ASSERTION FAILED: name[0] == '@' && length >= 2 in WebCore::CSSTokenizer::detectAtToken

Source/core/css/CSSTokenizer-in.cpp

 /*
  * Copyright (C) 2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Nicholas Shanks <webkit@nickshanks.com>
  * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  * Copyright (C) 2012 Intel Corporation. All rights reserved.
  *
@@ skipping 1463 matching lines @@
             currentCharacter<SrcCharacterType>() += 3;
             m_token = SGML_CD;
         }
         break;
 
     case CharacterAt:
         if (isIdentifierStart<SrcCharacterType>()) {
             m_token = ATKEYWORD;
             ++result;
             parseIdentifier(result, resultString, hasEscape);
-            detectAtToken<SrcCharacterType>(result - tokenStart<SrcCharacterType>(), hasEscape);
+            // The standard enables unicode escapes in at-rules. In this case only the resultString will contain the
+            // correct identifier, hence we have to use it to determine its length instead of the usual pointer arithmetic.
+            detectAtToken<SrcCharacterType>(resultString.length() + 1, hasEscape);
         }
         break;
 
     case CharacterBackSlash:
         if (isCSSEscape(*currentCharacter<SrcCharacterType>())) {
             --currentCharacter<SrcCharacterType>();
             parseIdentifier(result, yylval->string, hasEscape);
             m_token = IDENT;
         }
         break;
@@ skipping 85 matching lines @@
     m_dataStart16[length - 1] = 0;
 
     m_is8BitSource = false;
     m_currentCharacter8 = 0;
     m_currentCharacter16 = m_dataStart16.get();
     setTokenStart<UChar>(m_currentCharacter16);
     m_lexFunc = &CSSTokenizer::realLex<UChar>;
 }
 
 } // namespace WebCore