[Extensions] Make Binding.generate() load the schema directly

extensions/renderer/resources/binding.js

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 var Event = require('event_bindings').Event;
 var forEach = require('utils').forEach;
 var GetAvailability = requireNative('v8_context').GetAvailability;
 var exceptionHandler = require('uncaught_exception_handler');
 var lastError = require('lastError');
 var logActivity = requireNative('activityLogger');
@@ skipping 171 matching lines @@
                 type.id + '.');
   var customType = jsModule[jsModuleName];
   logging.CHECK(customType, jsModuleName + ' must export itself.');
   customType.prototype = new CustomBindingsObject();
   customType.prototype.setSchema(type);
   return customType;
 }
 
 var platform = getPlatform();
 
-function Binding(schema) {
-  this.schema_ = schema;
-  this.apiFunctions_ = new APIFunctions(schema.namespace);
+function Binding(apiName) {
+  this.apiName_ = apiName;
+  this.apiFunctions_ = new APIFunctions(apiName);
   this.customEvent_ = null;
   this.customHooks_ = [];
 };
 
 Binding.create = function(apiName) {
-  return new Binding(schemaRegistry.GetSchema(apiName));
+  return new Binding(apiName);
 };
 
 Binding.prototype = {
   // The API through which the ${api_name}_custom_bindings.js files customize
   // their API bindings beyond what can be generated.
   //
   // There are 2 types of customizations available: those which are required in
   // order to do the schema generation (registerCustomEvent and
   // registerCustomType), and those which can only run after the bindings have
   // been generated (registerCustomHook).
 
   // Registers a custom event type for the API identified by |namespace|.
   // |event| is the event's constructor.
   registerCustomEvent: function(event) {
     this.customEvent_ = event;
   },
 
   // Registers a function |hook| to run after the schema for all APIs has been
   // generated.  The hook is passed as its first argument an "API" object to
   // interact with, and second the current extension ID. See where
   // |customHooks| is used.
   registerCustomHook: function(fn) {
     $Array.push(this.customHooks_, fn);
   },
 
   // TODO(kalman/cduvall): Refactor this so |runHooks_| is not needed.
-  runHooks_: function(api) {
+  runHooks_: function(api, schema) {
     $Array.forEach(this.customHooks_, function(hook) {
-      if (!isSchemaNodeSupported(this.schema_, platform, manifestVersion))
+      if (!isSchemaNodeSupported(schema, platform, manifestVersion))
         return;
 
       if (!hook)
         return;
 
       hook({
         apiFunctions: this.apiFunctions_,
-        schema: this.schema_,
+        schema: schema,
         compiledApi: api
       }, extensionId, contextType);
     }, this);
   },
 
-  // Generates the bindings from |this.schema_| and integrates any custom
-  // bindings that might be present.
+  // Generates the bindings from the schema for |this.apiName_| and integrates
+  // any custom bindings that might be present.
   generate: function() {
-    var schema = this.schema_;
+    // NB: It's important to load the schema during generation rather than
+    // setting it beforehand so that we're more confident the schema we're
+    // loading is real, and not one that was injected by a page intercepting
+    // Binding.generate.
+    // Additionally, since the schema is an object returned from a native
+    // handler, its properties don't have the custom getters/setters that a page
+    // may have put on Object.prototype.
+    var schema = schemaRegistry.GetSchema(this.apiName_);
 
     function shouldCheckUnprivileged() {
       var shouldCheck = 'unprivileged' in schema;
       if (shouldCheck)
         return shouldCheck;
 
       $Array.forEach(['functions', 'events'], function(type) {
         if ($Object.hasOwnProperty(schema, type)) {
           $Array.forEach(schema[type], function(node) {
             if ('unprivileged' in node)
@@ skipping 282 matching lines @@
     if (!success) {
       var availability = GetAvailability(schema.namespace);
       // If an API was available it should have been successfully generated.
       logging.DCHECK(!availability.is_available,
                      schema.namespace + ' was available but not generated');
       console.error('chrome.' + schema.namespace + ' is not available: ' +
                     availability.message);
       return;
     }
 
-    this.runHooks_(mod);
+    this.runHooks_(mod, schema);
     return mod;
   }
 };
 
 exports.$set('Binding', Binding);