[parser] Fix NaryOperation positions.

If an initializer is a NaryOperation, its position ends up as a start position
of a Scope, and a DCHECK used to fire.

Interestingly, this was not caught by our existing tests.

BUG=chromium:791256

Change-Id: Id47f850c7ad17ca580352f9bd56c9567b485c3b8
Reviewed-on: https://chromium-review.googlesource.com/822093
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50051}

src/ast/ast.h

@@ -1807,7 +1807,7 @@ class NaryOperation final : public Expression {
 
   NaryOperation(Zone* zone, Token::Value op, Expression* first,
                 size_t initial_subsequent_size)
-      : Expression(kNoSourcePosition, kNaryOperation),
+      : Expression(first->position(), kNaryOperation),
         first_(first),
         subsequent_(zone) {
     bit_field_ |= OperatorField::encode(op);

test/mjsunit/regress/regress-crbug-791256.js

@@ -0,0 +1,12 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Original repro. A DCHECK used to fire.
+(function* (name = (eval(foo), foo, prototype)) { });
+
+// Simpler repro.
+(function (name = (foo, bar, baz) ) { });
+
+// A test which uses the value of the n-ary operation.
+(function (param = (0, 1, 2)) { assertEquals(2, param); })();