Web MIDI: Tune Request [0xf6] wasn't handled correctly.

third_party/WebKit/Source/modules/webmidi/MIDIOutput.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 129 matching lines @@
         }
         return false;
     }
 
     bool acceptCurrentMessage()
     {
         DCHECK(isStatusByte());
         DCHECK(!isSysex());
         DCHECK(!isReservedStatusByte());
         DCHECK(!isRealTimeMessage());
+        DCHECK(!isEndOfSysex());
         static const int channelMessageLength[7] = { 3, 3, 3, 3, 2, 2, 3 }; // for 0x8*, 0x9*, ..., 0xe*
         static const int systemMessageLength[7] = { 2, 3, 2, 0, 0, 1, 0 }; // for 0xf1, 0xf2, ..., 0xf7
         size_t length = isSystemMessage() ? systemMessageLength[m_data[m_offset] - 0xf1] : channelMessageLength[(m_data[m_offset] >> 4) - 8];
-        size_t count = 1;
-        for (m_offset++; !isEndOfData(); m_offset++) {
+        m_offset++;
+        DCHECK_GT(length, 0UL);
+        if (length == 1)
+            return true;
+        for (size_t count = 1; !isEndOfData(); m_offset++) {
             if (isReservedStatusByte())
                 return false;
             if (isRealTimeMessage())
                 continue;
             if (isStatusByte())
                 return false;
             if (++count == length) {
                 m_offset++;
                 return true;
             }
@@ skipping 74 matching lines @@
 {
     send(unsignedData, 0.0, exceptionState);
 }
 
 DEFINE_TRACE(MIDIOutput)
 {
     MIDIPort::trace(visitor);
 }
 
 } // namespace blink