Remove passwords from the keychain if the profile is destroyed.

chrome/browser/profiles/profile_manager.cc

Index: chrome/browser/profiles/profile_manager.cc
diff --git a/chrome/browser/profiles/profile_manager.cc b/chrome/browser/profiles/profile_manager.cc
index 845f33c818d4799b1e575f41689c06cb69a45972..45cd9a2055b2e80521b28824f64e484645fe6bb7 100644
--- a/chrome/browser/profiles/profile_manager.cc
+++ b/chrome/browser/profiles/profile_manager.cc
@@ -25,6 +25,7 @@
 #include "chrome/browser/content_settings/host_content_settings_map.h"
 #include "chrome/browser/download/download_service.h"
 #include "chrome/browser/download/download_service_factory.h"
+#include "chrome/browser/password_manager/password_store_factory.h"
 #include "chrome/browser/prefs/incognito_mode_prefs.h"
 #include "chrome/browser/profiles/bookmark_model_loaded_observer.h"
 #include "chrome/browser/profiles/profile_avatar_icon_util.h"
@@ -47,6 +48,7 @@
 #include "chrome/common/pref_names.h"
 #include "chrome/common/url_constants.h"
 #include "components/bookmarks/browser/bookmark_model.h"
+#include "components/password_manager/core/browser/password_store.h"
 #include "components/signin/core/common/profile_management_switches.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/notification_service.h"
@@ -1108,6 +1110,16 @@ void ProfileManager::FinishDeletingProfile(const base::FilePath& profile_dir) {
     bool profile_is_signed_in = !cache.GetUserNameOfProfileAtIndex(
         cache.GetIndexOfProfileWithPath(profile_dir)).empty();
     ProfileMetrics::LogProfileDelete(profile_is_signed_in);
+#if !defined(OS_WIN) && !defined(OS_ANDROID) && !defined(OS_CHROMEOS)

[stuartmorgan, 2014/07/07 18:49:42]

Is this code actually expensive enough that we need to ifdef it out on these
platforms?

[vasilii, 2014/07/08 09:27:39]

Not really.

+    // Some platforms store passwords in keychains. They should be removed.
+    scoped_refptr<password_manager::PasswordStore> password_store =
+        PasswordStoreFactory::GetForProfile(profile, Profile::EXPLICIT_ACCESS)
+            .get();
+    if (password_store) {
+      password_store->RemoveLoginsCreatedBetween(base::Time(),
+                                                 base::Time::Max());
+    }
+#endif  // !defined(OS_WIN) && !defined(OS_ANDROID) && !defined(OS_CHROMEOS)
   }
 
   QueueProfileDirectoryForDeletion(profile_dir);