https://bugs.webkit.org/show_bug.cgi?id=125527

Reviewed by Darin Adler.

Source/WebCore:

From the Blink port of this bug it becomes clear that svg/dom/SVGScriptElement/script-set-href.svg and
svg/dom/svg-element-attribute-js-null.xhtml still hit an assert in Debug because SVGNames::typeAttr can't
be used with fastGetAttribute in all cases, because it can be animatable. However for SVGScriptElement
it is not animatable, so make isAnimatableAttribute virtual (note Debug only method) and allow typeAttr
in the SVGScriptElement case to be useable for fastGetAttribute.

Test: svg/dom/SVGScriptElement/script-type-attribute.svg

* svg/SVGElement.h:
* svg/SVGScriptElement.cpp:
(WebCore::SVGScriptElement::isAnimatableAttribute):
* svg/SVGScriptElement.h:

LayoutTests:

Add test to verify the new type getter/setter behavior on SVScriptElement.
Specifically, the old behavior was setting the JS type property did not reflect in
the actual content attribute being set, the new behavior is to do set the content
attribute when setting the JS type property.

* svg/dom/SVGScriptElement/script-type-attribute-expected.txt: Added.
* svg/dom/SVGScriptElement/script-type-attribute.svg: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@160544 268f45cc-cd09-0410-ab3c-d52691b4dbfc