If easy sign-in is set up, allow TPMTokenLoader to start before login

crypto/nss_util.cc

Index: crypto/nss_util.cc
diff --git a/crypto/nss_util.cc b/crypto/nss_util.cc
index 02c932711968761233e0217bea0ccf3507ffbff6..49bd7dd7fb3e88d6dee755e5c20e60328373ad06 100644
--- a/crypto/nss_util.cc
+++ b/crypto/nss_util.cc
@@ -347,8 +347,7 @@ class NSSInitSingleton {
                        base::Unretained(this),  // NSSInitSingleton is leaky
                        callback,
                        base::Passed(&tpm_args)),
-            true /* task_is_slow */
-            )) {
+            true /* task_is_slow */)) {
       initializing_tpm_token_ = true;
     } else {
       base::MessageLoop::current()->PostTask(FROM_HERE,
@@ -507,8 +506,7 @@ class NSSInitSingleton {
                    base::Unretained(this),  // NSSInitSingleton is leaky
                    username_hash,
                    base::Passed(&tpm_args)),
-        true /* task_is_slow */
-        );
+        true /* task_is_slow */);
   }
 
   void OnInitializedTPMForChromeOSUser(const std::string& username_hash,
@@ -538,7 +536,7 @@ class NSSInitSingleton {
 
     if (username_hash.empty()) {
       DVLOG(2) << "empty username_hash";
-      return ScopedPK11Slot();
+      return ScopedPK11Slot(PK11_GetInternalKeySlot());

[pneubeck (no reviews), 2014/12/02 11:56:47]

the fact that you have to change this to make the CHECK in NSSCertDatabase
happy, indicates that we have still/again a conceptual problem here:

In my latest changes I tried to ensure clearer/stronger guarantees like
 1) username(_hash) always be non-empty
 2) NSSCertDatabase to guarantee slots to exist (so that consumers don't have to
clutter slot accesses if conditionals)

I still think that 1) is right and important. Just overloading an empty string
with some special semantics is error-prone. Wherever we need a 'signin-profile'
mode, we should make it explicit.
2) seems more arguable to me, and maybe you should better remove that CHECK
instead of modifying nss_util.cc. Did you explore that route?

     }
 
     if (chromeos_user_map_.find(username_hash) == chromeos_user_map_.end()) {