Updated SVGListPropertyHelper as per SVG2 Spec

Source/core/svg/properties/SVGListPropertyTearOffHelper.h

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 33 matching lines @@
     typedef ItemProperty ItemPropertyType;
     typedef typename ItemPropertyType::TearOffType ItemTearOffType;
 
     static PassRefPtrWillBeRawPtr<ItemPropertyType> getValueForInsertionFromTearOff(PassRefPtrWillBeRawPtr<ItemTearOffType> passNewItem, SVGElement* contextElement, const QualifiedName& attributeName)
     {
         RefPtrWillBeRawPtr<ItemTearOffType> newItem = passNewItem;
 
         // |newItem| is immutable, OR
         // |newItem| belongs to a SVGElement, but it does not belong to an animated list
         // (for example: "textElement.x.baseVal.appendItem(rectElement.width.baseVal)")
-        if (newItem->isImmutable()
-            || (newItem->contextElement() && !newItem->target()->ownerList())) {
+        // Spec: If newItem is already in a list, then a new object is created with the same values as newItem and this item is inserted into the list.
+        // Otherwise, newItem itself is inserted into the list.
+        if (newItem->isImmutable() || newItem->target()->ownerList() || newItem->contextElement()) {
             // We have to copy the incoming |newItem|,
             // Otherwise we'll end up having two tearoffs that operate on the same SVGProperty. Consider the example below:
             // SVGRectElements SVGAnimatedLength 'width' property baseVal points to the same tear off object
             // that's inserted into SVGTextElements SVGAnimatedLengthList 'x'. textElement.x.baseVal.getItem(0).value += 150 would
             // mutate the rectElement width _and_ the textElement x list. That's obviously wrong, take care of that.
             return newItem->target()->clone();
         }
 
         newItem->attachToSVGElementAttribute(contextElement, attributeName);
         return newItem->target();
@@ skipping 146 matching lines @@
         return ItemTraits::createTearOff(value, 0, PropertyIsNotAnimVal, QualifiedName::null());
     }
 
 private:
     Derived* toDerived() { return static_cast<Derived*>(this); }
 };
 
 }
 
 #endif // SVGListPropertyTearOffHelper_h