Remove the deprecated NSSCertDatabase::GetInstance() .

net/cert/nss_cert_database.h

Index: net/cert/nss_cert_database.h
diff --git a/net/cert/nss_cert_database.h b/net/cert/nss_cert_database.h
index 120e50da9bec7b214c731c8e53d101ce165f8210..c4e89f5aa4d03d70e2a834db78a4760550158c4e 100644
--- a/net/cert/nss_cert_database.h
+++ b/net/cert/nss_cert_database.h
@@ -20,7 +20,6 @@
 #include "net/cert/x509_certificate.h"
 
 namespace base {
-template <typename T> struct DefaultLazyInstanceTraits;
 class TaskRunner;
 }
 template <class ObserverType> class ObserverListThreadSafe;
@@ -35,7 +34,6 @@ typedef std::vector<scoped_refptr<CryptoModule> > CryptoModuleList;
 // singleton.
 class NET_EXPORT NSSCertDatabase {
  public:
-
   class NET_EXPORT Observer {
    public:
     virtual ~Observer() {}
@@ -102,8 +100,10 @@ class NET_EXPORT NSSCertDatabase {
 
   typedef base::Callback<void(bool)> DeleteCertCallback;
 
-  // DEPRECATED: See http://crbug.com/329735.
-  static NSSCertDatabase* GetInstance();
+  // Only exposed publicly for use in tests. Otherwise use the getter from
+  // nss_context.h.

[Ryan Sleevi, 2014/07/22 01:18:32]

Any chance of hiding this for future tests, and friending the tests explicitly?
Or having a bit in net_test_support that will create an NSSCertDatabase (which
is friended), and require callers go through it, which really ensures its
testing only (since only test targets can pull in net_test_support)

[pneubeck (no reviews), 2014/07/22 08:23:56]

I'd punt such a change into a separate CL and it should be consistent with
NSSCertDatabaseChromeOS (which currently has a public c'tor like after this
change).

Independent of when and how we change this. What do you suggest to protect
against? Once this class doesn't reference any global state (except NSS of
course), is it really likely that anybody will mistakenly use this constructor?


Regarding your proposal: not sure how you would whitelist the legitimate use in
chrome/browser/net/nss_context_linux.cc ?

+  explicit NSSCertDatabase(crypto::ScopedPK11Slot persistent_slot);
+  virtual ~NSSCertDatabase();
 
   // Get a list of unique certificates in the certificate database (one
   // instance of all certificates).
@@ -232,9 +232,6 @@ class NET_EXPORT NSSCertDatabase {
       const scoped_refptr<base::TaskRunner>& task_runner);
 
  protected:
-  NSSCertDatabase();
-  virtual ~NSSCertDatabase();
-
   // Certificate listing implementation used by |ListCerts*| and
   // |ListCertsSync|. Static so it may safely be used on the worker thread.
   // If |slot| is NULL, obtains the certs of all slots, otherwise only of
@@ -248,8 +245,6 @@ class NET_EXPORT NSSCertDatabase {
   scoped_refptr<base::TaskRunner> GetSlowTaskRunner() const;
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<NSSCertDatabase>;
-
   // Registers |observer| to receive notifications of certificate changes.  The
   // thread on which this is called is the thread on which |observer| will be
   // called back with notifications.
@@ -277,6 +272,8 @@ class NET_EXPORT NSSCertDatabase {
   // it may safely be used on the worker thread.
   static bool DeleteCertAndKeyImpl(scoped_refptr<X509Certificate> cert);
 
+  crypto::ScopedPK11Slot persistent_slot_;
+
   // A helper observer that forwards events from this database to CertDatabase.
   scoped_ptr<Observer> cert_notification_forwarder_;