Bug 788293 - Remove e4x support. r=jorendorff,terrence,evilpie.
authorNicholas Nethercote <nnethercote@mozilla.com>
Thu, 24 Jan 2013 21:24:57 -0800
changeset 130435 c929583ba8ae39a6e32752039fc538f3e94fde9a
parent 130434 ffacb7f986f03e056c7128b364e7477cb01e94bc
child 130436 c6e5bf0eb51a1a3c291e96c47bae8b30d52b56ba
push idunknown
push userunknown
push dateunknown
reviewersjorendorff, terrence, evilpie
bugs788293
milestone21.0a1
Bug 788293 - Remove e4x support. r=jorendorff,terrence,evilpie. Ding dong! The witch is dead!
content/base/src/nsFrameMessageManager.cpp
content/base/src/nsScriptLoader.cpp
content/xul/document/src/nsXULContentSink.cpp
dom/base/nsGlobalWindow.cpp
dom/base/nsJSEnvironment.cpp
dom/src/json/nsJSON.cpp
dom/workers/RuntimeService.cpp
js/ipc/ObjectWrapperChild.cpp
js/ipc/ObjectWrapperParent.cpp
js/public/MemoryMetrics.h
js/src/Makefile.in
js/src/builtin/Object.cpp
js/src/builtin/TestingFunctions.cpp
js/src/configure.in
js/src/frontend/BytecodeCompiler.cpp
js/src/frontend/BytecodeEmitter.cpp
js/src/frontend/FoldConstants.cpp
js/src/frontend/ParseNode.cpp
js/src/frontend/ParseNode.h
js/src/frontend/Parser.cpp
js/src/frontend/Parser.h
js/src/frontend/SharedContext.h
js/src/frontend/TokenStream.cpp
js/src/frontend/TokenStream.h
js/src/gc/Barrier.h
js/src/gc/Heap.h
js/src/gc/Marking.cpp
js/src/gc/Marking.h
js/src/gc/RootMarking.cpp
js/src/gc/StoreBuffer.h
js/src/gc/Verifier.cpp
js/src/gdb/mozilla/jsid.py
js/src/gdb/tests/test-jsid.cpp
js/src/gdb/tests/test-jsid.py
js/src/ion/IonCaches.cpp
js/src/js-config.h.in
js/src/js.msg
js/src/jsanalyze.cpp
js/src/jsanalyze.h
js/src/jsapi.cpp
js/src/jsapi.h
js/src/jsarray.cpp
js/src/jsast.tbl
js/src/jsatom.cpp
js/src/jsclass.h
js/src/jscntxt.h
js/src/jscntxtinlines.h
js/src/jsfriendapi.cpp
js/src/jsfriendapi.h
js/src/jsgc.cpp
js/src/jsgc.h
js/src/jsgcinlines.h
js/src/jsinfer.cpp
js/src/jsinterp.cpp
js/src/jsinterpinlines.h
js/src/jsiter.cpp
js/src/jsmemorymetrics.cpp
js/src/jsobj.cpp
js/src/jsobj.h
js/src/jsobjinlines.h
js/src/json.cpp
js/src/jsopcode.cpp
js/src/jsopcode.h
js/src/jsopcode.tbl
js/src/jspropertytree.cpp
js/src/jsprototypes.h
js/src/jsprvtd.h
js/src/jspubtd.h
js/src/jsreflect.cpp
js/src/jsreflect.h
js/src/jswrapper.cpp
js/src/jsxml.cpp
js/src/jsxml.h
js/src/methodjit/InvokeHelpers.cpp
js/src/methodjit/PolyIC.cpp
js/src/methodjit/StubCalls.cpp
js/src/shell/js.cpp
js/src/vm/CommonPropertyNames.h
js/src/vm/GlobalObject.cpp
js/src/vm/GlobalObject.h
js/src/vm/ObjectImpl.h
js/src/vm/Shape-inl.h
js/src/vm/Stack.h
js/src/vm/String.h
js/src/vm/Unicode.h
js/src/vm/Xdr.h
js/xpconnect/idl/xpccomponents.idl
js/xpconnect/loader/mozJSComponentLoader.cpp
js/xpconnect/shell/xpcshell.cpp
js/xpconnect/src/XPCComponents.cpp
js/xpconnect/src/XPCConvert.cpp
js/xpconnect/src/XPCJSRuntime.cpp
js/xpconnect/src/XPCQuickStubs.cpp
js/xpconnect/src/nsXPConnect.cpp
js/xpconnect/src/xpcprivate.h
modules/libpref/src/init/all.js
--- a/content/base/src/nsFrameMessageManager.cpp
+++ b/content/base/src/nsFrameMessageManager.cpp
@@ -1124,20 +1124,17 @@ nsFrameScriptExecutor::InitTabChildGloba
 
   JSContext* cx = JS_NewContext(rt, 8192);
   NS_ENSURE_TRUE(cx, false);
 
   mCx = cx;
 
   nsContentUtils::GetSecurityManager()->GetSystemPrincipal(getter_AddRefs(mPrincipal));
 
-  bool allowXML = Preferences::GetBool("javascript.options.xml.chrome");
-  JS_SetOptions(cx, JS_GetOptions(cx) |
-                    JSOPTION_PRIVATE_IS_NSISUPPORTS |
-                    (allowXML ? JSOPTION_ALLOW_XML : 0));
+  JS_SetOptions(cx, JS_GetOptions(cx) | JSOPTION_PRIVATE_IS_NSISUPPORTS);
   JS_SetVersion(cx, JSVERSION_LATEST);
   JS_SetErrorReporter(cx, ContentScriptErrorReporter);
 
   xpc_LocalizeContext(cx);
 
   JSAutoRequest ar(cx);
   nsIXPConnect* xpc = nsContentUtils::XPConnect();
   const uint32_t flags = nsIXPConnect::INIT_JS_STANDARD_CLASSES;
--- a/content/base/src/nsScriptLoader.cpp
+++ b/content/base/src/nsScriptLoader.cpp
@@ -393,30 +393,16 @@ ParseTypeAttribute(const nsAString& aTyp
   rv = parser.GetParameter("version", versionName);
 
   if (NS_SUCCEEDED(rv)) {
     *aVersion = nsContentUtils::ParseJavascriptVersion(versionName);
   } else if (rv != NS_ERROR_INVALID_ARG) {
     return false;
   }
 
-  nsAutoString value;
-  rv = parser.GetParameter("e4x", value);
-  if (NS_SUCCEEDED(rv)) {
-    if (value.Length() == 1 && value[0] == '1') {
-      // This happens in about 2 web pages. Enable E4X no matter what JS
-      // version number was selected.  We do this by turning on the "moar
-      // XML" version bit.  This is OK even if version has
-      // JSVERSION_UNKNOWN (-1).
-      *aVersion = js::VersionSetMoarXML(*aVersion, true);
-    }
-  } else if (rv != NS_ERROR_INVALID_ARG) {
-    return false;
-  }
-
   return true;
 }
 
 bool
 nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
 {
   // We need a document to evaluate scripts.
   NS_ENSURE_TRUE(mDocument, false);
--- a/content/xul/document/src/nsXULContentSink.cpp
+++ b/content/xul/document/src/nsXULContentSink.cpp
@@ -1,9 +1,10 @@
-/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* vim: set ts=8 sts=4 et sw=4 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 /*
  * An implementation for a Gecko-style content sink that knows how
  * to build a content model (the "prototype" document) from XUL.
  *
@@ -868,54 +869,34 @@ XULContentSinkImpl::OpenScript(const PRU
           if (nsContentUtils::IsJavascriptMIMEType(mimeType)) {
               langID = nsIProgrammingLanguage::JAVASCRIPT;
               version = JSVERSION_LATEST;
           } else {
               langID = nsIProgrammingLanguage::UNKNOWN;
           }
 
           if (langID != nsIProgrammingLanguage::UNKNOWN) {
-            // Get the version string, and ensure the language supports it.
-            nsAutoString versionName;
-            rv = parser.GetParameter("version", versionName);
+              // Get the version string, and ensure the language supports it.
+              nsAutoString versionName;
+              rv = parser.GetParameter("version", versionName);
 
-            if (NS_SUCCEEDED(rv)) {
-              version = nsContentUtils::ParseJavascriptVersion(versionName);
-            } else if (rv != NS_ERROR_INVALID_ARG) {
-              return rv;
-            }
-          }
-          // Some js specifics yet to be abstracted.
-          if (langID == nsIProgrammingLanguage::JAVASCRIPT) {
-              // By default scripts in XUL documents have E4X turned on. This
-              // is still OK if version is JSVERSION_UNKNOWN (-1),
-              version = js::VersionSetMoarXML(JSVersion(version), true);
-
-              nsAutoString value;
-              rv = parser.GetParameter("e4x", value);
-              if (NS_FAILED(rv)) {
-                  if (rv != NS_ERROR_INVALID_ARG)
-                      return rv;
-              } else {
-                  if (value.Length() == 1 && value[0] == '0')
-                    version = js::VersionSetMoarXML(JSVersion(version), false);
+              if (NS_SUCCEEDED(rv)) {
+                  version = nsContentUtils::ParseJavascriptVersion(versionName);
+              } else if (rv != NS_ERROR_INVALID_ARG) {
+                  return rv;
               }
           }
       }
       else if (key.EqualsLiteral("language")) {
           // Language is deprecated, and the impl in nsScriptLoader ignores the
           // various version strings anyway.  So we make no attempt to support
           // languages other than JS for language=
           nsAutoString lang(aAttributes[1]);
           if (nsContentUtils::IsJavaScriptLanguage(lang, &version)) {
               langID = nsIProgrammingLanguage::JAVASCRIPT;
-
-              // Even when JS version < 1.6 is specified, E4X is
-              // turned on in XUL.
-              version = js::VersionSetMoarXML(JSVersion(version), true);
           }
       }
       aAttributes += 2;
   }
 
   // Not all script languages have a "sandbox" concept.  At time of
   // writing, Python is the only other language, and it does not.
   // For such languages, neither any inline script nor remote script are
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -1901,27 +1901,18 @@ WindowStateHolder::~WindowStateHolder()
 
 NS_IMPL_ISUPPORTS1(WindowStateHolder, WindowStateHolder)
 
 nsresult
 nsGlobalWindow::CreateOuterObject(nsGlobalWindow* aNewInner)
 {
   JSContext* cx = mContext->GetNativeContext();
 
-  bool isChrome = IsChromeWindow();
-  if (isChrome) {
-    // Always enable E4X for XUL and other chrome content -- there is no
-    // need to preserve the <!-- script hiding hack from JS-in-HTML daze
-    // (introduced in 1995 for graceful script degradation in Netscape 1,
-    // Mosaic, and other pre-JS browsers).
-    JS_SetOptions(cx, JS_GetOptions(cx) | JSOPTION_MOAR_XML);
-  }
-
   JSObject* outer = NewOuterWindowProxy(cx, aNewInner->FastGetGlobalJSObject(),
-                                        isChrome);
+                                        IsChromeWindow());
   if (!outer) {
     return NS_ERROR_FAILURE;
   }
 
   js::SetProxyExtra(outer, 0, js::PrivateValue(ToSupports(this)));
 
   return SetOuterObject(cx, outer);
 }
--- a/dom/base/nsJSEnvironment.cpp
+++ b/dom/base/nsJSEnvironment.cpp
@@ -998,32 +998,28 @@ nsJSContext::JSOptionChangedCallback(con
   bool useMethodJIT = Preferences::GetBool(chromeWindow || !contentWindow ?
                                                js_methodjit_chrome_str :
                                                js_methodjit_content_str);
   bool usePCCounts = Preferences::GetBool(chromeWindow || !contentWindow ?
                                             js_pccounts_chrome_str :
                                             js_pccounts_content_str);
   bool useMethodJITAlways = Preferences::GetBool(js_methodjit_always_str);
   bool useTypeInference = !chromeWindow && contentWindow && Preferences::GetBool(js_typeinfer_str);
-  bool useXML = Preferences::GetBool(chromeWindow || !contentWindow ?
-                                     "javascript.options.xml.chrome" :
-                                     "javascript.options.xml.content");
   bool useHardening = Preferences::GetBool(js_jit_hardening_str);
   bool useIon = Preferences::GetBool(js_ion_content_str);
   bool parallelIonCompilation = Preferences::GetBool(js_ion_parallel_compilation_str);
   nsCOMPtr<nsIXULRuntime> xr = do_GetService(XULRUNTIME_SERVICE_CONTRACTID);
   if (xr) {
     bool safeMode = false;
     xr->GetInSafeMode(&safeMode);
     if (safeMode) {
       useMethodJIT = false;
       usePCCounts = false;
       useTypeInference = false;
       useMethodJITAlways = true;
-      useXML = false;
       useHardening = false;
       useIon = false;
     }
   }
 
   if (useMethodJIT)
     newDefaultJSOptions |= JSOPTION_METHODJIT;
   else
@@ -1044,39 +1040,33 @@ nsJSContext::JSOptionChangedCallback(con
   else
     newDefaultJSOptions &= ~JSOPTION_TYPE_INFERENCE;
 
   if (useIon)
     newDefaultJSOptions |= JSOPTION_ION;
   else
     newDefaultJSOptions &= ~JSOPTION_ION;
 
-  if (useXML)
-    newDefaultJSOptions |= JSOPTION_ALLOW_XML;
-  else
-    newDefaultJSOptions &= ~JSOPTION_ALLOW_XML;
-
 #ifdef DEBUG
   // In debug builds, warnings are enabled in chrome context if
   // javascript.options.strict.debug is true
   bool strictDebug = Preferences::GetBool(js_strict_debug_option_str);
   if (strictDebug && (newDefaultJSOptions & JSOPTION_STRICT) == 0) {
     if (chromeWindow || !contentWindow)
       newDefaultJSOptions |= JSOPTION_STRICT;
   }
 #endif
 
   bool werror = Preferences::GetBool(js_werror_option_str);
   if (werror)
     newDefaultJSOptions |= JSOPTION_WERROR;
   else
     newDefaultJSOptions &= ~JSOPTION_WERROR;
 
-  ::JS_SetOptions(context->mContext,
-                  newDefaultJSOptions & (JSRUNOPTION_MASK | JSOPTION_ALLOW_XML));
+  ::JS_SetOptions(context->mContext, newDefaultJSOptions & JSRUNOPTION_MASK);
 
   ::JS_SetParallelCompilationEnabled(context->mContext, parallelIonCompilation);
 
   // Save the new defaults for the next page load (InitContext).
   context->mDefaultJSOptions = newDefaultJSOptions;
 
   JSRuntime *rt = JS_GetRuntime(context->mContext);
   JS_SetJitHardening(rt, useHardening);
@@ -1102,17 +1092,17 @@ nsJSContext::nsJSContext(JSRuntime *aRun
   mPrev = &sContextList;
   if (sContextList) {
     sContextList->mPrev = &mNext;
   }
   sContextList = this;
 
   ++sContextCount;
 
-  mDefaultJSOptions = JSOPTION_PRIVATE_IS_NSISUPPORTS | JSOPTION_ALLOW_XML;
+  mDefaultJSOptions = JSOPTION_PRIVATE_IS_NSISUPPORTS;
 
   mContext = ::JS_NewContext(aRuntime, gStackSize);
   if (mContext) {
     ::JS_SetContextPrivate(mContext, static_cast<nsIScriptContext *>(this));
 
     // Preserve any flags the context callback might have set.
     mDefaultJSOptions |= ::JS_GetOptions(mContext);
 
--- a/dom/src/json/nsJSON.cpp
+++ b/dom/src/json/nsJSON.cpp
@@ -234,19 +234,19 @@ nsJSON::EncodeInternal(JSContext* cx, co
       return NS_ERROR_INVALID_ARG;
   }
   // GetMethod may have thrown
   else if (JS_IsExceptionPending(cx))
     // passing NS_OK will throw the pending exception
     return NS_OK;
 
   // Backward compatibility:
-  // function/xml shall not pass, just "plain" objects and arrays
+  // function shall not pass, just "plain" objects and arrays
   JSType type = JS_TypeOfValue(cx, val);
-  if (type == JSTYPE_FUNCTION || type == JSTYPE_XML)
+  if (type == JSTYPE_FUNCTION)
     return NS_ERROR_INVALID_ARG;
 
   // We're good now; try to stringify
   if (!JS_Stringify(cx, &val, NULL, JSVAL_NULL, WriteCallback, writer))
     return NS_ERROR_FAILURE;
 
   return NS_OK;
 }
--- a/dom/workers/RuntimeService.cpp
+++ b/dom/workers/RuntimeService.cpp
@@ -146,17 +146,16 @@ MOZ_STATIC_ASSERT(NS_ARRAY_LENGTH(gStrin
                   "gStringChars should have the right length.");
 
 enum {
   PREF_strict = 0,
   PREF_werror,
   PREF_methodjit,
   PREF_methodjit_always,
   PREF_typeinference,
-  PREF_allow_xml,
   PREF_jit_hardening,
   PREF_mem_max,
   PREF_ion,
   PREF_mem_gc_allocation_threshold_mb,
 
 #ifdef JS_GC_ZEAL
   PREF_gczeal,
 #endif
@@ -167,17 +166,16 @@ enum {
 #define JS_OPTIONS_DOT_STR "javascript.options."
 
 const char* gPrefsToWatch[] = {
   JS_OPTIONS_DOT_STR "strict",
   JS_OPTIONS_DOT_STR "werror",
   JS_OPTIONS_DOT_STR "methodjit.content",
   JS_OPTIONS_DOT_STR "methodjit_always",
   JS_OPTIONS_DOT_STR "typeinference",
-  JS_OPTIONS_DOT_STR "allow_xml",
   JS_OPTIONS_DOT_STR "jit_hardening",
   JS_OPTIONS_DOT_STR "mem.max",
   JS_OPTIONS_DOT_STR "ion.content",
   "dom.workers.mem.gc_allocation_threshold_mb"
 
 #ifdef JS_GC_ZEAL
   , PREF_WORKERS_GCZEAL
 #endif
@@ -225,19 +223,16 @@ PrefCallback(const char* aPrefName, void
       newOptions |= JSOPTION_METHODJIT_ALWAYS;
     }
     if (Preferences::GetBool(gPrefsToWatch[PREF_typeinference])) {
       newOptions |= JSOPTION_TYPE_INFERENCE;
     }
     if (Preferences::GetBool(gPrefsToWatch[PREF_ion])) {
       newOptions |= JSOPTION_ION;
     }
-    if (Preferences::GetBool(gPrefsToWatch[PREF_allow_xml])) {
-      newOptions |= JSOPTION_ALLOW_XML;
-    }
 
     RuntimeService::SetDefaultJSContextOptions(newOptions);
     rts->UpdateAllWorkerJSContextOptions();
   }
 #ifdef JS_GC_ZEAL
   else if (!strcmp(aPrefName, gPrefsToWatch[PREF_gczeal])) {
     int32_t gczeal = Preferences::GetInt(gPrefsToWatch[PREF_gczeal]);
     RuntimeService::SetDefaultGCZeal(uint8_t(clamped(gczeal, 0, 3)));
--- a/js/ipc/ObjectWrapperChild.cpp
+++ b/js/ipc/ObjectWrapperChild.cpp
@@ -168,18 +168,16 @@ ObjectWrapperChild::jsval_to_JSVariant(J
             *to = JSVAL_TO_INT(from);
         else if (JSVAL_IS_DOUBLE(from))
             *to = JSVAL_TO_DOUBLE(from);
         else return false;
         return true;
     case JSTYPE_BOOLEAN:
         *to = !!JSVAL_TO_BOOLEAN(from);
         return true;
-    case JSTYPE_XML:
-        // fall through
     default:
         return false;
     }
 }
 
 /*static*/ bool
 ObjectWrapperChild::
 JSObject_from_PObjectWrapperChild(JSContext*,
--- a/js/ipc/ObjectWrapperParent.cpp
+++ b/js/ipc/ObjectWrapperParent.cpp
@@ -239,18 +239,16 @@ ObjectWrapperParent::jsval_to_JSVariant(
             *to = JSVAL_TO_INT(from);
         else if (JSVAL_IS_DOUBLE(from))
             *to = JSVAL_TO_DOUBLE(from);
         else return false;
         return true;
     case JSTYPE_BOOLEAN:
         *to = !!JSVAL_TO_BOOLEAN(from);
         return true;
-    case JSTYPE_XML:
-        return with_error(cx, false, "CPOWs currently cannot handle JSTYPE_XML");
     default:
         return with_error(cx, false, "Bad jsval type");
     }
 }
 
 /*static*/ bool
 ObjectWrapperParent::jsval_from_JSVariant(JSContext* cx, const JSVariant& from,
                                           jsval* to)
--- a/js/public/MemoryMetrics.h
+++ b/js/public/MemoryMetrics.h
@@ -155,19 +155,16 @@ struct CompartmentStats
       , gcHeapStringsShort(0)
       , gcHeapShapesTreeGlobalParented(0)
       , gcHeapShapesTreeNonGlobalParented(0)
       , gcHeapShapesDict(0)
       , gcHeapShapesBase(0)
       , gcHeapScripts(0)
       , gcHeapTypeObjects(0)
       , gcHeapIonCodes(0)
-#if JS_HAS_XML_SUPPORT
-      , gcHeapXML(0)
-#endif
       , objectsExtra()
       , stringCharsNonHuge(0)
       , shapesExtraTreeTables(0)
       , shapesExtraDictTables(0)
       , shapesExtraTreeShapeKids(0)
       , shapesCompartmentTables(0)
       , scriptData(0)
       , jaegerData(0)
@@ -194,19 +191,16 @@ struct CompartmentStats
       , gcHeapStringsShort(other.gcHeapStringsShort)
       , gcHeapShapesTreeGlobalParented(other.gcHeapShapesTreeGlobalParented)
       , gcHeapShapesTreeNonGlobalParented(other.gcHeapShapesTreeNonGlobalParented)
       , gcHeapShapesDict(other.gcHeapShapesDict)
       , gcHeapShapesBase(other.gcHeapShapesBase)
       , gcHeapScripts(other.gcHeapScripts)
       , gcHeapTypeObjects(other.gcHeapTypeObjects)
       , gcHeapIonCodes(other.gcHeapIonCodes)
-#if JS_HAS_XML_SUPPORT
-      , gcHeapXML(other.gcHeapXML)
-#endif
       , objectsExtra(other.objectsExtra)
       , stringCharsNonHuge(other.stringCharsNonHuge)
       , shapesExtraTreeTables(other.shapesExtraTreeTables)
       , shapesExtraDictTables(other.shapesExtraDictTables)
       , shapesExtraTreeShapeKids(other.shapesExtraTreeShapeKids)
       , shapesCompartmentTables(other.shapesCompartmentTables)
       , scriptData(other.scriptData)
       , jaegerData(other.jaegerData)
@@ -238,19 +232,16 @@ struct CompartmentStats
     size_t gcHeapStringsShort;
     size_t gcHeapShapesTreeGlobalParented;
     size_t gcHeapShapesTreeNonGlobalParented;
     size_t gcHeapShapesDict;
     size_t gcHeapShapesBase;
     size_t gcHeapScripts;
     size_t gcHeapTypeObjects;
     size_t gcHeapIonCodes;
-#if JS_HAS_XML_SUPPORT
-    size_t gcHeapXML;
-#endif
     ObjectsExtraSizes objectsExtra;
 
     size_t stringCharsNonHuge;
     size_t shapesExtraTreeTables;
     size_t shapesExtraDictTables;
     size_t shapesExtraTreeShapeKids;
     size_t shapesCompartmentTables;
     size_t scriptData;
@@ -281,19 +272,16 @@ struct CompartmentStats
         ADD(gcHeapStringsShort);
         ADD(gcHeapShapesTreeGlobalParented);
         ADD(gcHeapShapesTreeNonGlobalParented);
         ADD(gcHeapShapesDict);
         ADD(gcHeapShapesBase);
         ADD(gcHeapScripts);
         ADD(gcHeapTypeObjects);
         ADD(gcHeapIonCodes);
-    #if JS_HAS_XML_SUPPORT
-        ADD(gcHeapXML);
-    #endif
         objectsExtra.add(cStats.objectsExtra);
 
         ADD(stringCharsNonHuge);
         ADD(shapesExtraTreeTables);
         ADD(shapesExtraDictTables);
         ADD(shapesExtraTreeShapeKids);
         ADD(shapesCompartmentTables);
         ADD(scriptData);
--- a/js/src/Makefile.in
+++ b/js/src/Makefile.in
@@ -114,17 +114,16 @@ CPPSRCS		= \
 		jsutil.cpp \
 		jswatchpoint.cpp \
 		jsweakmap.cpp \
 		jsworkers.cpp \
 		ThreadPool.cpp \
 		Monitor.cpp \
 		ForkJoin.cpp \
 		jswrapper.cpp \
-		jsxml.cpp \
 		prmjtime.cpp \
 		sharkctl.cpp \
 		ArgumentsObject.cpp \
 		DateTime.cpp \
 		Debugger.cpp \
 		GlobalObject.cpp \
 		Object.cpp \
 		ObjectImpl.cpp \
--- a/js/src/builtin/Object.cpp
+++ b/js/src/builtin/Object.cpp
@@ -706,22 +706,16 @@ obj_create(JSContext *cx, unsigned argc,
             return false;
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_UNEXPECTED_TYPE,
                              bytes, "not an object or null");
         js_free(bytes);
         return false;
     }
 
     JSObject *proto = v.toObjectOrNull();
-#if JS_HAS_XML_SUPPORT
-    if (proto && proto->isXML()) {
-        JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_XML_PROTO_FORBIDDEN);
-        return false;
-    }
-#endif
 
     /*
      * Use the callee's global as the parent of the new object to avoid dynamic
      * scoping (i.e., using the caller's global).
      */
     RootedObject obj(cx, NewObjectWithGivenProto(cx, &ObjectClass, proto, &args.callee().global()));
     if (!obj)
         return false;
--- a/js/src/builtin/TestingFunctions.cpp
+++ b/js/src/builtin/TestingFunctions.cpp
@@ -171,24 +171,16 @@ GetBuildConfiguration(JSContext *cx, uns
 #ifdef JS_METHODJIT
     value = BooleanValue(true);
 #else
     value = BooleanValue(false);
 #endif
     if (!JS_SetProperty(cx, info, "methodjit", &value))
         return false;
 
-#ifdef JS_HAS_XML_SUPPORT
-    value = BooleanValue(true);
-#else
-    value = BooleanValue(false);
-#endif
-    if (!JS_SetProperty(cx, info, "e4x", &value))
-        return false;
-
     *vp = ObjectValue(*info);
     return true;
 }
 
 static JSBool
 GC(JSContext *cx, unsigned argc, jsval *vp)
 {
     /*
@@ -633,19 +625,16 @@ CountHeapNotify(JSTracer *trc, void **th
 
 static const struct TraceKindPair {
     const char       *name;
     int32_t           kind;
 } traceKindNames[] = {
     { "all",        -1                  },
     { "object",     JSTRACE_OBJECT      },
     { "string",     JSTRACE_STRING      },
-#if JS_HAS_XML_SUPPORT
-    { "xml",        JSTRACE_XML         },
-#endif
 };
 
 static JSBool
 CountHeap(JSContext *cx, unsigned argc, jsval *vp)
 {
     void* startThing;
     JSGCTraceKind startTraceKind;
     jsval v;
@@ -905,18 +894,18 @@ static JSFunctionSpecWithHelp TestingFun
 "getBuildConfiguration()",
 "  Return an object describing some of the configuration options SpiderMonkey\n"
 "  was built with."),
 
     JS_FN_HELP("countHeap", CountHeap, 0, 0,
 "countHeap([start[, kind]])",
 "  Count the number of live GC things in the heap or things reachable from\n"
 "  start when it is given and is not null. kind is either 'all' (default) to\n"
-"  count all things or one of 'object', 'double', 'string', 'function',\n"
-"  'qname', 'namespace', 'xml' to count only things of that kind."),
+"  count all things or one of 'object', 'double', 'string', 'function'\n"
+"  to count only things of that kind."),
 
     JS_FN_HELP("makeFinalizeObserver", MakeFinalizeObserver, 0, 0,
 "makeFinalizeObserver()",
 "  Get a special object whose finalization increases the counter returned\n"
 "  by the finalizeCount function."),
 
     JS_FN_HELP("finalizeCount", FinalizeCount, 0, 0,
 "finalizeCount()",
@@ -932,18 +921,18 @@ static JSFunctionSpecWithHelp TestingFun
 "gczeal(level, [period])",
 "  Specifies how zealous the garbage collector should be. Values for level:\n"
 "    0: Normal amount of collection\n"
 "    1: Collect when roots are added or removed\n"
 "    2: Collect when memory is allocated\n"
 "    3: Collect when the window paints (browser only)\n"
 "    4: Verify pre write barriers between instructions\n"
 "    5: Verify pre write barriers between paints\n"
-"    6: Verify stack rooting (ignoring XML and Reflect)\n"
-"    7: Verify stack rooting (all roots)\n"
+"    6: Verify stack rooting\n"
+"    7: Verify stack rooting (yes, it's the same as 6)\n"
 "    8: Incremental GC in two slices: 1) mark roots 2) finish collection\n"
 "    9: Incremental GC in two slices: 1) mark all 2) new marking and finish\n"
 "   10: Incremental GC in multiple slices\n"
 "   11: Verify post write barriers between instructions\n"
 "   12: Verify post write barriers between paints\n"
 "   13: Purge analysis state when memory is allocated\n"
 "  Period specifies that collection happens every n allocations.\n"),
 
--- a/js/src/configure.in
+++ b/js/src/configure.in
@@ -3810,25 +3810,16 @@ MOZ_ARG_WITH_STRING(jitreport-granularit
                              2 - per-line information
                              3 - per-op information],
   JITREPORT_GRANULARITY=$withval,
   JITREPORT_GRANULARITY=3)
 
 AC_DEFINE_UNQUOTED(JS_DEFAULT_JITREPORT_GRANULARITY, $JITREPORT_GRANULARITY)
 
 dnl ========================================================
-dnl = E4X support (ECMA-357)
-dnl ========================================================
-JS_HAS_XML_SUPPORT=1
-MOZ_ARG_DISABLE_BOOL(e4x,
-[  --disable-e4x           Disable JS support for XML (ECMA-357)],
-    JS_HAS_XML_SUPPORT=0 )
-AC_DEFINE_UNQUOTED(JS_HAS_XML_SUPPORT, $JS_HAS_XML_SUPPORT)
-
-dnl ========================================================
 dnl =
 dnl = Misc. Options
 dnl =
 dnl ========================================================
 MOZ_ARG_HEADER(Misc. Options)
 
 dnl ========================================================
 dnl update xterm title
--- a/js/src/frontend/BytecodeCompiler.cpp
+++ b/js/src/frontend/BytecodeCompiler.cpp
@@ -153,74 +153,50 @@ frontend::CompileScript(JSContext *cx, H
             JSFunction *fun = callerFrame.fun();
             ObjectBox *funbox = parser.newFunctionBox(fun, &pc, fun->strict());
             if (!funbox)
                 return UnrootedScript(NULL);
             bce.objectList.add(funbox);
         }
     }
 
-    ParseNode *pn;
-#if JS_HAS_XML_SUPPORT
-    pn = NULL;
-    bool onlyXML;
-    onlyXML = true;
-#endif
-
     TokenStream &tokenStream = parser.tokenStream;
     bool canHaveDirectives = true;
     for (;;) {
         TokenKind tt = tokenStream.peekToken(TSF_OPERAND);
         if (tt <= TOK_EOF) {
             if (tt == TOK_EOF)
                 break;
             JS_ASSERT(tt == TOK_ERROR);
             return UnrootedScript(NULL);
         }
 
-        pn = parser.statement();
+        ParseNode *pn = parser.statement();
         if (!pn)
             return UnrootedScript(NULL);
 
         if (canHaveDirectives) {
             if (!parser.maybeParseDirective(pn, &canHaveDirectives))
                 return UnrootedScript(NULL);
         }
 
         if (!FoldConstants(cx, &pn, &parser))
             return UnrootedScript(NULL);
         if (!NameFunctions(cx, pn))
             return UnrootedScript(NULL);
 
         if (!EmitTree(cx, &bce, pn))
             return UnrootedScript(NULL);
 
-#if JS_HAS_XML_SUPPORT
-        if (!pn->isKind(PNK_SEMI) || !pn->pn_kid || !pn->pn_kid->isXMLItem())
-            onlyXML = false;
-#endif
         parser.freeTree(pn);
     }
 
     if (!SetSourceMap(cx, tokenStream, ss, script))
         return UnrootedScript(NULL);
 
-#if JS_HAS_XML_SUPPORT
-    /*
-     * Prevent XML data theft via <script src="http://victim.com/foo.xml">.
-     * For background, see:
-     *
-     * https://bugzilla.mozilla.org/show_bug.cgi?id=336551
-     */
-    if (pn && onlyXML && !callerFrame) {
-        parser.reportError(NULL, JSMSG_XML_WHOLE_PROGRAM);
-        return UnrootedScript(NULL);
-    }
-#endif
-
     // It's an error to use |arguments| in a function that has a rest parameter.
     if (callerFrame && callerFrame.isFunctionFrame() && callerFrame.fun()->hasRest()) {
         HandlePropertyName arguments = cx->names().arguments;
         for (AtomDefnRange r = pc.lexdeps->all(); !r.empty(); r.popFront()) {
             if (r.front().key() == arguments) {
                 parser.reportError(NULL, JSMSG_ARGUMENTS_AND_REST);
                 return UnrootedScript(NULL);
             }
--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@@ -1579,22 +1579,16 @@ CheckSideEffects(JSContext *cx, Bytecode
                 if (!BindNameToSlot(cx, bce, pn2))
                     return false;
                 if (pn2->isConst()) {
                     *answer = false;
                     break;
                 }
                 /* FALL THROUGH */
               case PNK_DOT:
-#if JS_HAS_XML_SUPPORT
-              case PNK_DBLDOT:
-                JS_ASSERT_IF(pn2->getKind() == PNK_DBLDOT, !bce->sc->strict);
-                /* FALL THROUGH */
-
-#endif
               case PNK_CALL:
               case PNK_ELEM:
                 /* All these delete addressing modes have effects too. */
                 *answer = true;
                 break;
               default:
                 ok = CheckSideEffects(cx, bce, pn2, answer);
                 break;
@@ -1804,41 +1798,16 @@ EmitNameOp(JSContext *cx, BytecodeEmitte
         }
         if (Emit1(cx, bce, JSOP_NOTEARG) < 0)
             return false;
     }
 
     return true;
 }
 
-#if JS_HAS_XML_SUPPORT
-static bool
-EmitXMLName(JSContext *cx, ParseNode *pn, JSOp op, BytecodeEmitter *bce)
-{
-    JS_ASSERT(!bce->sc->strict);
-    JS_ASSERT(pn->isKind(PNK_XMLUNARY));
-    JS_ASSERT(pn->isOp(JSOP_XMLNAME));
-    JS_ASSERT(op == JSOP_XMLNAME || op == JSOP_CALLXMLNAME);
-
-    ParseNode *pn2 = pn->pn_kid;
-    bool oldEmittingForInit = bce->emittingForInit;
-    bce->emittingForInit = false;
-    if (!EmitTree(cx, bce, pn2))
-        return false;
-    bce->emittingForInit = oldEmittingForInit;
-    if (NewSrcNote2(cx, bce, SRC_PCBASE, bce->offset() - pn2->pn_offset) < 0)
-        return false;
-
-    if (Emit1(cx, bce, op) < 0)
-        return false;
-
-    return true;
-}
-#endif
-
 static inline bool
 EmitElemOpBase(JSContext *cx, BytecodeEmitter *bce, JSOp op)
 {
     if (Emit1(cx, bce, op) < 0)
         return false;
     CheckTypeSet(cx, bce, op);
 
     if (op == JSOP_CALLELEM) {
@@ -2053,17 +2022,17 @@ EmitElemOp(JSContext *cx, ParseNode *pn,
                 return false;
             left->setOp(JSOP_BINDNAME);
             left->pn_pos = pn->pn_pos;
             left->pn_atom = pn->pn_atom;
         }
         right = NullaryNode::create(PNK_STRING, bce->parser);
         if (!right)
             return false;
-        right->setOp(IsIdentifier(pn->pn_atom) ? JSOP_QNAMEPART : JSOP_STRING);
+        right->setOp(JSOP_STRING);
         right->pn_pos = pn->pn_pos;
         right->pn_atom = pn->pn_atom;
     } else {
         JS_ASSERT(pn->isArity(PN_BINARY));
         left = pn->pn_left;
         right = pn->pn_right;
     }
 
@@ -2073,19 +2042,16 @@ EmitElemOp(JSContext *cx, ParseNode *pn,
     }
 
     if (!EmitTree(cx, bce, left))
         return false;
 
     if (op == JSOP_CALLELEM && Emit1(cx, bce, JSOP_DUP) < 0)
         return false;
 
-    /* The right side of the descendant operator is implicitly quoted. */
-    JS_ASSERT(op != JSOP_DESCENDANTS || !right->isKind(PNK_STRING) ||
-              right->isOp(JSOP_QNAMEPART));
     if (!EmitTree(cx, bce, right))
         return false;
     if (NewSrcNote2(cx, bce, SRC_PCBASE, bce->offset() - top) < 0)
         return false;
     return EmitElemOpBase(cx, bce, op);
 }
 
 static bool
@@ -3470,27 +3436,16 @@ EmitAssignment(JSContext *cx, BytecodeEm
         break;
 #endif
       case PNK_CALL:
         if (!EmitTree(cx, bce, lhs))
             return false;
         JS_ASSERT(lhs->pn_xflags & PNX_SETCALL);
         offset += 2;
         break;
-#if JS_HAS_XML_SUPPORT
-      case PNK_XMLUNARY:
-        JS_ASSERT(!bce->sc->strict);
-        JS_ASSERT(lhs->isOp(JSOP_SETXMLNAME));
-        if (!EmitTree(cx, bce, lhs->pn_kid))
-            return false;
-        if (Emit1(cx, bce, JSOP_BINDXMLNAME) < 0)
-            return false;
-        offset += 2;
-        break;
-#endif
       default:
         JS_ASSERT(0);
     }
 
     if (op != JSOP_NOP) {
         JS_ASSERT(rhs);
         switch (lhs->getKind()) {
           case PNK_NAME:
@@ -3530,19 +3485,16 @@ EmitAssignment(JSContext *cx, BytecodeEm
                 return false;
             bool isLength = (lhs->pn_atom == cx->names().length);
             if (!EmitIndex32(cx, isLength ? JSOP_LENGTH : JSOP_GETPROP, atomIndex, bce))
                 return false;
             break;
           }
           case PNK_ELEM:
           case PNK_CALL:
-#if JS_HAS_XML_SUPPORT
-          case PNK_XMLUNARY:
-#endif
             if (Emit1(cx, bce, JSOP_DUP2) < 0)
                 return false;
             if (!EmitElemOpBase(cx, bce, JSOP_GETELEM))
                 return false;
             break;
           default:;
         }
     }
@@ -3617,23 +3569,16 @@ EmitAssignment(JSContext *cx, BytecodeEm
         break;
 #if JS_HAS_DESTRUCTURING
       case PNK_ARRAY:
       case PNK_OBJECT:
         if (!EmitDestructuringOps(cx, bce, SRC_DECL_NONE, lhs))
             return false;
         break;
 #endif
-#if JS_HAS_XML_SUPPORT
-      case PNK_XMLUNARY:
-        JS_ASSERT(!bce->sc->strict);
-        if (Emit1(cx, bce, JSOP_SETXMLNAME) < 0)
-            return false;
-        break;
-#endif
       default:
         JS_ASSERT(0);
     }
     return true;
 }
 
 #ifdef DEBUG
 static bool
@@ -4311,98 +4256,16 @@ EmitLet(JSContext *cx, BytecodeEmitter *
 
     ptrdiff_t o = PackLetData((bodyEnd - bodyBegin) -
                               (JSOP_ENTERLET0_LENGTH + JSOP_LEAVEBLOCK_LENGTH),
                               letNotes.isGroupAssign());
     return SetSrcNoteOffset(cx, bce, declNote, 0, o);
 }
 #endif
 
-#if JS_HAS_XML_SUPPORT
-/*
- * Using MOZ_NEVER_INLINE in here is a workaround for llvm.org/pr14047. See
- * the comment on EmitSwitch.
- */
-MOZ_NEVER_INLINE static bool
-EmitXMLTag(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
-{
-    JS_ASSERT(!bce->sc->strict);
-
-    if (Emit1(cx, bce, JSOP_STARTXML) < 0)
-        return false;
-
-    {
-        jsatomid index;
-        HandlePropertyName tagAtom = (pn->isKind(PNK_XMLETAGO))
-                                     ? cx->names().etago
-                                     : cx->names().stago;
-        if (!bce->makeAtomIndex(tagAtom, &index))
-            return false;
-        if (!EmitIndex32(cx, JSOP_STRING, index, bce))
-            return false;
-    }
-
-    JS_ASSERT(pn->pn_count != 0);
-    ParseNode *pn2 = pn->pn_head;
-    if (pn2->isKind(PNK_XMLCURLYEXPR) && Emit1(cx, bce, JSOP_STARTXMLEXPR) < 0)
-        return false;
-    if (!EmitTree(cx, bce, pn2))
-        return false;
-    if (Emit1(cx, bce, JSOP_ADD) < 0)
-        return false;
-
-    uint32_t i;
-    for (pn2 = pn2->pn_next, i = 0; pn2; pn2 = pn2->pn_next, i++) {
-        if (pn2->isKind(PNK_XMLCURLYEXPR) && Emit1(cx, bce, JSOP_STARTXMLEXPR) < 0)
-            return false;
-        if (!EmitTree(cx, bce, pn2))
-            return false;
-        if ((i & 1) && pn2->isKind(PNK_XMLCURLYEXPR)) {
-            if (Emit1(cx, bce, JSOP_TOATTRVAL) < 0)
-                return false;
-        }
-        if (Emit1(cx, bce, (i & 1) ? JSOP_ADDATTRVAL : JSOP_ADDATTRNAME) < 0)
-            return false;
-    }
-
-    {
-        jsatomid index;
-        HandlePropertyName tmp = pn->isKind(PNK_XMLPTAGC)
-                                 ? cx->names().ptagc
-                                 : cx->names().tagc;
-        if (!bce->makeAtomIndex(tmp, &index))
-            return false;
-        if (!EmitIndex32(cx, JSOP_STRING, index, bce))
-            return false;
-    }
-    if (Emit1(cx, bce, JSOP_ADD) < 0)
-        return false;
-
-    if ((pn->pn_xflags & PNX_XMLROOT) && Emit1(cx, bce, pn->getOp()) < 0)
-        return false;
-
-    return true;
-}
-
-static bool
-EmitXMLProcessingInstruction(JSContext *cx, BytecodeEmitter *bce, XMLProcessingInstruction &pi)
-{
-    JS_ASSERT(!bce->sc->strict);
-
-    jsatomid index;
-    if (!bce->makeAtomIndex(pi.data(), &index))
-        return false;
-    if (!EmitIndex32(cx, JSOP_QNAMEPART, index, bce))
-        return false;
-    if (!EmitAtomOp(cx, pi.target(), JSOP_XMLPI, bce))
-        return false;
-    return true;
-}
-#endif
-
 /*
  * Using MOZ_NEVER_INLINE in here is a workaround for llvm.org/pr14047. See
  * the comment on EmitSwitch.
  */
 MOZ_NEVER_INLINE static bool
 EmitLexicalScope(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 {
     JS_ASSERT(pn->isKind(PNK_LEXICALSCOPE));
@@ -5249,23 +5112,16 @@ EmitDelete(JSContext *cx, BytecodeEmitte
                 return false;
         }
         break;
       }
       case PNK_DOT:
         if (!EmitPropOp(cx, pn2, JSOP_DELPROP, bce, false))
             return false;
         break;
-#if JS_HAS_XML_SUPPORT
-      case PNK_DBLDOT:
-        JS_ASSERT(!bce->sc->strict);
-        if (!EmitElemOp(cx, pn2, JSOP_DELDESC, bce))
-            return false;
-        break;
-#endif
       case PNK_ELEM:
         if (!EmitElemOp(cx, pn2, JSOP_DELELEM, bce))
             return false;
         break;
       default:
       {
         /*
          * If useless, just emit JSOP_TRUE; otherwise convert delete foo()
@@ -5306,20 +5162,20 @@ EmitCallOrNew(JSContext *cx, BytecodeEmi
 {
     bool callop = pn->isKind(PNK_CALL);
 
     /*
      * Emit callable invocation or operator new (constructor call) code.
      * First, emit code for the left operand to evaluate the callable or
      * constructable object expression.
      *
-     * For operator new applied to other expressions than E4X ones, we emit
-     * JSOP_GETPROP instead of JSOP_CALLPROP, etc. This is necessary to
-     * interpose the lambda-initialized method read barrier -- see the code
-     * in jsinterp.cpp for JSOP_LAMBDA followed by JSOP_{SET,INIT}PROP.
+     * For operator new, we emit JSOP_GETPROP instead of JSOP_CALLPROP, etc.
+     * This is necessary to interpose the lambda-initialized method read
+     * barrier -- see the code in jsinterp.cpp for JSOP_LAMBDA followed by
+     * JSOP_{SET,INIT}PROP.
      *
      * Then (or in a call case that has no explicit reference-base
      * object) we emit JSOP_UNDEFINED to produce the undefined |this|
      * value required for calls (which non-strict mode functions
      * will box into the global object).
      */
     uint32_t argc = pn->pn_count - 1;
     bool emitArgs = true;
@@ -5371,24 +5227,16 @@ EmitCallOrNew(JSContext *cx, BytecodeEmi
         if (!EmitPropOp(cx, pn2, pn2->getOp(), bce, callop))
             return false;
         break;
       case PNK_ELEM:
         JS_ASSERT(pn2->isOp(JSOP_GETELEM));
         if (!EmitElemOp(cx, pn2, callop ? JSOP_CALLELEM : JSOP_GETELEM, bce))
             return false;
         break;
-#if JS_HAS_XML_SUPPORT
-      case PNK_XMLUNARY:
-        JS_ASSERT(pn2->isOp(JSOP_XMLNAME));
-        if (!EmitXMLName(cx, pn2, JSOP_CALLXMLNAME, bce))
-            return false;
-        callop = true;          /* suppress JSOP_UNDEFINED after */
-        break;
-#endif
       case PNK_FUNCTION:
         /*
          * Top level lambdas which are immediately invoked should be
          * treated as only running once. Every time they execute we will
          * create new types and scripts for their contents, to increase
          * the quality of type information within them and enable more
          * backend optimizations. Note that this does not depend on the
          * lambda being invoked at most once (it may be named or be
@@ -5557,28 +5405,16 @@ EmitIncOrDec(JSContext *cx, BytecodeEmit
          */
         JS_ASSERT(js_CodeSpec[op].format & JOF_DECOMPOSE);
         JS_ASSERT(js_CodeSpec[op].format & JOF_ELEM);
         if (Emit1(cx, bce, (JSOp)1) < 0)
             return false;
         if (Emit1(cx, bce, JSOP_POP) < 0)
             return false;
         break;
-#if JS_HAS_XML_SUPPORT
-      case PNK_XMLUNARY:
-        JS_ASSERT(!bce->sc->strict);
-        JS_ASSERT(pn2->isOp(JSOP_SETXMLNAME));
-        if (!EmitTree(cx, bce, pn2->pn_kid))
-            return false;
-        if (Emit1(cx, bce, JSOP_BINDXMLNAME) < 0)
-            return false;
-        if (!EmitElemIncDec(cx, NULL, op, bce))
-            return false;
-        break;
-#endif
       default:
         JS_ASSERT(pn2->isKind(PNK_NAME));
         pn2->setOp(op);
         if (!BindNameToSlot(cx, bce, pn2))
             return false;
         op = pn2->getOp();
         if (op == JSOP_CALLEE) {
             if (Emit1(cx, bce, op) < 0)
@@ -5941,17 +5777,16 @@ static bool
 EmitUnary(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 {
     if (!UpdateSourceCoordNotes(cx, bce, pn->pn_pos.begin))
         return false;
     /* Unary op, including unary +/-. */
     JSOp op = pn->getOp();
     ParseNode *pn2 = pn->pn_kid;
 
-    JS_ASSERT(op != JSOP_XMLNAME);
     if (op == JSOP_TYPEOF && !pn2->isKind(PNK_NAME))
         op = JSOP_TYPEOFEXPR;
 
     bool oldEmittingForInit = bce->emittingForInit;
     bce->emittingForInit = false;
     if (!EmitTree(cx, bce, pn2))
         return false;
 
@@ -6176,26 +6011,16 @@ frontend::EmitTree(JSContext *cx, Byteco
         }
         if (pn->pn_hidden && NewSrcNote(cx, bce, SRC_HIDDEN) < 0)
             return false;
         if (Emit1(cx, bce, JSOP_YIELD) < 0)
             return false;
         break;
 #endif
 
-#if JS_HAS_XML_SUPPORT
-      case PNK_XMLCURLYEXPR:
-        JS_ASSERT(pn->isArity(PN_UNARY));
-        if (!EmitTree(cx, bce, pn->pn_kid))
-            return false;
-        if (Emit1(cx, bce, pn->getOp()) < 0)
-            return false;
-        break;
-#endif
-
       case PNK_STATEMENTLIST:
         ok = EmitStatementList(cx, bce, pn, top);
         break;
 
       case PNK_SEQ:
         ok = EmitSyntheticStatements(cx, bce, pn, top);
         break;
 
@@ -6289,79 +6114,27 @@ frontend::EmitTree(JSContext *cx, Byteco
             JSOp op = pn->getOp();
             while ((pn2 = pn2->pn_next) != NULL) {
                 if (!EmitTree(cx, bce, pn2))
                     return false;
                 if (Emit1(cx, bce, op) < 0)
                     return false;
             }
         } else {
-#if JS_HAS_XML_SUPPORT
-      case PNK_DBLCOLON:
-            JS_ASSERT(pn->getOp() != JSOP_XMLNAME);
-            if (pn->isArity(PN_NAME)) {
-                if (!EmitTree(cx, bce, pn->expr()))
-                    return false;
-                if (!EmitAtomOp(cx, pn, pn->getOp(), bce))
-                    return false;
-                break;
-            }
-
-            /*
-             * Binary :: has a right operand that brackets arbitrary code,
-             * possibly including a let (a = b) ... expression.  We must clear
-             * emittingForInit to avoid mis-compiling such beasts.
-             */
-            bool oldEmittingForInit = bce->emittingForInit;
-            bce->emittingForInit = false;
-#endif
-
             /* Binary operators that evaluate both operands unconditionally. */
             if (!EmitTree(cx, bce, pn->pn_left))
                 return false;
             if (!EmitTree(cx, bce, pn->pn_right))
                 return false;
-#if JS_HAS_XML_SUPPORT
-            bce->emittingForInit = oldEmittingForInit;
-#endif
             if (Emit1(cx, bce, pn->getOp()) < 0)
                 return false;
         }
         break;
 
-#if JS_HAS_XML_SUPPORT
-      case PNK_FUNCTIONNS:
-        ok = (Emit1(cx, bce, JSOP_GETFUNNS) >= 0);
-        break;
-
-      case PNK_XMLUNARY:
-        if (pn->getOp() == JSOP_XMLNAME) {
-            if (!EmitXMLName(cx, pn, JSOP_XMLNAME, bce))
-                return false;
-        } else {
-            JSOp op = pn->getOp();
-            JS_ASSERT(op == JSOP_BINDXMLNAME || op == JSOP_SETXMLNAME);
-            bool oldEmittingForInit = bce->emittingForInit;
-            bce->emittingForInit = false;
-            if (!EmitTree(cx, bce, pn->pn_kid))
-                return false;
-            bce->emittingForInit = oldEmittingForInit;
-            if (Emit1(cx, bce, op) < 0)
-                return false;
-        }
-        break;
-#endif
-
       case PNK_THROW:
-#if JS_HAS_XML_SUPPORT
-      case PNK_AT:
-      case PNK_DEFXMLNS:
-        JS_ASSERT(pn->isArity(PN_UNARY));
-        /* FALL THROUGH */
-#endif
       case PNK_TYPEOF:
       case PNK_VOID:
       case PNK_NOT:
       case PNK_BITNOT:
       case PNK_POS:
       case PNK_NEG:
         ok = EmitUnary(cx, bce, pn);
         break;
@@ -6372,55 +6145,25 @@ frontend::EmitTree(JSContext *cx, Byteco
       case PNK_POSTDECREMENT:
         ok = EmitIncOrDec(cx, bce, pn);
         break;
 
       case PNK_DELETE:
         ok = EmitDelete(cx, bce, pn);
         break;
 
-#if JS_HAS_XML_SUPPORT
-      case PNK_FILTER:
-      {
-          JS_ASSERT(!bce->sc->strict);
-
-        if (!EmitTree(cx, bce, pn->pn_left))
-            return false;
-        ptrdiff_t jmp = EmitJump(cx, bce, JSOP_FILTER, 0);
-        if (jmp < 0)
-            return false;
-        top = EmitLoopHead(cx, bce, pn->pn_right);
-        if (top < 0)
-            return false;
-        if (!EmitTree(cx, bce, pn->pn_right))
-            return false;
-        SetJumpOffsetAt(bce, jmp);
-        if (!EmitLoopEntry(cx, bce, NULL))
-            return false;
-        if (EmitJump(cx, bce, JSOP_ENDFILTER, top - bce->offset()) < 0)
-            return false;
-        break;
-      }
-#endif
-
       case PNK_DOT:
         /*
          * Pop a stack operand, convert it to object, get a property named by
          * this bytecode's immediate-indexed atom operand, and push its value
          * (not a reference to it).
          */
         ok = EmitPropOp(cx, pn, pn->getOp(), bce, false);
         break;
 
-#if JS_HAS_XML_SUPPORT
-      case PNK_DBLDOT:
-        JS_ASSERT(!bce->sc->strict);
-        /* FALL THROUGH */
-#endif
-
       case PNK_ELEM:
         /*
          * Pop two operands, convert the left one to object and the right one
          * to property name (atom or tagged int), get the named property, and
          * push its value.  Set the "obj" register to the result of ToObject
          * on the left operand.
          */
         ok = EmitElemOp(cx, pn, pn->getOp(), bce);
@@ -6475,133 +6218,42 @@ frontend::EmitTree(JSContext *cx, Byteco
         ok = EmitObject(cx, bce, pn);
         break;
 
       case PNK_NAME:
         if (!EmitNameOp(cx, bce, pn, false))
             return false;
         break;
 
-#if JS_HAS_XML_SUPPORT
-      case PNK_XMLATTR:
-      case PNK_XMLSPACE:
-      case PNK_XMLTEXT:
-      case PNK_XMLCDATA:
-      case PNK_XMLCOMMENT:
-        JS_ASSERT(!bce->sc->strict);
-        /* FALL THROUGH */
-#endif
       case PNK_STRING:
         ok = EmitAtomOp(cx, pn, pn->getOp(), bce);
         break;
 
       case PNK_NUMBER:
         ok = EmitNumberOp(cx, pn->pn_dval, bce);
         break;
 
       case PNK_REGEXP:
         JS_ASSERT(pn->isOp(JSOP_REGEXP));
         ok = EmitRegExp(cx, bce->regexpList.add(pn->pn_objbox), bce);
         break;
 
-#if JS_HAS_XML_SUPPORT
-      case PNK_ANYNAME:
-#endif
       case PNK_TRUE:
       case PNK_FALSE:
       case PNK_THIS:
       case PNK_NULL:
         if (Emit1(cx, bce, pn->getOp()) < 0)
             return false;
         break;
 
       case PNK_DEBUGGER:
         if (Emit1(cx, bce, JSOP_DEBUGGER) < 0)
             return false;
         break;
 
-#if JS_HAS_XML_SUPPORT
-      case PNK_XMLELEM:
-      case PNK_XMLLIST:
-        JS_ASSERT(!bce->sc->strict);
-        JS_ASSERT(pn->isKind(PNK_XMLLIST) || pn->pn_count != 0);
-
-        switch (pn->pn_head ? pn->pn_head->getKind() : PNK_XMLLIST) {
-          case PNK_XMLETAGO:
-            JS_ASSERT(0);
-            /* FALL THROUGH */
-          case PNK_XMLPTAGC:
-          case PNK_XMLSTAGO:
-            break;
-          default:
-            if (Emit1(cx, bce, JSOP_STARTXML) < 0)
-                return false;
-        }
-
-        for (ParseNode *pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next) {
-            if (pn2->isKind(PNK_XMLCURLYEXPR) && Emit1(cx, bce, JSOP_STARTXMLEXPR) < 0)
-                return false;
-            if (!EmitTree(cx, bce, pn2))
-                return false;
-            if (pn2 != pn->pn_head && Emit1(cx, bce, JSOP_ADD) < 0)
-                return false;
-        }
-
-        if (pn->pn_xflags & PNX_XMLROOT) {
-            if (pn->pn_count == 0) {
-                JS_ASSERT(pn->isKind(PNK_XMLLIST));
-                jsatomid index;
-                if (!bce->makeAtomIndex(cx->names().empty, &index))
-                    return false;
-                if (!EmitIndex32(cx, JSOP_STRING, index, bce))
-                    return false;
-            }
-            if (Emit1(cx, bce, pn->getOp()) < 0)
-                return false;
-        }
-#ifdef DEBUG
-        else
-            JS_ASSERT(pn->pn_count != 0);
-#endif
-        break;
-
-      case PNK_XMLPTAGC:
-      case PNK_XMLSTAGO:
-      case PNK_XMLETAGO:
-        if (!EmitXMLTag(cx, bce, pn))
-            return false;
-        break;
-
-      case PNK_XMLNAME:
-        JS_ASSERT(!bce->sc->strict);
-
-        if (pn->isArity(PN_LIST)) {
-            JS_ASSERT(pn->pn_count != 0);
-            for (ParseNode *pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next) {
-                if (pn2->isKind(PNK_XMLCURLYEXPR) && Emit1(cx, bce, JSOP_STARTXMLEXPR) < 0)
-                    return false;
-                if (!EmitTree(cx, bce, pn2))
-                    return false;
-                if (pn2 != pn->pn_head && Emit1(cx, bce, JSOP_ADD) < 0)
-                    return false;
-            }
-        } else {
-            JS_ASSERT(pn->isArity(PN_NULLARY));
-            ok = pn->isOp(JSOP_OBJECT)
-                 ? EmitObjectOp(cx, pn->pn_objbox, pn->getOp(), bce)
-                 : EmitAtomOp(cx, pn, pn->getOp(), bce);
-        }
-        break;
-
-      case PNK_XMLPI:
-        if (!EmitXMLProcessingInstruction(cx, bce, pn->as<XMLProcessingInstruction>()))
-            return false;
-        break;
-#endif /* JS_HAS_XML_SUPPORT */
-
       case PNK_NOP:
         JS_ASSERT(pn->getArity() == PN_NULLARY);
         break;
 
       default:
         JS_ASSERT(0);
     }
 
--- a/js/src/frontend/FoldConstants.cpp
+++ b/js/src/frontend/FoldConstants.cpp
@@ -3,19 +3,16 @@
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "mozilla/FloatingPoint.h"
 
 #include "jslibmath.h"
-#if JS_HAS_XML_SUPPORT
-#include "jsxml.h"
-#endif
 
 #include "frontend/FoldConstants.h"
 #include "frontend/ParseNode.h"
 #include "frontend/Parser.h"
 #include "vm/NumericConversions.h"
 
 #include "jsatominlines.h"
 
@@ -197,181 +194,16 @@ FoldBinaryNumeric(JSContext *cx, JSOp op
 // list node.
 void
 ReplaceNode(ParseNode **pnp, ParseNode *pn)
 {
     pn->pn_next = (*pnp)->pn_next;
     *pnp = pn;
 }
 
-#if JS_HAS_XML_SUPPORT
-
-static bool
-FoldXMLConstants(JSContext *cx, ParseNode **pnp, Parser *parser)
-{
-    ParseNode *pn = *pnp;
-    JS_ASSERT(pn->isArity(PN_LIST));
-    ParseNodeKind kind = pn->getKind();
-    ParseNode **listp = &pn->pn_head;
-    ParseNode *pn1 = *listp;
-    RootedString accum(cx);
-    RootedString str(cx);
-    if ((pn->pn_xflags & PNX_CANTFOLD) == 0) {
-        if (kind == PNK_XMLETAGO)
-            accum = cx->names().etago;
-        else if (kind == PNK_XMLSTAGO || kind == PNK_XMLPTAGC)
-            accum = cx->names().stago;
-    }
-
-    /*
-     * GC Rooting here is tricky: for most of the loop, |accum| is safe via
-     * the newborn string root. However, when |pn2->getKind()| is PNK_XMLCDATA,
-     * PNK_XMLCOMMENT, or PNK_XMLPI it is knocked out of the newborn root.
-     * Therefore, we have to add additonal protection from GC nesting under
-     * ConcatString.
-     */
-    ParseNode *pn2;
-    uint32_t i, j;
-    for (pn2 = pn1, i = j = 0; pn2; pn2 = pn2->pn_next, i++) {
-        /* The parser already rejected end-tags with attributes. */
-        JS_ASSERT(kind != PNK_XMLETAGO || i == 0);
-        switch (pn2->getKind()) {
-          case PNK_XMLATTR:
-            if (!accum)
-                goto cantfold;
-            /* FALL THROUGH */
-          case PNK_XMLNAME:
-          case PNK_XMLSPACE:
-          case PNK_XMLTEXT:
-          case PNK_STRING:
-            if (pn2->isArity(PN_LIST))
-                goto cantfold;
-            str = pn2->pn_atom;
-            break;
-
-          case PNK_XMLCDATA:
-            str = js_MakeXMLCDATAString(cx, pn2->pn_atom);
-            if (!str)
-                return false;
-            break;
-
-          case PNK_XMLCOMMENT:
-            str = js_MakeXMLCommentString(cx, pn2->pn_atom);
-            if (!str)
-                return false;
-            break;
-
-          case PNK_XMLPI: {
-            XMLProcessingInstruction &pi = pn2->as<XMLProcessingInstruction>();
-            str = js_MakeXMLPIString(cx, pi.target(), pi.data());
-            if (!str)
-                return false;
-            break;
-          }
-
-          cantfold:
-          default:
-            JS_ASSERT(*listp == pn1);
-            if ((kind == PNK_XMLSTAGO || kind == PNK_XMLPTAGC) &&
-                (i & 1) ^ (j & 1)) {
-#ifdef DEBUG_brendanXXX
-                printf("1: %d, %d => ", i, j);
-                if (accum)
-                    FileEscapedString(stdout, accum, 0);
-                else
-                    fputs("NULL", stdout);
-                fputc('\n', stdout);
-#endif
-            } else if (accum && pn1 != pn2) {
-                while (pn1->pn_next != pn2) {
-                    pn1 = parser->freeTree(pn1);
-                    --pn->pn_count;
-                }
-                pn1->setKind(PNK_XMLTEXT);
-                pn1->setOp(JSOP_STRING);
-                pn1->setArity(PN_NULLARY);
-                pn1->pn_atom = AtomizeString<CanGC>(cx, accum);
-                if (!pn1->pn_atom)
-                    return false;
-                JS_ASSERT(listp != &pn1->pn_next);
-                *listp = pn1;
-            }
-            listp = &pn2->pn_next;
-            pn1 = *listp;
-            accum = NULL;
-            continue;
-        }
-
-        if (accum) {
-            {
-                str = ((kind == PNK_XMLSTAGO || kind == PNK_XMLPTAGC) && i != 0)
-                      ? js_AddAttributePart(cx, i & 1, accum, str)
-                      : ConcatStrings<CanGC>(cx, accum, str);
-            }
-            if (!str)
-                return false;
-#ifdef DEBUG_brendanXXX
-            printf("2: %d, %d => ", i, j);
-            FileEscapedString(stdout, str, 0);
-            printf(" (%u)\n", str->length());
-#endif
-            ++j;
-        }
-        accum = str;
-    }
-
-    if (accum) {
-        str = NULL;
-        if ((pn->pn_xflags & PNX_CANTFOLD) == 0) {
-            if (kind == PNK_XMLPTAGC)
-                str = cx->names().ptagc;
-            else if (kind == PNK_XMLSTAGO || kind == PNK_XMLETAGO)
-                str = cx->names().tagc;
-        }
-        if (str) {
-            accum = ConcatStrings<CanGC>(cx, accum, str);
-            if (!accum)
-                return false;
-        }
-
-        JS_ASSERT(*listp == pn1);
-        while (pn1->pn_next) {
-            pn1 = parser->freeTree(pn1);
-            --pn->pn_count;
-        }
-        pn1->setKind(PNK_XMLTEXT);
-        pn1->setOp(JSOP_STRING);
-        pn1->setArity(PN_NULLARY);
-        pn1->pn_atom = AtomizeString<CanGC>(cx, accum);
-        if (!pn1->pn_atom)
-            return false;
-        JS_ASSERT(listp != &pn1->pn_next);
-        *listp = pn1;
-    }
-
-    if (pn1 && pn->pn_count == 1) {
-        /*
-         * Only one node under pn, and it has been folded: move pn1 onto pn
-         * unless pn is an XML root (in which case we need it to tell the code
-         * generator to emit a JSOP_TOXML or JSOP_TOXMLLIST op).  If pn is an
-         * XML root *and* it's a point-tag, rewrite it to PNK_XMLELEM to avoid
-         * extra "<" and "/>" bracketing at runtime.
-         */
-        if (!(pn->pn_xflags & PNX_XMLROOT)) {
-            ReplaceNode(pnp, pn1);
-        } else if (kind == PNK_XMLPTAGC) {
-            pn->setKind(PNK_XMLELEM);
-            pn->setOp(JSOP_TOXML);
-        }
-    }
-    return true;
-}
-
-#endif /* JS_HAS_XML_SUPPORT */
-
 enum Truthiness { Truthy, Falsy, Unknown };
 
 static Truthiness
 Boolish(ParseNode *pn)
 {
     switch (pn->getOp()) {
       case JSOP_DOUBLE:
         return (pn->pn_dval != 0 && !MOZ_DOUBLE_IS_NaN(pn->pn_dval)) ? Truthy : Falsy;
@@ -859,51 +691,16 @@ frontend::FoldConstants(JSContext *cx, P
                 } else {
                     pn->setKind(PNK_TRUE);
                     pn->setOp(JSOP_TRUE);
                 }
             }
         }
         break;
 
-#if JS_HAS_XML_SUPPORT
-      case PNK_XMLELEM:
-      case PNK_XMLLIST:
-      case PNK_XMLPTAGC:
-      case PNK_XMLSTAGO:
-      case PNK_XMLETAGO:
-      case PNK_XMLNAME:
-        if (pn->isArity(PN_LIST)) {
-            JS_ASSERT(pn->isKind(PNK_XMLLIST) || pn->pn_count != 0);
-            if (!FoldXMLConstants(cx, pnp, parser))
-                return false;
-            pn = *pnp;
-        }
-        break;
-
-      case PNK_AT:
-        if (pn1->isKind(PNK_XMLNAME)) {
-            Value v = StringValue(pn1->pn_atom);
-            if (!js_ToAttributeName(cx, &v))
-                return false;
-            JS_ASSERT(v.isObject());
-
-            ObjectBox *xmlbox = parser->newObjectBox(&v.toObject());
-            if (!xmlbox)
-                return false;
-
-            pn->setKind(PNK_XMLNAME);
-            pn->setOp(JSOP_OBJECT);
-            pn->setArity(PN_NULLARY);
-            pn->pn_objbox = xmlbox;
-            parser->freeTree(pn1);
-        }
-        break;
-#endif /* JS_HAS_XML_SUPPORT */
-
       default:;
     }
 
     if (inCond) {
         Truthiness t = Boolish(pn);
         if (t != Unknown) {
             /*
              * We can turn function nodes into constant nodes here, but mutating function
--- a/js/src/frontend/ParseNode.cpp
+++ b/js/src/frontend/ParseNode.cpp
@@ -1,14 +1,15 @@
 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
  * vim: set ts=8 sw=4 et tw=99:
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
 #include "builtin/Module.h"
 #include "frontend/ParseNode.h"
 #include "frontend/Parser.h"
 
 #include "jsscriptinlines.h"
 
 #include "frontend/ParseMaps-inl.h"
 #include "frontend/ParseNode-inl.h"
@@ -171,20 +172,16 @@ PushNodeChildren(ParseNode *pn, NodeStac
         if (pn->pn_left != pn->pn_right)
             stack->pushUnlessNull(pn->pn_left);
         stack->pushUnlessNull(pn->pn_right);
         break;
       case PN_UNARY:
         stack->pushUnlessNull(pn->pn_kid);
         break;
       case PN_NULLARY:
-        /*
-         * E4X function namespace nodes are PN_NULLARY, but can appear on use
-         * lists.
-         */
         return !pn->isUsed() && !pn->isDefn();
       default:
         ;
     }
 
     return true;
 }
 
@@ -449,17 +446,16 @@ CloneParseTree(ParseNode *opn, Parser *p
             if (opn->isDefn()) {
                 opn->setDefn(false);
                 LinkUseToDef(opn, (Definition *) pn);
             }
         }
         break;
 
       case PN_NULLARY:
-        // Even PN_NULLARY may have data (xmlpi for E4X -- what a botch).
         pn->pn_u = opn->pn_u;
         break;
 
 #undef NULLCHECK
     }
     return pn;
 }
 
--- a/js/src/frontend/ParseNode.h
+++ b/js/src/frontend/ParseNode.h
@@ -80,17 +80,16 @@ class UpvarCookie
     F(PREINCREMENT) \
     F(POSTINCREMENT) \
     F(PREDECREMENT) \
     F(POSTDECREMENT) \
     F(DOT) \
     F(ELEM) \
     F(ARRAY) \
     F(STATEMENTLIST) \
-    F(XMLCURLYEXPR) \
     F(OBJECT) \
     F(CALL) \
     F(NAME) \
     F(NUMBER) \
     F(STRING) \
     F(REGEXP) \
     F(TRUE) \
     F(FALSE) \
@@ -116,37 +115,16 @@ class UpvarCookie
     F(DELETE) \
     F(TRY) \
     F(CATCH) \
     F(CATCHLIST) \
     F(FINALLY) \
     F(THROW) \
     F(INSTANCEOF) \
     F(DEBUGGER) \
-    F(DEFXMLNS) \
-    F(XMLSTAGO) \
-    F(XMLETAGO) \
-    F(XMLPTAGC) \
-    F(XMLTAGC) \
-    F(XMLNAME) \
-    F(XMLATTR) \
-    F(XMLSPACE) \
-    F(XMLTEXT) \
-    F(XMLCOMMENT) \
-    F(XMLCDATA) \
-    F(XMLPI) \
-    F(XMLUNARY) \
-    F(AT) \
-    F(FUNCTIONNS) \
-    F(DBLCOLON) \
-    F(ANYNAME) \
-    F(DBLDOT) \
-    F(FILTER) \
-    F(XMLELEM) \
-    F(XMLLIST) \
     F(YIELD) \
     F(GENEXP) \
     F(ARRAYCOMP) \
     F(ARRAYPUSH) \
     F(LEXICALSCOPE) \
     F(LET) \
     F(SEQ) \
     F(FORIN) \
@@ -361,18 +339,18 @@ enum ParseNodeKind {
  * PNK_PREINCREMENT, unary  pn_kid: MEMBER expr
  * PNK_POSTINCREMENT,
  * PNK_PREDECREMENT,
  * PNK_POSTDECREMENT
  * PNK_NEW      list        pn_head: list of ctor, arg1, arg2, ... argN
  *                          pn_count: 1 + N (where N is number of args)
  *                          ctor is a MEMBER expr
  * PNK_DELETE   unary       pn_kid: MEMBER expr
- * PNK_DOT,     name        pn_expr: MEMBER expr to left of .
- * PNK_DBLDOT               pn_atom: name to right of .
+ * PNK_DOT      name        pn_expr: MEMBER expr to left of .
+ *                          pn_atom: name to right of .
  * PNK_ELEM     binary      pn_left: MEMBER expr to left of [
  *                          pn_right: expr between [ and ]
  * PNK_CALL     list        pn_head: list of call, arg1, arg2, ... argN
  *                          pn_count: 1 + N (where N is number of args)
  *                          call is a MEMBER expr naming a callable object
  * PNK_GENEXP   list        Exactly like PNK_CALL, used for the implicit call
  *                          in the desugaring of a generator-expression.
  * PNK_ARRAY    list        pn_head: list of pn_count array element exprs
@@ -395,110 +373,42 @@ enum ParseNodeKind {
  * PNK_NAME     name        If pn_used, PNK_NAME uses the lexdef member instead
  *                          of the expr member it overlays
  * PNK_NUMBER   dval        pn_dval: double value of numeric literal
  * PNK_TRUE,    nullary     pn_op: JSOp bytecode
  * PNK_FALSE,
  * PNK_NULL,
  * PNK_THIS
  *
- * <E4X node descriptions>
- * PNK_XMLUNARY unary       pn_kid: PNK_AT, PNK_ANYNAME, or PNK_DBLCOLON node
- *                          pn_op: JSOP_XMLNAME, JSOP_BINDXMLNAME, or
- *                                 JSOP_SETXMLNAME
- * PNK_DEFXMLNS name        pn_kid: namespace expr
- * PNK_FILTER   binary      pn_left: container expr, pn_right: filter expr
- * PNK_DBLDOT   binary      pn_left: container expr, pn_right: selector expr
- * PNK_ANYNAME  nullary     pn_op: JSOP_ANYNAME
- *                          pn_atom: cx->runtime->atomState.starAtom
- * PNK_AT       unary       pn_op: JSOP_TOATTRNAME; pn_kid attribute id/expr
- * PNK_FUNCTIONNS nullary   special E4X "function::" namespace
- * PNK_DBLCOLON binary      pn_op: JSOP_QNAME
- *                          pn_left: PNK_ANYNAME or PNK_NAME node
- *                          pn_right: PNK_STRING "*" node, or expr within []
- *              name        pn_op: JSOP_QNAMECONST
- *                          pn_expr: PNK_ANYNAME or PNK_NAME left operand
- *                          pn_atom: name on right of ::
- * PNK_XMLELEM  list        XML element node
- *                          pn_head: start tag, content1, ... contentN, end tag
- *                          pn_count: 2 + N where N is number of content nodes
- *                                    N may be > x.length() if {expr} embedded
- *                            After constant folding, these contents may be
- *                            concatenated into string nodes.
- * PNK_XMLLIST  list        XML list node
- *                          pn_head: content1, ... contentN
- * PNK_XMLSTAGO, list       XML start, end, and point tag contents
- * PNK_XMLETAGO,            pn_head: tag name or {expr}, ... XML attrs ...
- * PNK_XMLPTAGC
- * PNK_XMLNAME  nullary     pn_atom: XML name, with no {expr} embedded
- * PNK_XMLNAME  list        pn_head: tag name or {expr}, ... name or {expr}
- * PNK_XMLATTR, nullary     pn_atom: attribute value string; pn_op: JSOP_STRING
- * PNK_XMLCDATA,
- * PNK_XMLCOMMENT
- * PNK_XMLPI    nullary     pn_pitarget: XML processing instruction target
- *                          pn_pidata: XML PI data, or null if no data
- * PNK_XMLTEXT  nullary     pn_atom: marked-up text, or null if empty string
- * PNK_XMLCURLYEXPR unary   {expr} in XML tag or content; pn_kid is expr
- *
- * So an XML tag with no {expr} and three attributes is a list with the form:
- *
- *    (tagname attrname1 attrvalue1 attrname2 attrvalue2 attrname2 attrvalue3)
- *
- * An XML tag with embedded expressions like so:
- *
- *    <name1{expr1} name2{expr2}name3={expr3}>
- *
- * would have the form:
- *
- *    ((name1 {expr1}) (name2 {expr2} name3) {expr3})
- *
- * where () bracket a list with elements separated by spaces, and {expr} is a
- * PNK_XMLCURLYEXPR unary node with expr as its kid.
- *
- * Thus, the attribute name/value pairs occupy successive odd and even list
- * locations, where pn_head is the PNK_XMLNAME node at list location 0.  The
- * parser builds the same sort of structures for elements:
- *
- *    <a x={x}>Hi there!<b y={y}>How are you?</b><answer>{x + y}</answer></a>
- *
- * translates to:
- *
- *    ((a x {x}) 'Hi there!' ((b y {y}) 'How are you?') ((answer) {x + y}))
- *
- * <Non-E4X node descriptions, continued>
- *
- * Label              Variant   Members
- * -----              -------   -------
- * PNK_LEXICALSCOPE   name      pn_op: JSOP_LEAVEBLOCK or JSOP_LEAVEBLOCKEXPR
- *                              pn_objbox: block object in ObjectBox holder
- *                              pn_expr: block body
- * PNK_ARRAYCOMP      list      pn_count: 1
- *                              pn_head: list of 1 element, which is block
- *                                enclosing for loop(s) and optionally
- *                                if-guarded PNK_ARRAYPUSH
- * PNK_ARRAYPUSH      unary     pn_op: JSOP_ARRAYCOMP
- *                              pn_kid: array comprehension expression
- * PNK_NOP            nullary
+ * PNK_LEXICALSCOPE name    pn_op: JSOP_LEAVEBLOCK or JSOP_LEAVEBLOCKEXPR
+ *                          pn_objbox: block object in ObjectBox holder
+ *                          pn_expr: block body
+ * PNK_ARRAYCOMP    list    pn_count: 1
+ *                          pn_head: list of 1 element, which is block
+ *                          enclosing for loop(s) and optionally
+ *                          if-guarded PNK_ARRAYPUSH
+ * PNK_ARRAYPUSH    unary   pn_op: JSOP_ARRAYCOMP
+ *                          pn_kid: array comprehension expression
+ * PNK_NOP          nullary
  */
 enum ParseNodeArity {
     PN_NULLARY,                         /* 0 kids, only pn_atom/pn_dval/etc. */
     PN_UNARY,                           /* one kid, plus a couple of scalars */
     PN_BINARY,                          /* two kids, plus a couple of scalars */
     PN_TERNARY,                         /* three kids */
     PN_FUNC,                            /* function definition node */
     PN_LIST,                            /* generic singly linked list */
     PN_NAME                             /* name use or definition node */
 };
 
 struct Definition;
 
 class LoopControlStatement;
 class BreakStatement;
 class ContinueStatement;
-class XMLProcessingInstruction;
 class ConditionalExpression;
 class PropertyAccess;
 
 struct ParseNode {
   private:
     uint32_t            pn_type   : 16, /* PNK_* type */
                         pn_op     : 8,  /* see JSOp enum and jsopcode.tbl */
                         pn_arity  : 5,  /* see ParseNodeArity enum */
@@ -543,36 +453,21 @@ struct ParseNode {
         pn_type = kind;
     }
     bool isKind(ParseNodeKind kind) const  { return getKind() == kind; }
 
     ParseNodeArity getArity() const        { return ParseNodeArity(pn_arity); }
     bool isArity(ParseNodeArity a) const   { return getArity() == a; }
     void setArity(ParseNodeArity a)        { pn_arity = a; }
 
-    bool isXMLNameOp() const {
-        ParseNodeKind kind = getKind();
-        return kind == PNK_ANYNAME || kind == PNK_AT || kind == PNK_DBLCOLON;
-    }
     bool isAssignment() const {
         ParseNodeKind kind = getKind();
         return PNK_ASSIGNMENT_START <= kind && kind <= PNK_ASSIGNMENT_LAST;
     }
 
-    bool isXMLPropertyIdentifier() const {
-        ParseNodeKind kind = getKind();
-        return kind == PNK_ANYNAME || kind == PNK_AT || kind == PNK_DBLCOLON;
-    }
-
-    bool isXMLItem() const {
-        ParseNodeKind kind = getKind();
-        return kind == PNK_XMLCOMMENT || kind == PNK_XMLCDATA || kind == PNK_XMLPI ||
-               kind == PNK_XMLELEM || kind == PNK_XMLLIST;
-    }
-
     /* Boolean attributes. */
     bool isInParens() const                { return pn_parens; }
     void setInParens(bool enabled)         { pn_parens = enabled; }
     bool isUsed() const                    { return pn_used; }
     void setUsed(bool enabled)             { pn_used = enabled; }
     bool isDefn() const                    { return pn_defn; }
     void setDefn(bool enabled)             { pn_defn = enabled; }
 
@@ -626,21 +521,16 @@ struct ParseNode {
         struct {
             double      value;          /* aligned numeric literal value */
             DecimalPoint decimalPoint;  /* Whether the number has a decimal point */
         } number;
         class {
             friend class LoopControlStatement;
             PropertyName     *label;    /* target of break/continue statement */
         } loopControl;
-        class {                         /* E4X <?target data?> XML PI */
-            friend class XMLProcessingInstruction;
-            PropertyName     *target;   /* non-empty */
-            JSAtom           *data;     /* may be empty, never null */
-        } xmlpi;
     } pn_u;
 
 #define pn_funbox       pn_u.name.funbox
 #define pn_body         pn_u.name.expr
 #define pn_cookie       pn_u.name.cookie
 #define pn_dflags       pn_u.name.dflags
 #define pn_blockid      pn_u.name.blockid
 #define pn_index        pn_u.name.blockid /* reuse as object table index */
@@ -742,29 +632,28 @@ struct ParseNode {
 /* PN_LIST pn_xflags bits. */
 #define PNX_STRCAT      0x01            /* PNK_ADD list has string term */
 #define PNX_CANTFOLD    0x02            /* PNK_ADD list has unfoldable term */
 #define PNX_POPVAR      0x04            /* PNK_VAR or PNK_CONST last result
                                            needs popping */
 #define PNX_FORINVAR    0x08            /* PNK_VAR is left kid of PNK_FORIN node
                                            which is left kid of PNK_FOR */
 #define PNX_ENDCOMMA    0x10            /* array literal has comma at end */
-#define PNX_XMLROOT     0x20            /* top-most node in XML literal tree */
-#define PNX_GROUPINIT   0x40            /* var [a, b] = [c, d]; unit list */
-#define PNX_NEEDBRACES  0x80            /* braces necessary due to closure */
-#define PNX_FUNCDEFS   0x100            /* contains top-level function statements */
-#define PNX_SETCALL    0x100            /* call expression in lvalue context */
-#define PNX_DESTRUCT   0x200            /* destructuring special cases:
+#define PNX_GROUPINIT   0x20            /* var [a, b] = [c, d]; unit list */
+#define PNX_NEEDBRACES  0x40            /* braces necessary due to closure */
+#define PNX_FUNCDEFS    0x80            /* contains top-level function statements */
+#define PNX_SETCALL     0x80            /* call expression in lvalue context */
+#define PNX_DESTRUCT   0x100            /* destructuring special cases:
                                            1. shorthand syntax used, at present
                                               object destructuring ({x,y}) only;
                                            2. code evaluating destructuring
                                               arguments occurs before function
                                               body */
-#define PNX_HOLEY      0x400            /* array initialiser has holes */
-#define PNX_NONCONST   0x800            /* initialiser has non-constants */
+#define PNX_HOLEY      0x200            /* array initialiser has holes */
+#define PNX_NONCONST   0x400            /* initialiser has non-constants */
 
     unsigned frameLevel() const {
         JS_ASSERT(pn_arity == PN_FUNC || pn_arity == PN_NAME);
         return pn_cookie.level();
     }
 
     unsigned frameSlot() const {
         JS_ASSERT(pn_arity == PN_FUNC || pn_arity == PN_NAME);
@@ -1133,43 +1022,16 @@ class ContinueStatement : public LoopCon
 
 class DebuggerStatement : public ParseNode {
   public:
     DebuggerStatement(const TokenPos &pos)
       : ParseNode(PNK_DEBUGGER, JSOP_NOP, PN_NULLARY, pos)
     { }
 };
 
-#if JS_HAS_XML_SUPPORT
-class XMLProcessingInstruction : public ParseNode {
-  public:
-    XMLProcessingInstruction(PropertyName *target, JSAtom *data, const TokenPos &pos)
-      : ParseNode(PNK_XMLPI, JSOP_NOP, PN_NULLARY, pos)
-    {
-        pn_u.xmlpi.target = target;
-        pn_u.xmlpi.data = data;
-    }
-
-    static bool test(const ParseNode &node) {
-        bool match = node.isKind(PNK_XMLPI);
-        JS_ASSERT_IF(match, node.isArity(PN_NULLARY));
-        JS_ASSERT_IF(match, node.isOp(JSOP_NOP));
-        return match;
-    }
-
-    PropertyName *target() const {
-        return pn_u.xmlpi.target;
-    }
-
-    JSAtom *data() const {
-        return pn_u.xmlpi.data;
-    }
-};
-#endif
-
 class ConditionalExpression : public ParseNode {
   public:
     ConditionalExpression(ParseNode *condition, ParseNode *thenExpr, ParseNode *elseExpr)
       : ParseNode(PNK_CONDITIONAL, JSOP_NOP, PN_TERNARY,
                   TokenPos::make(condition->pn_pos.begin, elseExpr->pn_pos.end))
     {
         JS_ASSERT(condition);
         JS_ASSERT(thenExpr);
@@ -1211,74 +1073,16 @@ class NullLiteral : public ParseNode {
 
 class BooleanLiteral : public ParseNode {
   public:
     BooleanLiteral(bool b, const TokenPos &pos)
       : ParseNode(b ? PNK_TRUE : PNK_FALSE, b ? JSOP_TRUE : JSOP_FALSE, PN_NULLARY, pos)
     { }
 };
 
-class XMLDoubleColonProperty : public ParseNode {
-  public:
-    XMLDoubleColonProperty(ParseNode *lhs, ParseNode *rhs,
-                           const TokenPtr &begin, const TokenPtr &end)
-      : ParseNode(PNK_ELEM, JSOP_GETELEM, PN_BINARY, TokenPos::make(begin, end))
-    {
-        JS_ASSERT(rhs->isKind(PNK_DBLCOLON));
-        pn_u.binary.left = lhs;
-        pn_u.binary.right = rhs;
-    }
-
-    ParseNode &left() const {
-        return *pn_u.binary.left;
-    }
-
-    ParseNode &right() const {
-        return *pn_u.binary.right;
-    }
-};
-
-class XMLFilterExpression : public ParseNode {
-  public:
-    XMLFilterExpression(ParseNode *lhs, ParseNode *filterExpr,
-                        const TokenPtr &begin, const TokenPtr &end)
-      : ParseNode(PNK_FILTER, JSOP_FILTER, PN_BINARY, TokenPos::make(begin, end))
-    {
-        pn_u.binary.left = lhs;
-        pn_u.binary.right = filterExpr;
-    }
-
-    ParseNode &left() const {
-        return *pn_u.binary.left;
-    }
-
-    ParseNode &filter() const {
-        return *pn_u.binary.right;
-    }
-};
-
-class XMLProperty : public ParseNode {
-  public:
-    XMLProperty(ParseNode *lhs, ParseNode *propertyId,
-                const TokenPtr &begin, const TokenPtr &end)
-      : ParseNode(PNK_ELEM, JSOP_GETELEM, PN_BINARY, TokenPos::make(begin, end))
-    {
-        pn_u.binary.left = lhs;
-        pn_u.binary.right = propertyId;
-    }
-
-    ParseNode &left() const {
-        return *pn_u.binary.left;
-    }
-
-    ParseNode &right() const {
-        return *pn_u.binary.right;
-    }
-};
-
 class PropertyAccess : public ParseNode {
   public:
     PropertyAccess(ParseNode *lhs, PropertyName *name,
                    const TokenPtr &begin, const TokenPtr &end)
       : ParseNode(PNK_DOT, JSOP_GETPROP, PN_NAME, TokenPos::make(begin, end))
     {
         JS_ASSERT(lhs != NULL);
         JS_ASSERT(name != NULL);
--- a/js/src/frontend/Parser.cpp
+++ b/js/src/frontend/Parser.cpp
@@ -42,20 +42,16 @@
 
 #include "frontend/FoldConstants.h"
 #include "frontend/ParseMaps.h"
 #include "frontend/Parser.h"
 #include "frontend/TokenStream.h"
 #include "gc/Marking.h"
 #include "vm/Shape.h"
 
-#if JS_HAS_XML_SUPPORT
-#include "jsxml.h"
-#endif
-
 #include "jsatominlines.h"
 #include "jsscriptinlines.h"
 
 #include "frontend/ParseMaps-inl.h"
 #include "frontend/ParseNode-inl.h"
 #include "frontend/Parser-inl.h"
 #include "frontend/SharedContext-inl.h"
 
@@ -1668,20 +1664,18 @@ Parser::functionArgsAndBody(ParseNode *p
     /* Initialize early for possible flags mutation via destructuringExpr. */
     ParseContext funpc(this, funbox, outerpc->staticLevel + 1, outerpc->blockidGen);
     if (!funpc.init())
         return false;
 
     /* Now parse formal argument list and compute fun->nargs. */
     ParseNode *prelude = NULL;
     bool hasRest;
-    tokenStream.incBanXML();
     if (!functionArguments(&prelude, pn, hasRest))
         return false;
-    tokenStream.decBanXML();
 
     fun->setArgCount(funpc.numArgs());
     if (funbox->ndefaults)
         fun->setHasDefaults();
     if (hasRest)
         fun->setHasRest();
 
     if (type == Getter && fun->nargs > 0) {
@@ -2355,23 +2349,16 @@ BindDestructuringLHS(JSContext *cx, Pars
             pn->setOp(JSOP_SETNAME);
         break;
 
       case PNK_CALL:
         if (!MakeSetCall(cx, pn, parser, JSMSG_BAD_LEFTSIDE_OF_ASS))
             return false;
         break;
 
-#if JS_HAS_XML_SUPPORT
-      case PNK_XMLUNARY:
-        JS_ASSERT(pn->isOp(JSOP_XMLNAME));
-        pn->setOp(JSOP_BINDXMLNAME);
-        break;
-#endif
-
       default:
         parser->reportError(pn, JSMSG_BAD_LEFTSIDE_OF_ASS);
         return false;
     }
 
     return true;
 }
 
@@ -2517,17 +2504,17 @@ CheckDestructuring(JSContext *cx, BindDa
 }
 
 ParseNode *
 Parser::destructuringExpr(BindData *data, TokenKind tt)
 {
     JS_ASSERT(tokenStream.isCurrentTokenType(tt));
 
     pc->inDeclDestructuring = true;
-    ParseNode *pn = primaryExpr(tt, false);
+    ParseNode *pn = primaryExpr(tt);
     pc->inDeclDestructuring = false;
     if (!pn)
         return NULL;
     if (!CheckDestructuring(context, data, pn, this))
         return NULL;
     return pn;
 }
 
@@ -2960,17 +2947,16 @@ IsValidForStatementLHS(ParseNode *pn1, J
 #endif
         return true;
     }
 
     switch (pn1->getKind()) {
       case PNK_NAME:
       case PNK_DOT:
       case PNK_CALL:
-      case PNK_XMLUNARY:
       case PNK_ELEM:
         return true;
 
 #if JS_HAS_DESTRUCTURING
       case PNK_ARRAY:
       case PNK_OBJECT:
         // In JS 1.7 only, for ([K, V] in EXPR) has a special meaning.
         // Hence all other destructuring left-hand sides are banned there.
@@ -3724,26 +3710,17 @@ ParseNode *
 Parser::statement()
 {
     ParseNode *pn;
 
     JS_CHECK_RECURSION(context, return NULL);
 
     switch (tokenStream.getToken(TSF_OPERAND)) {
       case TOK_FUNCTION:
-      {
-#if JS_HAS_XML_SUPPORT
-        if (allowsXML()) {
-            TokenKind tt = tokenStream.peekToken(TSF_KEYWORD_IS_NAME);
-            if (tt == TOK_DBLCOLON)
-                return expressionStatement();
-        }
-#endif
         return functionStmt();
-      }
 
       case TOK_IF:
       {
         /* An IF node has three kids: condition, then, and optional else. */
         pn = TernaryNode::create(PNK_IF, this);
         if (!pn)
             return NULL;
         ParseNode *pn1 = condition();
@@ -4011,49 +3988,16 @@ Parser::statement()
 
       case TOK_DEBUGGER:
         pn = new_<DebuggerStatement>(tokenStream.currentToken().pos);
         if (!pn)
             return NULL;
         pc->sc->setBindingsAccessedDynamically();
         break;
 
-#if JS_HAS_XML_SUPPORT
-      case TOK_DEFAULT:
-      {
-        if (!allowsXML())
-            return expressionStatement();
-
-        pn = UnaryNode::create(PNK_DEFXMLNS, this);
-        if (!pn)
-            return NULL;
-        if (!tokenStream.matchToken(TOK_NAME) ||
-            tokenStream.currentToken().name() != context->names().xml ||
-            !tokenStream.matchToken(TOK_NAME) ||
-            tokenStream.currentToken().name() != context->names().namespace_ ||
-            !tokenStream.matchToken(TOK_ASSIGN))
-        {
-            reportError(NULL, JSMSG_BAD_DEFAULT_XML_NAMESPACE);
-            return NULL;
-        }
-
-        JS_ASSERT(tokenStream.currentToken().t_op == JSOP_NOP);
-
-        /* Is this an E4X dagger I see before me? */
-        pc->sc->setBindingsAccessedDynamically();
-        ParseNode *pn2 = expr();
-        if (!pn2)
-            return NULL;
-        pn->setOp(JSOP_DEFXMLNS);
-        pn->pn_pos.end = pn2->pn_pos.end;
-        pn->pn_kid = pn2;
-        break;
-      }
-#endif
-
       case TOK_ERROR:
         return NULL;
 
       default:
         return expressionStatement();
     }
 
     /* Check termination of this primitive statement. */
@@ -4096,17 +4040,17 @@ Parser::variables(ParseNodeKind kind, St
         data.initVarOrConst(pn->getOp());
 
     ParseNode *pn2;
     do {
         TokenKind tt = tokenStream.getToken();
 #if JS_HAS_DESTRUCTURING
         if (tt == TOK_LB || tt == TOK_LC) {
             pc->inDeclDestructuring = true;
-            pn2 = primaryExpr(tt, false);
+            pn2 = primaryExpr(tt);
             pc->inDeclDestructuring = false;
             if (!pn2)
                 return NULL;
 
             if (!CheckDestructuring(context, &data, pn2, this))
                 return NULL;
             bool ignored;
             if (pc->parsingForInit && matchInOrOf(&ignored)) {
@@ -4469,22 +4413,16 @@ Parser::setAssignmentLhsOps(ParseNode *p
         if (!CheckDestructuring(context, NULL, pn, this))
             return false;
         break;
 #endif
       case PNK_CALL:
         if (!MakeSetCall(context, pn, this, JSMSG_BAD_LEFTSIDE_OF_ASS))
             return false;
         break;
-#if JS_HAS_XML_SUPPORT
-      case PNK_XMLUNARY:
-        JS_ASSERT(pn->isOp(JSOP_XMLNAME));
-        pn->setOp(JSOP_SETXMLNAME);
-        break;
-#endif
       default:
         reportError(NULL, JSMSG_BAD_LEFTSIDE_OF_ASS);
         return false;
     }
     return true;
 }
 
 ParseNode *
@@ -4536,19 +4474,16 @@ static bool
 SetLvalKid(JSContext *cx, Parser *parser, ParseNode *pn, ParseNode *kid,
            const char *name)
 {
     if (!kid->isKind(PNK_NAME) &&
         !kid->isKind(PNK_DOT) &&
         (!kid->isKind(PNK_CALL) ||
          (!kid->isOp(JSOP_CALL) && !kid->isOp(JSOP_EVAL) &&
           !kid->isOp(JSOP_FUNCALL) && !kid->isOp(JSOP_FUNAPPLY))) &&
-#if JS_HAS_XML_SUPPORT
-        !kid->isKind(PNK_XMLUNARY) &&
-#endif
         !kid->isKind(PNK_ELEM))
     {
         parser->reportError(NULL, JSMSG_BAD_OPERAND, name);
         return false;
     }
     if (!CheckStrictAssignment(cx, parser, kid))
         return false;
     pn->pn_kid = kid;
@@ -4578,22 +4513,16 @@ SetIncOpKid(JSContext *cx, Parser *parse
              ? (preorder ? JSOP_INCPROP : JSOP_PROPINC)
              : (preorder ? JSOP_DECPROP : JSOP_PROPDEC);
         break;
 
       case PNK_CALL:
         if (!MakeSetCall(cx, kid, parser, JSMSG_BAD_INCOP_OPERAND))
             return false;
         /* FALL THROUGH */
-#if JS_HAS_XML_SUPPORT
-      case PNK_XMLUNARY:
-        if (kid->isOp(JSOP_XMLNAME))
-            kid->setOp(JSOP_SETXMLNAME);
-        /* FALL THROUGH */
-#endif
       case PNK_ELEM:
         op = (tt == TOK_INC)
              ? (preorder ? JSOP_INCELEM : JSOP_ELEMINC)
              : (preorder ? JSOP_DECELEM : JSOP_ELEMDEC);
         break;
 
       default:
         JS_ASSERT(0);
@@ -5133,17 +5062,17 @@ Parser::comprehensionTail(ParseNode *kid
 
         RootedPropertyName name(context);
         tt = tokenStream.getToken();
         switch (tt) {
 #if JS_HAS_DESTRUCTURING
           case TOK_LB:
           case TOK_LC:
             pc->inDeclDestructuring = true;
-            pn3 = primaryExpr(tt, false);
+            pn3 = primaryExpr(tt);
             pc->inDeclDestructuring = false;
             if (!pn3)
                 return NULL;
             break;
 #endif
 
           case TOK_NAME:
             name = tokenStream.currentToken().name();
@@ -5480,131 +5409,39 @@ Parser::memberExpr(bool allowCallSyntax)
             return NULL;
         if (lhs->pn_count > ARGC_LIMIT) {
             JS_ReportErrorNumber(context, js_GetErrorMessage, NULL,
                                  JSMSG_TOO_MANY_CON_ARGS);
             return NULL;
         }
         lhs->pn_pos.end = lhs->last()->pn_pos.end;
     } else {
-        lhs = primaryExpr(tt, false);
+        lhs = primaryExpr(tt);
         if (!lhs)
             return NULL;
-
-        if (lhs->isXMLNameOp()) {
-            lhs = new_<UnaryNode>(PNK_XMLUNARY, JSOP_XMLNAME, lhs->pn_pos, lhs);
-            if (!lhs)
-                return NULL;
-        }
     }
 
     while ((tt = tokenStream.getToken()) > TOK_EOF) {
         ParseNode *nextMember;
         if (tt == TOK_DOT) {
             tt = tokenStream.getToken(TSF_KEYWORD_IS_NAME);
             if (tt == TOK_ERROR)
                 return NULL;
             if (tt == TOK_NAME) {
-#if JS_HAS_XML_SUPPORT
-                if (allowsXML() && tokenStream.peekToken() == TOK_DBLCOLON) {
-                    ParseNode *propertyId = propertyQualifiedIdentifier();
-                    if (!propertyId)
-                        return NULL;
-
-                    nextMember = new_<XMLDoubleColonProperty>(lhs, propertyId,
-                                                              lhs->pn_pos.begin,
-                                                              tokenStream.currentToken().pos.end);
-                    if (!nextMember)
-                        return NULL;
-                } else
-#endif
-                {
-                    PropertyName *field = tokenStream.currentToken().name();
-                    nextMember = new_<PropertyAccess>(lhs, field,
-                                                      lhs->pn_pos.begin,
-                                                      tokenStream.currentToken().pos.end);
-                    if (!nextMember)
-                        return NULL;
-                }
-            }
-#if JS_HAS_XML_SUPPORT
-            else if (allowsXML()) {
-                TokenPtr begin = lhs->pn_pos.begin;
-                if (tt == TOK_LP) {
-                    /* Filters are effectively 'with', so deoptimize names. */
-                    pc->sc->setBindingsAccessedDynamically();
-
-                    StmtInfoPC stmtInfo(context);
-                    bool oldParsingWith = pc->parsingWith;
-                    pc->parsingWith = true;
-                    PushStatementPC(pc, &stmtInfo, STMT_WITH);
-
-                    ParseNode *filter = bracketedExpr();
-                    if (!filter)
-                        return NULL;
-                    filter->setInParens(true);
-                    MUST_MATCH_TOKEN(TOK_RP, JSMSG_PAREN_IN_PAREN);
-
-                    pc->parsingWith = oldParsingWith;
-                    PopStatementPC(context, pc);
-
-                    nextMember =
-                        new_<XMLFilterExpression>(lhs, filter,
-                                                  begin, tokenStream.currentToken().pos.end);
-                    if (!nextMember)
-                        return NULL;
-                } else if (tt == TOK_AT || tt == TOK_STAR) {
-                    ParseNode *propertyId = starOrAtPropertyIdentifier(tt);
-                    if (!propertyId)
-                        return NULL;
-                    nextMember = new_<XMLProperty>(lhs, propertyId,
-                                                   begin, tokenStream.currentToken().pos.end);
-                    if (!nextMember)
-                        return NULL;
-                } else {
-                    reportError(NULL, JSMSG_NAME_AFTER_DOT);
+                PropertyName *field = tokenStream.currentToken().name();
+                nextMember = new_<PropertyAccess>(lhs, field,
+                                                  lhs->pn_pos.begin,
+                                                  tokenStream.currentToken().pos.end);
+                if (!nextMember)
                     return NULL;
-                }
-            }
-#endif
-            else {
+            } else {
                 reportError(NULL, JSMSG_NAME_AFTER_DOT);
                 return NULL;
             }
-        }
-#if JS_HAS_XML_SUPPORT
-        else if (tt == TOK_DBLDOT) {
-            if (!allowsXML()) {
-                reportError(NULL, JSMSG_NAME_AFTER_DOT);
-                return NULL;
-            }
-
-            nextMember = BinaryNode::create(PNK_DBLDOT, this);
-            if (!nextMember)
-                return NULL;
-            tt = tokenStream.getToken(TSF_OPERAND | TSF_KEYWORD_IS_NAME);
-            ParseNode *pn3 = primaryExpr(tt, true);
-            if (!pn3)
-                return NULL;
-            if (pn3->isKind(PNK_NAME) && !pn3->isInParens()) {
-                pn3->setKind(PNK_STRING);
-                pn3->setArity(PN_NULLARY);
-                pn3->setOp(JSOP_QNAMEPART);
-            } else if (!pn3->isXMLPropertyIdentifier()) {
-                reportError(NULL, JSMSG_NAME_AFTER_DOT);
-                return NULL;
-            }
-            nextMember->setOp(JSOP_DESCENDANTS);
-            nextMember->pn_left = lhs;
-            nextMember->pn_right = pn3;
-            nextMember->pn_pos.begin = lhs->pn_pos.begin;
-            nextMember->pn_pos.end = tokenStream.currentToken().pos.end;
-        }
-#endif
-        else if (tt == TOK_LB) {
+        } else if (tt == TOK_LB) {
             ParseNode *propExpr = expr();
             if (!propExpr)
                 return NULL;
 
             MUST_MATCH_TOKEN(TOK_RB, JSMSG_BRACKET_IN_INDEX);
             TokenPtr begin = lhs->pn_pos.begin, end = tokenStream.currentToken().pos.end;
 
             /*
@@ -5710,730 +5547,34 @@ Parser::bracketedExpr()
      */
     bool oldParsingForInit = pc->parsingForInit;
     pc->parsingForInit = false;
     ParseNode *pn = expr();
     pc->parsingForInit = oldParsingForInit;
     return pn;
 }
 
-#if JS_HAS_XML_SUPPORT
-
 ParseNode *
-Parser::endBracketedExpr()
-{
-    JS_ASSERT(allowsXML());
-
-    ParseNode *pn = bracketedExpr();
-    if (!pn)
-        return NULL;
-
-    MUST_MATCH_TOKEN(TOK_RB, JSMSG_BRACKET_AFTER_ATTR_EXPR);
-    return pn;
-}
-
-/*
- * From the ECMA-357 grammar in 11.1.1 and 11.1.2:
- *
- *      AttributeIdentifier:
- *              @ PropertySelector
- *              @ QualifiedIdentifier
- *              @ [ Expression ]
- *
- *      PropertySelector:
- *              Identifier
- *              *
- *
- *      QualifiedIdentifier:
- *              PropertySelector :: PropertySelector
- *              PropertySelector :: [ Expression ]
- *
- * We adapt AttributeIdentifier and QualifiedIdentier to be LL(1), like so:
- *
- *      AttributeIdentifier:
- *              @ QualifiedIdentifier
- *              @ [ Expression ]
- *
- *      PropertySelector:
- *              Identifier
- *              *
- *
- *      QualifiedIdentifier:
- *              PropertySelector :: PropertySelector
- *              PropertySelector :: [ Expression ]
- *              PropertySelector
- *
- * As PrimaryExpression: Identifier is in ECMA-262 and we want the semantics
- * for that rule to result in a name node, but ECMA-357 extends the grammar
- * to include PrimaryExpression: QualifiedIdentifier, we must factor further:
- *
- *      QualifiedIdentifier:
- *              PropertySelector QualifiedSuffix
- *
- *      QualifiedSuffix:
- *              :: PropertySelector
- *              :: [ Expression ]
- *              /nothing/
- *
- * And use this production instead of PrimaryExpression: QualifiedIdentifier:
- *
- *      PrimaryExpression:
- *              Identifier QualifiedSuffix
- *
- * We hoist the :: match into callers of QualifiedSuffix, in order to tweak
- * PropertySelector vs. Identifier pn_arity, pn_op, and other members.
- */
-ParseNode *
-Parser::propertySelector()
-{
-    JS_ASSERT(allowsXML());
-
-    ParseNode *selector;
-    if (tokenStream.isCurrentTokenType(TOK_STAR)) {
-        selector = NullaryNode::create(PNK_ANYNAME, this);
-        if (!selector)
-            return NULL;
-        selector->setOp(JSOP_ANYNAME);
-        selector->pn_atom = context->names().star;
-    } else {
-        JS_ASSERT(tokenStream.isCurrentTokenType(TOK_NAME));
-        selector = NullaryNode::create(PNK_NAME, this);
-        if (!selector)
-            return NULL;
-        selector->setOp(JSOP_QNAMEPART);
-        selector->setArity(PN_NAME);
-        selector->pn_atom = tokenStream.currentToken().name();
-        selector->pn_cookie.makeFree();
-    }
-    return selector;
-}
-
-ParseNode *
-Parser::qualifiedSuffix(ParseNode *pn)
-{
-    JS_ASSERT(allowsXML());
-
-    JS_ASSERT(tokenStream.currentToken().type == TOK_DBLCOLON);
-    ParseNode *pn2 = NameNode::create(PNK_DBLCOLON, NULL, this, this->pc);
-    if (!pn2)
-        return NULL;
-
-    pc->sc->setBindingsAccessedDynamically();
-
-    /* Left operand of :: must be evaluated if it is an identifier. */
-    if (pn->isOp(JSOP_QNAMEPART))
-        pn->setOp(JSOP_NAME);
-
-    TokenKind tt = tokenStream.getToken(TSF_KEYWORD_IS_NAME);
-    if (tt == TOK_STAR || tt == TOK_NAME) {
-        /* Inline and specialize propertySelector for JSOP_QNAMECONST. */
-        pn2->setOp(JSOP_QNAMECONST);
-        pn2->pn_pos.begin = pn->pn_pos.begin;
-        pn2->pn_atom = (tt == TOK_STAR)
-                       ? context->names().star
-                       : tokenStream.currentToken().name();
-        pn2->pn_expr = pn;
-        pn2->pn_cookie.makeFree();
-        return pn2;
-    }
-
-    if (tt != TOK_LB) {
-        reportError(NULL, JSMSG_SYNTAX_ERROR);
-        return NULL;
-    }
-    ParseNode *pn3 = endBracketedExpr();
-    if (!pn3)
-        return NULL;
-
-    pn2->setOp(JSOP_QNAME);
-    pn2->setArity(PN_BINARY);
-    pn2->pn_pos.begin = pn->pn_pos.begin;
-    pn2->pn_pos.end = pn3->pn_pos.end;
-    pn2->pn_left = pn;
-    pn2->pn_right = pn3;
-    return pn2;
-}
-
-ParseNode *
-Parser::qualifiedIdentifier()
-{
-    JS_ASSERT(allowsXML());
-
-    ParseNode *pn = propertySelector();
-    if (!pn)
-        return NULL;
-    if (tokenStream.matchToken(TOK_DBLCOLON)) {
-        /* Hack for bug 496316. Slowing down E4X won't make it go away, alas. */
-        pc->sc->setBindingsAccessedDynamically();
-        pn = qualifiedSuffix(pn);
-    }
-    return pn;
-}
-
-ParseNode *
-Parser::attributeIdentifier()
-{
-    JS_ASSERT(allowsXML());
-
-    JS_ASSERT(tokenStream.currentToken().type == TOK_AT);
-    ParseNode *pn = UnaryNode::create(PNK_AT, this);
-    if (!pn)
-        return NULL;
-    pn->setOp(JSOP_TOATTRNAME);
-
-    ParseNode *pn2;
-    TokenKind tt = tokenStream.getToken(TSF_KEYWORD_IS_NAME);
-    if (tt == TOK_STAR || tt == TOK_NAME) {
-        pn2 = qualifiedIdentifier();
-    } else if (tt == TOK_LB) {
-        pn2 = endBracketedExpr();
-    } else {
-        reportError(NULL, JSMSG_SYNTAX_ERROR);
-        return NULL;
-    }
-    if (!pn2)
-        return NULL;
-    pn->pn_kid = pn2;
-    pn->pn_pos.end = pn2->pn_pos.end;
-    return pn;
-}
-
-/*
- * Make a TOK_LC unary node whose pn_kid is an expression.
- */
-ParseNode *
-Parser::xmlExpr(bool inTag)
-{
-    JS_ASSERT(allowsXML());
-
-    JS_ASSERT(tokenStream.currentToken().type == TOK_LC);
-    ParseNode *pn = UnaryNode::create(PNK_XMLCURLYEXPR, this);
-    if (!pn)
-        return NULL;
-
-    /*
-     * Turn off XML tag mode. We save the old value of the flag because it may
-     * already be off: XMLExpr is called both from within a tag, and from
-     * within text contained in an element, but outside of any start, end, or
-     * point tag.
-     */
-    bool oldflag = tokenStream.isXMLTagMode();
-    tokenStream.setXMLTagMode(false);
-    ParseNode *pn2 = expr();
-    if (!pn2)
-        return NULL;
-
-    MUST_MATCH_TOKEN(TOK_RC, JSMSG_CURLY_IN_XML_EXPR);
-    tokenStream.setXMLTagMode(oldflag);
-    pn->pn_kid = pn2;
-    pn->setOp(inTag ? JSOP_XMLTAGEXPR : JSOP_XMLELTEXPR);
-    pn->pn_pos.end = pn2->pn_pos.end;
-    return pn;
-}
-
-/*
- * Parse the productions:
- *
- *      XMLNameExpr:
- *              XMLName XMLNameExpr?
- *              { Expr } XMLNameExpr?
- *
- * Return a PN_LIST, PN_UNARY, or PN_NULLARY according as XMLNameExpr produces
- * a list of names and/or expressions, a single expression, or a single name.
- * If PN_LIST or PN_NULLARY, getKind() will be PNK_XMLNAME.  Otherwise if
- * PN_UNARY, getKind() will be PNK_XMLCURLYEXPR.
- */
-ParseNode *
-Parser::xmlNameExpr()
-{
-    JS_ASSERT(allowsXML());
-
-    ParseNode *pn, *pn2, *list;
-    TokenKind tt;
-
-    pn = list = NULL;
-    do {
-        tt = tokenStream.currentToken().type;
-        if (tt == TOK_LC) {
-            pn2 = xmlExpr(true);
-            if (!pn2)
-                return NULL;
-        } else {
-            JS_ASSERT(tt == TOK_XMLNAME);
-            JS_ASSERT(tokenStream.currentToken().t_op == JSOP_STRING);
-            pn2 = atomNode(PNK_XMLNAME, JSOP_STRING);
-            if (!pn2)
-                return NULL;
-        }
-
-        if (!pn) {
-            pn = pn2;
-        } else {
-            if (!list) {
-                list = ListNode::create(PNK_XMLNAME, this);
-                if (!list)
-                    return NULL;
-                list->pn_pos.begin = pn->pn_pos.begin;
-                list->initList(pn);
-                list->pn_xflags = PNX_CANTFOLD;
-                pn = list;
-            }
-            pn->pn_pos.end = pn2->pn_pos.end;
-            pn->append(pn2);
-        }
-    } while ((tt = tokenStream.getToken()) == TOK_XMLNAME || tt == TOK_LC);
-
-    tokenStream.ungetToken();
-    return pn;
-}
-
-/*
- * Macro to test whether an XMLNameExpr or XMLTagContent node can be folded
- * at compile time into a JSXML tree.
- */
-#define XML_FOLDABLE(pn)        ((pn)->isArity(PN_LIST)                     \
-                                 ? ((pn)->pn_xflags & PNX_CANTFOLD) == 0    \
-                                 : !(pn)->isKind(PNK_XMLCURLYEXPR))
-
-/*
- * Parse the productions:
- *
- *      XMLTagContent:
- *              XMLNameExpr
- *              XMLTagContent S XMLNameExpr S? = S? XMLAttr
- *              XMLTagContent S XMLNameExpr S? = S? { Expr }
- *
- * Return a PN_LIST, PN_UNARY, or PN_NULLARY according to how XMLTagContent
- * produces a list of name and attribute values and/or braced expressions, a
- * single expression, or a single name.
- *
- * If PN_LIST or PN_NULLARY, getKind() will be PNK_XMLNAME for the case where
- * XMLTagContent: XMLNameExpr.  If getKind() is not PNK_XMLNAME but getArity()
- * is PN_LIST, getKind() will be tagkind.  If PN_UNARY, getKind() will be
- * PNK_XMLCURLYEXPR and we parsed exactly one expression.
- */
-ParseNode *
-Parser::xmlTagContent(ParseNodeKind tagkind, JSAtom **namep)
-{
-    JS_ASSERT(allowsXML());
-
-    ParseNode *pn, *pn2, *list;
-    TokenKind tt;
-
-    pn = xmlNameExpr();
-    if (!pn)
-        return NULL;
-    *namep = (pn->isArity(PN_NULLARY)) ? pn->pn_atom : NULL;
-    list = NULL;
-
-    while (tokenStream.matchToken(TOK_XMLSPACE)) {
-        tt = tokenStream.getToken();
-        if (tt != TOK_XMLNAME && tt != TOK_LC) {
-            tokenStream.ungetToken();
-            break;
-        }
-
-        pn2 = xmlNameExpr();
-        if (!pn2)
-            return NULL;
-        if (!list) {
-            list = ListNode::create(tagkind, this);
-            if (!list)
-                return NULL;
-            list->pn_pos.begin = pn->pn_pos.begin;
-            list->initList(pn);
-            pn = list;
-        }
-        pn->append(pn2);
-        if (!XML_FOLDABLE(pn2))
-            pn->pn_xflags |= PNX_CANTFOLD;
-
-        tokenStream.matchToken(TOK_XMLSPACE);
-        MUST_MATCH_TOKEN(TOK_ASSIGN, JSMSG_NO_ASSIGN_IN_XML_ATTR);
-        tokenStream.matchToken(TOK_XMLSPACE);
-
-        tt = tokenStream.getToken();
-        if (tt == TOK_XMLATTR) {
-            JS_ASSERT(tokenStream.currentToken().t_op == JSOP_STRING);
-            pn2 = atomNode(PNK_XMLATTR, JSOP_STRING);
-        } else if (tt == TOK_LC) {
-            pn2 = xmlExpr(true);
-            pn->pn_xflags |= PNX_CANTFOLD;
-        } else {
-            reportError(NULL, JSMSG_BAD_XML_ATTR_VALUE);
-            return NULL;
-        }
-        if (!pn2)
-            return NULL;
-        pn->append(pn2);
-    }
-
-    return pn;
-}
-
-#define XML_CHECK_FOR_ERROR_AND_EOF(tt,result)                                              \
-    JS_BEGIN_MACRO                                                                          \
-        if ((tt) <= TOK_EOF) {                                                              \
-            if ((tt) == TOK_EOF) {                                                          \
-                reportError(NULL, JSMSG_END_OF_XML_SOURCE);                                 \
-            }                                                                               \
-            return result;                                                                  \
-        }                                                                                   \
-    JS_END_MACRO
-
-/*
- * Consume XML element tag content, including the TOK_XMLETAGO (</) sequence
- * that opens the end tag for the container.
- */
-bool
-Parser::xmlElementContent(ParseNode *pn)
-{
-    JS_ASSERT(allowsXML());
-
-    tokenStream.setXMLTagMode(false);
-    for (;;) {
-        TokenKind tt = tokenStream.getToken(TSF_XMLTEXTMODE);
-        XML_CHECK_FOR_ERROR_AND_EOF(tt, false);
-
-        JS_ASSERT(tt == TOK_XMLSPACE || tt == TOK_XMLTEXT);
-        JSAtom *textAtom = tokenStream.currentToken().atom();
-        if (textAtom) {
-            /* Non-zero-length XML text scanned. */
-            JS_ASSERT(tokenStream.currentToken().t_op == JSOP_STRING);
-            ParseNode *pn2 = atomNode(tt == TOK_XMLSPACE ? PNK_XMLSPACE : PNK_XMLTEXT,
-                                      JSOP_STRING);
-            if (!pn2)
-                return false;
-            pn->append(pn2);
-        }
-
-        tt = tokenStream.getToken(TSF_OPERAND);
-        XML_CHECK_FOR_ERROR_AND_EOF(tt, false);
-        if (tt == TOK_XMLETAGO)
-            break;
-
-        ParseNode *pn2;
-        if (tt == TOK_LC) {
-            pn2 = xmlExpr(false);
-            if (!pn2)
-                return false;
-            pn->pn_xflags |= PNX_CANTFOLD;
-        } else if (tt == TOK_XMLSTAGO) {
-            pn2 = xmlElementOrList(false);
-            if (!pn2)
-                return false;
-            pn2->pn_xflags &= ~PNX_XMLROOT;
-            pn->pn_xflags |= pn2->pn_xflags;
-        } else if (tt == TOK_XMLPI) {
-            const Token &tok = tokenStream.currentToken();
-            pn2 = new_<XMLProcessingInstruction>(tok.xmlPITarget(), tok.xmlPIData(), tok.pos);
-            if (!pn2)
-                return false;
-        } else {
-            JS_ASSERT(tt == TOK_XMLCDATA || tt == TOK_XMLCOMMENT);
-            pn2 = atomNode(tt == TOK_XMLCDATA ? PNK_XMLCDATA : PNK_XMLCOMMENT,
-                           tokenStream.currentToken().t_op);
-            if (!pn2)
-                return false;
-        }
-        pn->append(pn2);
-    }
-    tokenStream.setXMLTagMode(true);
-
-    JS_ASSERT(tokenStream.currentToken().type == TOK_XMLETAGO);
-    return true;
-}
-
-/*
- * Return a PN_LIST node containing an XML or XMLList Initialiser.
- */
-ParseNode *
-Parser::xmlElementOrList(bool allowList)
-{
-    JS_ASSERT(allowsXML());
-
-    ParseNode *pn, *pn2, *list;
-    TokenKind tt;
-    RootedAtom startAtom(context), endAtom(context);
-
-    JS_CHECK_RECURSION(context, return NULL);
-
-    JS_ASSERT(tokenStream.currentToken().type == TOK_XMLSTAGO);
-    pn = ListNode::create(PNK_XMLSTAGO, this);
-    if (!pn)
-        return NULL;
-
-    tokenStream.setXMLTagMode(true);
-    tt = tokenStream.getToken();
-    if (tt == TOK_ERROR)
-        return NULL;
-
-    if (tt == TOK_XMLNAME || tt == TOK_LC) {
-        /*
-         * XMLElement.  Append the tag and its contents, if any, to pn.
-         */
-        pn2 = xmlTagContent(PNK_XMLSTAGO, startAtom.address());
-        if (!pn2)
-            return NULL;
-        tokenStream.matchToken(TOK_XMLSPACE);
-
-        tt = tokenStream.getToken();
-        if (tt == TOK_XMLPTAGC) {
-            /* Point tag (/>): recycle pn if pn2 is a list of tag contents. */
-            if (pn2->isKind(PNK_XMLSTAGO)) {
-                pn->makeEmpty();
-                freeTree(pn);
-                pn = pn2;
-            } else {
-                JS_ASSERT(pn2->isKind(PNK_XMLNAME) || pn2->isKind(PNK_XMLCURLYEXPR));
-                pn->initList(pn2);
-                if (!XML_FOLDABLE(pn2))
-                    pn->pn_xflags |= PNX_CANTFOLD;
-            }
-            pn->setKind(PNK_XMLPTAGC);
-            pn->pn_xflags |= PNX_XMLROOT;
-        } else {
-            /* We had better have a tag-close (>) at this point. */
-            if (tt != TOK_XMLTAGC) {
-                reportError(NULL, JSMSG_BAD_XML_TAG_SYNTAX);
-                return NULL;
-            }
-            pn2->pn_pos.end = tokenStream.currentToken().pos.end;
-
-            /* Make sure pn2 is a TOK_XMLSTAGO list containing tag contents. */
-            if (!pn2->isKind(PNK_XMLSTAGO)) {
-                pn->initList(pn2);
-                if (!XML_FOLDABLE(pn2))
-                    pn->pn_xflags |= PNX_CANTFOLD;
-                pn2 = pn;
-                pn = ListNode::create(PNK_XMLTAGC, this);
-                if (!pn)
-                    return NULL;
-                pn->pn_pos = pn2->pn_pos;
-            }
-
-            /* Now make pn a nominal-root TOK_XMLELEM list containing pn2. */
-            pn->setKind(PNK_XMLELEM);
-            pn->pn_pos.begin = pn2->pn_pos.begin;
-            pn->initList(pn2);
-            if (!XML_FOLDABLE(pn2))
-                pn->pn_xflags |= PNX_CANTFOLD;
-            pn->pn_xflags |= PNX_XMLROOT;
-
-            /* Get element contents and delimiting end-tag-open sequence. */
-            if (!xmlElementContent(pn))
-                return NULL;
-
-            tt = tokenStream.getToken();
-            XML_CHECK_FOR_ERROR_AND_EOF(tt, NULL);
-            if (tt != TOK_XMLNAME && tt != TOK_LC) {
-                reportError(NULL, JSMSG_BAD_XML_TAG_SYNTAX);
-                return NULL;
-            }
-
-            /* Parse end tag; check mismatch at compile-time if we can. */
-            pn2 = xmlTagContent(PNK_XMLETAGO, endAtom.address());
-            if (!pn2)
-                return NULL;
-            if (pn2->isKind(PNK_XMLETAGO)) {
-                /* Oops, end tag has attributes! */
-                reportError(NULL, JSMSG_BAD_XML_TAG_SYNTAX);
-                return NULL;
-            }
-            if (endAtom && startAtom && endAtom != startAtom) {
-                /* End vs. start tag name mismatch: point to the tag name. */
-                reportUcError(pn2, JSMSG_XML_TAG_NAME_MISMATCH, startAtom->chars());
-                return NULL;
-            }
-
-            /* Make a TOK_XMLETAGO list with pn2 as its single child. */
-            JS_ASSERT(pn2->isKind(PNK_XMLNAME) || pn2->isKind(PNK_XMLCURLYEXPR));
-            list = ListNode::create(PNK_XMLETAGO, this);
-            if (!list)
-                return NULL;
-            list->initList(pn2);
-            pn->append(list);
-            if (!XML_FOLDABLE(pn2)) {
-                list->pn_xflags |= PNX_CANTFOLD;
-                pn->pn_xflags |= PNX_CANTFOLD;
-            }
-
-            tokenStream.matchToken(TOK_XMLSPACE);
-            MUST_MATCH_TOKEN(TOK_XMLTAGC, JSMSG_BAD_XML_TAG_SYNTAX);
-        }
-
-        /* Set pn_op now that pn has been updated to its final value. */
-        pn->setOp(JSOP_TOXML);
-    } else if (allowList && tt == TOK_XMLTAGC) {
-        /* XMLList Initialiser. */
-        pn->setKind(PNK_XMLLIST);
-        pn->setOp(JSOP_TOXMLLIST);
-        pn->makeEmpty();
-        pn->pn_xflags |= PNX_XMLROOT;
-        if (!xmlElementContent(pn))
-            return NULL;
-
-        MUST_MATCH_TOKEN(TOK_XMLTAGC, JSMSG_BAD_XML_LIST_SYNTAX);
-    } else {
-        reportError(NULL, JSMSG_BAD_XML_NAME_SYNTAX);
-        return NULL;
-    }
-    tokenStream.setXMLTagMode(false);
-
-    pn->pn_pos.end = tokenStream.currentToken().pos.end;
-    return pn;
-}
-
-ParseNode *
-Parser::xmlElementOrListRoot(bool allowList)
-{
-    JS_ASSERT(allowsXML());
-
-    /*
-     * Turn on "moar XML" so that comments and CDATA literals are recognized,
-     * instead of <! followed by -- starting an HTML comment to end of line
-     * (used in script tags to hide content from old browsers that don't
-     * recognize <script>).
-     */
-    bool hadMoarXML = tokenStream.hasMoarXML();
-    tokenStream.setMoarXML(true);
-    ParseNode *pn = xmlElementOrList(allowList);
-    tokenStream.setMoarXML(hadMoarXML);
-    return pn;
-}
-
-ParseNode *
-Parser::parseXMLText(JSObject *chain, bool allowList)
-{
-    /*
-     * Push a compiler frame if we have no frames, or if the top frame is a
-     * lightweight function activation, or if its scope chain doesn't match
-     * the one passed to us.
-     */
-    GlobalSharedContext xmlsc(context, chain, false);
-    ParseContext xmlpc(this, &xmlsc, /* staticLevel = */ 0, /* bodyid = */ 0);
-    if (!xmlpc.init())
-        return NULL;
-
-    /* Set XML-only mode to turn off special treatment of {expr} in XML. */
-    tokenStream.setXMLOnlyMode();
-    TokenKind tt = tokenStream.getToken(TSF_OPERAND);
-
-    ParseNode *pn;
-    if (tt != TOK_XMLSTAGO) {
-        reportError(NULL, JSMSG_BAD_XML_MARKUP);
-        pn = NULL;
-    } else {
-        pn = xmlElementOrListRoot(allowList);
-    }
-    tokenStream.setXMLOnlyMode(false);
-
-    return pn;
-}
-
-#endif /* JS_HAS_XMLSUPPORT */
-
-bool
-Parser::checkForFunctionNode(PropertyName *name, ParseNode *node)
-{
-    /*
-     * In |a.ns::name|, |ns| refers to an in-scope variable, so |ns| can't be a
-     * keyword.  (Exception: |function::name| is the actual name property, not
-     * what E4X would expose.)  We parsed |ns| accepting a keyword as a name,
-     * so we must implement the keyword restriction manually in this case.
-     */
-    if (const KeywordInfo *ki = FindKeyword(name->charsZ(), name->length())) {
-        if (ki->tokentype != TOK_FUNCTION) {
-            reportError(NULL, JSMSG_KEYWORD_NOT_NS);
-            return false;
-        }
-
-        node->setArity(PN_NULLARY);
-        node->setKind(PNK_FUNCTIONNS);
-    }
-
-    return true;
-}
-
-#if JS_HAS_XML_SUPPORT
-ParseNode *
-Parser::propertyQualifiedIdentifier()
-{
-    JS_ASSERT(allowsXML());
-    JS_ASSERT(tokenStream.isCurrentTokenType(TOK_NAME));
-    JS_ASSERT(tokenStream.currentToken().t_op == JSOP_NAME);
-    JS_ASSERT(tokenStream.peekToken() == TOK_DBLCOLON);
-
-    /* Deoptimize QualifiedIdentifier properties to avoid tricky analysis. */
-    pc->sc->setBindingsAccessedDynamically();
-
-    PropertyName *name = tokenStream.currentToken().name();
-    ParseNode *node = NameNode::create(PNK_NAME, name, this, this->pc);
-    if (!node)
-        return NULL;
-    node->setOp(JSOP_NAME);
-    node->pn_dflags |= PND_DEOPTIMIZED;
-
-    if (!checkForFunctionNode(name, node))
-        return NULL;
-
-    tokenStream.consumeKnownToken(TOK_DBLCOLON);
-    return qualifiedSuffix(node);
-}
-#endif
-
-ParseNode *
-Parser::identifierName(bool afterDoubleDot)
+Parser::identifierName()
 {
     JS_ASSERT(tokenStream.isCurrentTokenType(TOK_NAME));
 
     PropertyName *name = tokenStream.currentToken().name();
     ParseNode *node = NameNode::create(PNK_NAME, name, this, this->pc);
     if (!node)
         return NULL;
     JS_ASSERT(tokenStream.currentToken().t_op == JSOP_NAME);
     node->setOp(JSOP_NAME);
 
-    if ((!afterDoubleDot
-#if JS_HAS_XML_SUPPORT
-                || (allowsXML() && tokenStream.peekToken() == TOK_DBLCOLON)
-#endif
-               ) && !pc->inDeclDestructuring)
-    {
-        if (!NoteNameUse(node, this))
-            return NULL;
-    }
-
-#if JS_HAS_XML_SUPPORT
-    if (allowsXML() && tokenStream.matchToken(TOK_DBLCOLON)) {
-        if (afterDoubleDot) {
-            if (!checkForFunctionNode(name, node))
-                return NULL;
-        }
-        node = qualifiedSuffix(node);
-        if (!node)
-            return NULL;
-    }
-#endif
+    if (!pc->inDeclDestructuring && !NoteNameUse(node, this))
+        return NULL;
 
     return node;
 }
 
-#if JS_HAS_XML_SUPPORT
-ParseNode *
-Parser::starOrAtPropertyIdentifier(TokenKind tt)
-{
-    JS_ASSERT(tt == TOK_AT || tt == TOK_STAR);
-    if (allowsXML())
-        return (tt == TOK_AT) ? attributeIdentifier() : qualifiedIdentifier();
-    reportError(NULL, JSMSG_SYNTAX_ERROR);
-    return NULL;
-}
-#endif
-
 ParseNode *
 Parser::atomNode(ParseNodeKind kind, JSOp op)
 {
     ParseNode *node = NullaryNode::create(kind, this);
     if (!node)
         return NULL;
     node->setOp(op);
     const Token &tok = tokenStream.currentToken();
@@ -6445,38 +5586,27 @@ Parser::atomNode(ParseNodeKind kind, JSO
     const size_t HUGE_STRING = 50000;
     if (sct && sct->active() && kind == PNK_STRING && node->pn_atom->length() >= HUGE_STRING)
         sct->abort();
 
     return node;
 }
 
 ParseNode *
-Parser::primaryExpr(TokenKind tt, bool afterDoubleDot)
+Parser::primaryExpr(TokenKind tt)
 {
     JS_ASSERT(tokenStream.isCurrentTokenType(tt));
 
     ParseNode *pn, *pn2, *pn3;
     JSOp op;
 
     JS_CHECK_RECURSION(context, return NULL);
 
     switch (tt) {
       case TOK_FUNCTION:
-#if JS_HAS_XML_SUPPORT
-        if (allowsXML() && tokenStream.matchToken(TOK_DBLCOLON, TSF_KEYWORD_IS_NAME)) {
-            pn2 = NullaryNode::create(PNK_FUNCTIONNS, this);
-            if (!pn2)
-                return NULL;
-            pn = qualifiedSuffix(pn2);
-            if (!pn)
-                return NULL;
-            break;
-        }
-#endif
         pn = functionExpr();
         if (!pn)
             return NULL;
         break;
 
       case TOK_LB:
       {
         pn = ListNode::create(PNK_ARRAY, this);
@@ -6873,61 +6003,18 @@ Parser::primaryExpr(TokenKind tt, bool a
       }
 
       case TOK_STRING:
         pn = atomNode(PNK_STRING, JSOP_STRING);
         if (!pn)
             return NULL;
         break;
 
-#if JS_HAS_XML_SUPPORT
-      case TOK_AT:
-      case TOK_STAR:
-        if (!allowsXML())
-            goto syntaxerror;
-        pn = starOrAtPropertyIdentifier(tt);
-        break;
-
-      case TOK_XMLSTAGO:
-        if (!allowsXML())
-            goto syntaxerror;
-        pn = xmlElementOrListRoot(true);
-        if (!pn)
-            return NULL;
-        break;
-
-      case TOK_XMLCDATA:
-        if (!allowsXML())
-            goto syntaxerror;
-        pn = atomNode(PNK_XMLCDATA, JSOP_XMLCDATA);
-        if (!pn)
-            return NULL;
-        break;
-
-      case TOK_XMLCOMMENT:
-        if (!allowsXML())
-            goto syntaxerror;
-        pn = atomNode(PNK_XMLCOMMENT, JSOP_XMLCOMMENT);
-        if (!pn)
-            return NULL;
-        break;
-
-      case TOK_XMLPI: {
-        if (!allowsXML())
-            goto syntaxerror;
-        const Token &tok = tokenStream.currentToken();
-        pn = new_<XMLProcessingInstruction>(tok.xmlPITarget(), tok.xmlPIData(), tok.pos);
-        if (!pn)
-            return NULL;
-        break;
-      }
-#endif
-
       case TOK_NAME:
-        pn = identifierName(afterDoubleDot);
+        pn = identifierName();
         break;
 
       case TOK_REGEXP:
       {
         pn = NullaryNode::create(PNK_REGEXP, this);
         if (!pn)
             return NULL;
 
@@ -6976,17 +6063,16 @@ Parser::primaryExpr(TokenKind tt, bool a
         return new_<ThisLiteral>(tokenStream.currentToken().pos);
       case TOK_NULL:
         return new_<NullLiteral>(tokenStream.currentToken().pos);
 
       case TOK_ERROR:
         /* The scanner or one of its subroutines reported the error. */
         return NULL;
 
-    syntaxerror:
       default:
         reportError(NULL, JSMSG_SYNTAX_ERROR);
         return NULL;
     }
     return pn;
 }
 
 ParseNode *
--- a/js/src/frontend/Parser.h
+++ b/js/src/frontend/Parser.h
@@ -174,19 +174,19 @@ struct ParseContext                 /* t
     bool            funHasReturnExpr:1; /* function has 'return <expr>;' */
     bool            funHasReturnVoid:1; /* function has 'return;' */
 
     // The following flags are set when parsing enters a particular region of
     // source code, and cleared when that region is exited.
     bool            parsingForInit:1;   /* true while parsing init expr of for;
                                            exclude 'in' */
     bool            parsingWith:1;  /* true while we are within a
-                                       with-statement or E4X filter-expression
-                                       in the current ParseContext chain
-                                       (which stops at the top-level or an eval() */
+                                       with-statement in the current
+                                       ParseContext chain (which stops at the
+                                       top-level or an eval() */
 
     // Set when parsing a declaration-like destructuring pattern.  This flag
     // causes PrimaryExpr to create PN_NAME parse nodes for variable references
     // which are not hooked into any definition's use chain, added to any tree
     // context's AtomList, etc. etc.  CheckDestructuring will do that work
     // later.
     //
     // The comments atop CheckDestructuring explain the distinction between
@@ -281,20 +281,16 @@ struct Parser : private AutoGCRooter
     const char *getFilename() const { return tokenStream.getFilename(); }
     JSVersion versionNumber() const { return tokenStream.versionNumber(); }
 
     /*
      * Parse a top-level JS script.
      */
     ParseNode *parse(JSObject *chain);
 
-#if JS_HAS_XML_SUPPORT
-    ParseNode *parseXMLText(JSObject *chain, bool allowList);
-#endif
-
     /*
      * Allocate a new parsed object or function container from
      * cx->tempLifoAlloc.
      */
     ObjectBox *newObjectBox(JSObject *obj);
 
     FunctionBox *newFunctionBox(JSFunction *fun, ParseContext *pc, bool strict);
 
@@ -412,17 +408,17 @@ struct Parser : private AutoGCRooter
     ParseNode *shiftExpr1i();
     ParseNode *shiftExpr1n();
     ParseNode *addExpr1i();
     ParseNode *addExpr1n();
     ParseNode *mulExpr1i();
     ParseNode *mulExpr1n();
     ParseNode *unaryExpr();
     ParseNode *memberExpr(bool allowCallSyntax);
-    ParseNode *primaryExpr(TokenKind tt, bool afterDoubleDot);
+    ParseNode *primaryExpr(TokenKind tt);
     ParseNode *parenExpr(bool *genexp = NULL);
 
     /*
      * Additional JS parsers.
      */
     enum FunctionType { Getter, Setter, Normal };
     bool functionArguments(ParseNode **list, ParseNode *funcpn, bool &hasRest);
 
@@ -439,45 +435,21 @@ struct Parser : private AutoGCRooter
                                  ParseNodeKind kind = PNK_SEMI, JSOp op = JSOP_NOP);
     ParseNode *generatorExpr(ParseNode *kid);
     bool argumentList(ParseNode *listNode);
     ParseNode *bracketedExpr();
     ParseNode *letBlock(LetContext letContext);
     ParseNode *returnOrYield(bool useAssignExpr);
     ParseNode *destructuringExpr(BindData *data, TokenKind tt);
 
-    bool checkForFunctionNode(PropertyName *name, ParseNode *node);
-
-    ParseNode *identifierName(bool afterDoubleDot);
-
-#if JS_HAS_XML_SUPPORT
-    bool allowsXML() const { return tokenStream.allowsXML(); }
-
-    ParseNode *endBracketedExpr();
-
-    ParseNode *propertySelector();
-    ParseNode *qualifiedSuffix(ParseNode *pn);
-    ParseNode *qualifiedIdentifier();
-    ParseNode *attributeIdentifier();
-    ParseNode *xmlExpr(bool inTag);
-    ParseNode *xmlNameExpr();
-    ParseNode *xmlTagContent(ParseNodeKind tagkind, JSAtom **namep);
-    bool xmlElementContent(ParseNode *pn);
-    ParseNode *xmlElementOrList(bool allowList);
-    ParseNode *xmlElementOrListRoot(bool allowList);
-
-    ParseNode *starOrAtPropertyIdentifier(TokenKind tt);
-    ParseNode *propertyQualifiedIdentifier();
-#endif /* JS_HAS_XML_SUPPORT */
+    ParseNode *identifierName();
 
     bool allowsForEachIn() {
 #if !JS_HAS_FOR_EACH_IN
         return false;
-#elif JS_HAS_XML_SUPPORT
-        return allowsXML() || tokenStream.hasMoarXML();
 #else
         return versionNumber() >= JSVERSION_1_6;
 #endif
     }
 
     bool setAssignmentLhsOps(ParseNode *pn, JSOp op);
     bool matchInOrOf(bool *isForOfp);
 };
--- a/js/src/frontend/SharedContext.h
+++ b/js/src/frontend/SharedContext.h
@@ -191,18 +191,17 @@ public:
 
 class FunctionBox : public ObjectBox, public SharedContext
 {
   public:
     Bindings        bindings;               /* bindings for this function */
     size_t          bufStart;
     size_t          bufEnd;
     uint16_t        ndefaults;
-    bool            inWith:1;               /* some enclosing scope is a with-statement
-                                               or E4X filter-expression */
+    bool            inWith:1;               /* some enclosing scope is a with-statement */
     bool            inGenexpLambda:1;       /* lambda from generator expression */
 
     FunctionContextFlags funCxFlags;
 
     FunctionBox(JSContext *cx, ObjectBox* traceListHead, JSFunction *fun, ParseContext *pc,
                 bool strict);
 
     ObjectBox *toObjectBox() { return this; }
--- a/js/src/frontend/TokenStream.cpp
+++ b/js/src/frontend/TokenStream.cpp
@@ -34,20 +34,16 @@
 #include "frontend/TokenStream.h"
 #include "js/CharacterEncoding.h"
 #include "vm/Keywords.h"
 #include "vm/RegExpObject.h"
 #include "vm/StringBuffer.h"
 
 #include "jsscriptinlines.h"
 
-#if JS_HAS_XML_SUPPORT
-#include "jsxml.h"
-#endif
-
 using namespace js;
 using namespace js::frontend;
 using namespace js::unicode;
 
 static const KeywordInfo keywords[] = {
 #define KEYWORD_INFO(keyword, name, type, op, version) \
     {js_##keyword##_str, type, op, version},
     FOR_EACH_JAVASCRIPT_KEYWORD(KEYWORD_INFO)
@@ -127,18 +123,16 @@ TokenStream::TokenStream(JSContext *cx, 
     linebase(base.get()),
     prevLinebase(NULL),
     userbuf(base.get(), length),
     filename(options.filename),
     sourceMap(NULL),
     listenerTSData(),
     tokenbuf(cx),
     version(options.version),
-    banXML(VersionHasAllowXML(options.version) ? 0 : 1),
-    moarXML(VersionHasMoarXML(options.version)),
     cx(cx),
     originPrincipals(JSScript::normalizeOriginPrincipals(options.principals,
                                                          options.originPrincipals)),
     strictModeGetter(smg),
     tokenSkip(cx, &tokens)
 {
     if (originPrincipals)
         JS_HoldPrincipals(originPrincipals);
@@ -615,485 +609,16 @@ bool
 TokenStream::reportStrictWarningErrorNumberVA(ParseNode *pn, unsigned errorNumber, va_list args)
 {
     if (!cx->hasStrictOption())
         return true;
 
     return reportCompileErrorNumberVA(NULL, JSREPORT_STRICT | JSREPORT_WARNING, errorNumber, args);
 }
 
-#if JS_HAS_XML_SUPPORT
-
-bool
-TokenStream::getXMLEntity()
-{
-    ptrdiff_t offset, length, i;
-    int c, d;
-    bool ispair;
-    jschar *bp, digit;
-    char *bytes;
-    JSErrNum msg;
-
-    CharBuffer &tb = tokenbuf;
-
-    /* Put the entity, including the '&' already scanned, in tokenbuf. */
-    offset = tb.length();
-    if (!tb.append('&'))
-        return false;
-    while ((c = getChar()) != ';') {
-        if (c == EOF || c == '\n') {
-            reportError(JSMSG_END_OF_XML_ENTITY);
-            return false;
-        }
-        if (!tb.append(c))
-            return false;
-    }
-
-    /* Let length be the number of jschars after the '&', including the ';'. */
-    length = tb.length() - offset;
-    bp = tb.begin() + offset;
-    c = d = 0;
-    ispair = false;
-    if (length > 2 && bp[1] == '#') {
-        /* Match a well-formed XML Character Reference. */
-        i = 2;
-        if (length > 3 && (bp[i] == 'x' || bp[i] == 'X')) {
-            if (length > 9)     /* at most 6 hex digits allowed */
-                goto badncr;
-            while (++i < length) {
-                digit = bp[i];
-                if (!JS7_ISHEX(digit))
-                    goto badncr;
-                c = (c << 4) + JS7_UNHEX(digit);
-            }
-        } else {
-            while (i < length) {
-                digit = bp[i++];
-                if (!JS7_ISDEC(digit))
-                    goto badncr;
-                c = (c * 10) + JS7_UNDEC(digit);
-                if (c < 0)
-                    goto badncr;
-            }
-        }
-
-        if (0x10000 <= c && c <= 0x10FFFF) {
-            /* Form a surrogate pair (c, d) -- c is the high surrogate. */
-            d = 0xDC00 + (c & 0x3FF);
-            c = 0xD7C0 + (c >> 10);
-            ispair = true;
-        } else {
-            /* Enforce the http://www.w3.org/TR/REC-xml/#wf-Legalchar WFC. */
-            if (c != 0x9 && c != 0xA && c != 0xD &&
-                !(0x20 <= c && c <= 0xD7FF) &&
-                !(0xE000 <= c && c <= 0xFFFD)) {
-                goto badncr;
-            }
-        }
-    } else {
-        /* Try to match one of the five XML 1.0 predefined entities. */
-        switch (length) {
-          case 3:
-            if (bp[2] == 't') {
-                if (bp[1] == 'l')
-                    c = '<';
-                else if (bp[1] == 'g')
-                    c = '>';
-            }
-            break;
-          case 4:
-            if (bp[1] == 'a' && bp[2] == 'm' && bp[3] == 'p')
-                c = '&';
-            break;
-          case 5:
-            if (bp[3] == 'o') {
-                if (bp[1] == 'a' && bp[2] == 'p' && bp[4] == 's')
-                    c = '\'';
-                else if (bp[1] == 'q' && bp[2] == 'u' && bp[4] == 't')
-                    c = '"';
-            }
-            break;
-        }
-        if (c == 0) {
-            msg = JSMSG_UNKNOWN_XML_ENTITY;
-            goto bad;
-        }
-    }
-
-    /* If we matched, retract tokenbuf and store the entity's value. */
-    *bp++ = (jschar) c;
-    if (ispair)
-        *bp++ = (jschar) d;
-    tb.shrinkBy(tb.end() - bp);
-    return true;
-
-  badncr:
-    msg = JSMSG_BAD_XML_NCR;
-  bad:
-    /* No match: throw a TypeError per ECMA-357 10.3.2.1 step 8(a). */
-    JS_ASSERT((tb.end() - bp) >= 1);
-    TwoByteChars tbchars(bp + 1, (tb.end() - bp) - 1);
-    bytes = LossyTwoByteCharsToNewLatin1CharsZ(cx, tbchars).c_str();
-    if (bytes) {
-        reportError(msg, bytes);
-        js_free(bytes);
-    }
-    return false;
-}
-
-bool
-TokenStream::getXMLTextOrTag(TokenKind *ttp, Token **tpp)
-{
-    TokenKind tt;
-    int c, qc;
-    Token *tp;
-    JSAtom *atom;
-
-    /*
-     * Look for XML text.
-     */
-    if (flags & TSF_XMLTEXTMODE) {
-        tt = TOK_XMLSPACE;      /* veto if non-space, return TOK_XMLTEXT */
-        tp = newToken(0);
-        tokenbuf.clear();
-        qc = (flags & TSF_XMLONLYMODE) ? '<' : '{';
-
-        while ((c = getChar()) != qc && c != '<' && c != EOF) {
-            if (c == '&' && qc == '<') {
-                if (!getXMLEntity())
-                    goto error;
-                tt = TOK_XMLTEXT;
-                continue;
-            }
-
-            if (!IsXMLSpace(c))
-                tt = TOK_XMLTEXT;
-            if (!tokenbuf.append(c))
-                goto error;
-        }
-        ungetChar(c);
-
-        if (tokenbuf.empty()) {
-            atom = NULL;
-        } else {
-            atom = atomize(cx, tokenbuf);
-            if (!atom)
-                goto error;
-        }
-        tp->pos.end.lineno = lineno;
-        tp->setAtom(JSOP_STRING, atom);
-        goto out;
-    }
-
-    /*
-     * XML tags.
-     */
-    else {
-        JS_ASSERT(flags & TSF_XMLTAGMODE);
-        tp = newToken(0);
-        c = getChar();
-        if (c != EOF && IsXMLSpace(c)) {
-            do {
-                c = getChar();
-                if (c == EOF)
-                    break;
-            } while (IsXMLSpace(c));
-            ungetChar(c);
-            tp->pos.end.lineno = lineno;
-            tt = TOK_XMLSPACE;
-            goto out;
-        }
-
-        if (c == EOF) {
-            tt = TOK_EOF;
-            goto out;
-        }
-
-        tokenbuf.clear();
-        if (IsXMLNamespaceStart(c)) {
-            bool sawColon = false;
-
-            if (!tokenbuf.append(c))
-                goto error;
-            while ((c = getChar()) != EOF && IsXMLNamePart(c)) {
-                if (c == ':') {
-                    int nextc;
-
-                    if (sawColon ||
-                        (nextc = peekChar(),
-                         ((flags & TSF_XMLONLYMODE) || nextc != '{') &&
-                         !IsXMLNamePart(nextc))) {
-                        reportError(JSMSG_BAD_XML_QNAME);
-                        goto error;
-                    }
-                    sawColon = true;
-                }
-
-                if (!tokenbuf.append(c))
-                    goto error;
-            }
-
-            ungetChar(c);
-            atom = atomize(cx, tokenbuf);
-            if (!atom)
-                goto error;
-            tp->setAtom(JSOP_STRING, atom);
-            tt = TOK_XMLNAME;
-            goto out;
-        }
-
-        switch (c) {
-          case '{':
-            if (flags & TSF_XMLONLYMODE)
-                goto bad_xml_char;
-            tt = TOK_LC;
-            goto out;
-
-          case '=':
-            tt = TOK_ASSIGN;
-            goto out;
-
-          case '"':
-          case '\'':
-            qc = c;
-            while ((c = getChar()) != qc) {
-                if (c == EOF) {
-                    reportError(JSMSG_UNTERMINATED_STRING);
-                    goto error;
-                }
-
-                /*
-                 * XML attribute values are double-quoted when pretty-printed,
-                 * so escape " if it is expressed directly in a single-quoted
-                 * attribute value.
-                 */
-                if (c == '"' && !(flags & TSF_XMLONLYMODE)) {
-                    JS_ASSERT(qc == '\'');
-                    if (!tokenbuf.append(js_quot_entity_str,
-                                     strlen(js_quot_entity_str)))
-                        goto error;
-                    continue;
-                }
-
-                if (c == '&' && (flags & TSF_XMLONLYMODE)) {
-                    if (!getXMLEntity())
-                        goto error;
-                    continue;
-                }
-
-                if (!tokenbuf.append(c))
-                    goto error;
-            }
-            atom = atomize(cx, tokenbuf);
-            if (!atom)
-                goto error;
-            tp->pos.end.lineno = lineno;
-            tp->setAtom(JSOP_STRING, atom);
-            tt = TOK_XMLATTR;
-            goto out;
-
-          case '>':
-            tt = TOK_XMLTAGC;
-            goto out;
-
-          case '/':
-            if (matchChar('>')) {
-                tt = TOK_XMLPTAGC;
-                goto out;
-            }
-            /* FALL THROUGH */
-
-          bad_xml_char:
-          default:
-            reportError(JSMSG_BAD_XML_CHARACTER);
-            goto error;
-        }
-        JS_NOT_REACHED("getXMLTextOrTag 1");
-    }
-    JS_NOT_REACHED("getXMLTextOrTag 2");
-
-  out:
-    *ttp = tt;
-    *tpp = tp;
-    return true;
-
-  error:
-    *ttp = TOK_ERROR;
-    *tpp = tp;
-    return false;
-}
-
-/*
- * After much testing, it's clear that Postel's advice to protocol designers
- * ("be liberal in what you accept, and conservative in what you send") invites
- * a natural-law repercussion for JS as "protocol":
- *
- * "If you are liberal in what you accept, others will utterly fail to be
- *  conservative in what they send."
- *
- * Which means you will get <!-- comments to end of line in the middle of .js
- * files, and after if conditions whose then statements are on the next line,
- * and other wonders.  See at least the following bugs:
- * - https://bugzilla.mozilla.org/show_bug.cgi?id=309242
- * - https://bugzilla.mozilla.org/show_bug.cgi?id=309712
- * - https://bugzilla.mozilla.org/show_bug.cgi?id=310993
- *
- * So without JSOPTION_MOAR_XML, we changed around Firefox 1.5 never to scan an
- * XML comment or CDATA literal.  Instead, we always scan <! as the start of an
- * HTML comment hack to end of line, used since Netscape 2 to hide script tag
- * content from script-unaware browsers.
- *
- * But this still leaves XML resources with certain internal structure
- * vulnerable to being loaded as script cross-origin, and some internal data
- * stolen, so for Firefox 3.5 and beyond, we reject programs whose source
- * consists only of XML literals. See:
- *
- * https://bugzilla.mozilla.org/show_bug.cgi?id=336551
- *
- * The check for this is in js::frontend::CompileScript.
- */
-bool
-TokenStream::getXMLMarkup(TokenKind *ttp, Token **tpp)
-{
-    TokenKind tt;
-    int c;
-    Token *tp = *tpp;
-
-    /* Check for XML comment or CDATA section. */
-    if (matchChar('!')) {
-        tokenbuf.clear();
-
-        /* Scan XML comment. */
-        if (matchChar('-')) {
-            if (!matchChar('-'))
-                goto bad_xml_markup;
-            while ((c = getChar()) != '-' || !matchChar('-')) {
-                if (c == EOF)
-                    goto bad_xml_markup;
-                if (!tokenbuf.append(c))
-                    goto error;
-            }
-            if (!matchChar('>'))
-                goto bad_xml_markup;
-
-            JSAtom *commentText = atomize(cx, tokenbuf);
-            if (!commentText)
-                goto error;
-            tp->setAtom(JSOP_XMLCOMMENT, commentText);
-            tp->pos.end.lineno = lineno;
-            tt = TOK_XMLCOMMENT;
-            goto out;
-        }
-
-        /* Scan CDATA section. */
-        if (matchChar('[')) {
-            jschar cp[6];
-            if (peekChars(6, cp) &&
-                cp[0] == 'C' &&
-                cp[1] == 'D' &&
-                cp[2] == 'A' &&
-                cp[3] == 'T' &&
-                cp[4] == 'A' &&
-                cp[5] == '[') {
-                skipChars(6);
-                while ((c = getChar()) != ']' ||
-                       !peekChars(2, cp) ||
-                       cp[0] != ']' ||
-                       cp[1] != '>') {
-                    if (c == EOF)
-                        goto bad_xml_markup;
-                    if (!tokenbuf.append(c))
-                        goto error;
-                }
-                consumeKnownChar(']');
-                consumeKnownChar('>');
-
-                JSAtom *cdataContent = atomize(cx, tokenbuf);
-                if (!cdataContent)
-                    goto error;
-
-                tp->setAtom(JSOP_XMLCDATA, cdataContent);
-                tp->pos.end.lineno = lineno;
-                tt = TOK_XMLCDATA;
-                goto out;
-            }
-            goto bad_xml_markup;
-        }
-    }
-
-    /* Check for processing instruction. */
-    if (matchChar('?')) {
-        bool inTarget = true;
-        size_t targetLength = 0;
-        ptrdiff_t contentIndex = -1;
-
-        tokenbuf.clear();
-        while ((c = getChar()) != '?' || peekChar() != '>') {
-            if (c == EOF)
-                goto bad_xml_markup;
-            if (inTarget) {
-                if (IsXMLSpace(c)) {
-                    if (tokenbuf.empty())
-                        goto bad_xml_markup;
-                    inTarget = false;
-                } else {
-                    if (!(tokenbuf.empty()
-                          ? IsXMLNamespaceStart(c)
-                          : IsXMLNamespacePart(c))) {
-                        goto bad_xml_markup;
-                    }
-                    ++targetLength;
-                }
-            } else {
-                if (contentIndex < 0 && !IsXMLSpace(c))
-                    contentIndex = tokenbuf.length();
-            }
-            if (!tokenbuf.append(c))
-                goto error;
-        }
-        if (targetLength == 0)
-            goto bad_xml_markup;
-
-        JSAtom *data;
-        if (contentIndex < 0) {
-            data = cx->names().empty;
-        } else {
-            data = AtomizeChars<CanGC>(cx, tokenbuf.begin() + contentIndex,
-                                       tokenbuf.length() - contentIndex);
-            if (!data)
-                goto error;
-        }
-        tokenbuf.shrinkBy(tokenbuf.length() - targetLength);
-        consumeKnownChar('>');
-        JSAtom *target = atomize(cx, tokenbuf);
-        if (!target)
-            goto error;
-        tp->setProcessingInstruction(target->asPropertyName(), data);
-        tp->pos.end.lineno = lineno;
-        tt = TOK_XMLPI;
-        goto out;
-    }
-
-    /* An XML start-of-tag character. */
-    tt = matchChar('/') ? TOK_XMLETAGO : TOK_XMLSTAGO;
-
-  out:
-    *ttp = tt;
-    *tpp = tp;
-    return true;
-
-  bad_xml_markup:
-    reportError(JSMSG_BAD_XML_MARKUP);
-  error:
-    *ttp = TOK_ERROR;
-    *tpp = tp;
-    return false;
-}
-#endif /* JS_HAS_XML_SUPPORT */
-
 /*
  * We have encountered a '\': check for a Unicode escape sequence after it.
  * Return 'true' and the character code value (by value) if we found a
  * Unicode escape sequence.  Otherwise, return 'false'.  In both cases, do not
  * advance along the buffer.
  */
 bool
 TokenStream::peekUnicodeEscape(int *result)
@@ -1297,29 +822,19 @@ IsTokenSane(Token *tp)
      */
     if (tp->type < TOK_ERROR || tp->type >= TOK_LIMIT || tp->type == TOK_EOL)
         return false;
 
     if (tp->pos.begin.lineno == tp->pos.end.lineno) {
         if (tp->pos.begin.index > tp->pos.end.index)
             return false;
     } else {
-        /* Only certain token kinds can be multi-line. */
-        switch (tp->type) {
-          case TOK_STRING:
-          case TOK_XMLATTR:
-          case TOK_XMLSPACE:
-          case TOK_XMLTEXT:
-          case TOK_XMLCOMMENT:
-          case TOK_XMLCDATA:
-          case TOK_XMLPI:
-            break;
-          default:
+        /* Only string tokens can be multi-line. */
+        if (tp->type != TOK_STRING)
             return false;
-        }
     }
     return true;
 }
 #endif
 
 bool
 TokenStream::putIdentInTokenbuf(const jschar *identStart)
 {
@@ -1439,27 +954,16 @@ TokenStream::getTokenInternal()
     Token *tp;
     FirstCharKind c1kind;
     const jschar *numStart;
     bool hasExp;
     DecimalPoint decimalPoint;
     const jschar *identStart;
     bool hadUnicodeEscape;
 
-#if JS_HAS_XML_SUPPORT
-    /*
-     * Look for XML text and tags.
-     */
-    if (flags & (TSF_XMLTEXTMODE|TSF_XMLTAGMODE)) {
-        if (!getXMLTextOrTag(&tt, &tp))
-            goto error;
-        goto out;
-    }
-#endif
-
   retry:
     if (JS_UNLIKELY(!userbuf.hasRawChars())) {
         tp = newToken(0);
         tt = TOK_EOF;
         flags |= TSF_EOF;
         goto out;
     }
 
@@ -1601,20 +1105,16 @@ TokenStream::getTokenInternal()
         }
         if (c == '.') {
             qc = getCharIgnoreEOL();
             if (qc == '.') {
                 tt = TOK_TRIPLEDOT;
                 goto out;
             }
             ungetCharIgnoreEOL(qc);
-#if JS_HAS_XML_SUPPORT
-            tt = TOK_DBLDOT;
-            goto out;
-#endif
         }
         ungetCharIgnoreEOL(c);
         tt = TOK_DOT;
         goto out;
     }
 
     if (c1kind == Equals) {
         if (matchChar('=')) {
@@ -1791,22 +1291,16 @@ TokenStream::getTokenInternal()
                 goto error;
         }
         tp->setNumber(dval, decimalPoint);
         tt = TOK_NUMBER;
         goto out;
     }
 
     if (c1kind == Colon) {
-#if JS_HAS_XML_SUPPORT
-        if (matchChar(':')) {
-            tt = TOK_DBLCOLON;
-            goto out;
-        }
-#endif
         tp->t_op = JSOP_NOP;
         tt = TOK_COLON;
         goto out;
     }
 
     if (c1kind == Plus) {
         if (matchChar('=')) {
             tp->t_op = JSOP_ADD;
@@ -1934,31 +1428,17 @@ TokenStream::getTokenInternal()
                 tt = TOK_NE;
             }
         } else {
             tp->t_op = JSOP_NOT;
             tt = TOK_NOT;
         }
         break;
 
-#if JS_HAS_XML_SUPPORT
-      case '@':
-        tt = TOK_AT;
-        break;
-#endif
-
       case '<':
-#if JS_HAS_XML_SUPPORT
-        if ((flags & TSF_OPERAND) && allowsXML() && (hasMoarXML() || peekChar() != '!')) {
-            if (!getXMLMarkup(&tt, &tp))
-                goto error;
-            goto out;
-        }
-#endif
-
         /* NB: treat HTML begin-comment as comment-till-end-of-line */
         if (matchChar('!')) {
             if (matchChar('-')) {
                 if (matchChar('-')) {
                     flags |= TSF_IN_HTML_COMMENT;
                     goto skipline;
                 }
                 ungetChar('-');
@@ -2275,33 +1755,16 @@ TokenKindToString(TokenKind tt)
       case TOK_NEW:             return "TOK_NEW";
       case TOK_DELETE:          return "TOK_DELETE";
       case TOK_TRY:             return "TOK_TRY";
       case TOK_CATCH:           return "TOK_CATCH";
       case TOK_FINALLY:         return "TOK_FINALLY";
       case TOK_THROW:           return "TOK_THROW";
       case TOK_INSTANCEOF:      return "TOK_INSTANCEOF";
       case TOK_DEBUGGER:        return "TOK_DEBUGGER";
-      case TOK_XMLSTAGO:        return "TOK_XMLSTAGO";
-      case TOK_XMLETAGO:        return "TOK_XMLETAGO";
-      case TOK_XMLPTAGC:        return "TOK_XMLPTAGC";
-      case TOK_XMLTAGC:         return "TOK_XMLTAGC";
-      case TOK_XMLNAME:         return "TOK_XMLNAME";
-      case TOK_XMLATTR:         return "TOK_XMLATTR";
-      case TOK_XMLSPACE:        return "TOK_XMLSPACE";
-      case TOK_XMLTEXT:         return "TOK_XMLTEXT";
-      case TOK_XMLCOMMENT:      return "TOK_XMLCOMMENT";
-      case TOK_XMLCDATA:        return "TOK_XMLCDATA";
-      case TOK_XMLPI:           return "TOK_XMLPI";
-      case TOK_AT:              return "TOK_AT";
-      case TOK_DBLCOLON:        return "TOK_DBLCOLON";
-      case TOK_DBLDOT:          return "TOK_DBLDOT";
-      case TOK_FILTER:          return "TOK_FILTER";
-      case TOK_XMLELEM:         return "TOK_XMLELEM";
-      case TOK_XMLLIST:         return "TOK_XMLLIST";
       case TOK_YIELD:           return "TOK_YIELD";
       case TOK_LEXICALSCOPE:    return "TOK_LEXICALSCOPE";
       case TOK_LET:             return "TOK_LET";
       case TOK_RESERVED:        return "TOK_RESERVED";
       case TOK_STRICT_RESERVED: return "TOK_STRICT_RESERVED";
       case TOK_STRICTEQ:        return "TOK_STRICTEQ";
       case TOK_EQ:              return "TOK_EQ";
       case TOK_STRICTNE:        return "TOK_STRICTNE";
--- a/js/src/frontend/TokenStream.h
+++ b/js/src/frontend/TokenStream.h
@@ -77,33 +77,16 @@ enum TokenKind {
     TOK_NEW,                       /* new keyword */
     TOK_DELETE,                    /* delete keyword */
     TOK_TRY,                       /* try keyword */
     TOK_CATCH,                     /* catch keyword */
     TOK_FINALLY,                   /* finally keyword */
     TOK_THROW,                     /* throw keyword */
     TOK_INSTANCEOF,                /* instanceof keyword */
     TOK_DEBUGGER,                  /* debugger keyword */
-    TOK_XMLSTAGO,                  /* XML start tag open (<) */
-    TOK_XMLETAGO,                  /* XML end tag open (</) */
-    TOK_XMLPTAGC,                  /* XML point tag close (/>) */
-    TOK_XMLTAGC,                   /* XML start or end tag close (>) */
-    TOK_XMLNAME,                   /* XML start-tag non-final fragment */
-    TOK_XMLATTR,                   /* XML quoted attribute value */
-    TOK_XMLSPACE,                  /* XML whitespace */
-    TOK_XMLTEXT,                   /* XML text */
-    TOK_XMLCOMMENT,                /* XML comment */
-    TOK_XMLCDATA,                  /* XML CDATA section */
-    TOK_XMLPI,                     /* XML processing instruction */
-    TOK_AT,                        /* XML attribute op (@) */
-    TOK_DBLCOLON,                  /* namespace qualified name op (::) */
-    TOK_DBLDOT,                    /* XML descendant op (..) */
-    TOK_FILTER,                    /* XML filtering predicate op (.()) */
-    TOK_XMLELEM,                   /* XML element node type (no token) */
-    TOK_XMLLIST,                   /* XML list node type (no token) */
     TOK_YIELD,                     /* yield from generator function */
     TOK_LEXICALSCOPE,              /* block scope AST node label */
     TOK_LET,                       /* let keyword */
     TOK_EXPORT,                    /* export keyword */
     TOK_IMPORT,                    /* import keyword */
     TOK_RESERVED,                  /* reserved keywords */
     TOK_STRICT_RESERVED,           /* reserved keywords in strict mode */
 
@@ -287,20 +270,16 @@ struct Token {
                 friend struct Token;
                 PropertyName *name;     /* non-numeric atom */
                 JSAtom       *atom;     /* potentially-numeric atom */
             } n;
         } s;
 
       private:
         friend struct Token;
-        struct {                        /* pair for <?target data?> XML PI */
-            PropertyName *target;       /* non-empty */
-            JSAtom       *data;         /* maybe empty, never null */
-        } xmlpi;
         struct {
             double       value;         /* floating point number */
             DecimalPoint decimalPoint;  /* literal contains . or exponent */
         } number;
         RegExpFlag      reflags;        /* regexp flags, use tokenbuf to access
                                            regexp chars */
     } u;
 
@@ -314,32 +293,22 @@ struct Token {
     void setName(JSOp op, PropertyName *name) {
         JS_ASSERT(op == JSOP_NAME);
         JS_ASSERT(!IsPoisonedPtr(name));
         u.s.op = op;
         u.s.n.name = name;
     }
 
     void setAtom(JSOp op, JSAtom *atom) {
-        JS_ASSERT(op == JSOP_STRING || op == JSOP_XMLCOMMENT || JSOP_XMLCDATA);
+        JS_ASSERT(op == JSOP_STRING);
         JS_ASSERT(!IsPoisonedPtr(atom));
         u.s.op = op;
         u.s.n.atom = atom;
     }
 
-    void setProcessingInstruction(PropertyName *target, JSAtom *data) {
-        JS_ASSERT(target);
-        JS_ASSERT(data);
-        JS_ASSERT(!target->empty());
-        JS_ASSERT(!IsPoisonedPtr(target));
-        JS_ASSERT(!IsPoisonedPtr(data));
-        u.xmlpi.target = target;
-        u.xmlpi.data = data;
-    }
-
     void setRegExpFlags(js::RegExpFlag flags) {
         JS_ASSERT((flags & AllFlags) == flags);
         u.reflags = flags;
     }
 
     void setNumber(double n, DecimalPoint decimalPoint) {
         u.number.value = n;
         u.number.decimalPoint = decimalPoint;
@@ -348,35 +317,20 @@ struct Token {
     /* Type-safe accessors */
 
     PropertyName *name() const {
         JS_ASSERT(type == TOK_NAME);
         return u.s.n.name->asPropertyName(); /* poor-man's type verification */
     }
 
     JSAtom *atom() const {
-        JS_ASSERT(type == TOK_STRING ||
-                  type == TOK_XMLNAME ||
-                  type == TOK_XMLATTR ||
-                  type == TOK_XMLTEXT ||
-                  type == TOK_XMLCDATA ||
-                  type == TOK_XMLSPACE ||
-                  type == TOK_XMLCOMMENT);
+        JS_ASSERT(type == TOK_STRING);
         return u.s.n.atom;
     }
 
-    PropertyName *xmlPITarget() const {
-        JS_ASSERT(type == TOK_XMLPI);
-        return u.xmlpi.target;
-    }
-    JSAtom *xmlPIData() const {
-        JS_ASSERT(type == TOK_XMLPI);
-        return u.xmlpi.data;
-    }
-
     js::RegExpFlag regExpFlags() const {
         JS_ASSERT(type == TOK_REGEXP);
         JS_ASSERT((u.reflags & AllFlags) == u.reflags);
         return u.reflags;
     }
 
     double number() const {
         JS_ASSERT(type == TOK_NUMBER);
@@ -395,21 +349,18 @@ enum TokenStreamFlags
 {
     TSF_EOF = 0x02,             /* hit end of file */
     TSF_EOL = 0x04,             /* an EOL was hit in whitespace or a multi-line comment */
     TSF_OPERAND = 0x08,         /* looking for operand, not operator */
     TSF_UNEXPECTED_EOF = 0x10,  /* unexpected end of input, i.e. TOK_EOF not at top-level. */
     TSF_KEYWORD_IS_NAME = 0x20, /* Ignore keywords and return TOK_NAME instead to the parser. */
     TSF_DIRTYLINE = 0x40,       /* non-whitespace since start of line */
     TSF_OWNFILENAME = 0x80,     /* ts->filename is malloc'd */
-    TSF_XMLTAGMODE = 0x100,     /* scanning within an XML tag in E4X */
-    TSF_XMLTEXTMODE = 0x200,    /* scanning XMLText terminal from E4X */
-    TSF_XMLONLYMODE = 0x400,    /* don't scan {expr} within text/tag */
-    TSF_OCTAL_CHAR = 0x800,     /* observed a octal character escape */
-    TSF_HAD_ERROR = 0x1000,     /* returned TOK_ERROR from getToken */
+    TSF_OCTAL_CHAR = 0x100,     /* observed a octal character escape */
+    TSF_HAD_ERROR = 0x200,      /* returned TOK_ERROR from getToken */
 
     /*
      * To handle the hard case of contiguous HTML comments, we want to clear the
      * TSF_DIRTYINPUT flag at the end of each such comment.  But we'd rather not
      * scan for --> within every //-style comment unless we have to.  So we set
      * TSF_IN_HTML_COMMENT when a <!-- is scanned as an HTML begin-comment, and
      * clear it (and TSF_DIRTYINPUT) when we scan --> either on a clean line, or
      * only if (ts->flags & TSF_IN_HTML_COMMENT), in a //-style comment.
@@ -499,24 +450,18 @@ class TokenStream
         return type == type1 || type == type2;
     }
     size_t offsetOfToken(const Token &tok) const {
         return tok.ptr - userbuf.base();
     }
     const CharBuffer &getTokenbuf() const { return tokenbuf; }
     const char *getFilename() const { return filename; }
     unsigned getLineno() const { return lineno; }
-    /* Note that the version and hasMoarXML can get out of sync via setMoarXML. */
     JSVersion versionNumber() const { return VersionNumber(version); }
     JSVersion versionWithFlags() const { return version; }
-    bool allowsXML() const { return banXML == 0 && !strictMode(); }
-    bool hasMoarXML() const { return moarXML || VersionShouldParseXML(versionNumber()); }
-    void setMoarXML(bool enabled) { moarXML = enabled; }
-    void incBanXML() { banXML++; }
-    void decBanXML() { JS_ASSERT(banXML); banXML--; }
     bool hadError() const { return !!(flags & TSF_HAD_ERROR); }
 
     bool isCurrentTokenEquality() const {
         return TokenKindIsEquality(currentToken().type);
     }
 
     bool isCurrentTokenRelational() const {
         return TokenKindIsRelational(currentToken().type);
@@ -526,22 +471,18 @@ class TokenStream
         return TokenKindIsShift(currentToken().type);
     }
 
     bool isCurrentTokenAssignment() const {
         return TokenKindIsAssignment(currentToken().type);
     }
 
     /* Flag methods. */
-    void setXMLTagMode(bool enabled = true) { setFlag(enabled, TSF_XMLTAGMODE); }
-    void setXMLOnlyMode(bool enabled = true) { setFlag(enabled, TSF_XMLONLYMODE); }
     void setUnexpectedEOF(bool enabled = true) { setFlag(enabled, TSF_UNEXPECTED_EOF); }
 
-    bool isXMLTagMode() const { return !!(flags & TSF_XMLTAGMODE); }
-    bool isXMLOnlyMode() const { return !!(flags & TSF_XMLONLYMODE); }
     bool isUnexpectedEOF() const { return !!(flags & TSF_UNEXPECTED_EOF); }
     bool isEOF() const { return !!(flags & TSF_EOF); }
     bool sawOctalEscape() const { return !!(flags & TSF_OCTAL_CHAR); }
 
     // TokenStream-specific error reporters.
     bool reportError(unsigned errorNumber, ...);
     bool reportWarning(unsigned errorNumber, ...);
 
@@ -590,17 +531,16 @@ class TokenStream
   public:
     /*
      * Get the next token from the stream, make it the current token, and
      * return its kind.
      */
     TokenKind getToken() {
         /* Check for a pushed-back token resulting from mismatching lookahead. */
         if (lookahead != 0) {
-            JS_ASSERT(!(flags & TSF_XMLTEXTMODE));
             lookahead--;
             cursor = (cursor + 1) & ntokensMask;
             TokenKind tt = currentToken().type;
             JS_ASSERT(tt != TOK_EOL);
             return tt;
         }
 
         return getTokenInternal();
@@ -826,20 +766,16 @@ class TokenStream
     Token *newToken(ptrdiff_t adjust);
     bool peekUnicodeEscape(int32_t *c);
     bool matchUnicodeEscapeIdStart(int32_t *c);
     bool matchUnicodeEscapeIdent(int32_t *c);
     bool peekChars(int n, jschar *cp);
     bool getAtLine();
     bool getAtSourceMappingURL();
 
-    bool getXMLEntity();
-    bool getXMLTextOrTag(TokenKind *ttp, Token **tpp);
-    bool getXMLMarkup(TokenKind *ttp, Token **tpp);
-
     bool matchChar(int32_t expect) {
         int32_t c = getChar();
         if (c == expect)
             return true;
         ungetChar(c);
         return false;
     }
 
@@ -873,18 +809,16 @@ class TokenStream
     const char          *filename;      /* input filename or null */
     jschar              *sourceMap;     /* source map's filename or null */
     void                *listenerTSData;/* listener data for this TokenStream */
     CharBuffer          tokenbuf;       /* current token string buffer */
     int8_t              oneCharTokens[128];  /* table of one-char tokens */
     bool                maybeEOL[256];       /* probabilistic EOL lookup table */
     bool                maybeStrSpecial[256];/* speeds up string scanning */
     JSVersion           version;        /* (i.e. to identify keywords) */
-    unsigned            banXML;         /* see JSOPTION_ALLOW_XML */
-    bool                moarXML;        /* see JSOPTION_MOAR_XML */
     JSContext           *const cx;
     JSPrincipals        *const originPrincipals;
     StrictModeGetter    *strictModeGetter; /* used to test for strict mode */
     Position            lastFunctionKeyword; /* used as a starting point for reparsing strict functions */
 
     /*
      * The tokens array stores pointers to JSAtoms. These are rooted by the
      * atoms table using AutoKeepAtoms in the Parser. This SkipRoot tells the
--- a/js/src/gc/Barrier.h
+++ b/js/src/gc/Barrier.h
@@ -110,18 +110,16 @@
  *
  * One additional note: not all object writes need to be barriered. Writes to
  * newly allocated objects do not need a pre-barrier.  In these cases, we use
  * the "obj->field.init(value)" method instead of "obj->field = value". We use
  * the init naming idiom in many places to signify that a field is being
  * assigned for the first time.
  */
 
-struct JSXML;
-
 namespace js {
 
 template<class T, typename Unioned = uintptr_t>
 class EncapsulatedPtr
 {
   protected:
     union {
         T *value;
@@ -332,17 +330,16 @@ typedef RelocatablePtr<JSScript> Relocat
 
 typedef HeapPtr<JSObject> HeapPtrObject;
 typedef HeapPtr<JSFunction> HeapPtrFunction;
 typedef HeapPtr<JSString> HeapPtrString;
 typedef HeapPtr<JSScript> HeapPtrScript;
 typedef HeapPtr<Shape> HeapPtrShape;
 typedef HeapPtr<BaseShape> HeapPtrBaseShape;
 typedef HeapPtr<types::TypeObject> HeapPtrTypeObject;
-typedef HeapPtr<JSXML> HeapPtrXML;
 
 /* Useful for hashtables with a HeapPtr as key. */
 template<class T>
 struct HeapPtrHasher
 {
     typedef HeapPtr<T> Key;
     typedef T *Lookup;
 
--- a/js/src/gc/Heap.h
+++ b/js/src/gc/Heap.h
@@ -48,19 +48,16 @@ enum AllocKind {
     FINALIZE_OBJECT12_BACKGROUND,
     FINALIZE_OBJECT16,
     FINALIZE_OBJECT16_BACKGROUND,
     FINALIZE_OBJECT_LAST = FINALIZE_OBJECT16_BACKGROUND,
     FINALIZE_SCRIPT,
     FINALIZE_SHAPE,
     FINALIZE_BASE_SHAPE,
     FINALIZE_TYPE_OBJECT,
-#if JS_HAS_XML_SUPPORT
-    FINALIZE_XML,
-#endif
     FINALIZE_SHORT_STRING,
     FINALIZE_STRING,
     FINALIZE_EXTERNAL_STRING,
     FINALIZE_IONCODE,
     FINALIZE_LAST = FINALIZE_IONCODE
 };
 
 static const unsigned FINALIZE_LIMIT = FINALIZE_LAST + 1;
--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@@ -4,17 +4,16 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "mozilla/DebugOnly.h"
 
 #include "jsprf.h"
 #include "jsstr.h"
-#include "jsxml.h"
 
 #include "gc/Marking.h"
 #include "methodjit/MethodJIT.h"
 #include "vm/Shape.h"
 
 #include "jsobjinlines.h"
 
 #include "ion/IonCode.h"
@@ -53,21 +52,16 @@ void * const js::NullPtr::constNullValue
  * The MarkX functions also handle non-GC object traversal. In this case, they
  * call a callback for each object visited. This is a recursive process; the
  * mark stacks are not involved. These callbacks may ask for the outgoing
  * pointers to be visited. Eventually, this leads to the MarkChildren functions
  * being called. These functions duplicate much of the functionality of
  * scanning functions, but they don't push onto an explicit stack.
  */
 
-#if JS_HAS_XML_SUPPORT
-static inline void
-PushMarkStack(GCMarker *gcmarker, JSXML *thing);
-#endif
-
 static inline void
 PushMarkStack(GCMarker *gcmarker, JSObject *thing);
 
 static inline void
 PushMarkStack(GCMarker *gcmarker, JSFunction *thing);
 
 static inline void
 PushMarkStack(GCMarker *gcmarker, UnrootedScript thing);
@@ -85,19 +79,16 @@ namespace js {
 namespace gc {
 
 static void MarkChildren(JSTracer *trc, JSString *str);
 static void MarkChildren(JSTracer *trc, UnrootedScript script);
 static void MarkChildren(JSTracer *trc, UnrootedShape shape);
 static void MarkChildren(JSTracer *trc, UnrootedBaseShape base);
 static void MarkChildren(JSTracer *trc, types::TypeObject *type);
 static void MarkChildren(JSTracer *trc, ion::IonCode *code);
-#if JS_HAS_XML_SUPPORT
-static void MarkChildren(JSTracer *trc, JSXML *xml);
-#endif
 
 } /* namespace gc */
 } /* namespace js */
 
 /*** Object Marking ***/
 
 #ifdef DEBUG
 template<typename T>
@@ -343,19 +334,16 @@ DeclMarkerImpl(Object, ScopeObject)
 DeclMarkerImpl(Script, JSScript)
 DeclMarkerImpl(Shape, Shape)
 DeclMarkerImpl(String, JSAtom)
 DeclMarkerImpl(String, JSString)
 DeclMarkerImpl(String, JSFlatString)
 DeclMarkerImpl(String, JSLinearString)
 DeclMarkerImpl(String, PropertyName)
 DeclMarkerImpl(TypeObject, js::types::TypeObject)
-#if JS_HAS_XML_SUPPORT
-DeclMarkerImpl(XML, JSXML)
-#endif
 
 } /* namespace gc */
 } /* namespace js */
 
 /*** Externally Typed Marking ***/
 
 void
 gc::MarkKind(JSTracer *trc, void **thingp, JSGCTraceKind kind)
@@ -380,21 +368,16 @@ gc::MarkKind(JSTracer *trc, void **thing
         MarkInternal(trc, reinterpret_cast<RawBaseShape *>(thingp));
         break;
       case JSTRACE_TYPE_OBJECT:
         MarkInternal(trc, reinterpret_cast<types::TypeObject **>(thingp));
         break;
       case JSTRACE_IONCODE:
         MarkInternal(trc, reinterpret_cast<ion::IonCode **>(thingp));
         break;
-#if JS_HAS_XML_SUPPORT
-      case JSTRACE_XML:
-        MarkInternal(trc, reinterpret_cast<JSXML **>(thingp));
-        break;
-#endif
     }
 }
 
 static void
 MarkGCThingInternal(JSTracer *trc, void **thingp, const char *name)
 {
     JS_SET_TRACING_NAME(trc, name);
     JS_ASSERT(thingp);
@@ -730,27 +713,16 @@ gc::IsCellAboutToBeFinalized(Cell **thin
 
 #define JS_COMPARTMENT_ASSERT(rt, thing)                                \
     JS_ASSERT((thing)->zone()->isGCMarking())
 
 #define JS_COMPARTMENT_ASSERT_STR(rt, thing)                            \
     JS_ASSERT((thing)->zone()->isGCMarking() ||                         \
               (thing)->compartment() == (rt)->atomsCompartment);
 
-#if JS_HAS_XML_SUPPORT
-static void
-PushMarkStack(GCMarker *gcmarker, JSXML *thing)
-{
-    JS_COMPARTMENT_ASSERT(gcmarker->runtime, thing);
-
-    if (thing->markIfUnmarked(gcmarker->getMarkColor()))
-        gcmarker->pushXML(thing);
-}
-#endif
-
 static void
 PushMarkStack(GCMarker *gcmarker, JSObject *thing)
 {
     JS_COMPARTMENT_ASSERT(gcmarker->runtime, thing);
 
     if (thing->markIfUnmarked(gcmarker->getMarkColor()))
         gcmarker->pushObject(thing);
 }
@@ -1113,24 +1085,16 @@ gc::MarkChildren(JSTracer *trc, types::T
 static void
 gc::MarkChildren(JSTracer *trc, ion::IonCode *code)
 {
 #ifdef JS_ION
     code->trace(trc);
 #endif
 }
 
-#if JS_HAS_XML_SUPPORT
-static void
-gc::MarkChildren(JSTracer *trc, JSXML *xml)
-{
-    js_TraceXML(trc, xml);
-}
-#endif
-
 template<typename T>
 static void
 PushArenaTyped(GCMarker *gcmarker, ArenaHeader *aheader)
 {
     for (CellIterUnderGC i(aheader); !i.done(); i.next())
         PushMarkStack(gcmarker, i.get<T>());
 }
 
@@ -1160,22 +1124,16 @@ gc::PushArena(GCMarker *gcmarker, ArenaH
 
       case JSTRACE_TYPE_OBJECT:
         PushArenaTyped<js::types::TypeObject>(gcmarker, aheader);
         break;
 
       case JSTRACE_IONCODE:
         PushArenaTyped<js::ion::IonCode>(gcmarker, aheader);
         break;
-
-#if JS_HAS_XML_SUPPORT
-      case JSTRACE_XML:
-        PushArenaTyped<JSXML>(gcmarker, aheader);
-        break;
-#endif
     }
 }
 
 struct SlotArrayLayout
 {
     union {
         HeapSlot *end;
         HeapSlot::Kind kind;
@@ -1321,23 +1279,16 @@ GCMarker::processMarkStackOther(SliceBud
                 }
             }
             if (budget.isOverBudget()) {
                 pushArenaList(aheader);
                 return;
             }
         }
     }
-
-#if JS_HAS_XML_SUPPORT
-    else {
-        JS_ASSERT(tag == XmlTag);
-        MarkChildren(this, reinterpret_cast<JSXML *>(addr));
-    }
-#endif
 }
 
 inline void
 GCMarker::processMarkStackTop(SliceBudget &budget)
 {
     /*
      * The function uses explicit goto and implements the scanning of the
      * object directly. It allows to eliminate the tail recursion and
@@ -1521,22 +1472,16 @@ js::TraceChildren(JSTracer *trc, void *t
 
       case JSTRACE_BASE_SHAPE:
         MarkChildren(trc, static_cast<RawBaseShape>(thing));
         break;
 
       case JSTRACE_TYPE_OBJECT:
         MarkChildren(trc, (types::TypeObject *)thing);
         break;
-
-#if JS_HAS_XML_SUPPORT
-      case JSTRACE_XML:
-        MarkChildren(trc, static_cast<JSXML *>(thing));
-        break;
-#endif
     }
 }
 
 void
 js::CallTracer(JSTracer *trc, void *thing, JSGCTraceKind kind)
 {
     JS_ASSERT(thing);
     void *tmp = thing;
--- a/js/src/gc/Marking.h
+++ b/js/src/gc/Marking.h
@@ -101,19 +101,16 @@ DeclMarker(Object, ScopeObject)
 DeclMarker(Script, JSScript)
 DeclMarker(Shape, Shape)
 DeclMarker(String, JSAtom)
 DeclMarker(String, JSString)
 DeclMarker(String, JSFlatString)
 DeclMarker(String, JSLinearString)
 DeclMarker(String, PropertyName)
 DeclMarker(TypeObject, types::TypeObject)
-#if JS_HAS_XML_SUPPORT
-DeclMarker(XML, JSXML)
-#endif
 
 #undef DeclMarker
 
 /*** Externally Typed Marking ***/
 
 /*
  * Note: this must only be called by the GC and only when we are tracing through
  * MarkRoots. It is explicitly for ConservativeStackMarking and should go away
@@ -264,24 +261,16 @@ Mark(JSTracer *trc, EncapsulatedPtrObjec
 }
 
 inline void
 Mark(JSTracer *trc, EncapsulatedPtrScript *o, const char *name)
 {
     MarkScript(trc, o, name);
 }
 
-#if JS_HAS_XML_SUPPORT
-inline void
-Mark(JSTracer *trc, HeapPtr<JSXML> *xml, const char *name)
-{
-    MarkXML(trc, xml, name);
-}
-#endif
-
 inline void
 Mark(JSTracer *trc, HeapPtr<ion::IonCode> *code, const char *name)
 {
     MarkIonCode(trc, code, name);
 }
 
 bool
 IsCellMarked(Cell **thingp);
--- a/js/src/gc/RootMarking.cpp
+++ b/js/src/gc/RootMarking.cpp
@@ -418,29 +418,16 @@ AutoGCRooter::trace(JSTracer *trc)
         if (desc.attrs & JSPROP_SETTER && desc.setter) {
             JSObject *tmp = JS_FUNC_TO_DATA_PTR(JSObject *, desc.setter);
             MarkObjectRoot(trc, &tmp, "Descriptor::set");
             desc.setter = JS_DATA_TO_FUNC_PTR(JSStrictPropertyOp, tmp);
         }
         return;
       }
 
-#if JS_HAS_XML_SUPPORT
-      case NAMESPACES: {
-        JSXMLArray<JSObject> &array = static_cast<AutoNamespaceArray *>(this)->array;
-        MarkObjectRange(trc, array.length, array.vector, "JSXMLArray.vector");
-        js_XMLArrayCursorTrace(trc, array.cursors);
-        return;
-      }
-
-      case XML:
-        js_TraceXML(trc, static_cast<AutoXMLRooter *>(this)->xml);
-        return;
-#endif
-
       case OBJECT:
         if (static_cast<AutoObjectRooter *>(this)->obj)
             MarkObjectRoot(trc, &static_cast<AutoObjectRooter *>(this)->obj,
                            "JS::AutoObjectRooter.obj");
         return;
 
       case ID:
         MarkIdRoot(trc, &static_cast<AutoIdRooter *>(this)->id_, "JS::AutoIdRooter.id_");
--- a/js/src/gc/StoreBuffer.h
+++ b/js/src/gc/StoreBuffer.h
@@ -7,19 +7,16 @@
 
 #ifdef JSGC_GENERATIONAL
 #ifndef jsgc_storebuffer_h___
 #define jsgc_storebuffer_h___
 
 #ifndef JSGC_USE_EXACT_ROOTING
 # error "Generational GC requires exact rooting."
 #endif
-#ifdef JSGC_HAS_XML_SUPPORT
-# error "E4X must be disabled to enable generational GC."
-#endif
 
 #include "jsgc.h"
 #include "jsalloc.h"
 
 #include "gc/Marking.h"
 
 namespace js {
 namespace gc {
--- a/js/src/gc/Verifier.cpp
+++ b/js/src/gc/Verifier.cpp
@@ -196,19 +196,17 @@ SuppressCheckRoots(Vector<Rooter, 0, Sys
     return false;
 }
 
 void
 JS::CheckStackRoots(JSContext *cx)
 {
     JSRuntime *rt = cx->runtime;
 
-    if (rt->gcZeal_ != ZealStackRootingSafeValue && rt->gcZeal_ != ZealStackRootingValue)
-        return;
-    if (rt->gcZeal_ == ZealStackRootingSafeValue && !rt->gcExactScanningEnabled)
+    if (rt->gcZeal_ != ZealStackRootingValue)
         return;
 
     // If this assertion fails, it means that an AutoAssertNoGC was placed
     // around code that could trigger GC, and is therefore wrong. The
     // AutoAssertNoGC should be removed and the code it was guarding should be
     // modified to properly root any gcthings, and very possibly any code
     // calling that function should also be modified if it was improperly
     // assuming that GC could not happen at all within the called function.
@@ -643,18 +641,17 @@ struct VerifyPostTracer : JSTracer {
  * The post-barrier verifier runs the full store buffer and a fake nursery when
  * running and when it stops, walks the full heap to ensure that all the
  * important edges were inserted into the storebuffer.
  */
 void
 gc::StartVerifyPostBarriers(JSRuntime *rt)
 {
 #ifdef JSGC_GENERATIONAL
-    if (!rt->gcExactScanningEnabled ||
-        rt->gcVerifyPostData ||
+    if (rt->gcVerifyPostData ||
         rt->gcIncrementalState != NO_INCREMENTAL)
     {
         return;
     }
     VerifyPostTracer *trc = js_new<VerifyPostTracer>();
     rt->gcVerifyPostData = trc;
     rt->gcNumber++;
     trc->number = rt->gcNumber;
@@ -729,19 +726,16 @@ js::gc::EndVerifyPostBarriers(JSRuntime 
 {
 #ifdef JSGC_GENERATIONAL
     AutoPrepareForTracing prep(rt);
 
     VerifyPostTracer *trc = (VerifyPostTracer *)rt->gcVerifyPostData;
     JS_TracerInit(trc, rt, PostVerifierVisitEdge);
     trc->count = 0;
 
-    if (!rt->gcExactScanningEnabled)
-        goto oom;
-
     for (CompartmentsIter c(rt); !c.done(); c.next()) {
         if (c->gcStoreBuffer.hasOverflowed())
             continue;
         if (!c->gcStoreBuffer.coalesceForVerification())
             goto oom;
     }
 
     /* Walk the heap. */
--- a/js/src/gdb/mozilla/jsid.py
+++ b/js/src/gdb/mozilla/jsid.py
@@ -13,17 +13,16 @@ class jsid(object):
     # Since people don't always build with macro debugging info, I can't
     # think of any way to avoid copying these values here, short of using
     # inferior calls for every operation (which, I hear, is broken from
     # pretty-printers in some recent GDBs).
     TYPE_STRING                 = 0x0
     TYPE_INT                    = 0x1
     TYPE_VOID                   = 0x2
     TYPE_OBJECT                 = 0x4
-    TYPE_DEFAULT_XML_NAMESPACE  = 0x6
     TYPE_MASK                   = 0x7
 
     def __init__(self, value, cache):
         self.value = value
         self.cache = cache
 
     # SpiderMonkey has two alternative definitions of jsid: a typedef for
     # ptrdiff_t, and a struct with == and != operators defined on it.
@@ -44,13 +43,11 @@ class jsid(object):
             body = bits.cast(self.cache.JSString_ptr_t)
         elif tag & jsid.TYPE_INT:
             body = bits >> 1
         elif tag == jsid.TYPE_VOID:
             return "JSID_VOID"
         elif tag == jsid.TYPE_OBJECT:
             body = ((bits & ~jsid.TYPE_MASK)
                     .cast(self.cache.JSObject_ptr_t))
-        elif tag == jsid.TYPE_DEFAULT_XML_NAMESPACE:
-            return "JS_DEFAULT_XML_NAMESPACE_ID"
         else:
             body = "<unrecognized>"
         return '$jsid(%s)' % (body,)
--- a/js/src/gdb/tests/test-jsid.cpp
+++ b/js/src/gdb/tests/test-jsid.cpp
@@ -2,20 +2,18 @@
 
 FRAGMENT(jsid, simple) {
   js::Rooted<JSString *> string(cx, JS_NewStringCopyZ(cx, "moon"));
   js::Rooted<JSString *> interned(cx, JS_InternJSString(cx, string));
   js::Rooted<jsid> string_id(cx, INTERNED_STRING_TO_JSID(cx, interned));
   jsid int_id = INT_TO_JSID(1729);
   jsid void_id = JSID_VOID;
   js::Rooted<jsid> object_id(cx, OBJECT_TO_JSID(JS_GetGlobalObject(cx)));
-  jsid xml_id = JS_DEFAULT_XML_NAMESPACE_ID;
 
   breakpoint();
 
   (void) string;
   (void) interned;
   (void) string_id;
   (void) int_id;
   (void) void_id;
   (void) object_id;
-  (void) xml_id;
 }
--- a/js/src/gdb/tests/test-jsid.py
+++ b/js/src/gdb/tests/test-jsid.py
@@ -3,9 +3,8 @@
 assert_subprinter_registered('SpiderMonkey', 'jsid')
 
 run_fragment('jsid.simple')
 
 assert_pretty('string_id', '$jsid("moon")')
 assert_pretty('int_id', '$jsid(1729)')
 assert_pretty('void_id', 'JSID_VOID')
 assert_pretty('object_id', '$jsid((JSObject *)  [object global] delegate)')
-assert_pretty('xml_id', 'JS_DEFAULT_XML_NAMESPACE_ID')
--- a/js/src/ion/IonCaches.cpp
+++ b/js/src/ion/IonCaches.cpp
@@ -994,17 +994,17 @@ js::ion::GetPropertyCache(JSContext *cx,
         if (!topScript->hasIonScript())
             return true;
 
         return Invalidate(cx, topScript);
     }
 
     RootedId id(cx, NameToId(name));
     if (obj->getOps()->getProperty) {
-        if (!GetPropertyGenericMaybeCallXML(cx, JSOp(*pc), obj, id, vp))
+        if (!JSObject::getGeneric(cx, obj, obj, id, vp))
             return false;
     } else {
         if (!GetPropertyHelper(cx, obj, id, 0, vp))
             return false;
     }
 
     if (!cache.idempotent()) {
         // If the cache is idempotent, the property exists so we don't have to
--- a/js/src/js-config.h.in
+++ b/js/src/js-config.h.in
@@ -57,12 +57,9 @@
 #undef JS_INT64_TYPE
 #undef JS_INTPTR_TYPE
 #undef JS_BYTES_PER_WORD
 
 /* Some mozilla code uses JS-friend APIs that depend on JS_METHODJIT being
    correct. */
 #undef JS_METHODJIT
 
-/* Define to 1 to enable support for E4X (ECMA-357), 0 to disable it. */
-#undef JS_HAS_XML_SUPPORT
-
 #endif /* js_config_h___ */
--- a/js/src/js.msg
+++ b/js/src/js.msg
@@ -124,17 +124,17 @@ MSG_DEF(JSMSG_MISSING_FORMAL,          7
 MSG_DEF(JSMSG_PAREN_AFTER_FORMAL,      71, 0, JSEXN_SYNTAXERR, "missing ) after formal parameters")
 MSG_DEF(JSMSG_CURLY_BEFORE_BODY,       72, 0, JSEXN_SYNTAXERR, "missing { before function body")
 MSG_DEF(JSMSG_CURLY_AFTER_BODY,        73, 0, JSEXN_SYNTAXERR, "missing } after function body")
 MSG_DEF(JSMSG_PAREN_BEFORE_COND,       74, 0, JSEXN_SYNTAXERR, "missing ( before condition")
 MSG_DEF(JSMSG_PAREN_AFTER_COND,        75, 0, JSEXN_SYNTAXERR, "missing ) after condition")
 MSG_DEF(JSMSG_BAD_DUP_ARGS,            76, 0, JSEXN_SYNTAXERR, "duplicate argument names not allowed in this context")
 MSG_DEF(JSMSG_NAME_AFTER_DOT,          77, 0, JSEXN_SYNTAXERR, "missing name after . operator")
 MSG_DEF(JSMSG_BRACKET_IN_INDEX,        78, 0, JSEXN_SYNTAXERR, "missing ] in index expression")
-MSG_DEF(JSMSG_XML_WHOLE_PROGRAM,       79, 0, JSEXN_SYNTAXERR, "XML can't be the whole program")
+MSG_DEF(JSMSG_UNUSED79,                79, 0, JSEXN_NONE, "")
 MSG_DEF(JSMSG_PAREN_BEFORE_SWITCH,     80, 0, JSEXN_SYNTAXERR, "missing ( before switch expression")
 MSG_DEF(JSMSG_PAREN_AFTER_SWITCH,      81, 0, JSEXN_SYNTAXERR, "missing ) after switch expression")
 MSG_DEF(JSMSG_CURLY_BEFORE_SWITCH,     82, 0, JSEXN_SYNTAXERR, "missing { before switch body")
 MSG_DEF(JSMSG_COLON_AFTER_CASE,        83, 0, JSEXN_SYNTAXERR, "missing : after case label")
 MSG_DEF(JSMSG_WHILE_AFTER_DO,          84, 0, JSEXN_SYNTAXERR, "missing while after do-loop body")
 MSG_DEF(JSMSG_PAREN_AFTER_FOR,         85, 0, JSEXN_SYNTAXERR, "missing ( after for")
 MSG_DEF(JSMSG_SEMI_AFTER_FOR_INIT,     86, 0, JSEXN_SYNTAXERR, "missing ; after for-loop initializer")
 MSG_DEF(JSMSG_SEMI_AFTER_FOR_COND,     87, 0, JSEXN_SYNTAXERR, "missing ; after for-loop condition")
@@ -215,66 +215,66 @@ MSG_DEF(JSMSG_IDSTART_AFTER_NUMBER,   16
 MSG_DEF(JSMSG_UNDEFINED_PROP,         162, 1, JSEXN_REFERENCEERR, "reference to undefined property {0}")
 MSG_DEF(JSMSG_USELESS_EXPR,           163, 0, JSEXN_TYPEERR, "useless expression")
 MSG_DEF(JSMSG_REDECLARED_PARAM,       164, 1, JSEXN_TYPEERR, "redeclaration of formal parameter {0}")
 MSG_DEF(JSMSG_NEWREGEXP_FLAGGED,      165, 0, JSEXN_TYPEERR, "can't supply flags when constructing one RegExp from another")
 MSG_DEF(JSMSG_RESERVED_SLOT_RANGE,    166, 0, JSEXN_RANGEERR, "reserved slot index out of range")
 MSG_DEF(JSMSG_CANT_DECODE_PRINCIPALS, 167, 0, JSEXN_INTERNALERR, "can't decode JSPrincipals")
 MSG_DEF(JSMSG_CANT_SEAL_OBJECT,       168, 1, JSEXN_ERR, "can't seal {0} objects")
 MSG_DEF(JSMSG_TOO_MANY_CATCH_VARS,    169, 0, JSEXN_SYNTAXERR, "too many catch variables")
-MSG_DEF(JSMSG_BAD_XML_MARKUP,         170, 0, JSEXN_SYNTAXERR, "invalid XML markup")
-MSG_DEF(JSMSG_BAD_XML_CHARACTER,      171, 0, JSEXN_SYNTAXERR, "illegal XML character")
-MSG_DEF(JSMSG_BAD_DEFAULT_XML_NAMESPACE,172,0,JSEXN_SYNTAXERR, "invalid default XML namespace")
-MSG_DEF(JSMSG_BAD_XML_NAME_SYNTAX,    173, 0, JSEXN_SYNTAXERR, "invalid XML name")
-MSG_DEF(JSMSG_BRACKET_AFTER_ATTR_EXPR,174, 0, JSEXN_SYNTAXERR, "missing ] after attribute expression")
+MSG_DEF(JSMSG_UNUSED170,              170, 0, JSEXN_NONE, "")
+MSG_DEF(JSMSG_UNUSED171,              171, 0, JSEXN_NONE, "")
+MSG_DEF(JSMSG_UNUSED172,              172, 0, JSEXN_NONE, "")
+MSG_DEF(JSMSG_UNUSED173,              173, 0, JSEXN_NONE, "")
+MSG_DEF(JSMSG_UNUSED174,              174, 0, JSEXN_NONE, "")
 MSG_DEF(JSMSG_NESTING_GENERATOR,      175, 0, JSEXN_TYPEERR, "already executing generator")
-MSG_DEF(JSMSG_CURLY_IN_XML_EXPR,      176, 0, JSEXN_SYNTAXERR, "missing } in XML expression")
-MSG_DEF(JSMSG_BAD_XML_NAMESPACE,      177, 1, JSEXN_TYPEERR, "invalid XML namespace {0}")
-MSG_DEF(JSMSG_BAD_XML_ATTR_NAME,      178, 1, JSEXN_TYPEERR, "invalid XML attribute name {0}")
-MSG_DEF(JSMSG_BAD_XML_NAME,           179, 1, JSEXN_TYPEERR, "invalid XML name {0}")
-MSG_DEF(JSMSG_BAD_XML_CONVERSION,     180, 1, JSEXN_TYPEERR, "can't convert {0} to XML")
-MSG_DEF(JSMSG_BAD_XMLLIST_CONVERSION, 181, 1, JSEXN_TYPEERR, "can't convert {0} to XMLList")
+MSG_DEF(JSMSG_UNUSED176,              176, 0, JSEXN_NONE, "")
+MSG_DEF(JSMSG_UNUSED177,              177, 0, JSEXN_NONE, "")
+MSG_DEF(JSMSG_UNUSED178,              178, 0, JSEXN_NONE, "")
+MSG_DEF(JSMSG_UNUSED179,              179, 0, JSEXN_NONE, "")
+MSG_DEF(JSMSG_UNUSED180,              180, 0, JSEXN_NONE, "")
+MSG_DEF(JSMSG_UNUSED181,              181, 0, JSEXN_NONE, "")
 MSG_DEF(JSMSG_BAD_GENERATOR_SEND,     182, 1, JSEXN_TYPEERR, "attempt to send {0} to newborn generator")
-MSG_DEF(JSMSG_NO_ASSIGN_IN_XML_ATTR,  183, 0, JSEXN_SYNTAXERR, "missing = in XML attribute")
-MSG_DEF(JSMSG_BAD_XML_ATTR_VALUE,     184, 0, JSEXN_SYNTAXERR, "invalid XML attribute value")
-MSG_DEF(JSMSG_XML_TAG_NAME_MISMATCH,  185, 1, JSEXN_SYNTAXERR, "XML tag name mismatch (expected {0})")
-MSG_DEF(JSMSG_BAD_XML_TAG_SYNTAX,     186, 0, JSEXN_SYNTAXERR, "invalid XML tag syntax")
-MSG_DEF(JSMSG_BAD_XML_LIST_SYNTAX,    187, 0, JSEXN_SYNTAXERR, "invalid XML list syntax")
+MSG_DEF(JSMSG_UNUSED183,              183, 0, JSEXN_NONE, "")
+MSG_DEF(JSMSG_UNUSED184,              184, 0, JSEXN_NONE, "")
+MSG_DEF(JSMSG_UNUSED185,              185, 0, JSEXN_NONE, "")
+MSG_DEF(JSMSG_UNUSED186,              186, 0, JSEXN_NONE, "")
+MSG_DEF(JSMSG_UNUSED187,              187, 0, JSEXN_NONE, "")
 MSG_DEF(JSMSG_INCOMPATIBLE_METHOD,    188, 3, JSEXN_TYPEERR, "{0} {1} called on incompatible {2}")
-MSG_DEF(JSMSG_CANT_SET_XML_ATTRS,     189, 0, JSEXN_INTERNALERR, "can't set XML property attributes")
-MSG_DEF(JSMSG_END_OF_XML_SOURCE,      190, 0, JSEXN_SYNTAXERR, "unexpected end of XML source")
-MSG_DEF(JSMSG_END_OF_XML_ENTITY,      191, 0, JSEXN_SYNTAXERR, "unexpected end of XML entity")
-MSG_DEF(JSMSG_BAD_XML_QNAME,          192, 0, JSEXN_SYNTAXERR, "invalid XML qualified name")
+MSG_DEF(JSMSG_UNUSED189,              189, 0, JSEXN_NONE, "")
+MSG_DEF(JSMSG_UNUSED190,              190, 0, JSEXN_NONE, "")
+MSG_DEF(JSMSG_UNUSED191,              191, 0, JSEXN_NONE, "")
+MSG_DEF(JSMSG_UNUSED192,              192, 0, JSEXN_NONE, "")
 MSG_DEF(JSMSG_BAD_FOR_EACH_LOOP,      193, 0, JSEXN_SYNTAXERR, "invalid for each loop")
-MSG_DEF(JSMSG_BAD_XMLLIST_PUT,        194, 1, JSEXN_TYPEERR, "can't set property {0} in XMLList")
-MSG_DEF(JSMSG_UNKNOWN_XML_ENTITY,     195, 1, JSEXN_TYPEERR, "unknown XML entity {0}")
-MSG_DEF(JSMSG_BAD_XML_NCR,            196, 1, JSEXN_TYPEERR, "malformed XML character {0}")
-MSG_DEF(JSMSG_UNDEFINED_XML_NAME,     197, 1, JSEXN_REFERENCEERR, "reference to undefined XML name {0}")
-MSG_DEF(JSMSG_DUPLICATE_XML_ATTR,     198, 1, JSEXN_TYPEERR, "duplicate XML attribute {0}")
+MSG_DEF(JSMSG_UNUSED194,              194, 0, JSEXN_NONE, "")
+MSG_DEF(JSMSG_UNUSED195,              195, 0, JSEXN_NONE, "")
+MSG_DEF(JSMSG_UNUSED196,              196, 0, JSEXN_NONE, "")
+MSG_DEF(JSMSG_UNUSED197,              197, 0, JSEXN_NONE, "")
+MSG_DEF(JSMSG_UNUSED198,              198, 0, JSEXN_NONE, "")
 MSG_DEF(JSMSG_TOO_MANY_LOCALS,        199, 0, JSEXN_SYNTAXERR, "too many local variables")
 MSG_DEF(JSMSG_ARRAY_INIT_TOO_BIG,     200, 0, JSEXN_INTERNALERR, "array initialiser too large")
 MSG_DEF(JSMSG_REGEXP_TOO_COMPLEX,     201, 0, JSEXN_INTERNALERR, "regular expression too complex")
 MSG_DEF(JSMSG_BUFFER_TOO_SMALL,       202, 0, JSEXN_INTERNALERR, "buffer too small")
 MSG_DEF(JSMSG_BAD_SURROGATE_CHAR,     203, 1, JSEXN_TYPEERR, "bad surrogate character {0}")
 MSG_DEF(JSMSG_UTF8_CHAR_TOO_LARGE,    204, 1, JSEXN_TYPEERR, "UTF-8 character {0} too large")
 MSG_DEF(JSMSG_MALFORMED_UTF8_CHAR,    205, 1, JSEXN_TYPEERR, "malformed UTF-8 character sequence at offset {0}")
 MSG_DEF(JSMSG_USER_DEFINED_ERROR,     206, 0, JSEXN_ERR, "JS_ReportError was called")
 MSG_DEF(JSMSG_WRONG_CONSTRUCTOR,      207, 1, JSEXN_TYPEERR, "wrong constructor called for {0}")
 MSG_DEF(JSMSG_BAD_GENERATOR_RETURN,   208, 1, JSEXN_TYPEERR, "generator function {0} returns a value")
 MSG_DEF(JSMSG_BAD_ANON_GENERATOR_RETURN, 209, 0, JSEXN_TYPEERR, "anonymous generator function returns a value")
 MSG_DEF(JSMSG_NAME_AFTER_FOR_PAREN,   210, 0, JSEXN_SYNTAXERR, "missing name after for (")
 MSG_DEF(JSMSG_IN_AFTER_FOR_NAME,      211, 0, JSEXN_SYNTAXERR, "missing 'in' or 'of' after for")
 MSG_DEF(JSMSG_BAD_TRAP_RETURN_VALUE,  212, 2, JSEXN_TYPEERR,"trap {1} for {0} returned a primitive value")
-MSG_DEF(JSMSG_KEYWORD_NOT_NS,         213, 0, JSEXN_SYNTAXERR, "keyword is used as namespace")
+MSG_DEF(JSMSG_UNUSED213,              213, 0, JSEXN_NONE, "")
 MSG_DEF(JSMSG_BAD_GENERATOR_YIELD,    214, 1, JSEXN_TYPEERR, "yield from closing generator {0}")
 MSG_DEF(JSMSG_BAD_GENERATOR_SYNTAX,   215, 1, JSEXN_SYNTAXERR, "{0} expression must be parenthesized")
 MSG_DEF(JSMSG_ARRAY_COMP_LEFTSIDE,    216, 0, JSEXN_SYNTAXERR, "invalid array comprehension left-hand side")
-MSG_DEF(JSMSG_NON_XML_FILTER,         217, 1, JSEXN_TYPEERR, "XML filter is applied to non-XML value {0}")
+MSG_DEF(JSMSG_UNUSED217,              217, 0, JSEXN_NONE, "")
 MSG_DEF(JSMSG_EMPTY_ARRAY_REDUCE,     218, 0, JSEXN_TYPEERR, "reduce of empty array with no initial value")
-MSG_DEF(JSMSG_NON_LIST_XML_METHOD,    219, 2, JSEXN_TYPEERR, "can't call {0} method on an XML list with {1} elements")
+MSG_DEF(JSMSG_UNUSED219,              219, 0, JSEXN_NONE, "")
 MSG_DEF(JSMSG_BAD_DELETE_OPERAND,     220, 0, JSEXN_REFERENCEERR, "invalid delete operand")
 MSG_DEF(JSMSG_BAD_INCOP_OPERAND,      221, 0, JSEXN_REFERENCEERR, "invalid increment/decrement operand")
 MSG_DEF(JSMSG_UNEXPECTED_TYPE,        222, 2, JSEXN_TYPEERR, "{0} is {1}")
 MSG_DEF(JSMSG_LET_DECL_NOT_IN_BLOCK,  223, 0, JSEXN_SYNTAXERR, "let declaration not directly within block")
 MSG_DEF(JSMSG_BAD_OBJECT_INIT,        224, 0, JSEXN_SYNTAXERR, "invalid object initializer")
 MSG_DEF(JSMSG_CANT_SET_ARRAY_ATTRS,   225, 0, JSEXN_INTERNALERR, "can't set attributes on indexed array properties")
 MSG_DEF(JSMSG_EVAL_ARITY,             226, 0, JSEXN_TYPEERR, "eval accepts only one parameter")
 MSG_DEF(JSMSG_MISSING_FUN_ARG,        227, 2, JSEXN_TYPEERR, "missing argument {0} when calling function {1}")
@@ -308,26 +308,26 @@ MSG_DEF(JSMSG_BAD_PARSE_NODE,         25
 MSG_DEF(JSMSG_NOT_EXPECTED_TYPE,      255, 3, JSEXN_TYPEERR, "{0}: expected {1}, got {2}")
 MSG_DEF(JSMSG_CALLER_IS_STRICT,       256, 0, JSEXN_TYPEERR, "access to strict mode caller function is censored")
 MSG_DEF(JSMSG_NEED_DEBUG_MODE,        257, 0, JSEXN_ERR, "function can be called only in debug mode")
 MSG_DEF(JSMSG_STRICT_CODE_LET_EXPR_STMT, 258, 0, JSEXN_ERR, "strict mode code may not contain unparenthesized let expression statements")
 MSG_DEF(JSMSG_CANT_CHANGE_EXTENSIBILITY, 259, 0, JSEXN_TYPEERR, "can't change object's extensibility")
 MSG_DEF(JSMSG_SC_BAD_SERIALIZED_DATA, 260, 1, JSEXN_INTERNALERR, "bad serialized structured data ({0})")
 MSG_DEF(JSMSG_SC_UNSUPPORTED_TYPE,    261, 0, JSEXN_TYPEERR, "unsupported type for structured data")
 MSG_DEF(JSMSG_SC_RECURSION,           262, 0, JSEXN_INTERNALERR, "recursive object")
-MSG_DEF(JSMSG_CANT_WRAP_XML_OBJECT,   263, 0, JSEXN_TYPEERR, "can't wrap XML objects")
+MSG_DEF(JSMSG_UNUSED263,              263, 0, JSEXN_NONE, "")
 MSG_DEF(JSMSG_BAD_CLONE_VERSION,      264, 0, JSEXN_ERR, "unsupported structured clone version")
 MSG_DEF(JSMSG_CANT_CLONE_OBJECT,      265, 0, JSEXN_TYPEERR, "can't clone object")
 MSG_DEF(JSMSG_UNUSED266,              266, 0, JSEXN_NONE, "")
 MSG_DEF(JSMSG_STRICT_FUNCTION_STATEMENT, 267, 0, JSEXN_SYNTAXERR, "in strict mode code, functions may be declared only at top level or immediately within another function")
 MSG_DEF(JSMSG_INVALID_FOR_IN_INIT,    268, 0, JSEXN_SYNTAXERR, "for-in loop let declaration may not have an initializer")
 MSG_DEF(JSMSG_CLEARED_SCOPE,          269, 0, JSEXN_TYPEERR, "attempt to run compile-and-go script on a cleared scope")
 MSG_DEF(JSMSG_MALFORMED_ESCAPE,       270, 1, JSEXN_SYNTAXERR, "malformed {0} character escape sequence")
 MSG_DEF(JSMSG_BAD_GENEXP_BODY,        271, 1, JSEXN_SYNTAXERR, "illegal use of {0} in generator expression")
-MSG_DEF(JSMSG_XML_PROTO_FORBIDDEN,    272, 0, JSEXN_TYPEERR, "can't set prototype of an object to an XML value")
+MSG_DEF(JSMSG_UNUSED272,              272, 0, JSEXN_NONE, "")
 MSG_DEF(JSMSG_UNNAMED_FUNCTION_STMT,  273, 0, JSEXN_SYNTAXERR, "function statement requires a name")
 MSG_DEF(JSMSG_CCW_REQUIRED,           274, 1, JSEXN_TYPEERR, "{0}: argument must be an object from a different compartment")
 MSG_DEF(JSMSG_DEBUG_BAD_RESUMPTION,   275, 0, JSEXN_TYPEERR, "debugger resumption value must be undefined, {throw: val}, {return: val}, or null")
 MSG_DEF(JSMSG_ASSIGN_FUNCTION_OR_NULL, 276, 1, JSEXN_TYPEERR, "value assigned to {0} must be a function or null")
 MSG_DEF(JSMSG_DEBUG_NOT_LIVE,         277, 1, JSEXN_ERR, "{0} is not live")
 MSG_DEF(JSMSG_DEBUG_OBJECT_WRONG_OWNER, 278, 0, JSEXN_TYPEERR, "Debugger.Object belongs to a different Debugger")
 MSG_DEF(JSMSG_DEBUG_OBJECT_PROTO,     279, 0, JSEXN_TYPEERR, "Debugger.Object.prototype is not a valid Debugger.Object")
 MSG_DEF(JSMSG_DEBUG_LOOP,             280, 0, JSEXN_TYPEERR, "cannot debug an object in same compartment as debugger or a compartment that is already debugging the debugger")
--- a/js/src/jsanalyze.cpp
+++ b/js/src/jsanalyze.cpp
@@ -305,20 +305,16 @@ ScriptAnalysis::analyzeBytecode(JSContex
             break;
 
           case JSOP_SETRVAL:
           case JSOP_POPV:
             usesReturnValue_ = true;
             isJaegerInlineable = isIonInlineable = false;
             break;
 
-          case JSOP_QNAMEPART:
-          case JSOP_QNAMECONST:
-            isJaegerCompileable = false;
-            /* FALL THROUGH */
           case JSOP_NAME:
           case JSOP_CALLNAME:
           case JSOP_BINDNAME:
           case JSOP_SETNAME:
           case JSOP_DELNAME:
           case JSOP_GETALIASEDVAR:
           case JSOP_CALLALIASEDVAR:
           case JSOP_SETALIASEDVAR:
@@ -869,17 +865,17 @@ ScriptAnalysis::analyzeLifetimes(JSConte
                 uint32_t entry = targetOffset;
                 if (entry) {
                     do {
                         entry--;
                     } while (!maybeCode(entry));
 
                     jsbytecode *entrypc = script_->code + entry;
 
-                    if (JSOp(*entrypc) == JSOP_GOTO || JSOp(*entrypc) == JSOP_FILTER)
+                    if (JSOp(*entrypc) == JSOP_GOTO)
                         loop->entry = entry + GET_JUMP_OFFSET(entrypc);
                     else
                         loop->entry = targetOffset;
                 } else {
                     /* Do-while loop at the start of the script. */
                     loop->entry = targetOffset;
                 }
                 JS_ASSERT(script_->code[loop->entry] == JSOP_LOOPHEAD ||
--- a/js/src/jsanalyze.h
+++ b/js/src/jsanalyze.h
@@ -178,18 +178,16 @@ GetDefCount(UnrootedScript script, unsig
     /*
      * Add an extra pushed value for OR/AND opcodes, so that they are included
      * in the pushed array of stack values for type inference.
      */
     switch (JSOp(*pc)) {
       case JSOP_OR:
       case JSOP_AND:
         return 1;
-      case JSOP_FILTER:
-        return 2;
       case JSOP_PICK:
         /*
          * Pick pops and pushes how deep it looks in the stack + 1
          * items. i.e. if the stack were |a b[2] c[1] d[0]|, pick 2
          * would pop b, c, and d to rearrange the stack to |a c[0]
          * d[1] b[2]|.
          */
         return (pc[1] + 1);
@@ -242,17 +240,16 @@ BytecodeNoFallThrough(JSOp op)
     switch (op) {
       case JSOP_GOTO:
       case JSOP_DEFAULT:
       case JSOP_RETURN:
       case JSOP_STOP:
       case JSOP_RETRVAL:
       case JSOP_THROW:
       case JSOP_TABLESWITCH:
-      case JSOP_FILTER:
         return true;
       case JSOP_GOSUB:
         /* These fall through indirectly, after executing a 'finally'. */
         return false;
       default:
         return false;
     }
 }
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -47,17 +47,16 @@
 #include "jsproxy.h"
 #include "jsscript.h"
 #include "jsstr.h"
 #include "prmjtime.h"
 #include "jsweakmap.h"
 #include "jsworkers.h"
 #include "jswrapper.h"
 #include "jstypedarray.h"
-#include "jsxml.h"
 
 #include "builtin/Eval.h"
 #include "builtin/Intl.h"
 #include "builtin/MapObject.h"
 #include "builtin/RegExp.h"
 #include "builtin/ParallelArray.h"
 #include "ds/LifoAlloc.h"
 #include "frontend/BytecodeCompiler.h"
@@ -144,21 +143,16 @@ class AutoVersionAPI
       : cx(cx),
         oldDefaultVersion(cx->getDefaultVersion()),
         oldHasVersionOverride(cx->isVersionOverridden()),
         oldVersionOverride(oldHasVersionOverride ? cx->findVersion() : JSVERSION_UNKNOWN)
 #ifdef DEBUG
         , oldCompileOptions(cx->getCompileOptions())
 #endif
     {
-#if JS_HAS_XML_SUPPORT
-        // For backward compatibility, AutoVersionAPI clobbers the
-        // JSOPTION_MOAR_XML bit in cx, but not the JSOPTION_ALLOW_XML bit.
-        newVersion = JSVersion(newVersion | (oldDefaultVersion & VersionFlags::ALLOW_XML));
-#endif
         this->newVersion = newVersion;
         cx->clearVersionOverride();
         cx->setDefaultVersion(newVersion);
     }
 
     ~AutoVersionAPI() {
         cx->setDefaultVersion(oldDefaultVersion);
         if (oldHasVersionOverride)
@@ -174,17 +168,16 @@ class AutoVersionAPI
 
 #ifdef HAVE_VA_LIST_AS_ARRAY
 #define JS_ADDRESSOF_VA_LIST(ap) ((va_list *)(ap))
 #else
 #define JS_ADDRESSOF_VA_LIST(ap) (&(ap))
 #endif
 
 #ifdef JS_USE_JSID_STRUCT_TYPES
-jsid JS_DEFAULT_XML_NAMESPACE_ID = { size_t(JSID_TYPE_DEFAULT_XML_NAMESPACE) };
 jsid JSID_VOID  = { size_t(JSID_TYPE_VOID) };
 jsid JSID_EMPTY = { size_t(JSID_TYPE_OBJECT) };
 #endif
 
 const jsval JSVAL_NULL  = IMPL_TO_JSVAL(BUILD_JSVAL(JSVAL_TAG_NULL,      0));
 const jsval JSVAL_ZERO  = IMPL_TO_JSVAL(BUILD_JSVAL(JSVAL_TAG_INT32,     0));
 const jsval JSVAL_ONE   = IMPL_TO_JSVAL(BUILD_JSVAL(JSVAL_TAG_INT32,     1));
 const jsval JSVAL_FALSE = IMPL_TO_JSVAL(BUILD_JSVAL(JSVAL_TAG_BOOLEAN,   JS_FALSE));
@@ -812,17 +805,16 @@ JSRuntime::JSRuntime(JSUseHelperThreads 
     gcAbortSweepAfterCurrentGroup(false),
     gcArenasAllocatedDuringSweep(NULL),
 #ifdef DEBUG
     gcMarkingValidator(NULL),
 #endif
     gcInterFrameGC(0),
     gcSliceBudget(SliceBudget::Unlimited),
     gcIncrementalEnabled(true),
-    gcExactScanningEnabled(true),
     gcManipulatingDeadCompartments(false),
     gcObjectsMarkedInDeadCompartments(0),
     gcPoke(false),
     heapState(Idle),
 #ifdef JS_GC_ZEAL
     gcZeal_(0),
     gcZealFrequency(0),
     gcNextScheduled(0),
@@ -1788,21 +1780,16 @@ static JSStdName standard_class_atoms[] 
     {js_InitArrayClass,                 EAGER_ATOM_AND_CLASP(Array)},
     {js_InitBooleanClass,               EAGER_ATOM_AND_CLASP(Boolean)},
     {js_InitDateClass,                  EAGER_ATOM_AND_CLASP(Date)},
     {js_InitMathClass,                  EAGER_ATOM_AND_CLASP(Math)},
     {js_InitNumberClass,                EAGER_ATOM_AND_CLASP(Number)},
     {js_InitStringClass,                EAGER_ATOM_AND_CLASP(String)},
     {js_InitExceptionClasses,           EAGER_ATOM_AND_CLASP(Error)},
     {js_InitRegExpClass,                EAGER_ATOM_AND_CLASP(RegExp)},
-#if JS_HAS_XML_SUPPORT
-    {js_InitXMLClass,                   EAGER_ATOM_AND_CLASP(XML)},
-    {js_InitNamespaceClass,             EAGER_ATOM_AND_CLASP(Namespace)},
-    {js_InitQNameClass,                 EAGER_ATOM_AND_CLASP(QName)},
-#endif
 #if JS_HAS_GENERATORS
     {js_InitIteratorClasses,            EAGER_ATOM_AND_CLASP(StopIteration)},
 #endif
     {js_InitJSONClass,                  EAGER_ATOM_AND_CLASP(JSON)},
     {js_InitTypedArrayClasses,          EAGER_CLASS_ATOM(ArrayBuffer), &js::ArrayBufferObject::protoClass},
     {js_InitWeakMapClass,               EAGER_ATOM_AND_CLASP(WeakMap)},
     {js_InitMapClass,                   EAGER_CLASS_ATOM(Map), &js::MapObject::class_},
     {js_InitSetClass,                   EAGER_CLASS_ATOM(Set), &js::SetObject::class_},
@@ -1846,21 +1833,16 @@ static JSStdName standard_class_names[] 
     {js_InitExceptionClasses,   EAGER_CLASS_ATOM(InternalError), CLASP(Error)},
     {js_InitExceptionClasses,   EAGER_CLASS_ATOM(EvalError), CLASP(Error)},
     {js_InitExceptionClasses,   EAGER_CLASS_ATOM(RangeError), CLASP(Error)},
     {js_InitExceptionClasses,   EAGER_CLASS_ATOM(ReferenceError), CLASP(Error)},
     {js_InitExceptionClasses,   EAGER_CLASS_ATOM(SyntaxError), CLASP(Error)},
     {js_InitExceptionClasses,   EAGER_CLASS_ATOM(TypeError), CLASP(Error)},
     {js_InitExceptionClasses,   EAGER_CLASS_ATOM(URIError), CLASP(Error)},
 
-#if JS_HAS_XML_SUPPORT
-    {js_InitXMLClass,           EAGER_ATOM(XMLList), CLASP(XML)},
-    {js_InitXMLClass,           EAGER_ATOM(isXMLName), CLASP(XML)},
-#endif
-
     {js_InitIteratorClasses,    EAGER_CLASS_ATOM(Iterator), &PropertyIteratorObject::class_},
 
     /* Typed Arrays */
     {js_InitTypedArrayClasses,  EAGER_CLASS_ATOM(ArrayBuffer),  &ArrayBufferClass},
     {js_InitTypedArrayClasses,  EAGER_CLASS_ATOM(Int8Array),    TYPED_ARRAY_CLASP(TYPE_INT8)},
     {js_InitTypedArrayClasses,  EAGER_CLASS_ATOM(Uint8Array),   TYPED_ARRAY_CLASP(TYPE_UINT8)},
     {js_InitTypedArrayClasses,  EAGER_CLASS_ATOM(Int16Array),   TYPED_ARRAY_CLASP(TYPE_INT16)},
     {js_InitTypedArrayClasses,  EAGER_CLASS_ATOM(Uint16Array),  TYPED_ARRAY_CLASP(TYPE_UINT16)},
@@ -1984,26 +1966,16 @@ JS_ResolveStandardClass(JSContext *cx, J
          */
         JS_ASSERT(obj->isGlobal());
         if (stdnm->clasp->flags & JSCLASS_IS_ANONYMOUS)
             return true;
 
         if (IsStandardClassResolved(obj, stdnm->clasp))
             return true;
 
-#if JS_HAS_XML_SUPPORT
-        if ((stdnm->init == js_InitXMLClass ||
-             stdnm->init == js_InitNamespaceClass ||
-             stdnm->init == js_InitQNameClass) &&
-            !VersionHasAllowXML(cx->findVersion()))
-        {
-            return true;
-        }
-#endif
-
         if (!stdnm->init(cx, obj))
             return false;
         *resolved = true;
     }
     return true;
 }
 
 JS_PUBLIC_API(JSBool)
@@ -2025,25 +1997,17 @@ JS_EnumerateStandardClasses(JSContext *c
                                   JS_PropertyStub, JS_StrictPropertyStub,
                                   JSPROP_PERMANENT | JSPROP_READONLY)) {
         return false;
     }
 
     /* Initialize any classes that have not been initialized yet. */
     for (unsigned i = 0; standard_class_atoms[i].init; i++) {
         const JSStdName &stdnm = standard_class_atoms[i];
-        if (!js::IsStandardClassResolved(obj, stdnm.clasp)
-#if JS_HAS_XML_SUPPORT
-            && ((stdnm.init != js_InitXMLClass &&
-                 stdnm.init != js_InitNamespaceClass &&
-                 stdnm.init != js_InitQNameClass) ||
-                VersionHasAllowXML(cx->findVersion()))
-#endif
-            )
-        {
+        if (!js::IsStandardClassResolved(obj, stdnm.clasp)) {
             if (!stdnm.init(cx, obj))
                 return false;
         }
     }
 
     return true;
 }
 
@@ -2521,22 +2485,16 @@ JS_GetTraceThingInfo(char *buf, size_t b
 
       case JSTRACE_BASE_SHAPE:
         name = "base_shape";
         break;
 
       case JSTRACE_TYPE_OBJECT:
         name = "type_object";
         break;
-
-#if JS_HAS_XML_SUPPORT
-      case JSTRACE_XML:
-        name = "xml";
-        break;
-#endif
     }
 
     n = strlen(name);
     if (n > bufsize - 1)
         n = bufsize - 1;
     js_memcpy(buf, name, n + 1);
     buf += n;
     bufsize -= n;
@@ -2588,27 +2546,16 @@ JS_GetTraceThingInfo(char *buf, size_t b
             break;
           }
 
           case JSTRACE_IONCODE:
           case JSTRACE_SHAPE:
           case JSTRACE_BASE_SHAPE:
           case JSTRACE_TYPE_OBJECT:
             break;
-
-#if JS_HAS_XML_SUPPORT
-          case JSTRACE_XML:
-          {
-            extern const char *js_xml_class_str[];
-            JSXML *xml = (JSXML *)thing;
-
-            JS_snprintf(buf, bufsize, " %s", js_xml_class_str[xml->xml_class]);
-            break;
-          }
-#endif
         }
     }
     buf[bufsize - 1] = '\0';
 }
 
 extern JS_PUBLIC_API(const char *)
 JS_GetTraceEdgeName(JSTracer *trc, char *buffer, int bufferSize)
 {
--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -1063,18 +1063,18 @@ class JS_PUBLIC_API(AutoGCRooter) {
 
     enum {
         JSVAL =        -1, /* js::AutoValueRooter */
         VALARRAY =     -2, /* js::AutoValueArrayRooter */
         PARSER =       -3, /* js::frontend::Parser */
         SHAPEVECTOR =  -4, /* js::AutoShapeVector */
         IDARRAY =      -6, /* js::AutoIdArray */
         DESCRIPTORS =  -7, /* js::AutoPropDescArrayRooter */
-        NAMESPACES =   -8, /* js::AutoNamespaceArray */
-        XML =          -9, /* js::AutoXMLRooter */
+        // UNUSED      -8
+        // UNUSED      -9
         OBJECT =      -10, /* js::AutoObjectRooter */
         ID =          -11, /* js::AutoIdRooter */
         VALVECTOR =   -12, /* js::AutoValueVector */
         DESCRIPTOR =  -13, /* js::AutoPropertyDescriptorRooter */
         STRING =      -14, /* js::AutoStringRooter */
         IDVECTOR =    -15, /* js::AutoIdVector */
         OBJVECTOR =   -16, /* js::AutoObjectVector */
         STRINGVECTOR =-17, /* js::AutoStringVector */
@@ -2379,31 +2379,28 @@ JS_NumberValue(double d)
         return INT_TO_JSVAL(i);
     return DOUBLE_TO_JSVAL(d);
 }
 
 /************************************************************************/
 
 /*
  * A jsid is an identifier for a property or method of an object which is
- * either a 31-bit signed integer, interned string or object. If XML is
- * enabled, there is an additional singleton jsid value; see
- * JS_DEFAULT_XML_NAMESPACE_ID below. Finally, there is an additional jsid
- * value, JSID_VOID, which does not occur in JS scripts but may be used to
- * indicate the absence of a valid jsid.
+ * either a 31-bit signed integer, interned string or object.  Also, there is
+ * an additional jsid value, JSID_VOID, which does not occur in JS scripts but
+ * may be used to indicate the absence of a valid jsid.
  *
  * A jsid is not implicitly convertible to or from a jsval; JS_ValueToId or
  * JS_IdToValue must be used instead.
  */
 
 #define JSID_TYPE_STRING                 0x0
 #define JSID_TYPE_INT                    0x1
 #define JSID_TYPE_VOID                   0x2
 #define JSID_TYPE_OBJECT                 0x4
-#define JSID_TYPE_DEFAULT_XML_NAMESPACE  0x6
 #define JSID_TYPE_MASK                   0x7
 
 /*
  * Avoid using canonical 'id' for jsid parameters since this is a magic word in
  * Objective-C++ which, apparently, wants to be able to #include jsapi.h.
  */
 #define id iden
 
@@ -2502,35 +2499,16 @@ JSID_IS_GCTHING(jsid id)
 
 static JS_ALWAYS_INLINE void *
 JSID_TO_GCTHING(jsid id)
 {
     return (void *)(JSID_BITS(id) & ~(size_t)JSID_TYPE_MASK);
 }
 
 /*
- * The magic XML namespace id is not a valid jsid. Global object classes in
- * embeddings that enable JS_HAS_XML_SUPPORT (E4X) should handle this id.
- */
-
-static JS_ALWAYS_INLINE JSBool
-JSID_IS_DEFAULT_XML_NAMESPACE(jsid id)
-{
-    JS_ASSERT_IF(((size_t)JSID_BITS(id) & JSID_TYPE_MASK) == JSID_TYPE_DEFAULT_XML_NAMESPACE,
-                 JSID_BITS(id) == JSID_TYPE_DEFAULT_XML_NAMESPACE);
-    return ((size_t)JSID_BITS(id) == JSID_TYPE_DEFAULT_XML_NAMESPACE);
-}
-
-#ifdef JS_USE_JSID_STRUCT_TYPES
-extern JS_PUBLIC_DATA(jsid) JS_DEFAULT_XML_NAMESPACE_ID;
-#else
-# define JS_DEFAULT_XML_NAMESPACE_ID ((jsid)JSID_TYPE_DEFAULT_XML_NAMESPACE)
-#endif
-
-/*
  * A void jsid is not a valid id and only arises as an exceptional API return
  * value, such as in JS_NextProperty. Embeddings must not pass JSID_VOID into
  * JSAPI entry points expecting a jsid and do not need to handle JSID_VOID in
  * hooks receiving a jsid except when explicitly noted in the API contract.
  */
 
 static JS_ALWAYS_INLINE JSBool
 JSID_IS_VOID(const js::RawId id)
@@ -3160,26 +3138,21 @@ JS_StringToVersion(const char *string);
                                                    promises to execute compiled
                                                    script once only; enables
                                                    compile-time scope chain
                                                    resolution of consts. */
 #define JSOPTION_ATLINE         JS_BIT(5)       /* //@line number ["filename"]
                                                    option supported for the
                                                    XUL preprocessor and kindred
                                                    beasts. */
-#define JSOPTION_ALLOW_XML      JS_BIT(6)       /* enable E4X syntax (deprecated)
-                                                   and define the E4X-related
-                                                   globals: XML, XMLList,
-                                                   Namespace, etc. */
-#define JSOPTION_MOAR_XML       JS_BIT(7)       /* enable E4X even in versions
-                                                   that don't normally get it;
-                                                   parse <!-- --> as a token,
-                                                   not backward compatible with
-                                                   the comment-hiding hack used
-                                                   in HTML script tags. */
+
+/* JS_BIT(6) is currently unused. */
+
+/* JS_BIT(7) is currently unused. */
+
 #define JSOPTION_DONT_REPORT_UNCAUGHT                                   \
                                 JS_BIT(8)       /* When returning from the
                                                    outermost API call, prevent
                                                    uncaught exceptions from
                                                    being converted to error
                                                    reports */
 
 /* JS_BIT(9) is currently unused. */
@@ -3211,17 +3184,17 @@ JS_StringToVersion(const char *string);
 #define JSOPTION_STRICT_MODE    JS_BIT(19)      /* Provides a way to force
                                                    strict mode for all code
                                                    without requiring
                                                    "use strict" annotations. */
 
 #define JSOPTION_ION            JS_BIT(20)      /* IonMonkey */
 
 /* Options which reflect compile-time properties of scripts. */
-#define JSCOMPILEOPTION_MASK    (JSOPTION_ALLOW_XML | JSOPTION_MOAR_XML)
+#define JSCOMPILEOPTION_MASK    0
 
 #define JSRUNOPTION_MASK        (JS_BITMASK(21) & ~JSCOMPILEOPTION_MASK)
 #define JSALLOPTION_MASK        (JSCOMPILEOPTION_MASK | JSRUNOPTION_MASK)
 
 extern JS_PUBLIC_API(uint32_t)
 JS_GetOptions(JSContext *cx);
 
 extern JS_PUBLIC_API(uint32_t)
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -88,17 +88,17 @@ js::GetLengthProperty(JSContext *cx, Han
         *lengthp = uint32_t(value.toInt32()); /* uint32_t cast does ToUint32_t */
         return true;
     }
 
     return ToUint32(cx, value, (uint32_t *)lengthp);
 }
 
 /*
- * Determine if the id represents an array index or an XML property index.
+ * Determine if the id represents an array index.
  *
  * An id is an array index according to ECMA by (15.4):
  *
  * "Array objects give special treatment to a certain class of property names.
  * A property name P (in the form of a string value) is an array index if and
  * only if ToString(ToUint32(P)) is equal to P and ToUint32(P) is not equal
  * to 2^32-1."
  *
--- a/js/src/jsast.tbl
+++ b/js/src/jsast.tbl
@@ -61,28 +61,9 @@ ASTDEF(AST_LET_STMT,              "LetSt
 ASTDEF(AST_CASE,                  "SwitchCase",                     "switchCase")
 ASTDEF(AST_CATCH,                 "CatchClause",                    "catchClause")
 ASTDEF(AST_COMP_BLOCK,            "ComprehensionBlock",             "comprehensionBlock")
 
 ASTDEF(AST_ARRAY_PATT,            "ArrayPattern",                   "arrayPattern")
 ASTDEF(AST_OBJECT_PATT,           "ObjectPattern",                  "objectPattern")
 ASTDEF(AST_PROP_PATT,             "Property",                       "propertyPattern")
 
-ASTDEF(AST_XMLANYNAME,            "XMLAnyName",                     "xmlAnyName")
-ASTDEF(AST_XMLATTR_SEL,           "XMLAttributeSelector",           "xmlAttributeSelector")
-ASTDEF(AST_XMLESCAPE,             "XMLEscape",                      "xmlEscape")
-ASTDEF(AST_XMLFILTER,             "XMLFilterExpression",            "xmlFilterExpression")
-ASTDEF(AST_XMLDEFAULT,            "XMLDefaultDeclaration",          "xmlDefaultDeclaration")
-ASTDEF(AST_XMLQUAL,               "XMLQualifiedIdentifier",         "xmlQualifiedIdentifier")
-ASTDEF(AST_XMLFUNCQUAL,           "XMLFunctionQualifiedIdentifier", "xmlFunctionQualifiedIdentifier")
-ASTDEF(AST_XMLELEM,               "XMLElement",                     "xmlElement")
-ASTDEF(AST_XMLTEXT,               "XMLText",                        "xmlText")
-ASTDEF(AST_XMLLIST,               "XMLList",                        "xmlList")
-ASTDEF(AST_XMLSTART,              "XMLStartTag",                    "xmlStartTag")
-ASTDEF(AST_XMLEND,                "XMLEndTag",                      "xmlEndTag")
-ASTDEF(AST_XMLPOINT,              "XMLPointTag",                    "xmlPointTag")
-ASTDEF(AST_XMLNAME,               "XMLName",                        "xmlName")
-ASTDEF(AST_XMLATTR,               "XMLAttribute",                   "xmlAttribute")
-ASTDEF(AST_XMLCDATA,              "XMLCdata",                       "xmlCdata")
-ASTDEF(AST_XMLCOMMENT,            "XMLComment",                     "xmlComment")
-ASTDEF(AST_XMLPI,                 "XMLProcessingInstruction",       "xmlProcessingInstruction")
-
 /* AST_LIMIT = last + 1 */
--- a/js/src/jsatom.cpp
+++ b/js/src/jsatom.cpp
@@ -19,17 +19,16 @@
 #include "jsapi.h"
 #include "jsatom.h"
 #include "jscntxt.h"
 #include "jsgc.h"
 #include "jslock.h"
 #include "jsnum.h"
 #include "jsstr.h"
 #include "jsversion.h"
-#include "jsxml.h"
 
 #include "frontend/Parser.h"
 #include "gc/Marking.h"
 #include "vm/Xdr.h"
 
 #include "jsstrinlines.h"
 #include "jsatominlines.h"
 #include "jsobjinlines.h"
@@ -52,17 +51,16 @@ js_AtomToPrintableString(JSContext *cx, 
 const char * js::TypeStrings[] = {
     js_undefined_str,
     js_object_str,
     js_function_str,
     js_string_str,
     js_number_str,
     js_boolean_str,
     js_null_str,
-    js_xml_str,
 };
 
 #define DEFINE_PROTO_STRING(name,code,init) const char js_##name##_str[] = #name;
 JS_FOR_EACH_PROTOTYPE(DEFINE_PROTO_STRING)
 #undef DEFINE_PROTO_STRING
 
 #define CONST_CHAR_STR(idpart, id, text) const char js_##idpart##_str[] = text;
 FOR_EACH_COMMON_PROPERTYNAME(CONST_CHAR_STR)
@@ -447,42 +445,16 @@ template bool
 js::IndexToIdSlow<NoGC>(JSContext *cx, uint32_t index, FakeMutableHandle<jsid> idp);
 
 template <AllowGC allowGC>
 bool
 js::InternNonIntElementId(JSContext *cx, JSObject *obj, const Value &idval,
                           typename MaybeRooted<jsid, allowGC>::MutableHandleType idp,
                           typename MaybeRooted<Value, allowGC>::MutableHandleType vp)
 {
-#if JS_HAS_XML_SUPPORT
-    if (idval.isObject()) {
-        JSObject *idobj = &idval.toObject();
-
-        if (obj && obj->isXML()) {
-            idp.set(OBJECT_TO_JSID(idobj));
-            vp.set(idval);
-            return true;
-        }
-
-        if (!allowGC)
-            return false;
-
-        if (js_GetLocalNameFromFunctionQName(idobj, idp.address(), cx)) {
-            vp.set(IdToValue(idp));
-            return true;
-        }
-
-        if (!obj && idobj->isXMLId()) {
-            idp.set(OBJECT_TO_JSID(idobj));
-            vp.set(idval);
-            return JS_TRUE;
-        }
-    }
-#endif
-
     JSAtom *atom = ToAtom<allowGC>(cx, idval);
     if (!atom)
         return false;
 
     idp.set(AtomToId(atom));
     vp.setString(atom);
     return true;
 }
--- a/js/src/jsclass.h
+++ b/js/src/jsclass.h
@@ -28,32 +28,31 @@ static JS_ALWAYS_INLINE jsid
 SPECIALID_TO_JSID(const SpecialId &sid);
 
 /*
  * We partition the ways to refer to a property into three: by an index
  * (uint32_t); by a string whose characters do not represent an index
  * (PropertyName, see vm/String.h); and by various special values.
  *
  * Special values are encoded using SpecialId, which is layout-compatible but
- * non-interconvertible with jsid.  A SpecialId may be: an object (used by E4X
- * and perhaps eventually by Harmony-proposed private names); JSID_VOID, which
+ * non-interconvertible with jsid.  A SpecialId is used for JSID_VOID, which
  * does not occur in JS scripts but may be used to indicate the absence of a
- * valid identifier; or JS_DEFAULT_XML_NAMESPACE_ID, if E4X is enabled.
+ * valid identifier.  In the future, a SpecialId may also be an object used by
+ * Harmony-proposed private names.
  */
 class SpecialId
 {
     uintptr_t bits;
 
     /* Needs access to raw bits. */
     friend JS_ALWAYS_INLINE jsid SPECIALID_TO_JSID(const SpecialId &sid);
     friend class PropertyId;
 
     static const uintptr_t TYPE_VOID = JSID_TYPE_VOID;
     static const uintptr_t TYPE_OBJECT = JSID_TYPE_OBJECT;
-    static const uintptr_t TYPE_DEFAULT_XML_NAMESPACE = JSID_TYPE_DEFAULT_XML_NAMESPACE;
     static const uintptr_t TYPE_MASK = JSID_TYPE_MASK;
 
     SpecialId(uintptr_t bits) : bits(bits) { }
 
   public:
     SpecialId() : bits(TYPE_VOID) { }
 
     /* Object-valued */
@@ -92,61 +91,45 @@ class SpecialId
         SpecialId sid(TYPE_VOID);
         JS_ASSERT(sid.isVoid());
         return sid;
     }
 
     bool isVoid() const {
         return bits == TYPE_VOID;
     }
-
-    /* Default XML namespace */
-
-    static SpecialId defaultXMLNamespace() {
-        SpecialId sid(TYPE_DEFAULT_XML_NAMESPACE);
-        JS_ASSERT(sid.isDefaultXMLNamespace());
-        return sid;
-    }
-
-    bool isDefaultXMLNamespace() const {
-        return bits == TYPE_DEFAULT_XML_NAMESPACE;
-    }
 };
 
 static JS_ALWAYS_INLINE jsid
 SPECIALID_TO_JSID(const SpecialId &sid)
 {
     jsid id;
     JSID_BITS(id) = sid.bits;
     JS_ASSERT_IF(sid.isObject(), JSID_IS_OBJECT(id) && JSID_TO_OBJECT(id) == sid.toObject());
     JS_ASSERT_IF(sid.isVoid(), JSID_IS_VOID(id));
     JS_ASSERT_IF(sid.isEmpty(), JSID_IS_EMPTY(id));
-    JS_ASSERT_IF(sid.isDefaultXMLNamespace(), JSID_IS_DEFAULT_XML_NAMESPACE(id));
     return id;
 }
 
 static JS_ALWAYS_INLINE bool
 JSID_IS_SPECIAL(jsid id)
 {
-    return JSID_IS_OBJECT(id) || JSID_IS_EMPTY(id) || JSID_IS_VOID(id) ||
-           JSID_IS_DEFAULT_XML_NAMESPACE(id);
+    return JSID_IS_OBJECT(id) || JSID_IS_EMPTY(id) || JSID_IS_VOID(id);
 }
 
 static JS_ALWAYS_INLINE SpecialId
 JSID_TO_SPECIALID(jsid id)
 {
     JS_ASSERT(JSID_IS_SPECIAL(id));
     if (JSID_IS_OBJECT(id))
         return SpecialId(*JSID_TO_OBJECT(id));
     if (JSID_IS_EMPTY(id))
         return SpecialId::empty();
-    if (JSID_IS_VOID(id))
-        return SpecialId::voidId();
-    JS_ASSERT(JSID_IS_DEFAULT_XML_NAMESPACE(id));
-    return SpecialId::defaultXMLNamespace();
+    JS_ASSERT(JSID_IS_VOID(id));
+    return SpecialId::voidId();
 }
 
 typedef JS::Handle<SpecialId> HandleSpecialId;
 
 /* js::Class operation signatures. */
 
 typedef JSBool
 (* LookupGenericOp)(JSContext *cx, HandleObject obj, HandleId id,
--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@@ -874,24 +874,16 @@ struct JSRuntime : js::RuntimeFriendFiel
     bool                gcIncrementalEnabled;
 
     /*
      * GGC can be enabled from the command line while testing.
      */
     bool                gcGenerationalEnabled;
 
     /*
-     * Whether exact stack scanning is enabled for this runtime. This is
-     * currently only used for dynamic root analysis. Exact scanning starts out
-     * enabled, and is disabled if e4x has been used.
-     */
-    bool                gcExactScanningEnabled;
-
-
-    /*
      * This is true if we are in the middle of a brain transplant (e.g.,
      * JS_TransplantObject) or some other operation that can manipulate
      * dead compartments.
      */
     bool                gcManipulatingDeadCompartments;
 
     /*
      * This field is incremented each time we mark an object inside a
@@ -1284,75 +1276,35 @@ struct JSRuntime : js::RuntimeFriendFiel
 /* Common macros to access thread-local caches in JSRuntime. */
 #define JS_KEEP_ATOMS(rt)   (rt)->gcKeepAtoms++;
 #define JS_UNKEEP_ATOMS(rt) (rt)->gcKeepAtoms--;
 
 namespace js {
 
 struct AutoResolving;
 
-static inline bool
-OptionsHasAllowXML(uint32_t options)
-{
-    return !!(options & JSOPTION_ALLOW_XML);
-}
-
-static inline bool
-OptionsHasMoarXML(uint32_t options)
-{
-    return !!(options & JSOPTION_MOAR_XML);
-}
-
-static inline bool
-OptionsSameVersionFlags(uint32_t self, uint32_t other)
-{
-    static const uint32_t mask = JSOPTION_MOAR_XML;
-    return !((self & mask) ^ (other & mask));
-}
-
 /*
  * Flags accompany script version data so that a) dynamically created scripts
  * can inherit their caller's compile-time properties and b) scripts can be
  * appropriately compared in the eval cache across global option changes. An
  * example of the latter is enabling the top-level-anonymous-function-is-error
  * option: subsequent evals of the same, previously-valid script text may have
  * become invalid.
  */
 namespace VersionFlags {
 static const unsigned MASK      = 0x0FFF; /* see JSVersion in jspubtd.h */
-static const unsigned ALLOW_XML = 0x1000; /* flag induced by JSOPTION_ALLOW_XML */
-static const unsigned MOAR_XML  = 0x2000; /* flag induced by JSOPTION_MOAR_XML */
-static const unsigned FULL_MASK = 0x3FFF;
+static const unsigned FULL_MASK = 0x0FFF;
 } /* namespace VersionFlags */
 
 static inline JSVersion
 VersionNumber(JSVersion version)
 {
     return JSVersion(uint32_t(version) & VersionFlags::MASK);
 }
 
-static inline bool
-VersionHasAllowXML(JSVersion version)
-{
-    return !!(version & VersionFlags::ALLOW_XML);
-}
-
-static inline bool
-VersionHasMoarXML(JSVersion version)
-{
-    return !!(version & VersionFlags::MOAR_XML);
-}
-
-/* @warning This is a distinct condition from having the XML flag set. */
-static inline bool
-VersionShouldParseXML(JSVersion version)
-{
-    return VersionHasMoarXML(version) || VersionNumber(version) >= JSVERSION_1_6;
-}
-
 static inline JSVersion
 VersionExtractFlags(JSVersion version)
 {
     return JSVersion(uint32_t(version) & ~VersionFlags::MASK);
 }
 
 static inline void
 VersionCopyFlags(JSVersion *version, JSVersion from)
@@ -1364,32 +1316,25 @@ static inline bool
 VersionHasFlags(JSVersion version)
 {
     return !!VersionExtractFlags(version);
 }
 
 static inline unsigned
 VersionFlagsToOptions(JSVersion version)
 {
-    unsigned copts = (VersionHasAllowXML(version) ? JSOPTION_ALLOW_XML : 0) |
-                     (VersionHasMoarXML(version) ? JSOPTION_MOAR_XML : 0);
+    unsigned copts = 0;
     JS_ASSERT((copts & JSCOMPILEOPTION_MASK) == copts);
     return copts;
 }
 
 static inline JSVersion
 OptionFlagsToVersion(unsigned options, JSVersion version)
 {
-    uint32_t v = version;
-    v &= ~(VersionFlags::ALLOW_XML | VersionFlags::MOAR_XML);
-    if (OptionsHasAllowXML(options))
-        v |= VersionFlags::ALLOW_XML;
-    if (OptionsHasMoarXML(options))
-        v |= VersionFlags::MOAR_XML;
-    return JSVersion(v);
+    return version;
 }
 
 static inline bool
 VersionIsKnown(JSVersion version)
 {
     return VersionNumber(version) != JSVERSION_UNKNOWN;
 }
 
@@ -1784,35 +1729,16 @@ struct AutoResolving {
     JSContext           *const context;
     HandleObject        object;
     HandleId            id;
     Kind                const kind;
     AutoResolving       *const link;
     MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
 };
 
-#if JS_HAS_XML_SUPPORT
-class AutoXMLRooter : private AutoGCRooter {
-  public:
-    AutoXMLRooter(JSContext *cx, JSXML *xml
-                  MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
-      : AutoGCRooter(cx, XML), xml(xml)
-    {
-        MOZ_GUARD_OBJECT_NOTIFIER_INIT;
-        JS_ASSERT(xml);
-    }
-
-    friend void AutoGCRooter::trace(JSTracer *trc);
-
-  private:
-    JSXML * const xml;
-    MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
-};
-#endif /* JS_HAS_XML_SUPPORT */
-
 #ifdef JS_THREADSAFE
 # define JS_LOCK_GC(rt)    PR_Lock((rt)->gcLock)
 # define JS_UNLOCK_GC(rt)  PR_Unlock((rt)->gcLock)
 #else
 # define JS_LOCK_GC(rt)    do { } while (0)
 # define JS_UNLOCK_GC(rt)  do { } while (0)
 #endif
 
--- a/js/src/jscntxtinlines.h
+++ b/js/src/jscntxtinlines.h
@@ -8,17 +8,16 @@
 #ifndef jscntxtinlines_h___
 #define jscntxtinlines_h___
 
 #include "jscntxt.h"
 #include "jscompartment.h"
 #include "jsfriendapi.h"
 #include "jsinterp.h"
 #include "jsprobes.h"
-#include "jsxml.h"
 #include "jsgc.h"
 
 #include "builtin/Object.h" // For js::obj_construct
 #include "frontend/ParseMaps.h"
 #include "vm/RegExpObject.h"
 
 #include "jsgcinlines.h"
 
@@ -130,41 +129,16 @@ struct PreserveRegsGuard
 
     FrameRegs *prevContextRegs;
 
   private:
     JSContext *cx;
     FrameRegs &regs_;
 };
 
-#if JS_HAS_XML_SUPPORT
-
-class AutoNamespaceArray : protected AutoGCRooter {
-  public:
-    AutoNamespaceArray(JSContext *cx)
-        : AutoGCRooter(cx, NAMESPACES), context(cx) {
-        array.init();
-    }
-
-    ~AutoNamespaceArray() {
-        array.finish(context->runtime->defaultFreeOp());
-    }
-
-    uint32_t length() const { return array.length; }
-
-  private:
-    JSContext *context;
-    friend void AutoGCRooter::trace(JSTracer *trc);
-
-  public:
-    JSXMLArray<JSObject> array;
-};
-
-#endif /* JS_HAS_XML_SUPPORT */
-
 #ifdef JS_CRASH_DIAGNOSTICS
 class CompartmentChecker
 {
     JSContext *context;
     JSCompartment *compartment;
 
   public:
     explicit CompartmentChecker(JSContext *cx)
--- a/js/src/jsfriendapi.cpp
+++ b/js/src/jsfriendapi.cpp
@@ -496,25 +496,16 @@ js::SetPreserveWrapperCallback(JSRuntime
     rt->preserveWrapperCallback = callback;
 }
 
 /*
  * The below code is for temporary telemetry use. It can be removed when
  * sufficient data has been harvested.
  */
 
-// Defined in jsxml.cpp.
-extern size_t sE4XObjectsCreated;
-
-JS_FRIEND_API(size_t)
-JS_GetE4XObjectsCreated(JSContext *)
-{
-    return sE4XObjectsCreated;
-}
-
 namespace js {
 // Defined in vm/GlobalObject.cpp.
 extern size_t sSetProtoCalled;
 }
 
 JS_FRIEND_API(size_t)
 JS_SetProtoCalled(JSContext *)
 {
@@ -713,23 +704,16 @@ js::DumpHeapComplete(JSRuntime *rt, FILE
 }
 
 JS_FRIEND_API(const JSStructuredCloneCallbacks *)
 js::GetContextStructuredCloneCallbacks(JSContext *cx)
 {
     return cx->runtime->structuredCloneCallbacks;
 }
 
-JS_FRIEND_API(JSVersion)
-js::VersionSetMoarXML(JSVersion version, bool enable)
-{
-    return enable ? JSVersion(uint32_t(version) | VersionFlags::MOAR_XML)
-                  : JSVersion(uint32_t(version) & ~VersionFlags::MOAR_XML);
-}
-
 JS_FRIEND_API(bool)
 js::CanCallContextDebugHandler(JSContext *cx)
 {
     return !!cx->runtime->debugHooks.debuggerHandler;
 }
 
 JS_FRIEND_API(JSTrapStatus)
 js::CallContextDebugHandler(JSContext *cx, JSScript *script, jsbytecode *bc, Value *rval)
--- a/js/src/jsfriendapi.h
+++ b/js/src/jsfriendapi.h
@@ -46,19 +46,16 @@ JS_SplicePrototype(JSContext *cx, JSObje
 
 extern JS_FRIEND_API(JSObject *)
 JS_NewObjectWithUniqueType(JSContext *cx, JSClass *clasp, JSObject *proto, JSObject *parent);
 
 extern JS_FRIEND_API(uint32_t)
 JS_ObjectCountDynamicSlots(JSHandleObject obj);
 
 extern JS_FRIEND_API(size_t)
-JS_GetE4XObjectsCreated(JSContext *cx);
-
-extern JS_FRIEND_API(size_t)
 JS_SetProtoCalled(JSContext *cx);
 
 extern JS_FRIEND_API(size_t)
 JS_GetCustomIteratorCount(JSContext *cx);
 
 extern JS_FRIEND_API(JSBool)
 JS_NondeterministicGetWeakMapKeys(JSContext *cx, JSObject *obj, JSObject **ret);
 
@@ -350,27 +347,22 @@ struct Function {
 
 struct Atom {
     size_t _;
     const jschar *chars;
 };
 
 } /* namespace shadow */
 
-extern JS_FRIEND_DATA(js::Class) AnyNameClass;
-extern JS_FRIEND_DATA(js::Class) AttributeNameClass;
 extern JS_FRIEND_DATA(js::Class) CallClass;
 extern JS_FRIEND_DATA(js::Class) DeclEnvClass;
 extern JS_FRIEND_DATA(js::Class) FunctionClass;
 extern JS_FRIEND_DATA(js::Class) FunctionProxyClass;
-extern JS_FRIEND_DATA(js::Class) NamespaceClass;
 extern JS_FRIEND_DATA(js::Class) OuterWindowProxyClass;
 extern JS_FRIEND_DATA(js::Class) ObjectProxyClass;
-extern JS_FRIEND_DATA(js::Class) QNameClass;
-extern JS_FRIEND_DATA(js::Class) XMLClass;
 extern JS_FRIEND_DATA(js::Class) ObjectClass;
 
 inline js::Class *
 GetObjectClass(RawObject obj)
 {
     return reinterpret_cast<const shadow::Object*>(obj)->type->clasp;
 }
 
@@ -707,19 +699,16 @@ typedef void
  * idle and a request begins.
  */
 JS_FRIEND_API(void)
 SetActivityCallback(JSRuntime *rt, ActivityCallback cb, void *arg);
 
 extern JS_FRIEND_API(const JSStructuredCloneCallbacks *)
 GetContextStructuredCloneCallbacks(JSContext *cx);
 
-extern JS_FRIEND_API(JSVersion)
-VersionSetMoarXML(JSVersion version, bool enable);
-
 extern JS_FRIEND_API(bool)
 CanCallContextDebugHandler(JSContext *cx);
 
 extern JS_FRIEND_API(JSTrapStatus)
 CallContextDebugHandler(JSContext *cx, JSScript *script, jsbytecode *bc, Value *rval);
 
 extern JS_FRIEND_API(bool)
 IsContextRunningJS(JSContext *cx);
@@ -1357,17 +1346,17 @@ static JS_ALWAYS_INLINE Value
 IdToValue(jsid id)
 {
     if (JSID_IS_STRING(id))
         return StringValue(JSID_TO_STRING(id));
     if (JS_LIKELY(JSID_IS_INT(id)))
         return Int32Value(JSID_TO_INT(id));
     if (JS_LIKELY(JSID_IS_OBJECT(id)))
         return ObjectValue(*JSID_TO_OBJECT(id));
-    JS_ASSERT(JSID_IS_DEFAULT_XML_NAMESPACE(id) || JSID_IS_VOID(id));
+    JS_ASSERT(JSID_IS_VOID(id));
     return UndefinedValue();
 }
 
 static JS_ALWAYS_INLINE jsval
 IdToJsval(jsid id)
 {
     return IdToValue(id);
 }
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -63,19 +63,16 @@
 #include "jslock.h"
 #include "jsnum.h"
 #include "jsobj.h"
 #include "jsprobes.h"
 #include "jsproxy.h"
 #include "jsscript.h"
 #include "jswatchpoint.h"
 #include "jsweakmap.h"
-#if JS_HAS_XML_SUPPORT
-#include "jsxml.h"
-#endif
 
 #include "builtin/MapObject.h"
 #include "frontend/Parser.h"
 #include "gc/FindSCCs.h"
 #include "gc/GCInternals.h"
 #include "gc/Marking.h"
 #include "gc/Memory.h"
 #include "methodjit/MethodJIT.h"
@@ -143,19 +140,16 @@ const uint32_t Arena::ThingSizes[] = {
     sizeof(JSObject_Slots12),   /* FINALIZE_OBJECT12            */
     sizeof(JSObject_Slots12),   /* FINALIZE_OBJECT12_BACKGROUND */
     sizeof(JSObject_Slots16),   /* FINALIZE_OBJECT16            */
     sizeof(JSObject_Slots16),   /* FINALIZE_OBJECT16_BACKGROUND */
     sizeof(JSScript),           /* FINALIZE_SCRIPT              */
     sizeof(Shape),              /* FINALIZE_SHAPE               */
     sizeof(BaseShape),          /* FINALIZE_BASE_SHAPE          */
     sizeof(types::TypeObject),  /* FINALIZE_TYPE_OBJECT         */
-#if JS_HAS_XML_SUPPORT
-    sizeof(JSXML),              /* FINALIZE_XML                 */
-#endif
     sizeof(JSShortString),      /* FINALIZE_SHORT_STRING        */
     sizeof(JSString),           /* FINALIZE_STRING              */
     sizeof(JSExternalString),   /* FINALIZE_EXTERNAL_STRING     */
     sizeof(ion::IonCode),       /* FINALIZE_IONCODE             */
 };
 
 #define OFFSET(type) uint32_t(sizeof(ArenaHeader) + (ArenaSize - sizeof(ArenaHeader)) % sizeof(type))
 
@@ -171,19 +165,16 @@ const uint32_t Arena::FirstThingOffsets[
     OFFSET(JSObject_Slots12),   /* FINALIZE_OBJECT12            */
     OFFSET(JSObject_Slots12),   /* FINALIZE_OBJECT12_BACKGROUND */
     OFFSET(JSObject_Slots16),   /* FINALIZE_OBJECT16            */
     OFFSET(JSObject_Slots16),   /* FINALIZE_OBJECT16_BACKGROUND */
     OFFSET(JSScript),           /* FINALIZE_SCRIPT              */
     OFFSET(Shape),              /* FINALIZE_SHAPE               */
     OFFSET(BaseShape),          /* FINALIZE_BASE_SHAPE          */
     OFFSET(types::TypeObject),  /* FINALIZE_TYPE_OBJECT         */
-#if JS_HAS_XML_SUPPORT
-    OFFSET(JSXML),              /* FINALIZE_XML                 */
-#endif
     OFFSET(JSShortString),      /* FINALIZE_SHORT_STRING        */
     OFFSET(JSString),           /* FINALIZE_STRING              */
     OFFSET(JSExternalString),   /* FINALIZE_EXTERNAL_STRING     */
     OFFSET(ion::IonCode),       /* FINALIZE_IONCODE             */
 };
 
 #undef OFFSET
 
@@ -459,20 +450,16 @@ FinalizeArenas(FreeOp *fop,
       case FINALIZE_SCRIPT:
         return FinalizeTypedArenas<JSScript>(fop, src, dest, thingKind, budget);
       case FINALIZE_SHAPE:
         return FinalizeTypedArenas<Shape>(fop, src, dest, thingKind, budget);
       case FINALIZE_BASE_SHAPE:
         return FinalizeTypedArenas<BaseShape>(fop, src, dest, thingKind, budget);
       case FINALIZE_TYPE_OBJECT:
         return FinalizeTypedArenas<types::TypeObject>(fop, src, dest, thingKind, budget);
-#if JS_HAS_XML_SUPPORT
-      case FINALIZE_XML:
-        return FinalizeTypedArenas<JSXML>(fop, src, dest, thingKind, budget);
-#endif
       case FINALIZE_STRING:
         return FinalizeTypedArenas<JSString>(fop, src, dest, thingKind, budget);
       case FINALIZE_SHORT_STRING:
         return FinalizeTypedArenas<JSShortString>(fop, src, dest, thingKind, budget);
       case FINALIZE_EXTERNAL_STRING:
         return FinalizeTypedArenas<JSExternalString>(fop, src, dest, thingKind, budget);
       case FINALIZE_IONCODE:
 #ifdef JS_ION
@@ -928,18 +915,18 @@ InitGCZeal(JSRuntime *rt)
                 "Format: JS_GC_ZEAL=N[,F]\n"
                 "N indicates \"zealousness\":\n"
                 "  0: no additional GCs\n"
                 "  1: additional GCs at common danger points\n"
                 "  2: GC every F allocations (default: 100)\n"
                 "  3: GC when the window paints (browser only)\n"
                 "  4: Verify pre write barriers between instructions\n"
                 "  5: Verify pre write barriers between paints\n"
-                "  6: Verify stack rooting (ignoring XML)\n"
-                "  7: Verify stack rooting (all roots)\n"
+                "  6: Verify stack rooting\n"
+                "  7: Verify stack rooting (yes, it's the same as 6)\n"
                 "  8: Incremental GC in two slices: 1) mark roots 2) finish collection\n"
                 "  9: Incremental GC in two slices: 1) mark all 2) new marking and finish\n"
                 " 10: Incremental GC in multiple slices\n"
                 " 11: Verify post write barriers between instructions\n"
                 " 12: Verify post write barriers between paints\n"
                 " 13: Purge analysis state every F allocations (default: 100)\n");
         return false;
     }
@@ -1441,20 +1428,16 @@ ArenaLists::queueObjectsForSweep(FreeOp 
     finalizeNow(fop, FINALIZE_OBJECT16);
 
     queueForBackgroundSweep(fop, FINALIZE_OBJECT0_BACKGROUND);
     queueForBackgroundSweep(fop, FINALIZE_OBJECT2_BACKGROUND);
     queueForBackgroundSweep(fop, FINALIZE_OBJECT4_BACKGROUND);
     queueForBackgroundSweep(fop, FINALIZE_OBJECT8_BACKGROUND);
     queueForBackgroundSweep(fop, FINALIZE_OBJECT12_BACKGROUND);
     queueForBackgroundSweep(fop, FINALIZE_OBJECT16_BACKGROUND);
-
-#if JS_HAS_XML_SUPPORT
-    finalizeNow(fop, FINALIZE_XML);
-#endif
 }
 
 void
 ArenaLists::queueStringsForSweep(FreeOp *fop)
 {
     gcstats::AutoPhase ap(fop->runtime()->gcStats, gcstats::PHASE_SWEEP_STRING);
 
     queueForBackgroundSweep(fop, FINALIZE_SHORT_STRING);
@@ -4921,21 +4904,8 @@ AutoMaybeTouchDeadCompartments::~AutoMay
 {
     if (inIncremental && runtime->gcObjectsMarkedInDeadCompartments != markCount) {
         PrepareForFullGC(runtime);
         js::GC(runtime, GC_NORMAL, gcreason::TRANSPLANT);
     }
 
     runtime->gcManipulatingDeadCompartments = manipulatingDeadCompartments;
 }
-
-#if JS_HAS_XML_SUPPORT
-extern size_t sE4XObjectsCreated;
-
-JSXML *
-js_NewGCXML(JSContext *cx)
-{
-    if (!cx->runningWithTrustedPrincipals())
-        ++sE4XObjectsCreated;
-
-    return NewGCThing<JSXML, CanGC>(cx, js::gc::FINALIZE_XML, sizeof(JSXML));
-}
-#endif
--- a/js/src/jsgc.h
+++ b/js/src/jsgc.h
@@ -103,19 +103,16 @@ MapAllocToTraceKind(AllocKind kind)
         JSTRACE_OBJECT,     /* FINALIZE_OBJECT12 */
         JSTRACE_OBJECT,     /* FINALIZE_OBJECT12_BACKGROUND */
         JSTRACE_OBJECT,     /* FINALIZE_OBJECT16 */
         JSTRACE_OBJECT,     /* FINALIZE_OBJECT16_BACKGROUND */
         JSTRACE_SCRIPT,     /* FINALIZE_SCRIPT */
         JSTRACE_SHAPE,      /* FINALIZE_SHAPE */
         JSTRACE_BASE_SHAPE, /* FINALIZE_BASE_SHAPE */
         JSTRACE_TYPE_OBJECT,/* FINALIZE_TYPE_OBJECT */
-#if JS_HAS_XML_SUPPORT      /* FINALIZE_XML */
-        JSTRACE_XML,
-#endif
         JSTRACE_STRING,     /* FINALIZE_SHORT_STRING */
         JSTRACE_STRING,     /* FINALIZE_STRING */
         JSTRACE_STRING,     /* FINALIZE_EXTERNAL_STRING */
         JSTRACE_IONCODE,    /* FINALIZE_IONCODE */
     };
     JS_STATIC_ASSERT(JS_ARRAY_LENGTH(map) == FINALIZE_LIMIT);
     return map[kind];
 }
@@ -137,19 +134,16 @@ IsNurseryAllocable(AllocKind kind)
         false,     /* FINALIZE_OBJECT12 */
         true,      /* FINALIZE_OBJECT12_BACKGROUND */
         false,     /* FINALIZE_OBJECT16 */
         true,      /* FINALIZE_OBJECT16_BACKGROUND */
         false,     /* FINALIZE_SCRIPT */
         false,     /* FINALIZE_SHAPE */
         false,     /* FINALIZE_BASE_SHAPE */
         false,     /* FINALIZE_TYPE_OBJECT */
-#if JS_HAS_XML_SUPPORT
-        false,     /* FINALIZE_XML */
-#endif
         true,      /* FINALIZE_SHORT_STRING */
         true,      /* FINALIZE_STRING */
         false,     /* FINALIZE_EXTERNAL_STRING */
         false,     /* FINALIZE_IONCODE */
     };
     JS_STATIC_ASSERT(JS_ARRAY_LENGTH(map) == FINALIZE_LIMIT);
     return map[kind];
 }
@@ -171,19 +165,16 @@ IsBackgroundFinalized(AllocKind kind)
         false,     /* FINALIZE_OBJECT12 */
         true,      /* FINALIZE_OBJECT12_BACKGROUND */
         false,     /* FINALIZE_OBJECT16 */
         true,      /* FINALIZE_OBJECT16_BACKGROUND */
         false,     /* FINALIZE_SCRIPT */
         false,     /* FINALIZE_SHAPE */
         false,     /* FINALIZE_BASE_SHAPE */
         false,     /* FINALIZE_TYPE_OBJECT */
-#if JS_HAS_XML_SUPPORT
-        false,     /* FINALIZE_XML */
-#endif
         true,      /* FINALIZE_SHORT_STRING */
         true,      /* FINALIZE_STRING */
         false,     /* FINALIZE_EXTERNAL_STRING */
         false,     /* FINALIZE_IONCODE */
     };
     JS_STATIC_ASSERT(JS_ARRAY_LENGTH(map) == FINALIZE_LIMIT);
     return map[kind];
 }
@@ -999,23 +990,16 @@ struct GCMarker : public JSTracer {
     void pushArenaList(gc::ArenaHeader *firstArena) {
         pushTaggedPtr(ArenaTag, firstArena);
     }
 
     void pushType(types::TypeObject *type) {
         pushTaggedPtr(TypeTag, type);
     }
 
-#if JS_HAS_XML_SUPPORT
-    void pushXML(JSXML *xml) {
-        pushTaggedPtr(XmlTag, xml);
-    }
-
-#endif
-
     void pushIonCode(ion::IonCode *code) {
         pushTaggedPtr(IonCodeTag, code);
     }
 
     uint32_t getMarkColor() const {
         return color;
     }
 
@@ -1110,17 +1094,17 @@ struct GCMarker : public JSTracer {
 
     bool restoreValueArray(JSObject *obj, void **vpp, void **endp);
     void saveValueRanges();
     inline void processMarkStackTop(SliceBudget &budget);
     void processMarkStackOther(SliceBudget &budget, uintptr_t tag, uintptr_t addr);
 
     void appendGrayRoot(void *thing, JSGCTraceKind kind);
 
-    /* The color is only applied to objects, functions and xml. */
+    /* The color is only applied to objects and functions. */
     uint32_t color;
 
     mozilla::DebugOnly<bool> started;
 
     /* Pointer to the top of the stack of arenas we are delaying marking on. */
     js::gc::ArenaHeader *unmarkedArenaStackTop;
     /* Count of arenas that are currently in the stack. */
     mozilla::DebugOnly<size_t> markLaterArenas;
@@ -1192,18 +1176,20 @@ SetDeterministicGC(JSContext *cx, bool e
 void
 SetValidateGC(JSContext *cx, bool enabled);
 
 const int ZealPokeValue = 1;
 const int ZealAllocValue = 2;
 const int ZealFrameGCValue = 3;
 const int ZealVerifierPreValue = 4;
 const int ZealFrameVerifierPreValue = 5;
-const int ZealStackRootingSafeValue = 6;
-const int ZealStackRootingValue = 7;
+// These two values used to be distinct.  They no longer are, but both were
+// kept to avoid breaking fuzz tests.  Avoid using ZealStackRootingValue__2.
+const int ZealStackRootingValue = 6;
+const int ZealStackRootingValue__2 = 7;
 const int ZealIncrementalRootsThenFinish = 8;
 const int ZealIncrementalMarkAllThenFinish = 9;
 const int ZealIncrementalMultipleSlices = 10;
 const int ZealVerifierPostValue = 11;
 const int ZealFrameVerifierPostValue = 12;
 const int ZealPurgeAnalysisValue = 13;
 const int ZealLimit = 13;
 
--- a/js/src/jsgcinlines.h
+++ b/js/src/jsgcinlines.h
@@ -6,17 +6,16 @@
 
 #ifndef jsgcinlines_h___
 #define jsgcinlines_h___
 
 #include "jsgc.h"
 #include "jscntxt.h"
 #include "jscompartment.h"
 #include "jslock.h"
-#include "jsxml.h"
 
 #include "gc/Root.h"
 #include "js/TemplateLib.h"
 #include "vm/Shape.h"
 
 using JS::AssertCanGC;
 
 namespace js {
@@ -599,14 +598,9 @@ js_NewGCShape(JSContext *cx)
 
 template <js::AllowGC allowGC>
 inline js::UnrootedBaseShape
 js_NewGCBaseShape(JSContext *cx)
 {
     return js::gc::NewGCThing<js::BaseShape, allowGC>(cx, js::gc::FINALIZE_BASE_SHAPE, sizeof(js::BaseShape));
 }
 
-#if JS_HAS_XML_SUPPORT
-extern JSXML *
-js_NewGCXML(JSContext *cx);
-#endif
-
 #endif /* jsgcinlines_h___ */
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -40,20 +40,16 @@
 #include "jsatominlines.h"
 #include "jsgcinlines.h"
 #include "jsinferinlines.h"
 #include "jsobjinlines.h"
 #include "jsscriptinlines.h"
 
 #include "vm/Stack-inl.h"
 
-#ifdef JS_HAS_XML_SUPPORT
-#include "jsxml.h"
-#endif
-
 #ifdef __SUNPRO_CC
 #include <alloca.h>
 #endif
 
 using namespace js;
 using namespace js::types;
 using namespace js::analyze;
 
@@ -3986,19 +3982,16 @@ ScriptAnalysis::analyzeTypesBytecode(JSC
       case JSOP_RETRVAL:
       case JSOP_ENDITER:
       case JSOP_THROWING:
       case JSOP_GOSUB:
       case JSOP_RETSUB:
       case JSOP_CONDSWITCH:
       case JSOP_DEFAULT:
       case JSOP_POPN:
-      case JSOP_STARTXML:
-      case JSOP_STARTXMLEXPR:
-      case JSOP_DEFXMLNS:
       case JSOP_POPV:
       case JSOP_DEBUGGER:
       case JSOP_SETCALL:
       case JSOP_TABLESWITCH:
       case JSOP_TRY:
       case JSOP_LABEL:
         break;
 
@@ -4030,31 +4023,24 @@ ScriptAnalysis::analyzeTypesBytecode(JSC
       case JSOP_LE:
       case JSOP_GT:
       case JSOP_GE:
       case JSOP_NOT:
       case JSOP_STRICTEQ:
       case JSOP_STRICTNE:
       case JSOP_IN:
       case JSOP_INSTANCEOF:
-      case JSOP_DELDESC:
         pushed[0].addType(cx, Type::BooleanType());
         break;
       case JSOP_DOUBLE:
         pushed[0].addType(cx, Type::DoubleType());
         break;
       case JSOP_STRING:
       case JSOP_TYPEOF:
       case JSOP_TYPEOFEXPR:
-      case JSOP_QNAMEPART:
-      case JSOP_XMLTAGEXPR:
-      case JSOP_TOATTRVAL:
-      case JSOP_ADDATTRNAME:
-      case JSOP_ADDATTRVAL:
-      case JSOP_XMLELTEXPR:
         pushed[0].addType(cx, Type::StringType());
         break;
       case JSOP_NULL:
         pushed[0].addType(cx, Type::NullType());
         break;
 
       case JSOP_REGEXP:
         if (script->compileAndGo) {
@@ -4634,49 +4620,16 @@ ScriptAnalysis::analyzeTypesBytecode(JSC
       case JSOP_GENERATOR:
         TypeScript::ReturnTypes(script)->addType(cx, Type::UnknownType());
         break;
 
       case JSOP_YIELD:
         pushed[0].addType(cx, Type::UnknownType());
         break;
 
-      case JSOP_CALLXMLNAME:
-        pushed[1].addType(cx, Type::UnknownType());
-        /* FALLTHROUGH */
-
-      case JSOP_XMLNAME:
-        pushed[0].addType(cx, Type::UnknownType());
-        break;
-
-      case JSOP_SETXMLNAME:
-        cx->compartment->types.monitorBytecode(cx, script, offset);
-        poppedTypes(pc, 0)->addSubset(cx, &pushed[0]);
-        break;
-
-      case JSOP_BINDXMLNAME:
-        break;
-
-      case JSOP_TOXML:
-      case JSOP_TOXMLLIST:
-      case JSOP_XMLPI:
-      case JSOP_XMLCDATA:
-      case JSOP_XMLCOMMENT:
-      case JSOP_DESCENDANTS:
-      case JSOP_TOATTRNAME:
-      case JSOP_QNAMECONST:
-      case JSOP_QNAME:
-      case JSOP_ANYNAME:
-      case JSOP_GETFUNNS:
-      case JSOP_FILTER:
-        /* Note: the second value pushed by filter is a hole, and not modelled. */
-      case JSOP_ENDFILTER:
-        pushed[0].addType(cx, Type::UnknownType());
-        break;
-
       case JSOP_CALLEE:
         pushed[0].addType(cx, Type::AnyObjectType());
         break;
 
       default:
         /* Display fine-grained debug information first */
         fprintf(stderr, "Unknown bytecode %02x at #%u:%05u\n", op, script->id(), offset);
         TypeFailure(cx, "Unknown bytecode %02x", op);
@@ -5714,17 +5667,16 @@ types::TypeMonitorResult(JSContext *cx, 
 static inline bool
 IgnorePushed(const jsbytecode *pc, unsigned index)
 {
     switch (JSOp(*pc)) {
       /* We keep track of the scopes pushed by BINDNAME separately. */
       case JSOP_BINDNAME:
       case JSOP_BINDGNAME:
       case JSOP_BINDINTRINSIC:
-      case JSOP_BINDXMLNAME:
         return true;
 
       /* Stack not consistent in TRY_BRANCH_AFTER_COND. */
       case JSOP_IN:
       case JSOP_EQ:
       case JSOP_NE:
       case JSOP_LT:
       case JSOP_LE:
@@ -5735,18 +5687,16 @@ IgnorePushed(const jsbytecode *pc, unsig
       /* Value not determining result is not pushed by OR/AND. */
       case JSOP_OR:
       case JSOP_AND:
         return (index == 0);
 
       /* Holes tracked separately. */
       case JSOP_HOLE:
         return (index == 0);
-      case JSOP_FILTER:
-        return (index == 1);
 
       /* Storage for 'with' and 'let' blocks not monitored. */
       case JSOP_ENTERWITH:
       case JSOP_ENTERBLOCK:
       case JSOP_ENTERLET0:
       case JSOP_ENTERLET1:
         return true;
 
@@ -6061,25 +6011,16 @@ JSObject::makeLazyType(JSContext *cx)
         type->interpretedFunction = self->toFunction();
         if (type->interpretedFunction->nonLazyScript()->uninlineable)
             type->flags |= OBJECT_FLAG_UNINLINEABLE;
     }
 
     if (self->lastProperty()->hasObjectFlag(BaseShape::ITERATED_SINGLETON))
         type->flags |= OBJECT_FLAG_ITERATED;
 
-#if JS_HAS_XML_SUPPORT
-    /*
-     * XML objects do not have equality hooks but are treated special by EQ/NE
-     * ops. Just mark the type as totally unknown.
-     */
-    if (self->isXML() && !type->unknownProperties())
-        type->markUnknown(cx);
-#endif
-
     if (self->getClass()->ext.equality)
         type->flags |= OBJECT_FLAG_SPECIAL_EQUALITY;
     if (self->getClass()->emulatesUndefined())
         type->flags |= OBJECT_FLAG_EMULATES_UNDEFINED;
 
     /*
      * Adjust flags for objects which will have the wrong flags set by just
      * looking at the class prototype key.
@@ -6210,22 +6151,16 @@ JSCompartment::getNewType(JSContext *cx,
         RootedObject obj(cx, proto.toObject());
 
         if (obj->hasSpecialEquality())
             type->flags |= OBJECT_FLAG_SPECIAL_EQUALITY;
 
         if (fun)
             CheckNewScriptProperties(cx, type, fun);
 
-#if JS_HAS_XML_SUPPORT
-        /* Special case for XML object equality, see makeLazyType(). */
-        if (obj->isXML() && !type->unknownProperties())
-            type->flags |= OBJECT_FLAG_UNKNOWN_MASK;
-#endif
-
         if (obj->isRegExp()) {
             AddTypeProperty(cx, type, "source", types::Type::StringType());
             AddTypeProperty(cx, type, "global", types::Type::BooleanType());
             AddTypeProperty(cx, type, "ignoreCase", types::Type::BooleanType());
             AddTypeProperty(cx, type, "multiline", types::Type::BooleanType());
             AddTypeProperty(cx, type, "sticky", types::Type::BooleanType());
             AddTypeProperty(cx, type, "lastIndex", types::Type::Int32Type());
         }
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -61,20 +61,16 @@
 #include "jsscriptinlines.h"
 #include "jstypedarrayinlines.h"
 
 #include "builtin/Iterator-inl.h"
 #include "vm/Shape-inl.h"
 #include "vm/Stack-inl.h"
 #include "vm/String-inl.h"
 
-#if JS_HAS_XML_SUPPORT
-#include "jsxml.h"
-#endif
-
 #include "jsautooplen.h"
 
 #if defined(JS_METHODJIT) && defined(JS_MONOIC)
 #include "methodjit/MonoIC.h"
 #endif
 
 #if JS_TRACE_LOGGING
 #include "TraceLogging.h"
@@ -200,25 +196,16 @@ js::OnUnknownMethod(JSContext *cx, Handl
     RootedValue value(cx);
     if (!GetMethod(cx, obj, id, 0, &value))
         return false;
     TypeScript::MonitorUnknown(cx);
 
     if (value.get().isPrimitive()) {
         vp.set(value);
     } else {
-#if JS_HAS_XML_SUPPORT
-        /* Extract the function name from function::name qname. */
-        if (idval.get().isObject()) {
-            JSObject *obj = &idval.get().toObject();
-            if (js_GetLocalNameFromFunctionQName(obj, id.address(), cx))
-                idval = IdToValue(id);
-        }
-#endif
-
         JSObject *obj = NewObjectWithClassProto(cx, &js_NoSuchMethodClass, NULL, NULL);
         if (!obj)
             return false;
 
         obj->setSlot(JSSLOT_FOUND_FUNCTION, value);
         obj->setSlot(JSSLOT_SAVED_ID, idval);
         vp.setObject(*obj);
     }
@@ -587,27 +574,16 @@ js::HasInstance(JSContext *cx, HandleObj
     js_ReportValueError(cx, JSMSG_BAD_INSTANCEOF_RHS,
                         JSDVG_SEARCH_STACK, val, NullPtr());
     return JS_FALSE;
 }
 
 bool
 js::LooselyEqual(JSContext *cx, const Value &lval, const Value &rval, bool *result)
 {
-#if JS_HAS_XML_SUPPORT
-    if (JS_UNLIKELY(lval.isObject() && lval.toObject().isXML()) ||
-                    (rval.isObject() && rval.toObject().isXML())) {
-        JSBool res;
-        if (!js_TestXMLEquality(cx, lval, rval, &res))
-            return false;
-        *result = !!res;
-        return true;
-    }
-#endif
-
     if (SameType(lval, rval)) {
         if (lval.isString()) {
             JSString *l = lval.toString();
             JSString *r = rval.toString();
             return EqualStrings(cx, l, r, result);
         }
 
         if (lval.isDouble()) {
@@ -961,17 +937,16 @@ js::AssertValidPropertyCacheHit(JSContex
 
 /*
  * Ensure that the intrepreter switch can close call-bytecode cases in the
  * same way as non-call bytecodes.
  */
 JS_STATIC_ASSERT(JSOP_NAME_LENGTH == JSOP_CALLNAME_LENGTH);
 JS_STATIC_ASSERT(JSOP_GETARG_LENGTH == JSOP_CALLARG_LENGTH);
 JS_STATIC_ASSERT(JSOP_GETLOCAL_LENGTH == JSOP_CALLLOCAL_LENGTH);
-JS_STATIC_ASSERT(JSOP_XMLNAME_LENGTH == JSOP_CALLXMLNAME_LENGTH);
 
 /*
  * Same for JSOP_SETNAME and JSOP_SETPROP, which differ only slightly but
  * remain distinct for the decompiler.
  */
 JS_STATIC_ASSERT(JSOP_SETNAME_LENGTH == JSOP_SETPROP_LENGTH);
 
 /* See TRY_BRANCH_AFTER_COND. */
@@ -1341,35 +1316,54 @@ js::Interpret(JSContext *cx, StackFrame 
 
 /* No-ops for ease of decompilation. */
 ADD_EMPTY_CASE(JSOP_NOP)
 ADD_EMPTY_CASE(JSOP_UNUSED71)
 ADD_EMPTY_CASE(JSOP_UNUSED107)
 ADD_EMPTY_CASE(JSOP_UNUSED132)
 ADD_EMPTY_CASE(JSOP_UNUSED147)
 ADD_EMPTY_CASE(JSOP_UNUSED148)
+ADD_EMPTY_CASE(JSOP_UNUSED161)
+ADD_EMPTY_CASE(JSOP_UNUSED162)
+ADD_EMPTY_CASE(JSOP_UNUSED163)
+ADD_EMPTY_CASE(JSOP_UNUSED164)
+ADD_EMPTY_CASE(JSOP_UNUSED165)
+ADD_EMPTY_CASE(JSOP_UNUSED166)
+ADD_EMPTY_CASE(JSOP_UNUSED167)
+ADD_EMPTY_CASE(JSOP_UNUSED168)
+ADD_EMPTY_CASE(JSOP_UNUSED169)
+ADD_EMPTY_CASE(JSOP_UNUSED170)
+ADD_EMPTY_CASE(JSOP_UNUSED171)
+ADD_EMPTY_CASE(JSOP_UNUSED172)
+ADD_EMPTY_CASE(JSOP_UNUSED173)
+ADD_EMPTY_CASE(JSOP_UNUSED174)
+ADD_EMPTY_CASE(JSOP_UNUSED175)
+ADD_EMPTY_CASE(JSOP_UNUSED176)
+ADD_EMPTY_CASE(JSOP_UNUSED177)
+ADD_EMPTY_CASE(JSOP_UNUSED178)
+ADD_EMPTY_CASE(JSOP_UNUSED179)
+ADD_EMPTY_CASE(JSOP_UNUSED180)
+ADD_EMPTY_CASE(JSOP_UNUSED181)
+ADD_EMPTY_CASE(JSOP_UNUSED182)
+ADD_EMPTY_CASE(JSOP_UNUSED183)
 ADD_EMPTY_CASE(JSOP_UNUSED188)
 ADD_EMPTY_CASE(JSOP_UNUSED189)
 ADD_EMPTY_CASE(JSOP_UNUSED190)
 ADD_EMPTY_CASE(JSOP_UNUSED200)
 ADD_EMPTY_CASE(JSOP_UNUSED201)
 ADD_EMPTY_CASE(JSOP_UNUSED208)
 ADD_EMPTY_CASE(JSOP_UNUSED209)
 ADD_EMPTY_CASE(JSOP_UNUSED210)
 ADD_EMPTY_CASE(JSOP_UNUSED219)
 ADD_EMPTY_CASE(JSOP_UNUSED220)
 ADD_EMPTY_CASE(JSOP_UNUSED221)
 ADD_EMPTY_CASE(JSOP_UNUSED222)
 ADD_EMPTY_CASE(JSOP_UNUSED223)
 ADD_EMPTY_CASE(JSOP_CONDSWITCH)
 ADD_EMPTY_CASE(JSOP_TRY)
-#if JS_HAS_XML_SUPPORT
-ADD_EMPTY_CASE(JSOP_STARTXML)
-ADD_EMPTY_CASE(JSOP_STARTXMLEXPR)
-#endif
 END_EMPTY_CASES
 
 BEGIN_CASE(JSOP_LOOPHEAD)
 
 #ifdef JS_METHODJIT
     script->incrLoopCount();
 #endif
 END_CASE(JSOP_LOOPHEAD)
@@ -1611,22 +1605,16 @@ BEGIN_CASE(JSOP_AND)
     bool cond = ToBoolean(regs.sp[-1]);
     if (cond == false) {
         len = GET_JUMP_OFFSET(regs.pc);
         DO_NEXT_OP(len);
     }
 }
 END_CASE(JSOP_AND)
 
-/*
- * If the index value at sp[n] is not an int that fits in a jsval, it could
- * be an object (an XML QName, AttributeName, or AnyName), but only if we are
- * compiling with JS_HAS_XML_SUPPORT.  Otherwise convert the index value to a
- * string atom id.
- */
 #define FETCH_ELEMENT_ID(obj, n, id)                                          \
     JS_BEGIN_MACRO                                                            \
         const Value &idval_ = regs.sp[n];                                     \
         if (!ValueToId<CanGC>(cx, obj, idval_, &id))                          \
             goto error;                                                       \
     JS_END_MACRO
 
 #define TRY_BRANCH_AFTER_COND(cond,spdec)                                     \
@@ -2134,20 +2122,19 @@ BEGIN_CASE(JSOP_DELELEM)
 
     regs.sp--;
 }
 END_CASE(JSOP_DELELEM)
 
 BEGIN_CASE(JSOP_TOID)
 {
     /*
-     * Increment or decrement requires use to lookup the same property twice, but we need to avoid
-     * the oberservable stringification the second time.
-     * There must be an object value below the id, which will not be popped
-     * but is necessary in interning the id for XML.
+     * Increment or decrement requires use to lookup the same property twice,
+     * but we need to avoid the observable stringification the second time.
+     * There must be an object value below the id, which will not be popped.
      */
     RootedValue &objval = rootValue0, &idval = rootValue1;
     objval = regs.sp[-2];
     idval = regs.sp[-1];
 
     MutableHandleValue res = MutableHandleValue::fromMarkedLocation(&regs.sp[-1]);
     if (!ToIdOperation(cx, script, regs.pc, objval, idval, res))
         goto error;
@@ -3121,349 +3108,16 @@ BEGIN_CASE(JSOP_DEBUGGER)
       case JSTRAP_THROW:
         cx->setPendingException(rval);
         goto error;
       default:;
     }
 }
 END_CASE(JSOP_DEBUGGER)
 
-#if JS_HAS_XML_SUPPORT
-BEGIN_CASE(JSOP_DEFXMLNS)
-{
-    JS_ASSERT(!script->strict);
-
-    if (!js_SetDefaultXMLNamespace(cx, regs.sp[-1]))
-        goto error;
-    regs.sp--;
-}
-END_CASE(JSOP_DEFXMLNS)
-
-BEGIN_CASE(JSOP_ANYNAME)
-{
-    JS_ASSERT(!script->strict);
-
-    cx->runtime->gcExactScanningEnabled = false;
-
-    jsid id;
-    if (!js_GetAnyName(cx, &id))
-        goto error;
-    PUSH_COPY(IdToValue(id));
-}
-END_CASE(JSOP_ANYNAME)
-#endif
-
-BEGIN_CASE(JSOP_QNAMEPART)
-    /*
-     * We do not JS_ASSERT(!script->strict) here because JSOP_QNAMEPART
-     * is used for __proto__ and (in contexts where we favor JSOP_*ELEM instead
-     * of JSOP_*PROP) obj.prop compiled as obj['prop'].
-     */
-    PUSH_STRING(script->getAtom(regs.pc));
-END_CASE(JSOP_QNAMEPART)
-
-#if JS_HAS_XML_SUPPORT
-BEGIN_CASE(JSOP_QNAMECONST)
-{
-    JS_ASSERT(!script->strict);
-    Value rval = StringValue(script->getAtom(regs.pc));
-    Value lval = regs.sp[-1];
-    JSObject *obj = js_ConstructXMLQNameObject(cx, lval, rval);
-    if (!obj)
-        goto error;
-    regs.sp[-1].setObject(*obj);
-}
-END_CASE(JSOP_QNAMECONST)
-
-BEGIN_CASE(JSOP_QNAME)
-{
-    JS_ASSERT(!script->strict);
-
-    Value rval = regs.sp[-1];
-    Value lval = regs.sp[-2];
-    JSObject *obj = js_ConstructXMLQNameObject(cx, lval, rval);
-    if (!obj)
-        goto error;
-    regs.sp--;
-    regs.sp[-1].setObject(*obj);
-}
-END_CASE(JSOP_QNAME)
-
-BEGIN_CASE(JSOP_TOATTRNAME)
-{
-    JS_ASSERT(!script->strict);
-
-    Value rval;
-    rval = regs.sp[-1];
-    if (!js_ToAttributeName(cx, &rval))
-        goto error;
-    regs.sp[-1] = rval;
-}
-END_CASE(JSOP_TOATTRNAME)
-
-BEGIN_CASE(JSOP_TOATTRVAL)
-{
-    JS_ASSERT(!script->strict);
-
-    Value rval;
-    rval = regs.sp[-1];
-    JS_ASSERT(rval.isString());
-    JSString *str = js_EscapeAttributeValue(cx, rval.toString(), JS_FALSE);
-    if (!str)
-        goto error;
-    regs.sp[-1].setString(str);
-}
-END_CASE(JSOP_TOATTRVAL)
-
-BEGIN_CASE(JSOP_ADDATTRNAME)
-BEGIN_CASE(JSOP_ADDATTRVAL)
-{
-    JS_ASSERT(!script->strict);
-
-    Value rval = regs.sp[-1];
-    Value lval = regs.sp[-2];
-    JSString *str = lval.toString();
-    JSString *str2 = rval.toString();
-    str = js_AddAttributePart(cx, op == JSOP_ADDATTRNAME, str, str2);
-    if (!str)
-        goto error;
-    regs.sp--;
-    regs.sp[-1].setString(str);
-}
-END_CASE(JSOP_ADDATTRNAME)
-
-BEGIN_CASE(JSOP_BINDXMLNAME)
-{
-    JS_ASSERT(!script->strict);
-
-    Value lval;
-    lval = regs.sp[-1];
-    RootedObject &obj = rootObject0;
-    jsid id;
-    if (!js_FindXMLProperty(cx, lval, &obj, &id))
-        goto error;
-    regs.sp[-1].setObjectOrNull(obj);
-    PUSH_COPY(IdToValue(id));
-}
-END_CASE(JSOP_BINDXMLNAME)
-
-BEGIN_CASE(JSOP_SETXMLNAME)
-{
-    JS_ASSERT(!script->strict);
-
-    RootedObject &obj = rootObject0;
-    obj = &regs.sp[-3].toObject();
-    RootedValue &rval = rootValue0;
-    rval = regs.sp[-1];
-    RootedId &id = rootId0;
-    FETCH_ELEMENT_ID(obj, -2, id);
-    if (!JSObject::setGeneric(cx, obj, obj, id, &rval, script->strict))
-        goto error;
-    rval = regs.sp[-1];
-    regs.sp -= 2;
-    regs.sp[-1] = rval;
-}
-END_CASE(JSOP_SETXMLNAME)
-
-BEGIN_CASE(JSOP_CALLXMLNAME)
-BEGIN_CASE(JSOP_XMLNAME)
-{
-    JS_ASSERT(!script->strict);
-
-    Value lval = regs.sp[-1];
-    RootedObject &obj = rootObject0;
-    RootedId &id = rootId0;
-    if (!js_FindXMLProperty(cx, lval, &obj, id.address()))
-        goto error;
-    RootedValue &rval = rootValue0;
-    if (!JSObject::getGeneric(cx, obj, obj, id, &rval))
-        goto error;
-    regs.sp[-1] = rval;
-    if (op == JSOP_CALLXMLNAME) {
-        Value v;
-        if (!ComputeImplicitThis(cx, obj, &v))
-            goto error;
-        PUSH_COPY(v);
-    }
-}
-END_CASE(JSOP_XMLNAME)
-
-BEGIN_CASE(JSOP_DESCENDANTS)
-BEGIN_CASE(JSOP_DELDESC)
-{
-    JS_ASSERT(!script->strict);
-
-    JSObject *obj;
-    FETCH_OBJECT(cx, -2, obj);
-    jsval rval = regs.sp[-1];
-    if (!js_GetXMLDescendants(cx, obj, rval, &rval))
-        goto error;
-
-    if (op == JSOP_DELDESC) {
-        regs.sp[-1] = rval;   /* set local root */
-        if (!js_DeleteXMLListElements(cx, JSVAL_TO_OBJECT(rval)))
-            goto error;
-        rval = JSVAL_TRUE;                  /* always succeed */
-    }
-
-    regs.sp--;
-    regs.sp[-1] = rval;
-}
-END_CASE(JSOP_DESCENDANTS)
-
-BEGIN_CASE(JSOP_FILTER)
-{
-    JS_ASSERT(!script->strict);
-
-    /*
-     * We push the hole value before jumping to [enditer] so we can detect the
-     * first iteration and direct js_StepXMLListFilter to initialize filter's
-     * state.
-     */
-    PUSH_HOLE();
-    len = GET_JUMP_OFFSET(regs.pc);
-    JS_ASSERT(len > 0);
-}
-END_VARLEN_CASE
-
-BEGIN_CASE(JSOP_ENDFILTER)
-{
-    JS_ASSERT(!script->strict);
-
-    bool cond = !regs.sp[-1].isMagic();
-    if (cond) {
-        /* Exit the "with" block left from the previous iteration. */
-        regs.fp()->popWith(cx);
-    }
-    if (!js_StepXMLListFilter(cx, cond))
-        goto error;
-    if (!regs.sp[-1].isNull()) {
-        /*
-         * Decrease sp after EnterWith returns as we use sp[-1] there to root
-         * temporaries.
-         */
-        JS_ASSERT(IsXML(regs.sp[-1]));
-        if (!EnterWith(cx, -2))
-            goto error;
-        regs.sp--;
-        len = GET_JUMP_OFFSET(regs.pc);
-        JS_ASSERT(len < 0);
-        BRANCH(len);
-    }
-    regs.sp--;
-}
-END_CASE(JSOP_ENDFILTER);
-
-BEGIN_CASE(JSOP_TOXML)
-{
-    JS_ASSERT(!script->strict);
-
-    cx->runtime->gcExactScanningEnabled = false;
-
-    Value rval = regs.sp[-1];
-    JSObject *obj = js_ValueToXMLObject(cx, rval);
-    if (!obj)
-        goto error;
-    regs.sp[-1].setObject(*obj);
-}
-END_CASE(JSOP_TOXML)
-
-BEGIN_CASE(JSOP_TOXMLLIST)
-{
-    JS_ASSERT(!script->strict);
-
-    Value rval = regs.sp[-1];
-    JSObject *obj = js_ValueToXMLListObject(cx, rval);
-    if (!obj)
-        goto error;
-    regs.sp[-1].setObject(*obj);
-}
-END_CASE(JSOP_TOXMLLIST)
-
-BEGIN_CASE(JSOP_XMLTAGEXPR)
-{
-    JS_ASSERT(!script->strict);
-
-    Value rval = regs.sp[-1];
-    JSString *str = ToString<CanGC>(cx, rval);
-    if (!str)
-        goto error;
-    regs.sp[-1].setString(str);
-}
-END_CASE(JSOP_XMLTAGEXPR)
-
-BEGIN_CASE(JSOP_XMLELTEXPR)
-{
-    JS_ASSERT(!script->strict);
-
-    Value rval = regs.sp[-1];
-    JSString *str;
-    if (IsXML(rval)) {
-        str = js_ValueToXMLString(cx, rval);
-    } else {
-        str = ToString<CanGC>(cx, rval);
-        if (str)
-            str = js_EscapeElementValue(cx, str);
-    }
-    if (!str)
-        goto error;
-    regs.sp[-1].setString(str);
-}
-END_CASE(JSOP_XMLELTEXPR)
-
-BEGIN_CASE(JSOP_XMLCDATA)
-{
-    JS_ASSERT(!script->strict);
-
-    JSAtom *atom = script->getAtom(regs.pc);
-    JSObject *obj = js_NewXMLSpecialObject(cx, JSXML_CLASS_TEXT, NULL, atom);
-    if (!obj)
-        goto error;
-    PUSH_OBJECT(*obj);
-}
-END_CASE(JSOP_XMLCDATA)
-
-BEGIN_CASE(JSOP_XMLCOMMENT)
-{
-    JS_ASSERT(!script->strict);
-
-    JSAtom *atom = script->getAtom(regs.pc);
-    JSObject *obj = js_NewXMLSpecialObject(cx, JSXML_CLASS_COMMENT, NULL, atom);
-    if (!obj)
-        goto error;
-    PUSH_OBJECT(*obj);
-}
-END_CASE(JSOP_XMLCOMMENT)
-
-BEGIN_CASE(JSOP_XMLPI)
-{
-    JS_ASSERT(!script->strict);
-
-    JSAtom *atom = script->getAtom(regs.pc);
-    Value rval = regs.sp[-1];
-    JSString *str2 = rval.toString();
-    JSObject *obj = js_NewXMLSpecialObject(cx, JSXML_CLASS_PROCESSING_INSTRUCTION, atom, str2);
-    if (!obj)
-        goto error;
-    regs.sp[-1].setObject(*obj);
-}
-END_CASE(JSOP_XMLPI)
-
-BEGIN_CASE(JSOP_GETFUNNS)
-{
-    JS_ASSERT(!script->strict);
-
-    Value rval;
-    if (!cx->fp()->global().getFunctionNamespace(cx, &rval))
-        goto error;
-    PUSH_COPY(rval);
-}
-END_CASE(JSOP_GETFUNNS)
-#endif /* JS_HAS_XML_SUPPORT */
-
 BEGIN_CASE(JSOP_ENTERBLOCK)
 BEGIN_CASE(JSOP_ENTERLET0)
 BEGIN_CASE(JSOP_ENTERLET1)
 {
     StaticBlockObject &blockObj = script->getObject(regs.pc)->asStaticBlock();
 
     if (op == JSOP_ENTERBLOCK) {
         JS_ASSERT(regs.stackDepth() == blockObj.stackDepth());
--- a/js/src/jsinterpinlines.h
+++ b/js/src/jsinterpinlines.h
@@ -215,31 +215,16 @@ AssertValidPropertyCacheHit(JSContext *c
 #else
 inline void
 AssertValidPropertyCacheHit(JSContext *cx, JSObject *start, JSObject *found,
                             PropertyCacheEntry *entry)
 {}
 #endif
 
 inline bool
-GetPropertyGenericMaybeCallXML(JSContext *cx, JSOp op, HandleObject obj, HandleId id, MutableHandleValue vp)
-{
-    /*
-     * Various XML properties behave differently when accessed in a
-     * call vs. normal context, and getGeneric will not work right.
-     */
-#if JS_HAS_XML_SUPPORT
-    if (op == JSOP_CALLPROP && obj->isXML())
-        return js_GetXMLMethod(cx, obj, id, vp);
-#endif
-
-    return JSObject::getGeneric(cx, obj, obj, id, vp);
-}
-
-inline bool
 GetLengthProperty(const Value &lval, MutableHandleValue vp)
 {
     /* Optimize length accesses on strings, arrays, and arguments. */
     if (lval.isString()) {
         vp.setInt32(lval.toString()->length());
         return true;
     }
     if (lval.isObject()) {
@@ -299,17 +284,17 @@ GetPropertyOperation(JSContext *cx, JSSc
     }
 
     bool wasObject = lval.isObject();
 
     RootedId id(cx, NameToId(name));
     RootedObject nobj(cx, obj);
 
     if (obj->getOps()->getProperty) {
-        if (!GetPropertyGenericMaybeCallXML(cx, op, nobj, id, vp))
+        if (!JSObject::getGeneric(cx, nobj, nobj, id, vp))
             return false;
     } else {
         if (!GetPropertyHelper(cx, nobj, id, JSGET_CACHE_RESULT, vp))
             return false;
     }
 
 #if JS_HAS_NO_SUCH_METHOD
     if (op == JSOP_CALLPROP &&
@@ -572,25 +557,16 @@ AddOperation(JSContext *cx, HandleScript
             res->setDouble(double(l) + double(r));
             types::TypeScript::MonitorOverflow(cx, script, pc);
         } else {
             res->setInt32(sum);
         }
         return true;
     }
 
-#if JS_HAS_XML_SUPPORT
-    if (IsXML(lhs) && IsXML(rhs)) {
-        if (!js_ConcatenateXML(cx, &lhs.toObject(), &rhs.toObject(), res))
-            return false;
-        types::TypeScript::MonitorUnknown(cx, script, pc);
-        return true;
-    }
-#endif
-
     /*
      * If either operand is an object, any non-integer result must be
      * reported to inference.
      */
     bool lIsObject = lhs.isObject(), rIsObject = rhs.isObject();
 
     if (!ToPrimitive(cx, lhs.address()))
         return false;
@@ -762,30 +738,16 @@ ToIdOperation(JSContext *cx, HandleScrip
     return true;
 }
 
 static JS_ALWAYS_INLINE bool
 GetObjectElementOperation(JSContext *cx, JSOp op, JSObject *objArg, bool wasObject,
                           HandleValue rref, MutableHandleValue res)
 {
     do {
-
-#if JS_HAS_XML_SUPPORT
-        if (op == JSOP_CALLELEM && JS_UNLIKELY(objArg->isXML())) {
-            RootedObject obj(cx, objArg);
-            RootedId id(cx);
-            if (!FetchElementId(cx, obj, rref, &id, res))
-                return false;
-            if (!js_GetXMLMethod(cx, obj, id, res))
-                return false;
-            objArg = obj;
-            break;
-        }
-#endif
-
         // Don't call GetPcScript (needed for analysis) from inside Ion since it's expensive.
         bool analyze = !cx->fp()->beginsIonActivation();
 
         uint32_t index;
         if (IsDefinitelyIndex(rref, &index)) {
             if (analyze && !objArg->isNative()) {
                 JSScript *script = NULL;
                 jsbytecode *pc = NULL;
--- a/js/src/jsiter.cpp
+++ b/js/src/jsiter.cpp
@@ -25,20 +25,16 @@
 #include "jsiter.h"
 #include "jslock.h"
 #include "jsnum.h"
 #include "jsobj.h"
 #include "jsopcode.h"
 #include "jsproxy.h"
 #include "jsscript.h"
 
-#if JS_HAS_XML_SUPPORT
-#include "jsxml.h"
-#endif
-
 #include "builtin/ParallelArray.h"
 #include "ds/Sort.h"
 #include "frontend/TokenStream.h"
 #include "gc/Marking.h"
 #include "vm/GlobalObject.h"
 #include "vm/Shape.h"
 
 #include "jsinferinlines.h"
@@ -146,21 +142,18 @@ EnumerateNativeProperties(JSContext *cx,
     size_t initialLength = props->length();
 
     /* Collect all unique properties from this object's scope. */
     Shape::Range r = pobj->lastProperty()->all();
     Shape::Range::AutoRooter root(cx, &r);
     for (; !r.empty(); r.popFront()) {
         Shape &shape = r.front();
 
-        if (!JSID_IS_DEFAULT_XML_NAMESPACE(shape.propid()) &&
-            !Enumerate(cx, pobj, shape.propid(), shape.enumerable(), flags, ht, props))
-        {
+        if (!Enumerate(cx, pobj, shape.propid(), shape.enumerable(), flags, ht, props))
             return false;
-        }
     }
 
     ::Reverse(props->begin() + initialLength, props->end());
     return true;
 }
 
 #ifdef JS_MORE_DETERMINISTIC
 
@@ -259,20 +252,16 @@ Snapshot(JSContext *cx, RawObject pobj_,
                         return false;
                 }
             }
         }
 
         if (flags & JSITER_OWNONLY)
             break;
 
-#if JS_HAS_XML_SUPPORT
-        if (pobj->isXML())
-            break;
-#endif
     } while ((pobj = pobj->getProto()) != NULL);
 
 #ifdef JS_MORE_DETERMINISTIC
 
     /*
      * In some cases the enumeration order for an object depends on the
      * execution mode (interpreter vs. JIT), especially for native objects
      * with a class enumerate hook (where resolving a property changes the
--- a/js/src/jsmemorymetrics.cpp
+++ b/js/src/jsmemorymetrics.cpp
@@ -59,19 +59,16 @@ CompartmentStats::gcHeapThingsSize()
     n += gcHeapStringsShort;
     n += gcHeapShapesTreeGlobalParented;
     n += gcHeapShapesTreeNonGlobalParented;
     n += gcHeapShapesDict;
     n += gcHeapShapesBase;
     n += gcHeapScripts;
     n += gcHeapTypeObjects;
     n += gcHeapIonCodes;
-#if JS_HAS_XML_SUPPORT
-    n += gcHeapXML;
-#endif
 
 #ifdef DEBUG
     size_t n2 = n;
     n2 += gcHeapArenaAdmin;
     n2 += gcHeapUnusedGcThings;
     // These numbers should sum to a multiple of the arena size.
     JS_ASSERT(n2 % gc::ArenaSize == 0);
 #endif
@@ -244,23 +241,16 @@ StatsCellCallback(JSRuntime *rt, void *d
     }
     case JSTRACE_TYPE_OBJECT:
     {
         types::TypeObject *obj = static_cast<types::TypeObject *>(thing);
         cStats->gcHeapTypeObjects += thingSize;
         cStats->typeInference.typeObjects += obj->sizeOfExcludingThis(rtStats->mallocSizeOf);
         break;
     }
-#if JS_HAS_XML_SUPPORT
-    case JSTRACE_XML:
-    {
-        cStats->gcHeapXML += thingSize;
-        break;
-    }
-#endif
     }
     // Yes, this is a subtraction:  see StatsArenaCallback() for details.
     cStats->gcHeapUnusedGcThings -= thingSize;
 }
 
 JS_PUBLIC_API(bool)
 JS::CollectRuntimeStats(JSRuntime *rt, RuntimeStats *rtStats, ObjectPrivateVisitor *opv)
 {
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -37,17 +37,16 @@
 #include "jsprototypes.h"
 #include "jsproxy.h"
 #include "jsscript.h"
 #include "jsstr.h"
 #include "jsdbgapi.h"
 #include "json.h"
 #include "jswatchpoint.h"
 #include "jswrapper.h"
-#include "jsxml.h"
 
 #include "builtin/MapObject.h"
 #include "builtin/Module.h"
 #include "builtin/ParallelArray.h"
 #include "frontend/BytecodeCompiler.h"
 #include "frontend/Parser.h"
 #include "gc/Marking.h"
 #include "js/MemoryMetrics.h"
@@ -2169,18 +2168,17 @@ js::DefineConstructorAndPrototype(JSCont
 
         RootedValue value(cx, ObjectValue(*fun));
         if (!DefineStandardSlot(cx, obj, key, atom, value, 0, named))
             goto bad;
 
         /*
          * Optionally construct the prototype object, before the class has
          * been fully initialized.  Allow the ctor to replace proto with a
-         * different object, as is done for operator new -- and as at least
-         * XML support requires.
+         * different object, as is done for operator new.
          */
         ctor = fun;
         if (!LinkConstructorAndPrototype(cx, ctor, proto))
             goto bad;
 
         /* Bootstrap Function.prototype (see also JS_InitStandardClasses). */
         Rooted<TaggedProto> tagged(cx, TaggedProto(proto));
         if (ctor->getClass() == clasp && !ctor->splicePrototype(cx, clasp, tagged))
@@ -2786,23 +2784,16 @@ static JSClassInitializerOp lazy_prototy
 };
 
 bool
 js::SetClassAndProto(JSContext *cx, HandleObject obj,
                      Class *clasp, Handle<js::TaggedProto> proto, bool checkForCycles)
 {
     JS_ASSERT_IF(!checkForCycles, obj.get() != proto.raw());
 
-#if JS_HAS_XML_SUPPORT
-    if (proto.isObject() && proto.toObject()->isXML()) {
-        JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_XML_PROTO_FORBIDDEN);
-        return false;
-    }
-#endif
-
     /*
      * Regenerate shapes for all of the scopes along the old prototype chain,
      * in case any entries were filled by looking up through obj. Stop when a
      * non-native object is found, prototype lookups will not be cached across
      * these.
      *
      * How this shape change is done is very delicate; the change can be made
      * either by marking the object's prototype as uncacheable (such that the
@@ -3905,26 +3896,19 @@ baseops::GetPropertyDefault(JSContext *c
 }
 
 JSBool
 js::GetMethod(JSContext *cx, HandleObject obj, HandleId id, unsigned getHow, MutableHandleValue vp)
 {
     JSAutoResolveFlags rf(cx, 0);
 
     GenericIdOp op = obj->getOps()->getGeneric;
-    if (!op) {
-#if JS_HAS_XML_SUPPORT
-        JS_ASSERT(!obj->isXML());
-#endif
+    if (!op)
         return GetPropertyHelper(cx, obj, id, getHow, vp);
-    }
-#if JS_HAS_XML_SUPPORT
-    if (obj->isXML())
-        return js_GetXMLMethod(cx, obj, id, vp);
-#endif
+
     return op(cx, obj, obj, id, vp);
 }
 
 static bool
 MaybeReportUndeclaredVarAssignment(JSContext *cx, JSString *propname)
 {
     {
         UnrootedScript script = cx->stack.currentScript(NULL, ContextStack::ALLOW_CROSS_COMPARTMENT);
@@ -4404,19 +4388,16 @@ MaybeCallMethod(JSContext *cx, HandleObj
     }
     return Invoke(cx, ObjectValue(*obj), vp, 0, NULL, vp.address());
 }
 
 JSBool
 js::DefaultValue(JSContext *cx, HandleObject obj, JSType hint, MutableHandleValue vp)
 {
     JS_ASSERT(hint == JSTYPE_NUMBER || hint == JSTYPE_STRING || hint == JSTYPE_VOID);
-#if JS_HAS_XML_SUPPORT
-    JS_ASSERT(!obj->isXML());
-#endif
 
     Rooted<jsid> id(cx);
 
     Class *clasp = obj->getClass();
     if (hint == JSTYPE_STRING) {
         id = NameToId(cx->names().toString);
 
         /* Optimize (new String(...)).toString(). */
--- a/js/src/jsobj.h
+++ b/js/src/jsobj.h
@@ -232,17 +232,16 @@ extern Class ProxyClass;
 extern Class RegExpClass;
 extern Class RegExpStaticsClass;
 extern Class SetIteratorClass;
 extern Class StopIterationClass;
 extern Class StringClass;
 extern Class StrictArgumentsObjectClass;
 extern Class WeakMapClass;
 extern Class WithClass;
-extern Class XMLFilterClass;
 
 class ArgumentsObject;
 class ArrayBufferObject;
 class BlockObject;
 class BooleanObject;
 class ClonedBlockObject;
 class DataViewObject;
 class DebugScopeObject;
@@ -695,55 +694,16 @@ class JSObject : public js::ObjectImpl
   public:
     /*
      * Iterator-specific getters and setters.
      */
 
     static const uint32_t ITER_CLASS_NFIXED_SLOTS = 1;
 
     /*
-     * XML-related getters and setters.
-     */
-
-    /*
-     * Slots for XML-related classes are as follows:
-     * - NamespaceClass.base reserves the *_NAME_* and *_NAMESPACE_* slots.
-     * - QNameClass.base, AttributeNameClass, AnyNameClass reserve
-     *   the *_NAME_* and *_QNAME_* slots.
-     * - Others (XMLClass, js_XMLFilterClass) don't reserve any slots.
-     */
-  private:
-    static const uint32_t JSSLOT_NAME_PREFIX          = 0;   // shared
-    static const uint32_t JSSLOT_NAME_URI             = 1;   // shared
-
-    static const uint32_t JSSLOT_NAMESPACE_DECLARED   = 2;
-
-    static const uint32_t JSSLOT_QNAME_LOCAL_NAME     = 2;
-
-  public:
-    static const uint32_t NAMESPACE_CLASS_RESERVED_SLOTS = 3;
-    static const uint32_t QNAME_CLASS_RESERVED_SLOTS     = 3;
-
-    inline JSLinearString *getNamePrefix() const;
-    inline jsval getNamePrefixVal() const;
-    inline void setNamePrefix(JSLinearString *prefix);
-    inline void clearNamePrefix();
-
-    inline JSLinearString *getNameURI() const;
-    inline jsval getNameURIVal() const;
-    inline void setNameURI(JSLinearString *uri);
-
-    inline jsval getNamespaceDeclared() const;
-    inline void setNamespaceDeclared(jsval decl);
-
-    inline JSAtom *getQNameLocalName() const;
-    inline jsval getQNameLocalNameVal() const;
-    inline void setQNameLocalName(JSAtom *name);
-
-    /*
      * Back to generic stuff.
      */
     inline bool isCallable();
 
     inline void finish(js::FreeOp *fop);
     JS_ALWAYS_INLINE void finalize(js::FreeOp *fop);
 
     static inline bool hasProperty(JSContext *cx, js::HandleObject obj,
@@ -1021,22 +981,16 @@ class JSObject : public js::ObjectImpl
     inline bool isRegExp() const;
     inline bool isRegExpStatics() const;
     inline bool isScope() const;
     inline bool isScript() const;
     inline bool isSetIterator() const;
     inline bool isStopIteration() const;
     inline bool isTypedArray() const;
     inline bool isWeakMap() const;
-#if JS_HAS_XML_SUPPORT
-    inline bool isNamespace() const;
-    inline bool isQName() const;
-    inline bool isXML() const;
-    inline bool isXMLId() const;
-#endif
 
     /* Subtypes of ScopeObject. */
     inline bool isBlock() const;
     inline bool isCall() const;
     inline bool isDeclEnv() const;
     inline bool isNestedScope() const;
     inline bool isWith() const;
     inline bool isClonedBlock() const;
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -17,17 +17,16 @@
 #include "jslock.h"
 #include "jsnum.h"
 #include "jsobj.h"
 #include "jsprobes.h"
 #include "jspropertytree.h"
 #include "jsproxy.h"
 #include "jsstr.h"
 #include "jstypedarray.h"
-#include "jsxml.h"
 #include "jswrapper.h"
 
 #include "builtin/MapObject.h"
 #include "builtin/Iterator-inl.h"
 #include "gc/Barrier.h"
 #include "gc/Marking.h"
 #include "gc/Root.h"
 #include "js/MemoryMetrics.h"
@@ -744,107 +743,16 @@ JSObject::getDateUTCTime() const
 
 inline void
 JSObject::setDateUTCTime(const js::Value &time)
 {
     JS_ASSERT(isDate());
     setFixedSlot(JSSLOT_DATE_UTC_TIME, time);
 }
 
-#if JS_HAS_XML_SUPPORT
-
-inline JSLinearString *
-JSObject::getNamePrefix() const
-{
-    JS_ASSERT(isNamespace() || isQName());
-    const js::Value &v = getSlot(JSSLOT_NAME_PREFIX);
-    return !v.isUndefined() ? &v.toString()->asLinear() : NULL;
-}
-
-inline jsval
-JSObject::getNamePrefixVal() const
-{
-    JS_ASSERT(isNamespace() || isQName());
-    return getSlot(JSSLOT_NAME_PREFIX);
-}
-
-inline void
-JSObject::setNamePrefix(JSLinearString *prefix)
-{
-    JS_ASSERT(isNamespace() || isQName());
-    setSlot(JSSLOT_NAME_PREFIX, prefix ? js::StringValue(prefix) : js::UndefinedValue());
-}
-
-inline void
-JSObject::clearNamePrefix()
-{
-    JS_ASSERT(isNamespace() || isQName());
-    setSlot(JSSLOT_NAME_PREFIX, js::UndefinedValue());
-}
-
-inline JSLinearString *
-JSObject::getNameURI() const
-{
-    JS_ASSERT(isNamespace() || isQName());
-    const js::Value &v = getSlot(JSSLOT_NAME_URI);
-    return !v.isUndefined() ? &v.toString()->asLinear() : NULL;
-}
-
-inline jsval
-JSObject::getNameURIVal() const
-{
-    JS_ASSERT(isNamespace() || isQName());
-    return getSlot(JSSLOT_NAME_URI);
-}
-
-inline void
-JSObject::setNameURI(JSLinearString *uri)
-{
-    JS_ASSERT(isNamespace() || isQName());
-    setSlot(JSSLOT_NAME_URI, uri ? js::StringValue(uri) : js::UndefinedValue());
-}
-
-inline jsval
-JSObject::getNamespaceDeclared() const
-{
-    JS_ASSERT(isNamespace());
-    return getSlot(JSSLOT_NAMESPACE_DECLARED);
-}
-
-inline void
-JSObject::setNamespaceDeclared(jsval decl)
-{
-    JS_ASSERT(isNamespace());
-    setSlot(JSSLOT_NAMESPACE_DECLARED, decl);
-}
-
-inline JSAtom *
-JSObject::getQNameLocalName() const
-{
-    JS_ASSERT(isQName());
-    const js::Value &v = getSlot(JSSLOT_QNAME_LOCAL_NAME);
-    return !v.isUndefined() ? &v.toString()->asAtom() : NULL;
-}
-
-inline jsval
-JSObject::getQNameLocalNameVal() const
-{
-    JS_ASSERT(isQName());
-    return getSlot(JSSLOT_QNAME_LOCAL_NAME);
-}
-
-inline void
-JSObject::setQNameLocalName(JSAtom *name)
-{
-    JS_ASSERT(isQName());
-    setSlot(JSSLOT_QNAME_LOCAL_NAME, name ? js::StringValue(name) : js::UndefinedValue());
-}
-
-#endif
-
 /* static */ inline bool
 JSObject::setSingletonType(JSContext *cx, js::HandleObject obj)
 {
     if (!cx->typeInferenceEnabled())
         return true;
 
     JS_ASSERT(!obj->hasLazyType());
     JS_ASSERT_IF(obj->getTaggedProto().isObject(),
@@ -1027,37 +935,16 @@ JSObject::asString()
 
 inline bool
 JSObject::isDebugScope() const
 {
     extern bool js_IsDebugScopeSlow(js::RawObject obj);
     return getClass() == &js::ObjectProxyClass && js_IsDebugScopeSlow(const_cast<JSObject*>(this));
 }
 
-#if JS_HAS_XML_SUPPORT
-inline bool JSObject::isNamespace() const { return hasClass(&js::NamespaceClass); }
-inline bool JSObject::isXML() const { return hasClass(&js::XMLClass); }
-
-inline bool
-JSObject::isXMLId() const
-{
-    return hasClass(&js::QNameClass)
-        || hasClass(&js::AttributeNameClass)
-        || hasClass(&js::AnyNameClass);
-}
-
-inline bool
-JSObject::isQName() const
-{
-    return hasClass(&js::QNameClass)
-        || hasClass(&js::AttributeNameClass)
-        || hasClass(&js::AnyNameClass);
-}
-#endif /* JS_HAS_XML_SUPPORT */
-
 /* static */ inline JSObject *
 JSObject::create(JSContext *cx, js::gc::AllocKind kind,
                  js::HandleShape shape, js::HandleTypeObject type, js::HeapSlot *slots)
 {
     /*
      * Callers must use dynamicSlotsCount to size the initial slot array of the
      * object. We can't check the allocated capacity of the dynamic slots, but
      * make sure their presence is consistent with the shape.
@@ -1478,35 +1365,16 @@ GetInnerObject(JSContext *cx, HandleObje
 inline JSObject *
 GetOuterObject(JSContext *cx, HandleObject obj)
 {
     if (JSObjectOp op = obj->getClass()->ext.outerObject)
         return op(cx, obj);
     return obj;
 }
 
-#if JS_HAS_XML_SUPPORT
-/*
- * Methods to test whether an object or a value is of type "xml" (per typeof).
- */
-
-#define VALUE_IS_XML(v)     ((v).isObject() && (v).toObject().isXML())
-
-static inline bool
-IsXML(const js::Value &v)
-{
-    return v.isObject() && v.toObject().isXML();
-}
-
-#else
-
-#define VALUE_IS_XML(v)     false
-
-#endif /* JS_HAS_XML_SUPPORT */
-
 static inline bool
 IsStopIteration(const js::Value &v)
 {
     return v.isObject() && v.toObject().isStopIteration();
 }
 
 static JS_ALWAYS_INLINE bool
 IsFunctionObject(const js::Value &v)
@@ -1939,33 +1807,16 @@ ValueMightBeSpecial(const Value &propval
 {
     return propval.isObject();
 }
 
 static JS_ALWAYS_INLINE bool
 ValueIsSpecial(JSObject *obj, MutableHandleValue propval, MutableHandle<SpecialId> sidp,
                JSContext *cx)
 {
-#if JS_HAS_XML_SUPPORT
-    if (!propval.isObject())
-        return false;
-
-    if (obj->isXML()) {
-        sidp.set(SpecialId(propval.toObject()));
-        return true;
-    }
-
-    JSObject &propobj = propval.toObject();
-    JSAtom *name;
-    if (propobj.isQName() && GetLocalNameFromFunctionQName(&propobj, &name, cx)) {
-        propval.setString(name);
-        return false;
-    }
-#endif
-
     return false;
 }
 
 JSObject *
 DefineConstructorAndPrototype(JSContext *cx, HandleObject obj, JSProtoKey key, HandleAtom atom,
                               JSObject *protoProto, Class *clasp,
                               Native constructor, unsigned nargs,
                               JSPropertySpec *ps, JSFunctionSpec *fs,
--- a/js/src/json.cpp
+++ b/js/src/json.cpp
@@ -19,17 +19,16 @@
 #include "jsnum.h"
 #include "jsobj.h"
 #include "json.h"
 #include "jsonparser.h"
 #include "jsprf.h"
 #include "jsstr.h"
 #include "jstypes.h"
 #include "jsutil.h"
-#include "jsxml.h"
 
 #include "frontend/TokenStream.h"
 #include "vm/StringBuffer.h"
 
 #include "jsatominlines.h"
 #include "jsboolinlines.h"
 #include "jsinferinlines.h"
 #include "jsobjinlines.h"
@@ -355,17 +354,17 @@ PreprocessValue(JSContext *cx, HandleObj
  * gauntlet will result in Str returning |undefined|.  This function is used to
  * properly omit properties resulting in such values when stringifying objects,
  * while properly stringifying such properties as null when they're encountered
  * in arrays.
  */
 static inline bool
 IsFilteredValue(const Value &v)
 {
-    return v.isUndefined() || js_IsCallable(v) || VALUE_IS_XML(v);
+    return v.isUndefined() || js_IsCallable(v);
 }
 
 /* ES5 15.12.3 JO. */
 static JSBool
 JO(JSContext *cx, HandleObject obj, StringifyContext *scx)
 {
     /*
      * This method implements the JO algorithm in ES5 15.12.3, but:
--- a/js/src/jsopcode.cpp
+++ b/js/src/jsopcode.cpp
@@ -2101,24 +2101,20 @@ DecompileDestructuringLHS(SprintStack *s
         LOCAL_ASSERT(op == JSOP_ENUMELEM || op == JSOP_ENUMCONSTELEM);
         xval = PopStr(ss, JSOP_NOP);
         lval = PopStr(ss, JSOP_GETPROP);
         ss->sprinter.setOffset(todo);
         if (*lval == '\0') {
             /* lval is from JSOP_BINDNAME, so just print xval. */
             todo = ss->sprinter.put(xval);
         } else if (*xval == '\0') {
-            /* xval is from JSOP_SETCALL or JSOP_BINDXMLNAME, print lval. */
+            /* xval is from JSOP_SETCALL, so print lval. */
             todo = ss->sprinter.put(lval);
         } else {
-            todo = Sprint(&ss->sprinter,
-                          (JOF_OPMODE(ss->opcodes[ss->top+1]) == JOF_XMLNAME)
-                          ? "%s.%s"
-                          : "%s[%s]",
-                          lval, xval);
+            todo = Sprint(&ss->sprinter, "%s[%s]", lval, xval);
         }
         if (todo < 0)
             return NULL;
         break;
       }
     }
 
     LOCAL_ASSERT(pc < endpc);
@@ -2622,28 +2618,22 @@ Decompile(SprintStack *ss, jsbytecode *p
     int i, argc;
     RootedAtom atom(cx);
     JSObject *obj;
     RootedFunction fun(cx);
     JSString *str;
     JSBool ok;
     JSBool foreach;
     JSBool defaultsSwitch = false;
-#if JS_HAS_XML_SUPPORT
-    JSBool inXML, quoteAttr;
-#else
-#define inXML JS_FALSE
-#endif
     jsval val;
 
     static const char exception_cookie[] = "/*EXCEPTION*/";
     static const char retsub_pc_cookie[] = "/*RETSUB_PC*/";
     static const char forelem_cookie[]   = "/*FORELEM*/";
     static const char with_cookie[]      = "/*WITH*/";
-    static const char dot_format[]       = "%s.%s";
     static const char index_format[]     = "%s[%s]";
     static const char predot_format[]    = "%s%s.%s";
     static const char postdot_format[]   = "%s.%s%s";
     static const char preindex_format[]  = "%s%s[%s]";
     static const char postindex_format[] = "%s[%s]%s";
     static const char ss_format[]        = "%s%s";
     static const char sss_format[]       = "%s%s%s";
 
@@ -2729,19 +2719,16 @@ Decompile(SprintStack *ss, jsbytecode *p
     endpc = (nb < 0) ? jp->script->code + jp->script->length : pc + nb;
     tail = -1;
     todo = -2;                  /* NB: different from Sprint() error return. */
     saveop = JSOP_NOP;
     sn = NULL;
     rval = NULL;
     bool forOf = false;
     foreach = false;
-#if JS_HAS_XML_SUPPORT
-    inXML = quoteAttr = false;
-#endif
 
     while (nb < 0 || pc < endpc) {
         /*
          * Move saveop to lastop so prefixed bytecodes can take special action
          * while sharing maximal code.  Set op and saveop to the new bytecode,
          * use op in POP_STR to trigger automatic parenthesization, but push
          * saveop at the bottom of the loop if this op pushes.  Thus op may be
          * set to nop or otherwise mutated to suppress auto-parens.
@@ -2836,19 +2823,16 @@ Decompile(SprintStack *ss, jsbytecode *p
                          * uncategorized for our purposes, so we must write
                          * per-op special case code here.
                          */
                         switch (op) {
                           case JSOP_ENUMELEM:
                           case JSOP_ENUMCONSTELEM:
                             op = JSOP_GETELEM;
                             break;
-                          case JSOP_SETXMLNAME:
-                            op = JSOp(JSOP_GETELEM2);
-                            break;
                           default:
                             LOCAL_ASSERT(0);
                         }
                     }
                 }
             }
 
             saveop = op;
@@ -2875,29 +2859,23 @@ Decompile(SprintStack *ss, jsbytecode *p
                      * problem).
                      */
                     op = (JSOp) pc[oplen];
                     rval = PopStr(ss, op, &lastrvalpc);
                     (void)PopStr(ss, op, &lastlvalpc);
 
                     /* Print only the right operand of the assignment-op. */
                     todo = ss->sprinter.put(rval);
-                } else if (!inXML) {
+                } else {
                     rval = PopStrPrecDupe(ss, cs->prec + !!(cs->format & JOF_LEFTASSOC), &rvalpc);
                     lval = PopStrPrec(ss, cs->prec + !(cs->format & JOF_LEFTASSOC), &lvalpc);
                     todo = ss->sprinter.getOffset();
                     SprintOpcode(ss, lval, lvalpc, pc, todo);
                     Sprint(&ss->sprinter, " %s ", token);
                     SprintOpcode(ss, rval, rvalpc, pc, todo);
-                } else {
-                    /* In XML, just concatenate the two operands. */
-                    LOCAL_ASSERT(op == JSOP_ADD);
-                    rval = POP_STR();
-                    lval = POP_STR();
-                    todo = Sprint(&ss->sprinter, ss_format, lval, rval);
                 }
                 break;
 
               case 1:
                 rval = PopStrDupe(ss, op, &rvalpc);
                 todo = ss->sprinter.put(token);
                 SprintOpcode(ss, rval, rvalpc, pc, todo);
                 break;
@@ -4169,21 +4147,17 @@ Decompile(SprintStack *ss, jsbytecode *p
                 op = JSOP_GETELEM;      /* lval must have high precedence */
                 lval = POP_STR();
                 op = saveop;
                 rval = POP_STR();
                 LOCAL_ASSERT(strcmp(rval, forelem_cookie) == 0);
                 if (*xval == '\0') {
                     todo = ss->sprinter.put(lval);
                 } else {
-                    todo = Sprint(&ss->sprinter,
-                                  (JOF_OPMODE(lastop) == JOF_XMLNAME)
-                                  ? dot_format
-                                  : index_format,
-                                  lval, xval);
+                    todo = Sprint(&ss->sprinter, index_format, lval, xval);
                 }
                 break;
 
               case JSOP_GETTER:
               case JSOP_SETTER:
                 todo = -2;
                 break;
 
@@ -4447,33 +4421,19 @@ Decompile(SprintStack *ss, jsbytecode *p
 
               case JSOP_DELELEM:
                 op = JSOP_NOP;          /* turn off parens */
                 xval = POP_STR();
                 op = JSOP_GETPROP;
                 lval = POP_STR();
                 if (*xval == '\0')
                     goto do_delete_lval;
-                todo = Sprint(&ss->sprinter,
-                              (JOF_OPMODE(lastop) == JOF_XMLNAME)
-                              ? "%s %s.%s"
-                              : "%s %s[%s]",
-                              js_delete_str, lval, xval);
+                todo = Sprint(&ss->sprinter, "%s %s[%s]", js_delete_str, lval, xval);
                 break;
 
-#if JS_HAS_XML_SUPPORT
-              case JSOP_DELDESC:
-                xval = POP_STR();
-                op = JSOP_GETPROP;
-                lval = POP_STR();
-                todo = Sprint(&ss->sprinter, "%s %s..%s",
-                              js_delete_str, lval, xval);
-                break;
-#endif
-
               case JSOP_TYPEOFEXPR:
               case JSOP_TYPEOF:
               case JSOP_VOID:
               {
                 const char *prefix = (op == JSOP_VOID) ? js_void_str : js_typeof_str;
                 rval = PopStrDupe(ss, op, &rvalpc);
                 todo = ss->sprinter.getOffset();
                 Sprint(&ss->sprinter, "%s ", prefix);
@@ -4525,20 +4485,17 @@ Decompile(SprintStack *ss, jsbytecode *p
 
               case JSOP_INCELEM:
               case JSOP_DECELEM:
                 op = JSOP_NOP;          /* turn off parens */
                 xval = POP_STR();
                 op = JSOP_GETELEM;
                 lval = POP_STR();
                 if (*xval != '\0') {
-                    todo = Sprint(&ss->sprinter,
-                                  (JOF_OPMODE(lastop) == JOF_XMLNAME)
-                                  ? predot_format
-                                  : preindex_format,
+                    todo = Sprint(&ss->sprinter, preindex_format,
                                   js_incop_strs[!(cs->format & JOF_INC)],
                                   lval, xval);
                 } else {
                     todo = Sprint(&ss->sprinter, ss_format,
                                   js_incop_strs[!(cs->format & JOF_INC)], lval);
                 }
                 len += GetDecomposeLength(pc, JSOP_INCELEM_LENGTH);
                 break;
@@ -4586,21 +4543,17 @@ Decompile(SprintStack *ss, jsbytecode *p
 
               case JSOP_ELEMINC:
               case JSOP_ELEMDEC:
                 op = JSOP_NOP;          /* turn off parens */
                 xval = POP_STR();
                 op = JSOP_GETELEM;
                 lval = POP_STR();
                 if (*xval != '\0') {
-                    todo = Sprint(&ss->sprinter,
-                                  (JOF_OPMODE(lastop) == JOF_XMLNAME)
-                                  ? postdot_format
-                                  : postindex_format,
-                                  lval, xval,
+                    todo = Sprint(&ss->sprinter, postindex_format, lval, xval,
                                   js_incop_strs[!(cs->format & JOF_INC)]);
                 } else {
                     todo = Sprint(&ss->sprinter, ss_format,
                                   lval, js_incop_strs[!(cs->format & JOF_INC)]);
                 }
                 len += GetDecomposeLength(pc, JSOP_ELEMINC_LENGTH);
                 break;
 
@@ -4655,44 +4608,42 @@ Decompile(SprintStack *ss, jsbytecode *p
                 op = JSOP_NOP;          /* turn off parens */
                 xval = PopStrDupe(ss, op, &xvalpc);
                 op = saveop;
                 PROPAGATE_CALLNESS();
                 lval = PopStr(ss, op, &lvalpc);
                 todo = ss->sprinter.getOffset();
                 SprintOpcode(ss, lval, lvalpc, pc, todo);
                 if (*xval != '\0') {
-                    bool xml = (JOF_OPMODE(lastop) == JOF_XMLNAME);
-                    ss->sprinter.put(xml ? "." : "[");
+                    ss->sprinter.put("[");
                     SprintOpcode(ss, xval, xvalpc, pc, todo);
-                    ss->sprinter.put(xml ? "" : "]");
+                    ss->sprinter.put("]");
                 }
                 break;
 
               case JSOP_SETELEM:
               {
                 rval = PopStrDupe(ss, op, &rvalpc);
                 op = JSOP_NOP;          /* turn off parens */
                 xval = PopStrDupe(ss, op, &xvalpc);
                 cs = &js_CodeSpec[ss->opcodes[ss->top]];
                 op = JSOP_GETELEM;      /* lval must have high precedence */
                 lval = PopStr(ss, op, &lvalpc);
                 op = saveop;
                 if (*xval == '\0')
                     goto do_setlval;
                 sn = js_GetSrcNote(cx, jp->script, pc - 1);
-                bool xml = (JOF_MODE(cs->format) == JOF_XMLNAME);
                 const char *token =
                     GetTokenForAssignment(jp, sn, lastop, pc, rvalpc,
                                           &lastlvalpc, &lastrvalpc);
                 todo = ss->sprinter.getOffset();
                 SprintOpcode(ss, lval, lvalpc, pc, todo);
-                ss->sprinter.put(xml ? "." : "[");
+                ss->sprinter.put("[");
                 SprintOpcode(ss, xval, xvalpc, pc, todo);
-                ss->sprinter.put(xml ? "" : "]");
+                ss->sprinter.put("]");
                 Sprint(&ss->sprinter, " %s= ", token);
                 SprintOpcode(ss, rval, rvalpc, pc, todo);
                 break;
               }
 
               case JSOP_CALLARG:
               case JSOP_GETARG:
                 i = GET_ARGNO(pc);
@@ -4709,21 +4660,18 @@ Decompile(SprintStack *ss, jsbytecode *p
 
               case JSOP_CALLNAME:
               case JSOP_NAME:
               case JSOP_GETGNAME:
               case JSOP_CALLGNAME:
                 LOAD_ATOM(0);
               do_name:
                 lval = "";
-#if JS_HAS_XML_SUPPORT
-              do_qname:
-#endif
                 sn = js_GetSrcNote(cx, jp->script, pc);
-                rval = QuoteString(&ss->sprinter, atom, inXML ? DONT_ESCAPE : 0);
+                rval = QuoteString(&ss->sprinter, atom, 0);
                 if (!rval)
                     return NULL;
                 ss->sprinter.setOffset(rval);
                 todo = Sprint(&ss->sprinter, sss_format,
                               VarPrefix(sn), lval, rval);
                 break;
 
               case JSOP_UINT16:
@@ -4748,17 +4696,17 @@ Decompile(SprintStack *ss, jsbytecode *p
               {
                 val = jp->script->getConst(GET_UINT32_INDEX(pc));
                 todo = SprintDoubleValue(&ss->sprinter, val, &saveop);
                 break;
               }
 
               case JSOP_STRING:
                 LOAD_ATOM(0);
-                rval = QuoteString(&ss->sprinter, atom, inXML ? DONT_ESCAPE : '"');
+                rval = QuoteString(&ss->sprinter, atom, '"');
                 if (!rval)
                     return NULL;
                 todo = ss->sprinter.getOffsetOf(rval);
                 break;
 
               case JSOP_LAMBDA:
 #if JS_HAS_GENERATOR_EXPRS
                 sn = js_GetSrcNote(cx, jp->script, pc);
@@ -5261,182 +5209,16 @@ Decompile(SprintStack *ss, jsbytecode *p
                 break;
               }
 
               case JSOP_DEBUGGER:
                 js_printf(jp, "\tdebugger;\n");
                 todo = -2;
                 break;
 
-#if JS_HAS_XML_SUPPORT
-              case JSOP_STARTXML:
-              case JSOP_STARTXMLEXPR:
-                inXML = op == JSOP_STARTXML;
-                todo = -2;
-                break;
-
-              case JSOP_DEFXMLNS:
-                rval = POP_STR();
-                js_printf(jp, "\t%s %s %s = %s;\n",
-                          js_default_str, js_xml_str, js_namespace_str, rval);
-                todo = -2;
-                break;
-
-              case JSOP_ANYNAME:
-                if (pc[JSOP_ANYNAME_LENGTH] == JSOP_TOATTRNAME) {
-                    len += JSOP_TOATTRNAME_LENGTH;
-                    todo = ss->sprinter.put("@*", 2);
-                } else {
-                    todo = ss->sprinter.put("*", 1);
-                }
-                break;
-#endif
-
-              case JSOP_QNAMEPART:
-                LOAD_ATOM(0);
-#if JS_HAS_XML_SUPPORT
-                if (pc[JSOP_QNAMEPART_LENGTH] == JSOP_TOATTRNAME) {
-                    saveop = JSOP_TOATTRNAME;
-                    len += JSOP_TOATTRNAME_LENGTH;
-                    lval = "@";
-                    goto do_qname;
-                }
-#endif
-                goto do_name;
-
-#if JS_HAS_XML_SUPPORT
-              case JSOP_QNAMECONST:
-                LOAD_ATOM(0);
-                rval = QuoteString(&ss->sprinter, atom, 0);
-                if (!rval)
-                    return NULL;
-                ss->sprinter.setOffset(rval);
-                lval = POP_STR();
-                todo = Sprint(&ss->sprinter, "%s::%s", lval, rval);
-                break;
-
-              case JSOP_QNAME:
-                rval = POP_STR();
-                lval = POP_STR();
-                todo = Sprint(&ss->sprinter, "%s::[%s]", lval, rval);
-                break;
-
-              case JSOP_TOATTRNAME:
-                op = JSOP_NOP;           /* turn off parens */
-                rval = POP_STR();
-                todo = Sprint(&ss->sprinter, "@[%s]", rval);
-                break;
-
-              case JSOP_TOATTRVAL:
-                todo = -2;
-                break;
-
-              case JSOP_ADDATTRNAME:
-                rval = POP_STR();
-                lval = POP_STR();
-                todo = Sprint(&ss->sprinter, "%s %s", lval, rval);
-                /* This gets reset by all XML tag expressions. */
-                quoteAttr = JS_TRUE;
-                break;
-
-              case JSOP_ADDATTRVAL:
-                rval = POP_STR();
-                lval = POP_STR();
-                if (quoteAttr)
-                    todo = Sprint(&ss->sprinter, "%s=\"%s\"", lval, rval);
-                else
-                    todo = Sprint(&ss->sprinter, "%s=%s", lval, rval);
-                break;
-
-              case JSOP_BINDXMLNAME:
-                /* Leave the name stacked and push a dummy string. */
-                todo = Sprint(&ss->sprinter, "");
-                break;
-
-              case JSOP_SETXMLNAME:
-                /* Pop the r.h.s., the dummy string, and the name. */
-                rval = PopStrDupe(ss, op, &rvalpc);
-                (void) PopOff(ss, op);
-                lval = POP_STR();
-                goto do_setlval;
-
-              case JSOP_XMLELTEXPR:
-              case JSOP_XMLTAGEXPR:
-                todo = Sprint(&ss->sprinter, "{%s}", POP_STR());
-                inXML = JS_TRUE;
-                /* If we're an attribute value, we shouldn't quote this. */
-                quoteAttr = JS_FALSE;
-                break;
-
-              case JSOP_TOXMLLIST:
-                op = JSOP_NOP;           /* turn off parens */
-                todo = Sprint(&ss->sprinter, "<>%s</>", POP_STR());
-                inXML = JS_FALSE;
-                break;
-
-              case JSOP_TOXML:
-              case JSOP_CALLXMLNAME:
-              case JSOP_XMLNAME:
-              case JSOP_FILTER:
-                /* These ops indicate the end of XML expressions. */
-                inXML = JS_FALSE;
-                todo = -2;
-                break;
-
-              case JSOP_ENDFILTER:
-                rval = POP_STR();
-                PROPAGATE_CALLNESS();
-                lval = POP_STR();
-                todo = Sprint(&ss->sprinter, "%s.(%s)", lval, rval);
-                break;
-
-              case JSOP_DESCENDANTS:
-                rval = POP_STR();
-                PROPAGATE_CALLNESS();
-                lval = POP_STR();
-                todo = Sprint(&ss->sprinter, "%s..%s", lval, rval);
-                break;
-
-              case JSOP_XMLCDATA:
-                LOAD_ATOM(0);
-                todo = ss->sprinter.put("<![CDATA[", 9);
-                if (!QuoteString(&ss->sprinter, atom, DONT_ESCAPE))
-                    return NULL;
-                ss->sprinter.put("]]>", 3);
-                break;
-
-              case JSOP_XMLCOMMENT:
-                LOAD_ATOM(0);
-                todo = ss->sprinter.put("<!--", 4);
-                if (!QuoteString(&ss->sprinter, atom, DONT_ESCAPE))
-                    return NULL;
-                ss->sprinter.put("-->", 3);
-                break;
-
-              case JSOP_XMLPI:
-                LOAD_ATOM(0);
-                rval = JS_strdup(cx, POP_STR());
-                if (!rval)
-                    return NULL;
-                todo = ss->sprinter.put("<?", 2);
-                ok = QuoteString(&ss->sprinter, atom, 0) &&
-                     (*rval == '\0' ||
-                      (ss->sprinter.put(" ", 1) >= 0 &&
-                       ss->sprinter.put(rval)));
-                js_free((char *)rval);
-                if (!ok)
-                    return NULL;
-                ss->sprinter.put("?>", 2);
-                break;
-
-              case JSOP_GETFUNNS:
-                todo = ss->sprinter.put(js_function_str, 8);
-                break;
-#endif /* JS_HAS_XML_SUPPORT */
-
               case JSOP_REST:
                 // Ignore bytecode related to handling rest.
                 pc += GetBytecodeLength(pc);
                 if (*pc == JSOP_UNDEFINED)
                     pc += GetBytecodeLength(pc);
                 if (*pc == JSOP_SETALIASEDVAR || *pc == JSOP_SETARG) {
                     pc += GetBytecodeLength(pc);
                     LOCAL_ASSERT(*pc == JSOP_POP);
@@ -5467,29 +5249,22 @@ Decompile(SprintStack *ss, jsbytecode *p
             if (!UpdateDecompiledText(ss, pushpc, todo))
                 return NULL;
             if (!PushOff(ss, todo, saveop, pushpc))
                 return NULL;
             if (js_CodeSpec[*pc].format & JOF_DECOMPOSE)
                 CopyDecompiledTextForDecomposedOp(jp, pc);
         }
 
-        if (op == JSOP_CALLXMLNAME) {
-            todo = Sprint(&ss->sprinter, "");
-            if (todo < 0 || !PushOff(ss, todo, saveop))
-                return NULL;
-        }
-
         pc += len;
     }
 
 /*
  * Undefine local macros.
  */
-#undef inXML
 #undef DECOMPILE_CODE
 #undef TOP_STR
 #undef POP_STR
 #undef POP_STR_PREC
 #undef LOCAL_ASSERT
 #undef GET_QUOTE_AND_FMT
 #undef GET_ATOM_QUOTE_AND_FMT
 
@@ -6420,17 +6195,16 @@ DecompileExpression(JSContext *cx, JSScr
 
     /* NAME ops are self-contained, others require left or right context. */
     const JSCodeSpec *cs = &js_CodeSpec[op];
     jsbytecode *begin = pc;
     jsbytecode *end = pc + cs->length;
     switch (JOF_MODE(cs->format)) {
       case JOF_PROP:
       case JOF_ELEM:
-      case JOF_XMLNAME:
       case 0: {
         jssrcnote *sn = js_GetSrcNote(cx, script, pc);
         if (!sn)
             return FAILED_EXPRESSION_DECOMPILER;
         switch (SN_TYPE(sn)) {
           case SRC_PCBASE:
             begin -= js_GetSrcNoteOffset(sn, 0);
             break;
--- a/js/src/jsopcode.h
+++ b/js/src/jsopcode.h
@@ -59,17 +59,16 @@ typedef enum JSOp {
 #define JOF_ATOMOBJECT    19      /* uint16_t constant index + object index */
 #define JOF_UINT16PAIR    20      /* pair of uint16_t immediates */
 #define JOF_SCOPECOORD    21      /* pair of uint16_t immediates followed by block index */
 #define JOF_TYPEMASK      0x001f  /* mask for above immediate types */
 
 #define JOF_NAME          (1U<<5) /* name operation */
 #define JOF_PROP          (2U<<5) /* obj.prop operation */
 #define JOF_ELEM          (3U<<5) /* obj[index] operation */
-#define JOF_XMLNAME       (4U<<5) /* XML name: *, a::b, @a, @a::b, etc. */
 #define JOF_MODEMASK      (7U<<5) /* mask for above addressing modes */
 #define JOF_SET           (1U<<8) /* set (i.e., assignment) operation */
 #define JOF_DEL           (1U<<9) /* delete operation */
 #define JOF_DEC          (1U<<10) /* decrement (--, not ++) opcode */
 #define JOF_INC          (2U<<10) /* increment (++, not --) opcode */
 #define JOF_INCDEC       (3U<<10) /* increment or decrement opcode */
 #define JOF_POST         (1U<<12) /* postorder increment or decrement */
 #define JOF_ASSIGNING     JOF_SET /* hint for Class.resolve, used for ops
--- a/js/src/jsopcode.tbl
+++ b/js/src/jsopcode.tbl
@@ -187,17 +187,17 @@ OPDEF(JSOP_SETCALL,   74, "setcall",    
  */
 OPDEF(JSOP_ITER,      75, "iter",       NULL,         2,  1,  1,  0,  JOF_UINT8)
 OPDEF(JSOP_MOREITER,  76, "moreiter",   NULL,         1,  1,  2,  0,  JOF_BYTE)
 OPDEF(JSOP_ITERNEXT,  77, "iternext",   "<next>",     1,  0,  1,  0,  JOF_BYTE)
 OPDEF(JSOP_ENDITER,   78, "enditer",    NULL,         1,  1,  0,  0,  JOF_BYTE)
 
 OPDEF(JSOP_FUNAPPLY,  79, "funapply",   NULL,         3, -1,  1, 18,  JOF_UINT16|JOF_INVOKE|JOF_TYPESET)
 
-/* Push object literal: either an XML object or initialiser object. */
+/* Push object initializer literal. */
 OPDEF(JSOP_OBJECT,    80, "object",     NULL,         5,  0,  1, 19,  JOF_OBJECT)
 
 /* Pop value and discard it. */
 OPDEF(JSOP_POP,       81, "pop",        NULL,         1,  1,  0,  2,  JOF_BYTE)
 
 /* Call a function as a constructor; operand is argc. */
 OPDEF(JSOP_NEW,       82, js_new_str,   NULL,         3, -1,  1, 17,  JOF_UINT16|JOF_INVOKE|JOF_TYPESET)
 
@@ -334,18 +334,18 @@ OPDEF(JSOP_PICK,        133, "pick",    
  */
 OPDEF(JSOP_TRY,         134,"try",        NULL,       1,  0,  0,  0,  JOF_BYTE)
 OPDEF(JSOP_FINALLY,     135,"finally",    NULL,       1,  0,  2,  0,  JOF_BYTE)
 
 /*
  * An "aliased variable" is a var, let, or formal arg that is aliased. Sources
  * of aliasing include: nested functions accessing the vars of an enclosing
  * function, function statements that are conditionally executed, 'eval',
- * 'with', 'arguments' and E4X filters. All of these cases require creating a
- * CallObject to own the aliased variable.
+ * 'with', and 'arguments'. All of these cases require creating a CallObject to
+ * own the aliased variable.
  *
  * An ALIASEDVAR opcode contains the following immediates:
  *  uint16 hops:  the number of scope objects to skip to find the ScopeObject
  *                containing the variable being accessed
  *  uint16 slot:  the slot containing the variable in the ScopeObject (this
  *                'slot' does not include RESERVED_SLOTS).
  *  uint32 block: the index (into the script object table) of the block chain
  *                at the point of the variable access.
@@ -391,40 +391,39 @@ OPDEF(JSOP_SETGNAME,      155,"setgname"
 OPDEF(JSOP_INCGNAME,      156,"incgname",  NULL,       6,  0,  1, 15,  JOF_ATOM|JOF_NAME|JOF_INC|JOF_TMPSLOT3|JOF_GNAME|JOF_DECOMPOSE)
 OPDEF(JSOP_DECGNAME,      157,"decgname",  NULL,       6,  0,  1, 15,  JOF_ATOM|JOF_NAME|JOF_DEC|JOF_TMPSLOT3|JOF_GNAME|JOF_DECOMPOSE)
 OPDEF(JSOP_GNAMEINC,      158,"gnameinc",  NULL,       6,  0,  1, 15,  JOF_ATOM|JOF_NAME|JOF_INC|JOF_POST|JOF_TMPSLOT3|JOF_GNAME|JOF_DECOMPOSE)
 OPDEF(JSOP_GNAMEDEC,      159,"gnamedec",  NULL,       6,  0,  1, 15,  JOF_ATOM|JOF_NAME|JOF_DEC|JOF_POST|JOF_TMPSLOT3|JOF_GNAME|JOF_DECOMPOSE)
 
 /* Regular expression literal requiring special "fork on exec" handling. */
 OPDEF(JSOP_REGEXP,        160,"regexp",   NULL,       5,  0,  1, 19,  JOF_REGEXP)
 
-/* XML (ECMA-357, a.k.a. "E4X") support. */
-OPDEF(JSOP_DEFXMLNS,      161,"defxmlns",   NULL,     1,  1,  0,  0,  JOF_BYTE)
-OPDEF(JSOP_ANYNAME,       162,"anyname",    NULL,     1,  0,  1, 19,  JOF_BYTE|JOF_XMLNAME)
-OPDEF(JSOP_QNAMEPART,     163,"qnamepart",  NULL,     5,  0,  1, 19,  JOF_ATOM|JOF_XMLNAME)
-OPDEF(JSOP_QNAMECONST,    164,"qnameconst", NULL,     5,  1,  1, 19,  JOF_ATOM|JOF_XMLNAME)
-OPDEF(JSOP_QNAME,         165,"qname",      NULL,     1,  2,  1,  0,  JOF_BYTE|JOF_XMLNAME)
-OPDEF(JSOP_TOATTRNAME,    166,"toattrname", NULL,     1,  1,  1, 19,  JOF_BYTE|JOF_XMLNAME)
-OPDEF(JSOP_TOATTRVAL,     167,"toattrval",  NULL,     1,  1,  1, 19,  JOF_BYTE)
-OPDEF(JSOP_ADDATTRNAME,   168,"addattrname",NULL,     1,  2,  1, 13,  JOF_BYTE)
-OPDEF(JSOP_ADDATTRVAL,    169,"addattrval", NULL,     1,  2,  1, 13,  JOF_BYTE)
-OPDEF(JSOP_BINDXMLNAME,   170,"bindxmlname",NULL,     1,  1,  2,  3,  JOF_BYTE|JOF_SET)
-OPDEF(JSOP_SETXMLNAME,    171,"setxmlname", NULL,     1,  3,  1,  3,  JOF_BYTE|JOF_SET|JOF_DETECTING)
-OPDEF(JSOP_XMLNAME,       172,"xmlname",    NULL,     1,  1,  1, 19,  JOF_BYTE)
-OPDEF(JSOP_DESCENDANTS,   173,"descendants",NULL,     1,  2,  1, 18,  JOF_BYTE)
-OPDEF(JSOP_FILTER,        174,"filter",     NULL,     5,  1,  1,  0,  JOF_JUMP)
-OPDEF(JSOP_ENDFILTER,     175,"endfilter",  NULL,     5,  2,  1, 18,  JOF_JUMP)
-OPDEF(JSOP_TOXML,         176,"toxml",      NULL,     1,  1,  1, 19,  JOF_BYTE)
-OPDEF(JSOP_TOXMLLIST,     177,"toxmllist",  NULL,     1,  1,  1, 19,  JOF_BYTE)
-OPDEF(JSOP_XMLTAGEXPR,    178,"xmltagexpr", NULL,     1,  1,  1,  0,  JOF_BYTE)
-OPDEF(JSOP_XMLELTEXPR,    179,"xmleltexpr", NULL,     1,  1,  1,  0,  JOF_BYTE)
-OPDEF(JSOP_XMLCDATA,      180,"xmlcdata",   NULL,     5,  0,  1, 19,  JOF_ATOM)
-OPDEF(JSOP_XMLCOMMENT,    181,"xmlcomment", NULL,     5,  0,  1, 19,  JOF_ATOM)
-OPDEF(JSOP_XMLPI,         182,"xmlpi",      NULL,     5,  1,  1, 19,  JOF_ATOM)
-OPDEF(JSOP_DELDESC,       183,"deldesc",    NULL,     1,  2,  1, 15,  JOF_BYTE|JOF_ELEM|JOF_DEL)
+OPDEF(JSOP_UNUSED161,     161,"unused161",  NULL,     1,  0,  0,  0,  JOF_BYTE)
+OPDEF(JSOP_UNUSED162,     162,"unused162",  NULL,     1,  0,  0,  0,  JOF_BYTE)
+OPDEF(JSOP_UNUSED163,     163,"unused163",  NULL,     1,  0,  0,  0,  JOF_BYTE)
+OPDEF(JSOP_UNUSED164,     164,"unused164",  NULL,     1,  0,  0,  0,  JOF_BYTE)
+OPDEF(JSOP_UNUSED165,     165,"unused165",  NULL,     1,  0,  0,  0,  JOF_BYTE)
+OPDEF(JSOP_UNUSED166,     166,"unused166",  NULL,     1,  0,  0,  0,  JOF_BYTE)
+OPDEF(JSOP_UNUSED167,     167,"unused167",  NULL,     1,  0,  0,  0,  JOF_BYTE)
+OPDEF(JSOP_UNUSED168,     168,"unused168",  NULL,     1,  0,  0,  0,  JOF_BYTE)
+OPDEF(JSOP_UNUSED169,     169,"unused169",  NULL,     1,  0,  0,  0,  JOF_BYTE)
+OPDEF(JSOP_UNUSED170,     170,"unused170",  NULL,     1,  0,  0,  0,  JOF_BYTE)
+OPDEF(JSOP_UNUSED171,     171,"unused171",  NULL,     1,  0,  0,  0,  JOF_BYTE)
+OPDEF(JSOP_UNUSED172,     172,"unused172",  NULL,     1,  0,  0,  0,  JOF_BYTE)
+OPDEF(JSOP_UNUSED173,     173,"unused173",  NULL,     1,  0,  0,  0,  JOF_BYTE)
+OPDEF(JSOP_UNUSED174,     174,"unused174",  NULL,     1,  0,  0,  0,  JOF_BYTE)
+OPDEF(JSOP_UNUSED175,     175,"unused175",  NULL,     1,  0,  0,  0,  JOF_BYTE)
+OPDEF(JSOP_UNUSED176,     176,"unused176",  NULL,     1,  0,  0,  0,  JOF_BYTE)
+OPDEF(JSOP_UNUSED177,     177,"unused177",  NULL,     1,  0,  0,  0,  JOF_BYTE)
+OPDEF(JSOP_UNUSED178,     178,"unused178",  NULL,     1,  0,  0,  0,  JOF_BYTE)
+OPDEF(JSOP_UNUSED179,     179,"unused179",  NULL,     1,  0,  0,  0,  JOF_BYTE)
+OPDEF(JSOP_UNUSED180,     180,"unused180",  NULL,     1,  0,  0,  0,  JOF_BYTE)
+OPDEF(JSOP_UNUSED181,     181,"unused181",  NULL,     1,  0,  0,  0,  JOF_BYTE)
+OPDEF(JSOP_UNUSED182,     182,"unused182",  NULL,     1,  0,  0,  0,  JOF_BYTE)
+OPDEF(JSOP_UNUSED183,     183,"unused183",  NULL,     1,  0,  0,  0,  JOF_BYTE)
 
 OPDEF(JSOP_CALLPROP,      184,"callprop",   NULL,     5,  1,  1, 18,  JOF_ATOM|JOF_PROP|JOF_TYPESET|JOF_TMPSLOT3)
 
 /* Enter a let block/expr whose slots are at the top of the stack. */
 OPDEF(JSOP_ENTERLET0,     185,"enterlet0",  NULL,     5, -1, -1,  0,  JOF_OBJECT)
 
 /* Enter a let block/expr whose slots are 1 below the top of the stack. */
 OPDEF(JSOP_ENTERLET1,     186,"enterlet1",  NULL,     5, -1, -1,  0,  JOF_OBJECT)
@@ -432,38 +431,34 @@ OPDEF(JSOP_ENTERLET1,     186,"enterlet1
 /*
  * Opcode to hold 24-bit immediate integer operands.
  */
 OPDEF(JSOP_UINT24,        187,"uint24",     NULL,     4,  0,  1, 16,  JOF_UINT24)
 
 OPDEF(JSOP_UNUSED188,     188,"unused188",   NULL,    1,  0,  0,  0,  JOF_BYTE)
 OPDEF(JSOP_UNUSED189,     189,"unused189",   NULL,    1,  0,  0,  0,  JOF_BYTE)
 OPDEF(JSOP_UNUSED190,     190,"unused190",   NULL,    1,  0,  0,  0,  JOF_BYTE)
-
-/*
- * Opcodes to help the decompiler deal with XML.
- */
-OPDEF(JSOP_STARTXML,      191,"startxml",    NULL,    1,  0,  0,  0,  JOF_BYTE)
-OPDEF(JSOP_STARTXMLEXPR,  192,"startxmlexpr",NULL,    1,  0,  0,  0,  JOF_BYTE)
+OPDEF(JSOP_UNUSED191,     191,"unused191",   NULL,    1,  0,  0,  0,  JOF_BYTE)
+OPDEF(JSOP_UNUSED192,     192,"unused192",   NULL,    1,  0,  0,  0,  JOF_BYTE)
 
 OPDEF(JSOP_CALLELEM,      193, "callelem",   NULL,    1,  2,  1, 18,  JOF_BYTE |JOF_ELEM|JOF_TYPESET|JOF_LEFTASSOC)
 
 /*
  * Stop interpretation, emitted at end of script to save the threaded bytecode
  * interpreter an extra branch test on every DO_NEXT_OP (see jsinterp.c).
  */
 OPDEF(JSOP_STOP,          194,"stop",        NULL,    1,  0,  0,  0,  JOF_BYTE)
 
 /*
  * Get an extant property value, throwing ReferenceError if the identified
  * property does not exist.
  */
 OPDEF(JSOP_GETXPROP,      195,"getxprop",    NULL,    5,  1,  1, 18,  JOF_ATOM|JOF_PROP|JOF_TYPESET)
 
-OPDEF(JSOP_CALLXMLNAME,   196, "callxmlname",  NULL,  1,  1,  2, 19,  JOF_BYTE)
+OPDEF(JSOP_UNUSED196,     196,"unused196",   NULL,    1,  0,  0,  0,  JOF_BYTE)
 
 /*
  * Specialized JSOP_TYPEOF to avoid reporting undefined for typeof(0, undef).
  */
 OPDEF(JSOP_TYPEOFEXPR,    197,"typeofexpr",  NULL,    1,  1,  1, 15,  JOF_BYTE|JOF_DETECTING)
 
 /*
  * Block-local scope support.
--- a/js/src/jspropertytree.cpp
+++ b/js/src/jspropertytree.cpp
@@ -254,18 +254,16 @@ void
 Shape::dump(JSContext *cx, FILE *fp) const
 {
     jsid propid = this->propid();
 
     JS_ASSERT(!JSID_IS_VOID(propid));
 
     if (JSID_IS_INT(propid)) {
         fprintf(fp, "[%ld]", (long) JSID_TO_INT(propid));
-    } else if (JSID_IS_DEFAULT_XML_NAMESPACE(propid)) {
-        fprintf(fp, "<default XML namespace>");
     } else {
         JSLinearString *str;
         if (JSID_IS_ATOM(propid)) {
             str = JSID_TO_ATOM(propid);
         } else {
             JS_ASSERT(JSID_IS_OBJECT(propid));
             JSString *s = ToStringSlow<CanGC>(cx, IdToValue(propid));
             fputs("object ", fp);
--- a/js/src/jsprototypes.h
+++ b/js/src/jsprototypes.h
@@ -25,41 +25,37 @@
     macro(Array,                  3,     js_InitArrayClass) \
     macro(Boolean,                4,     js_InitBooleanClass) \
     macro(JSON,                   5,     js_InitJSONClass) \
     macro(Date,                   6,     js_InitDateClass) \
     macro(Math,                   7,     js_InitMathClass) \
     macro(Number,                 8,     js_InitNumberClass) \
     macro(String,                 9,     js_InitStringClass) \
     macro(RegExp,                10,     js_InitRegExpClass) \
-    macro(XML,                   11,     js_InitXMLClass) \
-    macro(Namespace,             12,     js_InitNamespaceClass) \
-    macro(QName,                 13,     js_InitQNameClass) \
-    macro(Error,                 14,     js_InitExceptionClasses) \
-    macro(InternalError,         15,     js_InitExceptionClasses) \
-    macro(EvalError,             16,     js_InitExceptionClasses) \
-    macro(RangeError,            17,     js_InitExceptionClasses) \
-    macro(ReferenceError,        18,     js_InitExceptionClasses) \
-    macro(SyntaxError,           19,     js_InitExceptionClasses) \
-    macro(TypeError,             20,     js_InitExceptionClasses) \
-    macro(URIError,              21,     js_InitExceptionClasses) \
-    macro(Iterator,              22,     js_InitIteratorClasses) \
-    macro(StopIteration,         23,     js_InitIteratorClasses) \
-    macro(ArrayBuffer,           24,     js_InitTypedArrayClasses) \
-    macro(Int8Array,             25,     js_InitTypedArrayClasses) \
-    macro(Uint8Array,            26,     js_InitTypedArrayClasses) \
-    macro(Int16Array,            27,     js_InitTypedArrayClasses) \
-    macro(Uint16Array,           28,     js_InitTypedArrayClasses) \
-    macro(Int32Array,            29,     js_InitTypedArrayClasses) \
-    macro(Uint32Array,           30,     js_InitTypedArrayClasses) \
-    macro(Float32Array,          31,     js_InitTypedArrayClasses) \
-    macro(Float64Array,          32,     js_InitTypedArrayClasses) \
-    macro(Uint8ClampedArray,     33,     js_InitTypedArrayClasses) \
-    macro(Proxy,                 34,     js_InitProxyClass) \
-    macro(AnyName,               35,     js_InitNullClass) \
-    macro(WeakMap,               36,     js_InitWeakMapClass) \
-    macro(Map,                   37,     js_InitMapClass) \
-    macro(Set,                   38,     js_InitSetClass) \
-    macro(DataView,              39,     js_InitTypedArrayClasses) \
-    macro(ParallelArray,         40,     js_InitParallelArrayClass) \
-    macro(Intl,                  41,     js_InitIntlClass) \
+    macro(Error,                 11,     js_InitExceptionClasses) \
+    macro(InternalError,         12,     js_InitExceptionClasses) \
+    macro(EvalError,             13,     js_InitExceptionClasses) \
+    macro(RangeError,            14,     js_InitExceptionClasses) \
+    macro(ReferenceError,        15,     js_InitExceptionClasses) \
+    macro(SyntaxError,           16,     js_InitExceptionClasses) \
+    macro(TypeError,             17,     js_InitExceptionClasses) \
+    macro(URIError,              18,     js_InitExceptionClasses) \
+    macro(Iterator,              19,     js_InitIteratorClasses) \
+    macro(StopIteration,         20,     js_InitIteratorClasses) \
+    macro(ArrayBuffer,           21,     js_InitTypedArrayClasses) \
+    macro(Int8Array,             22,     js_InitTypedArrayClasses) \
+    macro(Uint8Array,            23,     js_InitTypedArrayClasses) \
+    macro(Int16Array,            24,     js_InitTypedArrayClasses) \
+    macro(Uint16Array,           25,     js_InitTypedArrayClasses) \
+    macro(Int32Array,            26,     js_InitTypedArrayClasses) \
+    macro(Uint32Array,           27,     js_InitTypedArrayClasses) \
+    macro(Float32Array,          28,     js_InitTypedArrayClasses) \
+    macro(Float64Array,          29,     js_InitTypedArrayClasses) \
+    macro(Uint8ClampedArray,     30,     js_InitTypedArrayClasses) \
+    macro(Proxy,                 31,     js_InitProxyClass) \
+    macro(WeakMap,               32,     js_InitWeakMapClass) \
+    macro(Map,                   33,     js_InitMapClass) \
+    macro(Set,                   34,     js_InitSetClass) \
+    macro(DataView,              35,     js_InitTypedArrayClasses) \
+    macro(ParallelArray,         36,     js_InitParallelArrayClass) \
+    macro(Intl,                  37,     js_InitIntlClass) \
 
 #endif /* jsprototypes_h___ */
--- a/js/src/jsprvtd.h
+++ b/js/src/jsprvtd.h
@@ -53,20 +53,16 @@ typedef struct JSTryNote            JSTr
 /* Friend "Advanced API" typedefs. */
 typedef struct JSAtomState          JSAtomState;
 typedef struct JSCodeSpec           JSCodeSpec;
 typedef struct JSPrinter            JSPrinter;
 typedef struct JSStackHeader        JSStackHeader;
 typedef struct JSSubString          JSSubString;
 typedef struct JSSpecializedNative  JSSpecializedNative;
 
-#if JS_HAS_XML_SUPPORT
-typedef struct JSXML                JSXML;
-#endif
-
 /*
  * Template declarations.
  *
  * jsprvtd.h can be included in both C and C++ translation units. For C++, it
  * may possibly be wrapped in an extern "C" block which does not agree with
  * templates.
  */
 #ifdef __cplusplus
--- a/js/src/jspubtd.h
+++ b/js/src/jspubtd.h
@@ -86,17 +86,16 @@ typedef enum JSVersion {
 typedef enum JSType {
     JSTYPE_VOID,                /* undefined */
     JSTYPE_OBJECT,              /* object */
     JSTYPE_FUNCTION,            /* function */
     JSTYPE_STRING,              /* string */
     JSTYPE_NUMBER,              /* number */
     JSTYPE_BOOLEAN,             /* boolean */
     JSTYPE_NULL,                /* null */
-    JSTYPE_XML,                 /* xml object */
     JSTYPE_LIMIT
 } JSType;
 
 /* Dense index into cached prototypes and class atoms for standard objects. */
 typedef enum JSProtoKey {
 #define PROTOKEY_AND_INITIALIZER(name,code,init) JSProto_##name = code,
     JS_FOR_EACH_PROTOTYPE(PROTOKEY_AND_INITIALIZER)
 #undef JS_PROTO
@@ -149,19 +148,16 @@ typedef enum {
     JSTRACE_STRING,
     JSTRACE_SCRIPT,
 
     /*
      * Trace kinds internal to the engine. The embedding can only them if it
      * implements JSTraceCallback.
      */
     JSTRACE_IONCODE,
-#if JS_HAS_XML_SUPPORT
-    JSTRACE_XML,
-#endif
     JSTRACE_SHAPE,
     JSTRACE_BASE_SHAPE,
     JSTRACE_TYPE_OBJECT,
     JSTRACE_LAST = JSTRACE_TYPE_OBJECT
 } JSGCTraceKind;
 
 /* Struct typedefs and class forward declarations. */
 typedef struct JSClass                      JSClass;
@@ -222,17 +218,16 @@ class SkipRoot;
 enum ThingRootKind
 {
     THING_ROOT_OBJECT,
     THING_ROOT_SHAPE,
     THING_ROOT_BASE_SHAPE,
     THING_ROOT_TYPE_OBJECT,
     THING_ROOT_STRING,
     THING_ROOT_SCRIPT,
-    THING_ROOT_XML,
     THING_ROOT_ID,
     THING_ROOT_PROPERTY_ID,
     THING_ROOT_VALUE,
     THING_ROOT_TYPE,
     THING_ROOT_BINDINGS,
     THING_ROOT_LIMIT
 };
 
--- a/js/src/jsreflect.cpp
+++ b/js/src/jsreflect.cpp
@@ -70,17 +70,16 @@ char const *js::binopNames[] = {
     "*",          /* BINOP_STAR */
     "/",          /* BINOP_DIV */
     "%",          /* BINOP_MOD */
     "|",          /* BINOP_BITOR */
     "^",          /* BINOP_BITXOR */
     "&",          /* BINOP_BITAND */
     "in",         /* BINOP_IN */
     "instanceof", /* BINOP_INSTANCEOF */
-    "..",         /* BINOP_DBLDOT */
 };
 
 char const *js::unopNames[] = {
     "delete",  /* UNOP_DELETE */
     "-",       /* UNOP_NEG */
     "+",       /* UNOP_POS */
     "!",       /* UNOP_NOT */
     "~",       /* UNOP_BITNOT */
@@ -607,62 +606,16 @@ class NodeBuilder
      * patterns
      */
 
     bool arrayPattern(NodeVector &elts, TokenPos *pos, MutableHandleValue dst);
 
     bool objectPattern(NodeVector &elts, TokenPos *pos, MutableHandleValue dst);
 
     bool propertyPattern(HandleValue key, HandleValue patt, TokenPos *pos, MutableHandleValue dst);
-
-    /*
-     * xml
-     */
-
-    bool xmlAnyName(TokenPos *pos, MutableHandleValue dst);
-
-    bool xmlEscapeExpression(HandleValue expr, TokenPos *pos, MutableHandleValue dst);
-
-    bool xmlDefaultNamespace(HandleValue ns, TokenPos *pos, MutableHandleValue dst);
-
-    bool xmlFilterExpression(HandleValue left, HandleValue right, TokenPos *pos,
-                             MutableHandleValue dst);
-
-    bool xmlAttributeSelector(HandleValue expr, bool computed, TokenPos *pos,
-                              MutableHandleValue dst);
-
-    bool xmlQualifiedIdentifier(HandleValue left, HandleValue right, bool computed, TokenPos *pos,
-                                MutableHandleValue dst);
-
-    bool xmlFunctionQualifiedIdentifier(HandleValue right, bool computed, TokenPos *pos,
-                                        MutableHandleValue dst);
-
-    bool xmlElement(NodeVector &elts, TokenPos *pos, MutableHandleValue dst);
-
-    bool xmlText(HandleValue text, TokenPos *pos, MutableHandleValue dst);
-
-    bool xmlList(NodeVector &elts, TokenPos *pos, MutableHandleValue dst);
-
-    bool xmlStartTag(NodeVector &elts, TokenPos *pos, MutableHandleValue dst);
-
-    bool xmlEndTag(NodeVector &elts, TokenPos *pos, MutableHandleValue dst);
-
-    bool xmlPointTag(NodeVector &elts, TokenPos *pos, MutableHandleValue dst);
-
-    bool xmlName(HandleValue text, TokenPos *pos, MutableHandleValue dst);
-
-    bool xmlName(NodeVector &elts, TokenPos *pos, MutableHandleValue dst);
-
-    bool xmlAttribute(HandleValue text, TokenPos *pos, MutableHandleValue dst);
-
-    bool xmlCdata(HandleValue text, TokenPos *pos, MutableHandleValue dst);
-
-    bool xmlComment(HandleValue text, TokenPos *pos, MutableHandleValue dst);
-
-    bool xmlPI(HandleValue target, HandleValue content, TokenPos *pos, MutableHandleValue dst);
 };
 
 bool
 NodeBuilder::newNode(ASTType type, TokenPos *pos, MutableHandleObject dst)
 {
     JS_ASSERT(type > AST_ERROR && type < AST_LIMIT);
 
     RootedValue tv(cx);
@@ -1492,205 +1445,16 @@ NodeBuilder::function(ASTType type, Toke
                    "defaults", defarray,
                    "body", body,
                    "rest", rest,
                    "generator", isGeneratorVal,
                    "expression", isExpressionVal,
                    dst);
 }
 
-bool
-NodeBuilder::xmlAnyName(TokenPos *pos, MutableHandleValue dst)
-{
-    RootedValue cb(cx, callbacks[AST_XMLANYNAME]);
-    if (!cb.isNull())
-        return callback(cb, pos, dst);
-
-    return newNode(AST_XMLANYNAME, pos, dst);
-}
-
-bool
-NodeBuilder::xmlEscapeExpression(HandleValue expr, TokenPos *pos, MutableHandleValue dst)
-{
-    RootedValue cb(cx, callbacks[AST_XMLESCAPE]);
-    if (!cb.isNull())
-        return callback(cb, expr, pos, dst);
-
-    return newNode(AST_XMLESCAPE, pos, "expression", expr, dst);
-}
-
-bool
-NodeBuilder::xmlFilterExpression(HandleValue left, HandleValue right, TokenPos *pos,
-                                 MutableHandleValue dst)
-{
-    RootedValue cb(cx, callbacks[AST_XMLFILTER]);
-    if (!cb.isNull())
-        return callback(cb, left, right, pos, dst);
-
-    return newNode(AST_XMLFILTER, pos, "left", left, "right", right, dst);
-}
-
-bool
-NodeBuilder::xmlDefaultNamespace(HandleValue ns, TokenPos *pos, MutableHandleValue dst)
-{
-    RootedValue cb(cx, callbacks[AST_XMLDEFAULT]);
-    if (!cb.isNull())
-        return callback(cb, ns, pos, dst);
-
-    return newNode(AST_XMLDEFAULT, pos, "namespace", ns, dst);
-}
-
-bool
-NodeBuilder::xmlAttributeSelector(HandleValue expr, bool computed, TokenPos *pos,
-                                  MutableHandleValue dst)
-{
-    RootedValue computedVal(cx, BooleanValue(computed));
-
-    RootedValue cb(cx, callbacks[AST_XMLATTR_SEL]);
-    if (!cb.isNull())
-        return callback(cb, expr, computedVal, pos, dst);
-
-    return newNode(AST_XMLATTR_SEL, pos,
-                   "attribute", expr,
-                   "computed", computedVal,
-                   dst);
-}
-
-bool
-NodeBuilder::xmlFunctionQualifiedIdentifier(HandleValue right, bool computed, TokenPos *pos,
-                                            MutableHandleValue dst)
-{
-    RootedValue computedVal(cx, BooleanValue(computed));
-
-    RootedValue cb(cx, callbacks[AST_XMLFUNCQUAL]);
-    if (!cb.isNull())
-        return callback(cb, right, computedVal, pos, dst);
-
-    return newNode(AST_XMLFUNCQUAL, pos,
-                   "right", right,
-                   "computed", computedVal,
-                   dst);
-}
-
-bool
-NodeBuilder::xmlQualifiedIdentifier(HandleValue left, HandleValue right, bool computed,
-                                    TokenPos *pos, MutableHandleValue dst)
-{
-    RootedValue computedVal(cx, BooleanValue(computed));
-
-    RootedValue cb(cx, callbacks[AST_XMLQUAL]);
-    if (!cb.isNull())
-        return callback(cb, left, right, computedVal, pos, dst);
-
-    return newNode(AST_XMLQUAL, pos,
-                   "left", left,
-                   "right", right,
-                   "computed", computedVal,
-                   dst);
-}
-
-bool
-NodeBuilder::xmlElement(NodeVector &elts, TokenPos *pos, MutableHandleValue dst)
-{
-    return listNode(AST_XMLELEM, "contents", elts, pos, dst);
-}
-
-bool
-NodeBuilder::xmlText(HandleValue text, TokenPos *pos, MutableHandleValue dst)
-{
-    RootedValue cb(cx, callbacks[AST_XMLTEXT]);
-    if (!cb.isNull())
-        return callback(cb, text, pos, dst);
-
-    return newNode(AST_XMLTEXT, pos, "text", text, dst);
-}
-
-bool
-NodeBuilder::xmlList(NodeVector &elts, TokenPos *pos, MutableHandleValue dst)
-{
-    return listNode(AST_XMLLIST, "contents", elts, pos, dst);
-}
-
-bool
-NodeBuilder::xmlStartTag(NodeVector &elts, TokenPos *pos, MutableHandleValue dst)
-{
-    return listNode(AST_XMLSTART, "contents", elts, pos, dst);
-}
-
-bool
-NodeBuilder::xmlEndTag(NodeVector &elts, TokenPos *pos, MutableHandleValue dst)
-{
-    return listNode(AST_XMLEND, "contents", elts, pos, dst);
-}
-
-bool
-NodeBuilder::xmlPointTag(NodeVector &elts, TokenPos *pos, MutableHandleValue dst)
-{
-    return listNode(AST_XMLPOINT, "contents", elts, pos, dst);
-}
-
-bool
-NodeBuilder::xmlName(HandleValue text, TokenPos *pos, MutableHandleValue dst)
-{
-    RootedValue cb(cx, callbacks[AST_XMLNAME]);
-    if (!cb.isNull())
-        return callback(cb, text, pos, dst);
-
-    return newNode(AST_XMLNAME, pos, "contents", text, dst);
-}
-
-bool
-NodeBuilder::xmlName(NodeVector &elts, TokenPos *pos, MutableHandleValue dst)
-{
-    return listNode(AST_XMLNAME, "contents", elts, pos, dst);
-}
-
-bool
-NodeBuilder::xmlAttribute(HandleValue text, TokenPos *pos, MutableHandleValue dst)
-{
-    RootedValue cb(cx, callbacks[AST_XMLATTR]);
-    if (!cb.isNull())
-        return callback(cb, text, pos, dst);
-
-    return newNode(AST_XMLATTR, pos, "value", text, dst);
-}
-
-bool
-NodeBuilder::xmlCdata(HandleValue text, TokenPos *pos, MutableHandleValue dst)
-{
-    RootedValue cb(cx, callbacks[AST_XMLCDATA]);
-    if (!cb.isNull())
-        return callback(cb, text, pos, dst);
-
-    return newNode(AST_XMLCDATA, pos, "contents", text, dst);
-}
-
-bool
-NodeBuilder::xmlComment(HandleValue text, TokenPos *pos, MutableHandleValue dst)
-{
-    RootedValue cb(cx, callbacks[AST_XMLCOMMENT]);
-    if (!cb.isNull())
-        return callback(cb, text, pos, dst);
-
-    return newNode(AST_XMLCOMMENT, pos, "contents", text, dst);
-}
-
-bool
-NodeBuilder::xmlPI(HandleValue target, HandleValue contents, TokenPos *pos, MutableHandleValue dst)
-{
-    RootedValue cb(cx, callbacks[AST_XMLPI]);
-    if (!cb.isNull())
-        return callback(cb, target, contents, pos, dst);
-
-    return newNode(AST_XMLPI, pos,
-                   "target", target,
-                   "contents", contents,
-                   dst);
-}
-
 /*
  * Serialization of parse nodes to JavaScript objects.
  *
  * All serialization methods take a non-nullable ParseNode pointer.
  */
 class ASTSerializer
 {
     JSContext           *cx;
@@ -1703,17 +1467,16 @@ class ASTSerializer
     }
 
     BinaryOperator binop(ParseNodeKind kind, JSOp op);
     UnaryOperator unop(ParseNodeKind kind, JSOp op);
     AssignmentOperator aop(JSOp op);
 
     bool statements(ParseNode *pn, NodeVector &elts);
     bool expressions(ParseNode *pn, NodeVector &elts);
-    bool xmls(ParseNode *pn, NodeVector &elts);
     bool leftAssociate(ParseNode *pn, MutableHandleValue dst);
     bool functionArgs(ParseNode *pn, ParseNode *pnargs, ParseNode *pndestruct, ParseNode *pnbody,
                       NodeVector &args, NodeVector &defaults, MutableHandleValue rest);
 
     bool sourceElement(ParseNode *pn, MutableHandleValue dst);
 
     bool declaration(ParseNode *pn, MutableHandleValue dst);
     bool variableDeclaration(ParseNode *pn, bool let, MutableHandleValue dst);
@@ -1771,18 +1534,16 @@ class ASTSerializer
     bool functionArgsAndBody(ParseNode *pn, NodeVector &args, NodeVector &defaults,
                              MutableHandleValue body, MutableHandleValue rest);
     bool functionBody(ParseNode *pn, TokenPos *pos, MutableHandleValue dst);
 
     bool comprehensionBlock(ParseNode *pn, MutableHandleValue dst);
     bool comprehension(ParseNode *pn, MutableHandleValue dst);
     bool generatorExpression(ParseNode *pn, MutableHandleValue dst);
 
-    bool xml(ParseNode *pn, MutableHandleValue dst);
-
   public:
     ASTSerializer(JSContext *c, bool l, char const *src, uint32_t ln)
         : cx(c)
         , builder(c, l, src)
 #ifdef DEBUG
         , lineno(ln)
 #endif
     {}
@@ -1897,18 +1658,16 @@ ASTSerializer::binop(ParseNodeKind kind,
       case PNK_BITXOR:
         return BINOP_BITXOR;
       case PNK_BITAND:
         return BINOP_BITAND;
       case PNK_IN:
         return BINOP_IN;
       case PNK_INSTANCEOF:
         return BINOP_INSTANCEOF;
-      case PNK_DBLDOT:
-        return BINOP_DBLDOT;
       default:
         return BINOP_ERR;
     }
 }
 
 bool
 ASTSerializer::statements(ParseNode *pn, NodeVector &elts)
 {
@@ -1944,34 +1703,16 @@ ASTSerializer::expressions(ParseNode *pn
             return false;
         elts.infallibleAppend(elt);
     }
 
     return true;
 }
 
 bool
-ASTSerializer::xmls(ParseNode *pn, NodeVector &elts)
-{
-    if (!elts.reserve(pn->pn_count))
-        return false;
-
-    for (ParseNode *next = pn->pn_head; next; next = next->pn_next) {
-        JS_ASSERT(pn->pn_pos.encloses(next->pn_pos));
-
-        RootedValue elt(cx);
-        if (!xml(next, &elt))
-            return false;
-        elts.infallibleAppend(elt);
-    }
-
-    return true;
-}
-
-bool
 ASTSerializer::blockStatement(ParseNode *pn, MutableHandleValue dst)
 {
     JS_ASSERT(pn->isKind(PNK_STATEMENTLIST));
 
     NodeVector stmts(cx);
     return statements(pn, stmts) &&
            builder.blockStatement(stmts, &pn->pn_pos, dst);
 }
@@ -2415,30 +2156,16 @@ ASTSerializer::statement(ParseNode *pn, 
                (pn->isKind(PNK_THROW)
                 ? builder.throwStatement(arg, &pn->pn_pos, dst)
                 : builder.returnStatement(arg, &pn->pn_pos, dst));
       }
 
       case PNK_DEBUGGER:
         return builder.debuggerStatement(&pn->pn_pos, dst);
 
-#if JS_HAS_XML_SUPPORT
-      case PNK_DEFXMLNS:
-      {
-        JS_ASSERT(pn->pn_pos.encloses(pn->pn_kid->pn_pos));
-
-        LOCAL_ASSERT(pn->isArity(PN_UNARY));
-
-        RootedValue ns(cx);
-
-        return expression(pn->pn_kid, &ns) &&
-               builder.xmlDefaultNamespace(ns, &pn->pn_pos, dst);
-      }
-#endif
-
       case PNK_NOP:
         return builder.emptyStatement(&pn->pn_pos, dst);
 
       default:
         LOCAL_NOT_REACHED("unexpected statement type");
     }
 }
 
@@ -2672,17 +2399,16 @@ ASTSerializer::expression(ParseNode *pn,
       case PNK_STAR:
       case PNK_DIV:
       case PNK_MOD:
       case PNK_BITOR:
       case PNK_BITXOR:
       case PNK_BITAND:
       case PNK_IN:
       case PNK_INSTANCEOF:
-      case PNK_DBLDOT:
         if (pn->isArity(PN_BINARY)) {
             JS_ASSERT(pn->pn_pos.encloses(pn->pn_left->pn_pos));
             JS_ASSERT(pn->pn_pos.encloses(pn->pn_right->pn_pos));
 
             BinaryOperator op = binop(pn->getKind(), pn->getOp());
             LOCAL_ASSERT(op > BINOP_ERR && op < BINOP_LIMIT);
 
             RootedValue left(cx), right(cx);
@@ -2847,199 +2573,18 @@ ASTSerializer::expression(ParseNode *pn,
         LOCAL_ASSERT(pn->pn_count == 1);
         LOCAL_ASSERT(pn->pn_head->isKind(PNK_LEXICALSCOPE));
 
         return comprehension(pn->pn_head->pn_expr, dst);
 
       case PNK_LET:
         return let(pn, true, dst);
 
-#if JS_HAS_XML_SUPPORT
-      case PNK_XMLUNARY:
-        JS_ASSERT(pn->isOp(JSOP_XMLNAME) ||
-                  pn->isOp(JSOP_SETXMLNAME) ||
-                  pn->isOp(JSOP_BINDXMLNAME));
-        return expression(pn->pn_kid, dst);
-
-      case PNK_ANYNAME:
-        return builder.xmlAnyName(&pn->pn_pos, dst);
-
-      case PNK_DBLCOLON:
-      {
-        RootedValue right(cx);
-
-        LOCAL_ASSERT(pn->isArity(PN_NAME) || pn->isArity(PN_BINARY));
-
-        ParseNode *pnleft;
-        bool computed;
-
-        if (pn->isArity(PN_BINARY)) {
-            JS_ASSERT(pn->pn_pos.encloses(pn->pn_left->pn_pos));
-            JS_ASSERT(pn->pn_pos.encloses(pn->pn_right->pn_pos));
-
-            computed = true;
-            pnleft = pn->pn_left;
-            if (!expression(pn->pn_right, &right))
-                return false;
-        } else {
-            JS_ASSERT(pn->isArity(PN_NAME));
-            JS_ASSERT(pn->pn_pos.encloses(pn->pn_expr->pn_pos));
-
-            computed = false;
-            pnleft = pn->pn_expr;
-            RootedAtom pnAtom(cx, pn->pn_atom);
-            if (!identifier(pnAtom, NULL, &right))
-                return false;
-        }
-
-        if (pnleft->isKind(PNK_FUNCTIONNS))
-            return builder.xmlFunctionQualifiedIdentifier(right, computed, &pn->pn_pos, dst);
-
-        RootedValue left(cx);
-        return expression(pnleft, &left) &&
-               builder.xmlQualifiedIdentifier(left, right, computed, &pn->pn_pos, dst);
-      }
-
-      case PNK_AT:
-      {
-        JS_ASSERT(pn->pn_pos.encloses(pn->pn_kid->pn_pos));
-
-        RootedValue expr(cx);
-        ParseNode *kid = pn->pn_kid;
-        bool computed = ((!kid->isKind(PNK_NAME) || !kid->isOp(JSOP_QNAMEPART)) &&
-                         !kid->isKind(PNK_DBLCOLON) &&
-                         !kid->isKind(PNK_ANYNAME));
-        return expression(kid, &expr) &&
-            builder.xmlAttributeSelector(expr, computed, &pn->pn_pos, dst);
-      }
-
-      case PNK_FILTER:
-      {
-        JS_ASSERT(pn->pn_pos.encloses(pn->pn_left->pn_pos));
-        JS_ASSERT(pn->pn_pos.encloses(pn->pn_right->pn_pos));
-
-        RootedValue left(cx), right(cx);
-        return expression(pn->pn_left, &left) &&
-               expression(pn->pn_right, &right) &&
-               builder.xmlFilterExpression(left, right, &pn->pn_pos, dst);
-      }
-
-      default:
-        return xml(pn, dst);
-
-#else
       default:
         LOCAL_NOT_REACHED("unexpected expression type");
-#endif
-    }
-}
-
-bool
-ASTSerializer::xml(ParseNode *pn, MutableHandleValue dst)
-{
-    JS_CHECK_RECURSION(cx, return false);
-    switch (pn->getKind()) {
-#if JS_HAS_XML_SUPPORT
-      case PNK_XMLCURLYEXPR:
-      {
-        JS_ASSERT(pn->pn_pos.encloses(pn->pn_kid->pn_pos));
-
-        RootedValue expr(cx);
-        return expression(pn->pn_kid, &expr) &&
-               builder.xmlEscapeExpression(expr, &pn->pn_pos, dst);
-      }
-
-      case PNK_XMLELEM:
-      {
-        NodeVector elts(cx);
-        if (!xmls(pn, elts))
-            return false;
-        return builder.xmlElement(elts, &pn->pn_pos, dst);
-      }
-
-      case PNK_XMLLIST:
-      {
-        NodeVector elts(cx);
-        if (!xmls(pn, elts))
-            return false;
-        return builder.xmlList(elts, &pn->pn_pos, dst);
-      }
-
-      case PNK_XMLSTAGO:
-      {
-        NodeVector elts(cx);
-        if (!xmls(pn, elts))
-            return false;
-        return builder.xmlStartTag(elts, &pn->pn_pos, dst);
-      }
-
-      case PNK_XMLETAGO:
-      {
-        NodeVector elts(cx);
-        if (!xmls(pn, elts))
-            return false;
-        return builder.xmlEndTag(elts, &pn->pn_pos, dst);
-      }
-
-      case PNK_XMLPTAGC:
-      {
-        NodeVector elts(cx);
-        if (!xmls(pn, elts))
-            return false;
-        return builder.xmlPointTag(elts, &pn->pn_pos, dst);
-      }
-
-      case PNK_XMLTEXT:
-      case PNK_XMLSPACE: {
-        RootedValue atomContentsVal(cx, unrootedAtomContents(pn->pn_atom));
-        return builder.xmlText(atomContentsVal, &pn->pn_pos, dst);
-      }
-
-      case PNK_XMLNAME:
-        if (pn->isArity(PN_NULLARY)) {
-            RootedValue atomContentsVal(cx, unrootedAtomContents(pn->pn_atom));
-            return builder.xmlName(atomContentsVal, &pn->pn_pos, dst);
-        }
-
-        LOCAL_ASSERT(pn->isArity(PN_LIST));
-
-        {
-            NodeVector elts(cx);
-            return xmls(pn, elts) &&
-                   builder.xmlName(elts, &pn->pn_pos, dst);
-        }
-
-      case PNK_XMLATTR: {
-        RootedValue atomContentsVal(cx, unrootedAtomContents(pn->pn_atom));
-        return builder.xmlAttribute(atomContentsVal, &pn->pn_pos, dst);
-      }
-
-      case PNK_XMLCDATA: {
-        RootedValue atomContentsVal(cx, unrootedAtomContents(pn->pn_atom));
-        return builder.xmlCdata(atomContentsVal, &pn->pn_pos, dst);
-      }
-
-      case PNK_XMLCOMMENT: {
-        RootedValue atomContentsVal(cx, unrootedAtomContents(pn->pn_atom));
-        return builder.xmlComment(atomContentsVal, &pn->pn_pos, dst);
-      }
-
-      case PNK_XMLPI: {
-        XMLProcessingInstruction &pi = pn->as<XMLProcessingInstruction>();
-        RootedValue targetAtomContentsVal(cx, unrootedAtomContents(pi.target()));
-        RootedValue dataAtomContentsVal(cx, unrootedAtomContents(pi.data()));
-        return builder.xmlPI(targetAtomContentsVal,
-                             dataAtomContentsVal,
-                             &pi.pn_pos,
-                             dst);
-      }
-#endif
-
-      default:
-        LOCAL_NOT_REACHED("unexpected XML node type");
     }
 }
 
 bool
 ASTSerializer::propertyName(ParseNode *pn, MutableHandleValue dst)
 {
     if (pn->isKind(PNK_NAME))
         return identifier(pn, dst);
--- a/js/src/jsreflect.h
+++ b/js/src/jsreflect.h
@@ -49,18 +49,16 @@ enum BinaryOperator {
     /* shift */
     BINOP_LSH, BINOP_RSH, BINOP_URSH,
     /* arithmetic */
     BINOP_ADD, BINOP_SUB, BINOP_STAR, BINOP_DIV, BINOP_MOD,
     /* binary */
     BINOP_BITOR, BINOP_BITXOR, BINOP_BITAND,
     /* misc */
     BINOP_IN, BINOP_INSTANCEOF,
-    /* xml */
-    BINOP_DBLDOT,
 
     BINOP_LIMIT
 };
 
 enum UnaryOperator {
     UNOP_ERR = -1,
 
     UNOP_DELETE = 0,
--- a/js/src/jswrapper.cpp
+++ b/js/src/jswrapper.cpp
@@ -40,38 +40,23 @@ Wrapper::getWrapperFamily()
 JSObject *
 Wrapper::New(JSContext *cx, JSObject *obj, JSObject *proto, JSObject *parent,
              Wrapper *handler)
 {
     JS_ASSERT(parent);
 
     AutoMarkInDeadCompartment amd(cx->compartment);
 
-#if JS_HAS_XML_SUPPORT
-    if (obj->isXML()) {
-        JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
-                             JSMSG_CANT_WRAP_XML_OBJECT);
-        return NULL;
-    }
-#endif
     return NewProxyObject(cx, handler, ObjectValue(*obj), proto, parent,
                           obj->isCallable() ? obj : NULL, NULL);
 }
 
 JSObject *
 Wrapper::Renew(JSContext *cx, JSObject *existing, JSObject *obj, Wrapper *handler)
 {
-#if JS_HAS_XML_SUPPORT
-    if (obj->isXML()) {
-        JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
-                             JSMSG_CANT_WRAP_XML_OBJECT);
-        return NULL;
-    }
-#endif
-
     JS_ASSERT(!obj->isCallable());
     return RenewProxyObject(cx, existing, handler, ObjectValue(*obj));
 }
 
 Wrapper *
 Wrapper::wrapperHandler(RawObject wrapper)
 {
     JS_ASSERT(wrapper->isWrapper());
deleted file mode 100644
--- a/js/src/jsxml.cpp
+++ /dev/null
@@ -1,8032 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
- * vim: set ts=4 sw=4 et tw=78:
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include <stddef.h>
-#include "jsversion.h"
-
-size_t sE4XObjectsCreated = 0;
-
-#if JS_HAS_XML_SUPPORT
-
-#include <math.h>
-#include <stdlib.h>
-#include <string.h>
-
-#include "mozilla/Util.h"
-
-#include "jstypes.h"
-#include "jsprf.h"
-#include "jsutil.h"
-#include "jsapi.h"
-#include "jsarray.h"
-#include "jsatom.h"
-#include "jsbool.h"
-#include "jscntxt.h"
-#include "jsfun.h"
-#include "jsgc.h"
-#include "jslock.h"
-#include "jsnum.h"
-#include "jsobj.h"
-#include "jsopcode.h"
-#include "jsscript.h"
-#include "jsstr.h"
-#include "jsxml.h"
-
-#include "frontend/Parser.h"
-#include "frontend/TokenStream.h"
-#include "gc/Marking.h"
-#include "vm/GlobalObject.h"
-#include "vm/Shape.h"
-#include "vm/StringBuffer.h"
-
-#include "jsatominlines.h"
-#include "jsinferinlines.h"
-#include "jsobjinlines.h"
-
-#include "vm/Stack-inl.h"
-#include "vm/String-inl.h"
-
-#ifdef DEBUG
-#include <string.h>     /* for #ifdef DEBUG memset calls */
-#endif
-
-using namespace js;
-using namespace js::gc;
-using namespace js::types;
-using namespace js::frontend;
-
-using mozilla::ArrayLength;
-
-template<class T, class U>
-struct IdentityOp
-{
-    typedef JSBool (* compare)(const T *a, const U *b);
-};
-
-template<class T>
-static JSBool
-pointer_match(const T *a, const T *b)
-{
-    return a == b;
-}
-
-/*
- * NOTES
- * - in the js shell, you must use the -x command line option, or call
- *   options('xml') before compiling anything that uses XML literals
- *
- * TODO
- * - XXXbe patrol
- * - Fuse objects and their JSXML* private data into single GC-things
- * - fix function::foo vs. x.(foo == 42) collision using proper namespacing
- */
-
-/*
- * Random utilities and global functions.
- */
-const char js_AttributeName_str[] = "AttributeName";
-const char js_localName_str[]     = "localName";
-const char js_xml_parent_str[]    = "parent";
-const char js_prefix_str[]        = "prefix";
-const char js_toXMLString_str[]   = "toXMLString";
-const char js_uri_str[]           = "uri";
-
-const char js_amp_entity_str[]    = "&amp;";
-const char js_gt_entity_str[]     = "&gt;";
-const char js_lt_entity_str[]     = "&lt;";
-const char js_quot_entity_str[]   = "&quot;";
-const char js_leftcurly_entity_str[]   = "&#123;";
-
-#define IS_STAR(str)  ((str)->length() == 1 && *(str)->chars() == '*')
-
-static JSBool
-GetXMLFunction(JSContext *cx, HandleObject obj, HandleId id, MutableHandleValue vp);
-
-static JSBool
-IsDeclared(const JSObject *obj)
-{
-    jsval v;
-
-    JS_ASSERT(obj->getClass() == &NamespaceClass);
-    v = obj->getNamespaceDeclared();
-    JS_ASSERT(JSVAL_IS_VOID(v) || v == JSVAL_TRUE);
-    return v == JSVAL_TRUE;
-}
-
-static JSBool
-xml_isXMLName(JSContext *cx, unsigned argc, jsval *vp)
-{
-    *vp = BOOLEAN_TO_JSVAL(js_IsXMLName(cx, argc ? vp[2] : JSVAL_VOID));
-    return JS_TRUE;
-}
-
-/*
- * This wrapper is needed because NewBuiltinClassInstance doesn't
- * call the constructor, and we need a place to set the
- * HAS_EQUALITY bit.
- */
-static inline JSObject *
-NewBuiltinClassInstanceXML(JSContext *cx, Class *clasp)
-{
-    if (!cx->runningWithTrustedPrincipals())
-        ++sE4XObjectsCreated;
-
-    return NewBuiltinClassInstance(cx, clasp);
-}
-
-#define DEFINE_GETTER(name,code)                                               \
-    static JSBool                                                              \
-    name(JSContext *cx, HandleObject obj, HandleId id, MutableHandleValue vp)  \
-    {                                                                          \
-        code;                                                                  \
-        return true;                                                           \
-    }
-
-/*
- * Namespace class and library functions.
- */
-DEFINE_GETTER(NamePrefix_getter,
-              if (obj->getClass() == &NamespaceClass) vp.set(obj->getNamePrefixVal()))
-DEFINE_GETTER(NameURI_getter,
-              if (obj->getClass() == &NamespaceClass) vp.set(obj->getNameURIVal()))
-
-static JSBool
-namespace_equality(JSContext *cx, HandleObject obj, HandleValue v, JSBool *bp)
-{
-    JSObject *obj2;
-
-    JS_ASSERT(v.isObjectOrNull());
-    obj2 = v.toObjectOrNull();
-    *bp = (!obj2 || obj2->getClass() != &NamespaceClass)
-          ? JS_FALSE
-          : EqualStrings(obj->getNameURI(), obj2->getNameURI());
-    return JS_TRUE;
-}
-
-JS_FRIEND_DATA(Class) js::NamespaceClass = {
-    "Namespace",
-    JSCLASS_HAS_RESERVED_SLOTS(JSObject::NAMESPACE_CLASS_RESERVED_SLOTS) |
-    JSCLASS_HAS_CACHED_PROTO(JSProto_Namespace),
-    JS_PropertyStub,         /* addProperty */
-    JS_PropertyStub,         /* delProperty */
-    JS_PropertyStub,         /* getProperty */
-    JS_StrictPropertyStub,   /* setProperty */
-    JS_EnumerateStub,
-    JS_ResolveStub,
-    JS_ConvertStub,
-    NULL,                    /* finalize    */
-    NULL,                    /* checkAccess */
-    NULL,                    /* call        */
-    NULL,                    /* construct   */
-    NULL,                    /* hasInstance */
-    NULL,                    /* trace       */
-    {
-        namespace_equality,
-        NULL,                /* outerObject    */
-        NULL,                /* innerObject    */
-        NULL,                /* iteratorObject */
-        NULL,                /* wrappedObject  */
-    }
-};
-
-#define NAMESPACE_ATTRS                                                       \
-    (JSPROP_ENUMERATE | JSPROP_READONLY | JSPROP_PERMANENT | JSPROP_SHARED)
-
-static JSPropertySpec namespace_props[] = {
-    {js_prefix_str, 0, NAMESPACE_ATTRS, JSOP_WRAPPER(NamePrefix_getter), JSOP_NULLWRAPPER},
-    {js_uri_str,    0, NAMESPACE_ATTRS, JSOP_WRAPPER(NameURI_getter), JSOP_NULLWRAPPER},
-    {0,0,0,JSOP_NULLWRAPPER, JSOP_NULLWRAPPER}
-};
-
-static JSBool
-namespace_toString(JSContext *cx, unsigned argc, Value *vp)
-{
-    JSObject *obj = ToObject(cx, HandleValue::fromMarkedLocation(&vp[1]));
-    if (!obj)
-        return JS_FALSE;
-    if (!obj->isNamespace()) {
-        ReportIncompatibleMethod(cx, CallReceiverFromVp(vp), &NamespaceClass);
-        return JS_FALSE;
-    }
-    *vp = obj->getNameURIVal();
-    return JS_TRUE;
-}
-
-static JSFunctionSpec namespace_methods[] = {
-    JS_FN(js_toString_str,  namespace_toString,        0,0),
-    JS_FS_END
-};
-
-static JSObject *
-NewXMLNamespace(JSContext *cx, JSLinearString *prefix, JSLinearString *uri, JSBool declared)
-{
-    RootedObject obj(cx, NewBuiltinClassInstanceXML(cx, &NamespaceClass));
-    if (!obj)
-        return NULL;
-
-    JS_ASSERT(JSVAL_IS_VOID(obj->getNamePrefixVal()));
-    JS_ASSERT(JSVAL_IS_VOID(obj->getNameURIVal()));
-    JS_ASSERT(JSVAL_IS_VOID(obj->getNamespaceDeclared()));
-
-    /* Per ECMA-357, 13.2.5, these properties must be "own". */
-    if (!JS_DefineProperties(cx, obj, namespace_props))
-        return NULL;
-
-    if (prefix)
-        obj->setNamePrefix(prefix);
-    if (uri)
-        obj->setNameURI(uri);
-    if (declared)
-        obj->setNamespaceDeclared(JSVAL_TRUE);
-    return obj;
-}
-
-/*
- * QName class and library functions.
- */
-DEFINE_GETTER(QNameNameURI_getter,
-              if (obj->getClass() == &QNameClass)
-                  vp.set(JSVAL_IS_VOID(obj->getNameURIVal()) ? JSVAL_NULL : obj->getNameURIVal()))
-DEFINE_GETTER(QNameLocalName_getter,
-              if (obj->getClass() == &QNameClass)
-                  vp.set(obj->getQNameLocalNameVal()))
-
-static JSBool
-qname_identity(JSObject *qna, const JSObject *qnb)
-{
-    JSLinearString *uri1 = qna->getNameURI();
-    JSLinearString *uri2 = qnb->getNameURI();
-
-    if (!uri1 ^ !uri2)
-        return JS_FALSE;
-    if (uri1 && !EqualStrings(uri1, uri2))
-        return JS_FALSE;
-    return EqualStrings(qna->getQNameLocalName(), qnb->getQNameLocalName());
-}
-
-static JSBool
-qname_equality(JSContext *cx, HandleObject qn, HandleValue v, JSBool *bp)
-{
-    JSObject *obj2;
-
-    obj2 = v.toObjectOrNull();
-    *bp = (!obj2 || obj2->getClass() != &QNameClass)
-          ? JS_FALSE
-          : qname_identity(qn, obj2);
-    return JS_TRUE;
-}
-
-JS_FRIEND_DATA(Class) js::QNameClass = {
-    "QName",
-    JSCLASS_HAS_RESERVED_SLOTS(JSObject::QNAME_CLASS_RESERVED_SLOTS) |
-    JSCLASS_HAS_CACHED_PROTO(JSProto_QName),
-    JS_PropertyStub,         /* addProperty */
-    JS_PropertyStub,         /* delProperty */
-    JS_PropertyStub,         /* getProperty */
-    JS_StrictPropertyStub,   /* setProperty */
-    JS_EnumerateStub,
-    JS_ResolveStub,
-    JS_ConvertStub,
-    NULL,                    /* finalize    */
-    NULL,                    /* checkAccess */
-    NULL,                    /* call        */
-    NULL,                    /* construct   */
-    NULL,                    /* hasInstance */
-    NULL,                    /* trace       */
-    {
-        qname_equality,
-        NULL,                /* outerObject    */
-        NULL,                /* innerObject    */
-        NULL,                /* iteratorObject */
-        NULL,                /* wrappedObject  */
-    }
-};
-
-/*
- * Classes for the ECMA-357-internal types AttributeName and AnyName, which
- * are like QName, except that they have no property getters.  They share the
- * qname_toString method, and therefore are exposed as constructable objects
- * in this implementation.
- */
-JS_FRIEND_DATA(Class) js::AttributeNameClass = {
-    js_AttributeName_str,
-    JSCLASS_HAS_RESERVED_SLOTS(JSObject::QNAME_CLASS_RESERVED_SLOTS) |
-    JSCLASS_IS_ANONYMOUS,
-    JS_PropertyStub,         /* addProperty */
-    JS_PropertyStub,         /* delProperty */
-    JS_PropertyStub,         /* getProperty */
-    JS_StrictPropertyStub,   /* setProperty */
-    JS_EnumerateStub,
-    JS_ResolveStub,
-    JS_ConvertStub
-};
-
-JS_FRIEND_DATA(Class) js::AnyNameClass = {
-    js_AnyName_str,
-    JSCLASS_HAS_RESERVED_SLOTS(JSObject::QNAME_CLASS_RESERVED_SLOTS) |
-    JSCLASS_IS_ANONYMOUS,
-    JS_PropertyStub,         /* addProperty */
-    JS_PropertyStub,         /* delProperty */
-    JS_PropertyStub,         /* getProperty */
-    JS_StrictPropertyStub,   /* setProperty */
-    JS_EnumerateStub,
-    JS_ResolveStub,
-    JS_ConvertStub
-};
-
-#define QNAME_ATTRS (JSPROP_ENUMERATE | JSPROP_READONLY | JSPROP_PERMANENT | JSPROP_SHARED)
-
-static JSPropertySpec qname_props[] = {
-    {js_uri_str,       0, QNAME_ATTRS, JSOP_WRAPPER(QNameNameURI_getter),   JSOP_NULLWRAPPER},
-    {js_localName_str, 0, QNAME_ATTRS, JSOP_WRAPPER(QNameLocalName_getter), JSOP_NULLWRAPPER},
-    {0,0,0,JSOP_NULLWRAPPER,JSOP_NULLWRAPPER}
-};
-
-static JSString *
-ConvertQNameToString(JSContext *cx, JSObject *obj)
-{
-    JS_ASSERT(obj->isQName());
-    RootedString uri(cx, obj->getNameURI());
-    RootedString str(cx);
-    if (!uri) {
-        /* No uri means wildcard qualifier. */
-        str = cx->names().starQualifier;
-    } else if (uri->empty()) {
-        /* Empty string for uri means localName is in no namespace. */
-        str = cx->runtime->emptyString;
-    } else {
-        RootedString qualstr(cx, cx->names().qualifier);
-        str = ConcatStrings<CanGC>(cx, uri, qualstr);
-        if (!str)
-            return NULL;
-    }
-    Rooted<JSString*> localName(cx, obj->getQNameLocalName());
-    str = ConcatStrings<CanGC>(cx, str, localName);
-    if (!str)
-        return NULL;
-
-    if (obj->getClass() == &AttributeNameClass) {
-        JS::Anchor<JSString *> anchor(str);
-        size_t length = str->length();
-        jschar *chars = cx->pod_malloc<jschar>(length + 2);
-        if (!chars)
-            return NULL;
-        *chars = '@';
-        const jschar *strChars = str->getChars(cx);
-        if (!strChars) {
-            js_free(chars);
-            return NULL;
-        }
-        js_strncpy(chars + 1, strChars, length);
-        chars[++length] = 0;
-        str = js_NewString<CanGC>(cx, chars, length);
-        if (!str) {
-            js_free(chars);
-            return NULL;