Tokenizer:simplifyFlowControl(): Fixed crash on garbage code.

lib/tokenize.cpp

@@ -3994,7 +3994,7 @@ void Tokenizer::simplifyFlowControl()
         unsigned int indentlevel = 0;
         bool stilldead = false;
 
-        for (Token *tok = begin; tok != end; tok = tok->next()) {
+        for (Token *tok = begin; tok && tok != end; tok = tok->next()) {
             if (tok->str() == "(" || tok->str() == "[") {
                 tok = tok->link();
                 continue;

test/testtokenize.cpp

@@ -76,6 +76,7 @@ private:
         TEST_CASE(garbageCode4); // #4887
         TEST_CASE(garbageCode5); // #5168
         TEST_CASE(garbageCode6); // #5214
+        TEST_CASE(garbageCode7);
 
         TEST_CASE(simplifyFileAndLineMacro);  // tokenize "return - __LINE__;"
 
@@ -994,6 +995,10 @@ private:
         tokenizeAndStringify("int a = int b = ( 0 ? ? ) 1 : 0 ;", /*simplify=*/true);
     }
 
+    void garbageCode7() {
+        tokenizeAndStringify(" 1  (int j) {  return return (c) * sizeof } y[1];", /*simplify=*/true);
+    }
+
     void simplifyFileAndLineMacro() { // tokenize 'return - __LINE__' correctly
         ASSERT_EQUALS("\"test.cpp\"", tokenizeAndStringify("__FILE__"));
         ASSERT_EQUALS("return -1 ;", tokenizeAndStringify("return - __LINE__;"));