Fix correctness, mem leak

src/core/ext/load_reporting/load_reporting_filter.c

@@ -138,8 +138,15 @@ static void destroy_call_elem(grpc_exec_ctx *exec_ctx, grpc_call_element *elem,
                                                 calld->service_method};
   */
 
-  grpc_slice_unref_internal(exec_ctx, calld->initial_md_string);
-  grpc_slice_unref_internal(exec_ctx, calld->trailing_md_string);
+  if (calld->have_initial_md_string) {
+    grpc_slice_unref_internal(exec_ctx, calld->initial_md_string);
+  }
+  if (calld->have_trailing_md_string) {
+    grpc_slice_unref_internal(exec_ctx, calld->trailing_md_string);
+  }
+  if (calld->have_service_method) {
+    grpc_slice_unref_internal(exec_ctx, calld->service_method);
+  }
 }
 
 /* Constructor for channel_data */

src/core/lib/slice/slice.c

@@ -327,6 +327,7 @@ grpc_slice grpc_slice_split_tail(grpc_slice *source, size_t split) {
       tail.data.refcounted.bytes = source->data.refcounted.bytes + split;
       tail.data.refcounted.length = tail_length;
     }
+    source->refcount = source->refcount->sub_refcount;
     source->data.refcounted.length = split;
   }
 
@@ -352,6 +353,7 @@ grpc_slice grpc_slice_split_head(grpc_slice *source, size_t split) {
     head.refcount = NULL;
     head.data.inlined.length = (uint8_t)split;
     memcpy(head.data.inlined.bytes, source->data.refcounted.bytes, split);
+    source->refcount = source->refcount->sub_refcount;
     source->data.refcounted.bytes += split;
     source->data.refcounted.length -= split;
   } else {
@@ -364,6 +366,7 @@ grpc_slice grpc_slice_split_head(grpc_slice *source, size_t split) {
     /* Point into the source array */
     head.data.refcounted.bytes = source->data.refcounted.bytes;
     head.data.refcounted.length = split;
+    source->refcount = source->refcount->sub_refcount;
     source->data.refcounted.bytes += split;
     source->data.refcounted.length -= split;
   }