Use an SVGElementProxy in ReferenceClipPathOperation

third_party/WebKit/Source/core/paint/ClipPathClipper.cpp

Index: third_party/WebKit/Source/core/paint/ClipPathClipper.cpp
diff --git a/third_party/WebKit/Source/core/paint/ClipPathClipper.cpp b/third_party/WebKit/Source/core/paint/ClipPathClipper.cpp
index d336ac44589121571929396a816a56f036122d0c..38e535df4edba09c42a77123b7c2c0ac5778338f 100644
--- a/third_party/WebKit/Source/core/paint/ClipPathClipper.cpp
+++ b/third_party/WebKit/Source/core/paint/ClipPathClipper.cpp
@@ -26,10 +26,12 @@ LayoutSVGResourceClipper* resolveElementReference(
         SVGResourcesCache::cachedResourcesForLayoutObject(&layoutObject);
     return resources ? resources->clipper() : nullptr;
   }
-  // TODO(fs): It doesn't work with forward or external SVG references
-  // (https://bugs.webkit.org/show_bug.cgi?id=90405)
-  Element* element = layoutObject.document().getElementById(
-      referenceClipPathOperation.fragment());
+  // TODO(fs): Doesn't work with external SVG references (crbug.com/109212.)
+  Node* targetNode = layoutObject.node();
+  if (!targetNode)
+    return nullptr;
+  SVGElement* element =
+      referenceClipPathOperation.findElement(targetNode->treeScope());
   if (!isSVGClipPathElement(element) || !element->layoutObject())
     return nullptr;
   return toLayoutSVGResourceClipper(