Remove DenyCertForHost from SSLHostStateDelegate API.

content/browser/ssl/ssl_policy.cc

Index: content/browser/ssl/ssl_policy.cc
diff --git a/content/browser/ssl/ssl_policy.cc b/content/browser/ssl/ssl_policy.cc
index 18fdde4dfe2bf9823e716ae01e48db73f1641fb8..ff0f7ce19e8243af980528017f56abf13eaa62aa 100644
--- a/content/browser/ssl/ssl_policy.cc
+++ b/content/browser/ssl/ssl_policy.cc
@@ -34,21 +34,20 @@ SSLPolicy::SSLPolicy(SSLPolicyBackend* backend)
 void SSLPolicy::OnCertError(SSLCertErrorHandler* handler) {
   bool expired_previous_decision;
   // First we check if we know the policy for this error.
-  net::CertPolicy::Judgment judgment =
+  SSLHostStateDelegate::CertJudgment judgment =
       backend_->QueryPolicy(handler->ssl_info().cert.get(),
                             handler->request_url().host(),
                             handler->cert_error(),
                             &expired_previous_decision);
 
-  if (judgment == net::CertPolicy::ALLOWED) {
+  if (judgment == SSLHostStateDelegate::ALLOWED) {
     handler->ContinueRequest();
     return;
   }
 
-  // The judgment is either DENIED or UNKNOWN.
-  // For now we handle the DENIED as the UNKNOWN, which means a blocking
-  // page is shown to the user every time he comes back to the page.
-
+  // The judgment must be UNKNOWN because QueryPolicy guarantees that it will

[Peter Kasting, 2014/09/03 23:02:55]

Update all comments that talk about UNKNOWN.  (There are several across a number
of files.)

[jww, 2014/09/03 23:33:49]

Whoops. Thought I had gotten them, but clearly not. Done.

+  // never return DENIED. For these hosts, a blocking page is shown to the user
+  // every time he comes back to the page.
   int options_mask = 0;
   switch (handler->cert_error()) {
     case net::ERR_CERT_COMMON_NAME_INVALID:
@@ -180,13 +179,6 @@ void SSLPolicy::OnAllowCertificate(scoped_refptr<SSLCertErrorHandler> handler,
     handler->ContinueRequest();
   } else {
     // Default behavior for rejecting a certificate.
-    //
-    // While DenyCertForHost() executes synchronously on this thread,
-    // CancelRequest() gets posted to a different thread. Calling
-    // DenyCertForHost() first ensures deterministic ordering.
-    backend_->DenyCertForHost(handler->ssl_info().cert.get(),
-                              handler->request_url().host(),
-                              handler->cert_error());
     handler->CancelRequest();
   }
 }