Instrument calls to window.speechSynthesis.getVoices().

This will be used to analyze how much entropy leaked by this API can be
used for cross-site tracking.

This cl does not address entropy leaked by voiceschanged events. Given
those events only occur when the list of voices changes due to a voice
being added or becoming unavailable, it is unlikely that they would be
useful to fingerprinting scripts.

Bug: 973801
Change-Id: Iaa2a43f942f2eb59cece362a571da3fe308e4831
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2435738Reviewed-by: Dominic Mazzoni <dmazzoni@chromium.org>
Reviewed-by: Asanka Herath <asanka@chromium.org>
Commit-Queue: Chris Fredrickson <cfredric@google.com>
Cr-Commit-Position: refs/heads/master@{#812132}

third_party/blink/public/mojom/web_feature/web_feature.mojom

@@ -2804,7 +2804,7 @@ enum WebFeature {
   kWebkitPrerenderDOMContentLoadedEventFired = 3476,
   kIdleDetectionPermissionRequested = 3477,
   kIdentifiabilityStudyReserved3478 = 3478,
-  kIdentifiabilityStudyReserved3479 = 3479,
+  kSpeechSynthesis_GetVoices_Method = 3479,
   kIdentifiabilityStudyReserved3480 = 3480,
   kV8Navigator_JavaEnabled_Method = 3481,
   kIdentifiabilityStudyReserved3482 = 3482,

third_party/blink/renderer/modules/speech/speech_synthesis.cc

@@ -27,6 +27,10 @@
 
 #include "build/build_config.h"
 #include "third_party/blink/public/common/browser_interface_broker_proxy.h"
+#include "third_party/blink/public/common/privacy_budget/identifiability_metric_builder.h"
+#include "third_party/blink/public/common/privacy_budget/identifiability_study_settings.h"
+#include "third_party/blink/public/common/privacy_budget/identifiable_token.h"
+#include "third_party/blink/public/common/privacy_budget/identifiable_token_builder.h"
 #include "third_party/blink/public/common/thread_safe_browser_interface_broker_proxy.h"
 #include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/renderer/bindings/modules/v8/v8_speech_synthesis_error_event_init.h"
@@ -35,12 +39,15 @@
 #include "third_party/blink/renderer/core/execution_context/execution_context.h"
 #include "third_party/blink/renderer/core/frame/deprecation.h"
 #include "third_party/blink/renderer/core/frame/local_dom_window.h"
+#include "third_party/blink/renderer/core/frame/web_feature.h"
 #include "third_party/blink/renderer/core/html/media/autoplay_policy.h"
 #include "third_party/blink/renderer/core/timing/dom_window_performance.h"
 #include "third_party/blink/renderer/core/timing/performance.h"
 #include "third_party/blink/renderer/modules/speech/speech_synthesis_error_event.h"
 #include "third_party/blink/renderer/modules/speech/speech_synthesis_event.h"
+#include "third_party/blink/renderer/modules/speech/speech_synthesis_voice.h"
 #include "third_party/blink/renderer/platform/instrumentation/use_counter.h"
+#include "third_party/blink/renderer/platform/privacy_budget/identifiability_digest_helpers.h"
 
 namespace blink {
 
@@ -91,9 +98,32 @@ void SpeechSynthesis::OnSetVoiceList(
 const HeapVector<Member<SpeechSynthesisVoice>>& SpeechSynthesis::getVoices() {
   // Kick off initialization here to ensure voice list gets populated.
   ignore_result(TryEnsureMojomSynthesis());
+  RecordVoicesForIdentifiability();
   return voice_list_;
 }
 
+void SpeechSynthesis::RecordVoicesForIdentifiability() const {
+  constexpr IdentifiableSurface surface = IdentifiableSurface::FromTypeAndToken(
+      IdentifiableSurface::Type::kWebFeature,
+      WebFeature::kSpeechSynthesis_GetVoices_Method);
+  if (!IdentifiabilityStudySettings::Get()->IsSurfaceAllowed(surface))
+    return;
+  ExecutionContext* context = GetExecutionContext();
+  if (!context)
+    return;
+
+  IdentifiableTokenBuilder builder;
+  for (const auto& voice : voice_list_) {
+    builder.AddToken(IdentifiabilityBenignStringToken(voice->voiceURI()));
+    builder.AddToken(IdentifiabilityBenignStringToken(voice->lang()));
+    builder.AddToken(IdentifiabilityBenignStringToken(voice->name()));
+    builder.AddToken(voice->localService());
+  }
+  IdentifiabilityMetricBuilder(context->UkmSourceID())
+      .Set(surface, builder.GetToken())
+      .Record(context->UkmRecorder());
+}
+
 bool SpeechSynthesis::speaking() const {
   // If we have a current speech utterance, then that means we're assumed to be
   // in a speaking state. This state is independent of whether the utterance

third_party/blink/renderer/modules/speech/speech_synthesis.h

@@ -122,6 +122,8 @@ class MODULES_EXPORT SpeechSynthesis final
 
   bool IsAllowedToStartByAutoplay() const;
 
+  void RecordVoicesForIdentifiability() const;
+
   void SetMojomSynthesisForTesting(
       mojo::PendingRemote<mojom::blink::SpeechSynthesis>);
   mojom::blink::SpeechSynthesis* TryEnsureMojomSynthesis();

tools/metrics/histograms/enums.xml

@@ -29269,7 +29269,7 @@ Called by update_use_counter_feature_enum.py.-->
   <int value="3476" label="WebkitPrerenderDOMContentLoadedEventFired"/>
   <int value="3477" label="IdleDetectionPermissionRequested"/>
   <int value="3478" label="IdentifiabilityStudyReserved3478"/>
-  <int value="3479" label="IdentifiabilityStudyReserved3479"/>
+  <int value="3479" label="SpeechSynthesis_GetVoices_Method"/>
   <int value="3480" label="IdentifiabilityStudyReserved3480"/>
   <int value="3481" label="V8Navigator_JavaEnabled_Method"/>
   <int value="3482" label="IdentifiabilityStudyReserved3482"/>