Use CSSTokenizerInputStream::peekWithoutReplacement instead of peek().

third_party/WebKit/Source/core/css/parser/CSSTokenizerInputStream.h

Index: third_party/WebKit/Source/core/css/parser/CSSTokenizerInputStream.h
diff --git a/third_party/WebKit/Source/core/css/parser/CSSTokenizerInputStream.h b/third_party/WebKit/Source/core/css/parser/CSSTokenizerInputStream.h
index df45945aca42eba2ae54db02658e914c19c90b22..d3fa5eed8bf029a129d1110397fd99f3e1abb2a0 100644
--- a/third_party/WebKit/Source/core/css/parser/CSSTokenizerInputStream.h
+++ b/third_party/WebKit/Source/core/css/parser/CSSTokenizerInputStream.h
@@ -16,14 +16,24 @@ class CSSTokenizerInputStream {
 public:
     explicit CSSTokenizerInputStream(String input);
 
-    UChar peek(unsigned) const;
-    UChar nextInputChar() const { return peek(0); }
+    // Gets the char in the stream replacing NUL characters with a unicode
+    // replacement character. Will return (NUL) kEndOfFileMarker when at the
+    // end of the stream.
+    UChar nextInputChar() const
+    {
+        if (m_offset >= m_stringLength)
+            return '\0';
+        UChar result = (*m_string)[m_offset];
+        return result ? result : 0xFFFD;
+    }
 
-    // For fast-path code, don't replace nulls with replacement characters
+    // Gets the char at lookaheadOffset from the current stream position. Will
+    // return NUL (kEndOfFileMarker) if the stream position is at the end.
+    // NOTE: This may *also* return NUL if there's one in the input! Never
+    // compare the return value to '\0'.
     UChar peekWithoutReplacement(unsigned lookaheadOffset) const
     {
-        DCHECK((m_offset + lookaheadOffset) <= m_stringLength);
-        if ((m_offset + lookaheadOffset) == m_stringLength)
+        if ((m_offset + lookaheadOffset) >= m_stringLength)
             return '\0';
         return (*m_string)[m_offset + lookaheadOffset];
     }