The bug is in nsXMLContentSink::PushNameSpacesFrom The variable 'prefix' must be initialized each time a namespace is encountered. Move declaration of prefix from top of function to inside if (0 == offset) { Here's a sample file (based on simple.xml): <?xml version="1.0"?> <?xml-stylesheet href="docbook.css" type="text/css"?> <!DOCTYPE Book System "docbook.dtd"> <Book xmlns:html="http://www.w3.org/TR/REC-html40" xmlns:svg="http://www.w3.org/TR/WD-SVG0"> <Title>The Book</Title> <Chapter> <Title>Chapter 1.</Title> <Para>Yada yada <html:img src="AniEyes.gif"/> yada. <svg:g> <svg:rectangle x="10" y="10" width="50" height="50"/> </svg:g> </Para> </Chapter> </Book>

Setting all current Open/Normal to M4.

per leger, assigning QA contacts to all open bugs without QA contacts according to list at http://bugzilla.mozilla.org/describecomponents.cgi?product=Browser

Hmm...as long as we get into the (0 == offset) case, we truncate the prefix string before doing anything with it. Again, it seems like this should work...and the test case in question does work. It's a bit hard to confirm that it does work, of course, since the DOM doesn't provide a way to query namespace. Breaking in the debugger and looking at the fields is the poor man's alternative.

I checked my original test case in the debugger, and it does work now. The prefix.truncate(0) was added after I originally reported the bug, and it's equivalent to the fix I suggested.