Use an SVGElementProxy in ReferenceClipPathOperation

third_party/WebKit/Source/core/paint/ClipPathClipper.cpp

Index: third_party/WebKit/Source/core/paint/ClipPathClipper.cpp
diff --git a/third_party/WebKit/Source/core/paint/ClipPathClipper.cpp b/third_party/WebKit/Source/core/paint/ClipPathClipper.cpp
index d336ac44589121571929396a816a56f036122d0c..d0923212c5535d866e7acaee33a8b150efe5c389 100644
--- a/third_party/WebKit/Source/core/paint/ClipPathClipper.cpp
+++ b/third_party/WebKit/Source/core/paint/ClipPathClipper.cpp
@@ -28,8 +28,11 @@ LayoutSVGResourceClipper* resolveElementReference(
   }
   // TODO(fs): It doesn't work with forward or external SVG references
   // (https://bugs.webkit.org/show_bug.cgi?id=90405)
-  Element* element = layoutObject.document().getElementById(
-      referenceClipPathOperation.fragment());
+  Node* targetNode = layoutObject.node();
+  if (!targetNode)
+    return nullptr;
+  SVGElement* element = referenceClipPathOperation.elementProxy().findElement(
+      targetNode->treeScope());
   if (!isSVGClipPathElement(element) || !element->layoutObject())
     return nullptr;
   return toLayoutSVGResourceClipper(