Split the nssckbi target off from the 'nss' target.

nss.gyp

 # Copyright (c) 2012 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 {
   'variables': {
     'exclude_nss_root_certs%': 1,
     'exclude_nss_libpkix%': 1,
   },
   'target_defaults': {
@@ skipping 227 matching lines @@
       'conditions': [
         ['OS=="mac"', {
           'defines': [
             'XP_UNIX',
             'DARWIN',
             'XP_MACOSX',
             '_PR_PTHREADS',
             'HAVE_BSD_FLOCK',
             'HAVE_CRT_EXTERNS_H',
             'HAVE_DLADDR',
-            'HAVE_LCHOWN',

[wtc, 2012/05/15 18:03:47]

I would add this macro back. This is a faithful imitation
of the upstream NSPR build system.  HAVE_LCHOWN is tested
by a file not used by Chromium.

             'HAVE_SOCKLEN_T',
             'HAVE_STRERROR',
           ],
+          'direct_dependent_settings': {
+            'defines': [
+              'XP_UNIX',
+              'DARWIN',
+              'XP_MACOSX',

[Ryan Sleevi, 2012/05/15 04:23:39]

Since these all appear in (indirectly included) .h files, explicitly specifying
them here.

Previously this was handled transitively by each of the targets.

[wtc, 2012/05/15 18:03:47]

Please remove these direct_dependent_settings blocks for
NSPR.

A design goal of NSPR is that one should not need to define
any macro in order to include NSPR headers.  This is why
public NSPR headers are only allowed to test
compiler-predefined macros or macros defined in prcpucfg.h.

[Ryan Sleevi, 2012/05/15 19:38:47]

Ah, I missed that we had specially patched prcpucfg.h to work around the
configure step auto-generating.

[wtc, 2012/05/15 23:47:11]

prcpucfg.h is not generated by the configure script.
It comes from one of the _xxxos.cfg files in the
mozilla/nsprpub/pr/include/md directory:
http://mxr.mozilla.org/nspr/source/nsprpub/pr/include/md/

The macros from the configure script are defined on the
compiler command line and are not tested by NSPR public
header files.

[Ryan Sleevi, 2012/05/15 23:54:12]

I think we may be miscommunicating.

prcpucfg.h is not checked in to NSPR public. It's copied by the Makefile-based
compile step from one of the .cfg files - see 
http://mxr.mozilla.org/nspr/source/nsprpub/pr/include/md/Makefile.in

In our tree, we've checked in prcpucfg.h that just directly includes one of the
_xxxos.cfg files, for the platforms we support compiling NSS statically (OS X &
Win)

For other third-party packages, such as those based on config.h-and-friends,
we've done things like set the defines in the .GYP files, and just include an
empty config.h, which is why I missed that we'd modified prcpucfg.h

+            ],
+          },
           'sources/': [
             ['exclude', '^mozilla/nsprpub/pr/src/md/windows/'],
             ['exclude', '^mozilla/nsprpub/pr/src/threads/combined/'],
           ],
           'sources!': [
             'mozilla/nsprpub/pr/src/io/prdir.c',
             'mozilla/nsprpub/pr/src/io/prfile.c',
             'mozilla/nsprpub/pr/src/io/prio.c',
             'mozilla/nsprpub/pr/src/io/prsocket.c',
             # os_Darwin_x86.s and os_Darwin_x86_64.s are included by
@@ skipping 15 matching lines @@
         }],
         ['OS=="win"', {
           'defines': [
             'XP_PC',
             'WIN32',
             'WIN95',
             '_PR_GLOBAL_THREADS_ONLY',
             '_CRT_SECURE_NO_WARNINGS',
             '_CRT_NONSTDC_NO_WARNINGS',
           ],
+          'direct_dependent_settings': {
+            'defines': [
+              'XP_PC',
+              'WIN32',
+              'WIN95',
+            ],
+          },

[Ryan Sleevi, 2012/05/15 04:23:39]

Same here

           'sources/': [
             ['exclude', '^mozilla/nsprpub/pr/src/md/unix/'],
             ['exclude', '^mozilla/nsprpub/pr/src/pthreads/'],
           ],
           'conditions': [
             ['target_arch=="ia32"', {
               'defines': [
                 '_X86_',
               ],
             }],
@@ skipping 25 matching lines @@
             '-Wno-incompatible-pointer-types',
             '-Wno-pointer-sign',
           ],
         }],
       ],
     },
     {
       'target_name': 'nss',
       'product_name': 'crnss',
       'type': '<(component)',
+      'dependencies': [
+        'nss_static',
+      ],
+      'export_dependent_settings': [
+        'nss_static',
+      ],
+      'sources': [
+        'mozilla/security/nss/lib/nss/nssver.c',

[Ryan Sleevi, 2012/05/15 04:23:39]

A bit of a hack to ensure at least one symbol is linked in to the target. MSVC
gets grumpy if a target has no linkables but tries to produce a DLL (line 344)

+      ],
+      'conditions': [
+        ['exclude_nss_root_certs==0', {
+          'dependencies': [
+            'nssckbi',
+          ],
+          'export_dependent_settings': [
+            'nssckbi',

[wtc, 2012/05/15 18:03:47]

This export_dependent_settings block may not be necessary
because nssckbi should not be used directly.  It has just
a public header nssckbi.h, which doesn't test any macros.

[Ryan Sleevi, 2012/05/15 19:38:47]

If "nssckbi.h" is part of the public interface of NSS (and it does seem to be),
then generally we should be exporting the settings for it.

That said, nssckbi.h lives in lib/ckfw/builtins/, whereas the 'nssckbi' target
is exporting as an include dir lib/ckfw. I've fixed it such that the proper
builtins/ dir is exported (which wasn't happening in the old code - line 913-930
of old), which at least ensures that callers can #include "nssckbi.h"

[wtc, 2012/05/15 23:47:11]

nssckbi.h is an NSS public header, but Chromium doesn't use
it and I think Chromium should not use it.  So I suggest not
exposing nssckbi.h to NSS consumers in the Chromium source
tree.

(Mozilla uses nssckbi.h because Mozilla loads nssckbi.dll
using a different method and needs to know the version of
nssckbi.dll.)

[Ryan Sleevi, 2012/05/15 23:54:12]

If it's all the same, I'd rather keep the static-vs-dynamic linkage opaque to
the dependents, and provide as much as possible the same interfaces as upstream.
It also keeps consistency between Linux/ChromeOS and Mac/Win targets in terms of
what is visible header wise.

[wtc, 2012/05/16 00:07:40]

Yes, it is fine to export the dependent settings of nssckbi.

+          ],
+        }],
+        ['OS == "mac" and component == "shared_library"', {
+          'xcode_settings': {
+            'GCC_SYMBOLS_PRIVATE_EXTERN': 'NO',  # no -fvisibility=hidden
+          },
+        }],
+        ['OS == "win" and component == "shared_library"', {
+          'sources': [
+            'mozilla/security/nss/exports_win.def',
+          ],
+        }],
+      ],
+    },
+    {
+      # This is really more of a pseudo-target to work around the fact that
+      # a single static_library target cannot contain two object files of the
+      # same name (hash.o / hash.obj). Logically, this is part of the
+      # 'nss_static' target. By separating it out, it creates a possible
+      # circular dependency between 'nss_static' and 'nssckbi' when
+      # 'exclude_nss_root_certs' is not specified, as 'nss_static' depends on
+      # the 'builtinsC_GetFunctionList' exported by this target. This is an
+      # artifact of how NSS is being statically built, which is not an
+      # officially supported configuration - normally, 'nssckbi.dll/so' would
+      # depend on libnss3.dll/so, and the higher layer caller would instruct
+      # libnss3.dll to dynamically load nssckbi.dll, breaking the circle.
+      #
+      # TODO(rsleevi): http://crbug.com/128134 - Break the circular dependency
+      # without requiring nssckbi to be built as a shared library.
+      'target_name': 'nssckbi',
+      'product_name': 'crnssckbi',
+      'type': 'static_library',
+      'sources': [
+        'mozilla/security/nss/lib/ckfw/builtins/anchor.c',
+        'mozilla/security/nss/lib/ckfw/builtins/bfind.c',
+        'mozilla/security/nss/lib/ckfw/builtins/binst.c',
+        'mozilla/security/nss/lib/ckfw/builtins/bobject.c',
+        'mozilla/security/nss/lib/ckfw/builtins/bsession.c',
+        'mozilla/security/nss/lib/ckfw/builtins/bslot.c',
+        'mozilla/security/nss/lib/ckfw/builtins/btoken.c',
+        'mozilla/security/nss/lib/ckfw/builtins/builtins.h',
+        'mozilla/security/nss/lib/ckfw/builtins/certdata.c',
+        'mozilla/security/nss/lib/ckfw/builtins/ckbiver.c',
+        'mozilla/security/nss/lib/ckfw/builtins/constants.c',
+        'mozilla/security/nss/lib/ckfw/builtins/nssckbi.h',
+        'mozilla/security/nss/lib/ckfw/ck.h',
+        'mozilla/security/nss/lib/ckfw/ckfw.h',
+        'mozilla/security/nss/lib/ckfw/ckfwm.h',
+        'mozilla/security/nss/lib/ckfw/ckfwtm.h',
+        'mozilla/security/nss/lib/ckfw/ckmd.h',
+        'mozilla/security/nss/lib/ckfw/ckt.h',
+        'mozilla/security/nss/lib/ckfw/crypto.c',
+        'mozilla/security/nss/lib/ckfw/find.c',
+        'mozilla/security/nss/lib/ckfw/hash.c',
+        'mozilla/security/nss/lib/ckfw/instance.c',
+        'mozilla/security/nss/lib/ckfw/mechanism.c',
+        'mozilla/security/nss/lib/ckfw/mutex.c',
+        'mozilla/security/nss/lib/ckfw/nssck.api',
+        'mozilla/security/nss/lib/ckfw/nssckepv.h',
+        'mozilla/security/nss/lib/ckfw/nssckft.h',
+        'mozilla/security/nss/lib/ckfw/nssckfw.h',
+        'mozilla/security/nss/lib/ckfw/nssckfwc.h',
+        'mozilla/security/nss/lib/ckfw/nssckfwt.h',
+        'mozilla/security/nss/lib/ckfw/nssckg.h',
+        'mozilla/security/nss/lib/ckfw/nssckmdt.h',
+        'mozilla/security/nss/lib/ckfw/nssckt.h',
+        'mozilla/security/nss/lib/ckfw/object.c',
+        'mozilla/security/nss/lib/ckfw/session.c',
+        'mozilla/security/nss/lib/ckfw/sessobj.c',
+        'mozilla/security/nss/lib/ckfw/slot.c',
+        'mozilla/security/nss/lib/ckfw/token.c',
+        'mozilla/security/nss/lib/ckfw/wrap.c',
+      ],
+      'dependencies': [
+        'nss_static',
+      ],
+      'export_dependent_settings': [
+        'nss_static',
+      ],
+      'include_dirs': [
+        'mozilla/security/nss/lib/ckfw',
+      ],
+    },
+    {
+      'target_name': 'nss_static',
+      'type': 'static_library',
       'sources': [
         'mozilla/security/nss/lib/base/arena.c',
         'mozilla/security/nss/lib/base/base.h',
         'mozilla/security/nss/lib/base/baset.h',
         'mozilla/security/nss/lib/base/error.c',
         'mozilla/security/nss/lib/base/errorval.c',
         'mozilla/security/nss/lib/base/hash.c',
         'mozilla/security/nss/lib/base/hashops.c',
         'mozilla/security/nss/lib/base/item.c',
         'mozilla/security/nss/lib/base/libc.c',
@@ skipping 27 matching lines @@
         'mozilla/security/nss/lib/certhigh/certvfy.c',
         'mozilla/security/nss/lib/certhigh/certvfypkix.c',
         'mozilla/security/nss/lib/certhigh/certvfypkixprint.c',
         'mozilla/security/nss/lib/certhigh/crlv2.c',
         'mozilla/security/nss/lib/certhigh/ocsp.c',
         'mozilla/security/nss/lib/certhigh/ocsp.h',
         'mozilla/security/nss/lib/certhigh/ocspi.h',
         'mozilla/security/nss/lib/certhigh/ocspt.h',
         'mozilla/security/nss/lib/certhigh/ocspti.h',
         'mozilla/security/nss/lib/certhigh/xcrldist.c',
-        'mozilla/security/nss/lib/ckfw/builtins/anchor.c',
-        'mozilla/security/nss/lib/ckfw/builtins/bfind.c',
-        'mozilla/security/nss/lib/ckfw/builtins/binst.c',
-        'mozilla/security/nss/lib/ckfw/builtins/bobject.c',
-        'mozilla/security/nss/lib/ckfw/builtins/bsession.c',
-        'mozilla/security/nss/lib/ckfw/builtins/bslot.c',
-        'mozilla/security/nss/lib/ckfw/builtins/btoken.c',
-        'mozilla/security/nss/lib/ckfw/builtins/builtins.h',
-        'mozilla/security/nss/lib/ckfw/builtins/certdata.c',
-        'mozilla/security/nss/lib/ckfw/builtins/ckbiver.c',
-        'mozilla/security/nss/lib/ckfw/builtins/constants.c',
-        'mozilla/security/nss/lib/ckfw/builtins/nssckbi.h',
-        'mozilla/security/nss/lib/ckfw/ck.h',
-        'mozilla/security/nss/lib/ckfw/ckfw.h',
-        'mozilla/security/nss/lib/ckfw/ckfwm.h',
-        'mozilla/security/nss/lib/ckfw/ckfwtm.h',
-        'mozilla/security/nss/lib/ckfw/ckmd.h',
-        'mozilla/security/nss/lib/ckfw/ckt.h',
-        'mozilla/security/nss/lib/ckfw/crypto.c',
-        'mozilla/security/nss/lib/ckfw/find.c',
-        'mozilla/security/nss/lib/ckfw/hash.c',
-        'mozilla/security/nss/lib/ckfw/instance.c',
-        'mozilla/security/nss/lib/ckfw/mechanism.c',
-        'mozilla/security/nss/lib/ckfw/mutex.c',
-        'mozilla/security/nss/lib/ckfw/nssck.api',
-        'mozilla/security/nss/lib/ckfw/nssckepv.h',
-        'mozilla/security/nss/lib/ckfw/nssckft.h',
-        'mozilla/security/nss/lib/ckfw/nssckfw.h',
-        'mozilla/security/nss/lib/ckfw/nssckfwc.h',
-        'mozilla/security/nss/lib/ckfw/nssckfwt.h',
-        'mozilla/security/nss/lib/ckfw/nssckg.h',
-        'mozilla/security/nss/lib/ckfw/nssckmdt.h',
-        'mozilla/security/nss/lib/ckfw/nssckt.h',
-        'mozilla/security/nss/lib/ckfw/object.c',
-        'mozilla/security/nss/lib/ckfw/session.c',
-        'mozilla/security/nss/lib/ckfw/sessobj.c',
-        'mozilla/security/nss/lib/ckfw/slot.c',
-        'mozilla/security/nss/lib/ckfw/token.c',
-        'mozilla/security/nss/lib/ckfw/wrap.c',
         'mozilla/security/nss/lib/cryptohi/cryptohi.h',
         'mozilla/security/nss/lib/cryptohi/cryptoht.h',
         'mozilla/security/nss/lib/cryptohi/dsautil.c',
         'mozilla/security/nss/lib/cryptohi/key.h',
         'mozilla/security/nss/lib/cryptohi/keyhi.h',
         'mozilla/security/nss/lib/cryptohi/keyi.h',
         'mozilla/security/nss/lib/cryptohi/keyt.h',
         'mozilla/security/nss/lib/cryptohi/keythi.h',
         'mozilla/security/nss/lib/cryptohi/sechash.c',
         'mozilla/security/nss/lib/cryptohi/seckey.c',
@@ skipping 248 matching lines @@
         'mozilla/security/nss/lib/libpkix/pkix_pl_nss/system/pkix_pl_oid.h',
         'mozilla/security/nss/lib/libpkix/pkix_pl_nss/system/pkix_pl_primhash.c',
         'mozilla/security/nss/lib/libpkix/pkix_pl_nss/system/pkix_pl_primhash.h',
         'mozilla/security/nss/lib/libpkix/pkix_pl_nss/system/pkix_pl_rwlock.c',
         'mozilla/security/nss/lib/libpkix/pkix_pl_nss/system/pkix_pl_rwlock.h',
         'mozilla/security/nss/lib/libpkix/pkix_pl_nss/system/pkix_pl_string.c',
         'mozilla/security/nss/lib/libpkix/pkix_pl_nss/system/pkix_pl_string.h',
         'mozilla/security/nss/lib/nss/nss.h',
         'mozilla/security/nss/lib/nss/nssinit.c',
         'mozilla/security/nss/lib/nss/nssrenam.h',
-        'mozilla/security/nss/lib/nss/nssver.c',
         'mozilla/security/nss/lib/nss/utilwrap.c',
         'mozilla/security/nss/lib/pk11wrap/debug_module.c',
         'mozilla/security/nss/lib/pk11wrap/dev3hack.c',
         'mozilla/security/nss/lib/pk11wrap/dev3hack.h',
         'mozilla/security/nss/lib/pk11wrap/pk11akey.c',
         'mozilla/security/nss/lib/pk11wrap/pk11auth.c',
         'mozilla/security/nss/lib/pk11wrap/pk11cert.c',
         'mozilla/security/nss/lib/pk11wrap/pk11cxt.c',
         'mozilla/security/nss/lib/pk11wrap/pk11err.c',
         'mozilla/security/nss/lib/pk11wrap/pk11func.h',
@@ skipping 149 matching lines @@
       ],
       'sources!': [
         # primes.c is included by mpprime.c.
         'mozilla/security/nss/lib/freebl/mpi/primes.c',
         # unix_rand.c and win_rand.c are included by sysrand.c.
         'mozilla/security/nss/lib/freebl/unix_rand.c',
         'mozilla/security/nss/lib/freebl/win_rand.c',
         # debug_module.c is included by pk11load.c.
         'mozilla/security/nss/lib/pk11wrap/debug_module.c',
       ],
+      'dependencies': [
+        'nspr',
+        '../sqlite/sqlite.gyp:sqlite',
+      ],
+      'export_dependent_settings': [
+        'nspr',

[Ryan Sleevi, 2012/05/15 04:23:39]

Since NSS public headers include NSPR headers, forcing this dependency to be
declared.

+      ],
       'defines': [
+        'MP_API_COMPATIBLE',
+        'NSS_DISABLE_DBM',
         'NSS_ENABLE_ECC',
-        'USE_UTIL_DIRECTLY',
-        'MP_API_COMPATIBLE',
-        'RIJNDAEL_INCLUDE_TABLES',
-        'NSS_DISABLE_DBM',
         'NSS_STATIC',
         'NSS_USE_STATIC_LIBS',
+        'RIJNDAEL_INCLUDE_TABLES',
         'SHLIB_VERSION=\"3\"',
         'SOFTOKEN_SHLIB_VERSION=\"3\"',

[wtc, 2012/05/15 18:03:47]

The original order of these macros is a faithful imitation
of the upstream NSS build system.  Sorting the macros is
fine.

+        'USE_UTIL_DIRECTLY',
       ],
       'defines!': [
         # Regrettably, NSS can't be compiled with NO_NSPR_10_SUPPORT yet.
         'NO_NSPR_10_SUPPORT',
       ],
       'include_dirs': [
         'mozilla/security/nss/lib/base',
         'mozilla/security/nss/lib/certdb',
         'mozilla/security/nss/lib/certhigh',
-        'mozilla/security/nss/lib/ckfw',
         'mozilla/security/nss/lib/cryptohi',
         'mozilla/security/nss/lib/dev',
         'mozilla/security/nss/lib/freebl',
         'mozilla/security/nss/lib/freebl/ecl',
         'mozilla/security/nss/lib/freebl/mpi',
         'mozilla/security/nss/lib/libpkix/include',
         'mozilla/security/nss/lib/libpkix/pkix/certsel',
         'mozilla/security/nss/lib/libpkix/pkix/checker',
         'mozilla/security/nss/lib/libpkix/pkix/crlsel',
         'mozilla/security/nss/lib/libpkix/pkix/params',
         'mozilla/security/nss/lib/libpkix/pkix/results',
         'mozilla/security/nss/lib/libpkix/pkix/store',
         'mozilla/security/nss/lib/libpkix/pkix/top',
         'mozilla/security/nss/lib/libpkix/pkix/util',
         'mozilla/security/nss/lib/libpkix/pkix_pl_nss/module',
         'mozilla/security/nss/lib/libpkix/pkix_pl_nss/pki',
         'mozilla/security/nss/lib/libpkix/pkix_pl_nss/system',
         'mozilla/security/nss/lib/nss',
         'mozilla/security/nss/lib/pk11wrap',
         'mozilla/security/nss/lib/pkcs7',
         'mozilla/security/nss/lib/pki',
         'mozilla/security/nss/lib/smime',
         'mozilla/security/nss/lib/softoken',
         'mozilla/security/nss/lib/ssl',
         'mozilla/security/nss/lib/util',
       ],
-      'dependencies': [
-        'nspr',
-        '../sqlite/sqlite.gyp:sqlite',
-      ],
       'direct_dependent_settings': {
         'defines': [
           'NO_NSPR_10_SUPPORT',

[wtc, 2012/05/15 18:03:47]

I believe NO_NSPR_10_SUPPORT can be removed because you
added the export_dependent_settings block for nspr.

+          'NSS_ENABLE_ECC',

[Ryan Sleevi, 2012/05/15 04:23:39]

Similar to the above XP_UNIX-and-friends above in nspr, this worked because
libssl in Chromium's local tree was also defining this.

Since this affects the public API, force this as a #define.

[wtc, 2012/05/15 18:03:47]

Yes, this is a good change.  Thanks.

           'NSS_STATIC',
           'NSS_USE_STATIC_LIBS',
           'USE_UTIL_DIRECTLY',
         ],
         'include_dirs': [
           'mozilla/nsprpub/pr/include',
           'mozilla/nsprpub/lib/ds',
           'mozilla/nsprpub/lib/libc/include',
           'mozilla/security/nss/lib/base',
           'mozilla/security/nss/lib/certdb',
@@ skipping 10 matching lines @@
           'mozilla/security/nss/lib/softoken',
           'mozilla/security/nss/lib/util',
         ],
       },
       'msvs_disabled_warnings': [4018, 4101],
       'conditions': [
         ['exclude_nss_root_certs==1', {
           'defines': [
             'NSS_DISABLE_ROOT_CERTS',
           ],
-          'sources/': [
-            ['exclude', '^mozilla/security/nss/lib/ckfw/'],
-          ],
-          'include_dirs!': [
-            'mozilla/security/nss/lib/ckfw',
-          ],
         }],
         ['exclude_nss_libpkix==1', {
           'defines': [
             'NSS_DISABLE_LIBPKIX',
           ],
           'sources/': [
             ['exclude', '^mozilla/security/nss/lib/libpkix/'],
           ],
           'sources!': [
             'mozilla/security/nss/lib/certhigh/certvfypkix.c',
             'mozilla/security/nss/lib/certhigh/certvfypkixprint.c',
           ],
           'include_dirs/': [
             ['exclude', '^mozilla/security/nss/lib/libpkix/'],
           ],
         }],
         ['target_arch=="ia32"', {
           'sources/': [
             ['exclude', 'amd64'],
           ],
         }],
         ['OS=="mac"', {
           'defines': [
-            'XP_UNIX',
-            'DARWIN',
-            'HAVE_STRERROR',
-            'HAVE_BSD_FLOCK',

[Ryan Sleevi, 2012/05/15 04:23:39]

HAVE_STRERROR and HAVE_BSD_FLOCK are only used by NSPR, and the other two are
now exported as dependent settings by NSPR.

[wtc, 2012/05/15 18:03:47]

Please add these four macros back (especially the first two).
These are a faithful imitation of the upstream NSS build
system.

I will have HAVE_STRERROR and HAVE_BSD_FLOCK removed from
the upstream NSS build system.

             'SHLIB_SUFFIX=\"dylib\"',
             'SHLIB_PREFIX=\"lib\"',
             'SOFTOKEN_LIB_NAME=\"libsoftokn3.dylib\"',
           ],
           'sources!': [
             'mozilla/security/nss/lib/freebl/mpi/mpi_x86_asm.c',
           ],
           'xcode_settings': {
             # Can't use 'target_arch=="ia32"' conditional because that is
             # only checked at GYP file generation time.
             'GCC_PREPROCESSOR_DEFINITIONS[arch=i386]': [
               '$(inherited)',
               'NSS_X86_OR_X64',
               'NSS_X86',
               'i386',
             ],
             'GCC_PREPROCESSOR_DEFINITIONS[arch=x86_64]': [
               '$(inherited)',
               'NSS_USE_64',
               'NSS_X86_OR_X64',
               'NSS_X64',
             ],
           },
-          'conditions': [
-            ['component == "shared_library"', {
-              'xcode_settings': {
-                'GCC_SYMBOLS_PRIVATE_EXTERN': 'NO',  # no -fvisibility=hidden
-              },
-            }],
-          ],
         }],
         ['OS=="win"', {
           'defines': [
-            'XP_PC',
-            'WIN32',
             '_WINDOWS',
-            'WIN95',

[wtc, 2012/05/15 18:03:47]

Please add these three macros back.  These are a faithful
imitation of the upstream NSS build system.

             'SHLIB_SUFFIX=\"dll\"',
             'SHLIB_PREFIX=\"\"',
             'SOFTOKEN_LIB_NAME=\"softokn3.dll\"',
           ],
+          'direct_dependent_settings': {
+            'defines': [
+              '_WINDOWS',

[wtc, 2012/05/15 18:03:47]

This direct_dependent_settings block is correct because the
public NSS header secport.h tests the _WINDOWS macro.  We
probably should change secport.h in NSS upstream to not
test _WINDOWS.  I believe the testing of _WINDOWS is a mistake
because _WINDOWS means a windows application (as opposed to
_CONSOLE, a console application) rather than the Windows
operating system.

+            ],
+          },
           'conditions': [
             ['target_arch=="ia32"', {
               'defines': [
                 'NSS_X86_OR_X64',
                 'NSS_X86',
                 '_X86_',
                 'MP_ASSEMBLY_MULTIPLY',
                 'MP_ASSEMBLY_SQUARE',
                 'MP_ASSEMBLY_DIV_2DX1D',
                 'MP_USE_UINT_DIGIT',
                 'MP_NO_MP_WORD',
               ],
             }],
-            ['component == "shared_library"', {
-              'sources': [
-                'mozilla/security/nss/exports_win.def',
-              ],
-            }],
           ],
         }],
         ['clang==1', {
           'xcode_settings': {
             'WARNING_CFLAGS': [
               # nss doesn't explicitly cast between different enum types.
               '-Wno-conversion',
               # nss passes "const char*" through "void*".
               '-Wno-incompatible-pointer-types',
               # nss prefers `a && b || c` over `(a && b) || c`.
               '-Wno-logical-op-parentheses',
               # nss doesn't use exhaustive switches on enums
               '-Wno-switch',
               # nss has some `unsigned < 0` checks.
               '-Wno-tautological-compare',
             ],
           },
           'cflags': [
             '-Wno-conversion',
             '-Wno-incompatible-pointer-types',
             '-Wno-logical-op-parentheses',
             '-Wno-switch',
             '-Wno-tautological-compare',
           ],
         }],
       ],
     },
   ],
 }