ b/image/imgLoader.h
@@ -248,28 +248,28 @@ public:
 
   static imgLoader* Singleton();
   static imgLoader* PBSingleton();
 
   imgLoader();
 
   nsresult Init();
 
-  static imgLoader* Create()
+  static already_AddRefed<imgLoader>
+  Create()
   {
       // Unfortunately, we rely on XPCOM module init happening
       // before imgLoader creation. For now, it's easier
       // to just call CallCreateInstance() which will init
       // the image module instead of calling new imgLoader
       // directly.
-      imgILoader* loader;
-      CallCreateInstance("@mozilla.org/image/loader;1", &loader);
+      nsCOMPtr<imgILoader> loader = do_CreateInstance("@mozilla.org/image/loader;1");
       // There's only one imgLoader implementation so we
       // can safely cast to it.
-      return static_cast<imgLoader*>(loader);
+      return loader.forget().downcast<imgLoader>();
   }
 
   static already_AddRefed<imgLoader>
   GetInstance();
 
   nsresult LoadImage(nsIURI* aURI,
                      nsIURI* aInitialDocumentURI,
                      nsIURI* aReferrerURI,