diff --git a/mozilla/security/nss/lib/dev/devobject.c b/mozilla/security/nss/lib/dev/devobject.c
index 48311d6cd93..70f863aceb4 100644
--- a/mozilla/security/nss/lib/dev/devobject.c
+++ b/mozilla/security/nss/lib/dev/devobject.c
@@ -32,7 +32,7 @@
  */
 
 #ifdef DEBUG
-static const char CVS_ID[] = "@(#) $RCSfile: devobject.c,v $ $Revision: 1.10 $ $Date: 2002-01-08 15:37:36 $ $Name: not supported by cvs2svn $";
+static const char CVS_ID[] = "@(#) $RCSfile: devobject.c,v $ $Revision: 1.11 $ $Date: 2002-01-09 21:09:19 $ $Name: not supported by cvs2svn $";
 #endif /* DEBUG */
 
 #ifndef DEV_H
@@ -56,9 +56,9 @@ static const char CVS_ID[] = "@(#) $RCSfile: devobject.c,v $ $Revision: 1.10 $ $
 #endif /* BASE_H */
 
 /* XXX */
-#ifndef PKIT_H
-#include "pkit.h"
-#endif /* PKIT_H */
+#ifndef PKI_H
+#include "pki.h"
+#endif /* PKI_H */
 
 /* XXX */
 #ifndef NSSPKI_H
@@ -462,6 +462,7 @@ retrieve_cert(NSSToken *t, nssSession *session, CK_OBJECT_HANDLE h, void *arg)
     }
     found = PR_FALSE;
     if (cert) {
+	nssCertificate_AddRef(cert);
 	instances = cert->object.instances;
 	for (ci  = (nssCryptokiInstance *)nssListIterator_Start(instances);
 	     ci != (nssCryptokiInstance *)NULL;
diff --git a/mozilla/security/nss/lib/pk11wrap/pk11cert.c b/mozilla/security/nss/lib/pk11wrap/pk11cert.c
index 4865de08cc8..8c429bebc78 100644
--- a/mozilla/security/nss/lib/pk11wrap/pk11cert.c
+++ b/mozilla/security/nss/lib/pk11wrap/pk11cert.c
@@ -1249,8 +1249,11 @@ static PRStatus
 collect_certs(NSSCertificate *c, void *arg)
 {
     nssList *list = (nssList *)arg;
-    /* Add the cert to the return list */
-    nssList_AddUnique(list, (void *)c);
+    /* Add the cert to the return list if not present */
+    if (!nssList_Get(list, (void *)c)) {
+	nssCertificate_AddRef(c);
+	nssList_Add(list, (void *)c);
+    }
     return PR_SUCCESS;
 }
 
@@ -1327,7 +1330,6 @@ PK11_FindCertsFromNickname(char *nickname, void *wincx) {
 	count = nssList_Count(nameList);
 	foundCerts = nss_ZNEWARRAY(NULL, NSSCertificate *, count + 1);
 	nssList_GetArray(nameList, (void **)foundCerts, count);
-	nssList_Clear(nameList, cert_destructor);
 	nssList_Destroy(nameList);
     }
     if (slot) {
diff --git a/mozilla/security/nss/lib/pki/tdcache.c b/mozilla/security/nss/lib/pki/tdcache.c
index 2226590cf48..0a0edf927dd 100644
--- a/mozilla/security/nss/lib/pki/tdcache.c
+++ b/mozilla/security/nss/lib/pki/tdcache.c
@@ -32,7 +32,7 @@
  */
 
 #ifdef DEBUG
-static const char CVS_ID[] = "@(#) $RCSfile: tdcache.c,v $ $Revision: 1.18 $ $Date: 2002-01-03 20:09:24 $ $Name: not supported by cvs2svn $";
+static const char CVS_ID[] = "@(#) $RCSfile: tdcache.c,v $ $Revision: 1.19 $ $Date: 2002-01-09 21:09:21 $ $Name: not supported by cvs2svn $";
 #endif /* DEBUG */
 
 #ifndef PKIM_H
@@ -488,6 +488,7 @@ add_subject_entry
 	log_cert_ref("added to existing subject list", cert);
 #endif
     } else {
+	NSSDER *subject;
 	/* Create a new subject list for the subject */
 	list = nssList_Create(arena, PR_FALSE);
 	if (!list) {
@@ -504,7 +505,11 @@ add_subject_entry
 	    return nssrv;
 	}
 	/* Add the subject list to the cache */
-	nssrv = nssHash_Add(cache->subject, &cert->subject, ce);
+	subject = nssItem_Duplicate(&cert->subject, arena, NULL);
+	if (!subject) {
+	    return PR_FAILURE;
+	}
+	nssrv = nssHash_Add(cache->subject, subject, ce);
 	if (nssrv != PR_SUCCESS) {
 	    return nssrv;
 	}
@@ -535,11 +540,16 @@ add_nickname_entry
 	 */
 	return PR_FAILURE;
     } else {
+	NSSUTF8 *nickname;
 	ce = new_cache_entry(arena, subjectList);
 	if (!ce) {
 	    return PR_FAILURE;
 	}
-	nssrv = nssHash_Add(cache->nickname, cert->nickname, ce);
+	nickname = nssUTF8_Duplicate(cert->nickname, arena);
+	if (!nickname) {
+	    return PR_FAILURE;
+	}
+	nssrv = nssHash_Add(cache->nickname, nickname, ce);
 #ifdef DEBUG_CACHE
 	log_cert_ref("created nickname for", cert);
 #endif
@@ -570,6 +580,7 @@ add_email_entry
 	log_cert_ref("added subject to email for", cert);
 #endif
     } else {
+	NSSASCII7 *email;
 	/* Create a new list of subject lists, add this subject */
 	subjects = nssList_Create(arena, PR_TRUE);
 	if (!subjects) {
@@ -585,7 +596,11 @@ add_email_entry
 	if (!ce) {
 	    return PR_FAILURE;
 	}
-	nssrv = nssHash_Add(cache->email, &cert->email, ce);
+	email = nssUTF8_Duplicate(cert->email, arena);
+	if (!email) {
+	    return PR_FAILURE;
+	}
+	nssrv = nssHash_Add(cache->email, email, ce);
 	if (nssrv != PR_SUCCESS) {
 	    return nssrv;
 	}
@@ -714,6 +729,8 @@ nssTrustDomain_AddCertsToCache
 		if (c != certs[i]) {
 		    NSSCertificate_Destroy(certs[i]);
 		    certs[i] = c;
+		} else {
+		    NSSCertificate_Destroy(c);
 		}
 		nss_ClearErrorStack();
 		continue;
diff --git a/mozilla/security/nss/lib/pki/trustdomain.c b/mozilla/security/nss/lib/pki/trustdomain.c
index 7185e90c7f5..c7ac9cb20dd 100644
--- a/mozilla/security/nss/lib/pki/trustdomain.c
+++ b/mozilla/security/nss/lib/pki/trustdomain.c
@@ -32,7 +32,7 @@
  */
 
 #ifdef DEBUG
-static const char CVS_ID[] = "@(#) $RCSfile: trustdomain.c,v $ $Revision: 1.24 $ $Date: 2002-01-08 15:37:40 $ $Name: not supported by cvs2svn $";
+static const char CVS_ID[] = "@(#) $RCSfile: trustdomain.c,v $ $Revision: 1.25 $ $Date: 2002-01-09 21:09:21 $ $Name: not supported by cvs2svn $";
 #endif /* DEBUG */
 
 #ifndef NSSPKI_H
@@ -373,9 +373,11 @@ static PRStatus
 collect_certs(NSSCertificate *c, void *arg)
 {
     struct collect_arg_str *ca = (struct collect_arg_str *)arg;
-    /* Add the cert to the return list */
-    nssCertificate_AddRef(c);
-    nssList_AddUnique(ca->list, (void *)c);
+    /* Add the cert to the return list if not present */
+    if (!nssList_Get(ca->list, (void *)c)) {
+	nssCertificate_AddRef(c);
+	nssList_Add(ca->list, (void *)c);
+    }
     if (ca->maximum > 0 && nssList_Count(ca->list) >= ca->maximum) {
 	/* signal the end of collection) */
 	nss_SetError(NSS_ERROR_MAXIMUM_FOUND);
@@ -474,8 +476,8 @@ NSSTrustDomain_FindCertificatesByNickname
 	}
 	nssTrustDomain_AddCertsToCache(td, rvCerts, count);
     }
-    nssList_Clear(nameList, cert_destructor);
     nssList_Destroy(nameList);
+    /* The return array assumes the references from the list */
     return rvCerts;
 }
 
@@ -606,8 +608,8 @@ NSSTrustDomain_FindCertificatesBySubject
 	}
 	nssTrustDomain_AddCertsToCache(td, rvCerts, count);
     }
-    nssList_Clear(subjectList, cert_destructor);
     nssList_Destroy(subjectList);
+    /* The return array assumes the references from the list */
     return rvCerts;
 }