[Extensions] Update last_error.js, send_request.js

extensions/renderer/resources/send_request.js

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 var exceptionHandler = require('uncaught_exception_handler');
 var lastError = require('lastError');
 var logging = requireNative('logging');
 var natives = requireNative('sendRequest');
 var validate = require('schemaUtils').validate;
 
 // All outstanding requests from sendRequest().
-var requests = {};
+var requests = { __proto__: null };
 
 // Used to prevent double Activity Logging for API calls that use both custom
 // bindings and ExtensionFunctions (via sendRequest).
 var calledSendRequest = false;
 
 // Runs a user-supplied callback safely.
 function safeCallbackApply(name, request, callback, args) {
   try {
     $Function.apply(callback, request, args);
   } catch (e) {
@@ skipping 58 matching lines @@
     }
   } finally {
     delete requests[requestId];
     lastError.clear(chrome);
     if (callerChrome !== chrome)
       lastError.clear(callerChrome);
   }
 }
 
 function prepareRequest(args, argSchemas) {
-  var request = {};
+  var request = { __proto__: null };
   var argCount = args.length;
 
   // Look for callback param.
   if (argSchemas.length > 0 &&
       argSchemas[argSchemas.length - 1].type == "function") {
     request.callback = args[args.length - 1];
     request.callbackSchema = argSchemas[argSchemas.length - 1];
     --argCount;
   }
 
-  request.args = [];
-  for (var k = 0; k < argCount; k++) {
-    request.args[k] = args[k];
-  }
-
+  request.args = $Array.slice(args, 0, argCount);
   return request;
 }
 
 // Send an API request and optionally register a callback.
 // |optArgs| is an object with optional parameters as follows:
 // - customCallback: a callback that should be called instead of the standard
 //   callback.
 // - forIOThread: true if this function should be handled on the browser IO
 //   thread.
 // - preserveNullInObjects: true if it is safe for null to be in objects.
 // - stack: An optional string that contains the stack trace, to be displayed
 //   to the user if an error occurs.
 function sendRequest(functionName, args, argSchemas, optArgs) {
   calledSendRequest = true;
   if (!optArgs)
-    optArgs = {};
+    optArgs = { __proto__: null };

[robwu, 2016/04/23 09:54:38]

Can you also check the callers of sendRequest and make sure that optArgs
inherits from null?

E.g. the properties of optArgs in binding.js will leak when you "optArgs.stack"
is accessed below.

[Devlin, 2016/04/25 21:50:35]

That wasn't as painful as I thought it'd be, given how many callers of
sendRequest() there are.  Done.

   var request = prepareRequest(args, argSchemas);
   request.stack = optArgs.stack || exceptionHandler.getExtensionStackTrace();
   if (optArgs.customCallback) {
     request.customCallback = optArgs.customCallback;
   }
 
   var hasCallback = request.callback || optArgs.customCallback;
   var requestId =
       natives.StartRequest(functionName, request.args, hasCallback,
                            optArgs.forIOThread, optArgs.preserveNullInObjects);
   request.id = requestId;
   requests[requestId] = request;
 }
 
 function getCalledSendRequest() {
   return calledSendRequest;
 }
 
 function clearCalledSendRequest() {
   calledSendRequest = false;
 }
 
 exports.$set('sendRequest', sendRequest);
 exports.$set('getCalledSendRequest', getCalledSendRequest);
 exports.$set('clearCalledSendRequest', clearCalledSendRequest);
 exports.$set('safeCallbackApply', safeCallbackApply);
 
 // Called by C++.
 exports.$set('handleResponse', handleResponse);