Test sending corrupt mojo messages back from javascript.

mojo/public/js/bindings/connector.js

Index: mojo/public/js/bindings/connector.js
diff --git a/mojo/public/js/bindings/connector.js b/mojo/public/js/bindings/connector.js
index 51fb7fe96bbeecf6fa0f5f6dfce1ac4c929fb0dc..6750aa5ae19acf6b3188aedc04eace7ada6938f3 100644
--- a/mojo/public/js/bindings/connector.js
+++ b/mojo/public/js/bindings/connector.js
@@ -30,6 +30,11 @@ define("mojo/public/js/bindings/connector", [
     }
   };
 
+  // For IPC fuzzing/testing.
+  Connector.prototype.setFuzzer = function(fuzzer) {
+    this.fuzzer_ = fuzzer;
+  }
+
   Connector.prototype.accept = function(message) {
     if (this.error_)
       return false;
@@ -37,6 +42,10 @@ define("mojo/public/js/bindings/connector", [
     if (this.dropWrites_)
       return true;
 
+    if (this.fuzzer_) {
+      this.fuzzer_(message);
+    }
+
     var result = core.writeMessage(this.handle_,
                                    new Uint8Array(message.buffer.arrayBuffer),
                                    message.handles,