Make fragment-only URLs always be document-local references

third_party/WebKit/Source/core/css/resolver/StyleBuilderConverter.cpp

Index: third_party/WebKit/Source/core/css/resolver/StyleBuilderConverter.cpp
diff --git a/third_party/WebKit/Source/core/css/resolver/StyleBuilderConverter.cpp b/third_party/WebKit/Source/core/css/resolver/StyleBuilderConverter.cpp
index bd5c532c1470f56bbd8ebc749d3d5b24f6b72abe..c1c4a2e78d007f9fc3cb09b7f82f1a394809c696 100644
--- a/third_party/WebKit/Source/core/css/resolver/StyleBuilderConverter.cpp
+++ b/third_party/WebKit/Source/core/css/resolver/StyleBuilderConverter.cpp
@@ -123,10 +123,9 @@ PassRefPtr<ClipPathOperation> StyleBuilderConverter::convertClipPath(StyleResolv
     if (value.isBasicShapeValue())
         return ShapeClipPathOperation::create(basicShapeForValue(state, value));
     if (value.isURIValue()) {
-        String cssURLValue = toCSSURIValue(value).value();
-        KURL url = state.document().completeURL(cssURLValue);
+        SVGURLReferenceResolver resolver(toCSSURIValue(value).value(), state.document());
         // TODO(fs): Doesn't work with forward or external SVG references (crbug.com/391604, crbug.com/109212, ...)
-        return ReferenceClipPathOperation::create(cssURLValue, AtomicString(url.fragmentIdentifier()));
+        return ReferenceClipPathOperation::create(toCSSURIValue(value).value(), resolver.fragmentIdentifier());

[fs, 2016/07/22 16:06:53]

This has a (preexisting) bug (filed as crbug.com/629826), will send a dependent
CL to fix that.

     }
     DCHECK(value.isPrimitiveValue() && toCSSPrimitiveValue(value).getValueID() == CSSValueNone);
     return nullptr;