net: don't duplicate HPKP hashes when parsing the header.

net/http/http_security_headers_unittest.cc

Index: net/http/http_security_headers_unittest.cc
diff --git a/net/http/http_security_headers_unittest.cc b/net/http/http_security_headers_unittest.cc
index 0cc81b57eb88128f1809b9a47736720e7ea1fe88..42a5ee9896062504e21575f23519983d5caa9652 100644
--- a/net/http/http_security_headers_unittest.cc
+++ b/net/http/http_security_headers_unittest.cc
@@ -416,6 +416,20 @@ static void TestValidPKPHeaders(HashValueTag tag) {
   expect_max_age = base::TimeDelta::FromSeconds(kMaxHSTSAgeSecs);
   EXPECT_EQ(expect_max_age, max_age);
   EXPECT_FALSE(include_subdomains);
+
+  // Test that parsing the same header twice doesn't duplicate the recorded
+  // hashes.
+  hashes.clear();
+  EXPECT_TRUE(ParseHPKPHeader(
+      "  max-age=999;  " +
+          backup_pin + ";" + good_pin + ";   ",
+      chain_hashes, &max_age, &include_subdomains, &hashes));
+  EXPECT_EQ(2u, hashes.size());
+  EXPECT_TRUE(ParseHPKPHeader(
+      "  max-age=999;  " +
+          backup_pin + ";" + good_pin + ";   ",
+      chain_hashes, &max_age, &include_subdomains, &hashes));
+  EXPECT_EQ(2u, hashes.size());
 }
 
 TEST_F(HttpSecurityHeadersTest, BogusPinsHeadersSHA1) {