[parser] Fix IsValidReferenceExpression

A Property access is only a valid reference expression if the accessed object
is a valid expression.

Bug: v8:8409
Change-Id: I9bc9ac60ca3bf4e261d10af97aba18e9db2085ea
Reviewed-on: https://chromium-review.googlesource.com/c/1317816Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57244}

src/parsing/parser-base.h

@@ -4524,7 +4524,8 @@ ParserBase<Impl>::CheckAndRewriteReferenceExpression(ExpressionT expression,
 
 template <typename Impl>
 bool ParserBase<Impl>::IsValidReferenceExpression(ExpressionT expression) {
-  return IsAssignableIdentifier(expression) || expression->IsProperty();
+  return IsAssignableIdentifier(expression) ||
+         (expression->IsProperty() && classifier()->is_valid_expression());
 }
 
 template <typename Impl>

test/message/regress/fail/regress-8409.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+[().x] = 1

test/message/regress/fail/regress-8409.out

+*%(basename)s:5: SyntaxError: Unexpected token (
+[().x] = 1
+ ^
+SyntaxError: Unexpected token (