| Index: third_party/WebKit/Source/core/paint/ClipPathClipper.cpp
 | 
| diff --git a/third_party/WebKit/Source/core/paint/ClipPathClipper.cpp b/third_party/WebKit/Source/core/paint/ClipPathClipper.cpp
 | 
| index 723110707b67b346556153faf2addf2e7fc21451..4351c73c849716e31a1eda109058614dde79b871 100644
 | 
| --- a/third_party/WebKit/Source/core/paint/ClipPathClipper.cpp
 | 
| +++ b/third_party/WebKit/Source/core/paint/ClipPathClipper.cpp
 | 
| @@ -5,36 +5,59 @@
 | 
|  #include "core/paint/ClipPathClipper.h"
 | 
|  
 | 
|  #include "core/layout/svg/LayoutSVGResourceClipper.h"
 | 
| +#include "core/layout/svg/SVGResources.h"
 | 
| +#include "core/layout/svg/SVGResourcesCache.h"
 | 
| +#include "core/paint/SVGClipPainter.h"
 | 
|  #include "core/style/ClipPathOperation.h"
 | 
|  #include "platform/graphics/paint/ClipPathRecorder.h"
 | 
|  
 | 
|  namespace blink {
 | 
|  
 | 
| +namespace {
 | 
| +
 | 
| +LayoutSVGResourceClipper* resolveElementReference(
 | 
| +    const LayoutObject& layoutObject,
 | 
| +    const ReferenceClipPathOperation& referenceClipPathOperation)
 | 
| +{
 | 
| +    if (layoutObject.isSVG()) {
 | 
| +        // The reference will have been resolved in
 | 
| +        // SVGResources::buildResources, so we can just use the LayoutObject's
 | 
| +        // SVGResources.
 | 
| +        SVGResources* resources = SVGResourcesCache::cachedResourcesForLayoutObject(&layoutObject);
 | 
| +        return resources ? resources->clipper() : nullptr;
 | 
| +    }
 | 
| +    // TODO(fs): It doesn't work with forward or external SVG references (https://bugs.webkit.org/show_bug.cgi?id=90405)
 | 
| +    Element* element = layoutObject.document().getElementById(referenceClipPathOperation.fragment());
 | 
| +    if (!isSVGClipPathElement(element) || !element->layoutObject())
 | 
| +        return nullptr;
 | 
| +    return toLayoutSVGResourceClipper(toLayoutSVGResourceContainer(element->layoutObject()));
 | 
| +}
 | 
| +
 | 
| +} // namespace
 | 
| +
 | 
|  ClipPathClipper::ClipPathClipper(
 | 
|      GraphicsContext& context,
 | 
| +    ClipPathOperation& clipPathOperation,
 | 
|      const LayoutObject& layoutObject,
 | 
|      const FloatRect& referenceBox,
 | 
|      const FloatPoint& origin)
 | 
|      : m_resourceClipper(nullptr)
 | 
| -    , m_clipperState(SVGClipPainter::ClipperNotApplied)
 | 
| +    , m_clipperState(ClipperState::NotApplied)
 | 
|      , m_layoutObject(layoutObject)
 | 
|      , m_context(context)
 | 
|  {
 | 
| -    DCHECK(layoutObject.styleRef().clipPath());
 | 
| -    ClipPathOperation* clipPathOperation = layoutObject.styleRef().clipPath();
 | 
| -    if (clipPathOperation->type() == ClipPathOperation::SHAPE) {
 | 
| -        ShapeClipPathOperation* shape = toShapeClipPathOperation(clipPathOperation);
 | 
| -        if (!shape->isValid())
 | 
| +    if (clipPathOperation.type() == ClipPathOperation::SHAPE) {
 | 
| +        ShapeClipPathOperation& shape = toShapeClipPathOperation(clipPathOperation);
 | 
| +        if (!shape.isValid())
 | 
|              return;
 | 
| -        m_clipPathRecorder.emplace(context, layoutObject, shape->path(referenceBox));
 | 
| +        m_clipPathRecorder.emplace(context, layoutObject, shape.path(referenceBox));
 | 
| +        m_clipperState = ClipperState::AppliedPath;
 | 
|      } else {
 | 
| -        DCHECK_EQ(clipPathOperation->type(), ClipPathOperation::REFERENCE);
 | 
| -        ReferenceClipPathOperation* referenceClipPathOperation = toReferenceClipPathOperation(clipPathOperation);
 | 
| -        // TODO(fs): It doesn't work with forward or external SVG references (https://bugs.webkit.org/show_bug.cgi?id=90405)
 | 
| -        Element* element = layoutObject.document().getElementById(referenceClipPathOperation->fragment());
 | 
| -        if (!isSVGClipPathElement(element) || !element->layoutObject())
 | 
| +        DCHECK_EQ(clipPathOperation.type(), ClipPathOperation::REFERENCE);
 | 
| +        LayoutSVGResourceClipper* clipper = resolveElementReference(
 | 
| +            layoutObject, toReferenceClipPathOperation(clipPathOperation));
 | 
| +        if (!clipper)
 | 
|              return;
 | 
| -        LayoutSVGResourceClipper* clipper = toLayoutSVGResourceClipper(toLayoutSVGResourceContainer(element->layoutObject()));
 | 
|          // Compute the (conservative) bounds of the clip-path.
 | 
|          FloatRect clipPathBounds = clipper->resourceBoundingBox(referenceBox);
 | 
|          // When SVG applies the clip, and the coordinate system is "userspace on use", we must explicitly pass in
 | 
| 
 |