[Extensions] Update last_error.js, send_request.js

extensions/renderer/resources/send_request.js

Index: extensions/renderer/resources/send_request.js
diff --git a/extensions/renderer/resources/send_request.js b/extensions/renderer/resources/send_request.js
index 9fed10e7f4279bd936b0f52d982a3460b038daa4..5a9fa965e3ef71e481e21a32658f810e251857d3 100644
--- a/extensions/renderer/resources/send_request.js
+++ b/extensions/renderer/resources/send_request.js
@@ -9,7 +9,7 @@ var natives = requireNative('sendRequest');
 var validate = require('schemaUtils').validate;
 
 // All outstanding requests from sendRequest().
-var requests = {};
+var requests = { __proto__: null };
 
 // Used to prevent double Activity Logging for API calls that use both custom
 // bindings and ExtensionFunctions (via sendRequest).
@@ -88,7 +88,7 @@ function handleResponse(requestId, name, success, responseList, error) {
 }
 
 function prepareRequest(args, argSchemas) {
-  var request = {};
+  var request = { __proto__: null };
   var argCount = args.length;
 
   // Look for callback param.
@@ -99,11 +99,7 @@ function prepareRequest(args, argSchemas) {
     --argCount;
   }
 
-  request.args = [];
-  for (var k = 0; k < argCount; k++) {
-    request.args[k] = args[k];
-  }
-
+  request.args = $Array.slice(args, 0, argCount);
   return request;
 }
 
@@ -119,7 +115,8 @@ function prepareRequest(args, argSchemas) {
 function sendRequest(functionName, args, argSchemas, optArgs) {
   calledSendRequest = true;
   if (!optArgs)
-    optArgs = {};
+    optArgs = { __proto__: null };
+  logging.DCHECK(optArgs.__proto__ == null);

[robwu, 2016/04/25 22:25:53]

$Object.getPrototypeOf(optArgs) === null

If not set, __proto__ can be spoofed.

[Devlin, 2016/04/25 22:35:00]

I had thought about that, but this is only to check our own code for issues.  If
anyone can call sendRequest but us, we're already in a bad state.  This is just
to verify that our own callsites are correct, and, for that, this is sufficient.
 Can you think of a counter case where doing $Object.getPrototypeOf() would be
more helpful?

[robwu, 2016/04/25 22:53:27]

It's just a debug assertion, so it doesn't matter.

   var request = prepareRequest(args, argSchemas);
   request.stack = optArgs.stack || exceptionHandler.getExtensionStackTrace();
   if (optArgs.customCallback) {