bug 305883: Protect against the empty XML list to fix a crash when emitting code for |<></>|. Also fix the decompiler to handle XMLLists correctly. r=brendan

js/src/jsemit.c

@@ -4709,7 +4709,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
         }
 
         JS_ASSERT(pn->pn_type == TOK_XMLLIST || pn->pn_count != 0);
-        switch (pn->pn_head->pn_type) {
+        switch (pn->pn_head ? pn->pn_head->pn_type : TOK_XMLLIST) {
           case TOK_XMLETAGO:
             JS_ASSERT(0);
             /* FALL THROUGH */

js/src/jsopcode.c

@@ -2560,8 +2560,12 @@ Decompile(SprintStack *ss, jsbytecode *pc, intN nb)
                 quoteAttr = JS_FALSE;
                 break;
 
-              case JSOP_TOXML:
               case JSOP_TOXMLLIST:
+                todo = Sprint(&ss->sprinter, "<>%s</>", POP_STR());
+                inXML = JS_FALSE;
+                break;
+
+              case JSOP_TOXML:
                 inXML = JS_FALSE;
                 /* fall through */