CSSParserString::equalIgnoringCase should check string length.

Source/core/css/CSSParserValues.h

Index: Source/core/css/CSSParserValues.h
diff --git a/Source/core/css/CSSParserValues.h b/Source/core/css/CSSParserValues.h
index 37d56aac75202f6815ea7697921650889b626eb1..854a4715514e862335bb7b736edf893be4716325 100644
--- a/Source/core/css/CSSParserValues.h
+++ b/Source/core/css/CSSParserValues.h
@@ -98,9 +98,11 @@ struct CSSParserString {
 
     bool equalIgnoringCase(const char* str) const
     {
-        if (is8Bit())
-            return WTF::equalIgnoringCase(str, characters8(), length());
-        return WTF::equalIgnoringCase(str, characters16(), length());
+        bool match = is8Bit() ? WTF::equalIgnoringCase(str, characters8(), length()) : WTF::equalIgnoringCase(str, characters16(), length());
+        if (!match)
+            return false;
+        ASSERT(strlen(str) >= length());
+        return str[length()] == '\0';
     }
 
     template <size_t strLength>