mrbkap's fix for 313799, r=me.

js/src/jsxml.c

@@ -5554,6 +5554,10 @@ xml_child(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
                 return JS_FALSE;
             if (!xml_child_helper(cx, kidobj, kid, name, &v))
                 return JS_FALSE;
+            if (JSVAL_IS_VOID(v)) {
+                /* The property didn't exist in this kid. */
+                continue;
+            }
 
             JS_ASSERT(!JSVAL_IS_PRIMITIVE(v));
             vxml = (JSXML *) JS_GetPrivate(cx, JSVAL_TO_OBJECT(v));