Fix function name inference corruption for async functions

The code which pushes and pops to the function name inference stack
generally checks if the stack is active with the IsOpen method. One
piece of code pertaining to async functions was missing that check.
This patch adds it.

BUG=chromium:658267
R=gsathya,caitp

Review-Url: https://codereview.chromium.org/2514893002
Cr-Commit-Position: refs/heads/master@{#41120}

src/parsing/func-name-inferrer.cc

@@ -45,9 +45,11 @@ void FuncNameInferrer::PushVariableName(const AstRawString* name) {
 }
 
 void FuncNameInferrer::RemoveAsyncKeywordFromEnd() {
-  DCHECK(names_stack_.length() > 0);
-  DCHECK(names_stack_.last().name->IsOneByteEqualTo("async"));
-  names_stack_.RemoveLast();
+  if (IsOpen()) {
+    DCHECK(names_stack_.length() > 0);
+    DCHECK(names_stack_.last().name->IsOneByteEqualTo("async"));
+    names_stack_.RemoveLast();
+  }
 }
 
 const AstString* FuncNameInferrer::MakeNameFromStack() {

test/mjsunit/regress/regress-cr-658267.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows("class D extends async() =>", SyntaxError);