Merge 104275 - Fix a crash by importing an element of which local name ends with ":input".

Source/WebCore/dom/Document.cpp

Index: Source/WebCore/dom/Document.cpp
===================================================================
--- Source/WebCore/dom/Document.cpp	(revision 105338)
+++ Source/WebCore/dom/Document.cpp	(working copy)
@@ -835,8 +835,13 @@
         return createComment(importedNode->nodeValue());
     case ELEMENT_NODE: {
         Element* oldElement = static_cast<Element*>(importedNode);
-        RefPtr<Element> newElement = createElementNS(oldElement->namespaceURI(), oldElement->tagQName().toString(), ec);
-                    
+        // FIXME: The following check might be unnecessary. Is it possible that
+        // oldElement has mismatched prefix/namespace?
+        if (hasPrefixNamespaceMismatch(oldElement->tagQName())) {
+            ec = NAMESPACE_ERR;
+            return 0;
+        }
+        RefPtr<Element> newElement = createElement(oldElement->tagQName(), ec);
         if (ec)
             return 0;