Initialize NSS in the PPAPI process for ClearKey CDM.

content/ppapi_plugin/ppapi_plugin_main.cc

Index: content/ppapi_plugin/ppapi_plugin_main.cc
diff --git a/content/ppapi_plugin/ppapi_plugin_main.cc b/content/ppapi_plugin/ppapi_plugin_main.cc
index 38875b0931fa425dbf92125c18d8f276f8c22a20..63fa8e17894e5e6a9a671769290635e5a5efec77 100644
--- a/content/ppapi_plugin/ppapi_plugin_main.cc
+++ b/content/ppapi_plugin/ppapi_plugin_main.cc
@@ -14,6 +14,7 @@
 #include "content/public/common/content_switches.h"
 #include "content/public/common/main_function_params.h"
 #include "content/public/plugin/content_plugin_client.h"
+#include "crypto/nss_util.h"
 #include "ppapi/proxy/proxy_module.h"
 #include "ui/base/ui_base_switches.h"
 
@@ -80,6 +81,12 @@ int PpapiPluginMain(const MainFunctionParams& parameters) {
   MessageLoop main_message_loop;
   base::PlatformThread::SetName("CrPPAPIMain");
 
+#if defined(OS_LINUX) && defined(USE_NSS)
+  // Some out-of-process PPAPI plugins use NSS.
+  // NSS must be initialized before enabling the sandbox below.
+  crypto::WarmUpNSSSafely();
+#endif
+
   // Allow the embedder to perform any necessary per-process initialization
   // before the sandbox is initialized.
   if (GetContentClient()->plugin())