Bug 563221 - "Assertion failure: ss->top >= nuses," or "Assertion failure: top != 0," with decompiler, if-else chain, and GOTOX. r=brendan.

--HG--
extra : rebase_source : b085564d7569fceb144193da4b93054b6ddbdadc

js/src/jsopcode.cpp

@@ -3274,6 +3274,7 @@ Decompile(SprintStack *ss, jsbytecode *pc, intN nb, JSOp nextop)
                             cond -= tail;
                             DECOMPILE_CODE(pc + oplen, cond - oplen);
                             pc += cond;
+                            oplen = js_CodeSpec[*pc].length;
                             elseif = JS_TRUE;
                             goto if_again;
                         }

js/src/tests/js1_8_5/regress/jstests.list

@@ -14,3 +14,4 @@ script regress-559438.js
 script regress-560101.js
 script regress-560998-1.js
 script regress-560998-2.js
+script regress-563221.js

js/src/tests/js1_8_5/regress/regress-563221.js

@@ -0,0 +1,8 @@
+// Any copyright is dedicated to the Public Domain.
+// http://creativecommons.org/licenses/publicdomain/
+// Contributor: Jason Orendorff <jorendorff@mozilla.com>
+
+"" + eval("(function () { if (x) ; else if (y) n(); else { " + Array(10000).join("e;") + " } });");
+
+if (this.reportCompare)
+    reportCompare(0, 0, "ok");