Don't expose document.register to Chrome Apps by default.

chrome/renderer/resources/extensions/web_view.js

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Shim that simulates a <webview> tag via Mutation Observers.
 //
 // The actual tag is implemented via the browser plugin. The internals of this
 // are hidden via Shadow DOM.
 
 'use strict';
 
 var eventBindings = require('event_bindings');
 var WebRequestEvent = require('webRequestInternal').WebRequestEvent;
 var webRequestSchema =
     requireNative('schema_registry').GetSchema('webRequest');
+var WebviewNatives = requireNative('webview_natives');
 
 // This secret enables hiding <webview> private members from the outside scope.
 // Outside of this file, |secret| is inaccessible. The only way to access the
 // <webview> element's internal members is via the |secret|. Since it's only
 // accessible by code here (and in web_view_experimental), only <webview>'s
 // API can access it and not external developers.
 var secret = {};
 
 /** @type {Array.<string>} */
 var WEB_VIEW_ATTRIBUTES = ['name', 'src', 'partition', 'autosize', 'minheight',
@@ skipping 668 matching lines @@
       this.webviewNode_,
       'request',
       {
         value: request,
         enumerable: true,
         writable: false
       }
   );
 };
 
 // Save document.register in a variable in case the developer attempts to

[dominicc (has gone to gerrit), 2013/08/17 00:13:12]

This comment can go now. No author is going to override you now.

[Fady Samuel, 2013/08/20 23:00:39]

Done.

 // override it at some point.
-var register = document.register;
+var register = WebviewNatives.RegisterElement;
 
 // Registers browser plugin <object> custom element.
 function registerBrowserPluginElement() {
   var proto = Object.create(HTMLObjectElement.prototype);
 
   proto.createdCallback = function() {
     this.setAttribute('type', 'application/browser-plugin');
     // The <object> node fills in the <webview> container.
     this.style.width = '100%';
     this.style.height = '100%';
@@ skipping 108 matching lines @@
 WebViewInternal.prototype.maybeGetWebviewExperimentalExtEvents_ = function() {};
 
 /**
  * Implemented when the experimental API is available.
  * @private
  */
 WebViewInternal.prototype.maybeAttachWebRequestEventToWebview_ = function() {};
 
 exports.WebViewInternal = WebViewInternal;
 exports.CreateEvent = createEvent;