Update net/ to use scoped_refptr<T>::get() rather than implicit "operator T*"

net/cert/nss_cert_database_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <cert.h>
 #include <certdb.h>
 #include <pk11pub.h>
 
 #include <algorithm>
 
@@ skipping 98 matching lines @@
     CertificateList certs = ListCertsInSlot(slot_->os_module_handle());
     CERTCertTrust default_trust = {0};
     for (size_t i = 0; i < certs.size(); ++i) {
       // Reset cert trust values to defaults before deleting.  Otherwise NSS
       // somehow seems to remember the trust which can break following tests.
       SECStatus srv = CERT_ChangeCertTrust(
           CERT_GetDefaultCertDB(), certs[i]->os_cert_handle(), &default_trust);
       if (srv != SECSuccess)
         ok = false;
 
-      if (!cert_db_->DeleteCertAndKey(certs[i]))
+      if (!cert_db_->DeleteCertAndKey(certs[i].get()))
         ok = false;
     }
     return ok;
   }
 
   crypto::ScopedTestNSSDB test_nssdb_;
 };
 
 TEST_F(CertDatabaseNSSTest, ListCerts) {
   // This test isn't terribly useful, though it will at least let valgrind test
   // for leaks.
   CertificateList certs;
   cert_db_->ListCerts(&certs);
   // The test DB is empty, but let's assume there will always be something in
   // the other slots.
   EXPECT_LT(0U, certs.size());
 }
 
 TEST_F(CertDatabaseNSSTest, ImportFromPKCS12WrongPassword) {
   std::string pkcs12_data = ReadTestFile("client.p12");
 
   EXPECT_EQ(ERR_PKCS12_IMPORT_BAD_PASSWORD,
-            cert_db_->ImportFromPKCS12(slot_,
+            cert_db_->ImportFromPKCS12(slot_.get(),
                                        pkcs12_data,
                                        base::string16(),
                                        true,  // is_extractable
                                        NULL));
 
   // Test db should still be empty.
   EXPECT_EQ(0U, ListCertsInSlot(slot_->os_module_handle()).size());
 }
 
 TEST_F(CertDatabaseNSSTest, ImportFromPKCS12AsExtractableAndExportAgain) {
   std::string pkcs12_data = ReadTestFile("client.p12");
 
-  EXPECT_EQ(OK, cert_db_->ImportFromPKCS12(slot_,
-                                           pkcs12_data,
-                                           ASCIIToUTF16("12345"),
-                                           true,  // is_extractable
-                                           NULL));
+  EXPECT_EQ(OK,
+            cert_db_->ImportFromPKCS12(slot_.get(),
+                                       pkcs12_data,
+                                       ASCIIToUTF16("12345"),
+                                       true,  // is_extractable
+                                       NULL));
 
   CertificateList cert_list = ListCertsInSlot(slot_->os_module_handle());
   ASSERT_EQ(1U, cert_list.size());
   scoped_refptr<X509Certificate> cert(cert_list[0]);
 
   EXPECT_EQ("testusercert",
             cert->subject().common_name);
 
   // TODO(mattm): move export test to separate test case?
   std::string exported_data;
   EXPECT_EQ(1, cert_db_->ExportToPKCS12(cert_list, ASCIIToUTF16("exportpw"),
                                         &exported_data));
   ASSERT_LT(0U, exported_data.size());
   // TODO(mattm): further verification of exported data?
 }
 
 TEST_F(CertDatabaseNSSTest, ImportFromPKCS12Twice) {
   std::string pkcs12_data = ReadTestFile("client.p12");
 
-  EXPECT_EQ(OK, cert_db_->ImportFromPKCS12(slot_,
-                                           pkcs12_data,
-                                           ASCIIToUTF16("12345"),
-                                           true,  // is_extractable
-                                           NULL));
+  EXPECT_EQ(OK,
+            cert_db_->ImportFromPKCS12(slot_.get(),
+                                       pkcs12_data,
+                                       ASCIIToUTF16("12345"),
+                                       true,  // is_extractable
+                                       NULL));
   EXPECT_EQ(1U, ListCertsInSlot(slot_->os_module_handle()).size());
 
   // NSS has a SEC_ERROR_PKCS12_DUPLICATE_DATA error, but it doesn't look like
   // it's ever used.  This test verifies that.
-  EXPECT_EQ(OK, cert_db_->ImportFromPKCS12(slot_,
-                                           pkcs12_data,
-                                           ASCIIToUTF16("12345"),
-                                           true,  // is_extractable
-                                           NULL));
+  EXPECT_EQ(OK,
+            cert_db_->ImportFromPKCS12(slot_.get(),
+                                       pkcs12_data,
+                                       ASCIIToUTF16("12345"),
+                                       true,  // is_extractable
+                                       NULL));
   EXPECT_EQ(1U, ListCertsInSlot(slot_->os_module_handle()).size());
 }
 
 TEST_F(CertDatabaseNSSTest, ImportFromPKCS12AsUnextractableAndExportAgain) {
   std::string pkcs12_data = ReadTestFile("client.p12");
 
-  EXPECT_EQ(OK, cert_db_->ImportFromPKCS12(slot_,
-                                           pkcs12_data,
-                                           ASCIIToUTF16("12345"),
-                                           false,  // is_extractable
-                                           NULL));
+  EXPECT_EQ(OK,
+            cert_db_->ImportFromPKCS12(slot_.get(),
+                                       pkcs12_data,
+                                       ASCIIToUTF16("12345"),
+                                       false,  // is_extractable
+                                       NULL));
 
   CertificateList cert_list = ListCertsInSlot(slot_->os_module_handle());
   ASSERT_EQ(1U, cert_list.size());
   scoped_refptr<X509Certificate> cert(cert_list[0]);
 
   EXPECT_EQ("testusercert",
             cert->subject().common_name);
 
   std::string exported_data;
   EXPECT_EQ(0, cert_db_->ExportToPKCS12(cert_list, ASCIIToUTF16("exportpw"),
                                         &exported_data));
 }
 
 // Importing a PKCS#12 file with a certificate but no corresponding
 // private key should not mark an existing private key as unextractable.
 TEST_F(CertDatabaseNSSTest, ImportFromPKCS12OnlyMarkIncludedKey) {
   std::string pkcs12_data = ReadTestFile("client.p12");
-  EXPECT_EQ(OK, cert_db_->ImportFromPKCS12(slot_,
-                                           pkcs12_data,
-                                           ASCIIToUTF16("12345"),
-                                           true,  // is_extractable
-                                           NULL));
+  EXPECT_EQ(OK,
+            cert_db_->ImportFromPKCS12(slot_.get(),
+                                       pkcs12_data,
+                                       ASCIIToUTF16("12345"),
+                                       true,  // is_extractable
+                                       NULL));
 
   CertificateList cert_list = ListCertsInSlot(slot_->os_module_handle());
   ASSERT_EQ(1U, cert_list.size());
 
   // Now import a PKCS#12 file with just a certificate but no private key.
   pkcs12_data = ReadTestFile("client-nokey.p12");
-  EXPECT_EQ(OK, cert_db_->ImportFromPKCS12(slot_,
-                                           pkcs12_data,
-                                           ASCIIToUTF16("12345"),
-                                           false,  // is_extractable
-                                           NULL));
+  EXPECT_EQ(OK,
+            cert_db_->ImportFromPKCS12(slot_.get(),
+                                       pkcs12_data,
+                                       ASCIIToUTF16("12345"),
+                                       false,  // is_extractable
+                                       NULL));
 
   cert_list = ListCertsInSlot(slot_->os_module_handle());
   ASSERT_EQ(1U, cert_list.size());
 
   // Make sure the imported private key is still extractable.
   std::string exported_data;
   EXPECT_EQ(1, cert_db_->ExportToPKCS12(cert_list, ASCIIToUTF16("exportpw"),
                                         &exported_data));
   ASSERT_LT(0U, exported_data.size());
 }
 
 TEST_F(CertDatabaseNSSTest, ImportFromPKCS12InvalidFile) {
   std::string pkcs12_data = "Foobarbaz";
 
   EXPECT_EQ(ERR_PKCS12_IMPORT_INVALID_FILE,
-            cert_db_->ImportFromPKCS12(slot_,
+            cert_db_->ImportFromPKCS12(slot_.get(),
                                        pkcs12_data,
                                        base::string16(),
                                        true,  // is_extractable
                                        NULL));
 
   // Test db should still be empty.
   EXPECT_EQ(0U, ListCertsInSlot(slot_->os_module_handle()).size());
 }
 
 TEST_F(CertDatabaseNSSTest, ImportCACert_SSLTrust) {
@@ skipping 271 matching lines @@
   EXPECT_EQ("Thawte SGC CA", thawte_cert->subject().common_name);
 
   EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT,
             cert_db_->GetCertTrust(goog_cert.get(), SERVER_CERT));
 
   EXPECT_EQ(0U, goog_cert->os_cert_handle()->trust->sslFlags);
 
   scoped_refptr<CertVerifyProc> verify_proc(new CertVerifyProcNSS());
   int flags = 0;
   CertVerifyResult verify_result;
-  int error = verify_proc->Verify(goog_cert, "www.google.com", flags,
-                                  NULL, empty_cert_list_, &verify_result);
+  int error = verify_proc->Verify(goog_cert.get(),
+                                  "www.google.com",
+                                  flags,
+                                  NULL,
+                                  empty_cert_list_,
+                                  &verify_result);
   EXPECT_EQ(OK, error);
   EXPECT_EQ(0U, verify_result.cert_status);
 }
 
 TEST_F(CertDatabaseNSSTest, ImportServerCert_SelfSigned) {
   CertificateList certs;
   ASSERT_TRUE(ReadCertIntoList("punycodetest.der", &certs));
 
   NSSCertDatabase::ImportCertFailureList failed;
   EXPECT_TRUE(cert_db_->ImportServerCert(certs, NSSCertDatabase::TRUST_DEFAULT,
                                          &failed));
 
   EXPECT_EQ(0U, failed.size());
 
   CertificateList cert_list = ListCertsInSlot(slot_->os_module_handle());
   ASSERT_EQ(1U, cert_list.size());
   scoped_refptr<X509Certificate> puny_cert(cert_list[0]);
 
   EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT,
             cert_db_->GetCertTrust(puny_cert.get(), SERVER_CERT));
   EXPECT_EQ(0U, puny_cert->os_cert_handle()->trust->sslFlags);
 
   scoped_refptr<CertVerifyProc> verify_proc(new CertVerifyProcNSS());
   int flags = 0;
   CertVerifyResult verify_result;
-  int error = verify_proc->Verify(puny_cert, "xn--wgv71a119e.com", flags,
-                                  NULL, empty_cert_list_, &verify_result);
+  int error = verify_proc->Verify(puny_cert.get(),
+                                  "xn--wgv71a119e.com",
+                                  flags,
+                                  NULL,
+                                  empty_cert_list_,
+                                  &verify_result);
   EXPECT_EQ(ERR_CERT_AUTHORITY_INVALID, error);
   EXPECT_EQ(CERT_STATUS_AUTHORITY_INVALID, verify_result.cert_status);
 }
 
 TEST_F(CertDatabaseNSSTest, ImportServerCert_SelfSigned_Trusted) {
   // When using CERT_PKIXVerifyCert (which we do), server trust only works from
   // 3.13.4 onwards.  See https://bugzilla.mozilla.org/show_bug.cgi?id=647364.
   if (!NSS_VersionCheck("3.13.4")) {
     LOG(INFO) << "test skipped on NSS < 3.13.4";
     return;
@@ skipping 13 matching lines @@
   scoped_refptr<X509Certificate> puny_cert(cert_list[0]);
 
   EXPECT_EQ(NSSCertDatabase::TRUSTED_SSL,
             cert_db_->GetCertTrust(puny_cert.get(), SERVER_CERT));
   EXPECT_EQ(unsigned(CERTDB_TRUSTED | CERTDB_TERMINAL_RECORD),
             puny_cert->os_cert_handle()->trust->sslFlags);
 
   scoped_refptr<CertVerifyProc> verify_proc(new CertVerifyProcNSS());
   int flags = 0;
   CertVerifyResult verify_result;
-  int error = verify_proc->Verify(puny_cert, "xn--wgv71a119e.com", flags,
-                                  NULL, empty_cert_list_, &verify_result);
+  int error = verify_proc->Verify(puny_cert.get(),
+                                  "xn--wgv71a119e.com",
+                                  flags,
+                                  NULL,
+                                  empty_cert_list_,
+                                  &verify_result);
   EXPECT_EQ(OK, error);
   EXPECT_EQ(0U, verify_result.cert_status);
 }
 
 TEST_F(CertDatabaseNSSTest, ImportCaAndServerCert) {
   CertificateList ca_certs = CreateCertificateListFromFile(
       GetTestCertsDirectory(), "root_ca_cert.crt",
       X509Certificate::FORMAT_AUTO);
   ASSERT_EQ(1U, ca_certs.size());
 
@@ skipping 10 matching lines @@
 
   // Import server cert with default trust.
   EXPECT_TRUE(cert_db_->ImportServerCert(certs, NSSCertDatabase::TRUST_DEFAULT,
                                          &failed));
   EXPECT_EQ(0U, failed.size());
 
   // Server cert should verify.
   scoped_refptr<CertVerifyProc> verify_proc(new CertVerifyProcNSS());
   int flags = 0;
   CertVerifyResult verify_result;
-  int error = verify_proc->Verify(certs[0], "127.0.0.1", flags,
-                                  NULL, empty_cert_list_, &verify_result);
+  int error = verify_proc->Verify(certs[0].get(),
+                                  "127.0.0.1",
+                                  flags,
+                                  NULL,
+                                  empty_cert_list_,
+                                  &verify_result);
   EXPECT_EQ(OK, error);
   EXPECT_EQ(0U, verify_result.cert_status);
 }
 
 TEST_F(CertDatabaseNSSTest, ImportCaAndServerCert_DistrustServer) {
   // Explicit distrust only works starting in NSS 3.13.
   if (!NSS_VersionCheck("3.13")) {
     LOG(INFO) << "test skipped on NSS < 3.13";
     return;
   }
@@ skipping 13 matching lines @@
       GetTestCertsDirectory(), "ok_cert.pem",
       X509Certificate::FORMAT_AUTO);
   ASSERT_EQ(1U, certs.size());
 
   // Import server cert without inheriting trust from issuer (explicit
   // distrust).
   EXPECT_TRUE(cert_db_->ImportServerCert(
       certs, NSSCertDatabase::DISTRUSTED_SSL, &failed));
   EXPECT_EQ(0U, failed.size());
   EXPECT_EQ(NSSCertDatabase::DISTRUSTED_SSL,
-            cert_db_->GetCertTrust(certs[0], SERVER_CERT));
+            cert_db_->GetCertTrust(certs[0].get(), SERVER_CERT));
 
   EXPECT_EQ(unsigned(CERTDB_TERMINAL_RECORD),
             certs[0]->os_cert_handle()->trust->sslFlags);
 
   // Server cert should fail to verify.
   scoped_refptr<CertVerifyProc> verify_proc(new CertVerifyProcNSS());
   int flags = 0;
   CertVerifyResult verify_result;
-  int error = verify_proc->Verify(certs[0], "127.0.0.1", flags,
-                                  NULL, empty_cert_list_, &verify_result);
+  int error = verify_proc->Verify(certs[0].get(),
+                                  "127.0.0.1",
+                                  flags,
+                                  NULL,
+                                  empty_cert_list_,
+                                  &verify_result);
   EXPECT_EQ(ERR_CERT_REVOKED, error);
   EXPECT_EQ(CERT_STATUS_REVOKED, verify_result.cert_status);
 }
 
 TEST_F(CertDatabaseNSSTest, TrustIntermediateCa) {
   CertificateList ca_certs = CreateCertificateListFromFile(
       GetTestCertsDirectory(), "2048-rsa-root.pem",
       X509Certificate::FORMAT_AUTO);
   ASSERT_EQ(1U, ca_certs.size());
 
@@ skipping 16 matching lines @@
   CertificateList certs = CreateCertificateListFromFile(
       GetTestCertsDirectory(), "2048-rsa-ee-by-2048-rsa-intermediate.pem",
       X509Certificate::FORMAT_AUTO);
   ASSERT_EQ(1U, certs.size());
 
   // Import server cert with default trust.
   EXPECT_TRUE(cert_db_->ImportServerCert(
       certs, NSSCertDatabase::TRUST_DEFAULT, &failed));
   EXPECT_EQ(0U, failed.size());
   EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT,
-            cert_db_->GetCertTrust(certs[0], SERVER_CERT));
+            cert_db_->GetCertTrust(certs[0].get(), SERVER_CERT));
 
   // Server cert should verify.
   scoped_refptr<CertVerifyProc> verify_proc(new CertVerifyProcNSS());
   int flags = 0;
   CertVerifyResult verify_result;
-  int error = verify_proc->Verify(certs[0], "127.0.0.1", flags,
-                                  NULL, empty_cert_list_, &verify_result);
+  int error = verify_proc->Verify(certs[0].get(),
+                                  "127.0.0.1",
+                                  flags,
+                                  NULL,
+                                  empty_cert_list_,
+                                  &verify_result);
   EXPECT_EQ(OK, error);
   EXPECT_EQ(0U, verify_result.cert_status);
 
   // Explicit distrust only works starting in NSS 3.13.
   if (!NSS_VersionCheck("3.13")) {
     LOG(INFO) << "test partially skipped on NSS < 3.13";
     return;
   }
 
   // Trust the root cert and distrust the intermediate.
   EXPECT_TRUE(cert_db_->SetCertTrust(
-      ca_certs[0], CA_CERT, NSSCertDatabase::TRUSTED_SSL));
+      ca_certs[0].get(), CA_CERT, NSSCertDatabase::TRUSTED_SSL));
   EXPECT_TRUE(cert_db_->SetCertTrust(
-      intermediate_certs[0], CA_CERT, NSSCertDatabase::DISTRUSTED_SSL));
+      intermediate_certs[0].get(), CA_CERT, NSSCertDatabase::DISTRUSTED_SSL));
   EXPECT_EQ(
       unsigned(CERTDB_VALID_CA | CERTDB_TRUSTED_CA | CERTDB_TRUSTED_CLIENT_CA),
       ca_certs[0]->os_cert_handle()->trust->sslFlags);
   EXPECT_EQ(unsigned(CERTDB_VALID_CA),
             ca_certs[0]->os_cert_handle()->trust->emailFlags);
   EXPECT_EQ(unsigned(CERTDB_VALID_CA),
             ca_certs[0]->os_cert_handle()->trust->objectSigningFlags);
   EXPECT_EQ(unsigned(CERTDB_TERMINAL_RECORD),
             intermediate_certs[0]->os_cert_handle()->trust->sslFlags);
   EXPECT_EQ(unsigned(CERTDB_VALID_CA),
             intermediate_certs[0]->os_cert_handle()->trust->emailFlags);
   EXPECT_EQ(
       unsigned(CERTDB_VALID_CA),
       intermediate_certs[0]->os_cert_handle()->trust->objectSigningFlags);
 
   // Server cert should fail to verify.
   CertVerifyResult verify_result2;
-  error = verify_proc->Verify(certs[0], "127.0.0.1", flags,
-                              NULL, empty_cert_list_, &verify_result2);
+  error = verify_proc->Verify(certs[0].get(),
+                              "127.0.0.1",
+                              flags,
+                              NULL,
+                              empty_cert_list_,
+                              &verify_result2);
   EXPECT_EQ(ERR_CERT_REVOKED, error);
   EXPECT_EQ(CERT_STATUS_REVOKED, verify_result2.cert_status);
 }
 
 TEST_F(CertDatabaseNSSTest, TrustIntermediateCa2) {
   if (NSS_VersionCheck("3.14.2") && !NSS_VersionCheck("3.15")) {
     // See http://bugzil.la/863947 for details.
     LOG(INFO) << "Skipping test for NSS 3.14.2 - NSS 3.15";
     return;
   }
@@ skipping 13 matching lines @@
   CertificateList certs = CreateCertificateListFromFile(
       GetTestCertsDirectory(), "2048-rsa-ee-by-2048-rsa-intermediate.pem",
       X509Certificate::FORMAT_AUTO);
   ASSERT_EQ(1U, certs.size());
 
   // Import server cert with default trust.
   EXPECT_TRUE(cert_db_->ImportServerCert(
       certs, NSSCertDatabase::TRUST_DEFAULT, &failed));
   EXPECT_EQ(0U, failed.size());
   EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT,
-            cert_db_->GetCertTrust(certs[0], SERVER_CERT));
+            cert_db_->GetCertTrust(certs[0].get(), SERVER_CERT));
 
   // Server cert should verify.
   scoped_refptr<CertVerifyProc> verify_proc(new CertVerifyProcNSS());
   int flags = 0;
   CertVerifyResult verify_result;
-  int error = verify_proc->Verify(certs[0], "127.0.0.1", flags,
-                                  NULL, empty_cert_list_, &verify_result);
+  int error = verify_proc->Verify(certs[0].get(),
+                                  "127.0.0.1",
+                                  flags,
+                                  NULL,
+                                  empty_cert_list_,
+                                  &verify_result);
   EXPECT_EQ(OK, error);
   EXPECT_EQ(0U, verify_result.cert_status);
 
   // Without explicit trust of the intermediate, verification should fail.
   EXPECT_TRUE(cert_db_->SetCertTrust(
-      intermediate_certs[0], CA_CERT, NSSCertDatabase::TRUST_DEFAULT));
+      intermediate_certs[0].get(), CA_CERT, NSSCertDatabase::TRUST_DEFAULT));
 
   // Server cert should fail to verify.
   CertVerifyResult verify_result2;
-  error = verify_proc->Verify(certs[0], "127.0.0.1", flags,
-                              NULL, empty_cert_list_, &verify_result2);
+  error = verify_proc->Verify(certs[0].get(),
+                              "127.0.0.1",
+                              flags,
+                              NULL,
+                              empty_cert_list_,
+                              &verify_result2);
   EXPECT_EQ(ERR_CERT_AUTHORITY_INVALID, error);
   EXPECT_EQ(CERT_STATUS_AUTHORITY_INVALID, verify_result2.cert_status);
 }
 
 TEST_F(CertDatabaseNSSTest, TrustIntermediateCa3) {
   if (NSS_VersionCheck("3.14.2") && !NSS_VersionCheck("3.15")) {
     // See http://bugzil.la/863947 for details.
     LOG(INFO) << "Skipping test for NSS 3.14.2 - NSS 3.15";
     return;
   }
@@ skipping 23 matching lines @@
   CertificateList certs = CreateCertificateListFromFile(
       GetTestCertsDirectory(), "2048-rsa-ee-by-2048-rsa-intermediate.pem",
       X509Certificate::FORMAT_AUTO);
   ASSERT_EQ(1U, certs.size());
 
   // Import server cert with default trust.
   EXPECT_TRUE(cert_db_->ImportServerCert(
       certs, NSSCertDatabase::TRUST_DEFAULT, &failed));
   EXPECT_EQ(0U, failed.size());
   EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT,
-            cert_db_->GetCertTrust(certs[0], SERVER_CERT));
+            cert_db_->GetCertTrust(certs[0].get(), SERVER_CERT));
 
   // Server cert should verify.
   scoped_refptr<CertVerifyProc> verify_proc(new CertVerifyProcNSS());
   int flags = 0;
   CertVerifyResult verify_result;
-  int error = verify_proc->Verify(certs[0], "127.0.0.1", flags,
-                                  NULL, empty_cert_list_, &verify_result);
+  int error = verify_proc->Verify(certs[0].get(),
+                                  "127.0.0.1",
+                                  flags,
+                                  NULL,
+                                  empty_cert_list_,
+                                  &verify_result);
   EXPECT_EQ(OK, error);
   EXPECT_EQ(0U, verify_result.cert_status);
 
   // Without explicit trust of the intermediate, verification should fail.
   EXPECT_TRUE(cert_db_->SetCertTrust(
-      intermediate_certs[0], CA_CERT, NSSCertDatabase::TRUST_DEFAULT));
+      intermediate_certs[0].get(), CA_CERT, NSSCertDatabase::TRUST_DEFAULT));
 
   // Server cert should fail to verify.
   CertVerifyResult verify_result2;
-  error = verify_proc->Verify(certs[0], "127.0.0.1", flags,
-                              NULL, empty_cert_list_, &verify_result2);
+  error = verify_proc->Verify(certs[0].get(),
+                              "127.0.0.1",
+                              flags,
+                              NULL,
+                              empty_cert_list_,
+                              &verify_result2);
   EXPECT_EQ(ERR_CERT_AUTHORITY_INVALID, error);
   EXPECT_EQ(CERT_STATUS_AUTHORITY_INVALID, verify_result2.cert_status);
 }
 
 TEST_F(CertDatabaseNSSTest, TrustIntermediateCa4) {
   // Explicit distrust only works starting in NSS 3.13.
   if (!NSS_VersionCheck("3.13")) {
     LOG(INFO) << "test skipped on NSS < 3.13";
     return;
   }
@@ skipping 23 matching lines @@
   CertificateList certs = CreateCertificateListFromFile(
       GetTestCertsDirectory(), "2048-rsa-ee-by-2048-rsa-intermediate.pem",
       X509Certificate::FORMAT_AUTO);
   ASSERT_EQ(1U, certs.size());
 
   // Import server cert with default trust.
   EXPECT_TRUE(cert_db_->ImportServerCert(
       certs, NSSCertDatabase::TRUST_DEFAULT, &failed));
   EXPECT_EQ(0U, failed.size());
   EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT,
-            cert_db_->GetCertTrust(certs[0], SERVER_CERT));
+            cert_db_->GetCertTrust(certs[0].get(), SERVER_CERT));
 
   // Server cert should not verify.
   scoped_refptr<CertVerifyProc> verify_proc(new CertVerifyProcNSS());
   int flags = 0;
   CertVerifyResult verify_result;
-  int error = verify_proc->Verify(certs[0], "127.0.0.1", flags,
-                                  NULL, empty_cert_list_, &verify_result);
+  int error = verify_proc->Verify(certs[0].get(),
+                                  "127.0.0.1",
+                                  flags,
+                                  NULL,
+                                  empty_cert_list_,
+                                  &verify_result);
   EXPECT_EQ(ERR_CERT_REVOKED, error);
   EXPECT_EQ(CERT_STATUS_REVOKED, verify_result.cert_status);
 
   // Without explicit distrust of the intermediate, verification should succeed.
   EXPECT_TRUE(cert_db_->SetCertTrust(
-      intermediate_certs[0], CA_CERT, NSSCertDatabase::TRUST_DEFAULT));
+      intermediate_certs[0].get(), CA_CERT, NSSCertDatabase::TRUST_DEFAULT));
 
   // Server cert should verify.
   CertVerifyResult verify_result2;
-  error = verify_proc->Verify(certs[0], "127.0.0.1", flags,
-                              NULL, empty_cert_list_, &verify_result2);
+  error = verify_proc->Verify(certs[0].get(),
+                              "127.0.0.1",
+                              flags,
+                              NULL,
+                              empty_cert_list_,
+                              &verify_result2);
   EXPECT_EQ(OK, error);
   EXPECT_EQ(0U, verify_result2.cert_status);
 }
 
 // Importing two certificates with the same issuer and subject common name,
 // but overall distinct subject names, should succeed and generate a unique
 // nickname for the second certificate.
 TEST_F(CertDatabaseNSSTest, ImportDuplicateCommonName) {
   CertificateList certs =
       CreateCertificateListFromFile(GetTestCertsDirectory(),
                                     "duplicate_cn_1.pem",
                                     X509Certificate::FORMAT_AUTO);
   ASSERT_EQ(1U, certs.size());
 
   EXPECT_EQ(0U, ListCertsInSlot(slot_->os_module_handle()).size());
 
   // Import server cert with default trust.
   NSSCertDatabase::ImportCertFailureList failed;
   EXPECT_TRUE(cert_db_->ImportServerCert(
       certs, NSSCertDatabase::TRUST_DEFAULT, &failed));
   EXPECT_EQ(0U, failed.size());
   EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT,
-            cert_db_->GetCertTrust(certs[0], SERVER_CERT));
+            cert_db_->GetCertTrust(certs[0].get(), SERVER_CERT));
 
   CertificateList new_certs = ListCertsInSlot(slot_->os_module_handle());
   ASSERT_EQ(1U, new_certs.size());
 
   // Now attempt to import a different certificate with the same common name.
   CertificateList certs2 =
       CreateCertificateListFromFile(GetTestCertsDirectory(),
                                     "duplicate_cn_2.pem",
                                     X509Certificate::FORMAT_AUTO);
   ASSERT_EQ(1U, certs2.size());
 
   // Import server cert with default trust.
   EXPECT_TRUE(cert_db_->ImportServerCert(
       certs2, NSSCertDatabase::TRUST_DEFAULT, &failed));
   EXPECT_EQ(0U, failed.size());
   EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT,
-            cert_db_->GetCertTrust(certs2[0], SERVER_CERT));
+            cert_db_->GetCertTrust(certs2[0].get(), SERVER_CERT));
 
   new_certs = ListCertsInSlot(slot_->os_module_handle());
   ASSERT_EQ(2U, new_certs.size());
   EXPECT_STRNE(new_certs[0]->os_cert_handle()->nickname,
                new_certs[1]->os_cert_handle()->nickname);
 }
 
 }  // namespace net