[parser] Fix late-checked destructuring pattern followed by property (2)

Now just accumulate right before we might validate a property and once we're
done, so we're guaranteed to catch all PatternErrors.

Bug: v8:8607
Change-Id: Ibc5bc7773756f4827868ca01d0f9fb0c5545e59b
Reviewed-on: https://chromium-review.googlesource.com/c/1382749
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58343}

src/parsing/expression-scope.h

@@ -437,6 +437,7 @@ class AccumulationScope {
 
   ~AccumulationScope() {
     if (scope_ == nullptr) return;
+    Accumulate();
     for (int i = 0; i < kNumberOfErrors; i++) copy_back(i);
   }
 

src/parsing/parser-base.h

@@ -1934,14 +1934,12 @@ typename ParserBase<Impl>::ExpressionT ParserBase<Impl>::ParseArrayLiteral() {
         expression_scope()->RecordPatternError(
             Scanner::Location(start_pos, end_position()),
             MessageTemplate::kInvalidDestructuringTarget);
-        accumulation_scope.Accumulate();
       }
 
       if (peek() == Token::COMMA) {
         expression_scope()->RecordPatternError(
             Scanner::Location(start_pos, end_position()),
             MessageTemplate::kElementAfterRest);
-        accumulation_scope.Accumulate();
       }
     } else {
       AcceptINScope scope(this, true);
@@ -4441,6 +4439,7 @@ template <typename Impl>
 typename ParserBase<Impl>::ExpressionT
 ParserBase<Impl>::ParsePossibleDestructuringSubPattern(
     AccumulationScope* scope) {
+  if (scope) scope->Accumulate();
   int begin = peek_position();
   ExpressionT result = ParseAssignmentExpressionCoverGrammar();
 
@@ -4457,6 +4456,12 @@ ParserBase<Impl>::ParsePossibleDestructuringSubPattern(
             Scanner::Location(begin, end_position()),
             MessageTemplate::kLetInLexicalBinding);
       }
+    } else {
+      DCHECK(result->IsProperty());
+      expression_scope()->RecordDeclarationError(
+          Scanner::Location(begin, end_position()),
+          MessageTemplate::kInvalidPropertyBindingPattern);
+      if (scope != nullptr) scope->ValidateExpression();
     }
   } else if (result->is_parenthesized() ||
              (!result->IsPattern() && !result->IsAssignment())) {
@@ -4465,15 +4470,6 @@ ParserBase<Impl>::ParsePossibleDestructuringSubPattern(
         MessageTemplate::kInvalidDestructuringTarget);
   }
 
-  if (scope == nullptr) return result;
-  if (result->IsProperty()) {
-    expression_scope()->RecordDeclarationError(
-        Scanner::Location(begin, end_position()),
-        MessageTemplate::kInvalidPropertyBindingPattern);
-    scope->ValidateExpression();
-  } else {
-    scope->Accumulate();
-  }
   return result;
 }
 

test/mjsunit/regress/regress-8607.js

@@ -5,3 +5,4 @@
 assertThrows("[({ p: this }), [][0]] = x", SyntaxError);
 assertThrows("[...a, [][0]] = []", SyntaxError);
 assertThrows("[...o=1,[][0]] = []", SyntaxError);
+assertThrows("({x(){},y:[][0]} = {})", SyntaxError);