Fix for CSS Variables tokenisation not checking CSS identifier length

Source/core/css/CSSParser.cpp

Index: Source/core/css/CSSParser.cpp
diff --git a/Source/core/css/CSSParser.cpp b/Source/core/css/CSSParser.cpp
index 4861b11c90cc9dc518137ba88af49a1eed450080..61b0e33a63ee140945a64e067701a6b5e83f0084 100644
--- a/Source/core/css/CSSParser.cpp
+++ b/Source/core/css/CSSParser.cpp
@@ -10307,6 +10307,18 @@ inline void CSSParser::detectSupportsToken(int length)
     }
 }
 
+template <typename CharacterType>
+inline bool CSSParser::detectCSSVariablesToken(int length)
+{
+    if (length >= 12) {

[eseidel, 2013/05/21 01:33:11]

Why 12?  webkit-var is 10 chars, no?  Can this by sizeof("webkit-var")?  Should
it be?

[alancutter (OOO until 2018), 2013/05/21 03:56:05]

We are trying to match on "-webkit-var-" as prefixed variable property names are
of the form "-webkit-var-name".
This function is called inside a switch that has already checked the first
character of the token and determined it to be '-'. The first part of the if
checks the 12th character (name[11]) before the "webkit-var" part is checked.

I should add an assert regarding the first character being '-', this might make
it more clear what is going on.

Looking at this again it should be (length >= 13) as at least one character is
required for the variable name.

+        CharacterType* name = tokenStart<CharacterType>();
+        if (name[11] == '-' && isEqualToCSSIdentifier(name + 1, "webkit-var"))
+            return true;
+    }
+    return false;
+}
+
+
 template <typename SrcCharacterType>
 int CSSParser::realLex(void* yylvalWithoutType)
 {
@@ -10491,7 +10503,7 @@ restartAfterComment:
             parseIdentifier(result, resultString, hasEscape);
             m_token = IDENT;
 
-            if (cssVariablesEnabled() && isEqualToCSSIdentifier(tokenStart<SrcCharacterType>() + 1, "webkit-var") && tokenStart<SrcCharacterType>()[11] == '-' && isIdentifierStartAfterDash(tokenStart<SrcCharacterType>() + 12))
+            if (cssVariablesEnabled() && detectCSSVariablesToken<SrcCharacterType>(result - tokenStart<SrcCharacterType>()))
                 m_token = VAR_DEFINITION;
             else if (*currentCharacter<SrcCharacterType>() == '(') {
                 m_token = FUNCTION;