Ensure 'for' loops have a leading JSOP_NOP, bug 732776. r=dvander.

js/src/frontend/BytecodeEmitter.cpp

@@ -4931,6 +4931,9 @@ EmitNormalFor(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t top)
         jmp = EmitJump(cx, bce, JSOP_GOTO, 0);
         if (jmp < 0)
             return false;
+    } else {
+        if (op != JSOP_NOP && Emit1(cx, bce, JSOP_NOP) < 0)
+            return false;
     }
 
     top = bce->offset();

js/src/jsopcode.cpp

@@ -2446,15 +2446,10 @@ SprintNormalFor(JSContext *cx, JSPrinter *jp, SprintStack *ss, const char *initP
     ptrdiff_t next = js_GetSrcNoteOffset(sn, 1);
     ptrdiff_t tail = js_GetSrcNoteOffset(sn, 2);
 
-    /*
-     * If this loop has a condition, then pc points at a goto
-     * targeting the condition.
-     */
+    /* Find the loop head, skipping over any leading GOTO or NOP. */
     jsbytecode *pc2 = pc;
-    if (cond != tail) {
-        LOCAL_ASSERT(*pc == JSOP_GOTO);
-        pc2 += JSOP_GOTO_LENGTH;
-    }
+    if (*pc == JSOP_GOTO || *pc == JSOP_NOP)
+        pc2 += GetBytecodeLength(pc);
     LOCAL_ASSERT(tail + GET_JUMP_OFFSET(pc + tail) == pc2 - pc);
 
     if (cond != tail) {