Add a build flag to configure bundling of HSTS preload list

net/http/transport_security_state.cc

Index: net/http/transport_security_state.cc
diff --git a/net/http/transport_security_state.cc b/net/http/transport_security_state.cc
index d4d6f495199460c4af336f05ba4f5c5b3649a278..acbd07bae91394cd7ad429771d22928216490107 100644
--- a/net/http/transport_security_state.cc
+++ b/net/http/transport_security_state.cc
@@ -639,8 +639,8 @@ bool DecodeHSTSPreloadRaw(const std::string& search_hostname,
 bool DecodeHSTSPreload(const std::string& hostname, PreloadResult* out) {
   bool found;
   if (!DecodeHSTSPreloadRaw(hostname, &found, out)) {
-    DCHECK(false) << "Internal error in DecodeHSTSPreloadRaw for hostname "
-                  << hostname;
+    // This can happen when INCLUDE_TRANSPORT_SECURITY_STATE_PRELOAD_LIST is
+    // false, in which case BitReader.seek(0) will return false.

[Ryan Sleevi, 2017/07/07 16:45:13]

Could you explain the rationale for doing this change, versus using the build
flag?

That is, one option is

#if !BUILDFLAG(...)
  return false;
#else
  bool found;
  if (...) {
  }
  return found;
#endif

- that forces the linker to optimize out DecodeHSTSPreloadRaw (and all the
supporting code), which it should be capable of doing.

Alternatively, you could do

#if !BUILDFLAG(...)
bool DecodeHSTSPreloadRaw(const std::string& search_hostname, bool* out_found,
PreloadResult* out) {
  *out_found = false;
  return true;
}
#else
....

#endif

Which would explicitly compile that code out.

From my reading, this would fully allow you to compile out both the
HuffmanDecoder and the BitReader, which this current approach - removing the
DCHECK - doesn't do.

By removing the DCHECK, you're removing a guard for when
INCLUDE_TRANSPORT_SECURITY_STATE_PRELOAD_LIST is true - thus weakening the
preconditions. That seems undesirable, but I was curious if there was a reason
for that which I missed.

[xunjieli, 2017/07/10 22:20:40]

Done. That's very neat. Thank you for the suggestion.

     return false;
   }