Fix for GuestView exposure through shift().
This patch converts all uses of shift() in the GuestView JavaScript
objects to use $Array.shift() instead. This will prevent GuestView
JavaScript objects from being exposed via overriding shift().
This patch also utilizes a weak pointer in
GuestViewContainer::OnHandleCallback() to ensure that |this| has not been
deleted in the callback, thus preventing further use-after-free bugs of
this type.
BUG=718292
Review-Url: https://codereview.chromium.org/2892253002
Cr-Commit-Position: refs/heads/master@{#474765}
3 files changed
