Fixed crash #6686

lib/tokenize.cpp

@@ -7306,6 +7306,9 @@ void Tokenizer::simplifyNestedStrcat()
             tok2 = tok2->tokAt(2);
         }
 
+        if (tok2->strAt(3) != ",")
+            continue;
+
         // If we have this code:
         //   strcat(strcat(dst, foo), bar);
         // We move this part of code before all strcat() calls: strcat(dst, foo)
@@ -7323,7 +7326,6 @@ void Tokenizer::simplifyNestedStrcat()
         // Insert semicolon after the moved strcat()
         tok->insertToken(";");
     }
-
 }
 
 void Tokenizer::duplicateEnumError(const Token * tok1, const Token * tok2, const std::string & type) const

test/testgarbage.cpp

@@ -77,6 +77,7 @@ private:
         TEST_CASE(garbageCode36); // #6334
         TEST_CASE(garbageCode37); // #5166
         TEST_CASE(garbageCode38); // #6666
+        TEST_CASE(garbageCode39); // #6686
 
         TEST_CASE(garbageValueFlow);
         TEST_CASE(garbageSymbolDatabase);
@@ -450,6 +451,10 @@ private:
         checkCode("{ f2 { } } void f3 () { delete[] } { }");
     }
 
+    void garbageCode39() { // #6686
+        checkCode("({ (); strcat(strcat(() ()) ()) })");
+    }
+
     void garbageValueFlow() {
         // #6089
         const char* code = "{} int foo(struct, x1, struct x2, x3, int, x5, x6, x7)\n"