Index: apps/app_voicemail.c
===================================================================
--- apps/app_voicemail.c	(revision 245044)
+++ apps/app_voicemail.c	(working copy)
@@ -432,14 +432,14 @@
 	return !strcmp(i->context, j->context) ? CMP_MATCH : 0;
 }
 
-static int inprocess_count(const char *context, const char *mailbox, int delta)
+static int inprocess_count(const char *mailbox, const char *context, int delta)
 {
 	struct inprocess *i, *arg = alloca(sizeof(*arg) + strlen(context) + strlen(mailbox) + 2);
 	arg->context = arg->mailbox + strlen(mailbox) + 1;
 	strcpy(arg->mailbox, mailbox); /* SAFE */
 	strcpy(arg->context, context); /* SAFE */
 	ao2_lock(inprocess_container);
-	if ((i = ao2_find(inprocess_container, &arg, 0))) {
+	if ((i = ao2_find(inprocess_container, &arg, OBJ_POINTER))) {
 		int ret = ast_atomic_fetchadd_int(&i->count, delta);
 		ao2_unlock(inprocess_container);
 		ao2_ref(i, -1);
Index: main/astobj2.c
===================================================================
--- main/astobj2.c	(revision 245044)
+++ main/astobj2.c	(working copy)
@@ -504,7 +504,8 @@
 		struct bucket_list *cur;
 
 		AST_LIST_TRAVERSE_SAFE_BEGIN(&c->buckets[i], cur, entry) {
-			int match = cb_fn(EXTERNAL_OBJ(cur->astobj), arg, flags) & (CMP_MATCH | CMP_STOP);
+			/* XXX Why is it possible that the object within is NULL? XXX */
+			int match = EXTERNAL_OBJ(cur->astobj) ? cb_fn(EXTERNAL_OBJ(cur->astobj), arg, flags) & (CMP_MATCH | CMP_STOP) : 0;
 
 			/* we found the object, performing operations according flags */
 			if (match == 0) {	/* no match, no stop, continue */