Rhino E4X does not allow xml literal in {expression}

Question

I am using rhino1_7R2. I have found that the following program causes syntax error(illegally formed XML syntax):

function b(node) { 
   return <span>{node}{node}</span>;  
}
a=<span>foo {b(<div>bar</div>)} baz</span>;
alert(a);

but it works:

function b(node) { 
   return <span>{node}{node}</span>;  
}
var bar=<div>bar</div>;
a=<span>foo {b(bar)} baz</span>;
alert(a);

It seems to that Rhino does not allow litral xml in { expression }. First I thought that the ECMAScript specification prohibits this. But in Firefox(3.6.23) allowed this syntax. So it may be not because ECMA specification.

This is test page run in Firefox(it works):

<script>
    function b(node) { 
        return <span>{node}{node}</span>;  
    }
    a=<span>foo {b(<div>bar</div>)} baz</span>;
    alert(a);
</script>

Can someone tell it is because Rhino's bug or specifications of either Rhino or Ecmascript?

I will attach test code in Java/Rhino. Regards.

import org.mozilla.javascript.Context;
import org.mozilla.javascript.ScriptableObject;


public class Main {
    public static void main(String[] args) {
        Context c=Context.enter();
        ScriptableObject scope = c.initStandardObjects();
        String source_OK = 
                "function b(node) { " +
                "   return <span>{node}{node}</span>;" +
                "}" +
                "var bar=<div>bar</div>;" +
                "a=<span>foo {b(bar)} baz</span>;   ";
        Object a=c.evaluateString(scope, source_OK, "TEST", 1, null);
        System.out.println(a);

        String source_NG = 
            "function b(node) { " +
            "   return <span>{node}{node}</span>;" +
            "}" +
            "a=<span>foo {b(<div>bar</div>)} baz</span>;   ";
        a=c.evaluateString(scope, source_NG, "TEST", 1, null); //Error!
        System.out.println(a);
        Context.exit();
    }
}

Answer 1

Sorry, I have found that it is a bug of Rhino by myself:

https://bugzilla.mozilla.org/show_bug.cgi?id=323890

I also sended a patch for this bug.