Call the platform certificate parser in WorkerPool.

Call the platform certificate parser in WorkerPool.

X509Certificate::CreateFromDERCertChain() can block for long time and
should not be called on the IO thread. In fact, on Chrome OS, it might
not return until TPM-related initialization is finished.

BUG=chromium:704024
TEST=net_unittests

[Shuhei Takahashi, 2017-03-22 09:06:07]

The CQ bit was checked by nya@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-03-22 09:06:20]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-03-22 10:08:21]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-03-22 10:08:22]

Dry run: Try jobs failed on following builders:
  win_chromium_x64_rel_ng on master.tryserver.chromium.win (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.win/builders/win_chromium_x64_...)

[Shuhei Takahashi, 2017-03-23 05:32:24]

Patchset #1 (id:1) has been deleted

[Shuhei Takahashi, 2017-03-23 05:32:32]

The CQ bit was checked by nya@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-03-23 05:32:41]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-03-23 05:46:31]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-03-23 05:46:32]

Dry run: Try jobs failed on following builders:
  chromeos_daisy_chromium_compile_only_ng on master.tryserver.chromium.linux
(JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/chromeos_daisy_...)

[Shuhei Takahashi, 2017-03-23 08:42:05]

The CQ bit was checked by nya@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-03-23 08:42:20]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-03-23 08:56:10]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-03-23 08:56:11]

Dry run: This issue passed the CQ dry run.

[Shuhei Takahashi, 2017-03-23 10:24:32]

nya@chromium.org changed reviewers:
+ davidben@chromium.org

[Shuhei Takahashi, 2017-03-23 10:24:32]

davidben: PTAL

[davidben, 2017-03-23 13:50:32]

davidben@chromium.org changed reviewers:
+ mattm@chromium.org, rsleevi@chromium.org

[davidben, 2017-03-23 13:50:33]

+rsleevi, mattm

Pushing things to worker threads has inherent cost and this *should* be
literally a parsing operation. Given how often we create X509Certificates, I
don't think this makes sense. Rather, we are working on detaching
X509Certificate from NSS entirely which would avoid this problem and many
others.

[davidben, 2017-03-23 13:52:15]

(Note this change also has a UAF because the pointer returned by
SSL_get0_peer_certificates is unretained, but I don't think we want to do this
to begin with.)

[Ryan Sleevi, 2017-03-23 15:11:02]

On 2017/03/23 13:50:33, davidben wrote:
> +rsleevi, mattm
> 
> Pushing things to worker threads has inherent cost and this *should* be
> literally a parsing operation. Given how often we create X509Certificates, I
> don't think this makes sense. Rather, we are working on detaching
> X509Certificate from NSS entirely which would avoid this problem and many
> others.

Yeah, we should see a trace where CERT_NewTempCertificate is locking on the
device lock held by PK11_FindKeyByKeyID

Also, TPM operations shouldn't be that slow :)

[Shuhei Takahashi, 2017-03-29 08:37:49]

We are still discussing what to do in http://crbug.com/704024, but we won't land
this change anyway. Closing.