Fix for GuestView exposure through shift().

extensions/renderer/resources/guest_view/extension_view/extension_view.js

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This module implements the ExtensionView <extensionview>.
 
 var GuestViewContainer = require('guestViewContainer').GuestViewContainer;
 var ExtensionViewConstants =
     require('extensionViewConstants').ExtensionViewConstants;
 var ExtensionViewEvents = require('extensionViewEvents').ExtensionViewEvents;
@@ skipping 53 matching lines @@
 ExtensionViewImpl.prototype.onLoadCommit = function(url) {
   this.attributes[ExtensionViewConstants.ATTRIBUTE_SRC].
       setValueIgnoreMutation(url);
 };
 
 // Loads the next pending src from |loadQueue| to the extensionview.
 ExtensionViewImpl.prototype.loadNextSrc = function() {
   // If extensionview isn't currently loading a src, load the next src
   // in |loadQueue|. Otherwise, do nothing.
   if (!this.pendingLoad && this.loadQueue.length) {
-    this.pendingLoad = this.loadQueue.shift();
+    this.pendingLoad = $Array.shift(this.loadQueue);
     var src = this.pendingLoad.src;
     var resolve = this.pendingLoad.resolve;
     var reject = this.pendingLoad.reject;
 
     // The extensionview validates the |src| twice, once in |parseSrc| and then
     // in |loadSrc|. The |src| isn't checked directly in |loadNextSrc| for
     // validity since the sending renderer (WebUI) is trusted.
     ExtensionViewInternal.parseSrc(
         src, $Function.bind(function(isSrcValid, extensionId) {
       // Check if the src is valid.
@@ skipping 46 matching lines @@
         }, this));
       }
     }, this));
   }
 };
 
 GuestViewContainer.registerElement(ExtensionViewImpl);
 
 // Exports.
 exports.$set('ExtensionViewImpl', ExtensionViewImpl);