Crash when calling getCueAsHTML() on a TextTrackCue with empty text

Source/core/html/track/WebVTTParser.cpp

 /*
  * Copyright (C) 2011 Google Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 310 matching lines @@
         return BadCue;
     return Id;
 }
 
 PassRefPtr<DocumentFragment>  WebVTTParser::createDocumentFragmentFromCueText(const String& text)
 {
     // Cue text processing based on
     // 4.8.10.13.4 WebVTT cue text parsing rules and
     // 4.8.10.13.5 WebVTT cue text DOM construction rules.
 
-    if (!text.length())
-        return 0;

[acolwell GONE FROM CHROMIUM, 2013/08/05 23:40:32]

nit: Do you really need to jump though all the hoops below. Can't you just move
this down 2 lines and do 'return DocumentFragment::create(document);'?

[vcarbune.chromium, 2013/08/09 18:47:26]

Yes, you're right, it shouldn't go through everything below. I also gave this a
bit more thought and I think what it should actually be returned is a
DocumentFragment with an empty Text as child node (empty string). This makes it
consistent with the regular behaviour.

-
     ASSERT(m_scriptExecutionContext->isDocument());
     Document* document = toDocument(m_scriptExecutionContext);
 
     RefPtr<DocumentFragment> fragment = DocumentFragment::create(document);
     m_currentNode = fragment;
     m_tokenizer->reset();
     m_token.clear();
 
     m_languageStack.clear();
     SegmentedString content(text);
@@ skipping 218 matching lines @@
     unsigned oldPosition = *position;
     while (*position < length && data[*position] != '\r' && data[*position] != '\n')
         (*position)++;
     String line = String::fromUTF8(data + oldPosition, *position - oldPosition);
     skipLineTerminator(data, length, position);
     return line;
 }
 
 }