Check length of String before checking if it's 8/16 bit

third_party/WebKit/Source/core/html/parser/HTMLParserIdioms.cpp

Index: third_party/WebKit/Source/core/html/parser/HTMLParserIdioms.cpp
diff --git a/third_party/WebKit/Source/core/html/parser/HTMLParserIdioms.cpp b/third_party/WebKit/Source/core/html/parser/HTMLParserIdioms.cpp
index 640803f4736174d7f6638635be4cb33bf3faf834..4d8b2c2b1385de9fc4ca9f9c09efd5a266e2a664 100644
--- a/third_party/WebKit/Source/core/html/parser/HTMLParserIdioms.cpp
+++ b/third_party/WebKit/Source/core/html/parser/HTMLParserIdioms.cpp
@@ -309,9 +309,10 @@ static Vector<double> parseHTMLListOfFloatingPointNumbersInternal(
 // https://html.spec.whatwg.org/multipage/infrastructure.html#rules-for-parsing-a-list-of-floating-point-numbers
 Vector<double> parseHTMLListOfFloatingPointNumbers(const String& input)
 {
-    if (input.is8Bit())
-        return parseHTMLListOfFloatingPointNumbersInternal(input.characters8(), input.characters8() + input.length());
-    return parseHTMLListOfFloatingPointNumbersInternal(input.characters16(), input.characters16() + input.length());
+    unsigned length = input.length();
+    if (!length || input.is8Bit())
+        return parseHTMLListOfFloatingPointNumbersInternal(input.characters8(), input.characters8() + length);
+    return parseHTMLListOfFloatingPointNumbersInternal(input.characters16(), input.characters16() + length);
 }
 
 static const char charsetString[] = "charset";