NSS Cros multiprofile: trust roots added by a profile shouldn't apply to other profiles.

net/cert/cert_verify_proc_openssl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/cert_verify_proc_openssl.h"
 
 #include <openssl/x509v3.h>
 
 #include <string>
 #include <vector>
@@ skipping 122 matching lines @@
     // certificate is issued by a known root using OpenSSL is to examine
     // distro-and-release specific hardcoded lists.
     verify_result->is_issued_by_known_root = true;
     if (TestRootCerts::HasInstance()) {
       X509* root = NULL;
       if (verified_chain.empty()) {
         root = verified_cert;
       } else {
         root = verified_chain.back();
       }
-      const CertificateList& temporary_roots =
-          TestRootCerts::GetInstance()->temporary_roots();
-      for (size_t i = 0; i < temporary_roots.size(); ++i) {
-        if (X509Certificate::IsSameOSCert(
-                root, temporary_roots[i]->os_cert_handle())) {
+      TestRootCerts* root_certs = TestRootCerts::GetInstance();
+      if (root_certs->Contains(root))
           verify_result->is_issued_by_known_root = false;
-          break;
-        }
-      }
     }
   }
 }
 
 void AppendPublicKeyHashes(X509_STORE_CTX* store_ctx,
                            HashValueVector* hashes) {
   STACK_OF(X509)* chain = X509_STORE_CTX_get_chain(store_ctx);
   for (int i = 0; i < sk_X509_num(chain); ++i) {
     X509* cert = sk_X509_value(chain, i);
 
@@ skipping 75 matching lines @@
 
   GetCertChainInfo(ctx.get(), verify_result);
   AppendPublicKeyHashes(ctx.get(), &verify_result->public_key_hashes);
   if (IsCertStatusError(verify_result->cert_status))
     return MapCertStatusToNetError(verify_result->cert_status);
 
   return OK;
 }
 
 }  // namespace net