This avoids the crash which ClusterFuzz found, but still does not
report the same position as without validate.asm.
For calls like "foo()|0", we report the position of the call instead of
the position of the "|" if ToNumber throws an error.

After this CL, the correctness-fuzzer for validate-asm will probably
find mismatches there.

R=titzer@chromium.org
BUG=chromium:670808

Review-Url: https://codereview.chromium.org/2548323002
Cr-Commit-Position: refs/heads/master@{#41500}