Merge 48667 - Prevent extensions from clobbering JSON implementation that ext...

chrome/renderer/resources/event_bindings.js

Index: chrome/renderer/resources/event_bindings.js
===================================================================
--- chrome/renderer/resources/event_bindings.js	(revision 49570)
+++ chrome/renderer/resources/event_bindings.js	(working copy)
@@ -9,7 +9,41 @@
   native function DetachEvent(eventName);
 
   var chromeHidden = GetChromeHidden();
+  
+  // Local implementation of JSON.parse & JSON.stringify that protect us
+  // from being clobbered by an extension.
+  chromeHidden.JSON = new (function() {
+    const $Object = Object;
+    const $Array = Array;
+    const $jsonStringify = JSON.stringify;
+    const $jsonParse = JSON.parse;
 
+    this.stringify = function(thing) {
+      var customizedObjectToJSON = $Object.prototype.toJSON;
+      var customizedArrayToJSON = $Array.prototype.toJSON;
+      if (customizedObjectToJSON !== undefined) {
+        $Object.prototype.toJSON = null;
+      }
+      if (customizedArrayToJSON !== undefined) {
+        $Array.prototype.toJSON = null;
+      }
+      try {
+        return $jsonStringify(thing);
+      } finally {
+        if (customizedObjectToJSON !== undefined) {
+          $Object.prototype.toJSON = customizedObjectToJSON;
+        }
+        if (customizedArrayToJSON !== undefined) {
+          $Array.prototype.toJSON = customizedArrayToJSON;
+        }
+      }
+    };
+
+    this.parse = function(thing) {
+      return $jsonParse(thing);
+    };
+  })();
+
   // Event object.  If opt_eventName is provided, this object represents
   // the unique instance of that named event, and dispatching an event
   // with that name will route through this object's listeners.
@@ -53,7 +87,7 @@
   chromeHidden.Event.dispatchJSON = function(name, args) {
     if (attachedNamedEvents[name]) {
       if (args) {
-        args = JSON.parse(args);
+        args = chromeHidden.JSON.parse(args);
       }
       return attachedNamedEvents[name].dispatch.apply(
           attachedNamedEvents[name], args);