diff --git a/image/DecodePool.h b/image/DecodePool.h
index 3ce1bf943017..f324131d92c8 100644
--- a/image/DecodePool.h
+++ b/image/DecodePool.h
@@ -98,8 +98,8 @@ class DecodePool final : public nsIObserver {
   bool mShuttingDown = false;
 
   // mMutex protects mIOThread.
-  Mutex mMutex MOZ_UNANNOTATED;
-  nsCOMPtr<nsIThread> mIOThread;
+  Mutex mMutex;
+  nsCOMPtr<nsIThread> mIOThread GUARDED_BY(mMutex);
 };
 
 }  // namespace image
diff --git a/image/imgFrame.h b/image/imgFrame.h
index 4ecb9e0d7299..242ccebb1af9 100644
--- a/image/imgFrame.h
+++ b/image/imgFrame.h
@@ -180,7 +180,7 @@ class imgFrame {
  private:  // methods
   ~imgFrame();
 
-  bool AreAllPixelsWritten() const;
+  bool AreAllPixelsWritten() const REQUIRES(mMonitor);
   nsresult ImageUpdatedInternal(const nsIntRect& aUpdateRect);
   void GetImageDataInternal(uint8_t** aData, uint32_t* length) const;
   uint32_t GetImageBytesPerRow() const;
@@ -219,25 +219,25 @@ class imgFrame {
   // Thread-safe mutable data, protected by mMonitor.
   //////////////////////////////////////////////////////////////////////////////
 
-  mutable Monitor mMonitor MOZ_UNANNOTATED;
+  mutable Monitor mMonitor;
 
   /**
    * Used for rasterized images, this contains the raw pixel data.
    */
-  RefPtr<SourceSurfaceSharedData> mRawSurface;
-  RefPtr<SourceSurfaceSharedData> mBlankRawSurface;
+  RefPtr<SourceSurfaceSharedData> mRawSurface GUARDED_BY(mMonitor);
+  RefPtr<SourceSurfaceSharedData> mBlankRawSurface GUARDED_BY(mMonitor);
 
   /**
    * Used for vector images that were not rasterized directly. This might be a
    * blob recording or native surface.
    */
-  RefPtr<SourceSurface> mOptSurface;
+  RefPtr<SourceSurface> mOptSurface GUARDED_BY(mMonitor);
 
-  nsIntRect mDecoded;
+  nsIntRect mDecoded GUARDED_BY(mMonitor);
 
-  bool mAborted;
-  bool mFinished;
-  bool mShouldRecycle;
+  bool mAborted GUARDED_BY(mMonitor);
+  bool mFinished GUARDED_BY(mMonitor);
+  bool mShouldRecycle GUARDED_BY(mMonitor);
 
   //////////////////////////////////////////////////////////////////////////////
   // Effectively const data, only mutated in the Init methods.
diff --git a/image/imgLoader.h b/image/imgLoader.h
index 9b3515a9066a..e55442df6ce4 100644
--- a/image/imgLoader.h
+++ b/image/imgLoader.h
@@ -413,11 +413,11 @@ class imgLoader final : public imgILoader,
   // mChromeCache. The union over all imgLoader's of mCache, mChromeCache, and
   // mUncachedImages should be every imgRequest that is alive. These are weak
   // pointers so we rely on the imgRequest destructor to remove itself.
-  imgSet mUncachedImages;
+  imgSet mUncachedImages GUARDED_BY(mUncachedImagesMutex);
   // The imgRequest can have refs to them held on non-main thread, so we need
   // a mutex because we modify the uncached images set from the imgRequest
   // destructor.
-  Mutex mUncachedImagesMutex MOZ_UNANNOTATED;
+  Mutex mUncachedImagesMutex;
 
   static double sCacheTimeWeight;
   static uint32_t sCacheMaxSize;
diff --git a/image/imgRequest.cpp b/image/imgRequest.cpp
index f4750b5dab66..e63533618fe8 100644
--- a/image/imgRequest.cpp
+++ b/image/imgRequest.cpp
@@ -68,7 +68,8 @@ imgRequest::imgRequest(imgLoader* aLoader, const ImageCacheKey& aCacheKey)
       mIsInCache(false),
       mDecodeRequested(false),
       mNewPartPending(false),
-      mHadInsecureRedirect(false) {
+      mHadInsecureRedirect(false),
+      mInnerWindowId(0) {
   LOG_FUNC(gImgLog, "imgRequest::imgRequest()");
 }
 
@@ -82,13 +83,12 @@ imgRequest::~imgRequest() {
     LOG_FUNC(gImgLog, "imgRequest::~imgRequest()");
 }
 
-nsresult imgRequest::Init(nsIURI* aURI, nsIURI* aFinalURI,
-                          bool aHadInsecureRedirect, nsIRequest* aRequest,
-                          nsIChannel* aChannel, imgCacheEntry* aCacheEntry,
-                          mozilla::dom::Document* aLoadingDocument,
-                          nsIPrincipal* aTriggeringPrincipal,
-                          mozilla::CORSMode aCORSMode,
-                          nsIReferrerInfo* aReferrerInfo) {
+nsresult imgRequest::Init(
+    nsIURI* aURI, nsIURI* aFinalURI, bool aHadInsecureRedirect,
+    nsIRequest* aRequest, nsIChannel* aChannel, imgCacheEntry* aCacheEntry,
+    mozilla::dom::Document* aLoadingDocument,
+    nsIPrincipal* aTriggeringPrincipal, mozilla::CORSMode aCORSMode,
+    nsIReferrerInfo* aReferrerInfo) NO_THREAD_SAFETY_ANALYSIS {
   MOZ_ASSERT(NS_IsMainThread(), "Cannot use nsIURI off main thread!");
   // Init() can only be called once, and that's before it can be used off
   // mainthread
diff --git a/image/imgRequest.h b/image/imgRequest.h
index e3ac3cb84b9f..2fd5ba1fbb39 100644
--- a/image/imgRequest.h
+++ b/image/imgRequest.h
@@ -278,20 +278,20 @@ class imgRequest final : public nsIStreamListener,
   bool mIsDeniedCrossSiteCORSRequest;
   bool mIsCrossSiteNoCORSRequest;
 
-  mutable mozilla::Mutex mMutex MOZ_UNANNOTATED;
+  mutable mozilla::Mutex mMutex;
 
   // Member variables protected by mMutex. Note that *all* flags in our bitfield
   // are protected by mMutex; if you're adding a new flag that isn'protected, it
   // must not be a part of this bitfield.
-  RefPtr<ProgressTracker> mProgressTracker;
-  RefPtr<Image> mImage;
-  // The ID of the inner window origin, used for error reporting, profiles.
-  uint64_t mInnerWindowId;
-  bool mIsMultiPartChannel : 1;
-  bool mIsInCache : 1;
-  bool mDecodeRequested : 1;
-  bool mNewPartPending : 1;
-  bool mHadInsecureRedirect : 1;
+  RefPtr<ProgressTracker> mProgressTracker GUARDED_BY(mMutex);
+  RefPtr<Image> mImage GUARDED_BY(mMutex);
+  bool mIsMultiPartChannel : 1 GUARDED_BY(mMutex);
+  bool mIsInCache : 1 GUARDED_BY(mMutex);
+  bool mDecodeRequested : 1 GUARDED_BY(mMutex);
+  bool mNewPartPending : 1 GUARDED_BY(mMutex);
+  bool mHadInsecureRedirect : 1 GUARDED_BY(mMutex);
+  // The ID of the inner window origin, used for error reporting.
+  uint64_t mInnerWindowId GUARDED_BY(mMutex);
 };
 
 #endif  // mozilla_image_imgRequest_h