Update some documentation for CertVerifyResult::verified_cert

net/cert/cert_verify_result.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_CERT_CERT_VERIFY_RESULT_H_
 #define NET_CERT_CERT_VERIFY_RESULT_H_
 
 #include <vector>
 
 #include "base/memory/ref_counted.h"
 #include "net/base/net_export.h"
 #include "net/cert/cert_status_flags.h"
 #include "net/cert/ocsp_verify_result.h"
 #include "net/cert/x509_cert_types.h"
 
 namespace net {
 
 class X509Certificate;
 
 // The result of certificate verification.
 class NET_EXPORT CertVerifyResult {
  public:
   CertVerifyResult();
   CertVerifyResult(const CertVerifyResult& other);
   ~CertVerifyResult();
 
   void Reset();
 
+  // Comparing CertVerifyResult with a nullptr |verified_cert| is invalid.
   bool operator==(const CertVerifyResult& other) const;
 
-  // The certificate and chain that was constructed during verification.
-  // Note that the though the verified certificate will match the originally
-  // supplied certificate, the intermediate certificates stored within may
-  // be substantially different. In the event of a verification failure, this
-  // will contain the chain as supplied by the server. This may be NULL if
-  // running within the sandbox.
+  // The certificate chain that was constructed during verification.
+  //
+  // Note: Although |verified_cert| will match the originally supplied
+  // certificate to be validated, the results of GetIntermediateCertificates()
+  // may be substantially different, both in order and in content, then the
+  // originally supplied intermediates.
+  //
+  // In the event of validation failures, this may contain the originally
+  // supplied certificate chain or a partially constructed path, depending on
+  // the implementation.
+  //
+  // In the event of validation success, the trust anchor will be
+  // |verified_cert->GetIntermediateCertificates().back()| if
+  // there was a certificate chain to the trust anchor, and will
+  // be |verified_cert->os_cert_handle()| if the certificate was
+  // the trust anchor.
   scoped_refptr<X509Certificate> verified_cert;
 
   // Bitmask of CERT_STATUS_* from net/cert/cert_status_flags.h. Note that
   // these status flags apply to the certificate chain returned in
   // |verified_cert|, rather than the originally supplied certificate
   // chain.
   CertStatus cert_status;
 
   // Properties of the certificate chain.
   bool has_md2;
@@ skipping 21 matching lines @@
   // name, rather than using the subjectAltName.
   bool common_name_fallback_used;
 
   // Verification of stapled OCSP response, if present.
   OCSPVerifyResult ocsp_result;
 };
 
 }  // namespace net
 
 #endif  // NET_CERT_CERT_VERIFY_RESULT_H_