diff -up ./nss/lib/pki/tdcache.c.race ./nss/lib/pki/tdcache.c
--- ./nss/lib/pki/tdcache.c.race	2014-12-18 15:39:42.975354956 -0800
+++ ./nss/lib/pki/tdcache.c	2014-12-18 15:42:33.934201074 -0800
@@ -399,6 +399,8 @@ remove_token_certs(const void *k, void *
 	    object->instances[i] = object->instances[object->numInstances-1];
 	    object->instances[object->numInstances-1] = NULL;
 	    object->numInstances--;
+	    /* make sure id doesn't disappear on us before we finish */
+	    nssPKIObject_AddRef(object);
 	    dtor->certs[dtor->numCerts++] = c;
 	    if (dtor->numCerts == dtor->arrSize) {
 		dtor->arrSize *= 2;
@@ -441,13 +443,15 @@ nssTrustDomain_RemoveTokenCertsFromCache
     for (i=0; i<dtor.numCerts; i++) {
 	if (dtor.certs[i]->object.numInstances == 0) {
 	    nssTrustDomain_RemoveCertFromCacheLOCKED(td, dtor.certs[i]);
+	    nssPKIObject_Destroy(&dtor.certs[i]->object);
 	    dtor.certs[i] = NULL;  /* skip this cert in the second for loop */
-	}
+	} 
     }
     PZ_Unlock(td->cache->lock);
     for (i=0; i<dtor.numCerts; i++) {
 	if (dtor.certs[i]) {
 	    STAN_ForceCERTCertificateUpdate(dtor.certs[i]);
+	    nssPKIObject_Destroy(&dtor.certs[i]->object);
 	}
     }
     nss_ZFreeIf(dtor.certs);