Prepare Chrome Extensions for ES2015 RegExp semantics

extensions/renderer/safe_builtins.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/renderer/safe_builtins.h"
 
 #include "base/logging.h"
 #include "base/stl_util.h"
 #include "base/strings/stringprintf.h"
 #include "extensions/renderer/script_context.h"
@@ skipping 61 matching lines @@
     "            ['create', 'defineProperty', 'freeze',\n"
     "             'getOwnPropertyDescriptor', 'getPrototypeOf', 'keys']);\n"
     "saveBuiltin(Function,\n"
     "            ['apply', 'bind', 'call']);\n"
     "saveBuiltin(Array,\n"
     "            ['concat', 'forEach', 'indexOf', 'join', 'push', 'slice',\n"
     "             'splice', 'map', 'filter']);\n"
     "saveBuiltin(String,\n"
     "            ['indexOf', 'slice', 'split', 'substr', 'toUpperCase',\n"
     "             'replace']);\n"
+    "// Use exec rather than test to defend against clobbering in the\n"
+    "// presence of ES2015 semantics, which read RegExp.prototype.exec.\n"
     "saveBuiltin(RegExp,\n"
-    "            ['test']);\n"
+    "            ['exec']);\n"
     "saveBuiltin(Error,\n"
     "            [],\n"
     "            ['captureStackTrace']);\n"
     "\n"
     "// JSON is trickier because extensions can override toJSON in\n"
     "// incompatible ways, and we need to prevent that.\n"
     "var builtinTypes = [\n"
     "  Object, Function, Array, String, Boolean, Number, Date, RegExp\n"
     "];\n"
     "var builtinToJSONs = builtinTypes.map(function(t) {\n"
@@ skipping 152 matching lines @@
 
 v8::Local<v8::Object> SafeBuiltins::GetString() const {
   return Load("String", context_->v8_context());
 }
 
 v8::Local<v8::Object> SafeBuiltins::GetError() const {
   return Load("Error", context_->v8_context());
 }
 
 }  //  namespace extensions