Merge lp:~chrisccoulson/oxide/lp1504853 into lp:~oxide-developers/oxide/oxide.trunk

[Chris Coulson]

[lp:~chrisccoulson/oxide/lp1504853]

1218. By Chris Coulson on 2015-10-15

Remove spurious printf

1219. By Chris Coulson on 2015-10-15

Add missing file

1220. By Chris Coulson on 2015-10-15

Add missing file

1221. By Chris Coulson on 2015-10-20

Merge from trunk

1222. By Chris Coulson on 2015-10-21

Merge from trunk

1223. By Chris Coulson on 2015-10-21

Merge from trunk

1224. By Chris Coulson on 2015-10-21

Remove unnecessary DCHECK

1225. By Chris Coulson on 2015-10-21

Fix a test crash

1226. By Chris Coulson on 2015-10-21

Merge from trunk

1227. By Chris Coulson on 2015-10-21

Merge from trunk

1228. By Chris Coulson on 2015-10-21

Clean up WebFrameTreeObserver

=== modified file 'qt/core/api/oxideqcertificateerror.cc'
--- qt/core/api/oxideqcertificateerror.cc	2015-07-02 15:53:48 +0000
+++ qt/core/api/oxideqcertificateerror.cc	2015-10-21 20:26:37 +0000
@@ -27,8 +27,8 @@
 #include "base/macros.h"
 #include "net/cert/x509_certificate.h"
 
-#include "shared/browser/oxide_certificate_error.h"
 #include "shared/browser/oxide_security_types.h"
+#include "shared/browser/ssl/oxide_certificate_error.h"
 
 #include "oxideqsslcertificate_p.h"
 
@@ -58,7 +58,7 @@
     return;
   }
 
-  if (error_->is_cancelled()) {
+  if (error_->IsCancelled()) {
     qWarning() << "Cannot respond to a CertificateError that has been cancelled";
     return;
   }
@@ -138,7 +138,7 @@
 bool OxideQCertificateError::isCancelled() const {
   Q_D(const OxideQCertificateError);
 
-  return d->error_->is_cancelled();
+  return d->error_->IsCancelled();
 }
 
 bool OxideQCertificateError::isMainFrame() const {

=== modified file 'qt/core/browser/oxide_qt_web_view.cc'
--- qt/core/browser/oxide_qt_web_view.cc	2015-10-21 17:09:06 +0000
+++ qt/core/browser/oxide_qt_web_view.cc	2015-10-21 20:26:37 +0000
@@ -81,6 +81,8 @@
 #include "shared/browser/oxide_web_view.h"
 #include "shared/browser/permissions/oxide_permission_request.h"
 #include "shared/browser/permissions/oxide_permission_request_dispatcher.h"
+#include "shared/browser/ssl/oxide_certificate_error.h"
+#include "shared/browser/ssl/oxide_certificate_error_dispatcher.h"
 #include "shared/common/oxide_enum_flags.h"
 
 #include "oxide_qt_file_picker.h"
@@ -408,6 +410,8 @@
 void WebView::CommonInit(OxideQFindController* find_controller) {
   content::WebContents* contents = view_->GetWebContents();
 
+  oxide::CertificateErrorDispatcher::FromWebContents(
+      contents)->set_client(this);
   oxide::PermissionRequestDispatcher::FromWebContents(
       contents)->set_client(this);
   OxideQSecurityStatusPrivate::get(security_status_)->view = this;
@@ -854,14 +858,6 @@
   OxideQSecurityStatusPrivate::get(security_status_)->Update(old);
 }
 
-void WebView::OnCertificateError(scoped_ptr<oxide::CertificateError> error) {
-  scoped_ptr<OxideQCertificateError> qerror(
-      OxideQCertificateErrorPrivate::Create(error.Pass()));
-
-  // Embedder takes ownership of qerror
-  client_->CertificateError(qerror.release());
-}
-
 void WebView::ContentBlocked() {
   client_->ContentBlocked();
 }
@@ -952,6 +948,14 @@
   f->client()->LoadCommitted();
 }
 
+void WebView::OnCertificateError(scoped_ptr<oxide::CertificateError> error) {
+  scoped_ptr<OxideQCertificateError> qerror(
+      OxideQCertificateErrorPrivate::Create(error.Pass()));
+
+  // Embedder takes ownership of qerror
+  client_->CertificateError(qerror.release());
+}
+
 QUrl WebView::url() const {
   return QUrl(QString::fromStdString(view_->GetURL().spec()));
 }
@@ -1428,12 +1432,15 @@
 }
 
 WebView::~WebView() {
+  content::WebContents* contents = view_->GetWebContents();
+  oxide::CertificateErrorDispatcher::FromWebContents(
+      contents)->set_client(nullptr);
   DCHECK(frame_tree_torn_down_);
 
   input_method_context_->DetachClient();
 
   oxide::PermissionRequestDispatcher::FromWebContents(
-      view_->GetWebContents())->set_client(nullptr);
+      contents)->set_client(nullptr);
 }
 
 // static

=== modified file 'qt/core/browser/oxide_qt_web_view.h'
--- qt/core/browser/oxide_qt_web_view.h	2015-10-21 16:44:08 +0000
+++ qt/core/browser/oxide_qt_web_view.h	2015-10-21 20:26:37 +0000
@@ -34,6 +34,7 @@
 #include "shared/browser/oxide_web_view_client.h"
 #include "shared/browser/oxide_web_frame_tree_observer.h"
 #include "shared/browser/permissions/oxide_permission_request_dispatcher_client.h"
+#include "shared/browser/ssl/oxide_certificate_error_dispatcher_client.h"
 
 QT_BEGIN_NAMESPACE
 class QFocusEvent;
@@ -61,6 +62,7 @@
                 public oxide::WebViewClient,
                 public oxide::PermissionRequestDispatcherClient,
                 public oxide::WebFrameTreeObserver,
+                public oxide::CertificateErrorDispatcherClient,
                 public WebViewProxy {
  public:
   WebView(WebViewProxyClient* client,
@@ -166,7 +168,6 @@
   oxide::InputMethodContext* GetInputMethodContext() const override;
   void UpdateCursor(const content::WebCursor& cursor) override;
   void SecurityStatusChanged(const oxide::SecurityStatus& old) override;
-  void OnCertificateError(scoped_ptr<oxide::CertificateError> error) override;
   void ContentBlocked() override;
   void PrepareToCloseResponseReceived(bool proceed) override;
   void CloseRequested() override;
@@ -189,6 +190,9 @@
   void FrameDeleted(oxide::WebFrame* frame) override;
   void LoadCommittedInFrame(oxide::WebFrame* frame) override;
 
+  // oxide::CertificateErrorDispatcherClient implementation
+  void OnCertificateError(scoped_ptr<oxide::CertificateError> error) override;
+
   // WebViewProxy implementation
   QUrl url() const override;
   void setUrl(const QUrl& url) override;

=== modified file 'qt/tests/qmltests/ssl/tst_CertificateError.qml'
--- qt/tests/qmltests/ssl/tst_CertificateError.qml	2015-06-22 22:57:01 +0000
+++ qt/tests/qmltests/ssl/tst_CertificateError.qml	2015-10-21 20:26:37 +0000
@@ -19,11 +19,22 @@
     signalName: "cancelled"
   }
 
+  SignalSpy {
+    id: urlSpy
+    target: webView
+    signalName: "urlChanged"
+  }
+
+  SignalSpy {
+    id: titleSpy
+    target: webView
+    signalName: "titleChanged"
+  }
+
   property var certError: null
 
   onCertificateError: {
     if (certError) {
-      error.allow();
       return;
     }
     certError = error;
@@ -38,23 +49,16 @@
       spy.clear();
       cancelSpy.target = null;
       cancelSpy.clear();
+      urlSpy.clear();
+      titleSpy.clear();
       certError = null;
       webView.clearLoadEventCounters();
     }
 
-    function test_CertificateError1_denials_data() {
+    function test_CertificateError1_subresource_deny_data() {
       function _verify_1() {
         // This verifies that either there is no document or it is an error page
         try {
-          compare(webView.getTestApi().documentURI, "data:text/html,chromewebdata");
-        } catch(e) {
-          compare(e.error, ScriptMessageRequest.ErrorDestinationNotFound);
-        }
-      }
-
-      function _verify_2() {
-        // This verifies that either there is no document or it is an error page
-        try {
           compare(webView.getTestApiForFrame(webView.rootFrame.childFrames[0]).documentURI,
                   "data:text/html,chromewebdata");
         } catch(e) {
@@ -62,15 +66,15 @@
         }
       }
 
+      function _verify_2() {
+        var colour = webView.getTestApi().evaluateCode("
+var elem = document.getElementById(\"foo\");
+var style = window.getComputedStyle(elem);
+return style.getPropertyValue(\"color\");", true);
+        compare(colour, "rgb(0, 0, 0)");
+      }
+
       function _verify_3() {
-        var colour = webView.getTestApi().evaluateCode("
-var elem = document.getElementById(\"foo\");
-var style = window.getComputedStyle(elem);
-return style.getPropertyValue(\"color\");", true);
-        compare(colour, "rgb(0, 0, 0)");
-      }
-
-      function _verify_4() {
         var colour = webView.getTestApiForFrame(webView.rootFrame.childFrames[0]).evaluateCode("
 var elem = document.getElementById(\"foo\");
 var style = window.getComputedStyle(elem);
@@ -81,234 +85,342 @@
       // FIXME: Test overridable and strictEnforcement properties
       return [
         {
-          loadUrl: "https://expired.testsuite/tst_CertificateError_broken_iframe.html",
-          url: "https://expired.testsuite/tst_CertificateError_broken_iframe.html",
-          mainframe: true, subresource: false, overridable: true,
-          strictEnforcement: false, error: CertificateError.ErrorExpired,
-          certificate: "df17c8da033e2d5ed64d1f187fdf419e1fc68e47",
-          verifyFunc: _verify_1
-        },
-        {
           loadUrl: "https://testsuite/tst_CertificateError_broken_iframe.html",
           url: "https://selfsigned.testsuite/empty.html",
-          mainframe: false, subresource: false, overridable: false,
+          mainframe: false, subresource: false,
           strictEnforcement: false, error: CertificateError.ErrorAuthorityInvalid,
           certificate: "f0357f544e27adaa51211663a28cc8d64b057e63",
+          verifyFunc: _verify_1
+        },
+        {
+          loadUrl: "https://testsuite/tst_CertificateError_broken_subresource.html",
+          url: "https://badidentity.testsuite/tst_CertificateError_broken_subresource.css",
+          mainframe: true, subresource: true,
+          strictEnforcement: false, error: CertificateError.ErrorBadIdentity,
+          certificate: "89c5760286e897ad32b9dd500d70755e1e026588",
           verifyFunc: _verify_2
         },
         {
-          loadUrl: "https://testsuite/tst_CertificateError_broken_subresource.html",
+          loadUrl: "https://testsuite/tst_CertificateError_broken_subresource_in_iframe.html",
           url: "https://badidentity.testsuite/tst_CertificateError_broken_subresource.css",
-          mainframe: true, subresource: true, overridable: false,
+          mainframe: false, subresource: true,
           strictEnforcement: false, error: CertificateError.ErrorBadIdentity,
           certificate: "89c5760286e897ad32b9dd500d70755e1e026588",
           verifyFunc: _verify_3
-        },
-        {
-          loadUrl: "https://testsuite/tst_CertificateError_broken_subresource_in_iframe.html",
-          url: "https://badidentity.testsuite/tst_CertificateError_broken_subresource.css",
-          mainframe: false, subresource: true, overridable: false,
-          strictEnforcement: false, error: CertificateError.ErrorBadIdentity,
-          certificate: "89c5760286e897ad32b9dd500d70755e1e026588",
-          verifyFunc: _verify_4
         }
       ];
     }
 
-    // Verify that CertificateError.deny() works correctly, and check that other
-    // properties behave as expected
-    function test_CertificateError1_denials(data) {
+    // This tests CertificateError for various subresource errors, and verifies
+    // that those subresources are always blocked
+    function test_CertificateError1_subresource_deny(data) {
       webView.url = data.loadUrl;
+      verify(webView.waitForLoadSucceeded());
+
       spy.wait();
 
+      if (!data.mainframe) {
+        // This is a bit of a hack, but we don't have another event we can
+        // fire off for subframe loads
+        wait(100);
+      }
+
       compare(certError.url, data.url);
       verify(!certError.isCancelled);
       compare(certError.isMainFrame, data.mainframe);
       compare(certError.isSubresource, data.subresource);
+      compare(certError.overridable, false);
+      compare(certError.strictEnforcement, data.strictEnforcement);
+      compare(certError.certError, data.error);
+      compare(certError.certificate.fingerprintSHA1, data.certificate);
+
+      compare(webView.url, data.loadUrl);
+
+      compare(webView.securityStatus.securityLevel,SecurityStatus.SecurityLevelSecure);
+      compare(webView.securityStatus.contentStatus, SecurityStatus.ContentStatusNormal);
+      compare(webView.securityStatus.certStatus, SecurityStatus.CertStatusOk);
+
+      data.verifyFunc();
+
+      // There's nothing to deny, but it shouldn't crash
+      certError.deny();
+    }
+
+    function test_CertificateError2_mainframe_deny_data() {
+      function _verify_1() {
+        // This verifies that the old document still exists
+        compare(webView.getTestApi().documentURI, "https://testsuite/tst_CertificateError_initial.html");
+      }
+
+      // FIXME: Test non-overridable errors too
+      return [
+        {
+          loadUrl: "https://expired.testsuite/empty.html",
+          overridable: true,
+          strictEnforcement: false, error: CertificateError.ErrorExpired,
+          certificate: "df17c8da033e2d5ed64d1f187fdf419e1fc68e47",
+          verifyFunc: _verify_1
+        },
+      ];
+
+    }
+
+    // This test CertificateError for main frame errors, and verifies that
+    // calling deny() blocks them
+    function test_CertificateError2_mainframe_deny(data) {
+      webView.url = "https://testsuite/tst_CertificateError_initial.html";
+      verify(webView.waitForLoadSucceeded());
+
+      compare(webView.title, "Test");
+
+      webView.clearLoadEventCounters();
+      titleSpy.clear();
+
+      webView.url = data.loadUrl;
+      spy.wait();
+      titleSpy.wait();
+      if (!data.overridable) {
+        verify(webView.waitForLoadStopped());
+      }
+
+      compare(certError.url, data.loadUrl);
+      verify(!certError.isCancelled);
+      compare(certError.isMainFrame, true);
+      compare(certError.isSubresource, false);
       compare(certError.overridable, data.overridable);
       compare(certError.strictEnforcement, data.strictEnforcement);
       compare(certError.certError, data.error);
       compare(certError.certificate.fingerprintSHA1, data.certificate);
 
+      compare(webView.loadsStartedCount, 1);
+      compare(webView.loadsCommittedCount, 0);
+      compare(webView.loadsFailedCount, 0);
+      compare(webView.loadsSucceededCount, 0);
+
+      // WebView.url should indicate the URL of the failing resource even for
+      // non-overridable errors, as we show a placeholder transient page
+      compare(webView.url, data.loadUrl);
+      compare(webView.title, data.loadUrl);
+
+      data.verifyFunc();
+
+      urlSpy.clear();
+      titleSpy.clear();
+
       certError.deny();
 
-      if (data.mainframe && !data.subresource) {
-        verify(webView.waitForLoadStopped());
-        compare(webView.loadsFailedCount, 0);
-        compare(webView.loadsStoppedCount, 1);
-        compare(webView.loadsSucceededCount, 0);
-      } else {
+      if (data.overridable) {
+        verify(webView.waitForLoadStopped());
+      }
+      urlSpy.wait();
+      titleSpy.wait();
+
+      compare(webView.url, "https://testsuite/tst_CertificateError_initial.html");
+      compare(webView.title, "Test");
+
+      data.verifyFunc();
+    }
+
+    function test_CertificateError3_subresource_allow_data() {
+      function _verify_1() {
+        // This verifies that either there is no document or it is an error page
+        try {
+          compare(webView.getTestApiForFrame(webView.rootFrame.childFrames[0]).documentURI,
+                  "data:text/html,chromewebdata");
+        } catch(e) {
+          compare(e.error, ScriptMessageRequest.ErrorDestinationNotFound);
+        }
+      }
+
+      function _verify_2() {
+        var colour = webView.getTestApi().evaluateCode("
+var elem = document.getElementById(\"foo\");
+var style = window.getComputedStyle(elem);
+return style.getPropertyValue(\"color\");", true);
+        compare(colour, "rgb(0, 0, 0)");
+      }
+
+      function _verify_3() {
+        var colour = webView.getTestApiForFrame(webView.rootFrame.childFrames[0]).evaluateCode("
+var elem = document.getElementById(\"foo\");
+var style = window.getComputedStyle(elem);
+return style.getPropertyValue(\"color\");", true);
+        compare(colour, "rgb(0, 0, 0)");
+      }
+
+      return [
+        {
+          loadUrl: "https://testsuite/tst_CertificateError_broken_iframe.html",
+          verifyFunc: _verify_1
+        },
+        {
+          loadUrl: "https://testsuite/tst_CertificateError_broken_subresource.html",
+          verifyFunc: _verify_2
+        },
+        {
+          loadUrl: "https://testsuite/tst_CertificateError_broken_subresource_in_iframe.html",
+          verifyFunc: _verify_3
+        }
+      ];
+    }
+
+    // Verifies that calling allow() on subresource errors cannot override
+    // them
+    function test_CertificateError3_subresource_allow(data) {
+      webView.url = data.loadUrl;
+      verify(webView.waitForLoadSucceeded());
+
+      spy.wait();
+
+      certError.allow();
+
+      // This is a bit of a hack, but we don't have another event we can fire off
+      wait(100);
+
+      data.verifyFunc();
+    }
+
+    function test_CertificateError4_mainframe_allow_data() {
+      function _verify_1() {
+        compare(webView.getTestApi().documentURI, "https://expired.testsuite/empty.html");
+      }
+
+      // FIXME: Test non-overridable errors too
+      return [
+        {
+          loadUrl: "https://expired.testsuite/empty.html",
+          overridable: true, verifyFunc: _verify_1
+        },
+      ];
+    }
+
+    // Verifies that calling allow() on overridable main frame errors allows
+    // the page to continue loading
+    function test_CertificateError4_mainframe_allow(data) {
+      webView.url = "https://testsuite/tst_CertificateError_initial.html";
+      verify(webView.waitForLoadSucceeded());
+
+      webView.clearLoadEventCounters();
+
+      webView.url = data.loadUrl;
+      spy.wait();
+      if (!data.overridable) {
+        verify(webView.waitForLoadStopped());
+      }
+
+      compare(webView.loadsStartedCount, 1);
+      compare(webView.loadsCommittedCount, 0);
+      compare(webView.loadsFailedCount, 0);
+      compare(webView.loadsSucceededCount, 0);
+
+      certError.allow();
+
+      if (data.overridable) {
         verify(webView.waitForLoadSucceeded());
-        if (!data.mainframe) {
-          // This is a bit of a hack, but we don't have another event we can
-          // fire off for subframe loads
-          wait(100);
-        }
-      }
-
-      compare(webView.securityStatus.securityLevel,
-              data.mainframe && !data.subresource ?
-                  SecurityStatus.SecurityLevelNone : SecurityStatus.SecurityLevelSecure);
-      compare(webView.securityStatus.contentStatus, SecurityStatus.ContentStatusNormal);
-      compare(webView.securityStatus.certStatus, SecurityStatus.CertStatusOk);
-
-      data.verifyFunc();
-    }
-
-    function test_CertificateError2_allow_data() {
-      function _verify_1() {
-        compare(webView.getTestApi().documentURI, "https://expired.testsuite/tst_CertificateError_broken_iframe.html");
-      }
-
-      function _verify_2() {
-        // This verifies that either there is no document or it is an error page
-        try {
-          compare(webView.getTestApiForFrame(webView.rootFrame.childFrames[0]).documentURI,
-                  "data:text/html,chromewebdata");
-        } catch(e) {
-          compare(e.error, ScriptMessageRequest.ErrorDestinationNotFound);
-        }
-      }
-
-      function _verify_3() {
-        var colour = webView.getTestApi().evaluateCode("
-var elem = document.getElementById(\"foo\");
-var style = window.getComputedStyle(elem);
-return style.getPropertyValue(\"color\");", true);
-        compare(colour, "rgb(0, 0, 0)");
-      }
-
-      function _verify_4() {
-        var colour = webView.getTestApiForFrame(webView.rootFrame.childFrames[0]).evaluateCode("
-var elem = document.getElementById(\"foo\");
-var style = window.getComputedStyle(elem);
-return style.getPropertyValue(\"color\");", true);
-        compare(colour, "rgb(0, 0, 0)");
-      }
-
-      return [
-        {
-          loadUrl: "https://expired.testsuite/tst_CertificateError_broken_iframe.html",
-          mainframe: true, overridable: true, verifyFunc: _verify_1
-        },
-        {
-          loadUrl: "https://testsuite/tst_CertificateError_broken_iframe.html",
-          mainframe: false, overridable: false, verifyFunc: _verify_2
-        },
-        {
-          loadUrl: "https://testsuite/tst_CertificateError_broken_subresource.html",
-          mainframe: false, overridable: false, verifyFunc: _verify_3
-        },
-        {
-          loadUrl: "https://testsuite/tst_CertificateError_broken_subresource_in_iframe.html",
-          mainframe: false, overridable: false, verifyFunc: _verify_4
-        }
-      ];
-    }
-
-    // Verify that CertificateError.allow works correctly for overridable errors
-    function test_CertificateError2_allow(data) {
-      webView.url = data.loadUrl;
-      spy.wait();
-
-      certError.allow();
-
-      verify(webView.waitForLoadSucceeded());
-
-      if (data.mainframe) {
-        compare(webView.loadsFailedCount, 0);
-        compare(webView.loadsStoppedCount, 0);
-        compare(webView.loadsSucceededCount, 1);
-      } else {
-        // This is a bit of a hack, but we don't have another event we can fire off
-        wait(100);
-      }
-
-      data.verifyFunc();
-    }
-
-    function test_CertificateError3_cancellation_data() {
-      // Test that starting a new load cancels pending frame errors
-      function _action_1() {
-        webView.url = "http://testsuite/empty.html";
-        verify(webView.waitForLoadStarted());
-      }
-
-      // Test that stopping a load cancels pending frame errors
-      function _action_2() {
-        webView.stop();
-        verify(webView.waitForLoadStopped());
-      }
-
-      // Test that committing a load cancels non-overridable frame errors
-      function _action_3() {
-        var frame = webView.rootFrame.childFrames[0];
-        webView.getTestApiForFrame(frame).evaluateCode(
-            "window.location = \"https://testsuite/empty.html\";",
-            true);
-        TestUtils.waitFor(function() { return frame.url == "https://testsuite/empty.html" });
-      }
-
-      // Test that deleting a frame cancels errors
-      function _action_4() {
-        var frame = webView.rootFrame.childFrames[0];
-        var obs = Utils.createDestructionObserver(frame);
-        webView.getTestApi().evaluateCode("
-var f = document.getElementsByTagName(\"iframe\")[0];
-f.parentElement.removeChild(f);", true);
-        TestUtils.waitFor(function() { return obs.destroyed; });
-      }
-
-      // Test that interrupting a load before it's committed doesn't cancel
-      // subresource errors
-      function _action_5() {
-        var savedError = certError;
-        certError = null;
-
-        webView.url = "https://expired.testsuite/empty.html";
-        spy.wait();
-        webView.stop();
-        verify(webView.waitForLoadStopped());
-
-        certError = savedError;
-      }
-
-      // Test that committing a load cancels subresource errors
-      function _action_6() {
-        webView.url = "https://testsuite/empty.html";
-        verify(webView.waitForLoadCommitted());
-      }
-
-      return [
-        { url: "https://expired.testsuite/tst_CertificateError_broken_iframe.html",
-          action: _action_1, expectCancel: true },
-        { url: "https://expired.testsuite/tst_CertificateError_broken_iframe.html",
-          action: _action_2, expectCancel: true },
-        { url: "https://testsuite/tst_CertificateError_broken_iframe.html",
-          action: _action_3, expectCancel: true },
-        { url: "https://testsuite/tst_CertificateError_broken_iframe.html",
-          action: _action_4, expectCancel: true },
-        { url: "https://testsuite/tst_CertificateError_broken_subresource.html",
-          action: _action_5, expectCancel: false },
-        { url: "https://testsuite/tst_CertificateError_broken_subresource.html",
-          action: _action_6, expectCancel: true }
-      ];
-    }
-
-    // Verify that CertificateError cancellation works as expected
-    function test_CertificateError3_cancellation(data) {
-      webView.url = data.url;
-      spy.wait();
-
-      verify(!certError.isCancelled);
-
-      cancelSpy.target = certError;
-
-      webView.clearLoadEventCounters();
-      data.action();
-
-      compare(certError.isCancelled, data.expectCancel);
-      compare(cancelSpy.count, data.expectCancel ? 1 : 0);
+      }
+
+      data.verifyFunc();
+    }
+
+    function test_CertificateError5_cancellation_browser_initiated_navigation_data() {
+      // Test non-overridable too
+      return [
+        { loadUrl: "https://badidentity.testsuite/empty.html", overridable: true }
+      ];
+    }
+
+    // Verify that main frame errors are cancelled on a browser-initiated navigation
+    function test_CertificateError5_cancellation_browser_initiated_navigation(data) {
+      webView.url = "https://testsuite/empty.html";
+      verify(webView.waitForLoadSucceeded());
+
+      webView.url = data.loadUrl;
+      spy.wait();
+      if (!data.overridable) {
+        verify(webView.waitForLoadStopped());
+      }
+
+      cancelSpy.target = certError;
+      verify(!certError.isCancelled);
+
+      webView.clearLoadEventCounters();
+
+      webView.url = "https://foo.testsuite/empty.html";
+      verify(webView.waitForLoadCommitted());
+
+      compare(cancelSpy.count, 1);
+      verify(certError.isCancelled);
+
+      verify(webView.waitForLoadSucceeded());
+      compare(webView.url, "https://foo.testsuite/empty.html");
+    }
+
+    function test_CertificateError6_cancellation_history_navigation_data() {
+      return test_CertificateError5_cancellation_browser_initiated_navigation_data();
+    }
+
+    function test_CertificateError6_cancellation_history_navigation(data) {
+      webView.url = "https://testsuite/empty.html";
+      verify(webView.waitForLoadSucceeded());
+
+      webView.url = data.loadUrl;
+      spy.wait();
+      if (!data.overridable) {
+        verify(webView.waitForLoadStopped());
+      }
+
+      cancelSpy.target = certError;
+      verify(!certError.isCancelled);
+
+      urlSpy.clear();
+
+      // FIXME(chrisccoulson): The test fails without the delay - cancellation
+      //  never happens. I suspect this is because we go back before getting
+      //  the commit from the renderer, which means that the interstitial is
+      //  not attached to the WebContents and DontProceed doesn't get called
+      wait(100);
+
+      webView.goBack();
+      // There's no new load here, so just wait for the URL to change back
+      urlSpy.wait();
+      cancelSpy.wait();
+
+      compare(cancelSpy.count, 1);
+      verify(certError.isCancelled);
+      compare(webView.url, "https://testsuite/empty.html");
+    }
+
+    function test_CertificateError7_content_initiated_navigation_data() {
+      return test_CertificateError5_cancellation_browser_initiated_navigation_data();
+    }
+
+    function test_CertificateError7_content_initiated_navigation(data) {
+      webView.url = "https://testsuite/tst_CertificateError_initial.html";
+      verify(webView.waitForLoadSucceeded());
+
+      urlSpy.clear();
+      titleSpy.clear();
+      webView.clearLoadEventCounters();
+
+      webView.getTestApi().evaluateCode("window.location = \"" + data.loadUrl + "\";");
+      spy.wait();
+      urlSpy.wait();
+      titleSpy.wait();
+      if (!data.overridable) {
+        verify(webView.waitForLoadStopped());
+      }
+
+      compare(webView.loadsStartedCount, 1);
+      compare(webView.loadsCommittedCount, 0);
+      compare(webView.loadsFailedCount, 0);
+      compare(webView.loadsSucceededCount, 0);
+
+      compare(webView.url, data.loadUrl);
+      compare(webView.loadsStartedCount, 1);
+      compare(webView.loadsCommittedCount, 0);
+      compare(webView.loadsFailedCount, 0);
+      compare(webView.loadsSucceededCount, 0);
+      compare(webView.title, data.loadUrl);
     }
   }
 }

=== added file 'qt/tests/qmltests/ssl/tst_CertificateError_initial.html'
--- qt/tests/qmltests/ssl/tst_CertificateError_initial.html	1970-01-01 00:00:00 +0000
+++ qt/tests/qmltests/ssl/tst_CertificateError_initial.html	2015-10-21 20:26:37 +0000
@@ -0,0 +1,5 @@
+<html>
+<head>
+  <title>Test</title>
+</head>
+</html>

=== modified file 'shared/browser/oxide_content_browser_client.cc'
--- shared/browser/oxide_content_browser_client.cc	2015-10-07 01:36:57 +0000
+++ shared/browser/oxide_content_browser_client.cc	2015-10-21 20:26:37 +0000
@@ -36,6 +36,7 @@
 #include "shared/browser/compositor/oxide_compositor_utils.h"
 #include "shared/browser/media/oxide_media_capture_devices_dispatcher.h"
 #include "shared/browser/notifications/oxide_platform_notification_service.h"
+#include "shared/browser/ssl/oxide_certificate_error_dispatcher.h"
 #include "shared/common/oxide_constants.h"
 #include "shared/common/oxide_content_client.h"
 #include "shared/common/oxide_form_factor.h"
@@ -169,25 +170,16 @@
     bool expired_previous_decision,
     const base::Callback<void(bool)>& callback,
     content::CertificateRequestResultType* result) {
-  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
-
-  content::RenderFrameHost* rfh = content::RenderFrameHost::FromID(
-      render_process_id, render_frame_id);
-  if (!rfh) {
-    *result = content::CERTIFICATE_REQUEST_RESULT_TYPE_CANCEL;
-    return;
-  }
-
-  WebView* webview = WebView::FromRenderFrameHost(rfh);
-  if (!webview) {
-    *result = content::CERTIFICATE_REQUEST_RESULT_TYPE_CANCEL;
-    return;
-  }
-
-  webview->AllowCertificateError(rfh, cert_error, ssl_info, request_url,
-                                 resource_type, overridable,
-                                 strict_enforcement, callback,
-                                 result);
+  CertificateErrorDispatcher::AllowCertificateError(render_process_id,
+                                                    render_frame_id,
+                                                    cert_error,
+                                                    ssl_info,
+                                                    request_url,
+                                                    resource_type,
+                                                    overridable,
+                                                    strict_enforcement,
+                                                    callback,
+                                                    result);
 }
 
 content::MediaObserver* ContentBrowserClient::GetMediaObserver() {
@@ -241,7 +233,13 @@
   WebViewContentsHelper* contents_helper =
       WebViewContentsHelper::FromRenderViewHost(render_view_host);
 
-  WebPreferences* web_prefs = contents_helper->GetWebPreferences();
+  WebPreferences* web_prefs = nullptr;
+  if (contents_helper) {
+    // If RVH is for an InterstitialPage, we can't map to WebContents
+    // XXX: If we ever expose transient pages in the public API, we should find
+    //  a way around this, so that transient pages get the same preferences
+    web_prefs = contents_helper->GetWebPreferences();
+  }
   if (!web_prefs) {
     web_prefs = WebPreferences::GetFallback();
   }
@@ -253,7 +251,9 @@
   prefs->device_supports_touch = platform_integration_->IsTouchSupported();
 
   prefs->javascript_can_open_windows_automatically =
-      !contents_helper->GetBrowserContext()->IsPopupBlockerEnabled();
+      !BrowserContext::FromContent(
+        render_view_host->GetProcess()->GetBrowserContext())
+        ->IsPopupBlockerEnabled();
 
   FormFactor form_factor = GetFormFactorHint();
   if (form_factor == FORM_FACTOR_TABLET || form_factor == FORM_FACTOR_PHONE) {

=== modified file 'shared/browser/oxide_web_frame_tree.cc'
--- shared/browser/oxide_web_frame_tree.cc	2015-10-16 21:36:30 +0000
+++ shared/browser/oxide_web_frame_tree.cc	2015-10-21 20:26:37 +0000
@@ -83,6 +83,12 @@
     return;
   }
 
+  if (!content::WebContents::FromRenderFrameHost(old_host)) {
+    // This is from an interstitial
+    // XXX(chrisccoulson): Is there a better way to detect this?
+    return;
+  }
+
   WebFrame* frame = WebFrame::FromRenderFrameHost(old_host);
   DCHECK(frame);
 

=== modified file 'shared/browser/oxide_web_view.cc'
--- shared/browser/oxide_web_view.cc	2015-10-21 20:14:13 +0000
+++ shared/browser/oxide_web_view.cc	2015-10-21 20:26:37 +0000
@@ -75,6 +75,7 @@
 #include "shared/browser/media/oxide_media_capture_devices_dispatcher.h"
 #include "shared/browser/permissions/oxide_permission_request_dispatcher.h"
 #include "shared/browser/permissions/oxide_temporary_saved_permission_context.h"
+#include "shared/browser/ssl/oxide_certificate_error_dispatcher.h"
 #include "shared/common/oxide_content_client.h"
 #include "shared/common/oxide_enum_flags.h"
 #include "shared/common/oxide_messages.h"
@@ -137,6 +138,7 @@
 void CreateHelpers(content::WebContents* contents,
                    content::WebContents* opener = nullptr) {
   new WebViewContentsHelper(contents, opener);
+  CertificateErrorDispatcher::CreateForWebContents(contents);
   PermissionRequestDispatcher::CreateForWebContents(contents);
   ScriptMessageContentsHelper::CreateForWebContents(contents);
 #if defined(ENABLE_MEDIAHUB)
@@ -850,22 +852,6 @@
   return status == TEMPORARY_SAVED_PERMISSION_STATUS_ALLOWED;
 }
 
-void WebView::RenderFrameDeleted(content::RenderFrameHost* render_frame_host) {
-  // XXX(chrisccoulson): Make CertificateErrorManager a WebContentsObserver so
-  // that we can get rid of this
-  certificate_error_manager_.FrameDetached(render_frame_host);
-}
-
-void WebView::RenderFrameHostChanged(content::RenderFrameHost* old_host,
-                                     content::RenderFrameHost* new_host) {
-  // XXX(chrisccoulson): Make CertificateErrorManager a WebContentsObserver so
-  // that we can get rid of this
-  if (!old_host) {
-    return;
-  }
-  certificate_error_manager_.FrameDetached(old_host);
-}
-
 void WebView::RenderViewReady() {
   client_->CrashedStatusChanged();
 }
@@ -951,14 +937,11 @@
     return;
   }
 
-  if (!render_frame_host->GetParent()) {
-    client_->LoadStarted(validated_url);
+  if (render_frame_host->GetParent()) {
+    return;
   }
 
-  // XXX(chrisccoulson): Make CertificateErrorManager a WebContentsObserver so
-  // that we can get rid of this
-  certificate_error_manager_.DidStartProvisionalLoadForFrame(
-      render_frame_host);
+  client_->LoadStarted(validated_url);
 }
 
 void WebView::DidCommitProvisionalLoadForFrame(
@@ -982,18 +965,15 @@
     int error_code,
     const base::string16& error_description,
     bool was_ignored_by_handler) {
-  if (!render_frame_host->GetParent() &&
-      validated_url.spec() != content::kUnreachableWebDataURL) {
-    DispatchLoadFailed(validated_url, error_code, error_description, true);
-  }
-
-  if (error_code != net::ERR_ABORTED) {
-    return;
-  }
-
-  // XXX(chrisccoulson): Make CertificateErrorManager a WebContentsObserverso
-  // that we can get rid of this
-  certificate_error_manager_.DidStopProvisionalLoadForFrame(render_frame_host);
+  if (render_frame_host->GetParent()) {
+    return;
+  }
+
+  if (validated_url.spec() == content::kUnreachableWebDataURL) {
+    return;
+  }
+
+  DispatchLoadFailed(validated_url, error_code, error_description, true);
 }
 
 void WebView::DidNavigateMainFrame(
@@ -1010,18 +990,6 @@
   }
 }
 
-void WebView::DidNavigateAnyFrame(
-    content::RenderFrameHost* render_frame_host,
-    const content::LoadCommittedDetails& details,
-    const content::FrameNavigateParams& params) {
-  // XXX(chrisccoulson): Make CertificateErrorManager a WebContentsObserver
-  if (details.is_in_page) {
-    return;
-  }
-
-  certificate_error_manager_.DidNavigateFrame(render_frame_host);
-}
-
 void WebView::DidGetRedirectForResourceRequest(
       content::RenderFrameHost* render_frame_host,
       const content::ResourceRedirectDetails& details) {
@@ -1205,12 +1173,24 @@
 
 // static
 WebView* WebView::FromRenderViewHost(content::RenderViewHost* rvh) {
-  return FromWebContents(content::WebContents::FromRenderViewHost(rvh));
+  content::WebContents* contents =
+      content::WebContents::FromRenderViewHost(rvh);
+  if (!contents) {
+    return nullptr;
+  }
+
+  return FromWebContents(contents);
 }
 
 // static
 WebView* WebView::FromRenderFrameHost(content::RenderFrameHost* rfh) {
-  return FromWebContents(content::WebContents::FromRenderFrameHost(rfh));
+  content::WebContents* contents =
+      content::WebContents::FromRenderFrameHost(rfh);
+  if (!contents) {
+    return nullptr;
+  }
+
+  return FromWebContents(contents);
 }
 
 const GURL& WebView::GetURL() const {
@@ -1663,38 +1643,6 @@
   web_contents_->DispatchBeforeUnload(false);
 }
 
-void WebView::AllowCertificateError(
-    content::RenderFrameHost* rfh,
-    int cert_error,
-    const net::SSLInfo& ssl_info,
-    const GURL& request_url,
-    content::ResourceType resource_type,
-    bool overridable,
-    bool strict_enforcement,
-    const base::Callback<void(bool)>& callback,
-    content::CertificateRequestResultType* result) {
-  // We can't safely allow the embedder to override errors for subresources or
-  // subframes because they don't always result in the API indicating a
-  // degraded security level. Mark these non-overridable for now and just
-  // deny them outright
-  // See https://launchpad.net/bugs/1368385
-  if (!overridable || resource_type != content::RESOURCE_TYPE_MAIN_FRAME) {
-    overridable = false;
-    *result = content::CERTIFICATE_REQUEST_RESULT_TYPE_DENY;
-  }
-
-  scoped_ptr<CertificateError> error(new CertificateError(
-      &certificate_error_manager_,
-      rfh,
-      cert_error,
-      ssl_info,
-      request_url,
-      resource_type,
-      strict_enforcement,
-      overridable ? callback : base::Callback<void(bool)>()));
-  client_->OnCertificateError(error.Pass());
-}
-
 void WebView::HandleKeyEvent(const content::NativeWebKeyboardEvent& event) {
   content::RenderViewHost* rvh = GetRenderViewHost();
   if (!rvh) {

=== modified file 'shared/browser/oxide_web_view.h'
--- shared/browser/oxide_web_view.h	2015-10-21 20:14:13 +0000
+++ shared/browser/oxide_web_view.h	2015-10-21 20:26:37 +0000
@@ -29,14 +29,12 @@
 #include "base/strings/string16.h"
 #include "cc/output/compositor_frame_metadata.h"
 #include "components/sessions/core/serialized_navigation_entry.h"
-#include "content/public/browser/certificate_request_result_type.h"
 #include "content/public/browser/navigation_controller.h"
 #include "content/public/browser/notification_observer.h"
 #include "content/public/browser/notification_registrar.h"
 #include "content/public/browser/web_contents_delegate.h"
 #include "content/public/browser/web_contents_observer.h"
 #include "content/public/common/javascript_message_type.h"
-#include "content/public/common/resource_type.h"
 #include "third_party/WebKit/public/platform/WebScreenInfo.h"
 #include "third_party/WebKit/public/platform/WebTopControlsState.h"
 #include "ui/gfx/geometry/point.h"
@@ -46,7 +44,6 @@
 #include "shared/browser/compositor/oxide_compositor_client.h"
 #include "shared/browser/compositor/oxide_compositor_observer.h"
 #include "shared/browser/input/oxide_input_method_context_observer.h"
-#include "shared/browser/oxide_certificate_error.h"
 #include "shared/browser/oxide_content_types.h"
 #include "shared/browser/oxide_render_widget_host_view_container.h"
 #include "shared/browser/oxide_script_message_target.h"
@@ -85,10 +82,6 @@
 class Size;
 }
 
-namespace net {
-class SSLInfo;
-}
-
 namespace ui {
 class TouchEvent;
 }
@@ -261,16 +254,6 @@
 
   void PrepareToClose();
 
-  void AllowCertificateError(content::RenderFrameHost* rfh,
-                             int cert_error,
-                             const net::SSLInfo& ssl_info,
-                             const GURL& request_url,
-                             content::ResourceType resource_type,
-                             bool overridable,
-                             bool strict_enforcement,
-                             const base::Callback<void(bool)>& callback,
-                             content::CertificateRequestResultType* result);
-
   void HandleKeyEvent(const content::NativeWebKeyboardEvent& event);
   void HandleMouseEvent(const blink::WebMouseEvent& event);
   void HandleTouchEvent(const ui::TouchEvent& event);
@@ -434,9 +417,6 @@
                                   content::MediaStreamType type) final;
 
   // content::WebContentsObserver implementation
-  void RenderFrameDeleted(content::RenderFrameHost* render_frame_host) final;
-  void RenderFrameHostChanged(content::RenderFrameHost* old_host,
-                              content::RenderFrameHost* new_host) final;
   void RenderViewReady() final;
   void RenderProcessGone(base::TerminationStatus status) final;
   void RenderViewHostChanged(content::RenderViewHost* old_host,
@@ -468,10 +448,6 @@
   void DidNavigateMainFrame(
       const content::LoadCommittedDetails& details,
       const content::FrameNavigateParams& params) final;
-  void DidNavigateAnyFrame(
-      content::RenderFrameHost* render_frame_host,
-      const content::LoadCommittedDetails& details,
-      const content::FrameNavigateParams& params) final;
   void DidGetRedirectForResourceRequest(
       content::RenderFrameHost* render_frame_host,
       const content::ResourceRedirectDetails& details) final;
@@ -510,8 +486,6 @@
   base::WeakPtr<WebPopupMenu> active_popup_menu_;
   base::WeakPtr<FilePicker> active_file_picker_;
 
-  CertificateErrorManager certificate_error_manager_;
-
   ContentType blocked_content_;
 
   cc::CompositorFrameMetadata pending_compositor_frame_metadata_;

=== modified file 'shared/browser/oxide_web_view_client.cc'
--- shared/browser/oxide_web_view_client.cc	2015-10-21 15:17:02 +0000
+++ shared/browser/oxide_web_view_client.cc	2015-10-21 20:26:37 +0000
@@ -141,8 +141,6 @@
 
 void WebViewClient::SecurityStatusChanged(const SecurityStatus& old) {}
 
-void WebViewClient::OnCertificateError(scoped_ptr<CertificateError> error) {}
-
 void WebViewClient::ContentBlocked() {}
 
 void WebViewClient::PrepareToCloseResponseReceived(bool proceed) {}

=== modified file 'shared/browser/oxide_web_view_client.h'
--- shared/browser/oxide_web_view_client.h	2015-10-21 15:17:02 +0000
+++ shared/browser/oxide_web_view_client.h	2015-10-21 20:26:37 +0000
@@ -173,8 +173,6 @@
   // TODO(chrisccoulson): Get rid of |old| and add |changed_flags|
   virtual void SecurityStatusChanged(const SecurityStatus& old);
 
-  virtual void OnCertificateError(scoped_ptr<CertificateError> error);
-
   // TODO(chrisccoulson): Rename to BlockedContentChanged or something
   // TODO(chrisccoulson): Move content tracking to a separate class with its
   //    own delegate, as this is going to be expanded with content settings

=== modified file 'shared/browser/oxide_web_view_contents_helper.cc'
--- shared/browser/oxide_web_view_contents_helper.cc	2015-09-24 15:53:36 +0000
+++ shared/browser/oxide_web_view_contents_helper.cc	2015-10-21 20:26:37 +0000
@@ -111,7 +111,13 @@
 // static
 WebViewContentsHelper* WebViewContentsHelper::FromRenderViewHost(
     content::RenderViewHost* rvh) {
-  return FromWebContents(content::WebContents::FromRenderViewHost(rvh));
+  content::WebContents* contents =
+      content::WebContents::FromRenderViewHost(rvh);
+  if (!contents) {
+    return nullptr;
+  }
+
+  return FromWebContents(contents);
 }
 
 content::WebContents* WebViewContentsHelper::GetWebContents() const {

=== added directory 'shared/browser/ssl'
=== renamed file 'shared/browser/oxide_certificate_error.cc' => 'shared/browser/ssl/oxide_certificate_error.cc'
--- shared/browser/oxide_certificate_error.cc	2015-10-07 17:20:23 +0000
+++ shared/browser/ssl/oxide_certificate_error.cc	2015-10-21 20:26:37 +0000
@@ -17,293 +17,75 @@
 
 #include "oxide_certificate_error.h"
 
-#include <algorithm>
-
 #include "base/logging.h"
-#include "content/public/browser/render_frame_host.h"
-#include "net/base/net_errors.h"
 #include "net/cert/x509_certificate.h"
-#include "net/ssl/ssl_info.h"
+
+#include "oxide_certificate_error_proxy.h"
 
 namespace oxide {
 
-namespace {
-
-CertError ToCertError(int error, net::X509Certificate* cert) {
-  DCHECK(net::IsCertificateError(error));
-
-  switch (error) {
-    case net::ERR_CERT_COMMON_NAME_INVALID:
-      return CERT_ERROR_BAD_IDENTITY;
-    case net::ERR_CERT_DATE_INVALID: {
-      if (cert && cert->HasExpired()) {
-        return CERT_ERROR_EXPIRED;
-      }
-      return CERT_ERROR_DATE_INVALID;
-    }
-    case net::ERR_CERT_AUTHORITY_INVALID:
-      return CERT_ERROR_AUTHORITY_INVALID;
-    case net::ERR_CERT_CONTAINS_ERRORS:
-    case net::ERR_CERT_INVALID:
-    case net::ERR_CERT_VALIDITY_TOO_LONG:
-      return CERT_ERROR_INVALID;
-    case net::ERR_CERT_REVOKED:
-      return CERT_ERROR_REVOKED;
-    case net::ERR_CERT_WEAK_SIGNATURE_ALGORITHM:
-    case net::ERR_CERT_WEAK_KEY:
-      return CERT_ERROR_INSECURE;
-    //case net::ERR_CERT_NO_REVOCATION_MECHANISM:
-    //case net::ERR_CERT_UNABLE_TO_CHECK_REVOCATION:
-    //case net::ERR_CERT_NON_UNIQUE_NAME:
-    //case net::ERR_CERT_NAME_CONSTRAINT_VIOLATION:
-    default:
-      return CERT_ERROR_GENERIC;
-  }
-}
-
-}
-
-class CertificateErrorManager::IteratorGuard {
- public:
-  IteratorGuard(CertificateErrorManager* manager);
-  ~IteratorGuard();
-
- private:
-  base::WeakPtr<CertificateErrorManager> manager_;
-  bool iterating_original_;
-
-  DISALLOW_COPY_AND_ASSIGN(IteratorGuard);
-};
-
-CertificateErrorManager::IteratorGuard::IteratorGuard(
-    CertificateErrorManager* manager)
-    : manager_(manager->weak_factory_.GetWeakPtr()),
-      iterating_original_(manager->iterating_) {
-  manager->iterating_ = true;
-}
-
-CertificateErrorManager::IteratorGuard::~IteratorGuard() {
-  if (!manager_) {
-    return;
-  }
-
-  manager_->iterating_ = iterating_original_;
-  if (!manager_->iterating_) {
-    manager_->Compact();
-  }
-}
-
-void CertificateErrorManager::AddError(CertificateError* error) {
-  DCHECK_EQ(error->manager_, this);
-  DCHECK(std::find(errors_.begin(), errors_.end(), error) == errors_.end());
-
-  errors_.push_back(error);
-}
-
-void CertificateErrorManager::RemoveError(CertificateError* error) {
-  auto it = std::find(errors_.begin(), errors_.end(), error);
-  DCHECK(it != errors_.end());
-  if (iterating_) {
-    *it = nullptr;
-  } else {
-    errors_.erase(it);
-  }
-
-  error->manager_ = nullptr;
-}
-
-void CertificateErrorManager::Compact() {
-  DCHECK(!iterating_);
-
-  errors_.erase(
-      std::remove(errors_.begin(), errors_.end(), nullptr),
-      errors_.end());
-}
-
-void CertificateErrorManager::CancelPendingFrameErrorsForFrame(
-    content::RenderFrameHost* frame) {
-  RenderFrameHostID frame_id = RenderFrameHostID::FromHost(frame);
-
-  IteratorGuard guard(this);
-
-  for (auto it = errors_.begin(); it != errors_.end(); ++it) {
-    CertificateError* error = *it;
-    if (!error) {
-      continue;
-    }
-
-    if (error->frame_id_ != frame_id) {
-      continue;
-    }
-
-    if (error->is_subresource()) {
-      continue;
-    }
-
-    if (error->non_overridable_frame_error_committed_) {
-      continue;
-    }
-
-    RemoveError(error);
-    error->Cancel();
-  }
-}
-
-CertificateErrorManager::CertificateErrorManager()
-    : iterating_(false),
-      weak_factory_(this) {}
-
-CertificateErrorManager::~CertificateErrorManager() {
-  IteratorGuard guard(this);
-  for (auto it = errors_.begin(); it != errors_.end(); ++it) {
-    CertificateError* error = *it;
-    if (!error) {
-      continue;
-    }
-
-    RemoveError(error);
-    error->Cancel();
-  }
-}
-
-void CertificateErrorManager::DidStartProvisionalLoadForFrame(
-    content::RenderFrameHost* frame) {
-  DCHECK(frame);
-  CancelPendingFrameErrorsForFrame(frame);
-}
-
-void CertificateErrorManager::DidNavigateFrame(
-    content::RenderFrameHost* frame) {
-  DCHECK(frame);
-
-  RenderFrameHostID frame_id = RenderFrameHostID::FromHost(frame);
-
-  IteratorGuard guard(this);
-
-  for (auto it = errors_.begin(); it != errors_.end(); ++it) {
-    CertificateError* error = *it;
-    if (!error) {
-      continue;
-    }
-
-    if (error->frame_id_ != frame_id) {
-      continue;
-    }
-
-    if (!error->is_subresource() &&
-        !error->non_overridable_frame_error_committed_) {
-      error->non_overridable_frame_error_committed_ = true;
-      continue;
-    }
-
-    RemoveError(error);
-    error->Cancel();
-  }
-}
-
-void CertificateErrorManager::DidStopProvisionalLoadForFrame(
-    content::RenderFrameHost* frame) {
-  DCHECK(frame);
-  CancelPendingFrameErrorsForFrame(frame);
-}
-
-void CertificateErrorManager::FrameDetached(content::RenderFrameHost* frame) {
-  DCHECK(frame);
-
-  RenderFrameHostID frame_id = RenderFrameHostID::FromHost(frame);
-
-  IteratorGuard guard(this);
-
-  for (auto it = errors_.begin(); it != errors_.end(); ++it) {
-    CertificateError* error = *it;
-    if (!error) {
-      continue;
-    }
-
-    if (error->frame_id_ != frame_id) {
-      continue;
-    }
-
-    RemoveError(error);
-    error->Cancel();
-  }
-}
-
-void CertificateError::Cancel() {
-  DCHECK(!is_cancelled_);
-  DCHECK(!callback_.is_null() || !overridable_);
-
-  is_cancelled_ = true;
-
-  if (!callback_.is_null()) {
-    callback_.Run(false);
-    callback_.Reset();
-  }
-
-  if (!cancel_callback_.is_null()) {
-    cancel_callback_.Run();
-    cancel_callback_.Reset();
-  }
-}
-
-CertificateError::CertificateError(
-    CertificateErrorManager* manager,
-    content::RenderFrameHost* frame,
-    int cert_error,
-    const net::SSLInfo& ssl_info,
-    const GURL& url,
-    content::ResourceType resource_type,
-    bool strict_enforcement,
-    const base::Callback<void(bool)>& callback)
-    : manager_(manager),
-      frame_id_(RenderFrameHostID::FromHost(frame)),
-      is_main_frame_(!frame->GetParent()),
-      is_subresource_(!content::IsResourceTypeFrame(resource_type)),
-      cert_error_(ToCertError(cert_error, ssl_info.cert.get())),
-      cert_(ssl_info.cert),
+CertificateError::CertificateError(bool is_main_frame,
+                                   bool is_subresource,
+                                   CertError cert_error,
+                                   net::X509Certificate* cert,
+                                   const GURL& url,
+                                   bool strict_enforcement,
+                                   bool overridable,
+                                   CertificateErrorProxy* proxy)
+    : is_main_frame_(is_main_frame),
+      is_subresource_(is_subresource),
+      cert_error_(cert_error),
+      cert_(cert),
       url_(url),
-      overridable_(!callback.is_null()),
       strict_enforcement_(strict_enforcement),
-      callback_(callback),
-      is_cancelled_(false),
-      non_overridable_frame_error_committed_(false) {
-  DCHECK(manager_);
-  DCHECK(frame);
-  CHECK(!overridable_ || !strict_enforcement_) <<
-      "overridable and strict_enforcement are expected to be mutually exclusive";
-
-  manager_->AddError(this);
-}
+      overridable_(overridable),
+      proxy_(proxy) {}
 
 CertificateError::~CertificateError() {
-  if (!callback_.is_null()) {
-    Deny();
-  } else if (manager_) {
-    manager_->RemoveError(this);
+  if (!proxy_->did_respond() && !proxy_->is_cancelled()) {
+    proxy_->Deny();
   }
 }
 
+bool CertificateError::IsCancelled() const {
+  return proxy_->is_cancelled();
+}
+
 void CertificateError::SetCancelCallback(const base::Closure& callback) {
-  DCHECK(!is_cancelled_);
-  cancel_callback_ = callback;
+  proxy_->set_cancel_callback(callback);
 }
 
 void CertificateError::Allow() {
-  DCHECK(!callback_.is_null());
-
-  callback_.Run(true);
-  callback_.Reset();
-
-  manager_->RemoveError(this);
+  if (!overridable()) {
+    LOG(WARNING) << "Can't override a non-overridable error";
+    return;
+  }
+
+  if (proxy_->is_cancelled()) {
+    LOG(WARNING) << "Can't override an error that's been cancelled";
+    return;
+  }
+
+  if (proxy_->did_respond()) {
+    LOG(WARNING) << "Can't respond more than once to a CertificateError";
+    return;
+  }
+
+  proxy_->Allow();
 }
 
 void CertificateError::Deny() {
-  DCHECK(!callback_.is_null());
-
-  callback_.Run(false);
-  callback_.Reset();
-
-  manager_->RemoveError(this);
+  if (proxy_->is_cancelled()) {
+    LOG(WARNING) << "Can't override an error that's been cancelled";
+    return;
+  }
+
+  if (proxy_->did_respond()) {
+    LOG(WARNING) << "Can't respond more than once to a CertificateError";
+    return;
+  }
+
+  proxy_->Deny();
 }
 
 } // namespace oxide

=== renamed file 'shared/browser/oxide_certificate_error.h' => 'shared/browser/ssl/oxide_certificate_error.h'
--- shared/browser/oxide_certificate_error.h	2015-10-07 17:20:23 +0000
+++ shared/browser/ssl/oxide_certificate_error.h	2015-10-21 20:26:37 +0000
@@ -15,96 +15,36 @@
 // License along with this library; if not, write to the Free Software
 // Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
 
-#ifndef _OXIDE_SHARED_BROWSER_CERTIFICATE_ERROR_H_
-#define _OXIDE_SHARED_BROWSER_CERTIFICATE_ERROR_H_
-
-#include <vector>
+#ifndef _OXIDE_SHARED_BROWSER_SSL_CERTIFICATE_ERROR_H_
+#define _OXIDE_SHARED_BROWSER_SSL_CERTIFICATE_ERROR_H_
 
 #include "base/callback.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
-#include "base/memory/weak_ptr.h"
-#include "content/public/common/resource_type.h"
 #include "url/gurl.h"
 
-#include "shared/browser/oxide_render_frame_host_id.h"
 #include "shared/browser/oxide_security_types.h"
 
-namespace content {
-class RenderFrameHost;
-}
-
 namespace net {
-class SSLInfo;
 class X509Certificate;
 }
 
 namespace oxide {
 
-class CertificateError;
-
-// This class tracks CertificateErrors
-class CertificateErrorManager {
- public:
-  CertificateErrorManager();
-  ~CertificateErrorManager();
-
-  // Cancels any pending frame errors for |frame|
-  void DidStartProvisionalLoadForFrame(content::RenderFrameHost* frame);
-
-  // Cancels any errors for |frame| with the exception of
-  // non-overridable frame errors if this is the corresponding error page
-  void DidNavigateFrame(content::RenderFrameHost* frame);
-
-  // Cancels any pending frame errors for |frame|
-  void DidStopProvisionalLoadForFrame(content::RenderFrameHost* frame);
-
-  // Cancels all errors for frame
-  void FrameDetached(content::RenderFrameHost* frame);
-
- private:
-  friend class CertificateError;
-  class IteratorGuard;
-
-  // Add a CertificateError
-  void AddError(CertificateError* error);
-
-  // Remove a CertificateError, clearing its pointers to this
-  // and the frame that generated the error
-  void RemoveError(CertificateError* error);
-
-  // Remove empty slots from errors_
-  void Compact();
-
-  void CancelPendingFrameErrorsForFrame(content::RenderFrameHost* frame);
-
-  typedef std::vector<CertificateError*> CertErrorVector;
-
-  // Used to indicate that errors_ is being iterated over, and
-  // will prevent RemoveError from removing entries from it
-  bool iterating_;
-
-  // The list of CertificateErrors
-  CertErrorVector errors_;
-
-  base::WeakPtrFactory<CertificateErrorManager> weak_factory_;
-
-  DISALLOW_COPY_AND_ASSIGN(CertificateErrorManager);
-};
+class CertificateErrorProxy;
 
 // Represents a SSL certificate error. It provides access to the relevant
 // information about the error, as well as methods to accept or deny it
 class CertificateError {
  public:
-  CertificateError(
-      CertificateErrorManager* manager,
-      content::RenderFrameHost* frame,
-      int cert_error,
-      const net::SSLInfo& ssl_info,
-      const GURL& url,
-      content::ResourceType resource_type,
-      bool strict_enforcement,
-      const base::Callback<void(bool)>& callback);
+  CertificateError(bool is_main_frame,
+                   bool is_subresource,
+                   CertError cert_error,
+                   net::X509Certificate* cert,
+                   const GURL& url,
+                   bool strict_enforcement,
+                   bool overridable,
+                   CertificateErrorProxy* proxy);
   ~CertificateError();
 
   // If the error is from the main frame
@@ -128,55 +68,35 @@
   // Whether the error was generated from a URL that uses HSTS
   bool strict_enforcement() const { return strict_enforcement_; }
 
-  // Whether the error has been cancelled by Oxide. A cancelled error is no
-  // longer relevant. This can happen if the frame navigates or goes away
-  bool is_cancelled() const { return is_cancelled_; }
+  // Whether the error has been cancelled by Oxide. This is only relevant
+  // for main frame errors (is_main_frame_ && !is_subresource_) and is used
+  // to signal to the application when it should hide its certificate error UI
+  bool IsCancelled() const;
 
   // Set a callback to be invoked when this error is cancelled
   void SetCancelCallback(const base::Closure& callback);
 
   // Allow the request that generated the error to continue, ignoring the
-  // error. Only possible if overridable() returns true
+  // error. Only possible if IsOverridable() returns true
   void Allow();
 
   // Cancel the request that generated the error
   void Deny();
 
  private:
-  friend class CertificateErrorManager;
-
-  // Cancel the request that generated the error and run the cancel callback.
-  // This is only called from CertificateErrorManager
-  void Cancel();
-
-  CertificateErrorManager* manager_;
-
-  // The ID of the frame the generated this error
-  RenderFrameHostID frame_id_;
-
   bool is_main_frame_;
   bool is_subresource_;
   CertError cert_error_;
   scoped_refptr<net::X509Certificate> cert_;
   GURL url_;
+  bool strict_enforcement_;
   bool overridable_;
-  bool strict_enforcement_;
-
-  // The callback provided by Chromium, which we use to respond to the error
-  base::Callback<void(bool)> callback_;
-
-  bool is_cancelled_;
-  base::Closure cancel_callback_;
-
-  // Subresource errors are cancelled when a frame is committed.
-  // However, non-overridable frame errors should persist beyond the error
-  // page commit for this failed load and then be cancelled on a subsequent
-  // commit. This is used for tracking that
-  bool non_overridable_frame_error_committed_;
+
+  scoped_refptr<CertificateErrorProxy> proxy_;
 
   DISALLOW_COPY_AND_ASSIGN(CertificateError);
 };
 
 } // namespace oxide
 
-#endif // _OXIDE_SHARED_BROWSER_CERTIFICATE_ERROR_H_
+#endif // _OXIDE_SHARED_BROWSER_SSL_CERTIFICATE_ERROR_H_

=== added file 'shared/browser/ssl/oxide_certificate_error_dispatcher.cc'
--- shared/browser/ssl/oxide_certificate_error_dispatcher.cc	1970-01-01 00:00:00 +0000
+++ shared/browser/ssl/oxide_certificate_error_dispatcher.cc	2015-10-21 20:26:37 +0000
@@ -0,0 +1,196 @@
+// vim:expandtab:shiftwidth=2:tabstop=2:
+// Copyright (C) 2015 Canonical Ltd.
+
+// This library is free software; you can redistribute it and/or
+// modify it under the terms of the GNU Lesser General Public
+// License as published by the Free Software Foundation; either
+// version 2.1 of the License, or (at your option) any later version.
+
+// This library is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+// Lesser General Public License for more details.
+
+// You should have received a copy of the GNU Lesser General Public
+// License along with this library; if not, write to the Free Software
+// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+
+#include "oxide_certificate_error_dispatcher.h"
+
+#include "base/logging.h"
+#include "base/memory/ref_counted.h"
+#include "content/public/browser/browser_thread.h"
+#include "content/public/browser/certificate_request_result_type.h"
+#include "content/public/browser/render_frame_host.h"
+#include "content/public/browser/web_contents.h"
+#include "net/base/net_errors.h"
+#include "net/cert/x509_certificate.h"
+#include "net/ssl/ssl_info.h"
+#include "url/gurl.h"
+
+#include "shared/browser/oxide_security_types.h"
+
+#include "oxide_certificate_error.h"
+#include "oxide_certificate_error_dispatcher_client.h"
+#include "oxide_certificate_error_placeholder_page.h"
+#include "oxide_certificate_error_proxy.h"
+
+namespace oxide {
+
+namespace {
+
+CertError ToCertError(int error, net::X509Certificate* cert) {
+  DCHECK(net::IsCertificateError(error));
+
+  switch (error) {
+    case net::ERR_CERT_COMMON_NAME_INVALID:
+      return CERT_ERROR_BAD_IDENTITY;
+    case net::ERR_CERT_DATE_INVALID: {
+      if (cert && cert->HasExpired()) {
+        return CERT_ERROR_EXPIRED;
+      }
+      return CERT_ERROR_DATE_INVALID;
+    }
+    case net::ERR_CERT_AUTHORITY_INVALID:
+      return CERT_ERROR_AUTHORITY_INVALID;
+    case net::ERR_CERT_CONTAINS_ERRORS:
+    case net::ERR_CERT_INVALID:
+    case net::ERR_CERT_VALIDITY_TOO_LONG:
+      return CERT_ERROR_INVALID;
+    case net::ERR_CERT_REVOKED:
+      return CERT_ERROR_REVOKED;
+    case net::ERR_CERT_WEAK_SIGNATURE_ALGORITHM:
+    case net::ERR_CERT_WEAK_KEY:
+      return CERT_ERROR_INSECURE;
+    //case net::ERR_CERT_NO_REVOCATION_MECHANISM:
+    //case net::ERR_CERT_UNABLE_TO_CHECK_REVOCATION:
+    //case net::ERR_CERT_NON_UNIQUE_NAME:
+    //case net::ERR_CERT_NAME_CONSTRAINT_VIOLATION:
+    default:
+      return CERT_ERROR_GENERIC;
+  }
+}
+
+}
+
+DEFINE_WEB_CONTENTS_USER_DATA_KEY(CertificateErrorDispatcher);
+
+CertificateErrorDispatcher::CertificateErrorDispatcher()
+    : client_(nullptr) {}
+
+bool CertificateErrorDispatcher::CanDispatch() const {
+  return !!client_;
+}
+
+void CertificateErrorDispatcher::Dispatch(scoped_ptr<CertificateError> error) {
+  client_->OnCertificateError(error.Pass());
+}
+
+CertificateErrorDispatcher::~CertificateErrorDispatcher() {}
+
+// static
+void CertificateErrorDispatcher::CreateForWebContents(
+    content::WebContents* contents) {
+  DCHECK(contents);
+  if (!FromWebContents(contents)) {
+    contents->SetUserData(UserDataKey(), new CertificateErrorDispatcher());
+  }
+}
+
+// static
+void CertificateErrorDispatcher::AllowCertificateError(
+    int render_process_id,
+    int render_frame_id,
+    int cert_error,
+    const net::SSLInfo& ssl_info,
+    const GURL& request_url,
+    content::ResourceType resource_type,
+    bool overridable,
+    bool strict_enforcement,
+    const base::Callback<void(bool)>& callback,
+    content::CertificateRequestResultType* result) {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+  DCHECK_IMPLIES(strict_enforcement, !overridable);
+
+  // Note, CANCEL will stop the resource load associated with the error, and
+  // DENY will fail it, resulting in an error page being loaded if it's
+  // for the document request
+
+  content::RenderFrameHost* rfh =
+      content::RenderFrameHost::FromID(render_process_id, render_frame_id);
+  if (!rfh) {
+    *result = content::CERTIFICATE_REQUEST_RESULT_TYPE_CANCEL;
+    return;
+  }
+
+  content::WebContents* contents =
+      content::WebContents::FromRenderFrameHost(rfh);
+  if (!contents) {
+    *result = content::CERTIFICATE_REQUEST_RESULT_TYPE_CANCEL;
+    return;
+  }
+
+  CertificateErrorDispatcher* dispatcher = FromWebContents(contents);
+
+  if (!dispatcher->CanDispatch()) {
+    *result = content::CERTIFICATE_REQUEST_RESULT_TYPE_DENY;
+    return;
+  }
+
+  if (resource_type != content::RESOURCE_TYPE_MAIN_FRAME) {
+    // Only errors for main frame document resources are overridable, as it's
+    // the only case where we can guarantee that the security status for the
+    // webview is correct (see https://launchpad.net/bugs/1368385), and it's
+    // the only case where we trust the application to be able to display a
+    // meaningful UI
+    overridable = false;
+    *result = content::CERTIFICATE_REQUEST_RESULT_TYPE_DENY;
+  } else if (!overridable) {
+    // Don't load an error page for main frame document errors, as we're going
+    // to load a placeholder transient page
+    *result = content::CERTIFICATE_REQUEST_RESULT_TYPE_CANCEL;
+  }
+
+
+  scoped_refptr<CertificateErrorProxy> proxy =
+      new CertificateErrorProxy(
+        overridable ? callback : base::Callback<void(bool)>());
+  scoped_ptr<CertificateError> error(
+      new CertificateError(!rfh->GetParent(),
+                           !content::IsResourceTypeFrame(resource_type),
+                           ToCertError(cert_error, ssl_info.cert.get()),
+                           ssl_info.cert.get(),
+                           request_url,
+                           strict_enforcement,
+                           overridable,
+                           proxy.get()));
+
+  dispatcher->Dispatch(error.Pass());
+
+  if (proxy->did_respond()) {
+    // If the application responded explicitly or by CertificateError being
+    // destroyed, there's nothing more to do
+    return;
+  }
+
+  if (resource_type != content::RESOURCE_TYPE_MAIN_FRAME) {
+    // If this error isn't for a main frame document resource, there's nothing
+    // more to do
+    return;
+  }
+
+  // For main frame document resources, we insert a placeholder transient page
+  // as long as CertificateError is alive and not responded to. This is
+  // intended to help the embedder when it displays a certificate error UI by
+  // ensuring the visible URL is correct, navigation history is consistent, the
+  // webview is marked as not loading and the back button behaves correctly
+  // (should dismiss the error via the cancel callback and go back to the last
+  // committed page)
+
+  // This gets owned by the |contents|
+  new CertificateErrorPlaceholderPage(contents,
+                                      request_url,
+                                      proxy.get());
+}
+
+} // namespace oxide

=== added file 'shared/browser/ssl/oxide_certificate_error_dispatcher.h'
--- shared/browser/ssl/oxide_certificate_error_dispatcher.h	1970-01-01 00:00:00 +0000
+++ shared/browser/ssl/oxide_certificate_error_dispatcher.h	2015-10-21 20:26:37 +0000
@@ -0,0 +1,77 @@
+// vim:expandtab:shiftwidth=2:tabstop=2:
+// Copyright (C) 2015 Canonical Ltd.
+
+// This library is free software; you can redistribute it and/or
+// modify it under the terms of the GNU Lesser General Public
+// License as published by the Free Software Foundation; either
+// version 2.1 of the License, or (at your option) any later version.
+
+// This library is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+// Lesser General Public License for more details.
+
+// You should have received a copy of the GNU Lesser General Public
+// License along with this library; if not, write to the Free Software
+// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+
+#ifndef _OXIDE_SHARED_BROWSER_SSL_CERTIFICATE_ERROR_DISPATCHER_H_
+#define _OXIDE_SHARED_BROWSER_SSL_CERTIFICATE_ERROR_DISPATCHER_H_
+
+#include "base/callback.h"
+#include "base/macros.h"
+#include "content/public/browser/certificate_request_result_type.h"
+#include "content/public/browser/web_contents_user_data.h"
+#include "content/public/common/resource_type.h"
+
+class GURL;
+
+namespace net {
+class SSLInfo;
+}
+
+namespace oxide {
+
+class CertificateError;
+class CertificateErrorDispatcherClient;
+
+// A helper class for dispatching certificate errors from Chromium to
+// CertificateErrorDispatcherClient
+class CertificateErrorDispatcher
+    : public content::WebContentsUserData<CertificateErrorDispatcher> {
+ public:
+  ~CertificateErrorDispatcher();
+
+  static void CreateForWebContents(content::WebContents* contents);
+
+  // Entry point from Chromium
+  static void AllowCertificateError(
+      int render_process_id,
+      int render_frame_id,
+      int cert_error,
+      const net::SSLInfo& ssl_info,
+      const GURL& request_url,
+      content::ResourceType resource_type,
+      bool overridable,
+      bool strict_enforcement,
+      const base::Callback<void(bool)>& callback,
+      content::CertificateRequestResultType* result);
+
+  void set_client(CertificateErrorDispatcherClient* client) {
+    client_ = client;
+  }
+
+ private:
+  CertificateErrorDispatcher();
+
+  bool CanDispatch() const;
+  void Dispatch(scoped_ptr<CertificateError> error);
+
+  CertificateErrorDispatcherClient* client_;
+
+  DISALLOW_COPY_AND_ASSIGN(CertificateErrorDispatcher);
+};
+
+} // namespace oxide
+
+#endif // _OXIDE_SHARED_BROWSER_SSL_CERTIFICATE_ERROR_DISPATCHER_H_

=== added file 'shared/browser/ssl/oxide_certificate_error_dispatcher_client.h'
--- shared/browser/ssl/oxide_certificate_error_dispatcher_client.h	1970-01-01 00:00:00 +0000
+++ shared/browser/ssl/oxide_certificate_error_dispatcher_client.h	2015-10-21 20:26:37 +0000
@@ -0,0 +1,36 @@
+// vim:expandtab:shiftwidth=2:tabstop=2:
+// Copyright (C) 2015 Canonical Ltd.
+
+// This library is free software; you can redistribute it and/or
+// modify it under the terms of the GNU Lesser General Public
+// License as published by the Free Software Foundation; either
+// version 2.1 of the License, or (at your option) any later version.
+
+// This library is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+// Lesser General Public License for more details.
+
+// You should have received a copy of the GNU Lesser General Public
+// License along with this library; if not, write to the Free Software
+// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+
+#ifndef _OXIDE_SHARED_BROWSER_SSL_CERTIFICATE_ERROR_DISPATCHER_CLIENT_H_
+#define _OXIDE_SHARED_BROWSER_SSL_CERTIFICATE_ERROR_DISPATCHER_CLIENT_H_
+
+#include "base/memory/scoped_ptr.h"
+
+namespace oxide {
+
+class CertificateError;
+
+class CertificateErrorDispatcherClient {
+ public:
+  virtual ~CertificateErrorDispatcherClient() {}
+
+  virtual void OnCertificateError(scoped_ptr<CertificateError> error) = 0;
+};
+
+} // namespace oxide
+
+#endif // _OXIDE_SHARED_BROWSER_SSL_CERTIFICATE_ERROR_DISPATCHER_CLIENT_H_

=== added file 'shared/browser/ssl/oxide_certificate_error_placeholder_page.cc'
--- shared/browser/ssl/oxide_certificate_error_placeholder_page.cc	1970-01-01 00:00:00 +0000
+++ shared/browser/ssl/oxide_certificate_error_placeholder_page.cc	2015-10-21 20:26:37 +0000
@@ -0,0 +1,58 @@
+// vim:expandtab:shiftwidth=2:tabstop=2:
+// Copyright (C) 2015 Canonical Ltd.
+
+// This library is free software; you can redistribute it and/or
+// modify it under the terms of the GNU Lesser General Public
+// License as published by the Free Software Foundation; either
+// version 2.1 of the License, or (at your option) any later version.
+
+// This library is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+// Lesser General Public License for more details.
+
+// You should have received a copy of the GNU Lesser General Public
+// License along with this library; if not, write to the Free Software
+// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+
+#include "oxide_certificate_error_placeholder_page.h"
+
+#include "base/logging.h"
+#include "content/public/browser/interstitial_page.h"
+
+#include "oxide_certificate_error_proxy.h"
+
+namespace oxide {
+
+CertificateErrorPlaceholderPage::~CertificateErrorPlaceholderPage() {}
+
+std::string CertificateErrorPlaceholderPage::GetHTMLContents() {
+  return "<html></html>";
+}
+
+void CertificateErrorPlaceholderPage::OnDontProceed() {
+  error_->Cancel();
+}
+
+CertificateErrorPlaceholderPage::CertificateErrorPlaceholderPage(
+    content::WebContents* contents,
+    const GURL& request_url,
+    CertificateErrorProxy* error)
+    : interstitial_(content::InterstitialPage::Create(contents,
+                                                      true,
+                                                      request_url,
+                                                      this)),
+      error_(error) {
+  error_->SetPlaceholderPage(this);
+  interstitial_->Show();
+}
+
+void CertificateErrorPlaceholderPage::Proceed() {
+  interstitial_->Proceed();
+}
+
+void CertificateErrorPlaceholderPage::DontProceed() {
+  interstitial_->DontProceed();
+}
+
+} // namespace oxide

=== added file 'shared/browser/ssl/oxide_certificate_error_placeholder_page.h'
--- shared/browser/ssl/oxide_certificate_error_placeholder_page.h	1970-01-01 00:00:00 +0000
+++ shared/browser/ssl/oxide_certificate_error_placeholder_page.h	2015-10-21 20:26:37 +0000
@@ -0,0 +1,64 @@
+// vim:expandtab:shiftwidth=2:tabstop=2:
+// Copyright (C) 2015 Canonical Ltd.
+
+// This library is free software; you can redistribute it and/or
+// modify it under the terms of the GNU Lesser General Public
+// License as published by the Free Software Foundation; either
+// version 2.1 of the License, or (at your option) any later version.
+
+// This library is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+// Lesser General Public License for more details.
+
+// You should have received a copy of the GNU Lesser General Public
+// License along with this library; if not, write to the Free Software
+// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+
+#ifndef _OXIDE_SHARED_BROWSER_SSL_CERTIFICATE_ERROR_PLACEHOLDER_PAGE_H_
+#define _OXIDE_SHARED_BROWSER_SSL_CERTIFICATE_ERROR_PLACEHOLDER_PAGE_H_
+
+#include "base/macros.h"
+#include "base/memory/ref_counted.h"
+#include "content/public/browser/interstitial_page_delegate.h"
+
+class GURL;
+
+namespace content {
+class InterstitialPage;
+class WebContents;
+}
+
+namespace oxide {
+
+class CertificateErrorProxy;
+
+// This class inserts a placeholder transient page in to a WebContents'
+// navigation list whilst an application displays a certificate error UI
+class CertificateErrorPlaceholderPage
+    : public content::InterstitialPageDelegate {
+ public:
+  CertificateErrorPlaceholderPage(content::WebContents* contents,
+                                  const GURL& request_url,
+                                  CertificateErrorProxy* error);
+
+  void Proceed();
+  void DontProceed();
+
+ private:
+  ~CertificateErrorPlaceholderPage() override;
+
+  // content::InterstitialPageDelegate implementation
+  std::string GetHTMLContents() override;
+  void OnDontProceed() override;
+
+  content::InterstitialPage* interstitial_; // This owns us
+
+  scoped_refptr<CertificateErrorProxy> error_;
+
+  DISALLOW_COPY_AND_ASSIGN(CertificateErrorPlaceholderPage);
+};
+
+} // namespace oxide
+
+#endif // _OXIDE_SHARED_BROWSER_SSL_CERTIFICATE_ERROR_PLACEHOLDER_PAGE_H_

=== added file 'shared/browser/ssl/oxide_certificate_error_proxy.cc'
--- shared/browser/ssl/oxide_certificate_error_proxy.cc	1970-01-01 00:00:00 +0000
+++ shared/browser/ssl/oxide_certificate_error_proxy.cc	2015-10-21 20:26:37 +0000
@@ -0,0 +1,105 @@
+// vim:expandtab:shiftwidth=2:tabstop=2:
+// Copyright (C) 2015 Canonical Ltd.
+
+// This library is free software; you can redistribute it and/or
+// modify it under the terms of the GNU Lesser General Public
+// License as published by the Free Software Foundation; either
+// version 2.1 of the License, or (at your option) any later version.
+
+// This library is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+// Lesser General Public License for more details.
+
+// You should have received a copy of the GNU Lesser General Public
+// License along with this library; if not, write to the Free Software
+// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+
+#include "oxide_certificate_error_proxy.h"
+
+#include "base/logging.h"
+
+#include "oxide_certificate_error_placeholder_page.h"
+
+namespace oxide {
+
+CertificateErrorProxy::~CertificateErrorProxy() {
+  DCHECK(did_respond_ || is_cancelled_);
+}
+
+CertificateErrorProxy::CertificateErrorProxy(
+    const base::Callback<void(bool)>& callback)
+    : callback_(callback),
+      is_cancelled_(false),
+      did_respond_(false),
+      placeholder_page_(nullptr) {}
+
+void CertificateErrorProxy::Allow() {
+  DCHECK(!did_respond_);
+  DCHECK(!is_cancelled_);
+  DCHECK(!callback_.is_null());
+
+  did_respond_ = true;
+
+  callback_.Run(true);
+  callback_.Reset();
+
+  if (placeholder_page_) {
+    placeholder_page_->Proceed();
+    placeholder_page_ = nullptr;
+  }
+}
+
+void CertificateErrorProxy::Deny() {
+  DCHECK(!did_respond_);
+  DCHECK(!is_cancelled_);
+
+  did_respond_ = true;
+
+  if (!callback_.is_null()) {
+    callback_.Run(false);
+    callback_.Reset();
+  }
+
+  if (placeholder_page_) {
+    placeholder_page_->DontProceed();
+    placeholder_page_ = nullptr;
+  }
+}
+
+void CertificateErrorProxy::Cancel() {
+  DCHECK(!is_cancelled_);
+
+  if (did_respond_) {
+    // Calling Deny() ends up re-entering here via
+    // InterstitialPageDelegate::OnDontProceed
+    return;
+  }
+
+  // Chromium can call in to us after we've responded, if we responded
+  // before the interstitial navigation was committed. This is why this check
+  // is here, and not higher up
+  DCHECK(placeholder_page_);
+
+  is_cancelled_ = true;
+  placeholder_page_ = nullptr;
+
+  if (!callback_.is_null()) {
+    callback_.Run(false);
+    callback_.Reset();
+  }
+
+  if (!cancel_callback_.is_null()) {
+    cancel_callback_.Run();
+    cancel_callback_.Reset();
+  }
+}
+
+void CertificateErrorProxy::SetPlaceholderPage(
+    CertificateErrorPlaceholderPage* placeholder) {
+  DCHECK(!did_respond_);
+  DCHECK(!is_cancelled_);
+  placeholder_page_ = placeholder;
+}
+
+} // namespace oxide

=== added file 'shared/browser/ssl/oxide_certificate_error_proxy.h'
--- shared/browser/ssl/oxide_certificate_error_proxy.h	1970-01-01 00:00:00 +0000
+++ shared/browser/ssl/oxide_certificate_error_proxy.h	2015-10-21 20:26:37 +0000
@@ -0,0 +1,65 @@
+// vim:expandtab:shiftwidth=2:tabstop=2:
+// Copyright (C) 2015 Canonical Ltd.
+
+// This library is free software; you can redistribute it and/or
+// modify it under the terms of the GNU Lesser General Public
+// License as published by the Free Software Foundation; either
+// version 2.1 of the License, or (at your option) any later version.
+
+// This library is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+// Lesser General Public License for more details.
+
+// You should have received a copy of the GNU Lesser General Public
+// License along with this library; if not, write to the Free Software
+// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+
+#ifndef _OXIDE_SHARED_BROWSER_SSL_CERTIFICATE_ERROR_PROXY_H_
+#define _OXIDE_SHARED_BROWSER_SSL_CERTIFICATE_ERROR_PROXY_H_
+
+#include "base/callback.h"
+#include "base/macros.h"
+#include "base/memory/ref_counted.h"
+
+namespace oxide {
+
+class CertificateErrorPlaceholderPage;
+
+// This class sits between CertificateError and CertificateErrorPlaceholderPage
+class CertificateErrorProxy : public base::RefCounted<CertificateErrorProxy> {
+ public:
+  CertificateErrorProxy(const base::Callback<void(bool)>& callback);
+
+  bool is_cancelled() const { return is_cancelled_; }
+  bool did_respond() const { return did_respond_; }
+
+  void set_cancel_callback(const base::Closure& cancel_callback) {
+    cancel_callback_ = cancel_callback;
+  }
+
+  void Allow();
+  void Deny();
+
+  void Cancel();
+
+  void SetPlaceholderPage(CertificateErrorPlaceholderPage* placeholder);
+
+ private:
+  friend class base::RefCounted<CertificateErrorProxy>;
+  ~CertificateErrorProxy();
+
+  base::Callback<void(bool)> callback_;
+
+  bool is_cancelled_;
+  bool did_respond_;
+  base::Closure cancel_callback_;
+
+  CertificateErrorPlaceholderPage* placeholder_page_;
+
+  DISALLOW_COPY_AND_ASSIGN(CertificateErrorProxy);
+};
+
+} // namespace oxide
+
+#endif // _OXIDE_SHARED_BROWSER_SSL_CERTIFICATE_ERROR_PROXY_H_

=== modified file 'shared/shared.gyp'
--- shared/shared.gyp	2015-10-21 17:07:17 +0000
+++ shared/shared.gyp	2015-10-21 20:26:37 +0000
@@ -352,8 +352,6 @@
         'browser/oxide_browser_platform_integration_observer.h',
         'browser/oxide_browser_process_main.cc',
         'browser/oxide_browser_process_main.h',
-        'browser/oxide_certificate_error.cc',
-        'browser/oxide_certificate_error.h',
         'browser/oxide_content_browser_client.cc',
         'browser/oxide_content_browser_client.h',
         'browser/oxide_content_types.h',
@@ -475,6 +473,15 @@
         'browser/permissions/oxide_permission_request_response.h',
         'browser/permissions/oxide_temporary_saved_permission_context.cc',
         'browser/permissions/oxide_temporary_saved_permission_context.h',
+        'browser/ssl/oxide_certificate_error.cc',
+        'browser/ssl/oxide_certificate_error.h',
+        'browser/ssl/oxide_certificate_error_dispatcher.cc',
+        'browser/ssl/oxide_certificate_error_dispatcher.h',
+        'browser/ssl/oxide_certificate_error_dispatcher_client.h',
+        'browser/ssl/oxide_certificate_error_placeholder_page.cc',
+        'browser/ssl/oxide_certificate_error_placeholder_page.h',
+        'browser/ssl/oxide_certificate_error_proxy.cc',
+        'browser/ssl/oxide_certificate_error_proxy.h',
         'common/oxide_constants.cc',
         'common/oxide_constants.h',
         'common/oxide_content_client.cc',