Interstitial options are not OR'd properly.

content/public/browser/content_browser_client.h

Index: content/public/browser/content_browser_client.h
diff --git a/content/public/browser/content_browser_client.h b/content/public/browser/content_browser_client.h
index 455bff9ead1581821fc3b5f1c0f104f8c73a8332..de76ce3507427278d06ea8fd9b7eb1861bc726ee 100644
--- a/content/public/browser/content_browser_client.h
+++ b/content/public/browser/content_browser_client.h
@@ -129,6 +129,12 @@ typedef ScopedVector<net::URLRequestInterceptor>
 // the observer interfaces.)
 class CONTENT_EXPORT ContentBrowserClient {
  public:
+  enum AllowCertErrorOptionsMask {

[Charlie Reis, 2014/09/19 20:00:12]

This should probably be in its own file in content/public/browser, since both
content/ and chrome/ code depend on it.

+    OVERRIDABLE = 1 << 0,

[Charlie Reis, 2014/09/19 20:00:12]

From the Content API guidelines:
"enum values should start with the name of the type, i.e. PAGE_TRANSITION_LINK
in the content::PageTransition enum"
http://www.chromium.org/developers/content-module/content-api

(We may want a better enum name in that case, like SSLCertErrorOptions?)

+    STRICT_ENFORCEMENT = 1 << 1,
+    EXPIRED_PREVIOUS_DECISION = 1 << 2
+  };
+
   virtual ~ContentBrowserClient() {}
 
   // Allows the embedder to set any number of custom BrowserMainParts
@@ -371,21 +377,20 @@ class CONTENT_EXPORT ContentBrowserClient {
   // Create and return a new quota permission context.
   virtual QuotaPermissionContext* CreateQuotaPermissionContext();
 
-  // Informs the embedder that a certificate error has occured.  If
-  // |overridable| is true and if |strict_enforcement| is false, the user
-  // can ignore the error and continue. The embedder can call the callback
+  // Informs the embedder that a certificate error has occured. |options_mask|
+  // must be a bitwise OR of AllowCertErrorOptionsMask values. If |options_mask|
+  // contains OVERRIDABLE and does not contain STRICT_ENFORCEMENT, the user can
+  // ignore the error and continue. The embedder can call the callback
   // asynchronously. If |result| is not set to
-  // CERTIFICATE_REQUEST_RESULT_TYPE_CONTINUE, the request will be cancelled
-  // or denied immediately, and the callback won't be run.
+  // CERTIFICATE_REQUEST_RESULT_TYPE_CONTINUE, the request will be cancelled or
+  // denied immediately, and the callback won't be run.
   virtual void AllowCertificateError(int render_process_id,
                                      int render_frame_id,
                                      int cert_error,
                                      const net::SSLInfo& ssl_info,
                                      const GURL& request_url,
                                      ResourceType resource_type,
-                                     bool overridable,
-                                     bool strict_enforcement,
-                                     bool expired_previous_decision,
+                                     int options_mask,
                                      const base::Callback<void(bool)>& callback,
                                      CertificateRequestResultType* result) {}