Fix handling of trailing whitespace on url('#foo ')

When |is_local_| was true we'd extract the fragment "manually" from the
relative URL string. Always get the fragment from the resolved/absolute
URL instead to make behavior is consistent w.r.t trimming whitespace.
This requires making sure that base URLs are provided/set up properly in
a few more cases, so do that. Drop the |is_local_| check from
ReResolveUrl() because we now rely on the absolute URL in that case too.

This matches the behavior of SVGURLReferenceResolver's
FragmentIdentifier() which is used for non-CSS URL resolving for SVG
element references. Add test for the case of an invalid base URL.

Also add some tests for various non-CSS uses.

Bug: 949135, 1063694
Change-Id: I2ffb30677b196d650ddaf2a712d82ac6c20b50fd
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2115650
Commit-Queue: Fredrik Söderquist <fs@opera.com>
Reviewed-by: Rune Lillesveen <futhark@chromium.org>
Cr-Commit-Position: refs/heads/master@{#752812}

third_party/blink/renderer/core/css/css_uri_value.cc

@@ -34,8 +34,6 @@ SVGResource* CSSURIValue::EnsureResourceReference() const {
 }
 
 void CSSURIValue::ReResolveUrl(const Document& document) const {
-  if (is_local_)
-    return;
   KURL url = document.CompleteURL(relative_url_);
   AtomicString url_string(url.GetString());
   if (url_string == absolute_url_)
@@ -49,8 +47,8 @@ String CSSURIValue::CustomCSSText() const {
 }
 
 AtomicString CSSURIValue::FragmentIdentifier() const {
-  if (is_local_)
-    return AtomicString(relative_url_.GetString().Substring(1));
+  // Always use KURL's FragmentIdentifier to ensure that we're handling the
+  // fragment in a consistent manner.
   return AtomicString(AbsoluteUrl().FragmentIdentifier());
 }
 

third_party/blink/renderer/core/svg/svg_animate_element.cc

@@ -24,6 +24,7 @@
 
 #include "third_party/blink/renderer/core/css/css_computed_style_declaration.h"
 #include "third_party/blink/renderer/core/css/css_property_value_set.h"
+#include "third_party/blink/renderer/core/css/css_style_sheet.h"
 #include "third_party/blink/renderer/core/css/style_change_reason.h"
 #include "third_party/blink/renderer/core/dom/document.h"
 #include "third_party/blink/renderer/core/dom/qualified_name.h"
@@ -488,11 +489,10 @@ void SVGAnimateElement::ApplyResultsToTarget() {
     MutableCSSPropertyValueSet* properties =
         target_element->EnsureAnimatedSMILStyleProperties();
     auto animated_value_string = animated_value_->ValueAsString();
-    auto secure_context_mode =
-        target_element->GetDocument().GetSecureContextMode();
-    auto set_result =
-        properties->SetProperty(css_property_id_, animated_value_string, false,
-                                secure_context_mode, nullptr);
+    auto& document = target_element->GetDocument();
+    auto set_result = properties->SetProperty(
+        css_property_id_, animated_value_string, false,
+        document.GetSecureContextMode(), document.ElementSheet().Contents());
     if (set_result.did_change) {
       target_element->SetNeedsStyleRecalc(
           kLocalStyleChange,

third_party/blink/web_tests/external/wpt/svg/linking/reftests/reference/green-100x100.svg

+<svg xmlns="http://www.w3.org/2000/svg">
+  <rect width="100" height="100" fill="green"/>
+</svg>

third_party/blink/web_tests/external/wpt/svg/linking/reftests/url-processing-invalid-base.svg

+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:html="http://www.w3.org/1999/xhtml">
+  <title>An invalid base URL makes all internal references invalid</title>
+  <html:link rel="help" href="https://svgwg.org/svg2-draft/linking.html#processingURL"/>
+  <html:link rel="help" href="https://svgwg.org/svg2-draft/painting.html#SpecifyingPaint"/>
+  <html:link rel="help" href="https://svgwg.org/svg2-draft/pservers.html#PaintServerTemplates"/>
+  <html:link rel="match" href="reference/green-100x100.svg"/>
+  <html:base href="invalid:"/>
+  <linearGradient id="p2">
+    <stop stop-color="orange"/>
+  </linearGradient>
+  <linearGradient id="p" href="#p2"/>
+  <rect width="100" height="100" fill="red"/>
+  <rect width="100" height="100" fill="url(#p) green"/>
+</svg>

third_party/blink/web_tests/external/wpt/svg/linking/reftests/url-processing-whitespace-001.svg

+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:html="http://www.w3.org/1999/xhtml">
+  <title>Leading and trailing whitespace is stripped from (local) URL references (&#x3c;paint&#x3e;)</title>
+  <html:link rel="help" href="https://svgwg.org/svg2-draft/linking.html#processingURL"/>
+  <html:link rel="help" href="https://svgwg.org/svg2-draft/painting.html#SpecifyingPaint"/>
+  <html:link rel="match" href="reference/green-100x100.svg"/>
+  <linearGradient id="green">
+    <stop stop-color="green"/>
+  </linearGradient>
+  <linearGradient id="red">
+    <stop stop-color="red"/>
+  </linearGradient>
+  <rect width="50" height="50" fill="url(' #green') red"/>
+  <rect width="50" height="50" fill="url('#green ') red" x="50"/>
+  <rect width="50" height="50" fill="url(' #green ') red" y="50"/>
+  <rect width="50" height="50" fill="url(' # red ') green" y="50" x="50"/>
+</svg>

third_party/blink/web_tests/external/wpt/svg/linking/reftests/url-processing-whitespace-002.svg

+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:html="http://www.w3.org/1999/xhtml">
+  <title>Leading and trailing whitespace is stripped from (local) URL references (&#x3c;use&#x3e; href)</title>
+  <html:link rel="help" href="https://svgwg.org/svg2-draft/linking.html#processingURL"/>
+  <html:link rel="help" href="https://svgwg.org/svg2-draft/struct.html#UseElementHrefAttribute"/>
+  <html:link rel="match" href="reference/green-100x100.svg"/>
+  <defs>
+    <rect id="green" width="50" height="50" fill="green"/>
+    <rect id="red" width="50" height="50" fill="red"/>
+  </defs>
+  <rect width="100" height="100" fill="red"/>
+  <use href=" #green"/>
+  <use href="#green " x="50"/>
+  <use href=" #green " y="50"/>
+  <g transform="translate(50 50)">
+    <rect id="green" width="50" height="50" fill="green"/>
+    <use href=" # red "/>
+  </g>
+</svg>

third_party/blink/web_tests/external/wpt/svg/linking/reftests/url-processing-whitespace-003.svg

+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:html="http://www.w3.org/1999/xhtml">
+  <title>Leading and trailing whitespace is stripped from (local) URL references (&#x3c;linearGradient&#x3e; href)</title>
+  <html:link rel="help" href="https://svgwg.org/svg2-draft/linking.html#processingURL"/>
+  <html:link rel="help" href="https://svgwg.org/svg2-draft/pservers.html#PaintServerTemplates"/>
+  <html:link rel="match" href="reference/green-100x100.svg"/>
+  <linearGradient id="green">
+    <stop stop-color="green"/>
+  </linearGradient>
+  <linearGradient id="red">
+    <stop stop-color="red"/>
+  </linearGradient>
+  <linearGradient id="g1" href=" #green"/>
+  <linearGradient id="g2" href="#green "/>
+  <linearGradient id="g3" href=" #green "/>
+  <linearGradient id="g4" href=" # red ">
+    <stop stop-color="green"/>
+  </linearGradient>
+  <rect width="100" height="100" fill="red"/>
+  <rect width="50" height="50" fill="url(#g1) red"/>
+  <rect width="50" height="50" fill="url(#g2) red" x="50"/>
+  <rect width="50" height="50" fill="url(#g3) red" y="50"/>
+  <rect width="50" height="50" fill="url(#g4) red" y="50" x="50"/>
+</svg>