Make the externally connectable browser test clobber all of the builtins,

chrome/renderer/extensions/safe_builtins.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/extensions/safe_builtins.h"
 
 #include "base/logging.h"
 #include "base/stl_util.h"
 #include "base/strings/stringprintf.h"
 #include "chrome/renderer/extensions/chrome_v8_context.h"
@@ skipping 41 matching lines @@
     "  });\n"
     "}\n"
     "\n"
     "function getSafeBuiltin(builtin) {\n"
     "  var safe = {};\n"
     "  makeCallable(builtin, safe, true);\n"
     "  makeCallable(builtin.prototype, safe, false);\n"
     "  return safe;\n"
     "}\n"
     "\n"
-    "[Array, Function, Object].forEach(function(builtin) {\n"
+    "[Array, Function, Object, RegExp, String].forEach(function(builtin) {\n"
     "  Save(builtin.name, getSafeBuiltin(builtin));\n"
     "});\n"
     "}());\n";
 
 v8::Local<v8::String> MakeKey(const char* name) {
   return v8::String::New(
       base::StringPrintf("%s::%s", kClassName, name).c_str());
 }
 
 void SaveImpl(const char* name,
@@ skipping 21 matching lines @@
       return v8::FunctionTemplate::New(Apply);
     if (name->Equals(v8::String::New("Save")))
       return v8::FunctionTemplate::New(Save);
     NOTREACHED() << *v8::String::AsciiValue(name);
     return v8::Handle<v8::FunctionTemplate>();
   }
 
   static void Apply(const v8::FunctionCallbackInfo<v8::Value>& info) {
     CHECK(info.Length() == 5 &&
           info[0]->IsFunction() &&  // function
           // info[1]->Object()      // recv (will throw error not check)

[Jeffrey Yasskin, 2013/06/20 23:33:04]

Object() isn't correct anymore, so update this comment.

[not at google - send to devlin, 2013/06/21 00:01:44]

Done.

           info[2]->IsObject() &&    // args
           info[3]->IsInt32() &&     // first_arg_index
           info[4]->IsInt32());      // args_length
-    if (!info[1]->IsObject()) {
+    v8::Local<v8::Function> function = info[0].As<v8::Function>();
+    v8::Local<v8::Object> recv;
+    if (info[1]->IsObject()) {
+      recv = info[1]->ToObject();
+    } else if (info[1]->IsString()) {
+      recv = v8::StringObject::New(info[1]->ToString())->ToObject();

[Jeffrey Yasskin, 2013/06/20 23:33:04]

Why are you creating a new string here instead of just upcasting the argument?

[not at google - send to devlin, 2013/06/21 00:01:44]

No new string is being created, ToString() is just a cast, and I don't think
that StringObject and String can be cast (at least, I don't see documented). The
trailing ToObject is necessary because StringObject::New inexplicably returns a
Value not an Object.

+    } else {
       v8::ThrowException(v8::Exception::TypeError(v8::String::New(
           "The first argument is the receiver and must be an object")));
       return;
     }
-    v8::Local<v8::Function> function = info[0].As<v8::Function>();
-    v8::Local<v8::Object> recv = info[1]->ToObject();
     v8::Local<v8::Object> args = info[2]->ToObject();
     int first_arg_index = static_cast<int>(info[3]->ToInt32()->Value());
     int args_length = static_cast<int>(info[4]->ToInt32()->Value());
 
     int argc = args_length - first_arg_index;
     scoped_ptr<v8::Local<v8::Value>[]> argv(new v8::Local<v8::Value>[argc]);
     for (int i = 0; i < argc; ++i) {
       CHECK(args->Has(i + first_arg_index));
       argv[i] = args->Get(i + first_arg_index);
     }
@@ skipping 29 matching lines @@
 }
 
 v8::Local<v8::Object> SafeBuiltins::GetFunction() const {
   return Load("Function", context_->v8_context());
 }
 
 v8::Local<v8::Object> SafeBuiltins::GetObjekt() const {
   return Load("Object", context_->v8_context());
 }
 
+v8::Local<v8::Object> SafeBuiltins::GetRegExp() const {
+  return Load("RegExp", context_->v8_context());
+}
+
+v8::Local<v8::Object> SafeBuiltins::GetString() const {
+  return Load("String", context_->v8_context());
+}
+
 } //  namespace extensions