Test sending corrupt mojo messages back from javascript.

content/test/data/web_ui_mojo.js

Index: content/test/data/web_ui_mojo.js
diff --git a/content/test/data/web_ui_mojo.js b/content/test/data/web_ui_mojo.js
index 3dc32293cf1aa17aaca0a48f931f1ca44ab9244b..10a87b37ff2af41b53e46bc08787ce7b61ddf9c2 100644
--- a/content/test/data/web_ui_mojo.js
+++ b/content/test/data/web_ui_mojo.js
@@ -3,10 +3,12 @@
 // found in the LICENSE file.
 
 define('main', [
-    'mojo/public/js/bindings/connection',
-    'content/test/data/web_ui_test_mojo_bindings.mojom',
+  'mojo/public/js/bindings/connection',
+  'content/test/data/web_ui_test_mojo_bindings.mojom',
 ], function (connection, bindings) {
-  var retainedConnection, kIterations = 100, kBadValue = 13;
+  var kBadValue = 13;
+  var fuzzerInstalled = false;
+  var retainedConnection;
 
   function RendererTargetTest(bindings) {
     this.bindings_ = bindings;
@@ -23,7 +25,7 @@ define('main', [
     this.bindings_.pingResponse();
   };
 
-  RendererTargetTest.prototype.echo = function (arg) {
+  RendererTargetTest.prototype.echo = function (iterations, arg) {
     var i;
 
     // Ensure negative values are negative.
@@ -39,7 +41,7 @@ define('main', [
     if (arg.si8 > 0)
       arg.si8 = kBadValue;
 
-    for (i = 0; i < kIterations; ++i) {
+    for (i = 0; i < iterations; ++i) {
       arg2 = new bindings.EchoArgs();
       arg2.si64 = -1;
       arg2.si32 = -1;
@@ -50,6 +52,26 @@ define('main', [
     }
   };
 
+  RendererTargetTest.prototype.flipBits = function (iterations, arg) {
+    var i;
+    if (!fuzzerInstalled) {
+      retainedConnection.setFuzzer((function () {
+        var iteration = 0;
+        return function (message) {
+          var offset = iteration / 8;
+          var mask = 1 << (iteration % 8);
+          var value = message.buffer.dataView.getUint8(offset) ^ mask;
+          message.buffer.dataView.setUint8(offset, value);
+          iteration += 1;
+        }
+      })());

[abarth-chromium, 2014/04/25 00:36:48]

Rather than hooking in like this, you should be able to hook into the JavaScript
objects directly without cooperation from the production code.

+      fuzzerInstalled = true;
+      console.log('Tests running with fuzzers enabled.');
+    }
+    for (i = 0; i < iterations; ++i)
+      this.bindings_.flipBitsResponse(arg);
+  };
+
   return function(handle) {
     retainedConnection = new connection.Connection(
         handle, RendererTargetTest, bindings.BrowserTargetProxy);