Update third_party/nss to 3.15.5 Beta 2.

nss/lib/libpkix/pkix/top/pkix_validate.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 /*
  * pkix_validate.c
  *
  * Top level validateChain function
  *
  */
 
@@ skipping 1095 matching lines @@
                         &certCheckedIndex,
                         &checkerIndex,
                         &revChecking,
                         &reasonCode,
                         &nbioContext,
                         &finalPubKey,
                         &validPolicyTree,
                         pVerifyTree,
                         plContext);
 
-                if (chainFailed || (reasonCode != 0)) {
+                if (chainFailed) {
 
                         /* cert chain failed to validate */
 
                         PKIX_DECREF(chainFailed);
                         PKIX_DECREF(anchor);
                         PKIX_DECREF(checkers);
                         PKIX_DECREF(validPolicyTree);
 
                         /* if last anchor, we fail; else, we try next anchor */
                         if (i == (numAnchors - 1)) { /* last anchor */
                                 PKIX_ERROR(PKIX_VALIDATECHAINFAILED);
                         }
 
                 } else {
 
+                        /* XXX Remove this assertion after 2014-12-31.
+                         * See bug 946984. */
+                        PORT_Assert(reasonCode == 0);
+
                         /* cert chain successfully validated! */
                         PKIX_CHECK(pkix_ValidateResult_Create
                                 (finalPubKey,
                                 anchor,
                                 validPolicyTree,
                                 &valResult,
                                 plContext),
                                 PKIX_VALIDATERESULTCREATEFAILED);
 
                         *pResult = valResult;
@@ skipping 244 matching lines @@
                         *pCertIndex = certIndex;
                         *pAnchorIndex = anchorIndex;
                         *pCheckerIndex = checkerIndex;
                         *pRevChecking = revChecking;
                         PKIX_INCREF(checkers);
                         *pCheckers = checkers;
                         *pNBIOContext = nbioContext;
                         goto cleanup;
                 }
 
-                if (chainFailed || (reasonCode != 0)) {
+                if (chainFailed) {
 
                         /* cert chain failed to validate */
 
                         PKIX_DECREF(chainFailed);
                         PKIX_DECREF(anchor);
                         PKIX_DECREF(checkers);
                         PKIX_DECREF(validPolicyTree);
 
                         /* if last anchor, we fail; else, we try next anchor */
                         if (i == (numAnchors - 1)) { /* last anchor */
                                 PKIX_ERROR(PKIX_VALIDATECHAINFAILED);
                         }
 
                 } else {
 
+                        /* XXX Remove this assertion after 2014-12-31.
+                         * See bug 946984. */
+                        PORT_Assert(reasonCode == 0);
+
                         /* cert chain successfully validated! */
                         PKIX_CHECK(pkix_ValidateResult_Create
                                 (finalPubKey,
                                 anchor,
                                 validPolicyTree,
                                 &valResult,
                                 plContext),
                                 PKIX_VALIDATERESULTCREATEFAILED);
 
                         *pResult = valResult;
@@ skipping 12 matching lines @@
         PKIX_DECREF(checkers);
         PKIX_DECREF(revChecker);
         PKIX_DECREF(validPolicyTree);
         PKIX_DECREF(chainFailed);
         PKIX_DECREF(procParams);
         PKIX_DECREF(userCheckers);
         PKIX_DECREF(validateCheckedCritExtOIDsList);
 
         PKIX_RETURN(VALIDATE);
 }