Bug 514567: Fix error processing in PrimaryExpr. r=brendan

This code seems to assume that one can proceed if pn3 is NULL, but we
never check it again further down.  Instead, we create TOK_COLON nodes
whose left (and perhaps right) children are NULL.  It seems to me that
the TOK_RC case in js_EmitTree will choke on this.

js/src/jsparse.cpp

@@ -7877,8 +7877,9 @@ PrimaryExpr(JSContext *cx, JSTokenStream *ts, JSTreeContext *tc,
             switch (tt) {
               case TOK_NUMBER:
                 pn3 = NewParseNode(PN_NULLARY, tc);
-                if (pn3)
-                    pn3->pn_dval = CURRENT_TOKEN(ts).t_dval;
+                if (!pn3)
+                    return NULL;
+                pn3->pn_dval = CURRENT_TOKEN(ts).t_dval;
                 break;
               case TOK_NAME:
 #if JS_HAS_GETTER_SETTER
@@ -7915,8 +7916,9 @@ PrimaryExpr(JSContext *cx, JSTokenStream *ts, JSTreeContext *tc,
 #endif
               case TOK_STRING:
                 pn3 = NewParseNode(PN_NULLARY, tc);
-                if (pn3)
-                    pn3->pn_atom = CURRENT_TOKEN(ts).t_atom;
+                if (!pn3)
+                    return NULL;
+                pn3->pn_atom = CURRENT_TOKEN(ts).t_atom;
                 break;
               case TOK_RC:
                 goto end_obj_init;