--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@@ -617,16 +617,19 @@ JS_STATIC_ASSERT(sizeof(JSTempValueUnion
     JS_PUSH_TEMP_ROOT_COMMON(cx, obj, tvr, JSTVU_SINGLE, object)
 
 #define JS_PUSH_TEMP_ROOT_STRING(cx,str,tvr)                                  \
     JS_PUSH_TEMP_ROOT_COMMON(cx, str, tvr, JSTVU_SINGLE, string)
 
 #define JS_PUSH_TEMP_ROOT_QNAME(cx,qn,tvr)                                    \
     JS_PUSH_TEMP_ROOT_COMMON(cx, qn, tvr, JSTVU_SINGLE, qname)
 
+#define JS_PUSH_TEMP_ROOT_NAMESPACE(cx,ns,tvr)                                \
+    JS_PUSH_TEMP_ROOT_COMMON(cx, ns, tvr, JSTVU_SINGLE, nspace)
+
 #define JS_PUSH_TEMP_ROOT_XML(cx,xml_,tvr)                                    \
     JS_PUSH_TEMP_ROOT_COMMON(cx, xml_, tvr, JSTVU_SINGLE, xml)
 
 #define JS_PUSH_TEMP_ROOT_TRACE(cx,trace_,tvr)                                \
     JS_PUSH_TEMP_ROOT_COMMON(cx, trace_, tvr, JSTVU_TRACE, trace)
 
 #define JS_PUSH_TEMP_ROOT_SPROP(cx,sprop_,tvr)                                \
     JS_PUSH_TEMP_ROOT_COMMON(cx, sprop_, tvr, JSTVU_SPROP, sprop)

--- a/js/src/jsfun.c
+++ b/js/src/jsfun.c
@@ -1971,27 +1971,22 @@ Function(JSContext *cx, JSObject *obj, u
                                   JSSTRING_CHARS(str), JSSTRING_LENGTH(str),
                                   filename, lineno);
 }
 
 JSObject *
 js_InitFunctionClass(JSContext *cx, JSObject *obj)
 {
     JSObject *proto;
-    JSAtom *atom;
     JSFunction *fun;
 
     proto = JS_InitClass(cx, obj, NULL, &js_FunctionClass, Function, 1,
                          function_props, function_methods, NULL, NULL);
     if (!proto)
         return NULL;
-    atom = js_Atomize(cx, js_FunctionClass.name, strlen(js_FunctionClass.name),
-                      0);
-    if (!atom)
-        goto bad;
     fun = js_NewFunction(cx, proto, NULL, 0, JSFUN_INTERPRETED, obj, NULL);
     if (!fun)
         goto bad;
     fun->u.i.script = js_NewScript(cx, 1, 0, 0, 0, 0, 0);
     if (!fun->u.i.script)
         goto bad;
     fun->u.i.script->code[0] = JSOP_STOP;
 #ifdef CHECK_SCRIPT_OWNER

--- a/js/src/jsprvtd.h
+++ b/js/src/jsprvtd.h
@@ -234,16 +234,17 @@ typedef void
 (* JS_DLL_CALLBACK JSTempValueTrace)(JSTracer *trc, JSTempValueRooter *tvr);
 
 typedef union JSTempValueUnion {
     jsval               value;
     JSObject            *object;
     JSString            *string;
     JSXML               *xml;
     JSXMLQName          *qname;
+    JSXMLNamespace      *nspace;
     JSTempValueTrace    trace;
     JSScopeProperty     *sprop;
     JSWeakRoots         *weakRoots;
     JSParseContext      *parseContext;
     JSScript            *script;
     jsval               *array;
 } JSTempValueUnion;
 

--- a/js/src/jsxml.c
+++ b/js/src/jsxml.c
@@ -309,21 +309,27 @@ js_FinalizeXMLNamespace(JSContext *cx, J
     UNMETER(xml_stats.livenamespace);
 }
 
 JSObject *
 js_NewXMLNamespaceObject(JSContext *cx, JSString *prefix, JSString *uri,
                          JSBool declared)
 {
     JSXMLNamespace *ns;
+    JSTempValueRooter tvr;
+    JSObject *obj;
 
     ns = js_NewXMLNamespace(cx, prefix, uri, declared);
     if (!ns)
         return NULL;
-    return js_GetXMLNamespaceObject(cx, ns);
+
+    JS_PUSH_TEMP_ROOT_NAMESPACE(cx, ns, &tvr);
+    obj = js_GetXMLNamespaceObject(cx, ns);
+    JS_POP_TEMP_ROOT(cx, &tvr);
+    return obj;
 }
 
 JSObject *
 js_GetXMLNamespaceObject(JSContext *cx, JSXMLNamespace *ns)
 {
     JSObject *obj;
 
     obj = ns->object;
@@ -585,21 +591,26 @@ js_FinalizeXMLQName(JSContext *cx, JSXML
     UNMETER(xml_stats.liveqname);
 }
 
 JSObject *
 js_NewXMLQNameObject(JSContext *cx, JSString *uri, JSString *prefix,
                      JSString *localName)
 {
     JSXMLQName *qn;
+    JSTempValueRooter tvr;
+    JSObject *obj;
 
     qn = js_NewXMLQName(cx, uri, prefix, localName);
     if (!qn)
         return NULL;
-    return js_GetXMLQNameObject(cx, qn);
+    JS_PUSH_TEMP_ROOT_QNAME(cx, qn, &tvr);
+    obj = js_GetXMLQNameObject(cx, qn);
+    JS_POP_TEMP_ROOT(cx, &tvr);
+    return obj;
 }
 
 JSObject *
 js_GetXMLQNameObject(JSContext *cx, JSXMLQName *qn)
 {
     JSObject *obj;
 
     obj = qn->object;
@@ -7750,32 +7761,30 @@ js_GetFunctionNamespace(JSContext *cx, j
     /* Optimize by avoiding JS_LOCK_GC(rt) for the common case. */
     rt = cx->runtime;
     obj = rt->functionNamespaceObject;
     if (!obj) {
         JS_LOCK_GC(rt);
         obj = rt->functionNamespaceObject;
         if (!obj) {
             JS_UNLOCK_GC(rt);
-            atom = js_Atomize(cx, js_function_str, 8, 0);
-            JS_ASSERT(atom);
-            prefix = ATOM_TO_STRING(atom);
 
             /*
              * Note that any race to atomize anti_uri here is resolved by
              * the atom table code, such that at most one atom for anti_uri
              * is created.  We store in rt->atomState.lazy unconditionally,
              * since we are guaranteed to overwrite either null or the same
              * atom pointer.
              */
             atom = js_Atomize(cx, anti_uri, sizeof anti_uri - 1, ATOM_PINNED);
             if (!atom)
                 return JS_FALSE;
             rt->atomState.lazy.functionNamespaceURIAtom = atom;
 
+            prefix = ATOM_TO_STRING(rt->atomState.typeAtoms[JSTYPE_FUNCTION]);
             uri = ATOM_TO_STRING(atom);
             obj = js_NewXMLNamespaceObject(cx, prefix, uri, JS_FALSE);
             if (!obj)
                 return JS_FALSE;
 
             /*
              * Avoid entraining any in-scope Object.prototype.  The loss of
              * Namespace.prototype is not detectable, as there is no way to