Handle legacy alert, etc. in AMP ads.

This blackholes them since nobody should ever use these in an ad.

3p/environment.js

@@ -64,6 +64,7 @@ function manageWin_(win) {
   installObserver(win);
   // Existing iframes.
   maybeInstrumentsNodes(win, win.document.querySelectorAll('iframe'));
+  blockSyncPopups(win);
 }
 
 
@@ -237,6 +238,33 @@ function instrumentEntryPoints(win) {
   }
 }
 
+/**
+ * Blackhole the legacy popups since they should never be used for anything.
+ * @param {!Window} win
+ */
+function blockSyncPopups(win) {
+  let count = 0;
+  function maybeThrow() {
+    // Prevent deep recursion.
+    if (count++ > 2) {
+      throw new Error('security error');
+    }
+  }
+  try {
+    win.alert = maybeThrow;
+    win.prompt = function() {
+      maybeThrow();
+      return '';
+    };
+    win.confirm = function() {
+      maybeThrow();
+      return false;
+    };
+  } catch (e) {
+    console./*OK*/error(e.message, e.stack);
+  }
+}
+
 /**
  * Run when we just became visible again. Runs all the queued up rafs.
  * @visibleForTesting

test/functional/test-3p-environment.js

@@ -255,6 +255,16 @@ describe('3p environment', () => {
     if (win.webkitRequestAnimationFrame) {
       expect(win.webkitRequestAnimationFrame).to.not.match(/native/);
     }
+    expect(win.alert.toString()).to.not.match(/native/);
+    expect(win.prompt.toString()).to.not.match(/native/);
+    expect(win.confirm.toString()).to.not.match(/native/);
+    expect(win.alert()).to.be.undefined;
+    expect(win.prompt()).to.equal('');
+    expect(win.confirm()).to.be.false;
+    // We only allow 3 calls to these functions.
+    expect(() => win.alert()).to.throw(/security error/);
+    expect(() => win.prompt()).to.throw(/security error/);
+    expect(() => win.confirm()).to.throw(/security error/);
   }
 
   function waitForMutationObserver(iframe) {