Don't treat trust anchors as certificates during path building.

net/cert/internal/verify_certificate_chain_pkits_unittest.cc

Index: net/cert/internal/verify_certificate_chain_pkits_unittest.cc
diff --git a/net/cert/internal/verify_certificate_chain_pkits_unittest.cc b/net/cert/internal/verify_certificate_chain_pkits_unittest.cc
index 33a11562ad1be4593e1c78cfd488b937bb564ea2..5055a8a240f86ad32fd7a40bf1a859502506c0f2 100644
--- a/net/cert/internal/verify_certificate_chain_pkits_unittest.cc
+++ b/net/cert/internal/verify_certificate_chain_pkits_unittest.cc
@@ -53,7 +53,7 @@ class VerifyCertificateChainPkitsTestDelegate {
       return false;
     }
 
-    // PKITS lists chains from trust anchor to target, VerifyCertificateChain
+    // PKITS lists chains from trust anchor to target, VerifyCertificateChainXXX

[mattm, 2016/08/09 00:59:21]

?

[eroman, 2016/08/09 01:37:20]

Fixed

(Left over note, thanks for spotting).

     // takes them starting with the target and not including the trust anchor.
     std::vector<scoped_refptr<net::ParsedCertificate>> input_chain;
     for (auto i = cert_ders.rbegin(); i != cert_ders.rend(); ++i) {
@@ -66,16 +66,17 @@ class VerifyCertificateChainPkitsTestDelegate {
       }
     }
 
-    TrustStore trust_store;
-    trust_store.AddTrustedCertificate(input_chain.back());
+    auto trust_anchor =
+        TrustAnchor::CreateFromCertificateNoConstraints(input_chain.back());
+    input_chain.pop_back();
 
     SimpleSignaturePolicy signature_policy(1024);
 
     // Run all tests at the time the PKITS was published.
     der::GeneralizedTime time = {2011, 4, 15, 0, 0, 0};
 
-    return VerifyCertificateChainAssumingTrustedRoot(input_chain, trust_store,
-                                                     &signature_policy, time);
+    return VerifyCertificateChain(input_chain, trust_anchor.get(),
+                                  &signature_policy, time);
   }
 };