diff --git a/mozilla/js/src/jsxml.c b/mozilla/js/src/jsxml.c
index 866b5600dc9..911bf6119bf 100644
--- a/mozilla/js/src/jsxml.c
+++ b/mozilla/js/src/jsxml.c
@@ -3681,9 +3681,6 @@ Equals(JSContext *cx, JSXML *xml, jsval v, JSBool *bp)
     return JS_TRUE;
 }
 
-static JSBool
-Replace(JSContext *cx, JSXML *xml, jsval id, jsval v);
-
 static JSBool
 CheckCycle(JSContext *cx, JSXML *xml, JSXML *kid)
 {
@@ -3722,6 +3719,13 @@ Insert(JSContext *cx, JSXML *xml, uint32 i, jsval v)
                 n = vxml->xml_kids.length;
                 if (n == 0)
                     return JS_TRUE;
+                for (j = 0; j < n; j++) {
+                    kid = XMLARRAY_MEMBER(&vxml->xml_kids, j, JSXML);
+                    if (!kid)
+                        continue;
+                    if (!CheckCycle(cx, xml, kid))
+                        return JS_FALSE;
+                }
             } else if (vxml->xml_class == JSXML_CLASS_ELEMENT) {
                 /* OPTION: enforce that descendants have superset namespaces. */
                 if (!CheckCycle(cx, xml, vxml))
@@ -3751,8 +3755,6 @@ Insert(JSContext *cx, JSXML *xml, uint32 i, jsval v)
             kid = XMLARRAY_MEMBER(&vxml->xml_kids, j, JSXML);
             if (!kid)
                 continue;
-            if (!CheckCycle(cx, xml, kid))
-                return JS_FALSE;
             kid->parent = xml;
             XMLARRAY_SET_MEMBER(&xml->xml_kids, i + j, kid);
 
@@ -3805,7 +3807,6 @@ Replace(JSContext *cx, JSXML *xml, jsval id, jsval v)
      * It should therefore constrain callers to pass in _i <= x.[[Length]]_.
      */
     n = xml->xml_kids.length;
-    JS_ASSERT(i <= n);
     if (i >= n) {
         if (!IndexToIdVal(cx, n, &id))
             return JS_FALSE;
@@ -5774,7 +5775,7 @@ xml_child_helper(JSContext *cx, JSObject *obj, JSXML *xml, jsval name,
         } else {
             kid = XMLARRAY_MEMBER(&xml->xml_kids, index, JSXML);
             if (!kid) {
-                *rval = JSVAL_NULL;
+                *rval = JSVAL_VOID;
             } else {
                 kidobj = js_GetXMLObject(cx, kid);
                 if (!kidobj)