diff --git a/mozilla/js/src/jsemit.c b/mozilla/js/src/jsemit.c
index 67b62b4f463..3dfaf5a728c 100644
--- a/mozilla/js/src/jsemit.c
+++ b/mozilla/js/src/jsemit.c
@@ -4709,7 +4709,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
         }
 
         JS_ASSERT(pn->pn_type == TOK_XMLLIST || pn->pn_count != 0);
-        switch (pn->pn_head->pn_type) {
+        switch (pn->pn_head ? pn->pn_head->pn_type : TOK_XMLLIST) {
           case TOK_XMLETAGO:
             JS_ASSERT(0);
             /* FALL THROUGH */
diff --git a/mozilla/js/src/jsopcode.c b/mozilla/js/src/jsopcode.c
index 5ca85370ce2..6d75b40d196 100644
--- a/mozilla/js/src/jsopcode.c
+++ b/mozilla/js/src/jsopcode.c
@@ -2560,8 +2560,12 @@ Decompile(SprintStack *ss, jsbytecode *pc, intN nb)
                 quoteAttr = JS_FALSE;
                 break;
 
-              case JSOP_TOXML:
               case JSOP_TOXMLLIST:
+                todo = Sprint(&ss->sprinter, "<>%s</>", POP_STR());
+                inXML = JS_FALSE;
+                break;
+
+              case JSOP_TOXML:
                 inXML = JS_FALSE;
                 /* fall through */