[ios] Protect JS messaging system from window.webkit object overriding.

ios/web/web_state/js/resources/message.js

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Scripts for the message handler.
 
 goog.provide('__crWeb.message');
 
 goog.require('__crWeb.common');
 
 /**
  * Namespace for this module.
  */
 __gCrWeb.message = {};
 
 /* Beginning of anonymous object. */
 (function() {
+
+  // Retain message handlers object in case if a web page decide to override

[Jackie Quinn, 2016/05/11 22:05:01]

Grammar nit: "in case a web page overrides"

[Eugene But (OOO till 7-30), 2016/05/12 13:59:15]

Acknowledged.

+  // |window.webkit|.
+  if (window.webkit)
+    __gCrWeb.webkitMessageHandlers = window.webkit.messageHandlers;
+
   /**
    * Object to manage queue of messages waiting to be sent to the main
    * application for immediate processing.
    * @type {Object}
    * @private
    */
   var immediateMessageQueue_ = {
     scheme: 'crwebinvokeimmediate',
     reset: function() {
       immediateMessageQueue_.queue = [];
@@ skipping 81 matching lines @@
     // in serializing messageQueue_ to an invalid format.
     var originalObjectToJSON = Object.prototype.toJSON;
     if (originalObjectToJSON)
       delete Object.prototype.toJSON;
 
     queueObject.queue.forEach(function(command) {
         var stringifiedMessage = __gCrWeb.common.JSONStringify({
             "crwCommand": command,
             "crwWindowId": __gCrWeb.windowId
         });
-        window.webkit.messageHandlers[queueObject.scheme].postMessage(
-            stringifiedMessage);
+        // If |window.webkit| has been overridden, use messageHandlers object
+        // retained before the page load.
+        var messageHandlers = window.webkit.messageHandlers ||

[Jackie Quinn, 2016/05/11 22:05:01]

What happens if it gets overridden and there is a window.webkit.messageHandlers
object? Should we be using the override here, or should we always use the ivar?

[Eugene But (OOO till 7-30), 2016/05/12 13:59:15]

deleting |window.webkit| addresses all kinds of issues :)

+            __gCrWeb.webkitMessageHandlers;
+        messageHandlers[queueObject.scheme].postMessage(stringifiedMessage);
     });
     queueObject.reset();
 
     if (originalObjectToJSON) {
       // Restore Object.prototype.toJSON to prevent from breaking any
       // functionality on the page that depends on its custom implementation.
       Object.prototype.toJSON = originalObjectToJSON;
     }
   };
 }());