From f7ad359b142a96cfa4a966e22c298e4187112c81 Mon Sep 17 00:00:00 2001
From: "nelson%bolyard.com" <nelson%bolyard.com>
Date: Sun, 27 Apr 2008 02:13:52 +0000
Subject: [PATCH] Bug 391903: nssSlot object for nssckbi leaked when loaded by
 PSM. r=rrelyea

---
 security/nss/lib/dev/devtoken.c    | 6 +++++-
 security/nss/lib/pki/trustdomain.c | 8 +++++---
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/security/nss/lib/dev/devtoken.c b/security/nss/lib/dev/devtoken.c
index 4891133baae..3899a8d72c2 100644
--- a/security/nss/lib/dev/devtoken.c
+++ b/security/nss/lib/dev/devtoken.c
@@ -35,7 +35,7 @@
  * ***** END LICENSE BLOCK ***** */
 
 #ifdef DEBUG
-static const char CVS_ID[] = "@(#) $RCSfile: devtoken.c,v $ $Revision: 1.45 $ $Date: 2008-04-23 16:37:19 $";
+static const char CVS_ID[] = "@(#) $RCSfile: devtoken.c,v $ $Revision: 1.46 $ $Date: 2008-04-27 02:13:52 $";
 #endif /* DEBUG */
 
 #ifndef NSSCKEPV_H
@@ -70,6 +70,10 @@ nssToken_Destroy (
 	if (PR_AtomicDecrement(&tok->base.refCount) == 0) {
 	    PZ_DestroyLock(tok->base.lock);
 	    nssTokenObjectCache_Destroy(tok->cache);
+	    /* The token holds the first/last reference to the slot.
+	     * When the token is actually destroyed, that ref must go too.
+	     */
+	    (void)nssSlot_Destroy(tok->slot);
 	    return nssArena_Destroy(tok->base.arena);
 	}
     }
diff --git a/security/nss/lib/pki/trustdomain.c b/security/nss/lib/pki/trustdomain.c
index d56a90adc22..7c3993bdadf 100644
--- a/security/nss/lib/pki/trustdomain.c
+++ b/security/nss/lib/pki/trustdomain.c
@@ -35,7 +35,7 @@
  * ***** END LICENSE BLOCK ***** */
 
 #ifdef DEBUG
-static const char CVS_ID[] = "@(#) $RCSfile: trustdomain.c,v $ $Revision: 1.56 $ $Date: 2007-11-16 18:57:54 $";
+static const char CVS_ID[] = "@(#) $RCSfile: trustdomain.c,v $ $Revision: 1.57 $ $Date: 2008-04-27 02:13:47 $";
 #endif /* DEBUG */
 
 #ifndef DEV_H
@@ -101,8 +101,10 @@ static void
 token_destructor(void *t)
 {
     NSSToken *tok = (NSSToken *)t;
-    /* in 3.4, also destroy the slot (managed separately) */
-    (void)nssSlot_Destroy(tok->slot);
+    /* The token holds the first/last reference to the slot.
+     * When the token is actually destroyed (ref count == 0), 
+     * the slot will also be destroyed.
+     */
     nssToken_Destroy(tok);
 }