if (crl && (decodeoptions & CRL_DECODE_DONT_COPY_DER)) {  GetOpaqueCRLFields(crl)->heapDER = PR_TRUE; } else {
if (crl && (!(decodeoptions & CRL_DECODE_DONT_COPY_DER)) ) {
SEC_FindCrlByKeyOnSlot(PK11SlotInfo *slot, SECItem *crlKey, int type,                       CERTSignedCrl** decoded, PRInt32 decodeoptions){    SECStatus rv = SECSuccess;    CERTSignedCrl *crl = NULL;    SECItem *derCrl = NULL;    CK_OBJECT_HANDLE crlHandle = 0;    char *url = NULL;    int nsserror;    PORT_Assert(decoded);    if (!decoded) {        PORT_SetError(SEC_ERROR_INVALID_ARGS);        return SECFailure;    }    /* XXX it would be really useful to be able to fetch the CRL directly into an       arena. This would avoid a copy later on in the decode step */    PORT_SetError(0);    derCrl = PK11_FindCrlByName(&slot, &crlHandle, crlKey, type, &url);    if (derCrl == NULL) {	/* if we had a problem other than the CRL just didn't exist, return	 * a failure to the upper level */	nsserror = PORT_GetError();	if ((nsserror != 0) && (nsserror != SEC_ERROR_CRL_NOT_FOUND)) {	    rv = SECFailure;	}	goto loser;    }    PORT_Assert(crlHandle != CK_INVALID_HANDLE);    /* PK11_FindCrlByName obtained a slot reference. */        crl = CERT_DecodeDERCrlWithFlags(NULL, derCrl, type, decodeoptions);    if (crl) {        crl->slot = slot;        slot = NULL; /* adopt it */        crl->pkcs11ID = crlHandle;        if (url) {            crl->url = PORT_ArenaStrdup(crl->arena,url);        }    } else {        rv = SECFailure;    }        if (url) {	PORT_Free(url);    }    if (slot) {	PK11_FreeSlot(slot);    }loser:    if (derCrl) {        /* destroy the DER, unless a decoded CRL was returned with DER           allocated on the heap. This is solely for cache purposes */        if (crl && (decodeoptions & CRL_DECODE_DONT_COPY_DER)) {            /* mark the DER as having come from the heap instead of the               arena, so it can be destroyed */            GetOpaqueCRLFields(crl)->heapDER = PR_TRUE;        } else {            SECITEM_FreeItem(derCrl, PR_TRUE);        }    }    *decoded = crl;    return rv;}