[ios] Protect JS messaging system from window.webkit object overriding.

ios/web/web_state/js/resources/message.js

Index: ios/web/web_state/js/resources/message.js
diff --git a/ios/web/web_state/js/resources/message.js b/ios/web/web_state/js/resources/message.js
index e57133a79efc648d99a59fdf21ac548c5d3da7df..1525e7d224605b8c5445ab71c4f42f90bd8139c1 100644
--- a/ios/web/web_state/js/resources/message.js
+++ b/ios/web/web_state/js/resources/message.js
@@ -116,8 +116,14 @@ __gCrWeb.message = {};
             "crwCommand": command,
             "crwWindowId": __gCrWeb.windowId
         });
+        // A web page can override |window.webkit| with any value. Deleting the
+        // object ensures that original and working implementation of
+        // window.webkit is restored.
+        var oldWebkit = window.webkit;
+        delete window.webkit;
         window.webkit.messageHandlers[queueObject.scheme].postMessage(
             stringifiedMessage);
+        window.webkit = oldWebkit;
     });
     queueObject.reset();