Make X509Certificate creation fail if X509Certificate::Initialize fails.

net/cert/x509_certificate.cc

Index: net/cert/x509_certificate.cc
diff --git a/net/cert/x509_certificate.cc b/net/cert/x509_certificate.cc
index db0969d72df76c76c400c019f036fd211dd6e937..3121e1b5a1022ee6917352423ba92afa0c308aa1 100644
--- a/net/cert/x509_certificate.cc
+++ b/net/cert/x509_certificate.cc
@@ -230,7 +230,11 @@ scoped_refptr<X509Certificate> X509Certificate::CreateFromHandle(
     OSCertHandle cert_handle,
     const OSCertHandles& intermediates) {
   DCHECK(cert_handle);
-  return new X509Certificate(cert_handle, intermediates);
+  scoped_refptr<X509Certificate> cert(
+      new X509Certificate(cert_handle, intermediates));
+  if (!cert->os_cert_handle())
+    return nullptr;  // Initialize() failed.
+  return cert;
 }
 
 // static
@@ -714,7 +718,12 @@ X509Certificate::X509Certificate(OSCertHandle cert_handle,
     intermediate_ca_certs_.push_back(intermediate);
   }
   // Platform-specific initialization.
-  Initialize();
+  if (!Initialize() && cert_handle_) {
+    // Signal initialization failure by clearing cert_handle_.
+    RemoveFromCache(cert_handle_);
+    FreeOSCertHandle(cert_handle_);
+    cert_handle_ = nullptr;
+  }
 }
 
 X509Certificate::~X509Certificate() {