Make fragment-only URLs always be document-local references

third_party/WebKit/Source/core/svg/SVGURIReference.h

 /*
  * Copyright (C) 2004, 2005, 2008, 2009 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) 2004, 2005 Rob Buis <buis@kde.org>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 30 matching lines @@
     // SVGURIReference.
     static const AtomicString& legacyHrefString(const SVGElement&);
 
     // Like above, but for elements that inherit from SVGURIReference. Resolves
     // against the base URL of the passed Document.
     KURL legacyHrefURL(const Document&) const;
 
     static AtomicString fragmentIdentifierFromIRIString(const String&, const TreeScope&);
     static Element* targetElementFromIRIString(const String&, const TreeScope&, AtomicString* = nullptr);
 
-    static inline bool isExternalURIReference(const String& uri, const Document& document)
-    {
-        // Fragment-only URIs are always internal if the baseURL is same as the document URL.
-        // This is common case, so check that first to avoid resolving URL (which is relatively expensive). See crbug.com/557979
-        if (document.baseURL() == document.url() && uri.startsWith('#'))
-            return false;
-
-        // If the URI matches our documents URL, we're dealing with a local reference.
-        KURL url = document.completeURL(uri);
-        return !equalIgnoringFragmentIdentifier(url, document.url());
-    }
-
     const String& hrefString() const { return m_href->currentValue()->value(); }
 
     // JS API
     SVGAnimatedHref* href() const { return m_href.get(); }
 
     DECLARE_VIRTUAL_TRACE();
 
 protected:
     explicit SVGURIReference(SVGElement*);
 
 private:
     Member<SVGAnimatedHref> m_href;
 };
 
+// Helper class used to resolve fragment references. Handles the 'local url
+// flag' per https://drafts.csswg.org/css-values/#local-urls .
+class SVGURLReferenceResolver {
+    STACK_ALLOCATED();
+public:
+    SVGURLReferenceResolver(const String& urlString, const Document&);
+
+    bool isLocal() const;
+    KURL absoluteUrl() const;
+    AtomicString fragmentIdentifier() const;
+
+private:
+    const String& m_relativeUrl;
+    Member<const Document> m_document;
+    mutable KURL m_absoluteUrl;
+    bool m_isLocal;
+};
+
 } // namespace blink
 
 #endif // SVGURIReference_h