Image cache isolation causes assert crash in debug builds (and other cases?)

Turns out that the patch in #5742 (closed) crashes in debug builds at VerifyCacheSizes() in imgLoader.cpp:1613.

There might also be a crash on certain XUL dialog types that contain chrome images/icons. In non-debug builds I get a refcount issue when pointing my new Firefox build at an old profile, or when running it with -P -no-remote.. Could be the fact that I re-use the same nsIURI pointer for two arguments in the XUL icon codepath, or could be something else.