Use user specific NSSDatabase in CertLoader.

chrome/browser/chromeos/login/login_utils.cc

Index: chrome/browser/chromeos/login/login_utils.cc
diff --git a/chrome/browser/chromeos/login/login_utils.cc b/chrome/browser/chromeos/login/login_utils.cc
index 57df96531f530a6a7ba8eadc8d30877f4c6d45db..e518284b354e9dbb90593e6f741e87651c70e805 100644
--- a/chrome/browser/chromeos/login/login_utils.cc
+++ b/chrome/browser/chromeos/login/login_utils.cc
@@ -63,6 +63,7 @@
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/logging_chrome.h"
 #include "chrome/common/pref_names.h"
+#include "chromeos/cert_loader.h"
 #include "chromeos/chromeos_switches.h"
 #include "chromeos/cryptohome/cryptohome_util.h"
 #include "chromeos/dbus/cryptohome_client.h"
@@ -584,10 +585,20 @@ void LoginUtilsImpl::FinalizePrepareProfile(Profile* user_profile) {
       content::NotificationService::AllSources(),
       content::Details<Profile>(user_profile));
 
-  // Initialize RLZ only for primary user.
+  // Initialize RLZ and CertLoader only for primary user.
   if (UserManager::Get()->GetPrimaryUser() ==
       UserManager::Get()->GetUserByProfile(user_profile)) {
     InitRlzDelayed(user_profile);
+
+    // CertLoader::StartWithUser must not be called before the NSS is
+    // initialized for the user. This happens during profile initialization,
+    // which should be done by now, so the CertLoader can be started at this
+    // point. The cert loader should be started woth the primary user,
+    // as it only needs to load the primary user's certificates.
+    if (CertLoader::IsInitialized()) {

[tbarzic, 2014/01/22 23:07:15]

Do you have any suggestions for a better place to put this?

+      const User* user = UserManager::Get()->GetPrimaryUser();
+      CertLoader::Get()->StartWithUser(user->username_hash());

[mattm, 2014/01/23 01:45:55]

Should use GetNSSCertDatabaseForResourceContext from
chrome/browser/net/nss_context.h instead of having the CertLoader create a new
NSSCertDatabaseChromeOS. There might be some issue with CertLoader lifetime vs
ResourceContext lifetime to work out. But we have moved from having multiple
instances of the certdatabase objects in the past to a single shared one (which
should now be one per profile).

[tbarzic, 2014/01/23 04:45:28]

Makes sense. Moved Db "creation" for the CertLoader to chrome/browser/.

As far as I understand, there should not be an issue with CertLoader lifetime vs
ResourceContext lifetime.
CertLoader is accessed only on UI thread, which stops running when profiles go
away.
An NSSCertDatabase is owned by ResourceContext, which lives on IO thread, and
it's destruction task is posted to IO thread on profile destruction. So, as long
as CertLoader only uses its NSSDB reference on IO thread, and the profile
destruction itself doesn't induce certificate loading in CertLoader, all tasks
issued by CertLoader to IO thread should be in message queue before the
ResourceContext deletion task.
Am I missing something here?

Off course, this means CertLoader cannot use WorkerPool for calling
database->ListCerts.

+    }
   }
   // TODO(altimofeev): This pointer should probably never be NULL, but it looks
   // like LoginUtilsImpl::OnProfileCreated() may be getting called before