Ensure X509Certificate::OSCertHandles are safe to be used on both UI and IO threads on Win

net/base/x509_certificate_nss.cc

Index: net/base/x509_certificate_nss.cc
diff --git a/net/base/x509_certificate_nss.cc b/net/base/x509_certificate_nss.cc
index 699c65502321e2dce387a8ca67328f889ee3d409..29382eea70a74dd17cae1c9bd655b4c5fb47b2b4 100644
--- a/net/base/x509_certificate_nss.cc
+++ b/net/base/x509_certificate_nss.cc
@@ -764,6 +764,11 @@ void X509Certificate::GetDNSNames(std::vector<std::string>* dns_names) const {
     dns_names->push_back(subject_.common_name);
 }
 
+X509Certificate::OSCertListHandle
+X509Certificate::CreateOSCertListHandle() const {
+  return CERT_DupCertificate(cert_handle_);
+}

[wtc, 2011/10/04 00:26:34]

Change VerifyInternal to use CreateOSCertListHandle().

[Ryan Sleevi, 2011/10/04 03:38:07]

I don't think this is desirable for NSS, since then it would have to be scoped
to un-dup.

[wtc, 2011/10/04 18:00:51]

The reason I suggested having VerifyInternal use
CreateOSCertListHandle on all platforms is that the
consistency makes it easier to explain when one should
use os_cert_handle() and when one should use CreateOSCertListHandle().

With your proposal, we will need to explain why
CreateOSCertListHandle() is necessary only for Mac (which
needs an array of SecCertificateRef) and Windows (for
thread safety of certificate store enumeration).  It still
works, but it makes it harder for a future maintainer to
understand this code.

+
 int X509Certificate::VerifyInternal(const std::string& hostname,
                                     int flags,
                                     CertVerifyResult* verify_result) const {
@@ -973,6 +978,11 @@ void X509Certificate::FreeOSCertHandle(OSCertHandle cert_handle) {
 }
 
 // static
+void X509Certificate::FreeOSCertListHandle(OSCertListHandle cert_list) {

[wtc, 2011/10/04 00:26:34]

cert_list => cert_list_handle

+  CERT_DestroyCertificate(cert_list);
+}
+
+// static
 SHA1Fingerprint X509Certificate::CalculateFingerprint(
     OSCertHandle cert) {
   SHA1Fingerprint sha1;