Do not perform online revocation checking when the user has explicitly disabled it, except for when…

net/base/ev_root_ca_metadata.h

Index: net/base/ev_root_ca_metadata.h
diff --git a/net/base/ev_root_ca_metadata.h b/net/base/ev_root_ca_metadata.h
index ab76c493de62d0069bd828e8dcdd7005cbd60f12..4e7af4035c61fc0259b362a7bca370ba10b734c6 100644
--- a/net/base/ev_root_ca_metadata.h
+++ b/net/base/ev_root_ca_metadata.h
@@ -12,6 +12,7 @@
 #endif
 
 #include <map>
+#include <set>
 #include <vector>
 
 #include "net/base/net_export.h"
@@ -36,14 +37,7 @@ class NET_EXPORT_PRIVATE EVRootCAMetadata {
 
   static EVRootCAMetadata* GetInstance();
 
-#if defined(USE_NSS)
-  // If the root CA cert has an EV policy OID, returns true and appends the
-  // policy OIDs to |*policy_oids|.  Otherwise, returns false.
-  bool GetPolicyOIDsForCA(const SHA1Fingerprint& fingerprint,
-                          std::vector<PolicyOID>* policy_oids) const;
-  const PolicyOID* GetPolicyOIDs() const;
-  int NumPolicyOIDs() const;
-#elif defined(OS_WIN)
+#if defined(USE_NSS) || defined(OS_WIN)

[wtc, 2012/08/16 23:17:39]

The CL's description should mention the cleanup you made to
EVRootCAMetadata.

   // Returns true if policy_oid is an EV policy OID of some root CA.
   bool IsEVPolicyOID(PolicyOID policy_oid) const;
 
@@ -77,7 +71,7 @@ class NET_EXPORT_PRIVATE EVRootCAMetadata {
   static bool RegisterOID(const char* policy, PolicyOID* out);
 
   PolicyOIDMap ev_policy_;
-  std::vector<PolicyOID> policy_oids_;
+  std::set<PolicyOID> policy_oids_;
 #elif defined(OS_WIN)
   typedef std::map<SHA1Fingerprint, std::string,
                    SHA1FingerprintLessThan> ExtraEVCAMap;