Add comment about wrong policy merging

components/policy/core/common/policy_loader_win.cc

 // Copyright (c) 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/policy/core/common/policy_loader_win.h"
 
 #include <windows.h>
 #include <ntdsapi.h>  // For Ds[Un]Bind
 #include <rpc.h>      // For struct GUID
 #include <shlwapi.h>  // For PathIsUNC()
@@ skipping 461 matching lines @@
 
     base::FilePath preg_file_path(
         base::FilePath(policy_object->lpFileSysPath).Append(kPRegFileName));
     if (policy_object->dwOptions & GPO_FLAG_FORCE) {
       RegistryDict new_forced_policy;
       if (!ReadPRegFile(preg_file_path, &new_forced_policy, status))
         return false;
 
       // Merge with existing forced policy, giving precedence to the existing
       // forced policy.
+      // TODO(ljusten): Same problem as below.
       new_forced_policy.Merge(forced_policy);
       forced_policy.Swap(&new_forced_policy);
     } else {
       if (!ReadPRegFile(preg_file_path, &parsed_policy, status))
         return false;
     }
   }
 
   // Merge, give precedence to forced policy.
+  // TODO(ljusten): This doesn't work properly if policies are explicitly
+  // disabled or string list policies have less entries in the forced_policy.
+  // The merged dictionary still has excessive policies and strings. To fix
+  // this, use only one dict and call ReadPRegFile in the proper order (forced
+  // last). See crbug.com/659979.
   parsed_policy.Merge(forced_policy);
   policy->Swap(&parsed_policy);
 
   return true;
 }
 
 bool PolicyLoaderWin::ReadPolicyFromGPO(PolicyScope scope,
                                         RegistryDict* policy,
                                         PolicyLoadStatusSample* status) {
   PGROUP_POLICY_OBJECT policy_object_list = NULL;
@@ skipping 105 matching lines @@
 
 void PolicyLoaderWin::OnObjectSignaled(HANDLE object) {
   DCHECK(object == user_policy_changed_event_.handle() ||
          object == machine_policy_changed_event_.handle())
       << "unexpected object signaled policy reload, obj = "
       << std::showbase << std::hex << object;
   Reload(false);
 }
 
 }  // namespace policy