The caseConvert function should not truncate strings with zero length.

Source/wtf/text/StringImpl.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller ( mueller@kde.org )
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2013 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Andrew Wellington (proton@wiretapped.net)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 671 matching lines @@
             return true;
     }
     return false;
 }
 
 typedef int32_t (*icuCaseConverter)(UChar*, int32_t, const UChar*, int32_t, const char*, UErrorCode*);
 
 static PassRefPtr<StringImpl> caseConvert(const UChar* source16, size_t length, icuCaseConverter converter, const char* locale, StringImpl* originalString)
 {
     UChar* data16;
-    int32_t targetLength = length;
+    size_t targetLength = length;
     RefPtr<StringImpl> output = StringImpl::createUninitialized(length, data16);
     do {
         UErrorCode status = U_ZERO_ERROR;
         targetLength = converter(data16, targetLength, source16, length, locale, &status);
         if (U_SUCCESS(status)) {
-            output->truncateAssumingIsolated(targetLength);
+            ASSERT(targetLength <= length);

[tkent, 2014/11/25 00:41:22]

This assertion is not correct.

input: ß  (length=1)
converter: u_strToUpper
output: SS (targetLength=2)

+            if (length > 0)
+                output->truncateAssumingIsolated(targetLength);
             return output.release();
         }
         if (status != U_BUFFER_OVERFLOW_ERROR)
             return originalString;
         // Expand the buffer.
         output = StringImpl::createUninitialized(targetLength, data16);
     } while (true);
 }
 
 PassRefPtr<StringImpl> StringImpl::lower(const AtomicString& localeIdentifier)
@@ skipping 1376 matching lines @@
 
 size_t StringImpl::sizeInBytes() const
 {
     size_t size = length();
     if (!is8Bit())
         size *= 2;
     return size + sizeof(*this);
 }
 
 } // namespace WTF