NSS Cros multiprofile: trust roots added by a profile shouldn't apply to other profiles.

net/cert/cert_verify_proc_nss.h

Index: net/cert/cert_verify_proc_nss.h
diff --git a/net/cert/cert_verify_proc_nss.h b/net/cert/cert_verify_proc_nss.h
index f8bb853544e0817200fde60d5ebaacb6cdf5e2b7..d9971cf34c8bf9620200bc2dce3ea89cac3c3f35 100644
--- a/net/cert/cert_verify_proc_nss.h
+++ b/net/cert/cert_verify_proc_nss.h
@@ -5,6 +5,8 @@
 #ifndef NET_CERT_CERT_VERIFY_PROC_NSS_H_
 #define NET_CERT_CERT_VERIFY_PROC_NSS_H_
 
+#include <certt.h>
+
 #include "net/base/net_export.h"
 #include "net/cert/cert_verify_proc.h"
 
@@ -20,6 +22,17 @@ class NET_EXPORT_PRIVATE CertVerifyProcNSS : public CertVerifyProc {
  protected:
   virtual ~CertVerifyProcNSS();
 
+  // Like VerifyInternal, but adds a |chain_verify_callback| to override trust
+  // decisions. See the documentation for CERTChainVerifyCallback and
+  // CERTChainVerifyCallbackFunc in NSS's lib/certdb/certt.h.
+  int VerifyInternalImpl(X509Certificate* cert,
+                         const std::string& hostname,
+                         int flags,
+                         CRLSet* crl_set,
+                         const CertificateList& additional_trust_anchors,
+                         CERTChainVerifyCallback* chain_verify_callback,
+                         CertVerifyResult* verify_result);
+
  private:
   virtual int VerifyInternal(X509Certificate* cert,
                              const std::string& hostname,