CSSParserString::equalIgnoringCase should check string length.

Source/core/css/CSSParserValues.h

Index: Source/core/css/CSSParserValues.h
diff --git a/Source/core/css/CSSParserValues.h b/Source/core/css/CSSParserValues.h
index 37d56aac75202f6815ea7697921650889b626eb1..1bcdb7d0d9b1de7f9b3c56d5bcef794126c92df1 100644
--- a/Source/core/css/CSSParserValues.h
+++ b/Source/core/css/CSSParserValues.h
@@ -98,9 +98,8 @@ struct CSSParserString {
 
     bool equalIgnoringCase(const char* str) const
     {
-        if (is8Bit())
-            return WTF::equalIgnoringCase(str, characters8(), length());
-        return WTF::equalIgnoringCase(str, characters16(), length());
+        bool match = is8Bit() ? WTF::equalIgnoringCase(str, characters8(), length()) : WTF::equalIgnoringCase(str, characters16(), length());
+        return match && str[length()] == '\0';

[esprehn, 2014/03/07 07:05:53]

Can you add an ASSERT(strlen(str) < length()) here? The index into the string is
really scary looking.

[tasak, 2014/03/07 09:55:49]

Sure. I added ASSERT.

     }
 
     template <size_t strLength>