diff --git a/js/src/jscntxt.h b/js/src/jscntxt.h
index c82d1f4eb2a1..dbb827d0a466 100644
--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@@ -622,6 +622,9 @@ JS_STATIC_ASSERT(sizeof(JSTempValueUnion) == sizeof(void *));
 #define JS_PUSH_TEMP_ROOT_QNAME(cx,qn,tvr)                                    \
     JS_PUSH_TEMP_ROOT_COMMON(cx, qn, tvr, JSTVU_SINGLE, qname)
 
+#define JS_PUSH_TEMP_ROOT_NAMESPACE(cx,ns,tvr)                                \
+    JS_PUSH_TEMP_ROOT_COMMON(cx, ns, tvr, JSTVU_SINGLE, nspace)
+
 #define JS_PUSH_TEMP_ROOT_XML(cx,xml_,tvr)                                    \
     JS_PUSH_TEMP_ROOT_COMMON(cx, xml_, tvr, JSTVU_SINGLE, xml)
 
diff --git a/js/src/jsfun.c b/js/src/jsfun.c
index 44b88e04fdec..cd8738b104fd 100644
--- a/js/src/jsfun.c
+++ b/js/src/jsfun.c
@@ -1976,17 +1976,12 @@ JSObject *
 js_InitFunctionClass(JSContext *cx, JSObject *obj)
 {
     JSObject *proto;
-    JSAtom *atom;
     JSFunction *fun;
 
     proto = JS_InitClass(cx, obj, NULL, &js_FunctionClass, Function, 1,
                          function_props, function_methods, NULL, NULL);
     if (!proto)
         return NULL;
-    atom = js_Atomize(cx, js_FunctionClass.name, strlen(js_FunctionClass.name),
-                      0);
-    if (!atom)
-        goto bad;
     fun = js_NewFunction(cx, proto, NULL, 0, JSFUN_INTERPRETED, obj, NULL);
     if (!fun)
         goto bad;
diff --git a/js/src/jsprvtd.h b/js/src/jsprvtd.h
index 127c5250ee4e..b8cbfa9d381d 100644
--- a/js/src/jsprvtd.h
+++ b/js/src/jsprvtd.h
@@ -239,6 +239,7 @@ typedef union JSTempValueUnion {
     JSString            *string;
     JSXML               *xml;
     JSXMLQName          *qname;
+    JSXMLNamespace      *nspace;
     JSTempValueTrace    trace;
     JSScopeProperty     *sprop;
     JSWeakRoots         *weakRoots;
diff --git a/js/src/jsxml.c b/js/src/jsxml.c
index aff680dd3aad..7c6e3b3d7cc0 100644
--- a/js/src/jsxml.c
+++ b/js/src/jsxml.c
@@ -314,11 +314,17 @@ js_NewXMLNamespaceObject(JSContext *cx, JSString *prefix, JSString *uri,
                          JSBool declared)
 {
     JSXMLNamespace *ns;
+    JSTempValueRooter tvr;
+    JSObject *obj;
 
     ns = js_NewXMLNamespace(cx, prefix, uri, declared);
     if (!ns)
         return NULL;
-    return js_GetXMLNamespaceObject(cx, ns);
+
+    JS_PUSH_TEMP_ROOT_NAMESPACE(cx, ns, &tvr);
+    obj = js_GetXMLNamespaceObject(cx, ns);
+    JS_POP_TEMP_ROOT(cx, &tvr);
+    return obj;
 }
 
 JSObject *
@@ -590,11 +596,16 @@ js_NewXMLQNameObject(JSContext *cx, JSString *uri, JSString *prefix,
                      JSString *localName)
 {
     JSXMLQName *qn;
+    JSTempValueRooter tvr;
+    JSObject *obj;
 
     qn = js_NewXMLQName(cx, uri, prefix, localName);
     if (!qn)
         return NULL;
-    return js_GetXMLQNameObject(cx, qn);
+    JS_PUSH_TEMP_ROOT_QNAME(cx, qn, &tvr);
+    obj = js_GetXMLQNameObject(cx, qn);
+    JS_POP_TEMP_ROOT(cx, &tvr);
+    return obj;
 }
 
 JSObject *
@@ -7755,9 +7766,6 @@ js_GetFunctionNamespace(JSContext *cx, jsval *vp)
         obj = rt->functionNamespaceObject;
         if (!obj) {
             JS_UNLOCK_GC(rt);
-            atom = js_Atomize(cx, js_function_str, 8, 0);
-            JS_ASSERT(atom);
-            prefix = ATOM_TO_STRING(atom);
 
             /*
              * Note that any race to atomize anti_uri here is resolved by
@@ -7771,6 +7779,7 @@ js_GetFunctionNamespace(JSContext *cx, jsval *vp)
                 return JS_FALSE;
             rt->atomState.lazy.functionNamespaceURIAtom = atom;
 
+            prefix = ATOM_TO_STRING(rt->atomState.typeAtoms[JSTYPE_FUNCTION]);
             uri = ATOM_TO_STRING(atom);
             obj = js_NewXMLNamespaceObject(cx, prefix, uri, JS_FALSE);
             if (!obj)