[parser] fix null-dereference in DoExpression rewriting

test/mjsunit/harmony/do-expressions.js

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --harmony-do-expressions --harmony-sloppy-let --allow-natives-syntax
 // Flags: --harmony-default-parameters --harmony-destructuring-bind
 // Flags: --harmony-completion
 
 function returnValue(v) { return v; }
 function MyError() {}
@@ skipping 245 matching lines @@
   // TODO(caitp): Always block-scope function declarations in |do| expressions
   //(do {
   //  assertEquals(true, inner_func());
   //  function inner_func() { return true; }
   //});
   //assertThrows(function() { return innerFunc(); }, ReferenceError);
 }
 TestHoisting();
 
 
+// v8:4661
+
+function tryFinallySimple() { (do { try {} finally {} }); }
+tryFinallySimple();
+tryFinallySimple();
+tryFinallySimple();
+tryFinallySimple();
+
+var finallyRanCount = 0;
+function tryFinallyDoExpr() {
+  return (do {
+    try {
+      throw "BOO";
+    } catch (e) {
+      "Caught: " + e + " (" + finallyRanCount + ")"
+    } finally {
+      ++finallyRanCount;
+    }
+  });
+}
+assertEquals("Caught: BOO (0)", tryFinallyDoExpr());
+assertEquals(1, finallyRanCount);
+assertEquals("Caught: BOO (1)", tryFinallyDoExpr());
+assertEquals(2, finallyRanCount);
+assertEquals("Caught: BOO (2)", tryFinallyDoExpr());
+assertEquals(3, finallyRanCount);
+assertEquals("Caught: BOO (3)", tryFinallyDoExpr());
+assertEquals(4, finallyRanCount);
+
+
 function TestOSR() {
   var numbers = do {
     let nums = [];
     for (let i = 0; i < 1000; ++i) {
       let value = (Math.random() * 100) | 0;
       nums.push(value === 0 ? 1 : value), nums;
     }
   };
   assertEquals(numbers.length, 1000);
 }
 
 for (var i = 0; i < 64; ++i) TestOSR();