[Bug 428424] fixing function definition emitter. r=brendan a1.9=mtschrep

js/src/jsemit.c

@@ -5144,9 +5144,18 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
             JS_ASSERT(cg->treeContext.flags & TCF_IN_FUNCTION);
             for (pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next) {
                 if (pn2->pn_type == TOK_FUNCTION) {
-                    JS_ASSERT(pn2->pn_op == JSOP_NOP);
-                    if (!js_EmitTree(cx, cg, pn2))
-                        return JS_FALSE;
+                    if (pn2->pn_op == JSOP_NOP) {
+                        if (!js_EmitTree(cx, cg, pn2))
+                            return JS_FALSE;
+                    } else {
+                        /*
+                         * A closure in a top-level block with function
+                         * definitions appears, for example, when "if (true)"
+                         * is optimized away from "if (true) function x() {}".
+                         * See bug 428424.
+                         */
+                        JS_ASSERT(pn2->pn_op == JSOP_CLOSURE);
+                    }
                 }
             }
         }