Ooops. Be sure to call Flush() _before_ freeing the mURLSpec.

rdf/base/src/nsRDFXMLDataSource.cpp

@@ -473,10 +473,10 @@ RDFXMLDataSourceImpl::~RDFXMLDataSourceImpl(void)
         rdf->UnregisterDataSource(this);
     }
 
-    if (mURLSpec) PL_strfree(mURLSpec);
-
     Flush();
 
+    if (mURLSpec) PL_strfree(mURLSpec);
+
     while (mNameSpaces) {
         NameSpaceMap* doomed = mNameSpaces;
         mNameSpaces = mNameSpaces->Next;