Block animation of the SVGScriptElement

third_party/WebKit/Source/core/svg/SVGAnimateElement.cpp

Index: third_party/WebKit/Source/core/svg/SVGAnimateElement.cpp
diff --git a/third_party/WebKit/Source/core/svg/SVGAnimateElement.cpp b/third_party/WebKit/Source/core/svg/SVGAnimateElement.cpp
index 90170a52bbdd646ca402846e91abb5acbfa81730..d2beb597d4f2461b5b5dc37e677716f91177e734 100644
--- a/third_party/WebKit/Source/core/svg/SVGAnimateElement.cpp
+++ b/third_party/WebKit/Source/core/svg/SVGAnimateElement.cpp
@@ -193,6 +193,14 @@ void SVGAnimateElement::resolveTargetProperty() {
                           ? cssPropertyID(attributeName().localName())
                           : CSSPropertyInvalid;
   }
+  // Blacklist <script> targets here for now to prevent unpleasantries. This
+  // also disallows the perfectly "valid" animation of 'className' on said
+  // element. If SVGScriptElement.href is transitioned off of SVGAnimatedHref,
+  // this can be removed.
+  if (isSVGScriptElement(*targetElement())) {
+    m_type = AnimatedUnknown;
+    m_cssPropertyId = CSSPropertyInvalid;
+  }
   DCHECK(m_type != AnimatedPoint && m_type != AnimatedStringList &&
          m_type != AnimatedTransform && m_type != AnimatedTransformList);
 }