Fix vp off-by-2 bug (566815, r=gal).

js/src/jsxml.cpp

@@ -261,7 +261,7 @@ namespace_toString(JSContext *cx, uintN argc, jsval *vp)
     JSObject *obj;
 
     obj = JS_THIS_OBJECT(cx, vp);
-    if (!JS_InstanceOf(cx, obj, &js_NamespaceClass.base, vp))
+    if (!JS_InstanceOf(cx, obj, &js_NamespaceClass.base, vp + 2))
         return JS_FALSE;
     *vp = obj->getNameURI();
     return JS_TRUE;