Build and send HPKP violation reports

chrome/browser/profiles/profile_io_data.h

Index: chrome/browser/profiles/profile_io_data.h
diff --git a/chrome/browser/profiles/profile_io_data.h b/chrome/browser/profiles/profile_io_data.h
index 4b2937b7b97303a1c2a56c29d905f22fa6df0220..f8164b80fdb41accac40edf75262d75b39c34461 100644
--- a/chrome/browser/profiles/profile_io_data.h
+++ b/chrome/browser/profiles/profile_io_data.h
@@ -68,6 +68,7 @@ class HttpTransactionFactory;
 class ProxyConfigService;
 class ProxyService;
 class SSLConfigService;
+class CertificateReportSender;

[davidben, 2015/07/24 20:42:55]

Nit: Alphabetize.

[estark, 2015/07/25 00:10:31]

Done.

 class TransportSecurityPersister;
 class TransportSecurityState;
 class URLRequestJobFactoryImpl;
@@ -557,6 +558,7 @@ class ProfileIOData {
 
   mutable scoped_ptr<net::TransportSecurityPersister>
       transport_security_persister_;
+  mutable scoped_ptr<net::CertificateReportSender> certificate_report_sender_;

[davidben, 2015/07/24 20:42:55]

This is really obnoxious, but there's a window where certificate_report_sender_
is alive and main_request_context_ isn't. Which actually can trip
AssertNoURLRequests if there are any live reports in flight on shutdown. And the
CertificateReportSender cannot outlive main_request_context_. (At the same time,
transport_security_state_ can't have a pointer to certificate_report_sender_
after it's been destroyed.)

Really the problem is you have a cycle. So you'll need some code in some
destructor to break one of the pointers, probably TSS -> CRS. (Note that
TransportSecurityPersister's destructor calls SetDelegate(NULL) which is why it
can outlive TransportSecurityState.)

Probably just putting something in ~ProfileIOData to disconnect it and either
certificate_report_sender_.reset() early or place it underneath
main_request_context_ so it's destroyed first.

[estark, 2015/07/25 00:10:31]

Ah, yeah, mmenke and I were talking about this earlier this week on
crbug.com/512461. Done.

 
   // These are only valid in between LazyInitialize() and their accessor being
   // called.