Test sending corrupt mojo messages back from javascript.

mojo/public/js/bindings/connector.js

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 define("mojo/public/js/bindings/connector", [
   "mojo/public/js/bindings/codec",
   "mojo/public/js/bindings/core",
   "mojo/public/js/bindings/support",
 ], function(codec, core, support) {
 
@@ skipping 12 matching lines @@
     if (this.readWaitCookie_) {
       support.cancelWait(this.readWaitCookie_);
       this.readWaitCookie_ = null;
     }
     if (this.handle_ != core.kInvalidHandle) {
       core.close(this.handle_);
       this.handle_ = core.kInvalidHandle;
     }
   };
 
+  // For IPC fuzzing/testing.
+  Connector.prototype.setFuzzer = function(fuzzer) {
+    this.fuzzer_ = fuzzer;
+  }
+
   Connector.prototype.accept = function(message) {
     if (this.error_)
       return false;
 
     if (this.dropWrites_)
       return true;
 
+    if (this.fuzzer_) {
+      this.fuzzer_(message);
+    }
+
     var result = core.writeMessage(this.handle_,
                                    new Uint8Array(message.buffer.arrayBuffer),
                                    message.handles,
                                    core.WRITE_MESSAGE_FLAG_NONE);
     switch (result) {
       case core.RESULT_OK:
         // The handles were successfully transferred, so we don't own them
         // anymore.
         message.handles = [];
         break;
@@ skipping 50 matching lines @@
       if (this.incomingReceiver_) {
           this.incomingReceiver_.accept(message);
       }
     }
   };
 
   var exports = {};
   exports.Connector = Connector;
   return exports;
 });