Created attachment 38835 [details] test case Element.baseURI parses xml:base attribute as if it were an absolute URL returned by KURL::string(). Instead, an actual base URL should be used as a base for it (one for parent element or the document, I'm not sure). See the attached test case, on which Firefox behaves differently. Depending on attribute value, we can also get an assertion failure now (no crash in release mode).
Created attachment 38836 [details] proper test case (will assert) Actually, I was wrong - in this case, the behavior is correct, as baseURI() falls back to a different code path for invalid base URLs. I cannot see any release-mode bugs possibly caused by this.
Created attachment 38837 [details] proposed fix
Committed revision 47910.
Mass moving XML DOM bugs to the "DOM" Component.