Fix the way <title> is read under <use> shadow tree

third_party/WebKit/Source/core/svg/SVGUseElement.cpp

Index: third_party/WebKit/Source/core/svg/SVGUseElement.cpp
diff --git a/third_party/WebKit/Source/core/svg/SVGUseElement.cpp b/third_party/WebKit/Source/core/svg/SVGUseElement.cpp
index 89e88c003deed519385b85049414dd464db1d1fd..a3459c17d87dca216e3635762f1d25b924546310 100644
--- a/third_party/WebKit/Source/core/svg/SVGUseElement.cpp
+++ b/third_party/WebKit/Source/core/svg/SVGUseElement.cpp
@@ -40,6 +40,7 @@
 #include "core/svg/SVGLengthContext.h"
 #include "core/svg/SVGSVGElement.h"
 #include "core/svg/SVGSymbolElement.h"
+#include "core/svg/SVGTitleElement.h"
 #include "core/svg/SVGTreeScopeResources.h"
 #include "core/xml/parser/XMLDocumentParser.h"
 #include "platform/loader/fetch/FetchRequest.h"
@@ -339,6 +340,22 @@ void SVGUseElement::buildPendingResource() {
   ASSERT(!m_needsShadowTreeRecreation);
 }
 
+String SVGUseElement::title() const {
+  // Find the first <title> child in <use> which doesn't cover shadow tree.
+  if (Element* titleElement = Traversal<SVGTitleElement>::firstChild(*this))
+    return titleElement->innerText();
+
+  // If there is no <title> child in <use>, we lookup first <title> child in
+  // shadow tree.
+  if (m_targetElementInstance) {
+    if (Element* titleElement =
+            Traversal<SVGTitleElement>::firstChild(*m_targetElementInstance))
+      return titleElement->innerText();
+  }
+  // Otherwise return a null string.
+  return String();
+}
+
 static void associateCorrespondingElements(SVGElement& targetRoot,
                                            SVGElement& instanceRoot) {
   auto targetRange = Traversal<SVGElement>::inclusiveDescendantsOf(targetRoot);