REGRESSION (Safari 5.0.5 - ToT): crash in SVG test http://dev.w3.org/SVG/profiles...

REGRESSION (Safari 5.0.5 - ToT): crash in SVG test dev.w3.org/SVG/profiles/1.1F2/test/harness/htmlObjectApproved/animate-elem-39-t.html
https://bugs.webkit.org/show_bug.cgi?id=64671

Patch by Stephen Chenney <schenney@chromium.org> on 2012-01-21
Reviewed by Nikolas Zimmermann.

Source/WebCore:

No new tests. This change is to fix crashes in existing tests.

* svg/animation/SVGSMILElement.cpp:
(WebCore::SVGSMILElement::beginListChanged): If the new begin time is
later than the current end time, and the event time is also after then
end time (but we have not yet updated to that time) and the animation
is active, we need to make the animation inactive explicitly.

LayoutTests:

* platform/chromium/test_expectations.txt: Marking all svg/W3C-SVG-1.1/animate-elem* tests
as flakey pending this change being committed and new results.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@105572 268f45cc-cd09-0410-ab3c-d52691b4dbfc