Set up TransportSecurityState subcomponents last in ProfileIOData.

chrome/browser/profiles/profile_io_data.cc

Index: chrome/browser/profiles/profile_io_data.cc
diff --git a/chrome/browser/profiles/profile_io_data.cc b/chrome/browser/profiles/profile_io_data.cc
index a47242db697abe6b8cba0328ca32e3683c6fce56..b211e0d36b7fff0c3636ae44456fb70ac495d84a 100644
--- a/chrome/browser/profiles/profile_io_data.cc
+++ b/chrome/browser/profiles/profile_io_data.cc
@@ -1063,45 +1063,6 @@ void ProfileIOData::Init(
           {base::MayBlock(), base::TaskPriority::BACKGROUND,
            base::TaskShutdownBehavior::BLOCK_SHUTDOWN}),
       IsOffTheRecord()));
-
-  net::NetworkTrafficAnnotationTag traffic_annotation =
-      net::DefineNetworkTrafficAnnotation("domain_security_policy", R"(
-        semantics {
-          sender: "Domain Security Policy"
-          description:
-            "Websites can opt in to have Chrome send reports to them when "
-            "Chrome observes connections to that website that do not meet "
-            "stricter security policies, such as with HTTP Public Key Pinning. "
-            "Websites can use this feature to discover misconfigurations that "
-            "prevent them from complying with stricter security policies that "
-            "they've opted in to."
-          trigger:
-            "Chrome observes that a user is loading a resource from a website "
-            "that has opted in for security policy reports, and the connection "
-            "does not meet the required security policies."
-          data:
-            "The time of the request, the hostname and port being requested, "
-            "the certificate chain, and sometimes certificate revocation "
-            "information included on the connection."
-          destination: OTHER
-        }
-        policy {
-          cookies_allowed: false
-          setting: "This feature cannot be disabled by settings."
-          policy_exception_justification:
-            "Not implemented, this is a feature that websites can opt into and "
-            "thus there is no Chrome-wide policy to disable it."
-        })");
-  certificate_report_sender_.reset(
-      new net::ReportSender(main_request_context_.get(), traffic_annotation));
-  transport_security_state->SetReportSender(certificate_report_sender_.get());
-
-  expect_ct_reporter_.reset(
-      new ChromeExpectCTReporter(main_request_context_.get()));
-  transport_security_state->SetExpectCTReporter(expect_ct_reporter_.get());
-
-  transport_security_state->SetRequireCTDelegate(
-      ct_policy_manager_->GetDelegate());
   main_request_context_storage_->set_transport_security_state(
       std::move(transport_security_state));
 
@@ -1182,6 +1143,47 @@ void ProfileIOData::Init(
   InitializeInternal(profile_params_.get(), protocol_handlers,
                      std::move(request_interceptors));
 
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("domain_security_policy", R"(
+        semantics {
+          sender: "Domain Security Policy"
+          description:
+            "Websites can opt in to have Chrome send reports to them when "
+            "Chrome observes connections to that website that do not meet "
+            "stricter security policies, such as with HTTP Public Key Pinning. "
+            "Websites can use this feature to discover misconfigurations that "
+            "prevent them from complying with stricter security policies that "
+            "they've opted in to."
+          trigger:
+            "Chrome observes that a user is loading a resource from a website "
+            "that has opted in for security policy reports, and the connection "
+            "does not meet the required security policies."
+          data:
+            "The time of the request, the hostname and port being requested, "
+            "the certificate chain, and sometimes certificate revocation "
+            "information included on the connection."
+          destination: OTHER
+        }
+        policy {
+          cookies_allowed: false
+          setting: "This feature cannot be disabled by settings."
+          policy_exception_justification:
+            "Not implemented, this is a feature that websites can opt into and "
+            "thus there is no Chrome-wide policy to disable it."
+        })");
+  certificate_report_sender_.reset(
+      new net::ReportSender(main_request_context_.get(), traffic_annotation));
+  main_request_context_->transport_security_state()->SetReportSender(
+      certificate_report_sender_.get());
+
+  expect_ct_reporter_.reset(
+      new ChromeExpectCTReporter(main_request_context_.get()));
+  main_request_context_->transport_security_state()->SetExpectCTReporter(
+      expect_ct_reporter_.get());
+
+  main_request_context_->transport_security_state()->SetRequireCTDelegate(
+      ct_policy_manager_->GetDelegate());
+
   profile_params_.reset();
   initialized_ = true;
 }