Closing a guest session clears all browsing history.

chrome/browser/ui/browser.cc

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/browser.h"
 
 #if defined(OS_WIN)
 #include <windows.h>
 #include <shellapi.h>
 #endif  // defined(OS_WIN)
@@ skipping 16 matching lines @@
 #include "base/threading/thread_restrictions.h"
 #include "base/time/time.h"
 #include "chrome/app/chrome_command_ids.h"
 #include "chrome/browser/app_mode/app_mode_utils.h"
 #include "chrome/browser/autofill/personal_data_manager_factory.h"
 #include "chrome/browser/background/background_contents.h"
 #include "chrome/browser/background/background_contents_service.h"
 #include "chrome/browser/background/background_contents_service_factory.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/browser_shutdown.h"
+#include "chrome/browser/browsing_data/browsing_data_helper.h"
+#include "chrome/browser/browsing_data/browsing_data_remover.h"
 #include "chrome/browser/character_encoding.h"
 #include "chrome/browser/chrome_notification_types.h"
 #include "chrome/browser/content_settings/tab_specific_content_settings.h"
 #include "chrome/browser/custom_handlers/protocol_handler_registry.h"
 #include "chrome/browser/custom_handlers/protocol_handler_registry_factory.h"
 #include "chrome/browser/custom_handlers/register_protocol_handler_infobar_delegate.h"
 #include "chrome/browser/custom_handlers/register_protocol_handler_permission_request.h"
 #include "chrome/browser/defaults.h"
 #include "chrome/browser/devtools/devtools_toggle_action.h"
 #include "chrome/browser/devtools/devtools_window.h"
@@ skipping 457 matching lines @@
   // Destroy BrowserExtensionWindowController before the incognito profile
   // is destroyed to make sure the chrome.windows.onRemoved event is sent.
   extension_window_controller_.reset();
 
   // Destroy BrowserInstantController before the incongnito profile is destroyed
   // because the InstantController destructor depends on this profile.
   instant_controller_.reset();
 
   if (profile_->IsOffTheRecord() &&
       !BrowserList::IsOffTheRecordSessionActiveForProfile(profile_)) {
-    // An incognito profile is no longer needed, this indirectly frees
-    // its cache and cookies once it gets destroyed at the appropriate time.
-    ProfileDestroyer::DestroyProfileWhenAppropriate(profile_);
+    if (profile_->IsGuestSession()) {

[Peter Kasting, 2015/02/10 21:43:36]

How come the incognito codepath doesn't actually work right?  The bug sounds
like this causes us to delete more state than before, but from the way the code
here reads I'd expect it to delete less state -- the incognito path destroys the
entire profile while this doesn't (and it even has a TODO to do so).

It seems like maybe there should be more comments here about why we can't do
what the incognito path does. 

[Mike Lerman, 2015/02/10 21:53:32]

I've modified the comment to explain why we're doing this. In short, the guest
profile has more setup than the incognito profile (such as
BrowserContextKeyedServices), and deleting it is hard, and won't get merged into
M41.

Ideally, we want to delete as much state as possible, but that requires profile
deletion, so for now we're going to clear browser data.

[Peter Kasting, 2015/02/10 21:58:10]

OK, the new comment is better, but I still don't really know what "it's harder
to just delete it" means.  Does that mean "DestroyProfileWhenAppropriate()
doesn't work right, and the fix for that is too big to merge, but we're going to
do that and then remove the conditional here again"?  Or something else?

[Mike Lerman, 2015/02/11 15:15:32]

You're exactly right. DestroyProfileWhenAppropriate, and the ProfileDestroyer,
just wrap and delay around deleting the Profile*. Deleting a Profile* (except
for an offTheRecordProfile) while Chrome's running doesn't currently work, and
that fix will be too big to merge.

I'm working on that fix (https://codereview.chromium.org/853743002/), and when I
lands that I can remove the BrowsingDataRemover here and just use the
ProfileDestroyer, as does the OffTheRecord.

Changed the comment a bit more.

+      // Clear all browsing data once a Guest Session completes.
+      // TODO(mlerman): Delete the guest |profile_| completely instead.
+      BrowsingDataRemover* data_remover =
+          BrowsingDataRemover::CreateForUnboundedRange(profile_);
+      data_remover->Remove(BrowsingDataRemover::REMOVE_ALL ^
+                               BrowsingDataRemover::REMOVE_DOWNLOADS,
+                           BrowsingDataHelper::ALL);
+      // BrowsingDataRemover deletes itself.
+    } else {
+      // An incognito profile is no longer needed, this indirectly frees
+      // its cache and cookies once it gets destroyed at the appropriate time.
+      ProfileDestroyer::DestroyProfileWhenAppropriate(profile_);
+    }
   }
 
   // There may be pending file dialogs, we need to tell them that we've gone
   // away so they don't try and call back to us.
   if (select_file_dialog_.get())
     select_file_dialog_->ListenerDestroyed();
 
   int num_downloads;
   if (OkToCloseWithInProgressDownloads(&num_downloads) ==
           DOWNLOAD_CLOSE_BROWSER_SHUTDOWN &&
@@ skipping 1985 matching lines @@
   if (contents && !allow_js_access) {
     contents->web_contents()->GetController().LoadURL(
         target_url,
         content::Referrer(),
         ui::PAGE_TRANSITION_LINK,
         std::string());  // No extra headers.
   }
 
   return contents != NULL;
 }