Lock only permitted where a supervised user is or was.

chrome/browser/profiles/profile_window.cc

Index: chrome/browser/profiles/profile_window.cc
diff --git a/chrome/browser/profiles/profile_window.cc b/chrome/browser/profiles/profile_window.cc
index f2d44d4358c6eed2c4c1fb5a2d8560185e98537d..ef5a6109c3680c7c89e5da9564d8bd2161eb23df 100644
--- a/chrome/browser/profiles/profile_window.cc
+++ b/chrome/browser/profiles/profile_window.cc
@@ -311,11 +311,25 @@ void LockProfile(Profile* profile) {
 
 bool IsLockAvailable(Profile* profile) {
   DCHECK(profile);
+  if (!switches::IsNewProfileManagement())
+    return false;
+
   const std::string& hosted_domain = profile->GetPrefs()->
       GetString(prefs::kGoogleServicesHostedDomain);
-  return switches::IsNewProfileManagement() &&
-         (hosted_domain == Profile::kNoHostedDomainFound ||
-         hosted_domain == "google.com");
+  if (hosted_domain != Profile::kNoHostedDomainFound &&
+      hosted_domain != "google.com") {
+    return false;
+  }
+
+  size_t num_supervised_profiles = 0;
+  ProfileInfoCache* cache =
+      &g_browser_process->profile_manager()->GetProfileInfoCache();
+
+  for (size_t i = 0; i < cache->GetNumberOfProfiles(); ++i) {
+    if (cache->ProfileIsSupervisedAtIndex(i))
+      num_supervised_profiles++;

[noms (inactive), 2014/10/14 14:22:01]

nit: you can just return true here, and return false at the end. You don't
actually have to count all the profiles :)

[Mike Lerman, 2014/10/29 15:28:48]

Done.

+  }
+  return num_supervised_profiles > 0;
 }
 
 void CreateGuestProfileForUserManager(