Remove the deprecated NSSCertDatabase::GetInstance() .

net/cert/nss_cert_database.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/nss_cert_database.h"
 
 #include <cert.h>
 #include <certdb.h>
 #include <keyhi.h>
 #include <pk11pub.h>
 #include <secmod.h>
 
 #include "base/bind.h"
 #include "base/callback.h"
-#include "base/lazy_instance.h"
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/observer_list_threadsafe.h"
 #include "base/task_runner.h"
 #include "base/task_runner_util.h"
 #include "base/threading/worker_pool.h"
-#include "crypto/nss_util.h"
-#include "crypto/nss_util_internal.h"
 #include "crypto/scoped_nss_types.h"
 #include "net/base/crypto_module.h"
 #include "net/base/net_errors.h"
 #include "net/cert/cert_database.h"
 #include "net/cert/x509_certificate.h"
 #include "net/third_party/mozilla_security_manager/nsNSSCertificateDB.h"
 #include "net/third_party/mozilla_security_manager/nsPKCS12Blob.h"
 
 // In NSS 3.13, CERTDB_VALID_PEER was renamed CERTDB_TERMINAL_RECORD. So we use
 // the new name of the macro.
@@ skipping 29 matching lines @@
   virtual void OnCACertChanged(const X509Certificate* cert) OVERRIDE {
     cert_db_->NotifyObserversOfCACertChanged(cert);
   }
 
  private:
   CertDatabase* cert_db_;
 
   DISALLOW_COPY_AND_ASSIGN(CertNotificationForwarder);
 };
 
-base::LazyInstance<NSSCertDatabase>::Leaky
-    g_nss_cert_database = LAZY_INSTANCE_INITIALIZER;
-
 }  // namespace
 
 NSSCertDatabase::ImportCertFailure::ImportCertFailure(
     const scoped_refptr<X509Certificate>& cert,
     int err)
     : certificate(cert), net_error(err) {}
 
 NSSCertDatabase::ImportCertFailure::~ImportCertFailure() {}
 
-// static
-NSSCertDatabase* NSSCertDatabase::GetInstance() {
-  // TODO(mattm): Remove this ifdef guard once the linux impl of
-  // GetNSSCertDatabaseForResourceContext does not call GetInstance.
-#if defined(OS_CHROMEOS)
-  LOG(ERROR) << "NSSCertDatabase::GetInstance() is deprecated."
-             << "See http://crbug.com/329735.";
-#endif
-  return &g_nss_cert_database.Get();
-}
-
-NSSCertDatabase::NSSCertDatabase()
-    : observer_list_(new ObserverListThreadSafe<Observer>),
+NSSCertDatabase::NSSCertDatabase(crypto::ScopedPK11Slot persistent_slot)
+    : persistent_slot_(persistent_slot.Pass()),
+      observer_list_(new ObserverListThreadSafe<Observer>),
       weak_factory_(this) {
   // This also makes sure that NSS has been initialized.
   CertDatabase* cert_db = CertDatabase::GetInstance();
   cert_notification_forwarder_.reset(new CertNotificationForwarder(cert_db));
   AddObserver(cert_notification_forwarder_.get());
 
   psm::EnsurePKCS12Init();
 }
 
 NSSCertDatabase::~NSSCertDatabase() {}
@@ skipping 25 matching lines @@
   CertificateList* raw_certs = certs.get();
   GetSlowTaskRunner()->PostTaskAndReply(
       FROM_HERE,
       base::Bind(&NSSCertDatabase::ListCertsImpl,
                  base::Passed(crypto::ScopedPK11Slot(PK11_ReferenceSlot(slot))),
                  base::Unretained(raw_certs)),
       base::Bind(callback, base::Passed(&certs)));
 }
 
 crypto::ScopedPK11Slot NSSCertDatabase::GetPublicSlot() const {
-  return crypto::ScopedPK11Slot(crypto::GetPersistentNSSKeySlot());
+  if (!persistent_slot_)
+    return crypto::ScopedPK11Slot();

[Ryan Sleevi, 2014/07/22 01:18:32]

Why is NULL valid? Requires updating the header files, but more importantly, I
think this is a breaking change and we should NEVER allow these to be NULL.

[pneubeck (no reviews), 2014/07/22 08:23:56]

Done.

Note that the DCHECK (PK11_REferenceSlot should crash on NULL) is here at the
usage site and not in the constructor, because the subclass
NSSCertDatabaseChromeOS overrides these to getters and doesn't use the
persistent_slot_.

+  return crypto::ScopedPK11Slot(PK11_ReferenceSlot(persistent_slot_.get()));
 }
 
 crypto::ScopedPK11Slot NSSCertDatabase::GetPrivateSlot() const {
-  return crypto::ScopedPK11Slot(crypto::GetPersistentNSSKeySlot());
+  if (!persistent_slot_)
+    return crypto::ScopedPK11Slot();
+  return crypto::ScopedPK11Slot(PK11_ReferenceSlot(persistent_slot_.get()));
 }
 
 CryptoModule* NSSCertDatabase::GetPublicModule() const {
   crypto::ScopedPK11Slot slot(GetPublicSlot());
   return CryptoModule::CreateFromHandle(slot.get());
 }
 
 CryptoModule* NSSCertDatabase::GetPrivateModule() const {
   crypto::ScopedPK11Slot slot(GetPrivateSlot());
   return CryptoModule::CreateFromHandle(slot.get());
@@ skipping 314 matching lines @@
   } else {
     if (SEC_DeletePermCertificate(cert->os_cert_handle())) {
       LOG(ERROR) << "SEC_DeletePermCertificate failed: " << PORT_GetError();
       return false;
     }
   }
   return true;
 }
 
 }  // namespace net