bug 426520 - limitting default xml namespace search to var objects as required by e4x. r=brendan

js/src/jsxml.cpp

@@ -7719,15 +7719,18 @@ js_GetDefaultXMLNamespace(JSContext *cx, jsval *vp)
     }
 
     obj = NULL;
-    for (tmp = fp->scopeChain; tmp; tmp = OBJ_GET_PARENT(cx, obj)) {
-        obj = tmp;
-        if (!OBJ_GET_PROPERTY(cx, obj, JS_DEFAULT_XML_NAMESPACE_ID, &v))
+    for (tmp = fp->scopeChain; tmp; tmp = OBJ_GET_PARENT(cx, tmp)) {
+        JSClass *clasp = OBJ_GET_CLASS(cx, tmp);
+        if (clasp == &js_BlockClass || clasp == &js_WithClass)
+            continue;
+        if (!OBJ_GET_PROPERTY(cx, tmp, JS_DEFAULT_XML_NAMESPACE_ID, &v))
             return JS_FALSE;
         if (!JSVAL_IS_PRIMITIVE(v)) {
             fp->xmlNamespace = JSVAL_TO_OBJECT(v);
             *vp = v;
             return JS_TRUE;
         }
+        obj = tmp;
     }
 
     ns = js_ConstructObject(cx, &js_NamespaceClass.base, NULL, obj, 0, NULL);