Bug 777834 - Don't call into the tokenizer if it's in an error state. r=jorendorff

js/src/frontend/Parser.cpp

@@ -1628,6 +1628,9 @@ Parser::functionDef(HandlePropertyName funName, FunctionType type, FunctionSynta
         funbox->bufEnd = tokenStream.offsetOfToken(tokenStream.currentToken()) + 1;
 #if JS_HAS_EXPR_CLOSURES
     } else {
+        // We shouldn't call endOffset if the tokenizer got an error.
+        if (tokenStream.hadError())
+            return NULL;
         funbox->bufEnd = tokenStream.endOffset(tokenStream.currentToken());
         if (kind == Statement && !MatchOrInsertSemicolon(context, &tokenStream))
             return NULL;

js/src/jit-test/tests/basic/function-tosource-exprbody-bug777834.js

@@ -0,0 +1,5 @@
+load(libdir + "asserts.js");
+
+assertThrowsInstanceOf(function () {
+    eval("function f()((l()))++2s");
+}, SyntaxError);