Hint: the referenceCount change doesn't really fix a leak since we also freed the CRL when referenceCount=-1, just wanted to fix it when I came across.

Comment on attachment 8767696 [details] [diff] [review] 0001-Bug-1284272-Enable-Chains-tests-on-LSan-runs.patch Review of attachment 8767696 [details] [diff] [review]: ----------------------------------------------------------------- lsan didn't complain about other paths in tstclnt? r+ with those fixed as well. ::: cmd/tstclnt/tstclnt.c @@ +1238,5 @@ > if (pingTimeoutSeconds >= 0) { > /* If caller requested a timeout, let's try just twice. */ > max_attempts = 2; > } > + PORT_Free(host); I see more returns in here that don't free host. We should probably change them to goto done.

(In reply to Franziskus Kiefer [:fkiefer or :franziskus] from comment #2) > lsan didn't complain about other paths in tstclnt? r+ with those fixed as > well. Yeah, if we don't cover a path LSan can't detect that. Coverity or scan-build could, maybe. > ::: cmd/tstclnt/tstclnt.c > @@ +1238,5 @@ > > if (pingTimeoutSeconds >= 0) { > > /* If caller requested a timeout, let's try just twice. */ > > max_attempts = 2; > > } > > + PORT_Free(host); > > I see more returns in here that don't free host. We should probably change > them to goto done. Good call, I replaced them with "goto done". Attached is a diff on top of the previous patch, I'll merge both.

https://hg.mozilla.org/projects/nss/rev/97a6fc5db60e