TestMultipleRootMatchesOnlyOneWorks expects the path builder to try paths in a specific order, specifically, it expects it to first find a bad path, and then find a good path.  If the trust store returns the anchor for the good path first, it will never try the bad path, and the test will fail.  Tests use in-memory trust store which is backed by unordered_multimap, which is unordered, i.e. the order in which the anchors are returned are platform-specific.  So depending on libc you're compiling with and the phase of the moon, the test may break, which it did when I tried merging new Chromium changes into proto-quic today.