Fix crash when combining text-emphasis with CSS variables

third_party/WebKit/Source/core/css/parser/CSSParserImpl.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/css/parser/CSSParserImpl.h"
 
 #include "core/css/CSSCustomPropertyDeclaration.h"
 #include "core/css/CSSKeyframesRule.h"
 #include "core/css/CSSStyleSheet.h"
@@ skipping 40 matching lines @@
     return declaration->addParsedProperties(parser.m_parsedProperties);
 }
 
 static inline void filterProperties(bool important, const WillBeHeapVector<CSSProperty, 256>& input, WillBeHeapVector<CSSProperty, 256>& output, size_t& unusedEntries, BitArray<numCSSProperties>& seenProperties)
 {
     // Add properties in reverse order so that highest priority definitions are reached first. Duplicate definitions can then be ignored when found.
     for (size_t i = input.size(); i--; ) {
         const CSSProperty& property = input[i];
         if (property.isImportant() != important)
             continue;
-        const unsigned propertyIDIndex = property.id();
+        const unsigned propertyIDIndex = property.id() - firstCSSProperty;
         // All custom properties use the same CSSPropertyID so we can't remove repeated definitions
         if (property.id() != CSSPropertyVariable) {
             if (seenProperties.get(propertyIDIndex))
                 continue;
             seenProperties.set(propertyIDIndex);
         }
         output[--unusedEntries] = property;
     }
 }
 
@@ skipping 675 matching lines @@
         else
             return nullptr; // Parser error, invalid value in keyframe selector
         if (range.atEnd())
             return result.release();
         if (range.consume().type() != CommaToken)
             return nullptr; // Parser error
     }
 }
 
 } // namespace blink