update master-with-bazel from master branch

src/crypto/x509/x509_vfy.c

@@ -1432,12 +1432,8 @@ static int cert_crl(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x) {
       return 0;
     }
   }
-  // Look for serial number of certificate in CRL If found make sure reason
-  // is not removeFromCRL.
+  // Look for serial number of certificate in CRL.
   if (X509_CRL_get0_by_cert(crl, &rev, x)) {
-    if (rev->reason == CRL_REASON_REMOVE_FROM_CRL) {
-      return 2;
-    }
     ctx->error = X509_V_ERR_CERT_REVOKED;
     ok = ctx->verify_cb(0, ctx);
     if (!ok) {

src/crypto/x509/x_crl.c

@@ -440,9 +440,6 @@ static int crl_lookup(X509_CRL *crl, X509_REVOKED **ret,
       if (ret) {
         *ret = rev;
       }
-      if (rev->reason == CRL_REASON_REMOVE_FROM_CRL) {
-        return 2;
-      }
       return 1;
     }
   }

src/include/openssl/x509.h

@@ -570,9 +570,8 @@ OPENSSL_EXPORT const ASN1_TIME *X509_CRL_get0_nextUpdate(const X509_CRL *crl);
 OPENSSL_EXPORT X509_NAME *X509_CRL_get_issuer(const X509_CRL *crl);
 
 // X509_CRL_get0_by_serial finds the entry in |crl| whose serial number is
-// |serial|. If found, it sets |*out| to the entry. It then returns two if the
-// reason code is removeFromCRL and one if it was revoked. If not found, it
-// returns zero.
+// |serial|. If found, it sets |*out| to the entry and returns one. If not
+// found, it returns zero.
 //
 // On success, |*out| continues to be owned by |crl|. It is an error to free or
 // otherwise modify |*out|.
@@ -580,9 +579,6 @@ OPENSSL_EXPORT X509_NAME *X509_CRL_get_issuer(const X509_CRL *crl);
 // TODO(crbug.com/boringssl/600): Ideally |crl| would be const. It is broadly
 // thread-safe, but changes the order of entries in |crl|. It cannot be called
 // concurrently with |i2d_X509_CRL|.
-//
-// TODO(crbug.com/boringssl/601): removeFromCRL is part of delta CRLs. Remove
-// this special case.
 OPENSSL_EXPORT int X509_CRL_get0_by_serial(X509_CRL *crl, X509_REVOKED **out,
                                            const ASN1_INTEGER *serial);