Check length of String before checking if it's 8/16 bit

third_party/WebKit/Source/core/html/parser/HTMLParserIdioms.cpp

 /*
  * Copyright (C) 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
@@ skipping 291 matching lines @@
         numbers.append(checkDoubleValue(number, parsedLength != 0, 0));
 
         skipWhile<CharacterType, isSpaceOrDelimiter>(position, end);
     }
     return numbers;
 }
 
 // https://html.spec.whatwg.org/multipage/infrastructure.html#rules-for-parsing-a-list-of-floating-point-numbers
 Vector<double> parseHTMLListOfFloatingPointNumbers(const String& input)
 {
-    if (input.is8Bit())
-        return parseHTMLListOfFloatingPointNumbersInternal(input.characters8(), input.characters8() + input.length());
-    return parseHTMLListOfFloatingPointNumbersInternal(input.characters16(), input.characters16() + input.length());
+    unsigned length = input.length();
+    if (!length || input.is8Bit())
+        return parseHTMLListOfFloatingPointNumbersInternal(input.characters8(), input.characters8() + length);
+    return parseHTMLListOfFloatingPointNumbersInternal(input.characters16(), input.characters16() + length);
 }
 
 static const char charsetString[] = "charset";
 static const size_t charsetLength = sizeof("charset") - 1;
 
 String extractCharset(const String& value)
 {
     size_t pos = 0;
     unsigned length = value.length();
 
@@ skipping 134 matching lines @@
         string = StringImpl::create8BitIfPossible(characters, size);
     else if (width == Force8Bit)
         string = String::make8BitFrom16BitSource(characters, size);
     else
         string = String(characters, size);
 
     return string;
 }
 
 } // namespace blink