diff --git a/mozilla/security/nss/lib/ckfw/instance.c b/mozilla/security/nss/lib/ckfw/instance.c
index 91b07527e94..7d9a34e9727 100644
--- a/mozilla/security/nss/lib/ckfw/instance.c
+++ b/mozilla/security/nss/lib/ckfw/instance.c
@@ -32,7 +32,7 @@
  */
 
 #ifdef DEBUG
-static const char CVS_ID[] = "@(#) $RCSfile: instance.c,v $ $Revision: 1.6 $ $Date: 2002-08-27 23:29:36 $ $Name: not supported by cvs2svn $";
+static const char CVS_ID[] = "@(#) $RCSfile: instance.c,v $ $Revision: 1.7 $ $Date: 2002-10-10 22:39:22 $ $Name: not supported by cvs2svn $";
 #endif /* DEBUG */
 
 /*
@@ -394,6 +394,14 @@ nssCKFWInstance_Destroy
     fwInstance->mdInstance->Finalize(fwInstance->mdInstance, fwInstance);
   }
 
+  if (fwInstance->sessionHandleHash) {
+     nssCKFWHash_Destroy(fwInstance->sessionHandleHash);
+  }
+
+  if (fwInstance->objectHandleHash) {
+     nssCKFWHash_Destroy(fwInstance->objectHandleHash);
+  }
+
 #ifdef DEBUG
   (void)instance_remove_pointer(fwInstance);
 #endif /* DEBUG */
diff --git a/mozilla/security/nss/lib/ckfw/slot.c b/mozilla/security/nss/lib/ckfw/slot.c
index be616ad427f..cffb89a1678 100644
--- a/mozilla/security/nss/lib/ckfw/slot.c
+++ b/mozilla/security/nss/lib/ckfw/slot.c
@@ -32,7 +32,7 @@
  */
 
 #ifdef DEBUG
-static const char CVS_ID[] = "@(#) $RCSfile: slot.c,v $ $Revision: 1.3 $ $Date: 2000-09-06 22:23:57 $ $Name: not supported by cvs2svn $";
+static const char CVS_ID[] = "@(#) $RCSfile: slot.c,v $ $Revision: 1.4 $ $Date: 2002-10-10 22:39:23 $ $Name: not supported by cvs2svn $";
 #endif /* DEBUG */
 
 /*
@@ -256,6 +256,9 @@ nssCKFWSlot_Destroy
     return error;
   }
 #endif /* NSSDEBUG */
+  if (fwSlot->fwToken) {
+    nssCKFWToken_Destroy(fwSlot->fwToken);
+  }
 
   (void)nssCKFWMutex_Destroy(fwSlot->mutex);
 
diff --git a/mozilla/security/nss/lib/ckfw/token.c b/mozilla/security/nss/lib/ckfw/token.c
index fb4b75162d1..beb4da4b917 100644
--- a/mozilla/security/nss/lib/ckfw/token.c
+++ b/mozilla/security/nss/lib/ckfw/token.c
@@ -32,7 +32,7 @@
  */
 
 #ifdef DEBUG
-static const char CVS_ID[] = "@(#) $RCSfile: token.c,v $ $Revision: 1.7 $ $Date: 2001-11-16 19:41:49 $ $Name: not supported by cvs2svn $";
+static const char CVS_ID[] = "@(#) $RCSfile: token.c,v $ $Revision: 1.8 $ $Date: 2002-10-10 22:39:23 $ $Name: not supported by cvs2svn $";
 #endif /* DEBUG */
 
 /*
@@ -307,6 +307,22 @@ nssCKFWToken_Create
   return (NSSCKFWToken *)NULL;
 }
 
+static void
+nss_ckfwtoken_session_iterator
+(
+  const void *key,
+  void *value,
+  void *closure
+)
+{
+  /*
+   * Remember that the fwToken->mutex is locked
+   */
+  NSSCKFWSession *fwSession = (NSSCKFWSession *)value;
+  (void)nssCKFWSession_Destroy(fwSession, CK_FALSE);
+  return;
+}
+
 /*
  * nssCKFWToken_Destroy
  *
@@ -332,6 +348,19 @@ nssCKFWToken_Destroy
     fwToken->mdToken->Invalidate(fwToken->mdToken, fwToken,
       fwToken->mdInstance, fwToken->fwInstance);
   }
+  /* we can destroy the list without locking now because no one else is 
+   * referencing us (or _Destroy was invalidly called!)
+   */
+  nssCKFWHash_Iterate(fwToken->sessions, nss_ckfwtoken_session_iterator, 
+								(void *)NULL);
+  nssCKFWHash_Destroy(fwToken->sessions);
+
+  if (fwToken->sessionObjectHash) {
+    nssCKFWHash_Destroy(fwToken->sessionObjectHash);
+  }
+  if (fwToken->mdObjectHash) {
+    nssCKFWHash_Destroy(fwToken->mdObjectHash);
+  }
 
   nssCKFWSlot_ClearToken(fwToken->fwSlot);
   
@@ -1547,21 +1576,6 @@ nssCKFWToken_RemoveSession
   return error;
 }
 
-static void
-nss_ckfwtoken_session_iterator
-(
-  const void *key,
-  void *value,
-  void *closure
-)
-{
-  /*
-   * Remember that the fwToken->mutex is locked
-   */
-  NSSCKFWSession *fwSession = (NSSCKFWSession *)value;
-  (void)nssCKFWSession_Destroy(fwSession, CK_FALSE);
-  return;
-}
 
 /*
  * nssCKFWToken_CloseAllSessions
diff --git a/mozilla/security/nss/lib/ckfw/wrap.c b/mozilla/security/nss/lib/ckfw/wrap.c
index 331a92e5069..956129a7cae 100644
--- a/mozilla/security/nss/lib/ckfw/wrap.c
+++ b/mozilla/security/nss/lib/ckfw/wrap.c
@@ -32,7 +32,7 @@
  */
 
 #ifdef DEBUG
-static const char CVS_ID[] = "@(#) $RCSfile: wrap.c,v $ $Revision: 1.7 $ $Date: 2002-09-06 00:27:33 $ $Name: not supported by cvs2svn $";
+static const char CVS_ID[] = "@(#) $RCSfile: wrap.c,v $ $Revision: 1.8 $ $Date: 2002-10-10 22:39:23 $ $Name: not supported by cvs2svn $";
 #endif /* DEBUG */
 
 /*
@@ -209,6 +209,9 @@ NSSCKFWC_Finalize
   /* In any case */
   *pFwInstance = (NSSCKFWInstance *)NULL;
 
+  /* clean up the arena pool records */
+  PL_ArenaFinish();
+
  loser:
   switch( error ) {
   case CKR_CRYPTOKI_NOT_INITIALIZED: