[ios] Protect JS messaging system from window.webkit object overriding.

ios/web/web_state/js/resources/message.js

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Scripts for the message handler.
 
 goog.provide('__crWeb.message');
 
 goog.require('__crWeb.common');
 
@@ skipping 98 matching lines @@
     // in serializing messageQueue_ to an invalid format.
     var originalObjectToJSON = Object.prototype.toJSON;
     if (originalObjectToJSON)
       delete Object.prototype.toJSON;
 
     queueObject.queue.forEach(function(command) {
         var stringifiedMessage = __gCrWeb.common.JSONStringify({
             "crwCommand": command,
             "crwWindowId": __gCrWeb.windowId
         });
+        // If |window.webkit| has been overridden deleting the object restores

[Jackie Quinn, 2016/05/12 17:33:58]

Well that's nifty! Probably still good to have a comment in there explaining why
we need to use the original rather than a potential override.

[Eugene But (OOO till 7-30), 2016/05/12 18:44:41]

I did my best changing the comment :)

+        // the original implementation.
+        var oldWebkit = window.webkit;
+        delete window.webkit;
         window.webkit.messageHandlers[queueObject.scheme].postMessage(
             stringifiedMessage);
+        window.webkit = oldWebkit;
     });
     queueObject.reset();
 
     if (originalObjectToJSON) {
       // Restore Object.prototype.toJSON to prevent from breaking any
       // functionality on the page that depends on its custom implementation.
       Object.prototype.toJSON = originalObjectToJSON;
     }
   };
 }());