[ios] Protect JS messaging system from window.webkit object overriding.

ios/web/web_state/js/resources/message.js

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Scripts for the message handler.
 
 goog.provide('__crWeb.message');
 
 goog.require('__crWeb.common');
 
@@ skipping 98 matching lines @@
     // in serializing messageQueue_ to an invalid format.
     var originalObjectToJSON = Object.prototype.toJSON;
     if (originalObjectToJSON)
       delete Object.prototype.toJSON;
 
     queueObject.queue.forEach(function(command) {
         var stringifiedMessage = __gCrWeb.common.JSONStringify({
             "crwCommand": command,
             "crwWindowId": __gCrWeb.windowId
         });
+        // A web page can override |window.webkit| with any value. Deleting the
+        // object ensures that original and working implementation of
+        // window.webkit is restored.
+        var oldWebkit = window.webkit;
+        delete window.webkit;
         window.webkit.messageHandlers[queueObject.scheme].postMessage(
             stringifiedMessage);
+        window.webkit = oldWebkit;
     });
     queueObject.reset();
 
     if (originalObjectToJSON) {
       // Restore Object.prototype.toJSON to prevent from breaking any
       // functionality on the page that depends on its custom implementation.
       Object.prototype.toJSON = originalObjectToJSON;
     }
   };
 }());