When user "discards history," discard speculative data as well

The speculative system record the first 10 connections
that are made (at startup), and also learns about 
subresource connections made when the user visits 
sites.  This information implies visitation history,
and needs to be discarded when the user 


BUG=62891
r=eroman,sky
Review URL: http://codereview.chromium.org/6538007

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@75525 0039d316-1c4b-4281-b951-d872f2087c98

6 files changed, 46 insertions, 19 deletions

diff --git a/chrome/browser/browsing_data_remover.cc b/chrome/browser/browsing_data_remover.cc
index b9cae94..7a5183c 100644
--- a/chrome/browser/browsing_data_remover.cc
+++ b/chrome/browser/browsing_data_remover.cc
@@ -66,7 +66,7 @@ BrowsingDataRemover::BrowsingDataRemover(Profile* profile,
       media_context_getter_(profile->GetRequestContextForMedia()),
       waiting_for_clear_databases_(false),
       waiting_for_clear_history_(false),
-      waiting_for_clear_host_cache_(false),
+      waiting_for_clear_networking_history_(false),
       waiting_for_clear_cache_(false),
       waiting_for_clear_appcache_(false) {
   DCHECK(profile);
@@ -93,7 +93,7 @@ BrowsingDataRemover::BrowsingDataRemover(Profile* profile,
       media_context_getter_(profile->GetRequestContextForMedia()),
       waiting_for_clear_databases_(false),
       waiting_for_clear_history_(false),
-      waiting_for_clear_host_cache_(false),
+      waiting_for_clear_networking_history_(false),
       waiting_for_clear_cache_(false),
       waiting_for_clear_appcache_(false),
       waiting_for_clear_lso_data_(false) {
@@ -141,13 +141,14 @@ void BrowsingDataRemover::Remove(int remove_mask) {
           NewCallback(this, &BrowsingDataRemover::OnHistoryDeletionDone));
     }
 
-    // Need to clear the host cache, as it also reveals some history.
-    waiting_for_clear_host_cache_ = true;
+    // Need to clear the host cache and accumulated speculative data, as it also
+    // reveals some history.
+    waiting_for_clear_networking_history_ = true;
     BrowserThread::PostTask(
         BrowserThread::IO, FROM_HERE,
         NewRunnableMethod(
             this,
-            &BrowsingDataRemover::ClearHostCacheOnIOThread,
+            &BrowsingDataRemover::ClearNetworkingHistory,
             g_browser_process->io_thread()));
 
     // As part of history deletion we also delete the auto-generated keywords.
@@ -356,16 +357,16 @@ void BrowsingDataRemover::NotifyAndDeleteIfDone() {
 }
 
 void BrowsingDataRemover::ClearedNetworkHistory() {
-  waiting_for_clear_host_cache_ = false;
+  waiting_for_clear_networking_history_ = false;
 
   NotifyAndDeleteIfDone();
 }
 
-void BrowsingDataRemover::ClearHostCacheOnIOThread(IOThread* io_thread) {
+void BrowsingDataRemover::ClearNetworkingHistory(IOThread* io_thread) {
   // This function should be called on the IO thread.
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
 
-  io_thread->ClearHostCache();
+  io_thread->ClearNetworkingHistory();
 
   // Notify the UI thread that we are done.
   BrowserThread::PostTask(
diff --git a/chrome/browser/browsing_data_remover.h b/chrome/browser/browsing_data_remover.h
index 39b280a..ef4ff5a 100644
--- a/chrome/browser/browsing_data_remover.h
+++ b/chrome/browser/browsing_data_remover.h
@@ -121,9 +121,9 @@ class BrowsingDataRemover : public NotificationObserver,
   // NotifyAndDeleteIfDone.
   void ClearedNetworkHistory();
 
-  // Invoked on the IO thread to clear the HostCache, which exposes some
-  // network history.
-  void ClearHostCacheOnIOThread(IOThread* io_thread);
+  // Invoked on the IO thread to clear the HostCache, speculative data about
+  // subresources on visited sites, and initial navigation history.
+  void ClearNetworkingHistory(IOThread* io_thread);
 
   // Callback when the cache has been deleted. Invokes NotifyAndDeleteIfDone.
   void ClearedCache();
@@ -163,7 +163,8 @@ class BrowsingDataRemover : public NotificationObserver,
   // Returns true if we're all done.
   bool all_done() {
     return registrar_.IsEmpty() && !waiting_for_clear_cache_ &&
-           !waiting_for_clear_history_ && !waiting_for_clear_host_cache_ &&
+           !waiting_for_clear_history_ &&
+           !waiting_for_clear_networking_history_ &&
            !waiting_for_clear_databases_ && !waiting_for_clear_appcache_ &&
            !waiting_for_clear_lso_data_;
   }
@@ -210,7 +211,7 @@ class BrowsingDataRemover : public NotificationObserver,
   // True if we're waiting for various data to be deleted.
   bool waiting_for_clear_databases_;
   bool waiting_for_clear_history_;
-  bool waiting_for_clear_host_cache_;
+  bool waiting_for_clear_networking_history_;
   bool waiting_for_clear_cache_;
   bool waiting_for_clear_appcache_;
   bool waiting_for_clear_lso_data_;
diff --git a/chrome/browser/io_thread.cc b/chrome/browser/io_thread.cc
index 16eec12..2a854b8 100644
--- a/chrome/browser/io_thread.cc
+++ b/chrome/browser/io_thread.cc
@@ -15,6 +15,7 @@
 #include "base/string_split.h"
 #include "base/string_util.h"
 #include "base/threading/thread_restrictions.h"
+#include "chrome/browser/browser_process.h"
 #include "chrome/browser/browser_thread.h"
 #include "chrome/browser/gpu_process_host.h"
 #include "chrome/browser/in_process_webkit/indexed_db_key_utility_client.h"
@@ -295,6 +296,15 @@ void IOThread::ChangedToOnTheRecord() {
           &IOThread::ChangedToOnTheRecordOnIOThread));
 }
 
+void IOThread::ClearNetworkingHistory() {
+  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
+  ClearHostCache();
+  // Discard acrued data used to speculate in the future.
+  chrome_browser_net::DiscardInitialNavigationHistory();
+  if (predictor_)
+    predictor_->DiscardAllResults();
+}
+
 void IOThread::Init() {
   // Though this thread is called the "IO" thread, it actually just routes
   // messages around; it shouldn't be allowed to perform any blocking disk I/O.
@@ -496,6 +506,7 @@ void IOThread::ChangedToOnTheRecordOnIOThread() {
 
   if (predictor_) {
     // Destroy all evidence of our OTR session.
+    // Note: OTR mode never saves InitialNavigationHistory data.
     predictor_->Predictor::DiscardAllResults();
   }
 
diff --git a/chrome/browser/io_thread.h b/chrome/browser/io_thread.h
index f912765..10cac6fa 100644
--- a/chrome/browser/io_thread.h
+++ b/chrome/browser/io_thread.h
@@ -95,14 +95,13 @@ class IOThread : public BrowserProcessSubThread {
   void UnregisterURLRequestContextGetter(
       ChromeURLRequestContextGetter* url_request_context_getter);
 
-  // Handles changing to On The Record mode.  Post a task for this onto the
-  // IOThread's message loop.
+  // Handles changing to On The Record mode, discarding confidential data.
   void ChangedToOnTheRecord();
 
-  // Clears the host cache.  Intended to be used to prevent exposing recently
-  // visited sites on about:net-internals/#dns and about:dns pages.  Must be
-  // called on the IO thread.
-  void ClearHostCache();
+  // Clear all network stack history, including the host cache, as well as
+  // speculative data about subresources of visited sites, and startup-time
+  // navigations.
+  void ClearNetworkingHistory();
 
  protected:
   virtual void Init();
@@ -125,6 +124,11 @@ class IOThread : public BrowserProcessSubThread {
 
   void ChangedToOnTheRecordOnIOThread();
 
+  // Clears the host cache.  Intended to be used to prevent exposing recently
+  // visited sites on about:net-internals/#dns and about:dns pages.  Must be
+  // called on the IO thread.
+  void ClearHostCache();
+
   // The NetLog is owned by the browser process, to allow logging from other
   // threads during shutdown, but is used most frequently on the IOThread.
   ChromeNetLog* net_log_;
diff --git a/chrome/browser/net/predictor_api.cc b/chrome/browser/net/predictor_api.cc
index 52a1497..f417aaf 100644
--- a/chrome/browser/net/predictor_api.cc
+++ b/chrome/browser/net/predictor_api.cc
@@ -96,6 +96,9 @@ class InitialObserver {
   // Persist the current first_navigations_ for storage in a list.
   void GetInitialDnsResolutionList(ListValue* startup_list);
 
+  // Discards all initial loading history.
+  void DiscardInitialNavigationHistory() { first_navigations_.clear(); }
+
  private:
   // List of the first N URL resolutions observed in this run.
   FirstNavigations first_navigations_;
@@ -134,6 +137,12 @@ void OnTheRecord(bool enable) {
     g_browser_process->io_thread()->ChangedToOnTheRecord();
 }
 
+void DiscardInitialNavigationHistory() {
+  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
+  if (g_initial_observer)
+    g_initial_observer->DiscardInitialNavigationHistory();
+}
+
 void RegisterUserPrefs(PrefService* user_prefs) {
   user_prefs->RegisterListPref(prefs::kDnsPrefetchingStartupList);
   user_prefs->RegisterListPref(prefs::kDnsPrefetchingHostReferralList);
diff --git a/chrome/browser/net/predictor_api.h b/chrome/browser/net/predictor_api.h
index 8f22d31..1eb27c0 100644
--- a/chrome/browser/net/predictor_api.h
+++ b/chrome/browser/net/predictor_api.h
@@ -41,6 +41,7 @@ void FreePredictorResources();
 //------------------------------------------------------------------------------
 // Global APIs relating to predictions in browser.
 void EnablePredictor(bool enable);
+void DiscardInitialNavigationHistory();
 void RegisterUserPrefs(PrefService* user_prefs);
 
 // Renderer bundles up list and sends to this browser API via IPC.