Don't crash when preparsing destructured arguments

test/mjsunit/harmony/regress/regress-4400.js

Index: test/mjsunit/harmony/regress/regress-4400.js
diff --git a/test/message/destructuring-modify-const.js b/test/mjsunit/harmony/regress/regress-4400.js
similarity index 60%
copy from test/message/destructuring-modify-const.js
copy to test/mjsunit/harmony/regress/regress-4400.js
index cabd924b37ea9f178259f4c979c3b3268920c713..7c42e4f557ad098c4778841285a7075498ba1bf7 100644
--- a/test/message/destructuring-modify-const.js
+++ b/test/mjsunit/harmony/regress/regress-4400.js
@@ -2,8 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-destructuring
-'use strict';
+// Flags: --harmony-default-parameters --min-preparse-length=0
 
-const { x : x, y : y } = { x : 1, y : 2 };
-x++;
+function borked(a = [], b = {}, c) {}
+borked();