nssCertificate_AddRef(cert);
add_cert_to_cache(  NSSTrustDomain *td,   NSSCertificate *cert){    NSSArena *arena = NULL;    nssList *subjectList;    PRStatus nssrv;    PRUint32 added = 0;    PZ_Lock(td->cache->lock);    /* If it exists in the issuer/serial hash, it's already in all */    if (nssHash_Exists(td->cache->issuerAndSN, cert)) {#ifdef DEBUG_CACHE	log_cert_ref("attempted to add cert already in cache", cert);#endif	PZ_Unlock(td->cache->lock);	/* collision - most likely, somebody else already added the cert	 * to the cache before this thread got around to it.	 */	nss_SetError(NSS_ERROR_CERTIFICATE_IN_CACHE);	return PR_FAILURE;    }    /* create a new cache entry for this cert within the cert's arena*/    nssrv = add_issuer_and_serial_entry(cert->object.arena, td->cache, cert);    if (nssrv != PR_SUCCESS) {	goto loser;    }    added++;    /* create an arena for the nickname and subject entries */    arena = nssArena_Create();    if (!arena) {	goto loser;    }    /* create a new subject list for this cert, or add to existing */    nssrv = add_subject_entry(arena, td->cache, cert, &subjectList);    if (nssrv != PR_SUCCESS) {	goto loser;    }    added++;    /* If a new subject entry was created, also need nickname and/or email */    if (subjectList != NULL) {	PRBool handle = PR_FALSE;	if (cert->nickname) {	    nssrv = add_nickname_entry(arena, td->cache, cert, subjectList);	    if (nssrv != PR_SUCCESS) {		goto loser;	    }	    handle = PR_TRUE;	    added++;	}	if (cert->email) {	    nssrv = add_email_entry(td->cache, cert, subjectList);	    if (nssrv != PR_SUCCESS) {		goto loser;	    }	    handle = PR_TRUE;	    added += 2;	}#ifdef nodef	/* I think either a nickname or email address must be associated	 * with the cert.  However, certs are passed to NewTemp without	 * either.  This worked in the old code, so it must work now.	 */	if (!handle) {	    /* Require either nickname or email handle */	    nssrv = PR_FAILURE;	    goto loser;	}#endif    }    PZ_Unlock(td->cache->lock);    nssCertificate_AddRef(cert);    return nssrv;loser:    /* Remove any handles that have been created */    if (added >= 1) {	(void)remove_issuer_and_serial_entry(td->cache, cert);    }    if (added >= 2) {	(void)remove_subject_entry(td->cache, cert, &subjectList, &arena);    }    if (added == 3 || added == 5) {	(void)remove_nickname_entry(td->cache, cert, subjectList);    }    if (added >= 4) {	(void)remove_email_entry(td->cache, cert, subjectList);    }    if (arena) {	nssArena_Destroy(arena);    }    PZ_Unlock(td->cache->lock);    return PR_FAILURE;}