This CL changes the lifespan of SSLConnectJobMessengers so that they are created only when needed,

net/socket/ssl_client_socket_nss.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived
 // from AuthCertificateCallback() in
 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp.
 
 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
@@ skipping 2816 matching lines @@
                 << " for cipherSuite " << cipher_suite;
   }
 
   ssl_info->handshake_type = core_->state().resumed_handshake ?
       SSLInfo::HANDSHAKE_RESUME : SSLInfo::HANDSHAKE_FULL;
 
   LeaveFunction("");
   return true;
 }
 
+std::string SSLClientSocketNSS::GetSessionCacheKey() const {
+  NOTIMPLEMENTED();
+  return std::string();
+}
+
 bool SSLClientSocketNSS::InSessionCache() const {
   // For now, always return true so that SSLConnectJobs are never held back.
   return true;
 }
 
 void SSLClientSocketNSS::SetHandshakeCompletionCallback(
     const base::Closure& callback) {
   NOTIMPLEMENTED();
 }
 
@@ skipping 398 matching lines @@
   // Set the peer ID for session reuse.  This is necessary when we create an
   // SSL tunnel through a proxy -- GetPeerName returns the proxy's address
   // rather than the destination server's address in that case.
   std::string peer_id = host_and_port_.ToString();
   // If the ssl_session_cache_shard_ is non-empty, we append it to the peer id.
   // This will cause session cache misses between sockets with different values
   // of ssl_session_cache_shard_ and this is used to partition the session cache
   // for incognito mode.
   if (!ssl_session_cache_shard_.empty()) {
     peer_id += "/" + ssl_session_cache_shard_;
   }

[wtc, 2014/08/14 23:26:26]

This is where the cache key for SSLClientSocketNSS is computed. You are right
that it is not exactly the same as the cache key for SSLClientSocketOpenSSL
(they differ when ssl_session_cache_shard_ is empty). So we can't just copy the
SSLClientSocketOpenSSL implementation to this file.

In any case, it is good to leave SSLClientSocketNSS::GetSessionCacheKey()
unimplemented.

   SECStatus rv = SSL_SetSockPeerID(nss_fd_, const_cast<char*>(peer_id.c_str()));
   if (rv != SECSuccess)
     LogFailedNSSFunction(net_log_, "SSL_SetSockPeerID", peer_id.c_str());
 
   return OK;
 }
 
 void SSLClientSocketNSS::DoConnectCallback(int rv) {
   EnterFunction(rv);
   DCHECK_NE(ERR_IO_PENDING, rv);
@@ skipping 276 matching lines @@
 scoped_refptr<X509Certificate>
 SSLClientSocketNSS::GetUnverifiedServerCertificateChain() const {
   return core_->state().server_cert.get();
 }
 
 ChannelIDService* SSLClientSocketNSS::GetChannelIDService() const {
   return channel_id_service_;
 }
 
 }  // namespace net