import changes from mozilla nss repo:

- Bug 1641480, TLS 1.3: tighten CCS handling in compatibility mode, r=mt
- Bug 1672703, always tolerate the first CCS in TLS 1.3, r=mt
- Bug 1663661 - Guard against NULL token in nssSlot_IsTokenPresent. r=jcj
- Bug 1607449 - Lock cert->nssCertificate to prevent data race. r=jcj,keeler
- Bug 1679290 - Don't hold slot lock when taking session lock r=bbeurdouche

security/nss/lib/certdb/stanpcertdb.c

@@ -32,6 +32,9 @@
 #include "dev.h"
 #include "secmodi.h"
 
+extern void CERT_MaybeLockCertTempPerm(const CERTCertificate *cert);
+extern void CERT_MaybeUnlockCertTempPerm(const CERTCertificate *cert);
+
 PRBool
 SEC_CertNicknameConflict(const char *nickname, const SECItem *derSubject,
                          CERTCertDBHandle *handle)
@@ -311,7 +314,9 @@ __CERT_AddTempCertToPerm(CERTCertificate *cert, char *nickname,
     nssPKIObject_AddInstance(&c->object, permInstance);
     nssTrustDomain_AddCertsToCache(STAN_GetDefaultTrustDomain(), &c, 1);
     /* reset the CERTCertificate fields */
+    CERT_LockCertTempPerm(cert);
     cert->nssCertificate = NULL;
+    CERT_UnlockCertTempPerm(cert);
     cert = STAN_GetCERTCertificateOrRelease(c); /* should return same pointer */
     if (!cert) {
         CERT_MapStanError();
@@ -808,9 +813,17 @@ CERT_DestroyCertificate(CERTCertificate *cert)
         /* don't use STAN_GetNSSCertificate because we don't want to
          * go to the trouble of translating the CERTCertificate into
          * an NSSCertificate just to destroy it.  If it hasn't been done
-         * yet, don't do it at all.
-         */
+         * yet, don't do it at all
+         *
+         * cert->nssCertificate contains its own locks and refcount, but as it
+         * may be NULL, the pointer itself must be guarded by some other lock.
+         * Rather than creating a new global lock for only this purpose, share
+         * an existing global lock that happens to be taken near the write in
+         * fill_CERTCertificateFields(). The longer-term goal is to refactor
+         * all these global locks to be certificate-scoped. */
+        CERT_MaybeLockCertTempPerm(cert);
         NSSCertificate *tmp = cert->nssCertificate;
+        CERT_MaybeUnlockCertTempPerm(cert);
         if (tmp) {
             /* delete the NSSCertificate */
             NSSCertificate_Destroy(tmp);