[NSS] ported mozilla upstream changes:

- Bug 1552254 internal_error alert on Certificate Request with sha1+ecdsa in TLS 1.3 (be6a9782)
- Bug 1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate. r=rrelyea (800111fa)
- Bug 1756271 - Remove token member from NSSSlot struct. r=rrelyea (55052f78)
- Bug 1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun. r=nss-reviewers,jschanck (2f2c8564)
- Bug 1755264 - TLS 1.3 Illegal legacy_version handling/alerts. r=djackson (7d931c59)
- Bug 1751305 - Remove expired explicitly distrusted certificates from certdata.txt. r=KathleenWilson (b722e523)
- Bug 1751298 - Add Telia Root CA v2 root certificate. r=KathleenWilson (1fcbbd7e)
- Bug 1754890 - Add two D-TRUST 2020 root certificates. r=KathleenWilson (f63fb86d)

security/nss/lib/pk11wrap/dev3hack.c

@@ -179,7 +179,6 @@ nssToken_CreateFromPK11SlotInfo(NSSTrustDomain *td, PK11SlotInfo *nss3slot)
     if (!rvToken->slot) {
         goto loser;
     }
-    rvToken->slot->token = rvToken;
     if (rvToken->defaultSession)
         rvToken->defaultSession->slot = rvToken->slot;
     return rvToken;
@@ -227,24 +226,6 @@ nssToken_Refresh(NSSToken *token)
     return token->defaultSession ? PR_SUCCESS : PR_FAILURE;
 }
 
-NSS_IMPLEMENT PRStatus
-nssSlot_Refresh(NSSSlot *slot)
-{
-    PK11SlotInfo *nss3slot = slot->pk11slot;
-    PRBool doit = PR_FALSE;
-    if (slot->token && slot->token->base.name[0] == 0) {
-        doit = PR_TRUE;
-    }
-    if (PK11_InitToken(nss3slot, PR_FALSE) != SECSuccess) {
-        return PR_FAILURE;
-    }
-    if (doit) {
-        nssTrustDomain_UpdateCachedTokenCerts(slot->token->trustDomain,
-                                              slot->token);
-    }
-    return nssToken_Refresh(slot->token);
-}
-
 NSS_IMPLEMENT PRStatus
 nssToken_GetTrustOrder(NSSToken *tok)
 {

security/nss/lib/pk11wrap/pk11obj.c

@@ -1722,7 +1722,10 @@ PK11_WriteRawAttribute(PK11ObjectType objType, void *objSpec,
             slot = ((PK11SymKey *)objSpec)->slot;
             handle = ((PK11SymKey *)objSpec)->objectID;
             break;
-        case PK11_TypeCert: /* don't handle cert case for now */
+        case PK11_TypeCert:
+            handle = PK11_FindObjectForCert((CERTCertificate *)objSpec, NULL,
+                                            &slot);
+            break;
         default:
             break;
     }

security/nss/lib/pk11wrap/pk11pub.h

@@ -680,6 +680,8 @@ CERTCertificate *PK11_FindBestKEAMatch(CERTCertificate *serverCert, void *wincx)
 PRBool PK11_FortezzaHasKEA(CERTCertificate *cert);
 CK_OBJECT_HANDLE PK11_FindCertInSlot(PK11SlotInfo *slot, CERTCertificate *cert,
                                      void *wincx);
+CK_OBJECT_HANDLE PK11_FindObjectForCert(CERTCertificate *cert,
+                                        void *wincx, PK11SlotInfo **pSlot);
 SECStatus PK11_TraverseCertsForNicknameInSlot(SECItem *nickname,
                                               PK11SlotInfo *slot, SECStatus (*callback)(CERTCertificate *, void *),
                                               void *arg);