Fix crasher when checking for "of", but next token has no literal buffer

Fix crasher when checking for "of", but next token has no literal buffer

Also fix a typo in an assertion in scanner.h.

R=mstarzinger@chromium.org
BUG=248025
TEST=mjsunit/regress/regress-crbug-248025.js

Committed: http://code.google.com/p/v8/source/detail?r=15059

[wingo, 2013-06-10 11:39:09]

An initial patch.  Still figuring out how to test it.

[wingo, 2013-06-10 15:30:08]

On 2013/06/10 11:39:09, wingo wrote:
> An initial patch.  Still figuring out how to test it.

I haven't figured out in what case you might not have a valid buffer, but I'm
pretty sure this fix is correct and I could imagine that without it, crashes are
possible as the scanner doesn't need to manage the literal buffer.  An imprecise
diagnosis, I know.  WDYT?

[wingo, 2013-06-11 10:52:44]

Updated patch adds test suite.  Thanks to Michael for help reproducing the bug.

[Michael Starzinger, 2013-06-11 11:01:38]

LGTM. Sorry for pestering you with the repro, but I think it is important to
have regression tests for these issues.

[wingo, 2013-06-11 11:30:12]

Committed patchset #2 manually as r15059 (presubmit successful).