[ios] Protect JS messaging system from window.webkit object overriding.

ios/web/web_state/web_state_impl_unittest.mm

Index: ios/web/web_state/web_state_impl_unittest.mm
diff --git a/ios/web/web_state/web_state_impl_unittest.mm b/ios/web/web_state/web_state_impl_unittest.mm
index a2eb6d079c7d4d264724abf7d1f39001d3354293..41ccbf87c0ecf224b6fb1a03ce862f2c71bd5f08 100644
--- a/ios/web/web_state/web_state_impl_unittest.mm
+++ b/ios/web/web_state/web_state_impl_unittest.mm
@@ -603,5 +603,31 @@ TEST_F(WebStateTest, LoadingProgress) {
   });
 }
 
+// Tests that page which overrides window.webkit object does not break the
+// messaging system.
+TEST_F(WebStateTest, OverridingWebKitObject) {
+  // Add a script command handler.
+  __block bool message_received = false;
+  const web::WebState::ScriptCommandCallback callback =
+      base::BindBlock(^bool(const base::DictionaryValue&, const GURL&, bool) {
+        message_received = true;
+        return true;
+      });
+  web_state_->AddScriptCommandCallback(callback, "test");
+
+  // Load the page which overrides window.webkit object and wait until the
+  // test message is received.
+  LoadHtml(
+      "<script>"
+      "  webkit = undefined;"
+      "  __gCrWeb.message.invokeOnHost({'command': 'test.webkit-overriding'});"
+      "</script>");
+
+  base::test::ios::WaitUntilCondition(^{
+    return message_received;
+  });
+  web_state_->RemoveScriptCommandCallback("test");
+}
+
 }  // namespace
 }  // namespace web