There is a memset in pk11_DestroySessionObjectData which shows up in SSL performance tests. It appears to be a cleanup memset, at least in some cases. I'm not certain if it is the right thing to remove that memset altogether, or to have it only in the case where freeData is PR_FALSE . I will attach a patch that just removes it.
Created attachment 176655 [details] [diff] [review] remove possibly unnecessary memset for investigation only, not checkin