diff --git a/tools/trace-malloc/lib/nsTraceMalloc.c b/tools/trace-malloc/lib/nsTraceMalloc.c
index 33535e73875c..e3999410082e 100644
--- a/tools/trace-malloc/lib/nsTraceMalloc.c
+++ b/tools/trace-malloc/lib/nsTraceMalloc.c
@@ -895,21 +895,23 @@ __ptr_t calloc(size_t count, size_t size)
 
 __ptr_t realloc(__ptr_t ptr, size_t size)
 {
+    callsite *oldsite, *site;
     size_t oldsize;
     PLHashNumber hash;
     PLHashEntry *he;
     allocation *alloc;
-    callsite *site;
 
     tmstats.realloc_calls++;
     if (suppress_tracing == 0) {
         if (tmmon)
             PR_EnterMonitor(tmmon);
+        oldsite = NULL;
         oldsize = 0;
         if (ptr && get_allocations()) {
             hash = hash_pointer(ptr);
             he = *PL_HashTableRawLookup(allocations, hash, ptr);
             if (he) {
+                oldsite = (callsite*) he->value;
                 alloc = (allocation*) he;
                 oldsize = alloc->size;
             }
@@ -938,8 +940,10 @@ __ptr_t realloc(__ptr_t ptr, size_t size)
             PR_EnterMonitor(tmmon);
 #endif
         site = backtrace(1);
-        if (site)
-            log_event3(logfp, TM_EVENT_REALLOC, site->serial, oldsize, size);
+        if (site) {
+            log_event4(logfp, TM_EVENT_REALLOC, site->serial, size,
+                       oldsite ? oldsite->serial : 0, oldsize);
+        }
         if (ptr && allocations) {
             suppress_tracing++;
             he = PL_HashTableAdd(allocations, ptr, site);
@@ -1298,4 +1302,19 @@ NS_TraceMallocDumpAllocations(const char *pathname)
     return rv;
 }
 
+PR_IMPLEMENT(void)
+NS_TraceMallocFlushLogfiles()
+{
+    logfile *fp;
+
+    if (tmmon)
+        PR_EnterMonitor(tmmon);
+
+    for (fp = logfile_list; fp; fp = fp->next)
+        flush_logfile(fp);
+
+    if (tmmon)
+        PR_ExitMonitor(tmmon);
+}
+
 #endif /* NS_TRACE_MALLOC */
diff --git a/tools/trace-malloc/lib/nsTraceMalloc.h b/tools/trace-malloc/lib/nsTraceMalloc.h
index bc08dceff6a2..2597e5c4295a 100644
--- a/tools/trace-malloc/lib/nsTraceMalloc.h
+++ b/tools/trace-malloc/lib/nsTraceMalloc.h
@@ -45,7 +45,7 @@ PR_BEGIN_EXTERN_C
  * NS_TraceMallocStartup comment (below) for magic number differences in log
  * file structure.
  */
-#define NS_TRACE_MALLOC_MAGIC           "XPCOM\nTMLog03\r\n\032"
+#define NS_TRACE_MALLOC_MAGIC           "XPCOM\nTMLog04\r\n\032"
 #define NS_TRACE_MALLOC_MAGIC_SIZE      16
 
 /**
@@ -105,6 +105,9 @@ typedef struct nsTMStats {
  * Event Operands (magic TMLog03)
  *   'T' seconds, microseconds, caption
  *
+ * Event Operands (magic TMLog04)
+ *   'R' site serial, realloc size, old site serial, realloc oldsize
+ *
  * See xpcom/base/bloatblame.c for an example log-file reader.
  */
 #define TM_EVENT_LIBRARY        'L'
@@ -168,6 +171,12 @@ PR_EXTERN(void) NS_TraceMallocLogTimestamp(const char *caption);
 PR_EXTERN(int)
 NS_TraceMallocDumpAllocations(const char *pathname);
 
+/**
+ * Flush all logfile buffers.
+ */
+PR_EXTERN(void)
+NS_TraceMallocFlushLogfiles(void);
+
 PR_END_EXTERN_C
 
 #endif /* nsTraceMalloc_h___ */
diff --git a/tools/trace-malloc/tmreader.c b/tools/trace-malloc/tmreader.c
index 5d97d5ce42ca..dee3925b7c74 100644
--- a/tools/trace-malloc/tmreader.c
+++ b/tools/trace-malloc/tmreader.c
@@ -169,10 +169,12 @@ static int get_tmevent(FILE *fp, tmevent *event)
         break;
 
       case TM_EVENT_REALLOC:
-        if (!get_uint32(fp, &event->u.alloc.oldsize))
-            return 0;
         if (!get_uint32(fp, &event->u.alloc.size))
             return 0;
+        if (!get_uint32(fp, &event->u.alloc.oldserial))
+            return 0;
+        if (!get_uint32(fp, &event->u.alloc.oldsize))
+            return 0;
         break;
 
       case TM_EVENT_STATS:
diff --git a/tools/trace-malloc/tmreader.h b/tools/trace-malloc/tmreader.h
index a3c13436f811..3a8b542e3e66 100644
--- a/tools/trace-malloc/tmreader.h
+++ b/tools/trace-malloc/tmreader.h
@@ -65,8 +65,9 @@ struct tmevent {
             uint32  offset;
         } site;
         struct {
-            uint32  oldsize;
             uint32  size;
+            uint32  oldserial;
+            uint32  oldsize;
         } alloc;
         struct {
             nsTMStats tmstats;
diff --git a/xpcom/base/nsTraceMalloc.c b/xpcom/base/nsTraceMalloc.c
index 33535e73875c..e3999410082e 100644
--- a/xpcom/base/nsTraceMalloc.c
+++ b/xpcom/base/nsTraceMalloc.c
@@ -895,21 +895,23 @@ __ptr_t calloc(size_t count, size_t size)
 
 __ptr_t realloc(__ptr_t ptr, size_t size)
 {
+    callsite *oldsite, *site;
     size_t oldsize;
     PLHashNumber hash;
     PLHashEntry *he;
     allocation *alloc;
-    callsite *site;
 
     tmstats.realloc_calls++;
     if (suppress_tracing == 0) {
         if (tmmon)
             PR_EnterMonitor(tmmon);
+        oldsite = NULL;
         oldsize = 0;
         if (ptr && get_allocations()) {
             hash = hash_pointer(ptr);
             he = *PL_HashTableRawLookup(allocations, hash, ptr);
             if (he) {
+                oldsite = (callsite*) he->value;
                 alloc = (allocation*) he;
                 oldsize = alloc->size;
             }
@@ -938,8 +940,10 @@ __ptr_t realloc(__ptr_t ptr, size_t size)
             PR_EnterMonitor(tmmon);
 #endif
         site = backtrace(1);
-        if (site)
-            log_event3(logfp, TM_EVENT_REALLOC, site->serial, oldsize, size);
+        if (site) {
+            log_event4(logfp, TM_EVENT_REALLOC, site->serial, size,
+                       oldsite ? oldsite->serial : 0, oldsize);
+        }
         if (ptr && allocations) {
             suppress_tracing++;
             he = PL_HashTableAdd(allocations, ptr, site);
@@ -1298,4 +1302,19 @@ NS_TraceMallocDumpAllocations(const char *pathname)
     return rv;
 }
 
+PR_IMPLEMENT(void)
+NS_TraceMallocFlushLogfiles()
+{
+    logfile *fp;
+
+    if (tmmon)
+        PR_EnterMonitor(tmmon);
+
+    for (fp = logfile_list; fp; fp = fp->next)
+        flush_logfile(fp);
+
+    if (tmmon)
+        PR_ExitMonitor(tmmon);
+}
+
 #endif /* NS_TRACE_MALLOC */
diff --git a/xpcom/base/nsTraceMalloc.h b/xpcom/base/nsTraceMalloc.h
index bc08dceff6a2..2597e5c4295a 100644
--- a/xpcom/base/nsTraceMalloc.h
+++ b/xpcom/base/nsTraceMalloc.h
@@ -45,7 +45,7 @@ PR_BEGIN_EXTERN_C
  * NS_TraceMallocStartup comment (below) for magic number differences in log
  * file structure.
  */
-#define NS_TRACE_MALLOC_MAGIC           "XPCOM\nTMLog03\r\n\032"
+#define NS_TRACE_MALLOC_MAGIC           "XPCOM\nTMLog04\r\n\032"
 #define NS_TRACE_MALLOC_MAGIC_SIZE      16
 
 /**
@@ -105,6 +105,9 @@ typedef struct nsTMStats {
  * Event Operands (magic TMLog03)
  *   'T' seconds, microseconds, caption
  *
+ * Event Operands (magic TMLog04)
+ *   'R' site serial, realloc size, old site serial, realloc oldsize
+ *
  * See xpcom/base/bloatblame.c for an example log-file reader.
  */
 #define TM_EVENT_LIBRARY        'L'
@@ -168,6 +171,12 @@ PR_EXTERN(void) NS_TraceMallocLogTimestamp(const char *caption);
 PR_EXTERN(int)
 NS_TraceMallocDumpAllocations(const char *pathname);
 
+/**
+ * Flush all logfile buffers.
+ */
+PR_EXTERN(void)
+NS_TraceMallocFlushLogfiles(void);
+
 PR_END_EXTERN_C
 
 #endif /* nsTraceMalloc_h___ */
diff --git a/xpcom/base/nsTraceRefcnt.cpp b/xpcom/base/nsTraceRefcnt.cpp
index e81978c34b6d..94e9c49d8c2d 100644
--- a/xpcom/base/nsTraceRefcnt.cpp
+++ b/xpcom/base/nsTraceRefcnt.cpp
@@ -1039,7 +1039,7 @@ nsTraceRefcnt::WalkTheStack(FILE* aStream)
       Dl_info info;
       int ok = dladdr((void*) pc, &info);
       if (!ok) {
-        fprintf(aStream, "UNKNOWN 0x%08X\n", (char*)pc);
+        fprintf(aStream, "UNKNOWN 0x%8p\n", (char*)pc);
         bp = nextbp;
         continue;
       }
diff --git a/xpcom/base/nsTraceRefcntImpl.cpp b/xpcom/base/nsTraceRefcntImpl.cpp
index e81978c34b6d..94e9c49d8c2d 100644
--- a/xpcom/base/nsTraceRefcntImpl.cpp
+++ b/xpcom/base/nsTraceRefcntImpl.cpp
@@ -1039,7 +1039,7 @@ nsTraceRefcnt::WalkTheStack(FILE* aStream)
       Dl_info info;
       int ok = dladdr((void*) pc, &info);
       if (!ok) {
-        fprintf(aStream, "UNKNOWN 0x%08X\n", (char*)pc);
+        fprintf(aStream, "UNKNOWN 0x%8p\n", (char*)pc);
         bp = nextbp;
         continue;
       }
diff --git a/xpcom/base/tmreader.c b/xpcom/base/tmreader.c
index 5d97d5ce42ca..dee3925b7c74 100644
--- a/xpcom/base/tmreader.c
+++ b/xpcom/base/tmreader.c
@@ -169,10 +169,12 @@ static int get_tmevent(FILE *fp, tmevent *event)
         break;
 
       case TM_EVENT_REALLOC:
-        if (!get_uint32(fp, &event->u.alloc.oldsize))
-            return 0;
         if (!get_uint32(fp, &event->u.alloc.size))
             return 0;
+        if (!get_uint32(fp, &event->u.alloc.oldserial))
+            return 0;
+        if (!get_uint32(fp, &event->u.alloc.oldsize))
+            return 0;
         break;
 
       case TM_EVENT_STATS:
diff --git a/xpcom/base/tmreader.h b/xpcom/base/tmreader.h
index a3c13436f811..3a8b542e3e66 100644
--- a/xpcom/base/tmreader.h
+++ b/xpcom/base/tmreader.h
@@ -65,8 +65,9 @@ struct tmevent {
             uint32  offset;
         } site;
         struct {
-            uint32  oldsize;
             uint32  size;
+            uint32  oldserial;
+            uint32  oldsize;
         } alloc;
         struct {
             nsTMStats tmstats;