NSS Cros multiprofile: trust roots added by a profile shouldn't apply to other profiles.

net/cert/test_root_certs_unittest.cc

Index: net/cert/test_root_certs_unittest.cc
diff --git a/net/cert/test_root_certs_unittest.cc b/net/cert/test_root_certs_unittest.cc
index 74c3551862bc6f787f40c250f978c24854e27cf8..a75de5229c138401a48796166fc6e88ebda848dd 100644
--- a/net/cert/test_root_certs_unittest.cc
+++ b/net/cert/test_root_certs_unittest.cc
@@ -26,6 +26,8 @@ namespace {
 const char kRootCertificateFile[] = "root_ca_cert.pem";
 // A certificate issued by the local test root for 127.0.0.1.
 const char kGoodCertificateFile[] = "ok_cert.pem";
+// Another test root certificate.
+const char kRootCertificateFile2[] = "2048-rsa-root.pem";
 
 }  // namespace
 
@@ -135,6 +137,37 @@ TEST(TestRootCertsTest, OverrideTrust) {
   EXPECT_EQ(bad_verify_result.cert_status, restored_verify_result.cert_status);
 }
 
+#if defined(USE_NSS) || defined(OS_IOS) || \
+    (defined(USE_OPENSSL) && !defined(OS_ANDROID))
+TEST(TestRootCertsTest, Contains) {
+  TestRootCerts* test_roots = TestRootCerts::GetInstance();
+  ASSERT_NE(static_cast<TestRootCerts*>(NULL), test_roots);
+
+  scoped_refptr<X509Certificate> root_cert_1 =
+      ImportCertFromFile(GetTestCertsDirectory(), kRootCertificateFile);
+  ASSERT_NE(static_cast<X509Certificate*>(NULL), root_cert_1.get());
+
+  scoped_refptr<X509Certificate> root_cert_2 =
+      ImportCertFromFile(GetTestCertsDirectory(), kRootCertificateFile2);
+  ASSERT_NE(static_cast<X509Certificate*>(NULL), root_cert_2.get());
+
+  EXPECT_FALSE(test_roots->Contains(root_cert_1->os_cert_handle()));
+  EXPECT_FALSE(test_roots->Contains(root_cert_2->os_cert_handle()));
+
+  EXPECT_TRUE(test_roots->Add(root_cert_1.get()));
+  EXPECT_TRUE(test_roots->Contains(root_cert_1->os_cert_handle()));
+  EXPECT_FALSE(test_roots->Contains(root_cert_2->os_cert_handle()));
+
+  EXPECT_TRUE(test_roots->Add(root_cert_2.get()));
+  EXPECT_TRUE(test_roots->Contains(root_cert_1->os_cert_handle()));
+  EXPECT_TRUE(test_roots->Contains(root_cert_2->os_cert_handle()));
+
+  test_roots->Clear();
+  EXPECT_FALSE(test_roots->Contains(root_cert_1->os_cert_handle()));
+  EXPECT_FALSE(test_roots->Contains(root_cert_2->os_cert_handle()));
+}
+#endif
+
 // TODO(rsleevi): Add tests for revocation checking via CRLs, ensuring that
 // TestRootCerts properly injects itself into the validation process. See
 // http://crbug.com/63958