diff --git a/include/binder/IBinder.h b/include/binder/IBinder.h
index 749a977..81b56c2 100644
--- a/include/binder/IBinder.h
+++ b/include/binder/IBinder.h
@@ -98,7 +98,7 @@
      * Register the @a recipient for a notification if this binder
      * goes away.  If this binder object unexpectedly goes away
      * (typically because its hosting process has been killed),
-     * then DeathRecipient::binderDied() will be called with a referene
+     * then DeathRecipient::binderDied() will be called with a reference
      * to this.
      *
      * The @a cookie is optional -- if non-NULL, it should be a
diff --git a/include/utils/StrongPointer.h b/include/utils/StrongPointer.h
index a8c9897..49fa3a8 100644
--- a/include/utils/StrongPointer.h
+++ b/include/utils/StrongPointer.h
@@ -133,7 +133,7 @@
 template<typename T> template<typename U>
 sp<T>::sp(U* other) : m_ptr(other)
 {
-    if (other) other->incStrong(this);
+    if (other) ((T*)other)->incStrong(this);
 }
 
 template<typename T> template<typename U>
@@ -170,7 +170,7 @@
 template<typename T> template<typename U>
 sp<T>& sp<T>::operator = (const sp<U>& other)
 {
-    U* otherPtr(other.m_ptr);
+    T* otherPtr(other.m_ptr);
     if (otherPtr) otherPtr->incStrong(this);
     if (m_ptr) m_ptr->decStrong(this);
     m_ptr = otherPtr;
@@ -180,7 +180,7 @@
 template<typename T> template<typename U>
 sp<T>& sp<T>::operator = (U* other)
 {
-    if (other) other->incStrong(this);
+    if (other) ((T*)other)->incStrong(this);
     if (m_ptr) m_ptr->decStrong(this);
     m_ptr = other;
     return *this;
diff --git a/libs/surfaceflinger_client/Surface.cpp b/libs/surfaceflinger_client/Surface.cpp
index 1e9bd74..68611d6 100644
--- a/libs/surfaceflinger_client/Surface.cpp
+++ b/libs/surfaceflinger_client/Surface.cpp
@@ -1040,7 +1040,7 @@
         // e.g. if GraphicBuffer is used to wrap an android_native_buffer_t that
         // was dequeued from an ANativeWindow.
         for (size_t i = 0; i < mBuffers.size(); i++) {
-            if (buffer->handle == mBuffers[i]->handle) {
+            if (mBuffers[i] != 0 && buffer->handle == mBuffers[i]->handle) {
                 idx = mBuffers[i]->getIndex();
                 break;
             }
diff --git a/libs/utils/RefBase.cpp b/libs/utils/RefBase.cpp
index 0fd404d..bb6c125 100644
--- a/libs/utils/RefBase.cpp
+++ b/libs/utils/RefBase.cpp
@@ -99,20 +99,38 @@
 #if DEBUG_REFS_FATAL_SANITY_CHECKS
             LOG_ALWAYS_FATAL("Strong references remain!");
 #else
-            LOGE("Strong references remain!");
+            LOGE("Strong references remain:");
 #endif
+            ref_entry* refs = mStrongRefs;
+            while (refs) {
+                char inc = refs->ref >= 0 ? '+' : '-';
+                LOGD("\t%c ID %p (ref %d):", inc, refs->id, refs->ref);
+#if DEBUG_REFS_CALLSTACK_ENABLED
+                refs->stack.dump();
+#endif;
+                refs = refs->next;
+            }
         }
 
         if (!mRetain && mWeakRefs != NULL) {
             dumpStack = true;
 #if DEBUG_REFS_FATAL_SANITY_CHECKS
-            LOG_ALWAYS_FATAL("Weak references remain!");
+            LOG_ALWAYS_FATAL("Weak references remain:");
 #else
             LOGE("Weak references remain!");
 #endif
+            ref_entry* refs = mWeakRefs;
+            while (refs) {
+                char inc = refs->ref >= 0 ? '+' : '-';
+                LOGD("\t%c ID %p (ref %d):", inc, refs->id, refs->ref);
+#if DEBUG_REFS_CALLSTACK_ENABLED
+                refs->stack.dump();
+#endif;
+                refs = refs->next;
+            }
         }
-
         if (dumpStack) {
+            LOGE("above errors at:");
             CallStack stack;
             stack.update();
             stack.dump();
@@ -228,7 +246,8 @@
         if (mTrackEnabled) {
             AutoMutex _l(mMutex);
             
-            ref_entry* ref = *refs;
+            ref_entry* const head = *refs;
+            ref_entry* ref = head;
             while (ref != NULL) {
                 if (ref->id == id) {
                     *refs = ref->next;
@@ -249,6 +268,13 @@
                     "(weakref_type %p) that doesn't exist!",
                     id, mBase, this);
 
+            ref = head;
+            while (ref) {
+                char inc = ref->ref >= 0 ? '+' : '-';
+                LOGD("\t%c ID %p (ref %d):", inc, ref->id, ref->ref);
+                ref = ref->next;
+            }
+
             CallStack stack;
             stack.update();
             stack.dump();