Change the bad-certificate handler for SSL (using NSS) to return an...

chrome/browser/ssl/ssl_policy.cc

Index: chrome/browser/ssl/ssl_policy.cc
===================================================================
--- chrome/browser/ssl/ssl_policy.cc	(revision 12708)
+++ chrome/browser/ssl/ssl_policy.cc	(working copy)
@@ -318,9 +318,13 @@
 
 void SSLPolicy::OnDenyCertificate(SSLManager::CertError* error) {
   // Default behavior for rejecting a certificate.
-  error->CancelRequest();
+  //
+  // While DenyCertForHost() executes synchronously on this thread,
+  // CancelRequest() gets posted to a different thread. Calling
+  // DenyCertForHost() first ensures deterministic ordering.
   error->manager()->DenyCertForHost(error->ssl_info().cert,
                                     error->request_url().host());
+  error->CancelRequest();
 }
 
 void SSLPolicy::OnAllowCertificate(SSLManager::CertError* error) {
@@ -330,9 +334,13 @@
   // new NavigationEntry will not be set until DidNavigate.  This is ok,
   // because the new NavigationEntry will have its max security style set
   // within DidNavigate.
-  error->ContinueRequest();
+  //
+  // While AllowCertForHost() executes synchronously on this thread,
+  // ContinueRequest() gets posted to a different thread. Calling
+  // AllowCertForHost() first ensures deterministic ordering.
   error->manager()->AllowCertForHost(error->ssl_info().cert,
                                      error->request_url().host());
+  error->ContinueRequest();
 }
 
 ////////////////////////////////////////////////////////////////////////////////