Rewrite to not store type in m_type and also remove type getter/setter.

LayoutTests/svg/dom/SVGScriptElement/script-type-attribute.svg

Index: LayoutTests/svg/dom/SVGScriptElement/script-type-attribute.svg
diff --git a/LayoutTests/svg/dom/SVGScriptElement/script-type-attribute.svg b/LayoutTests/svg/dom/SVGScriptElement/script-type-attribute.svg
new file mode 100644
index 0000000000000000000000000000000000000000..30cc5be4b1e35e84581fb9a6c37fe34e249aa36b
--- /dev/null
+++ b/LayoutTests/svg/dom/SVGScriptElement/script-type-attribute.svg
@@ -0,0 +1,24 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xhtml="http://www.w3.org/1999/xhtml" onload="test()">
+<script type="text/javascript">
+function test() {
+    if (window.testRunner) {
+        testRunner.dumpAsText();
+    }
+
+    var script = document.createElementNS("http://www.w3.org/2000/svg", "svg:script");
+    script.type = "text/javascript";
+    if (script.type != "text/javascript" || script.getAttribute("type") != "text/javascript") {
+        document.getElementById("p0").innerHTML = "FAIL";
+        return;
+    }
+
+    script.setAttribute("type", "text/fooscript");
+    if (script.type != "text/fooscript" || script.getAttribute("type") != "text/fooscript")
+        document.getElementById("p0").innerHTML = "FAIL";
+}
+</script>
+<foreignObject>
+<xhtml:p>Test that getting/setting the type JS property on SVGScriptElement keeps sync with the type content attribute.</xhtml:p>
+<xhtml:span id="p0">PASS</xhtml:span>
+</foreignObject>
+</svg>