[parser] Eagerly throw pattern error even if we lazily throw lhs error for calls

We don't eagerly throw for assignments to calls; see v8:4480. They are simply
turned into assignments to Property instead. We need to record a declaration
error, however. Otherwise we'll end up with a Property in a declaration
context.

To reduce the scope of the lazy throwing, in this fix I record a pattern error
instead, making calls as assignment target in a destructuring assignment
context throw eagerly.

Bug: chromium:916288
Change-Id: If94a46b5d2b65c3549c641e0e19135c6c8af7a9a
Reviewed-on: https://chromium-review.googlesource.com/c/1384084Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58357}

src/parsing/parser-base.h

@@ -1175,13 +1175,9 @@ class ParserBase {
   // Checks if the expression is a valid reference expression (e.g., on the
   // left-hand side of assignments). Although ruled out by ECMA as early errors,
   // we allow calls for web compatibility and rewrite them to a runtime throw.
-  V8_INLINE ExpressionT
-  RewriteInvalidReferenceExpression(ExpressionT expression, int beg_pos,
-                                    int end_pos, MessageTemplate message);
-  ExpressionT RewriteInvalidReferenceExpression(ExpressionT expression,
-                                                int beg_pos, int end_pos,
-                                                MessageTemplate message,
-                                                ParseErrorType type);
+  ExpressionT RewriteInvalidReferenceExpression(
+      ExpressionT expression, int beg_pos, int end_pos, MessageTemplate message,
+      ParseErrorType type = kReferenceError);
 
   bool IsValidReferenceExpression(ExpressionT expression);
 
@@ -2900,6 +2896,7 @@ ParserBase<Impl>::ParseUnaryOrPrefixExpression() {
 
   CheckStackOverflow();
 
+  int expression_position = peek_position();
   ExpressionT expression = ParseUnaryExpression();
 
   if (Token::IsUnaryOp(op)) {
@@ -2929,7 +2926,7 @@ ParserBase<Impl>::ParseUnaryOrPrefixExpression() {
 
   if (V8_UNLIKELY(!IsValidReferenceExpression(expression))) {
     expression = RewriteInvalidReferenceExpression(
-        expression, expression->position(), end_position(),
+        expression, expression_position, end_position(),
         MessageTemplate::kInvalidLhsInPrefixOp);
   }
   impl()->MarkExpressionAsAssigned(expression);
@@ -4357,15 +4354,6 @@ typename ParserBase<Impl>::ExpressionT ParserBase<Impl>::ParseTemplateLiteral(
   return impl()->CloseTemplateLiteral(&ts, start, tag);
 }
 
-template <typename Impl>
-typename ParserBase<Impl>::ExpressionT
-ParserBase<Impl>::RewriteInvalidReferenceExpression(ExpressionT expression,
-                                                    int beg_pos, int end_pos,
-                                                    MessageTemplate message) {
-  return RewriteInvalidReferenceExpression(expression, beg_pos, end_pos,
-                                           message, kReferenceError);
-}
-
 template <typename Impl>
 typename ParserBase<Impl>::ExpressionT
 ParserBase<Impl>::RewriteInvalidReferenceExpression(ExpressionT expression,
@@ -4382,6 +4370,9 @@ ParserBase<Impl>::RewriteInvalidReferenceExpression(ExpressionT expression,
     return impl()->FailureExpression();
   }
   if (expression->IsCall() && !expression->AsCall()->is_tagged_template()) {
+    expression_scope()->RecordPatternError(
+        Scanner::Location(beg_pos, end_pos),
+        MessageTemplate::kInvalidDestructuringTarget);
     // If it is a call, make it a runtime error for legacy web compatibility.
     // Bug: https://bugs.chromium.org/p/v8/issues/detail?id=4480
     // Rewrite `expr' to `expr[throw ReferenceError]'.

test/mjsunit/regress/regress-crbug-916288.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows("(a()=0)=>0", SyntaxError)