Bug 758408 - Fix XML slot handling (r=Waldo)

js/src/jsxml.cpp

@@ -7470,7 +7470,7 @@ namespace js {
 bool
 GlobalObject::getFunctionNamespace(JSContext *cx, Value *vp)
 {
-    HeapSlot &v = getSlotRef(FUNCTION_NS);
+    Value v = getSlot(FUNCTION_NS);
     if (v.isUndefined()) {
         JSRuntime *rt = cx->runtime;
         JSLinearString *prefix = rt->atomState.typeAtoms[JSTYPE_FUNCTION];
@@ -7489,7 +7489,8 @@ GlobalObject::getFunctionNamespace(JSContext *cx, Value *vp)
         if (!JSObject::clearType(cx, obj))
             return false;
 
-        v.set(this, FUNCTION_NS, ObjectValue(*obj));
+        v = ObjectValue(*obj);
+        setSlot(FUNCTION_NS, v);
     }
 
     *vp = v;