Fix Chromium bug 4178...

webkit/port/bindings/v8/v8_custom.cpp

 /*
  *  Copyright (C) 2000 Harri Porten (porten@kde.org)
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
  *  Copyright (C) 2004-2006 Apple Computer, Inc.
  *  Copyright (C) 2006 James G. Speth (speth@end.com)
  *  Copyright (C) 2006 Samuel Weinig (sam@webkit.org)
  *  Copyright 2007, 2008 Google Inc. All Rights Reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ skipping 1311 matching lines @@
   v8::Handle<v8::Value> result =
       holder->GetRealNamedPropertyInPrototypeChain(name);
   if (!result.IsEmpty())
     return result;
 
   // Lazy initialization map keeps global properties that can be lazily
   // initialized. The value is the code to instantiate the property.
   // It must return the value of property after initialization.
   static HashMap<String, String> kLazyInitMap;
   if (kLazyInitMap.isEmpty()) {
+    // "new Image()" does not appear to be well-defined in a spec, but Safari,
+    // Opera, and Firefox all consider it to always create an HTML image
+    // element, regardless of the current doctype.
     kLazyInitMap.set("Image",
                      "function Image() { \
-                        return document.createElement('image'); \
+                        return document.createElementNS( \
+                          'http://www.w3.org/1999/xhtml', 'img'); \
                       }; \
                       Image");
     kLazyInitMap.set("Option",
       "function Option(text, value, defaultSelected, selected) { \
          var option = document.createElement('option'); \
          if (text == null) return option; \
          option.text = text; \
          if (value == null) return option; \
          option.value = value; \
          if (defaultSelected == null) return option; \
@@ skipping 2290 matching lines @@
 #undef MAKE_CASE
 
   default:
     return V8ClassIndex::INVALID_CLASS_INDEX;
   }
 }
 
 #endif  // ENABLE(SVG)
 
 }  // namespace WebCore