Don't use X509Certificate in SSLConfig.

net/http/http_stream_factory_impl_job.cc

Index: net/http/http_stream_factory_impl_job.cc
diff --git a/net/http/http_stream_factory_impl_job.cc b/net/http/http_stream_factory_impl_job.cc
index 417857b7c9046cd0d35e295d2fd4a70e2c31eb5f..dcbf1149f24ba7dfa93f43a365c1048c8d851fc6 100644
--- a/net/http/http_stream_factory_impl_job.cc
+++ b/net/http/http_stream_factory_impl_job.cc
@@ -1013,7 +1013,13 @@ int HttpStreamFactoryImpl::Job::HandleCertificateError(int error) {
   // RestartIgnoringLastError(). And the user will be asked interactively
   // before RestartIgnoringLastError() is ever called.
   SSLConfig::CertAndStatus bad_cert;
-  bad_cert.cert = ssl_info_.cert;
+
+  // |ssl_info_.cert| may be NULL if we failed to create
+  // X509Certificate for whatever reason, but normally it shouldn't
+  // happen, unless this code is used inside sandbox.
+  if (ssl_info_.cert == NULL ||
+      !ssl_info_.cert->GetDEREncoded(&bad_cert.der_cert))
+    return error;
   bad_cert.cert_status = ssl_info_.cert_status;
   ssl_config_.allowed_bad_certs.push_back(bad_cert);