diff --git a/mozilla/js/src/jsparse.c b/mozilla/js/src/jsparse.c
index 367c283a958..60b87c5298e 100644
--- a/mozilla/js/src/jsparse.c
+++ b/mozilla/js/src/jsparse.c
@@ -6021,6 +6021,7 @@ FoldXMLConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc)
     JSParseNode **pnp, *pn1, *pn2;
     JSString *accum, *str;
     uint32 i, j;
+    JSTempValueRooter tvr;
 
     JS_ASSERT(pn->pn_arity == PN_LIST);
     tt = PN_TYPE(pn);
@@ -6034,6 +6035,13 @@ FoldXMLConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc)
             accum = ATOM_TO_STRING(cx->runtime->atomState.stagoAtom);
     }
 
+    /*
+     * GC Rooting here is tricky: for most of the loop, |accum| is safe via
+     * the newborn string root. However, when |pn2->pn_type| is TOK_XMLCDATA,
+     * TOK_XMLCOMMENT, or TOK_XMLPI it is knocked out of the newborn root.
+     * Therefore, we have to add additonal protection from GC nesting under
+     * js_ConcatStrings.
+     */
     for (pn2 = pn1, i = j = 0; pn2; pn2 = pn2->pn_next, i++) {
         /* The parser already rejected end-tags with attributes. */
         JS_ASSERT(tt != TOK_XMLETAGO || i == 0);
@@ -6104,9 +6112,11 @@ FoldXMLConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc)
         }
 
         if (accum) {
+            JS_PUSH_TEMP_ROOT_STRING(cx, accum, &tvr);
             str = ((tt == TOK_XMLSTAGO || tt == TOK_XMLPTAGC) && i != 0)
                   ? js_AddAttributePart(cx, i & 1, accum, str)
                   : js_ConcatStrings(cx, accum, str);
+            JS_POP_TEMP_ROOT(cx, &tvr);
             if (!str)
                 return JS_FALSE;
 #ifdef DEBUG_brendanXXX