Don't resolve non-local -webkit-clip-path references as local

Whether the reference was local or not was disregarded, meaning that any URL with a valid fragment part could potential result in a valid clip - regardless of whether it was local or not. I.e foo.svg#bar would reference an element with the id 'bar' in the local document. Check if the URL reference resolver flagged the reference as being local, and only pass a non-null fragment if it was. BUG=629826 Review-Url: https://codereview.chromium.org/2174813003 Cr-Commit-Position: refs/heads/master@{#407300}

Don't resolve non-local -webkit-clip-path references as local
Whether the reference was local or not was disregarded, meaning that any URL with a valid fragment part could potential result in a valid clip - regardless of whether it was local or not. I.e foo.svg#bar would reference an element with the id 'bar' in the local document. Check if the URL reference resolver flagged the reference as being local, and only pass a non-null fragment if it was. BUG=629826 Review-Url: https://codereview.chromium.org/2174813003 Cr-Commit-Position: refs/heads/master@{#407300}
d9357efc · fs · Commit bot · e7d7225c · d9357efc · d9357efc
Commit d9357efc authored Jul 22, 2016 by fs Committed by Commit bot Jul 22, 2016
3 changed files
--- a/third_party/WebKit/LayoutTests/css3/masking/clip-path-reference-nonexisting-existing-local-expected.html
+++ b/third_party/WebKit/LayoutTests/css3/masking/clip-path-reference-nonexisting-existing-local-expected.html
+<!DOCTYPE html>
+<div style="width: 100px; height: 100px; background-color: green"></div>
--- a/third_party/WebKit/LayoutTests/css3/masking/clip-path-reference-nonexisting-existing-local.html
+++ b/third_party/WebKit/LayoutTests/css3/masking/clip-path-reference-nonexisting-existing-local.html
+<!DOCTYPE html>
+<style>
+#target {
+  width: 100px;
+  height: 100px;
+  background-color: green;
+  -webkit-clip-path: url(notexisting.svg#c);
+  clip-path: url(notexisting.svg#c);
+}
+</style>
+<div style="background-color: red; width: 100px">
+  <div id="target"></div>
+</div>
+<svg>
+  <clipPath id="c" clipPathUnits="objectBoundingBox">
+    <circle cx="0.5" cy="0.5" r="0.5"/>
+  </clipPath>
+</svg>
--- a/third_party/WebKit/Source/core/css/resolver/StyleBuilderConverter.cpp
+++ b/third_party/WebKit/Source/core/css/resolver/StyleBuilderConverter.cpp
@@ -124,8 +124,13 @@ PassRefPtr<ClipPathOperation> StyleBuilderConverter::convertClipPath(StyleResolv
        return ShapeClipPathOperation::create(basicShapeForValue(state, value));
    if (value.isURIValue()) {
        SVGURLReferenceResolver resolver(toCSSURIValue(value).value(), state.document());
+        // If the reference is non-local, then the fragment will remain as a
+        // null string, which makes the element lookup fail.
+        AtomicString fragmentIdentifier;
+        if (resolver.isLocal())
+            fragmentIdentifier = resolver.fragmentIdentifier();
        // TODO(fs): Doesn't work with forward or external SVG references (crbug.com/391604, crbug.com/109212, ...)
-        return ReferenceClipPathOperation::create(toCSSURIValue(value).value(), resolver.fragmentIdentifier());
+        return ReferenceClipPathOperation::create(toCSSURIValue(value).value(), fragmentIdentifier);
    }
    DCHECK(value.isPrimitiveValue() && toCSSPrimitiveValue(value).getValueID() == CSSValueNone);
    return nullptr;