Test sending corrupt mojo messages back from javascript.

mojo/public/js/bindings/connection.js

Index: mojo/public/js/bindings/connection.js
diff --git a/mojo/public/js/bindings/connection.js b/mojo/public/js/bindings/connection.js
index ebf60adb7f8de5a94014d762db9c1ecbc0d8c356..c66f65354f333231db45c5c256da8f55e8d46f76 100644
--- a/mojo/public/js/bindings/connection.js
+++ b/mojo/public/js/bindings/connection.js
@@ -20,6 +20,10 @@ define("mojo/public/js/bindings/connection", [
     this.remote = null;
   };
 
+  Connection.prototype.setFuzzer = function(fuzzer) {
+    this.router_.setFuzzer(fuzzer);
+  }

[abarth-chromium, 2014/04/25 00:27:54]

We shouldn't need this test code in the production JavaScript....

[Matt Perry, 2014/04/25 00:30:46]

As Adam pointed out to me when I tried this, you can mock out the 'core'
functions to avoid this. You'll want to override core.writeMessage. See
https://code.google.com/p/chromium/codesearch#chromium/src/mojo/apps/js/bindi...
for an example.

[Tom Sepez, 2014/04/25 18:30:34]

Yep.  Was just trying to preserve some sort of layering, getting the object from
the top-level JS and ripping out its guts is always possible so long as the
names of the internal fields don't change.  Yay JS. (In other words, Will do).

I'm not sure mocking is appropriate here, we need to have the message flow all
the way to the C++ side and then to the browser, etc.  Maybe I'm missing
something?

+
   Connection.prototype.encounteredError = function() {
     return this.router_.encounteredError();
   };