NSS Cros multiprofile: trust roots added by a profile shouldn't apply to other profiles.

chrome/browser/chromeos/policy/policy_cert_verifier_browsertest.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/policy/policy_cert_verifier.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/callback.h"
 #include "base/memory/ref_counted.h"
@@ skipping 26 matching lines @@
   PolicyCertVerifierTest() : cert_db_(NULL), trust_anchor_used_(false) {}
 
   virtual ~PolicyCertVerifierTest() {}
 
   virtual void SetUp() OVERRIDE {
     ASSERT_TRUE(test_nssdb_.is_open());
     cert_db_ = net::NSSCertDatabase::GetInstance();
 
     cert_verifier_.reset(new PolicyCertVerifier(base::Bind(
         &PolicyCertVerifierTest::OnTrustAnchorUsed, base::Unretained(this))));
-    cert_verifier_->InitializeOnIOThread();
+    cert_verifier_->InitializeOnIOThread(net::CertVerifyProc::CreateDefault());

[Ryan Sleevi, 2014/01/22 00:43:48]

This is potentially dangerous as written, since if cert_verifier_ (or more
aptly, MultiThreadedCertVerifier) fails to grab a ref, this is leaked. Hence the
change request.

[mattm, 2014/01/24 04:47:31]

Done.

(Also had to change it to specify a slot for one of the tests.)

 
     test_ca_cert_ = LoadCertificate("root_ca_cert.pem", net::CA_CERT);
     ASSERT_TRUE(test_ca_cert_);
     test_server_cert_ = LoadCertificate("ok_cert.pem", net::SERVER_CERT);
     ASSERT_TRUE(test_server_cert_);
     test_ca_cert_list_.push_back(test_ca_cert_);
   }
 
   virtual void TearDown() OVERRIDE {
     // Destroy |cert_verifier_| before destroying the ThreadBundle, otherwise
@@ skipping 164 matching lines @@
     int error = VerifyTestServerCert(callback, &verify_result, &request_handle);
     // Note: this hits the cached result from the first Verify() in this test.
     EXPECT_EQ(net::ERR_CERT_AUTHORITY_INVALID, error);
   }
   // The additional trust anchors were reset, thus |cert_verifier_| should not
   // signal it's usage anymore.
   EXPECT_FALSE(WasTrustAnchorUsedAndReset());
 }
 
 }  // namespace policy