Iframe with srcDoc should resolve FragmentURIs internally

third_party/WebKit/Source/core/svg/SVGURIReference.h

Index: third_party/WebKit/Source/core/svg/SVGURIReference.h
diff --git a/third_party/WebKit/Source/core/svg/SVGURIReference.h b/third_party/WebKit/Source/core/svg/SVGURIReference.h
index 4653189df74101d1862cfa08e07e2a1298d1bae9..4d846d8ff7d993843e4950bf90c56ecfaf1c0c82 100644
--- a/third_party/WebKit/Source/core/svg/SVGURIReference.h
+++ b/third_party/WebKit/Source/core/svg/SVGURIReference.h
@@ -50,9 +50,9 @@ public:
 
     static inline bool isExternalURIReference(const String& uri, const Document& document)
     {
-        // Fragment-only URIs are always internal if the baseURL is same as the document URL.
+        // Fragment-only URIs are always internal if the baseURL is same as the document URL or for srcdoc document.
         // This is common case, so check that first to avoid resolving URL (which is relatively expensive). See crbug.com/557979
-        if (document.baseURL() == document.url() && uri.startsWith('#'))
+        if ((document.isSrcdocDocument() || document.baseURL() == document.url()) && uri.startsWith('#'))
             return false;
 
         // If the URI matches our documents URL, we're dealing with a local reference.