diff --git a/content/xul/document/src/nsXULDocument.cpp b/content/xul/document/src/nsXULDocument.cpp
index 1e52fb965080..793e95a9e0e1 100644
--- a/content/xul/document/src/nsXULDocument.cpp
+++ b/content/xul/document/src/nsXULDocument.cpp
@@ -114,6 +114,7 @@
 #include "nsContentCreatorFunctions.h"
 #include "nsContentUtils.h"
 #include "nsIParser.h"
+#include "nsIParserService.h"
 #include "nsICSSStyleSheet.h"
 #include "nsIScriptError.h"
 
@@ -1378,6 +1379,22 @@ nsXULDocument::Persist(const nsAString& aID,
         nameSpaceID = ni->NamespaceID();
     }
     else {
+        // Make sure that this QName is going to be valid.
+        nsIParserService *parserService = nsContentUtils::GetParserService();
+        NS_ASSERTION(parserService, "Running scripts during shutdown?");
+
+        const PRUnichar *colon;
+        rv = parserService->CheckQName(PromiseFlatString(aAttr), PR_TRUE, &colon);
+        if (NS_FAILED(rv)) {
+            // There was an invalid character or it was malformed.
+            return NS_ERROR_INVALID_ARG;
+        }
+
+        if (colon) {
+            // We don't really handle namespace qualifiers in attribute names.
+            return NS_ERROR_NOT_IMPLEMENTED;
+        }
+
         tag = do_GetAtom(aAttr);
         NS_ENSURE_TRUE(tag, NS_ERROR_OUT_OF_MEMORY);