Track subresources with cert errors separately from mixed content

content/browser/ssl/ssl_policy.cc

Index: content/browser/ssl/ssl_policy.cc
diff --git a/content/browser/ssl/ssl_policy.cc b/content/browser/ssl/ssl_policy.cc
index 9d60c36a8ceb770c6850ca91be149f1910153524..f94d0c6963d9034ff4dbc2f26c5f8dc7e72cf906 100644
--- a/content/browser/ssl/ssl_policy.cc
+++ b/content/browser/ssl/ssl_policy.cc
@@ -148,6 +148,19 @@ void SSLPolicy::DidRunInsecureContent(NavigationEntryImpl* entry,
                                    site_instance->GetProcess()->GetID());
 }
 
+void SSLPolicy::DidRunContentWithCertErrors(NavigationEntryImpl* entry,
+                                            const GURL& security_origin) {
+  if (!entry)
+    return;
+
+  SiteInstance* site_instance = entry->site_instance();
+  if (!site_instance)
+    return;
+
+  backend_->HostRanContentWithCertErrors(security_origin.host(),
+                                         site_instance->GetProcess()->GetID());
+}
+
 void SSLPolicy::OnRequestStarted(const GURL& url,
                                  int cert_id,
                                  net::CertStatus cert_status) {
@@ -177,17 +190,28 @@ void SSLPolicy::UpdateEntry(NavigationEntryImpl* entry,
                             WebContents* web_contents) {
   DCHECK(entry);
 
+  WebContentsImpl* web_contents_impl =
+      static_cast<WebContentsImpl*>(web_contents);
+
   InitializeEntryIfNeeded(entry);
 
   if (entry->GetSSL().security_style == SECURITY_STYLE_UNAUTHENTICATED)
     return;
 
-  if (!web_contents->DisplayedInsecureContent())
+  if (!web_contents_impl->DisplayedInsecureContent())
     entry->GetSSL().content_status &= ~SSLStatus::DISPLAYED_INSECURE_CONTENT;
 
-  if (web_contents->DisplayedInsecureContent())
+  if (web_contents_impl->DisplayedInsecureContent())
     entry->GetSSL().content_status |= SSLStatus::DISPLAYED_INSECURE_CONTENT;
 
+  if (!web_contents_impl->DisplayedContentWithCertErrors())
+    entry->GetSSL().content_status &=
+        ~SSLStatus::DISPLAYED_CONTENT_WITH_CERT_ERRORS;
+
+  if (web_contents_impl->DisplayedContentWithCertErrors())
+    entry->GetSSL().content_status |=
+        SSLStatus::DISPLAYED_CONTENT_WITH_CERT_ERRORS;
+
   SiteInstance* site_instance = entry->site_instance();
   // Note that |site_instance| can be NULL here because NavigationEntries don't
   // necessarily have site instances.  Without a process, the entry can't
@@ -199,6 +223,13 @@ void SSLPolicy::UpdateEntry(NavigationEntryImpl* entry,
         SECURITY_STYLE_AUTHENTICATION_BROKEN;
     entry->GetSSL().content_status |= SSLStatus::RAN_INSECURE_CONTENT;
   }
+
+  if (site_instance &&
+      backend_->DidHostRunContentWithCertErrors(
+          entry->GetURL().host(), site_instance->GetProcess()->GetID())) {
+    entry->GetSSL().security_style = SECURITY_STYLE_AUTHENTICATION_BROKEN;
+    entry->GetSSL().content_status |= SSLStatus::RAN_CONTENT_WITH_CERT_ERRORS;
+  }
 }
 
 // Static