Fix for CSS Variables tokenisation not checking CSS identifier length

Source/core/css/CSSParser.cpp

 /*
  * Copyright (C) 2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Nicholas Shanks <webkit@nickshanks.com>
  * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  * Copyright (C) 2012 Intel Corporation. All rights reserved.
  *
@@ skipping 10289 matching lines @@
         if (isASCIIAlphaCaselessEqual(name[0], 'o') && isASCIIAlphaCaselessEqual(name[1], 'r'))
             m_token = SUPPORTS_OR;
     } else if (length == 3) {
         if (isASCIIAlphaCaselessEqual(name[0], 'a') && isASCIIAlphaCaselessEqual(name[1], 'n') && isASCIIAlphaCaselessEqual(name[2], 'd'))
             m_token = SUPPORTS_AND;
         else if (isASCIIAlphaCaselessEqual(name[0], 'n') && isASCIIAlphaCaselessEqual(name[1], 'o') && isASCIIAlphaCaselessEqual(name[2], 't'))
             m_token = SUPPORTS_NOT;
     }
 }
 
+template <typename CharacterType>
+inline bool CSSParser::detectCSSVariablesToken(int length)
+{
+    if (length >= 12) {

[eseidel, 2013/05/21 01:33:11]

Why 12?  webkit-var is 10 chars, no?  Can this by sizeof("webkit-var")?  Should
it be?

[alancutter (OOO until 2018), 2013/05/21 03:56:05]

We are trying to match on "-webkit-var-" as prefixed variable property names are
of the form "-webkit-var-name".
This function is called inside a switch that has already checked the first
character of the token and determined it to be '-'. The first part of the if
checks the 12th character (name[11]) before the "webkit-var" part is checked.

I should add an assert regarding the first character being '-', this might make
it more clear what is going on.

Looking at this again it should be (length >= 13) as at least one character is
required for the variable name.

+        CharacterType* name = tokenStart<CharacterType>();
+        if (name[11] == '-' && isEqualToCSSIdentifier(name + 1, "webkit-var"))
+            return true;
+    }
+    return false;
+}
+
+
 template <typename SrcCharacterType>
 int CSSParser::realLex(void* yylvalWithoutType)
 {
     YYSTYPE* yylval = static_cast<YYSTYPE*>(yylvalWithoutType);
     // Write pointer for the next character.
     SrcCharacterType* result;
     CSSParserString resultString;
     bool hasEscape;
 
     // The input buffer is terminated by a \0 character, so
@@ skipping 164 matching lines @@
             m_token = dotSeen ? FLOATTOKEN : INTEGER;
         break;
     }
 
     case CharacterDash:
         if (isIdentifierStartAfterDash(currentCharacter<SrcCharacterType>())) {
             --currentCharacter<SrcCharacterType>();
             parseIdentifier(result, resultString, hasEscape);
             m_token = IDENT;
 
-            if (cssVariablesEnabled() && isEqualToCSSIdentifier(tokenStart<SrcCharacterType>() + 1, "webkit-var") && tokenStart<SrcCharacterType>()[11] == '-' && isIdentifierStartAfterDash(tokenStart<SrcCharacterType>() + 12))
+            if (cssVariablesEnabled() && detectCSSVariablesToken<SrcCharacterType>(result - tokenStart<SrcCharacterType>()))
                 m_token = VAR_DEFINITION;
             else if (*currentCharacter<SrcCharacterType>() == '(') {
                 m_token = FUNCTION;
                 if (!hasEscape)
                     detectDashToken<SrcCharacterType>(result - tokenStart<SrcCharacterType>());
                 ++currentCharacter<SrcCharacterType>();
                 ++result;
             } else if (UNLIKELY(m_parsingMode == NthChildMode) && !hasEscape && isASCIIAlphaCaselessEqual(tokenStart<SrcCharacterType>()[1], 'n')) {
                 if (result - tokenStart<SrcCharacterType>() == 2) {
                     // String "-n" is IDENT but "-n+1" is NTH.
@@ skipping 1225 matching lines @@
     result.lineNumber = lineNumber;
     result.content = content;
     size_t newLength = content.length();
     while (newLength > 0 && isHTMLSpace(result.content[newLength - 1]))
         --newLength;
     result.content.setLength(newLength);
     return result;
 }
 
 }